A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=tb_20220504 2022-05-04T18:02:08+00:00 2022-05-04T18:02:08+00:00 cvs2svn admin@example.com 2022-05-04T18:02:08+00:00 urn:sha1:3c94dc45dfb15483d76c47a128ec352cc0b655ac 2022-05-04T18:02:07+00:00 tb 2022-05-04T18:02:07+00:00 urn:sha1:f32cca700e59c0fd1ddd8f1fd4b35a5401be28fe This imports verbatim copies as of the OpenSSL_1_1_1o tag of crypto/kdf/hkdf.c crypto/kdf/hkdf_err.c include/openssl/kdf.h include/openssl/kdferr.h from https://www.github.com/openssl/openssl.git into lib/libcrypto/kdf. We only want the EVP interface to HKDF since some ports need them. Not yet linked to the build since it will not compile. Follow-on commits will add KNF, clean up and make this compile. Tests of an early draft version by abieber and Caspar Schutijser ok jsing 2022-05-04T10:57:48+00:00 jsing 2022-05-04T10:57:48+00:00 urn:sha1:c0d7276d07a10a7391d0f6d10b5975177e819cfe Use more readable variable and arguments names in the process. ok tb@ 2022-05-04T10:53:26+00:00 jsing 2022-05-04T10:53:26+00:00 urn:sha1:c7490c51699111407c7dbfb8d11418c22f1f7d4f The asn1_find_end() function handles definite length ASN.1, which means that there is no point in the only caller having code to explicitly handle definite length - it can just call the function. ok tb@ 2022-05-04T10:47:36+00:00 jsing 2022-05-04T10:47:36+00:00 urn:sha1:2ee05a254753f47ff6538a8badb026ca82bc74a4 The long vs size_t checks can be handled in the asn1_check_tag() wrapper and this will help to avoid propagating long vs size_t issues into new code. ok tb@ 2022-04-28T18:36:38+00:00 jsing 2022-04-28T18:36:38+00:00 urn:sha1:bd169e0415ec7e637a065aa58f5a3f922080bd81 Test decoding of sequences with length and indefinite length into an ASN.1 string - in this case the ASN.1 is not decoded, rather the octets are stored directly as the content of the string. This exercises a specific path through the ASN.1 decoder. (you know asn1complex is living up to its name when you have to import openssl/asn1t.h directly...) 2022-04-28T18:30:57+00:00 jsing 2022-04-28T18:30:57+00:00 urn:sha1:05884faa77375103b83e2804adf80d2daadbca40 Rather than calling asn1_get_object_cbs(), call asn1_get_identifier_cbs(), then immediately proceed with the tag number and tag class check. Only if that succeeds (or it is not required) do we call asn1_get_length_cbs(). This avoids incurring the overhead of decoding the length in the case where the tag number and tag class do not match. While here rename asn1_check_tlen() to asn1_check_tag() - while we decode the length, what we are normally checking is the tag number and tag class. Also rename the arguments for readability. For now the argument types and encoding remain unchanged. ok inoguchi@ tb@ 2022-04-28T17:31:29+00:00 tb 2022-04-28T17:31:29+00:00 urn:sha1:caf53398e438071d59fcb00cac3a6c9f153493a8 ASN1_TIME_adj_internal() does some strange dances with remembering allocations in a boolean and using strlen(p) to deduce what happened inside *_string_from_tm(). It also (mis)translates a NULL p to an illegal time value error. This can be streamlined by converting directly from a struct tm into an ASN1_TIME and setting the errors when they occur instead of trying to deduce them from a NULL return. This is made a bit uglier than necessary due to the reuse-or-allocate semantics of the public API. At the cost of a little code duplication, ASN1_TIME_adj_internal() becomes very easy and ASN1_TIME_to_generalizedtime() is also simplified somewhat. ok inoguchi jsing 2022-04-28T15:42:10+00:00 inoguchi 2022-04-28T15:42:10+00:00 urn:sha1:a4b8bbdad8f29f4bf82c5f38334d81a878b42e1a comment from tb@ 2022-04-28T15:29:10+00:00 inoguchi 2022-04-28T15:29:10+00:00 urn:sha1:da6a563f559ace0551eeecdcf0dd0911e542a6c5 ok tb@