openbsd/src/regress/lib/libcrypto/x509, branch OPENBSD_7_2_BASE

Fix the legacy verifier callback behaviour for untrusted certs.

2022-06-28T07:56:34+00:00

The verifier callback is used by mutt to do a form of certificate pinning where the callback gets fired and depending on a cert saved to a file will decide to accept an untrusted cert. This corrects two problems that affected this. The callback was not getting the correct depth and chain for the error where mutt would save the certificate in the first place, and then the callback was not getting fired to allow it to override the failing certificate validation. thanks to Avon Robertson for the report and sthen@ for analysis. "The callback is not an API, it's a gordian knot - tb@" ok jsing@

Fix URI name constraints, allow for URI's with no host part.

2022-06-26T11:29:27+00:00

Such uri's must be parsed and allowed, but then should fail if a name constraint is present. Adds regress testing for this same case. fixes https://github.com/libressl-portable/openbsd/issues/131 ok tb@

Move leaf certificate checks to the last thing after chain validation.

2022-06-25T20:01:43+00:00

While seemingly illogical and not what is done in Go's validator, this mimics OpenSSL's behavior so that callback overrides for the expiry of a certificate will not "sticky" override a failure to build a chain. ok jsing@

Use consistent spacing around assignments

2022-06-02T12:08:41+00:00

Only constraints and verify need static linking in here.

2022-06-02T11:48:36+00:00

Enable X509v3_asid_subset() tests now that they no longer segfault.

2022-05-12T19:58:45+00:00

Add a few more testcases for X509v3_asid_subset()

2022-05-12T10:12:18+00:00

Add some workarounds to make build_addr_block_test_data const.

2022-01-07T22:46:05+00:00

Revert previous accidental commit

2022-01-07T17:17:02+00:00

Add a comment that explains why build_addr_block_tests isn't const

2022-01-06T14:55:52+00:00