)]}'
{
  "commit": "fd86eaa868534ac480b0ae391d6e86c121835a53",
  "tree": "d5c58efecfc4d3b2d7d289e746dda238d14c5848",
  "parents": [
    "cbac9c3a2d20a05d5c634eaab8f8b07589838d57"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Wed Jun 17 15:13:16 2020 -0400"
  },
  "committer": {
    "name": "CQ bot account: commit-bot@chromium.org",
    "email": "commit-bot@chromium.org",
    "time": "Fri Jun 19 16:55:51 2020 +0000"
  },
  "message": "Fix x509v3_cache_extensions error-handling.\n\nThis imports https://github.com/openssl/openssl/pull/10756 from upstream\nwith a number of changes:\n\n- Add tests.\n\n- Rather than blindly return false in cert_self_signed, make that\n  function a tri-state return. This gives better error-reporting when the\n  leaf certificate has a bad extension and reduces the risk of confusing\n  the verifier.\n\n- Give x509v3_cache_extensions a return value rather than expecting\n  everyone to check EXFLAG_INVALID. Switch X509_check_purpose calls to\n  it when applicable.\n\n- Rather than setting EXFLAG_INVALID on bad CRLs, fail the parse\n  altogether. We\u0027re already in the d2i callback. (Nothing checks\n  EXFLAG_INVALID on CRLs.)\n\n- I\u0027ve intentionally left the error unchecked in X509_cmp. OpenSSL\u0027s\n  strategy is to return -2, but that\u0027s not a consistent comparison\n  and may mess up sorts that depend on transitivity. This retains the\n  current behavior where we consider all undigestable certs as equal\n  to each other (modulo the opportunistic TBSCertificate double-check\n  which should work most of the time). This is terrible, so I\u0027ve filed\n  https://crbug.com/boringssl/355 to track fixes here.\n\nThat last fix caught that I misread the spec when I generated\nkKnownCriticalCRL and kUnknownCriticalCRL2. This fixes those and uses\nthe old kKnownCriticalCRL as a test for invalid extensions. (Those CRLs\nwere assembled by hand, so they don\u0027t indicate any software has been\nencoding them wrong.)\n\nUpdate-Note: The X.509 verifier now correctly rejects syntax errors in\nimportant certificate extensions. This may break some malformed\ncertificates which were incorrectly accepted before.\n\nBug: 345\nChange-Id: Ifb3a98ba62cd296920546bc718fda524bd55c024\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41745\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "6ed8fa3561542b53892aff11d166651b346d4c80",
      "old_mode": 33188,
      "old_path": "crypto/err/x509.errordata",
      "new_id": "1426fbf8e5d4bf5a2cb7260dd1a200fd0f0d61b6",
      "new_mode": 33188,
      "new_path": "crypto/err/x509.errordata"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "b86865fa94a17917cb5d693026ecfe714c1ab3e0",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_intermediate.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "595703c118ac51e4c6c24d16c392a1f0194b36b5",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_intermediate_authority_key_identifier.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "32f09f5199a9fc20ae53708dafe25f3c16667333",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_intermediate_basic_constraints.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "20ff382f197cd6fed0a622f22034ec4705459764",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_intermediate_ext_key_usage.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "c31596c13cc3965f318a445f5e75c488605f804f",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_intermediate_key_usage.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "82c83a9dcbe945515f4f527c66a7551a71b72c9d",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_intermediate_name_constraints.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "6fd9bf61ed1a8997727bbdead1a34cb7d9be8ef8",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_intermediate_subject_alt_name.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "a440757008cc43e8823950d53dac9a6abe407ae9",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_intermediate_subject_key_identifier.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "14bcb5a161286734439de79aa0a962089e63fc2d",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_leaf.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "166b89c18c459140a9c989b843c429dd7b6d65b6",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_leaf_authority_key_identifier.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "611f7cb1edf46cb8ddd9e514942fcd953f201139",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_leaf_basic_constraints.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "2fa34ee005d352290410975fb4cb34bccd7665d5",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_leaf_ext_key_usage.