kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
e833a6dfa2
boringssl/crypto
History
Adam Langley 8bd1d07535 Require basicConstraints cA flag in intermediate certs. 
OpenSSL 1.0.2 (and thus BoringSSL) accepts keyUsage certSign or a
Netscape CA certificate-type in lieu of basicConstraints in an
intermediate certificate (unless X509_V_FLAG_X509_STRICT) is set.

Update-Note: This change tightens the code so that basicConstraints is required for intermediate certificates when verifying chains. This was previously only enabled if X509_V_FLAG_X509_STRICT was set, but that flag also has other effects.

Change-Id: I9e41f4c567084cf30ed08f015a744959982940af
Reviewed-on: https://boringssl-review.googlesource.com/30185
Reviewed-by: Matt Braithwaite <mab@google.com>
2018-08-01 19:10:19 +00:00
..
asn1 Use new encoding functions in ASN1_mbstring_ncopy. 2018-05-11 21:58:47 +00:00
base64 Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
bio Remove files from Trusty which can't link because of Trusty libc. 2018-04-19 19:06:58 +00:00
bn_extra Rename bn->top to bn->width. 2018-02-05 23:44:24 +00:00
buf Always process handshake records in full. 2017-10-17 14:53:11 +00:00
bytestring Properly advance the CBS when parsing BER structures. 2018-06-26 07:23:10 +00:00
chacha Sync up some perlasm license headers and easy fixes. 2018-02-11 01:00:35 +00:00
cipher_extra Remove more remnants of SSLv3. 2018-07-17 20:02:35 +00:00
cmac Support 3DES-CMAC. 2018-05-15 22:23:26 +00:00
conf Add more compatibility symbols for Node. 2017-11-03 01:31:50 +00:00
curve25519 Rename third_party/wycheproof to satisfy a bureaucrat. 2018-05-07 18:33:50 +00:00
dh Fx DH_set0_pqg. 2017-10-05 18:50:48 +00:00
digest_extra Add SHA256_TransformBlocks. 2018-04-25 17:51:50 +00:00
dsa Fix some timing leaks in the DSA code. 2018-06-15 02:37:45 +00:00
ec_extra Store EC_KEY's private key as an EC_SCALAR. 2018-03-07 21:17:31 +00:00
ecdh_extra Add ECDH_compute_key_fips inside the module. 2018-07-30 22:40:31 +00:00
ecdsa_extra Remove ECDSA_sign_setup and friends. 2017-11-22 20:23:40 +00:00
engine Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
err Add ECDH_compute_key_fips inside the module. 2018-07-30 22:40:31 +00:00
evp Update ECDH and EVP tests to accept latest Wycheproof vectors. 2018-06-07 16:54:30 +00:00
fipsmodule Fix the build with FIPS + NO_ASM. 2018-07-30 22:43:25 +00:00
hkdf Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
hmac_extra Convert a number of tests to GTest. 2017-06-01 17:02:13 +00:00
lhash Add lh_FOO_retrieve_key to avoid stack-allocating SSL_SESSION. 2018-07-03 22:56:46 +00:00
obj Add some more compatibility functions. 2018-05-08 20:51:15 +00:00
pem Add a bunch of compatibility functions for PKCS#7. 2018-06-26 18:42:49 +00:00
perlasm Sync up some perlasm license headers and easy fixes. 2018-02-11 01:00:35 +00:00
pkcs7 Add a bunch of compatibility functions for PKCS#7. 2018-06-26 18:42:49 +00:00
pkcs8 Properly advance the CBS when parsing BER structures. 2018-06-26 07:23:10 +00:00
poly1305 Remove custom memcpy and memset from poly1305_vec. 2017-11-10 20:53:30 +00:00
pool Add some TSan coverage of CRYPTO_BUFFER. 2018-07-23 19:04:44 +00:00
rand_extra [fuchsia] Update to zx_cprng_draw 2018-06-28 21:08:18 +00:00
rc4 Simplify RC4 code and remove assembly. 2016-08-30 15:32:31 +00:00
rsa_extra Add a thread test for RSA. 2018-07-23 19:00:03 +00:00
stack Avoid modifying stack in sk_find. 2018-04-12 21:02:12 +00:00
test Don't build test/malloc.cc with TSAN. 2018-07-24 15:38:09 +00:00
x509 Require basicConstraints cA flag in intermediate certs. 2018-08-01 19:10:19 +00:00
x509v3 Require basicConstraints cA flag in intermediate certs. 2018-08-01 19:10:19 +00:00
CMakeLists.txt Add ECDH_compute_key_fips inside the module. 2018-07-30 22:40:31 +00:00
compiler_test.cc Test that nullptr has the obvious memory representation. 2017-07-28 17:39:28 +00:00
constant_time_test.cc Add a test for CRYPTO_memcmp. 2018-03-27 16:22:47 +00:00
cpu-aarch64-fuchsia.c Add cpu-aarch64-fuchsia.c 2018-02-13 20:12:47 +00:00
cpu-aarch64-linux.c Add cpu-aarch64-fuchsia.c 2018-02-13 20:12:47 +00:00
cpu-arm-linux.c Add CRYPTO_needs_hwcap2_workaround. 2017-09-18 14:05:46 +00:00
cpu-arm.c Rewrite ARM feature detection. 2016-03-26 04:54:44 +00:00
cpu-intel.c Change OPENSSL_cpuid_setup to reserve more extended feature space. 2018-04-19 20:48:58 +00:00
cpu-ppc64le.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
crypto.c Move the MSan sanity check to a source file. 2018-07-25 15:15:19 +00:00
ex_data.c Unexport more of lhash. 2017-10-25 04:17:18 +00:00
internal.h Move the MSan sanity check to a source file. 2018-07-25 15:15:19 +00:00
mem.c Remove unused string.h include. 2018-04-24 17:42:39 +00:00
refcount_c11.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
refcount_lock.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
refcount_test.cc Add a basic TSan test for ref-counts. 2018-07-23 18:57:19 +00:00
self_test.cc Extract FIPS KAT tests into a function. 2018-01-22 20:16:38 +00:00
thread_none.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread_pthread.c Delete |pthread_key_t| on dlclose. 2018-02-20 19:53:24 +00:00
thread_test.cc Use std::thread in thread_test.cc. 2018-06-04 17:32:48 +00:00
thread_win.c Reland "Fix bssl client/server's error-handling." 2018-05-07 17:19:59 +00:00
thread.c Remove a bunch of unnecessary includes. 2016-06-28 20:31:14 +00:00