Add more name constraint tests.
We have coverage already in the betterTLS stuff for much of the
basics, but it does not cover email name constraints and some
of the other corner cases.
Cover a permitted subject email address, a hostname CN checked when
the SAN carries only an email address, excluded DNS and email
subtrees, and constraints carried by the trust anchor
ok tb@ joshua@
Allow wildcards to be specified in alternate names in the configuration
file. This does not enable issuance of wildcard certificates except in
limited circumstances where the ACME server does not require any challenges,
such as when you've already validated control of the domain name with your
CA and you're using an EAB key provided by the CA to link that to an
ACME account.
ok tb@, "fine by me" florian@
Search the whole subject for email addresses and common names.
The subject lookups started from the index left over from walking
the subjectAltName, so a leaf without a SAN never had its first two
subject entries examined and an emailAddress there escaped the
name constraints check.
Reported by Sina Gogani Khiabani.
ok tb@ joshua@
Use getexecpath in hl_sys_exe_path, a function which so far has been
failing silently.
Also remove the patch to rename pthread_setname_np to
pthread_set_name_np as we have an alias defined for this.
Enable 64 bit DMA for bge(4) BCM5720.
The DMA engines of various bge(4) hardware is full of bugs. Only
the latest revsion BCM5720 is common and it works with 64 bit DMA
addresses. Enable mbufs in the 64 bit address space only for that
model.
OK deraadt@ kettenis@ jmatthew@
Workaround a race with gcr-prompter: goa-daemon asks for a secret early enough
that the name is still unowned; dbus then activates gcr-prompter, which serves
the prompt as a plain GTK dialog (instead of +gnome-shell dialog).
Cache the leaf's extensions before adding it to the chain.
A freshly parsed leaf has no cached subjectAltName when its names are
collected for the name constraints check
Fixes https://github.com/libressl/portable/issues/1299
Change-Id: I0f155e08f5581ec1509138a96df34db29e9c46a1
Use getexecpath(3) in mono where it otherwise does readlink(2) on
/proc/self/exe. This corrects code paths that previously failed
silently or may not be commonly used.
"go ahead" from robert@
