summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509/x509_addr.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Check for trailing garbage in X509_addr_get_afi()tb2021-12-281-1/+5
| | | | | | | | | | | | Per RFC 3779 2.2.3.3, the addressFamily field contains the 2-byte AFI and an optional 1-byte SAFI. Nothing else. The optional SAFI is nowhere exposed in the API. It is used expliclty only for pretty printing. There are implicit uses in a few places, notably for sorting/comparing where trailing garbage would be erroneously taken into account. Erroring in this situation will let us avoid this in upcoming revisions. ok inoguchi jsing
* Convert X509v3_adr_get_afi() to CBStb2021-12-281-6/+21
| | | | | | | | | | | The manual byte bashing is performed more safely using this API which would have avoided the out-of-bounds read that this API had until a few years back. The API is somewhat strange in that it uses the reserved AFI 0 as an in-band error but it doesn't care about the reserved AFI 65535. ok inoguchi jsing
* Fix some weird line wrapping and a minor KNF nittb2021-12-251-10/+6
|
* drop a meaningless XXXtb2021-12-251-2/+1
|
* Use C99 initializers for v3_addr, v3_asid and v3_ct_scts[]tb2021-12-251-12/+15
| | | | | | as is done for most other X.509 v3 extension methods. discussed with jsing
* Fix a typo in a comment and add some empty lines for readabilitytb2021-12-241-2/+6
|
* Remove asserts from addr_validate_path_internal()tb2021-12-241-9/+19
| | | | | | | | | | This is reachable from x509_verify(), but all asserts are previously checked in the caller. Turn them into error checks and make sure the error is set on the X509_STORE_CTX if present. Change some stack == NULL || sk_num(stack) == 0 checks into sk_num(stack) <= 0 which is equivalent but simpler. ok jsing
* Turn assert in X509v3_addr_canonize() into an error check.tb2021-12-241-3/+5
| | | | | | | All internal callers check the return value and future external callers will be happy not to hit an assert from the library. ok jsing
* Fully check the second strtoul() call in v2i_IPAddrBlocks()tb2021-12-231-3/+34
| | | | | | | | | This can read a value in an arbitrary base from a string that is supposed to be followed by whitespace or a colon, so it cannot be switched to strtonum(). The current checks don't allow a read past the end, but let's use the standard idiom instead. ok jsing
* Fix an arbitrary out-of-bounds stack read in v2i_IPAddrBlocks()tb2021-12-231-3/+7
| | | | | | | | | | | | | | | | | | | | | | | Switch an insufficiently checked strtoul() to strtonum(). This can be used to trigger a read of a user-controlled size from the stack. $ openssl req -new -addext 'sbgp-ipAddrBlock = IPv4:192.0.2.0/12341234' Segmentation fault (core dumped) The bogus prefix length 12341234 is fed into X509v3_addr_add_prefix() and used to read (prefixlen + 7) / 8 bytes from the stack variable 'min[16]' that ends up as 'data' in the memmove in ASN1_STRING_set(). The full fix will add length checks to X509v3_addr_add_prefix() and make_addressPrefix() and will be dealt with later. The entire X509v3_{addr,asid}_* API will need a thorough review before it can be exposed. This code is only enabled in -current and can only be reached from openssl.cnf files that contain sbgp-ipAddrBlock or from the openssl(1) command line. ok jsing
* Reinstate the licenses that were replaced with a license stubtb2021-12-181-6/+54
| | | | in OpenSSL commit d2e9e320.
* Move the now internal X.509-related structs into x509_lcl.h.tb2021-11-011-1/+3
| | | | | | | | Garbage collect the now unused LIBRESSL_CRYPTO_INTERNAL and LIBRESSL_OPAQUE_X509. Include "x509_lcl.h" where needed and fix a couple of unnecessary reacharounds. ok jsing
* Add missing RCS markerstb2021-10-251-0/+1
|
* Zap two unused includesjca2021-10-251-2/+0
| | | | Spotted by egcc. ok tb@
* Replace bare ; with continue;job2021-09-081-7/+7
| | | | OK tb@
* Fix indentation of comments and labelsjob2021-09-081-80/+82
| | | | OK tb@
* Replace (&(x)) pattern with &xjob2021-09-071-16/+16
| | | | | | No functional changes. OK tb@
* KNFjob2021-09-071-903/+941
| | | | OK tb@ jsing@ beck@
* Repair unrolling of static ASN1_ITEM IPAddrBlocks_itjob2021-09-021-0/+11
| | | | | | The conversion tool didn't handle 'static_ASN1_ITEM_TEMPLATE_END' OK tb@
* Add err.h for X509error() and friendsjob2021-09-021-0/+1
| | | | OK tb@
* Fix OPENSSL_assert() and assert()job2021-09-021-9/+4
| | | | OK tb@
* Unroll ASN1_EX_TEMPLATE_TYPE IPAddrBlocksjob2021-09-021-4/+7
| | | | OK tb@
* Change the OPENSSL_strdup() to strdup()job2021-09-021-3/+4
| | | | OK beck@ tb@
* Fix header file includesjob2021-09-021-3/+3
| | | | OK tb@
* Move the error put functions from X509V3err() to X509V3error()job2021-09-021-23/+15
| | | | OK tb@
* Unroll ASN1_SEQUENCE() ASN1_CHOICE() ASN1_ITEM_TEMPLATE()job2021-09-021-24/+112
| | | | OK jsing@
* Replace ossl_assert()/assert() with OPENSSL_assert()job2021-09-021-4/+4
| | | | OK tb@
* Replace OPENSSL_free() with free()job2021-09-021-3/+3
| | | | OK tb@
* Unroll IMPLEMENT_ASN1_FUNCTIONS()job2021-09-021-4/+99
| | | | OK jsing@
* Lay groundwork to support X.509 v3 extensions for IP Addresses and AS ↵job2021-09-021-0/+1315
Identifiers These extensions are defined in RFC 3779 and used in the RPKI (RFC 6482, RFC 8360). Imported from OpenSSL 1.1.1j (aaf2fcb575cdf6491b98ab4829abf78a3dec8402b8b81efc8f23c00d443981bf) This changeset is a no-op, as there are 10+ issues and at least 2 security issues. Work will continue in-tree. OK tb@, discussed with beck@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-29 19:11:09 +0000