openbsd, branch tb_20210830A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=tb_202108302021-08-30T17:27:46+00:00This commit was manufactured by cvs2git to create tag 'tb_20210830'.2021-08-30T17:27:46+00:00cvs2svnadmin@example.com2021-08-30T17:27:46+00:00urn:sha1:4e4f5b4c833ba5285e001bdb6b832bdf91c43da3Reimplement part of the openssl/x509 regress tests in C2021-08-30T17:27:45+00:00tb2021-08-30T17:27:45+00:00urn:sha1:20a5de624e2e817be526407f2b8de078016ee258
Instead of using s_client and s_server and complicated shell scripts,
we can reuse the framework from the ssl_get_shared_cipher() regress
test and inspect the verify return value directly.
Discussed with beck jan jsing
Ignore warning alert returns from servername callback in TLSv1.32021-08-30T16:50:23+00:00tb2021-08-30T16:50:23+00:00urn:sha1:2fa2491cc72d7f3e79db1024c689d1a4dbf07ec8
If a servername callback returns SSL_TLSEXT_ERR_ALERT_WARNING, this
results in a fatal error in TLSv1.3 since alert levels are implicit
in the alert type and neither close_notify nor user_canceled make
sense in this context. OpenSSL chose to ignore this, so we need to
follow suit.
Found via a broken servername callback in p5-IO-Socket-SSL which
returns a Boolean instead of SSL_TLSEXT_ERR_*. This happened to
have worked before TLSv1.3 since warning alerts are often ignored.
This "fixes" sni.t and sni-verify.t in p5-IO-Socket-SSL.
ok beck jsing
Clean up end of do_body in openssl(1) ca2021-08-30T12:25:54+00:00inoguchi2021-08-30T12:25:54+00:00urn:sha1:08aabc745e4460cd2542cd2d5704af343e5dfd89
suggested from tb@
Remove NULL check before free in openssl(1) ca2021-08-30T12:12:11+00:00inoguchi2021-08-30T12:12:11+00:00urn:sha1:cd726bbf9877a08a759ecd8e256444a6e8a79ce9
ok tb@
Admit that we return error 20 in the failure case here. Changing2021-08-30T09:06:04+00:00beck2021-08-30T09:06:04+00:00urn:sha1:71f396acd1d4a784510f9b3b50e5c0fe055230c9
our verifier to return 21 results in other regress failures in
ruby and perl.
Revert previous change that changed our default return for unable to2021-08-30T08:59:33+00:00beck2021-08-30T08:59:33+00:00urn:sha1:128cd60e8913a5432c5f2cd611f876aaf30cc54a
find leaf cert issuers. This breaks perl and ruby regress, as noticed
by tb that "we tried this before".
Jan's regress that cares about 21 vs 20 needs to change
ok tb@
Fix Jan's regress in openssl/x509 to do what it says it does,2021-08-30T06:51:36+00:00beck2021-08-30T06:51:36+00:00urn:sha1:4e50a8d4146b751db152850becadcd0a15593980
then fix the only thing it still has complaints about which
is that we don't return the leaf version of the error code
when we can't verify the leaf (as opposed to the rest of the chain)
ok jan@ tb@
Do not call X509_alias_get0(3) with NULL as the second argument.2021-08-29T19:56:40+00:00schwarze2021-08-29T19:56:40+00:00urn:sha1:92a0608ad38f033cb50deb04b9a207a7b3a1ba25
Even if the buffer is guaranteed to be NUL-terminated in a particular
case, it is still setting a bad example. Besides, it is unclear
to me whether there is any such guarantee in the case at hand.
Checking that would require auditing all of d2i_X509_bio(3),
ASN1_item_d2i_bio(&NETSCAPE_X509_it, ...), PEM_read_bio_X509_AUX(3),
and PKCS12_parse(3), since no such guarantee is documented for any
of these functions, and even then it would remain fragile with
respect to later changes of implementation details.
In the worst case, this could potentially result in a read buffer
overrun.
OK tb@ on an earlier version of this patch.
While we are here, deraadt@ requested to not use the word "string" in the
name of a variable that is not a string in the sense of the C language.
Don't call the verify callback twice on success.2021-08-29T17:13:15+00:00beck2021-08-29T17:13:15+00:00urn:sha1:f9a1f301d09203a9502b89510114c776bc4f12bf
This fixes a problem in the perl regress where it notices the
callback is called twice and complains.
ok tb@ bluhm@