A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v4.0.0 2024-08-27T01:19:27+00:00 2024-08-27T01:19:27+00:00 tb 2024-08-27T01:19:27+00:00 urn:sha1:e6600c8781ee3168a9641ab8f28db4d05ef8e881 2024-07-26T13:23:52+00:00 tb 2024-07-26T13:23:52+00:00 urn:sha1:7e79b76e20322d8892ccae4c550ff53967768d5d ok jsing 2024-07-09T06:12:45+00:00 beck 2024-07-09T06:12:45+00:00 urn:sha1:79a609532ffec5c57581a3d8319df7e9b00d0efc ok tb@ 2024-06-24T06:43:23+00:00 tb 2024-06-24T06:43:23+00:00 urn:sha1:c9802a5afe29675d69b605ce906d34fd89c024ac These constitute the bulk of the remaining global mutable state in libcrypto. This commit moves most of them into data.rel.ro, leaving out ERR_str_{functs,libraries,reasons} (which require a slightly different approach) and SYS_str_reasons which is populated on startup. The main observation is that if ERR_load_strings() is called with a 0 lib argument, the ERR_STRING_DATA argument is not actually modified. We could use this fact to cast away const on the caller side and be done with it. We can make this cleaner by adding a helper ERR_load_const_strings() which explicitly avoids the assignment to str->error overriding the error code already set in the table. In order for this to work, we need to sprinkle some const in err/err.c. CMS called ERR_load_strings() with non-0 lib argument, but this didn't actually modify the error data since it ored in the value already stored in the table. Annoyingly, we need to cast const away once, namely in the call to lh_insert() in int_err_set_item(). Fixing this would require changing the public API and is going to be tricky since it requires that the LHASH_DOALL_FN_* types adjust. ok jsing 2024-05-19T07:12:50+00:00 jsg 2024-05-19T07:12:50+00:00 urn:sha1:9dd363a8109e5383b08891f9d0307a5d5aa2bc09 feedback and ok tb@ 2024-04-20T10:11:55+00:00 tb 2024-04-20T10:11:55+00:00 urn:sha1:dbc91b02b46414edaa98f5ae533bc4c44c5b6ef7 ok jsing 2024-04-07T06:34:42+00:00 tb 2024-04-07T06:34:42+00:00 urn:sha1:483b41efefd82d053ce8da00bd0d02f21616e651 This is an API to add an OID attribute to the set of SMIMECapabilities. While attributes are complicated in general, this only supports simple capabilities encoded as an OID with an optional integer parameter (e.g., the key size of a cipher). Make this API transactional, i.e., don't leave a new empty set behind on failure or leak the key size if setting the parameter on the X509_ALGOR fails. Also convert to single exit and add a doc comment with a reference. ok beck 2024-03-30T01:53:05+00:00 joshua 2024-03-30T01:53:05+00:00 urn:sha1:8476ea411cac22160a27f6983eb735b7e3c618ab ok jsing 2024-03-30T00:35:15+00:00 joshua 2024-03-30T00:35:15+00:00 urn:sha1:540b97f3e69316e87e9e2369f2d37dc835cfc5cd ok jsing 2024-03-29T06:41:58+00:00 tb 2024-03-29T06:41:58+00:00 urn:sha1:207bd9bb06ecc406c0e992892c96391e5f299077 This adds support for Edwards curve digital signature algorithms in the cryptographic message syntax, as specified in RFC 8419. Only Ed25519 is supported since that is the only EdDSA algorithm that LibreSSL supports (this is unlikely to change ever, but, as they say - never is a very long time). This has the usual curly interactions between EVP and CMS with poorly documented interfaces and lots of confusing magic return values and controls. This improves upon existing control handlers by documenting what is being done and why. Unlike other (draft) implementations we also happen to use the correct hashing algorithm. There are no plans to implement RFC 8418. joint work with job at p2k23 ok jsing