Check alignment of certificate CRLDPs with the CRLDP of the referring Manifest
RFC 6480, section 4.2, figure 2 illustrates how all valid products in
the same CA repository (i.e., from the same issuer, listed on the same
manifest) will point to the same CRL. For CRLDPs in manifest EE certs
alignment was already checked against the CRL location derived from
the fileList in a given manifest's eContent. Add a check to explicitly
confirm internally consistent CRLDPs in certificates as well.
OK tb@
tls_verify: do not assume ASN1_STRINGs are strings
OpenSSL 4.1 no longer NUL terminates ASN.1 strings. This is fine per se,
but the fact that they don't mention this major breaking change in their
overlong CHANGES.md is crazy. Who reads the migration guide for an update
that's supposedly backward compatible? This will cause buffer overreads
left and right.
To wit, strlen(data) is a buffer overread, so use strnlen() instead.
While it is probably possible to rewrite tls_match_name() to cope with a
bag of bytes, it gets really hairy (I think it is already hairier than
all the yaks in Tibet combined). So use the lazy way and strndup(), then
we have a string and do not need to mess with this horrible byte bashing.
The other caller of tls_match_name() already passes a string.
As jsing points out, CBS_strndup() would be the right way to fix this.
ok kenjiro jsing
rpki-client: do not provide IPAddrBlocks_{new,free}() unconditionally
After sitting on the issue for over four years, a last-minute addition to
OpenSSL 4.1 provided a somewhat incorrect version of IPAddrBlocks_new(),
and versions of IPAddrBlocks_free() ith i2d and d2i and the ASN.1 item.
Until LibreSSL provides the corresponding functions, we need this compat
code in base. After that the rfc3779.c file can move to portable where it
really belongs.
With this the rpki-client code is ready for OpenSSL 4.1, provided it uses
a fixed version of lib(re)tls.
ok claudio
rpki-client: fix valid_uri() to work with non-strings
valid_uri() takes a length parameter and should honor that. Most uris
passed are NUL terminated, but the ones coming from an ASN1_STRING are
not guaranteed to be. Calling strstr() on a non-terminated string with
no match is a buffer overread. So use memmem() instead.
This is needed for rpki-client to work with OpenSSL 4.1, who, in their
infinite disregard for downstreams chose to stop NUL-terminating ASN.1
strings. A massive breaking change in a minor release that will surely
cause lots of buffer overreads. It's also not mentioned in CHANGES.md,
only in their terrible migration guide. Of course it's been documented
since forever, but who reads OpenSSL's crappy documentation anyway?
ok claudio
Add a test, disabled for now, that tests $ORIGIN works when a program
is executed by a search of the PATH. Additional tests are needed for
other cases. okay deraadt@
