openbsd/src/lib/libcrypto/x509, branch libressl-v3.6.2A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=libressl-v3.6.22022-10-20T09:45:18+00:00Store errors that result from leaf certificate verification.2022-10-20T09:45:18+00:00tb2022-10-20T09:45:18+00:00urn:sha1:2e08bcb01b2d496908faf5968f289cda7e088285
In the case that a verification callback is installed that tells the
verifier to continue when a certificate is invalid (e.g. expired),
any error resulting from the leaf certificate verification is not stored
and made available post verification, resulting in an incorrect error being
returned.
Also perform leaf certificate verification prior to adding the chain, which
avoids a potential memory leak (as noted by tb@).
Issue reported by Ilya Shipitsin, who encountered haproxy regress failures.
ok tb@; from jsing
This is errata/7.2/001_x509.patch.sig
Prepare to provide OPENSSL_cleanup.2022-09-03T17:47:47+00:00jsing2022-09-03T17:47:47+00:00urn:sha1:f1083ba41574ef4e529cc2ea4ff2aa685c4833cd
OPENSSL_cleanup() cleans up and deallocates memory in use by the library.
There are a couple of use cases for this, primarily related to memory
leak testing. This will not be called automatically in LibreSSL, which
means that OpenSSL's OPENSSL_NO_INIT_ATEXIT is implied. If code wants to
clean up then they need to explicitly call this themselves.
ok tb@
Switch loop bounds from size_t to int in check_hosts()2022-08-31T07:15:31+00:00tb2022-08-31T07:15:31+00:00urn:sha1:d232bd6af93b87abffb31bf680b072890c17f61d
sk_num() can return a negative value, in which case the upper bound is
SIZE_MAX, which results in a very long for loop.
CID 153997
ok jsing
Allow empty attribute sets in CSRs2022-08-18T16:26:33+00:00tb2022-08-18T16:26:33+00:00urn:sha1:8be3e003ec0a654c1538dbd8f7e6d9d965b2e7dc
While each attribute must contain at least one extension, it is not
required that a CSR have attributes at all. Instead of signalling an
error by returning NULL if no extensions are found, return an empty
stack of extensions.
Via OpenSSL 1f02ca2d
ok jsing
Add missing RCS tag and zap a trailing space2022-08-15T11:52:37+00:00tb2022-08-15T11:52:37+00:00urn:sha1:726478d55d7f47f50feb22b91bfcb268950310acRemove overly aggressive trust check in legacy verifier that breaks2022-08-05T14:46:52+00:00beck2022-08-05T14:46:52+00:00urn:sha1:33f7a389689c3cc4d7351bfe5ea8496ca7927169
p5-IO-Socket-SSL regress and regress/sbin/iked/live
Still passes the mutt regress that this was intended to fix.
ok tb@
Untangle two logic chains in x509_asid.c into something more readable.2022-07-30T17:50:17+00:00tb2022-07-30T17:50:17+00:00urn:sha1:7004c9ad3ae411f3be9a9af2eb33a5cb6c0fc7d7
ok jsing
Plug leak in X509V3_add1_i2d()2022-07-24T21:41:29+00:00tb2022-07-24T21:41:29+00:00urn:sha1:eedf40d421c29b605c6fd42b96245296f46aafc4
Do not leak the extension that was deleted from the stack.
via OpenSSL c3efe5c9.
ok jsing
Remove mkerr.pl remnants from LibreSSL2022-07-12T14:42:50+00:00kn2022-07-12T14:42:50+00:00urn:sha1:89e42d5857196a8071fbafb5565388d0e20ec32b
This script is not used at all and files are edited by hand instead.
Thus remove misleading comments incl. the obsolete script/config.
Feedback OK jsing tb
Expose new API in headers.2022-07-07T13:01:28+00:00tb2022-07-07T13:01:28+00:00urn:sha1:7986c6c16406e5ad9f53a49107428df9f9fd70c1
These are mostly security-level related, but there are also ASN1_TIME
and ASN_INTEGER functions here, as well as some missing accessors.
ok jsing