initial BoringSSL harness

[woodruffw]

WIP.

[alex]

This looks like it uses the legacy validator. Boringssl has a new validator that might be more useful to include

…

On Thu, Aug 1, 2024, 4:08 PM William Woodruff ***@***.***> wrote: WIP. ------------------------------ You can view, comment on, or merge this pull request online at: #315 Commit Summary - 8437bd8 <8437bd8> initial BoringSSL harness File Changes (5 files <https://github.com/C2SP/x509-limbo/pull/315/files>) - *M* Cargo.lock <https://github.com/C2SP/x509-limbo/pull/315/files#diff-13ee4b2252c9e516a0547f2891aa2105c3ca71c6d7a1e682c69be97998dfc87e> (262) - *M* Makefile <https://github.com/C2SP/x509-limbo/pull/315/files#diff-76ed074a9305c04054cdebb9e9aad2d818052b07091de1f20cad0bbac34ffb52> (3) - *M* harness/openssl/Makefile <https://github.com/C2SP/x509-limbo/pull/315/files#diff-fb67f3a1ea4404b2e18f20857104550a8ced3bb920bd9da8e4907108d9c09108> (10) - *A* harness/openssl/boringssl.dockerfile <https://github.com/C2SP/x509-limbo/pull/315/files#diff-db8d8aecc698639e7344e1e33a7985f5c797324d811b7814fcdc8869525ba3a4> (10) - *M* harness/openssl/main.cpp <https://github.com/C2SP/x509-limbo/pull/315/files#diff-311ab821a4aeb2f0ebe79ad32cb9e799afe833139221168c2a31f8927e779b49> (17) Patch Links: - https://github.com/C2SP/x509-limbo/pull/315.patch - https://github.com/C2SP/x509-limbo/pull/315.diff — Reply to this email directly, view it on GitHub <#315>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBADIXX5XUC3JLURE5DZPKISDAVCNFSM6AAAAABL3HZZDGVHI2DSMVQWIX3LMV43ASLTON2WKOZSGQ2DGMZRHA2DMMQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[github-actions]

No regressions found.

[woodruffw]

TIL, I'll look into using that (I did it the lazy way to start by just adapting the existing OpenSSL harness).

[woodruffw]

I might be missing it, but I don't see a newer validator in BoringSSL's X.509 APIs.

x509.h has this note:

// Legacy X.509 library.
//
// This header is part of OpenSSL's X.509 implementation. It is retained for
// compatibility but should not be used by new code. The functions are difficult
// to use correctly, and have buggy or non-standard behaviors. They are thus
// particularly prone to behavior changes and API removals, as BoringSSL
// iterates on these issues.
//
// In the future, a replacement library will be available. Meanwhile, minimize
// dependencies on this header where possible.

https://github.com/google/boringssl/blob/7a6e828dc53ba9a56bd49915f2a0780d63af97d2/include/openssl/x509.h#L95C1-L104C47

[alex]

https://github.com/google/boringssl/tree/7a6e828dc53ba9a56bd49915f2a0780d63af97d2/include/openssl/pki

…

On Fri, Aug 2, 2024 at 11:06 AM William Woodruff ***@***.***> wrote: I might be missing it, but I don't see a newer validator in BoringSSL's X.509 APIs. x509.h has this note: // Legacy X.509 library.//// This header is part of OpenSSL's X.509 implementation. It is retained for// compatibility but should not be used by new code. The functions are difficult// to use correctly, and have buggy or non-standard behaviors. They are thus// particularly prone to behavior changes and API removals, as BoringSSL// iterates on these issues.//// In the future, a replacement library will be available. Meanwhile, minimize// dependencies on this header where possible. https://github.com/google/boringssl/blob/7a6e828dc53ba9a56bd49915f2a0780d63af97d2/include/openssl/x509.h#L95C1-L104C47 — Reply to this email directly, view it on GitHub <#315 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBE4AH7SGNTTI4IWFITZPON7DAVCNFSM6AAAAABL3HZZDGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENRVGYYDOMBSGI> . You are receiving this because you commented.Message ID: ***@***.***>

-- All that is necessary for evil to succeed is for good people to do nothing.

[woodruffw]

This now uses libpki, although FWICT the libpki APIs don't perform SAN/name verification as part of path/chain building. I might be missing that in the CertificateVerifyOptions, so I'll spend some more time attempting to make this work in the coming days.