A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE 2025-01-25T17:59:44+00:00 2025-01-25T17:59:44+00:00 tb 2025-01-25T17:59:44+00:00 urn:sha1:5d52abc236226c5a47c36b07e2256e77141e373a discussed with jsing 2023-04-18T08:33:43+00:00 tb 2023-04-18T08:33:43+00:00 urn:sha1:7c140db45f1d1b8f4daf0a81424b35e3a5ff8e29 Some headers were included conditionally on OPENSSL_NO_DEPRECATED in hopes that eventually the mess of everything includes everything will magically resolve itself. Of course everyone would end up building openssl with OPENSSL_NO_DEPRECATED over time... Right. Surprisingly, the ecosystem has come to rely on these implicit inclusions, so about two dozen ports would fail to build because of this. Patching this would be easy but really not worth the effort. ok jsing 2023-04-09T19:10:23+00:00 tb 2023-04-09T19:10:23+00:00 urn:sha1:180ac4430773db8fb86b3343279cc5790eee08e6 Geoff Thorpe added OPENSSL_NO_DEPRECATED nearly two decades ago. The hope was that at some point some functions can be dropped. Most of the functions marked deprecated are actually unused nowadays but unfortunately some of them are still used in the ecosystem. Move them out of OPENSSL_NO_DEPRECATED so we can define it without breaking the consumers in the next bump. ERR_remove_state() is still used by a dozen or so ports. This isn't a big deal since it is just a stupid wrapper for the not quite as deprecated ERR_remove_thread_state(). It's not worth patching these ports. Annoyingly, {DH,DSA}_generate_parameters() and RSA_generate_key() are still used. They "make use" of the old-style BN_GENCB callback, which is therefore more difficult to remove - in case you don't know know: that's the thing responsible for printing pretty '.', '+' and '*' when you generate keys. Most annoyingly, DH_generate_parameters() was added to rust-openssl in 2020 for "advanced DH support". This is very unfortunate since cargo bundles a rust-openssl and updates it only every few years or so. As a consequence we're going to be stuck with this nonsense for a good while. ok beck jsing 2022-07-12T14:42:50+00:00 kn 2022-07-12T14:42:50+00:00 urn:sha1:89e42d5857196a8071fbafb5565388d0e20ec32b This script is not used at all and files are edited by hand instead. Thus remove misleading comments incl. the obsolete script/config. Feedback OK jsing tb 2022-07-07T13:01:28+00:00 tb 2022-07-07T13:01:28+00:00 urn:sha1:7986c6c16406e5ad9f53a49107428df9f9fd70c1 These are mostly security-level related, but there are also ASN1_TIME and ASN_INTEGER functions here, as well as some missing accessors. ok jsing 2022-06-27T12:31:38+00:00 tb 2022-06-27T12:31:38+00:00 urn:sha1:e9bc35a6d120c0aa1f30feafb92222df91771dbd ok beck jsing 2022-01-14T08:25:44+00:00 tb 2022-01-14T08:25:44+00:00 urn:sha1:b750ed61cefe91940dce870088adff3ad6857d34 This moves the struct internals for DH and DH_METHOD to dh_local.h. ok inoguchi jsing 2022-01-14T07:49:49+00:00 tb 2022-01-14T07:49:49+00:00 urn:sha1:82ec18edf4e632f36b6f79c239fdb6961d421a82 This marks the start of major surgery in libcrypto. Do not attempt to build the tree for a while (~50 commits). 2022-01-10T12:00:52+00:00 tb 2022-01-10T12:00:52+00:00 urn:sha1:7f7aefb469a9916b1d914a9fabaed99bb909ef8d DH_check{,_pub_key}_ex() wrap their non-ex versions to translate the flags argument of the original functions into OpenSSL errors. For this almost a dozen new error codes need to be added. DH_params_check{,_ex}() is a new version of DH_check that only performs a cheap subset of the checks. They are needed to implement EVP_PKEY_{public,param}_check() (observe the consistent naming) although the actual implementation of EVP_PKEY_param_check() chose to use DH_check_ex(). As far as I can tell, the only raison d'être of the _ex functions and error codes is to spew them to stderr in a couple of openssl(1) commands. This couldn't have been solved differently... These functions will not be exposed publicly. ok inoguchi jsing 2022-01-07T09:21:21+00:00 tb 2022-01-07T09:21:21+00:00 urn:sha1:53b1ddcbe1030b90b0333d87f7533b35223ff685