A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=tb_20221020 2022-10-20T07:33:15+00:00 2022-10-20T07:33:15+00:00 cvs2svn admin@example.com 2022-10-20T07:33:15+00:00 urn:sha1:963a7b06e7d578322df5c53439ac3f52eae54095 2022-10-20T07:33:14+00:00 tb 2022-10-20T07:33:14+00:00 urn:sha1:6ef02c2707dc554983552781e5b767ae8103de15 rust-openssl is an integral part of the Rust ecosystem and more than a dozen ports, including lang/rust itself, depend on it. We need to ensure that it keeps working with LibreSSL. If the rust and rust-openssl-tests packages are installed, create a cargo workspace under obj/ that compiles and runs the rust-openssl regress tests much like what is done for the openssl-ruby tests. This expands our regress coverage: for instance, this would have caught the broken ASN.1 indefinite length encoding caused by asn1/tasn_enc.c r1.25. Positive feedback beck jsing semarie Testing and ok anton 2022-10-18T14:55:19+00:00 schwarze 2022-10-18T14:55:19+00:00 urn:sha1:3daa6137ebbb54877916ab760ed8716f17551850 on Jan 10, 2022: X509_EX_V_INIT X509_EX_V_NETSCAPE_HACK X509_EXT_PACK_STRING X509_EXT_PACK_UNKNOWN. Mark BN_set_params and BN_get_params as deprecated, unused, and intentionally undocumented. 2022-10-17T18:56:54+00:00 jsing 2022-10-17T18:56:54+00:00 urn:sha1:87bbbdfd185643167555b83c48992d495197809b In the case that a verification callback is installed that tells the verifier to continue when a certificate is invalid (e.g. expired), any error resulting from the leaf certificate verification is not stored and made available post verification, resulting in an incorrect error being returned. Also perform leaf certificate verification prior to adding the chain, which avoids a potential memory leak (as noted by tb@). Issue reported by Ilya Shipitsin, who encountered haproxy regress failures. ok tb@ 2022-10-17T18:44:36+00:00 jsing 2022-10-17T18:44:36+00:00 urn:sha1:9ca85afd54f2ef26c0988e91d438dc81e8f88558 Rather than using X509_STORE_CTX_set_time() (which is resulting all certificates in the chain being treated as expired), use chains that have an expired leaf or expired intermediate. This triggers a different code path, which is currently mishandled (and hence failing). Also ensure that the resulting error and error depth match what we expect them to be. 2022-10-17T18:36:52+00:00 jsing 2022-10-17T18:36:52+00:00 urn:sha1:60872b04d07d9a54d9f973c16c8c2c9974d77672 Improve verification regress and ensure that the legacy or modern verification completes with the expected error and error depth. 2022-10-17T18:26:41+00:00 jsing 2022-10-17T18:26:41+00:00 urn:sha1:16d28f35982285c3fa25fa684eeccb156a626557 Passing an indent value of 67 results in DUMP_WIDTH_LESS_IDENT returning a value of zero, which is promptly used for division. Likewise, passing a value larger than 67 results in a negative value being returned. Prevent this by limiting indent to 64 (which matches OpenSSL's current behaviour), as well as ensuring that dump_width is > 0. Should fix oss-fuzz #52464 and #52467. ok miod@ tb@ 2022-10-17T18:03:15+00:00 jsing 2022-10-17T18:03:15+00:00 urn:sha1:eb4f355a86ee7fc6d40003fe9f76b9a9a938b061 In r1.25 of tasn_enc.c a check was added to ensure that asn1_ex_i2c() returned the same value on both calls, however in the ndef case the len variable gets changed between calls. Keep a copy of the original value to test against. Issue reported by niklas, who encountered a test failure in rust-openssl. ok miod@ tb@ 2022-10-14T06:56:33+00:00 tb 2022-10-14T06:56:33+00:00 urn:sha1:4afadc9acdc3f71ccd29daea6ad1b6aaeb47af1b Calling HKDF_expand() with a length of 0 happens to succeed due to a quirk in the API inherited from BoringSSL. This hides caller-side errors during development. Error out to catch such mistakes early on. ok jsing 2022-10-14T04:38:39+00:00 deraadt 2022-10-14T04:38:39+00:00 urn:sha1:fa629fb86c1178c43a56145cd374cbe7e8948275 that the kernel and ld.so will know not to mark it immutable. malloc handles the read/write transitions by itself.