openbsd/src/lib/libcrypto/x509, branch libressl-v3.5.1 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v3.5.1 2022-03-13T17:23:02+00:00 Relax the check of x509_constraints_dirname() 2022-03-13T17:23:02+00:00 tb 2022-03-13T17:23:02+00:00 urn:sha1:80a47514c89065d34f61afd4698b0f8182c45d60 The dirname constraint must be a prefix in DER format, so relax the check from requiring equal-length strings to allow shorter names also. From Alex Wilson ok jsing Add x509_constraints_validate() to x509_internal.h 2022-03-13T17:08:04+00:00 tb 2022-03-13T17:08:04+00:00 urn:sha1:cd66e82e3090c8e0b602600f92762eec03e1f998 From Alex Wilson ok jsing Check name constraints using the proper API 2022-03-13T16:48:49+00:00 tb 2022-03-13T16:48:49+00:00 urn:sha1:7bdf8508440bb6ad889ebb6210b36e2e45db8c79 The previous versions were too strict and disallowed leading dots. From Alex Wilson ok jsing style tweak 2022-03-13T16:30:31+00:00 tb 2022-03-13T16:30:31+00:00 urn:sha1:6a05251669a841118ef2afb995c9fdf4ec6f7abf Add missing error check after strdup() 2022-03-13T16:25:58+00:00 tb 2022-03-13T16:25:58+00:00 urn:sha1:eb5306b751b98d33dc4833a353cd77e6e3a9d3ad From Alex Wilson ok jsing Pull a len == 0 check up before malloc(len) to avoid implementation 2022-03-03T11:29:05+00:00 tb 2022-03-03T11:29:05+00:00 urn:sha1:4544eb8a42dcaaf2607c92148dc57fb8caa03aaf defined behavior. ok deraadt inoguchi Unwrap a line 2022-03-02T17:53:03+00:00 tb 2022-03-02T17:53:03+00:00 urn:sha1:e1b11278a865932b9b7f8f0b46d05df1424c98c6 Get rid of SHA1 for comparing CRL's - use SHA512 just like we do for certs. 2022-02-24T22:05:07+00:00 beck 2022-02-24T22:05:07+00:00 urn:sha1:e29735531148d227a52ccd6fa19e0b2cdf8b7b83 ok tb@ Fix length check of IP addresses for name constraints 2022-02-11T17:41:55+00:00 tb 2022-02-11T17:41:55+00:00 urn:sha1:361c0710908fd1b1a377f83b3fd0ba3c3491c6bb An IP address in a name constraint is actually an IP address concatenated with a netmask, so it is twice as long as usual. This fixes a third bug introduced in r1.3 and reported by Volker Schlecht ok jsing Add missing error check for a2i_GENERAL_NAME() 2022-02-11T17:39:36+00:00 tb 2022-02-11T17:39:36+00:00 urn:sha1:911e0aa6f16aba90dc8107a37cd5e01f041fc86a Fixes a segfault reported by Volker Schlecht. ok jsing