From 7055fe86b576de9465d4d61dd913ff7f30e53e46 Mon Sep 17 00:00:00 2001
From: Benjy Weinberger <benjyw@gmail.com>
Date: Fri, 7 May 2021 10:16:43 -0700
Subject: [PATCH] Demonstrate an issue with a cert rewritten by SSL inspection.

---
 tests/integration.rs     |  15 +++++++++++++++
 tests/rewritten_cert.der | Bin 0 -> 1288 bytes
 2 files changed, 15 insertions(+)
 create mode 100644 tests/rewritten_cert.der

diff --git a/tests/integration.rs b/tests/integration.rs
index 598641d3..f3adc124 100644
--- a/tests/integration.rs
+++ b/tests/integration.rs
@@ -53,6 +53,21 @@ pub fn netflix() {
     );
 }
 
+#[test]
+pub fn rewritten_cert() {
+    // This cert is a rewritten version of github.com's end entity cert, generated by an
+    // SSL inspection system (https://www.forcepoint.com/product/ngfw-next-generation-firewall).
+    // We believe the cert should be considered valid:
+    //   - It can be parsed by OpenSSL, e.g., these both work:
+    //     `openssl x509  -inform der -in tests/rewritten_cert.der -text -noout`
+    //     `openssl asn1parse -i -inform der -in tests/rewritten_cert.der`
+    //   - It's generated by a robust real-world system that works in practice...
+    // We encountered an issue where rustls cannot handle this rewritten cert. We traced this
+    // back to webpki, and specifically to the code exercised by this test.
+    let ee: &[u8] = include_bytes!("rewritten_cert.der");
+    webpki::EndEntityCert::try_from(ee).unwrap();
+}
+
 #[test]
 pub fn ed25519() {
     let ee: &[u8] = include_bytes!("ed25519/ee.der");
diff --git a/tests/rewritten_cert.der b/tests/rewritten_cert.der
new file mode 100644
index 0000000000000000000000000000000000000000..7d0cd40c2633a24c8ff0d19302f65b50c1b5c53c
GIT binary patch
literal 1288
zcmXqLVr4OCVt%uLnTe5!N#KB;s(IV*V2x$gD|zc?W``K?vT<s)d9;1!Wn|=LWiZG#
z<Tl`BV-96u6J`nxHncIY0&%#6jlJ?S@`@Ea@(Z#vfplnIW?5=cab`)Sf@48JPG)L~
zLO@1kab|L{f=^;neo<mceo>{NoPi8TH?y#)mq(~$fR93Ou#bXgUU5Nca!F=>o`IY=
zuaTjFv5~0(7(@ZNMh3>l21drFmZp|b25G2{5jGG68OI^a<(!z4nU-IamziiNW*`C*
zWEbWQPRvtqD@x2u&MZ#OHxxAxhPa%^J+s84G)V_&ak8Ev)C^`}uJp{3jM5~%<osNN
zCPpRXaA0I*U~XdMX8?+GF*PwVGAv+u+v50e(qe9oB96`rMSRLy=fB2We(&&nnaoLf
zQ}ydHWsm=DFqz*p@$)oBu2cH|&Klg4W~x$-wtxAZMLXw?&%!D8n=hrUx9xs%jORgx
z+#fdYs-QJ@F1i2Qyz-FRMQ`=U&FbHb_Fg}-KV)Xy&6Ar$lOmia-CY|V-8S<~f4$=O
zJNA7Sml-rjnY3Q3xu}%Ma^?2ZT?bhAE4-?X>Ae5*()JlM`y-qEE?#nsGC0~Ve%t7p
z!5l4%8Aflp9r#oom^t@ee){3uf-7%=Z}iTYpc#3<|1!trnP#cdw@U8)3I6k<%2e>B
zv*T)Y>o>yZzFWtBv<*&rwP4C-)jwO4y47Faxy-Yunu(c_fpKvY<8ok#EH+RDhO4X~
z3ovq<kOHxZue`im4=GUjK+5<T8UM4eFf%c)07r+cDhrPR7aNB*8zU<#J2RsJ4@i+P
zND-3(gMmDVr_3T@Al4uvRibiNd1d`Y!DFs}0-tC6y25yOzkw`B0UwJPi%9GFwT|7V
zKPA*0?0L*}rKiGu>k<y2>sZ;ifM&BWUaMqcVPa|g#?tti;UhyCgJ$Kv5A!T76+eU(
z&re=j{&Zh>?VJRzA3uF#)nZg*kGC)|Fji#k-z&wyz{1SnZs5wK$T06&hfDn*6W2LL
zzVla4X=7V=H(B@5*ZAb=Ze83<EpJ?BQt${-zj(}O>;A^_>#s#K)_gkg?j++{`7<Uw
z?@kI7xy*=UC}&V|b!CqXRSBDBzfk|<_uRGz%4*4L4|vzd9&3)td&JKKwbv4CuZMvf
z(B2sgLSCGX66@JwG~UbYzSo*lAF=ZCy=j}ovStdb)BltSRC4#|kF|S0WNbLSx?#tM
zD=UK14W2LlVEuF3Zq5tKw*5OLi=3E&nHrdw85v?^^4gOPR;;VJtNQGvx|_|@KNs##
zyZG<*pN%JansNh-PAnI#oT7KIZz+RXtn{iYEbsoF7hI^fYJRO?@Zz3}9&=o}(-LOr
zzH^-;w$s@3ws#EUmw@WFmH&cetu?|X{G6F#cVM2?-C~w~FNKabdB=9A$X~5UElSz+
z@Dt;|Y>!tqGk<=}HI3s5Jh3}gp({Zt?QYA?-N9nN%{ENxIaRx=-26p+i^k$5f2XNb
zBtE!h`};<)@rISwQXPUWcltIw6g`*wQQ@EMlXsk#zG*(+%wVh+;(J&B;qSJxm(O-h
s%1zSV?``;v{pj2!oS$}HUh#DoUxbQ_tHOs;_k+5*OBhT;gn3!x0ly~o{{R30

literal 0
HcmV?d00001