openbsd/src/regress/lib/libcrypto/x509, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-09-21T06:04:53+00:00 move a misplaced 'goto done;' so that all invalid uris are tested 2020-09-21T06:04:53+00:00 tb 2020-09-21T06:04:53+00:00 urn:sha1:2ea91b696c5a52d526d7d3861c1e2d277c29a259 add a few short invalid URIs in test_constraints1() that cause early 2020-09-21T06:01:44+00:00 tb 2020-09-21T06:01:44+00:00 urn:sha1:87cd7ec5a926d4c4d683a29035a09e2f1c99c909 failure of x509_constraints_uri_host() in x509_constraints_uri() Correct a 1 byte read overflow in x509_contraints_uri and add 2020-09-20T18:22:31+00:00 beck 2020-09-20T18:22:31+00:00 urn:sha1:407345d49b1ca886ab4bc7e429c61fb07a7eb964 regress to catch it in the future. found by Guido Vranken's cryptofuzzer ok tb@ Move variable declaration to beginning of scope in order to make this 2020-09-18T15:23:16+00:00 tb 2020-09-18T15:23:16+00:00 urn:sha1:2a9053dfe715672038b7806c86b04635349a313d test compile and pass on sparc64. make this test compile and pass on sparc64 by moving variable declarations 2020-09-18T14:58:04+00:00 tb 2020-09-18T14:58:04+00:00 urn:sha1:f456e9137f38b887c0b9e36a76154db563b2e6ef to the beginning of the respective scopes (and out of for loops) move variable declaration up to top to make this compile and pass 2020-09-18T14:50:34+00:00 tb 2020-09-18T14:50:34+00:00 urn:sha1:280409082e121bf79a83a1567cf57c10f01acfc6 on sparc64 Use void function argument to appease gcc 4.2.1 2020-09-18T14:48:38+00:00 tb 2020-09-18T14:48:38+00:00 urn:sha1:8fc2ec9f3b890d255c071df8ab66b6fc83f14016 Change the known output to be the expected output, so that we 2020-09-14T10:34:11+00:00 beck 2020-09-14T10:34:11+00:00 urn:sha1:9281dd4caa01bf6f12f6b3e892adb9816992c872 no longer ignore the expected failures from the legacy name constraints validation, and will have a regress failure if we regress. Use a fixed validation time in these tests so we never 2020-09-14T09:59:58+00:00 beck 2020-09-14T09:59:58+00:00 urn:sha1:8b543e69b0bd5dd28c7402a7d4819b96caf8caa1 have to re-generate these certificates and this should just keep working even if the certs get old Add new x509 certificate chain validator in x509_verify.c 2020-09-13T15:06:17+00:00 beck 2020-09-13T15:06:17+00:00 urn:sha1:0a0ab802381c0d9f772240ce6370d981bc30962c The new validator finds multiple validated chains to handle the modern PKI cases which may frequently have multiple paths via different intermediates to different roots. It is loosely based on golang's x509 validator This includes integration so that the new validator can be used via X509_verify_cert() as well as a new api x509_verify() which will return multiple chains (similar to go). The new validator is not enabled by default with this commit, this will be changed in a follow on commit. The new public API is not yet exposed, and will be finalized and exposed with a man page and a library minor bump later. ok tb@ inoguchi@ jsing@