openbsd/src/lib/libcrypto/ts, branch libressl-v3.8.0

Remove TS_VERIFY_CTX_init()

2023-04-25T17:52:54+00:00

Mark TS_VERIFY_CTX_init() for removal

2023-04-16T08:31:54+00:00

With opaque TS_VERIFY_CTX the init function dangerous and useless. It will be dropped. ok jsing

Inline only use of TS_VERIFY_CTX_init()

2023-03-31T17:47:39+00:00

Since TS_VERIFY_CTX is now opaque, the only thing TS_VERIFY_CTX_init() is good for outside the library is memory leaks. Inside the library it's also useless, since as a much more familiar name is memset(). It will soon be able to join all the other nonsense that should never have leaked out of this library.

Make header guards of internal headers consistent

2022-11-26T17:23:18+00:00

Not all of them, only those that didn't leak into a public header... Yes.

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook

Make structs in ts.h opaque

2022-09-11T17:31:19+00:00

ok jsing

Prepare to resurrect TS_RESP_CTX_set_time_cb()

2022-07-24T20:02:04+00:00

This was removed shortly after the fork since TS is not 2038-ready and since there were no consumers of this API. Now there are consumers and they add it themselves if it's missing from libcrypto. This will no longer be possible with opaque TS structs, so begrudgingly add it back. ok jsing kn

Prepare to provide TS_VERIFY_CTX accessors

2022-07-24T19:54:46+00:00

The setters make no sense since they do not free the old members and return what was passed in instead of returning the old struct member so that the caller has a chance of freeing them. This has the side effect that calling a setter a second time will likely result in a leak. TS_VERIFY_CTX_set_imprint() was "fixed" upstream by adding a free() but the other three setters were missed since discussing the contributor's CLA was more important. Also missed was that adding frees will result in double frees: careful consumers like openssl/ruby have workarounds for the strange existing semantics. Add a compat #define for TS_VERIF_CTS_set_certs() that made it into the public API with a typo. A good illustration of the amount of thought and care that went into the OpenSSL 1.1 API by both the implementers and the reviewers. Amazing job overall. We will be stuck with this nonsense for a long time. ok jsing kn

Prepare to provide various TS_STATUS_INFO accessors

2022-07-24T19:25:36+00:00

This adds TS_STATUS_get0_{failure_info,text,status}() as well as TS_STATUS_INFO_set_status(). These will be needed by Ruby and openssl(1) when we make the structs in ts.h opaque. ok kn jsing

Start making ts opaque

2022-07-24T08:16:47+00:00

Move the not yet exposed EssCertIDv2 struct internals to ts_local.h and move the ASN.1 function prototypes that we don't want to expose with them. Include ts_local.h where necessary or where it will be needed soon. ok jsing