A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=master 2026-04-07T12:52:19+00:00 2026-04-07T12:52:19+00:00 tb 2026-04-07T12:52:19+00:00 urn:sha1:c8f25bd7366a35c48b23230ab0da4f3484424ba2 Prompted by the "fix" fighting symptoms of misdesign in Delta CRL processing rather than addressing the root cause. Probably the best fix is to remove support for Indirect CRLs and Delta CRLs outright. ok jsing 2026-02-08T17:17:03+00:00 tb 2026-02-08T17:17:03+00:00 urn:sha1:c1d87b1072b9f7d2783c4658953f787fb56f26a1 2026-02-08T10:27:00+00:00 tb 2026-02-08T10:27:00+00:00 urn:sha1:50933fb9bc6bf2281489d17ee48416a43163d847 Instead of relying on i2c_ASN1_BIT_STRING() to determine the "unused" bits on encoding, set them explicitly in abs->flags via a call to asn1_abs_set_unused_bits(). This means ASN1_STRING_FLAGS_BITS_LEFT is now set on a bit string, which was previously explicitly cleared. This also means that the encoding of a non-zero ASN1_BIT_STRING populated by setting the bits individually will now go through the if (a->flags & ASN1_STRING_FLAG_BITS_LEFT) path in i2c_ASN1_BIT_STRING(). The most prominent usage of this function is in X.509 for the keyUsage extension or the CRL reason codes. There's also the NS cert type, TS PKIFailureInfo and general BITLIST config strings. The reason for the truncation logic comes from the DER for NamedBitLists X.690, 11.2.2 below: X.680, 22.7: When a "NamedBitList" is used in defining a bitstring type ASN.1 encoding rules are free to add (or remove) arbitrarily any trailing 0 bits to (or from) values that are being encoded or decoded. Application designers should therefore ensure that different semantics are not associated with such values which differ only in the number of trailing 0 bits. X.690, 11.2.2 Where ITU-T Rec. X.680 | ISO/IEC 8824-1, 22.7, applies, the bitstring shall have all trailing 0 bits removed before it is encoded. Note 1 - In the case where a size constraint has been applied, the abstract value delivered by a decoder to the application will be one of those satisfying the size constraint and differing from the transmitted value only in the number of trailing zero bits. Note 2 - If a bitstring value has no 1 bits, then an encoder shall encode the value with a length of 1 and an initial octet set to 0. ok kenjiro (on an earlier version) jsing 2026-01-16T09:25:15+00:00 tb 2026-01-16T09:25:15+00:00 urn:sha1:fe899f24bfb43e00efb15a72fbbd28ff635a8caa Add missing space after commas, shorten a couple comments in structs, reflow weirdly wrapped long comments and improve the random line breaks in typedefs and prototypes. 2026-01-16T09:21:48+00:00 tb 2026-01-16T09:21:48+00:00 urn:sha1:e62eb532814715d8684398ad800f331610cfd8d0 2026-01-16T09:19:20+00:00 tb 2026-01-16T09:19:20+00:00 urn:sha1:24d198d8053cb927535d8b46fd5525f1c6eabafa ok kenjiro 2026-01-11T07:52:34+00:00 tb 2026-01-11T07:52:34+00:00 urn:sha1:d99a68faf5b1c42f032b8d5b3a43f842019a9124 This converts more macros to C99 initializers. Rename flags and tags arguments by appending val because they collide with the field names. The remainder are whitespace changes. ok kenjiro 2026-01-09T03:46:44+00:00 tb 2026-01-09T03:46:44+00:00 urn:sha1:e4f65dfbefdd9246eb289eaba77049fe18940d49 This is a first pass at tidying up the unsightly mess that is asn1t.h. For better or worse, we have expanded the macros internally, and in base only rpki-client uses the templates. They are generally rarely used. Fortunately. Having C99 initializers helps a lot with debugging templated ASN.1 by combining cc -E with clang-format. They make the macros more readable, look tidier and help with grep. ok kenjiro 2026-01-09T03:34:30+00:00 tb 2026-01-09T03:34:30+00:00 urn:sha1:8f78cc1cefeb39af4c91e2a88a30592310a88991 2026-01-07T10:18:35+00:00 tb 2026-01-07T10:18:35+00:00 urn:sha1:d1b3b66046081080bf1bd1de6e207c16ebcc4e49 In asn1t.h r1.18 (commit 9b72422d) I removed the app_items member from ASN1_ADB and failed to fix up the ASN1_ADB_END() macro that populates the ASN1_ADB. This means ASN1_ADB_END() tried to initialize one member too many and would thus cause a compilation failure, so nobody uses this with LibreSSL. Internally, we have expanded all its uses. We could leave it broken or fix it up. Take the opportunity to add an unused adb_cb() argument instead, making the macro invocation compatible with OpenSSL. ok jsing kenjiro