boring-sys 5.3.0

FFI bindings to BoringSSL
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

From fe0b517fa34063990a83268edf7a3cd9ba0b2362 Mon Sep 17 00:00:00 2001
From: Yuchen Wu <yuchen@cloudflare.com>
Date: Mon, 13 Mar 2023 14:28:10 -0700
Subject: [PATCH] PINGORA-474: disable CRL version check for openssl
 compatibility

Some free customers use badly crafted CRLs (with verification off).
Openssl allows these CRLs but boring does't.
---
 crypto/x509/x509_test.cc | 4 +---
 crypto/x509/x_crl.cc     | 2 ++
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/crypto/x509/x509_test.cc b/crypto/x509/x509_test.cc
index f98aa26cc..c881a4199 100644
--- a/crypto/x509/x509_test.cc
+++ b/crypto/x509/x509_test.cc
@@ -4473,9 +4473,7 @@ TEST(X509Test, InvalidVersion) {
   EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
   EXPECT_FALSE(CertFromPEM(kV1WithSubjectUniqueIDPEM));
   EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
-  EXPECT_FALSE(CRLFromPEM(kV1CRLWithExtensionsPEM));
-  EXPECT_TRUE(
-      ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_FIELD_FOR_VERSION}}));
+  EXPECT_TRUE(CRLFromPEM(kV1CRLWithExtensionsPEM));
   EXPECT_FALSE(CRLFromPEM(kV1CRLWithEntryExtensionsPEM));
   EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
   EXPECT_FALSE(CRLFromPEM(kV3CRLPEM));
diff --git a/crypto/x509/x_crl.cc b/crypto/x509/x_crl.cc
index d30c17253..5af682ca9 100644
--- a/crypto/x509/x_crl.cc
+++ b/crypto/x509/x_crl.cc
@@ -157,10 +157,12 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
       }
 
       // Per RFC 5280, section 5.1.2.1, extensions require v2.
+      /* disable this check for openssl compatibility
       if (version != X509_CRL_VERSION_2 && crl->crl->extensions != nullptr) {
         OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION);
         return 0;
       }
+      */
 
       // Extensions is a SEQUENCE SIZE (1..MAX), so it cannot be empty. An empty
       // extensions list is encoded by omitting the OPTIONAL field.