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "82c7cf0c75ccd11bf9dc24af40c5baae8c24dfe3",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_leaf_key_usage.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "f4e61059789cba17e78a179a573a43e879c0d67e",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_leaf_name_constraints.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "eae65f487be5c3b2fb9162abc03c795df8c3ebf5",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_leaf_subject_alt_name.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "d082bf8ade8a5641f7cf07843c3a8b013dc9250c",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_leaf_subject_key_identifier.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "9236111de2aa3d3cf8eec0310c887c5c54bfcf53",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_root.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "c2321b7f0f3d009bd13d3d031592aa1c3954aaa0",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_root_authority_key_identifier.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "4e507b3e2fa303260e3ac4dc5d7774d887b180fc",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_root_basic_constraints.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "17ac3a2b1fce18f5e212de47e25aa9117096c328",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_root_ext_key_usage.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "92ac0c608925e99c93f1e50e36bfab3f2f4dbd80",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_root_key_usage.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "3511236660d682ad16c4471ebf2cdfa39833e947",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_root_name_constraints.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "0604bf60abade811ce7099a6e7c3cdc49493f187",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_root_subject_alt_name.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "eb17a7ea4c2b7aa9d46452435c8394611d183fe4",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/invalid_extension_root_subject_key_identifier.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "3d20942bac3bbaf95fc30ab38a07f69b1ecbef3f",
      "new_mode": 33188,
      "new_path": "crypto/x509/test/make_invalid_extensions.go"
    },
    {
      "type": "modify",
      "old_id": "28f2e95ed738b233cb853b05cd3a573ee0b3c277",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_cmp.c",
      "new_id": "cd025abcafbdbf256b481214c5340026d76a5ada",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_cmp.c"
    },
    {
      "type": "modify",
      "old_id": "e0e2ec69df2494c85fa734a4b5284cae862dfd87",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_test.cc",
      "new_id": "957c0b8304e8fd06fe8e3a9feb3c710d9dfe670d",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_test.cc"
    },
    {
      "type": "modify",
      "old_id": "18ac8839e07d5a4fd3256d837c4154dbd6a3bc66",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_trs.c",
      "new_id": "019301ab8ecb970612fa80b81f7b8fa65a1f58bd",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_trs.c"
    },
    {
      "type": "modify",
      "old_id": "87dcb477882b15be694c50394c37f6dfb3cbc710",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_vfy.c",
      "new_id": "308ebbc3ae12350d43a3e10946d6a4a9eebbb49f",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_vfy.c"
    },
    {
      "type": "modify",
      "old_id": "6450e84702caadbf6db896f1529a609ba91b2d81",
      "old_mode": 33188,
      "old_path": "crypto/x509/x_crl.c",
      "new_id": "47e0ba5a9424eeba0f7ab2e08133070adf1bc160",
      "new_mode": 33188,
      "new_path": "crypto/x509/x_crl.c"
    },
    {
      "type": "modify",
      "old_id": "c143d735d78765b90e38de92cecaa631fc4b376a",
      "old_mode": 33188,
      "old_path": "crypto/x509v3/internal.h",
      "new_id": "245a5d1f6e87b9363286f1e1bed21a2aa6da9b7a",
      "new_mode": 33188,
      "new_path": "crypto/x509v3/internal.h"
    },
    {
      "type": "modify",
      "old_id": "d9d105e808da3452d0017ec2d73d572ec016fc8b",
      "old_mode": 33188,
      "old_path": "crypto/x509v3/v3_purp.c",
      "new_id": "e41b657febd3b303fcaefdb36bcb97e49077fea6",
      "new_mode": 33188,
      "new_path": "crypto/x509v3/v3_purp.c"
    },
    {
      "type": "modify",
      "old_id": "7bf492362894ff110745b2d0ee431fb8d40f3ac6",
      "old_mode": 33188,
      "old_path": "include/openssl/x509.h",
      "new_id": "252946fbcb975395fe025d369f2146b3c244bb6e",
      "new_mode": 33188,
      "new_path": "include/openssl/x509.h"
    },
    {
      "type": "modify",
      "old_id": "5454dde9bf6aa95172f205e3f722a70f280fed5c",
      "old_mode": 33188,
      "old_path": "sources.cmake",
      "new_id": "a5f2d2105fd018d48fa32d260dce99e946860aac",
      "new_mode": 33188,
      "new_path": "sources.cmake"
    }
  ]
}