fix(connection): Make set_config validator replacement transactional

[alexw91]

Goal

Make the x509 validator replacement in s2n_connection_set_config transactional, so a failed init does not leave the connection with a wiped validator.

Why

s2n_connection_set_config wiped the connection's x509_validator before initializing a replacement from the incoming config. If the replacement initialization failed (e.g. X509_STORE_CTX_new returning NULL under OOM, or s2n_x509_validator_set_max_chain_depth rejecting an invalid depth), the function returned an error with the validator already wiped to UNINIT state while conn->config still referenced the previous config. A subsequent handshake attempt on that connection would fail in cert validation.

How

The new validator is built into a stack-local struct s2n_x509_validator. Each fallible step (s2n_x509_validator_init, s2n_x509_validator_set_max_chain_depth) is checked individually. On failure, the local is wiped to avoid leaking any partially-initialized OpenSSL objects, and the error is propagated. The connection's existing validator is untouched. Only after the local is fully initialized is the old validator wiped and replaced via struct assignment.

Callouts

• The verify_host_fn assignment remains inside the else block in the same position relative to the other operations as in the original code. It is not part of the validator and does not need rollback.
• s2n_x509_validator_init can partially populate the struct (e.g. set trust_store, allocate cert_chain_from_wire via sk_X509_new_null()) before failing on X509_STORE_CTX_new. The explicit s2n_x509_validator_wipe(&new_validator) on the init failure path prevents leaking those objects.
• s2n_x509_validator_init_no_x509_validation cannot currently fail (it only does assignments and sk_X509_new_null), but the POSIX_GUARD is retained as a defensive measure.

Testing

Added a regression test in s2n_config_test.c that:

1. Creates a connection with a valid config and verifies the validator is in INIT state.
2. Creates a second config with max_verify_cert_chain_depth set to 0 (invalid) and max_verify_cert_chain_depth_set enabled, which causes s2n_x509_validator_set_max_chain_depth to fail with S2N_ERR_INVALID_ARGUMENT.
3. Calls s2n_connection_set_config with the bad config and asserts it fails.
4. Verifies conn->config still points to the original config.
5. Verifies conn->x509_validator.state is still INIT (not UNINIT).

Related

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.