Allow IP addresses to be specified in a URI.

Our checking here was a bit too aggressive, and did not permit an
IP address in a URI. IP's in a URI are allowed for things like CRLdp's
AIA, SAN URI's e

Allow IP addresses to be specified in a URI.

Our checking here was a bit too aggressive, and did not permit an
IP address in a URI. IP's in a URI are allowed for things like CRLdp's
AIA, SAN URI's etc.). The check for this was also slightly flawed as
we would permit an IP if memory allocation failed while checking for
an IP.

Correct both issues.

ok tb@

show more ...

spelling fixes; from paul tagliamonte
i removed the arithmetics -> arithmetic changes, as i felt they
were not clearly correct

ok tb

Fix NULL dereference in x509_constraints_uri_host()

When called from v2i, hostpart in x509_constraints_uri_host() is NULL, so
add a NULL check before storing the strdup result in it.

From Anton Bor

Fix NULL dereference in x509_constraints_uri_host()

When called from v2i, hostpart in x509_constraints_uri_host() is NULL, so
add a NULL check before storing the strdup result in it.

From Anton Borowka

ok jsing miod

show more ...

Start CBS-ifying the name constraints code.

ok jsing@ tb@

Correct misleading comment for URI parsing

ok jsing@

Fix URI name constraints, allow for URI's with no host part.

Such uri's must be parsed and allowed, but then should
fail if a name constraint is present.

Adds regress testing for this same case.

f

Fix URI name constraints, allow for URI's with no host part.

Such uri's must be parsed and allowed, but then should
fail if a name constraint is present.

Adds regress testing for this same case.

fixes https://github.com/libressl-portable/openbsd/issues/131

ok tb@

show more ...

name constraints: be more careful with NULs

An IA5STRING is a Pascal string that can have embedded NULs and is
not NUL terminated (except that for legacy reasons it happens to be).

Instead of takin

name constraints: be more careful with NULs

An IA5STRING is a Pascal string that can have embedded NULs and is
not NUL terminated (except that for legacy reasons it happens to be).

Instead of taking the strlen(), use the already known ASN.1 length and
use strndup() instead of strdup() to generate NUL terminated strings
after some existing code has checked that there are no embedded NULs.

In v2i_GENERAL_NAME_ex() use %.*s to print the bytes. This is not
optimal and might be switched to using strvis() later.

ok beck inoguchi jsing

show more ...

Allow constraints of the form @domain.com

Some things issue and expect that we support a non-standard extension of
accepting any email address from a host by prefixing an email name
constraint with

Allow constraints of the form @domain.com

Some things issue and expect that we support a non-standard extension of
accepting any email address from a host by prefixing an email name
constraint with @. This used to be the case with the old code as well.

Pointed out and based on a diff by Alex Wilson.

ok jsing

show more ...

Rework ownership handling in x509_constraints_validate()

Instead of having the caller allocate and pass in a new
x509_constraints_name struct, handle allocation inside
x509_constraints_validate(). A

Rework ownership handling in x509_constraints_validate()

Instead of having the caller allocate and pass in a new
x509_constraints_name struct, handle allocation inside
x509_constraints_validate(). Also make the error optional.
All this is done to simplify the call sites and to make it
more obvious that there are no leaks.

ok jsing

show more ...

Relax the check of x509_constraints_dirname()

The dirname constraint must be a prefix in DER format, so relax the
check from requiring equal-length strings to allow shorter names also.

From Alex Wi

Relax the check of x509_constraints_dirname()

The dirname constraint must be a prefix in DER format, so relax the
check from requiring equal-length strings to allow shorter names also.

From Alex Wilson

ok jsing

show more ...

Add missing error check after strdup()

From Alex Wilson

ok jsing

Pull a len == 0 check up before malloc(len) to avoid implementation
defined behavior.

ok deraadt inoguchi

Unwrap a line

zap doubled semicolon

Validate Subject Alternate Names when they are being added to certificates.

With this change we will reject adding SAN DNS, EMAIL, and IP addresses
that are malformed at certificate creation time.

Validate Subject Alternate Names when they are being added to certificates.

With this change we will reject adding SAN DNS, EMAIL, and IP addresses
that are malformed at certificate creation time.

ok jsing@ tb@

show more ...

Avoid a potential overread in x509_constraints_parse_mailbox()

The length checks need to be >= rather than > in order to ensure the string
remains NUL terminated. While here consistently check wi be

Avoid a potential overread in x509_constraints_parse_mailbox()

The length checks need to be >= rather than > in order to ensure the string
remains NUL terminated. While here consistently check wi before using it
so we have the same idiom throughout this function.

Issue reported by GoldBinocle on GitHub.

ok deraadt@ tb@

show more ...

Relax SAN DNSname validation and constraints to permit non leading *
wildcards. While we may choose not to support them the standards
appear to permit them optionally so we can't declare a certificat

Relax SAN DNSname validation and constraints to permit non leading *
wildcards. While we may choose not to support them the standards
appear to permit them optionally so we can't declare a certificate
containing them invalid. Noticed by jeremy@, and Steffan Ulrich
and others. Modify the regression tests to test these cases and
not check the SAN DNSnames as "hostnames" anymore (which don't support
wildcards).

ok jsing@, tb@

show more ...

Zap a useless variable.

suggested by jsing

Missing void in function definition

ok jsing

Fix checks of memory caps of constraints names

x509_internal.h defines caps on the number of name constraints and
other names (such as subjectAltNames) that we want to allocate per
cert chain. These

Fix checks of memory caps of constraints names

x509_internal.h defines caps on the number of name constraints and
other names (such as subjectAltNames) that we want to allocate per
cert chain. These limits are checked too late. In a particularly
silly cert that jan found on ugos.ugm.ac.id 443, we ended up
allocating six times 2048 x509_constraint_name structures before
deciding that these are more than 512.

Fix this by adding a names_max member to x509_constraints_names which
is set on allocation against which each addition of a name is checked.

cluebat/ok jsing
ok inoguchi on earlier version

show more ...

Avoid undefined behavior due to memcpy(NULL, NULL, 0)

This happens if name->der_len == 0. Since we already have a length
check, we can malloc and memcpy inside the conditional. This also
makes the

Avoid undefined behavior due to memcpy(NULL, NULL, 0)

This happens if name->der_len == 0. Since we already have a length
check, we can malloc and memcpy inside the conditional. This also
makes the code easier to read.

agreement from millert
ok jsing

show more ...

KNF (whitespace)

Fix some line wrapping and other whitespace issues.
No change in the generated assembly on amd64.

Move freeing and zeroing up to right after the while loop.

Requested by jsing

Avoid memleak caused by shadowing

The outer scope in x509_constraints_extract_names() contains a vname
variable which will be freed on error, but an inner scope contains
another vname that won't be

Avoid memleak caused by shadowing

The outer scope in x509_constraints_extract_names() contains a vname
variable which will be freed on error, but an inner scope contains
another vname that won't be freed, e.g., if x509_constraints_names_add
fails.

Found by llvm scan-build.

ok beck

show more ...