openbsd/src/lib/libcrypto/x509, branch libressl-v3.5.0 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v3.5.0 2022-02-11T17:41:55+00:00 Fix length check of IP addresses for name constraints 2022-02-11T17:41:55+00:00 tb 2022-02-11T17:41:55+00:00 urn:sha1:361c0710908fd1b1a377f83b3fd0ba3c3491c6bb An IP address in a name constraint is actually an IP address concatenated with a netmask, so it is twice as long as usual. This fixes a third bug introduced in r1.3 and reported by Volker Schlecht ok jsing Add missing error check for a2i_GENERAL_NAME() 2022-02-11T17:39:36+00:00 tb 2022-02-11T17:39:36+00:00 urn:sha1:911e0aa6f16aba90dc8107a37cd5e01f041fc86a Fixes a segfault reported by Volker Schlecht. ok jsing Fix a double free in v2i_NAME_CONSTRAINTS() 2022-02-11T17:37:54+00:00 tb 2022-02-11T17:37:54+00:00 urn:sha1:3e9423819d5b05b96cf6ad8d411708c75f9afbc5 a2i_GENERAL_NAME() modifies and returns the out argument that was passed in unless out == NULL, in which case it returns something freshly allocated. Thus, in v2i_GENERAL_NAME_ex() we must only free ret if out == NULL so v2i_NAME_CONSTRAINTS() can free correctly. Issue reported by Volker Schlecht ok jsing Remove a strange inheritance check from addr_validate_path_internal() 2022-02-04T16:34:15+00:00 tb 2022-02-04T16:34:15+00:00 urn:sha1:52686057ee5ada84b0783d53915ce779af668aba The trust anchor can't inherit, but the code says that it can inherit just not if the leaf tries to inherit from that. This makes no sense and doesn't match what is done on the asid side. ok jsing X509_GET_PUBKEY(3) return value check in libcrypto 2022-01-22T00:36:46+00:00 inoguchi 2022-01-22T00:36:46+00:00 urn:sha1:87d8a213e0706edea9e5ed31e623bd2fdd019729 CID 345116 ok beck@ tb@ X509_GET_PUBKEY(3) return value check in libcrypto 2022-01-22T00:34:48+00:00 inoguchi 2022-01-22T00:34:48+00:00 urn:sha1:1ac8594c219b822f6c1d88dfb9f304d09eac093d CID 25131 ok beck@ tb@ suggest using X509_REQ_get0_pubkey() and remove the EVP_PKEY_free() from tb@ Remove header guard around RFC 3779 declarations 2022-01-14T09:01:36+00:00 tb 2022-01-14T09:01:36+00:00 urn:sha1:cf5410882fabade6bbe1cfb5e37cbd5e234ff12a ok inoguchi jsing Remove name_cmp from public visibility 2022-01-14T08:50:25+00:00 tb 2022-01-14T08:50:25+00:00 urn:sha1:c24037a46025dcde612ce7f4a281ef94e716677f ok inoguchi jsing Garbage collect the app_items field of ASN1_ADB 2022-01-14T08:16:13+00:00 tb 2022-01-14T08:16:13+00:00 urn:sha1:ec5f7af843436771be5081c868e0fb0b44069ead This is unused and was removed in OpenSSL 5b70372d when it was replaced with an ASN.1 ADB callback (which we don't support). ok inoguchi jsing Remove X509_OBJECT_free_contents 2022-01-14T07:53:45+00:00 tb 2022-01-14T07:53:45+00:00 urn:sha1:6c6569a063047a621353ff519aeaa449af61ada3 Inline X509_OBJECT_free_contents() in X509_OBJECT_free() and remove this dangerous API. It was left over when x509_vfy.h was made opaque. ok inoguchi jsing