A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9 2024-02-03T15:58:34+00:00 2024-02-03T15:58:34+00:00 beck 2024-02-03T15:58:34+00:00 urn:sha1:20afa90e552d2efed2187dbafc92170a3895e921 This version of GOST is old and not anywhere close to compliant with modern GOST standards. It is also very intrusive in libssl and makes a mess everywhere. Efforts to entice a suitably minded anyone to care about it have been unsuccessful. At this point it is probably best to remove this, and if someone ever showed up who truly needed a working version, it should be a clean implementation from scratch, and have it use something closer to the typical API in libcrypto so it would integrate less painfully here. This removes it from libssl in preparation for it's removal from libcrypto with a future major bump ok tb@ 2022-07-02T16:00:12+00:00 tb 2022-07-02T16:00:12+00:00 urn:sha1:9c3b0c8dc2d9f6d2b9cb9cb675e49a1a04d021b8 This reworks various tls1_ curve APIs to indicate success via a boolean return value and move the output to an out parameter. This makes the caller code easier and more consistent. Based on a suggestion by jsing ok jsing 2022-06-29T07:53:58+00:00 tb 2022-06-29T07:53:58+00:00 urn:sha1:a1086276b4c8f8d8939172bf6629c0b903a7ceae ok beck jsing 2022-06-29T07:53:00+00:00 tb 2022-06-29T07:53:00+00:00 urn:sha1:0275009912e8916a8f6207901326206fba58328d ok beck jsing 2021-06-29T19:25:59+00:00 jsing 2021-06-29T19:25:59+00:00 urn:sha1:8adf0e05d3bec74c17982471beb7c53f79486ede 2021-06-29T19:20:39+00:00 jsing 2021-06-29T19:20:39+00:00 urn:sha1:00e2e75589da2a420af32d1b6b3accb4b32d823c Provide an ssl_sigalg_for_peer() function that knows how to figure out which signature algorithm should be used for a peer provided signature, performing appropriate validation to ensure that the peer provided value is suitable for the protocol version and key in use. In the TLSv1.3 code, this replaces the need for separate calls to lookup the sigalg from the peer provided value, then perform validation. ok inoguchi@ tb@ 2021-06-29T19:10:08+00:00 jsing 2021-06-29T19:10:08+00:00 urn:sha1:874b710e2c7da54811bcda2ec25c0be5783887d1 Also, rather than passing in a check_curve flag, pass in the SSL * and handle version checks internally to ssl_sigalg_pkey_ok(), simplifying the callers. ok inoguchi@ tb@ 2021-06-27T18:15:35+00:00 jsing 2021-06-27T18:15:35+00:00 urn:sha1:ba443ed94103428d62d60c3e504f6d1d607efe41 Rather that passing in a sigalg list at every call site, pass in the appropriate TLS version and have ssl_sigalgs_from_value() perform the sigalg list selection itself. This allows the sigalg lists to be made internal to the sigalgs code. ok tb@ 2021-06-27T18:09:07+00:00 jsing 2021-06-27T18:09:07+00:00 urn:sha1:c31f471e1447cb85ce143ca6d405fb7e37341198 This makes the code more self-documenting and avoids the ambiguity between ssl_sigalg the struct and ssl_sigalg the function. ok tb@ 2021-06-27T17:59:17+00:00 jsing 2021-06-27T17:59:17+00:00 urn:sha1:1c9c9d107a0bf12544815dd5cf115589ca003f12 Rather that doing sigalg list selection at every call site, pass in the appropriate TLS version and have ssl_sigalgs_build() perform the sigalg list selection itself. This reduces code duplication, simplifies the calling code and is the first step towards internalising the sigalg lists. ok tb@