openbsd/src/lib/libcrypto/ts, branch libressl-v2.4.0 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v2.4.0 2016-03-11T07:08:45+00:00 X509_free(3) is NULL-safe, so remove NULL checks before its calls. 2016-03-11T07:08:45+00:00 mmcc 2016-03-11T07:08:45+00:00 urn:sha1:3935f3d5bc0215b231fcd3c9f9ebd7cf653cfcde ok doug@ Replace M_ASN1_GENERALIZEDTIME_(new|free) with 2015-09-30T18:04:02+00:00 jsing 2015-09-30T18:04:02+00:00 urn:sha1:19f8db457572080e997c229267930d64b582b2ce ASN1_GENERALIZEDTIME_(new|free). Replace remaining M_ASN1_STRING_* macros with calls to ASN1_STRING_*. 2015-09-10T14:29:22+00:00 jsing 2015-09-10T14:29:22+00:00 urn:sha1:042566777cf875963166de1833bbe477f0ac3f64 This is not the same as the macro expansion, however the ASN1_STRING_* functions do match the macro expansions. ok doug@ miod@ Expand obsolete M_ASN1.*(cmp|dup|print|set) macros - no change in generated 2015-07-29T14:58:34+00:00 jsing 2015-07-29T14:58:34+00:00 urn:sha1:2186614b2e5af6bbfcc1a9f8898ac11ea9c93faf assembly. ok bcook@ Expand ASN.1 template macros - the generated assembly only differs by 2015-07-24T15:25:44+00:00 jsing 2015-07-24T15:25:44+00:00 urn:sha1:27b033dd3c62067e7e76be7e21528f4b2217adbe changes to line numbers. Verify ASN1 objects types before attempting to access them as a particular 2015-07-19T18:25:59+00:00 miod 2015-07-19T18:25:59+00:00 urn:sha1:61761e41c7c80fb243bc192e66dd048e359b9347 type. ok guenther@ doug@ Now that it is safe to invoke X509_STORE_CTX_cleanup() if X509_STORE_CTX_init() 2015-07-19T05:42:55+00:00 miod 2015-07-19T05:42:55+00:00 urn:sha1:6b0eb980d3e214f7207eac97cd4b726560f55c02 fails, check its return value and correctly mop up after ourselves. ok beck@ doug@ Put explicit braces around assignment used in a conditional. 2015-07-19T02:43:24+00:00 miod 2015-07-19T02:43:24+00:00 urn:sha1:2f199ccbed3e30323138538315273cc845854cb9 ok bcook@ doug@ Do not allow TS_check_signer_name() with signer == NULL from 2015-07-15T16:45:24+00:00 miod 2015-07-15T16:45:24+00:00 urn:sha1:b4b79ac55a858b9f4fb68520d70f59d7a78ef1c6 int_TS_RESP_verify_token(). Coverity CID 21710. Looking further, int_TS_RESP_verify_token() will only initialize signer to something non-NULL if TS_VFY_SIGNATURE is set in ctx->flags. But guess what? TS_REQ_to_TS_VERIFY_CTX() in ts/ts_verify_ctx.c, which is the TS_VERIFY_CTX constructor, explicitely clears this bit, with: ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE); followed by more conditional flag clears. Of course, nothing prevents the user to fiddle with ctx->flags afterwards. This is exactly what ts.c in usr.bin/openssl does. This is gross, mistakes will happen. ok beck@ Enable building with -DOPENSSL_NO_DEPRECATED. 2015-02-11T03:19:37+00:00 doug 2015-02-11T03:19:37+00:00 urn:sha1:e816a1ec1d4411707051912b945e8eab7a5a94e8 If you didn't enable deprecated code, there were missing err.h and bn.h includes. This commit allows building with or without deprecated code. This was not derived from an OpenSSL commit. However, they recently enabled OPENSSL_NO_DEPRECATED in git and fixed these header problems in a different way. Verified with clang that this only changes line numbers in the generated asm. ok miod@