RUSTSEC-2026-0098/99 - 0.101.7 (agave v3.1/v4.0)#5
Merged
Conversation
t-nelson
force-pushed
the
rs-26-98+99-0.101.7
branch
8 times, most recently
from
386dc84 to
83601a8
Compare
|
Upstream fixes for reference: |
t-nelson
force-pushed
the
rs-26-98+99-0.101.7
branch
from
83601a8 to
9c0f19c
Compare
There was a problem hiding this comment.
Pull request overview
Backports upstream fixes related to RustSec advisories RUSTSEC-2026-0098 and RUSTSEC-2026-0099 into the vendored 0.101.7 branch, focusing on tightening X.509 name-constraints handling for DNS names (notably wildcard semantics).
Changes:
- Makes name-constraint matching more explicit in
verify.rsby avoiding a catch-allmatcharm forGeneralNamevariant pairs. - Extends DNS name constraint matching to distinguish subtree polarity (
PermittedSubtreesvsExcludedSubtrees) and adds regression tests for wildcard containment/intersection behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
src/subject_name/verify.rs |
Refactors name/constraint variant matching and exposes Subtrees for use by other subject-name code. |
src/subject_name/dns_name.rs |
Introduces subtree-polarity into constraint role handling and adds wildcard-related tests. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
upstream change was merged 4ad751f |
Author
|
upstream is quite diverged from 0.101.x |
t-nelson
force-pushed
the
rs-26-98+99-0.101.7
branch
from
dc0c741 to
3affda8
Compare
t-nelson
force-pushed
the
rs-26-98+99-0.101.7
branch
from
3affda8 to
c9937f6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pick fixes for https://rustsec.org/advisories/RUSTSEC-2026-0098 and https://rustsec.org/advisories/RUSTSEC-2026-0099 onto our 0.101.7 based vendored branch
i couldn't get the test to go for d0024e6. too many new things 😢