untrusted comment: signature from openbsd 6.1 base secret key
RWQEQa33SgQSEu2i0Rk+2jegwVongnaA2ojcYgaEhpz07n4N7Y1uKv0jQ2+KIw333jm32ObggMxcnwwmB7mEn6WeG9u8bhUZ8gQ=

OpenBSD 6.1 errata 014, July 5, 2017:

Distinguish between self-issued certificates and self-signed certificates,
so that self-issued certificates verify correctly in a chain.

Apply by doing:
   signify -Vep /etc/signify/openbsd-61-base.pub -x 014_libcrypto.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install libcrypto:
       cd /usr/src/lib/libcrypto
       make obj
       make depend
       make
       make install

Index: lib/libcrypto/x509v3/v3_purp.c
===================================================================
RCS file: /cvs/src/lib/libcrypto/x509v3/v3_purp.c,v
retrieving revision 1.29
diff -u -p -u -p -r1.29 v3_purp.c
--- lib/libcrypto/x509v3/v3_purp.c      29 Jan 2017 17:49:23 -0000      1.29
+++ lib/libcrypto/x509v3/v3_purp.c      4 Jul 2017 16:59:03 -0000
@@ -65,6 +65,14 @@
#include <openssl/x509v3.h>
#include <openssl/x509_vfy.h>

+#define V1_ROOT (EXFLAG_V1|EXFLAG_SS)
+#define ku_reject(x, usage) \
+       (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
+#define xku_reject(x, usage) \
+       (((x)->ex_flags & EXFLAG_XKUSAGE) && !((x)->ex_xkusage & (usage)))
+#define ns_reject(x, usage) \
+       (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
+
static void x509v3_cache_extensions(X509 *x);

static int check_ssl_ca(const X509 *x);
@@ -427,19 +435,19 @@ x509v3_cache_extensions(X509 *x)
       ASN1_BIT_STRING *ns;
       EXTENDED_KEY_USAGE *extusage;
       X509_EXTENSION *ex;
-
       int i;
+
       if (x->ex_flags & EXFLAG_SET)
               return;
+
#ifndef OPENSSL_NO_SHA
       X509_digest(x, EVP_sha1(), x->sha1_hash, NULL);
#endif
-       /* Does subject name match issuer ? */
-       if (!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
-               x->ex_flags |= EXFLAG_SI;
+
       /* V1 should mean no extensions ... */
       if (!X509_get_version(x))
               x->ex_flags |= EXFLAG_V1;
+
       /* Handle basic constraints */
       if ((bs = X509_get_ext_d2i(x, NID_basic_constraints, NULL, NULL))) {
               if (bs->ca)
@@ -456,6 +464,7 @@ x509v3_cache_extensions(X509 *x)
               BASIC_CONSTRAINTS_free(bs);
               x->ex_flags |= EXFLAG_BCONS;
       }
+
       /* Handle proxy certificates */
       if ((pci = X509_get_ext_d2i(x, NID_proxyCertInfo, NULL, NULL))) {
               if (x->ex_flags & EXFLAG_CA ||
@@ -477,6 +486,7 @@ x509v3_cache_extensions(X509 *x)
               PROXY_CERT_INFO_EXTENSION_free(pci);
               x->ex_flags |= EXFLAG_PROXY;
       }
+
       /* Handle key usage */
       if ((usage = X509_get_ext_d2i(x, NID_key_usage, NULL, NULL))) {
               if (usage->length > 0) {
@@ -541,6 +551,16 @@ x509v3_cache_extensions(X509 *x)

       x->skid = X509_get_ext_d2i(x, NID_subject_key_identifier, NULL, NULL);
       x->akid = X509_get_ext_d2i(x, NID_authority_key_identifier, NULL, NULL);
+
+       /* Does subject name match issuer? */
+       if (!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x))) {
+               x->ex_flags |= EXFLAG_SI;
+               /* If SKID matches AKID also indicate self signed. */
+               if (X509_check_akid(x, x->akid) == X509_V_OK &&
+                   !ku_reject(x, KU_KEY_CERT_SIGN))
+                       x->ex_flags |= EXFLAG_SS;
+       }
+
       x->altname = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
       x->nc = X509_get_ext_d2i(x, NID_name_constraints, &i, NULL);
       if (!x->nc && (i != -1))
@@ -570,14 +590,6 @@ x509v3_cache_extensions(X509 *x)
 * 3 basicConstraints absent but self signed V1.
 * 4 basicConstraints absent but keyUsage present and keyCertSign asserted.
 */
-
-#define V1_ROOT (EXFLAG_V1|EXFLAG_SS)
-#define ku_reject(x, usage) \
-       (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
-#define xku_reject(x, usage) \
-       (((x)->ex_flags & EXFLAG_XKUSAGE) && !((x)->ex_xkusage & (usage)))
-#define ns_reject(x, usage) \
-       (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))

static int
check_ca(const X509 *x)
Index: lib/libcrypto/x509v3/x509v3.h
===================================================================
RCS file: /cvs/src/lib/libcrypto/x509v3/x509v3.h,v
retrieving revision 1.21
diff -u -p -u -p -r1.21 x509v3.h
--- lib/libcrypto/x509v3/x509v3.h       30 Dec 2016 16:19:24 -0000      1.21
+++ lib/libcrypto/x509v3/x509v3.h       4 Jul 2017 16:59:04 -0000
@@ -411,23 +411,21 @@ struct ISSUING_DIST_POINT_st

/* X509_PURPOSE stuff */

-#define EXFLAG_BCONS           0x1
-#define EXFLAG_KUSAGE          0x2
-#define EXFLAG_XKUSAGE         0x4
-#define EXFLAG_NSCERT          0x8
+#define EXFLAG_BCONS           0x0001
+#define EXFLAG_KUSAGE          0x0002
+#define EXFLAG_XKUSAGE         0x0004
+#define EXFLAG_NSCERT          0x0008

-#define EXFLAG_CA              0x10
-/* Really self issued not necessarily self signed */
-#define EXFLAG_SI              0x20
-#define EXFLAG_SS              0x20
-#define EXFLAG_V1              0x40
-#define EXFLAG_INVALID         0x80
-#define EXFLAG_SET             0x100
-#define EXFLAG_CRITICAL                0x200
-#define EXFLAG_PROXY           0x400
-
-#define EXFLAG_INVALID_POLICY  0x800
+#define EXFLAG_CA              0x0010
+#define EXFLAG_SI              0x0020  /* Self issued. */
+#define EXFLAG_V1              0x0040
+#define EXFLAG_INVALID         0x0080
+#define EXFLAG_SET             0x0100
+#define EXFLAG_CRITICAL                0x0200
+#define EXFLAG_PROXY           0x0400
+#define EXFLAG_INVALID_POLICY  0x0800
#define EXFLAG_FRESHEST                0x1000
+#define EXFLAG_SS               0x2000 /* Self signed. */

#define KU_DIGITAL_SIGNATURE   0x0080
#define KU_NON_REPUDIATION     0x0040

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.