when creating a peer out of a pool spec ("servers" in cfg), copy
"trusted" just like weight and everything else
openntpd-portable commit fd6d7d0 by bcook@
Save the rpkiNotify URI itself in the repository's RRDP state file
Providing this mapping makes introspection & comparison of RRDP states
across different instances easier.
OK tb@
Add a point at infinity check to ecdh_compute_key()
While we already check that the peer's public point is on the curve and
will reject the point at infinity when getting the affine coordinates,
doing this earlier avoids doing work with the private key in a clearly
invalid case.
Suggested by Lucca Hirschi et al.
[An EC_KEY_check_key() call was also suggested but this is a bit expensive
and punishes callers that do that or equivalent already (e.g. ssh)]
ok jsing kenjiro
ssl_kex: ensure the public key uses uncompressed encoding
EC_POINT_oct2point() does most of the validation we need it to do, but it
has to accept the point at infinity, compressed and hybrid encodings for
historic reasons. So exclude these cases: the point at infinity makes no
sense here and will be caught later in ECDH_compute_key(), the compressed
and hybrid encodings MUST NOT be supported per RFC 8422 section 5.1.2.
This is implemented using the strategy already used in ec_convert.c since
the point_conversion_form_t is completely unfit for anything.
Set decode_error to ensure we send that alert. We may make some effort to
use illegal_parameter later.
Issue about the missing alert and the point at infinity raised by Lucca
Hirschi et al.
ok jsing kenjiro
