Add Support for IPv4 and IPv6 X.509 Certificate Name Constraints #2340
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
skmcgrail
changed the title
|
Need to dig into the nature of this issue and associated fix #487 because it's impacting being able to specify |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## x509 #2340 +/- ##
==========================================
+ Coverage 78.78% 78.82% +0.04%
==========================================
Files 622 622
Lines 107977 108101 +124
Branches 15337 15345 +8
==========================================
+ Hits 85070 85216 +146
+ Misses 22254 22232 -22
Partials 653 653 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
The old scanf-based parser accepted all kinds of invalid inputs like: "1.2.3.4.5" "1.2.3.4 " "1.2.3. 4" " 1.2.3.4" "1.2.3.4." "1.2.3.+4" "1.2.3.4.example.test" "1.2.3.01" "1.2.3.0x1" Thanks to Amir Mohamadi for pointing this out in https://boringssl-review.googlesource.com/c/boringssl/+/68167. This is a different implementation since patching sscanf doesn't quite catch all the cases. Add a bunch of tests, some imported from Amr's patch to OpenSSL upstream, plus a bunch of my own. (IPv6 parsing is complicated!) Update-Note: The deprecated (and dangerous) string-based APIs for configuring X.509 extensions will no longer silently misinterpret some invalid inputs as IPv4 addresses. This was run through TGP internally without any issue. Change-Id: I66e223a466cc3e74df9f9ddc8aef3b6b6c790f7e Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/68567 Reviewed-by: Adam Langley <[email protected]> Commit-Queue: David Benjamin <[email protected]> Auto-Submit: David Benjamin <[email protected]> (cherry picked from commit ba62c812f01fb379f49f94a08a2d1282ce46e678)
skmcgrail
force-pushed
the
ip-name-constraints
branch
from
2b5fb50 to
2e00c0a
Compare
justsmth
reviewed
Apr 24, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Callouts
22afe5e is a cherry-pick from upstream that hardens textual parsing of IP addresses.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.