openbsd/src/lib/libcrypto/x509, branch OPENBSD_7_1_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_1_BASE2022-03-26T16:34:21+00:00name constraints: be more careful with NULs2022-03-26T16:34:21+00:00tb2022-03-26T16:34:21+00:00urn:sha1:ac8744d51889c42d26769c65c226f6a4ab45da5e
An IA5STRING is a Pascal string that can have embedded NULs and is
not NUL terminated (except that for legacy reasons it happens to be).
Instead of taking the strlen(), use the already known ASN.1 length and
use strndup() instead of strdup() to generate NUL terminated strings
after some existing code has checked that there are no embedded NULs.
In v2i_GENERAL_NAME_ex() use %.*s to print the bytes. This is not
optimal and might be switched to using strvis() later.
ok beck inoguchi jsing
Make gcc 4 happier about x509_addr.c2022-03-16T11:44:36+00:00tb2022-03-16T11:44:36+00:00urn:sha1:295526693f6a6e844f3d22eebc8f50fdf9fedf49
gcc 4 on sparc64 issues a few 'warning: value computed is not used'.
There are two cases: sk_set_cmp_function() returns the old comparison
function of the stack which we don't care about. The one warning about
an sk_delete() is about a return value that we know already and which
we will free a few lines down.
ok inoguchi miod
Allow constraints of the form @domain.com2022-03-14T21:29:46+00:00tb2022-03-14T21:29:46+00:00urn:sha1:2189fd34b7b61fc89bd474d85ac954a2fb1b6d71
Some things issue and expect that we support a non-standard extension of
accepting any email address from a host by prefixing an email name
constraint with @. This used to be the case with the old code as well.
Pointed out and based on a diff by Alex Wilson.
ok jsing
Rework ownership handling in x509_constraints_validate()2022-03-14T21:15:49+00:00tb2022-03-14T21:15:49+00:00urn:sha1:cdd92616160505c509e5c7f6736fcbaadcdd9afc
Instead of having the caller allocate and pass in a new
x509_constraints_name struct, handle allocation inside
x509_constraints_validate(). Also make the error optional.
All this is done to simplify the call sites and to make it
more obvious that there are no leaks.
ok jsing
Relax the check of x509_constraints_dirname()2022-03-13T17:23:02+00:00tb2022-03-13T17:23:02+00:00urn:sha1:80a47514c89065d34f61afd4698b0f8182c45d60
The dirname constraint must be a prefix in DER format, so relax the
check from requiring equal-length strings to allow shorter names also.
From Alex Wilson
ok jsing
Add x509_constraints_validate() to x509_internal.h2022-03-13T17:08:04+00:00tb2022-03-13T17:08:04+00:00urn:sha1:cd66e82e3090c8e0b602600f92762eec03e1f998
From Alex Wilson
ok jsing
Check name constraints using the proper API2022-03-13T16:48:49+00:00tb2022-03-13T16:48:49+00:00urn:sha1:7bdf8508440bb6ad889ebb6210b36e2e45db8c79
The previous versions were too strict and disallowed leading dots.
From Alex Wilson
ok jsing
style tweak2022-03-13T16:30:31+00:00tb2022-03-13T16:30:31+00:00urn:sha1:6a05251669a841118ef2afb995c9fdf4ec6f7abfAdd missing error check after strdup()2022-03-13T16:25:58+00:00tb2022-03-13T16:25:58+00:00urn:sha1:eb5306b751b98d33dc4833a353cd77e6e3a9d3ad
From Alex Wilson
ok jsing
Pull a len == 0 check up before malloc(len) to avoid implementation2022-03-03T11:29:05+00:00tb2022-03-03T11:29:05+00:00urn:sha1:4544eb8a42dcaaf2607c92148dc57fb8caa03aaf
defined behavior.
ok deraadt inoguchi