A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9 2024-03-26T00:39:22+00:00 2024-03-26T00:39:22+00:00 beck 2024-03-26T00:39:22+00:00 urn:sha1:3604a06d3b1412f3b3b3959a358b2c8e2a07836a RFC 3631 allows for sub second ASN1 GENERALIZED times, if you choose to support sub second time precison. It does not indicate that an implementation must support them. Supporting sub second timestamps is just silly and unrealistic, so set our maximum to one second of precision. We then simplify this code by removing some nasty eye-bleed that made artisinally hand crafted strings and jammed them into an ASN1_GENERALIZEDTIME. ok tb@, jsing@, with one second precision tested by kn@ 2023-11-19T15:46:10+00:00 tb 2023-11-19T15:46:10+00:00 urn:sha1:593d97e74cc873d99aced677883cf55625efe62d This is mechanical apart from a few manual edits to avoid doubled empty lines. ok jsing 2023-07-28T09:53:55+00:00 tb 2023-07-28T09:53:55+00:00 urn:sha1:b5382a6334a2ec0fe73ab6c49ebefb47af93329c ENGINE was special. It's horrible code even by the low standards of this library. Some ports may now try to use the stubs which will fail, but the fallout from this should be minimal. Of course there are various language bindings that expose the ENGINE API. OpenSSL 3 disabling ENGINE by default will likely help fixing this at some point. ok jsing 2023-04-25T17:52:54+00:00 tb 2023-04-25T17:52:54+00:00 urn:sha1:ad8e5cf00f379430d2f0b02a2a3f2d39ad4093cb 2023-04-16T08:31:54+00:00 tb 2023-04-16T08:31:54+00:00 urn:sha1:37121a865a4029aebfae0ca539a8796f265352f6 With opaque TS_VERIFY_CTX the init function dangerous and useless. It will be dropped. ok jsing 2022-09-11T17:31:19+00:00 tb 2022-09-11T17:31:19+00:00 urn:sha1:b7fb781bef534398c94a8cbc267fb62adea0af0c ok jsing 2022-07-24T20:02:04+00:00 tb 2022-07-24T20:02:04+00:00 urn:sha1:85f79c66f0901408d7c8da4194b0fbf892a490b6 This was removed shortly after the fork since TS is not 2038-ready and since there were no consumers of this API. Now there are consumers and they add it themselves if it's missing from libcrypto. This will no longer be possible with opaque TS structs, so begrudgingly add it back. ok jsing kn 2022-07-24T19:54:46+00:00 tb 2022-07-24T19:54:46+00:00 urn:sha1:d8527f944e5dcafa2687d0ebff33a09f762af6e8 The setters make no sense since they do not free the old members and return what was passed in instead of returning the old struct member so that the caller has a chance of freeing them. This has the side effect that calling a setter a second time will likely result in a leak. TS_VERIFY_CTX_set_imprint() was "fixed" upstream by adding a free() but the other three setters were missed since discussing the contributor's CLA was more important. Also missed was that adding frees will result in double frees: careful consumers like openssl/ruby have workarounds for the strange existing semantics. Add a compat #define for TS_VERIF_CTS_set_certs() that made it into the public API with a typo. A good illustration of the amount of thought and care that went into the OpenSSL 1.1 API by both the implementers and the reviewers. Amazing job overall. We will be stuck with this nonsense for a long time. ok jsing kn 2022-07-24T19:25:36+00:00 tb 2022-07-24T19:25:36+00:00 urn:sha1:339c448fd0ceaadd74966d59d053fd65f3516eb5 This adds TS_STATUS_get0_{failure_info,text,status}() as well as TS_STATUS_INFO_set_status(). These will be needed by Ruby and openssl(1) when we make the structs in ts.h opaque. ok kn jsing 2022-07-24T08:16:47+00:00 tb 2022-07-24T08:16:47+00:00 urn:sha1:2fafe1cde355b3cfbb3b49badb99d5597b3f3fa5 Move the not yet exposed EssCertIDv2 struct internals to ts_local.h and move the ASN.1 function prototypes that we don't want to expose with them. Include ts_local.h where necessary or where it will be needed soon. ok jsing