[musthaf-bughunter]

Description

CertTree chains certificates on issuer/subject matching and signature validity only (cert.py#L1806), and CertTree.verify checks the validity period and the hostname but never basicConstraints (cert.py#L1845-L1884). Any CA:FALSE certificate issued by a trusted CA can sign a certificate for another name, and the result verifies. With TLSClientAutomaton(verify_server=True) / cafile, a MitM holding a certificate from the trusted CA for its own name passes the chain and hostname checks; CMS_Engine.verify (Kerberos PKINIT) is affected the same way.

Repro with the test PKI (srv_cert.pem is CA:FALSE):

ca = Cert("ca_cert.pem")
srv = Cert("srv_cert.pem")
forged = Cert("srv_cert.pem")
forged.x509Cert.tbsCertificate.issuer = srv.x509Cert.tbsCertificate.subject
forged.x509Cert.tbsCertificate.subject[-1].rdn[0].value = ASN1_PRINTABLE_STRING(b"victim.example")
forged.setSubjectPublicKeyFromPrivateKey(PrivKeyECDSA())
forged = Cert(PrivKey("srv_key.pem").resignCert(forged))
CertTree([forged, srv], ca).verify(forged, hostname="victim.example", now=(2025, 1, 1, 0, 0, 0, 2, 1, 0))
# no exception

verify now rejects a chain that goes through a certificate without cA, and enforces pathLenConstraint (RFC 5280 sect 6.1.4). The trust anchor is not checked, so a non-CA certificate can still be pinned. Tests added to cert.uts.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.56%. Comparing base (56ba487) to head (9e568c0).
⚠️ Report is 15 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5255   +/-   ##
=======================================
  Coverage   80.55%   80.56%           
=======================================
  Files         375      375           
  Lines       98399    98498   +99     
=======================================
+ Hits        79263    79352   +89     
- Misses      19136    19146   +10     

Files with missing lines	Coverage Δ
scapy/layers/tls/cert.py	77.75% <100.00%> (+0.15%)	⬆️

... and 12 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.