A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9 2024-12-10T08:40:30+00:00 2024-12-10T08:40:30+00:00 tb 2024-12-10T08:40:30+00:00 urn:sha1:d3da05396af6da5d0c94da0425031aa4fd529ac9 There is currently no sane way of getting your hands on the common name or subject alternative name of the peer certificate from libtls. It is possible to extract it from the peer cert's PEM by hand, but that way lies madness. While the common name is close to being deprecated in the webpki, it is still the de facto standard to identify client certs. It would be nice to have a way to access the subject alternative names as well, but this is a lot more difficult to expose in a clean and sane C interface due to its multivaluedness. Initial diff from henning, with input from beck, jsing and myself henning and bluhm have plans of using this in syslogd. ok beck 2024-08-02T15:00:01+00:00 tb 2024-08-02T15:00:01+00:00 urn:sha1:b406bf2119594dc725dd7e537eb049151f94db87 Redefining TLS_PROTOCOL_TLSv1_0 and TLS_PROTOCOL_TLSv1_1 to be the same as TLS_PROTOCOL_TLSv1_2 had undesired side effects, as witnessed in the accompanying regress tests. The protocol string all:tlsv1.0 would disable TLSv1.2 (so only enable TLSv1.3) and tlsv1.2:!tlsv1.1 would disable all protocols. It makes more sense to ignore any setting of TLSv1.0 and TLSv1.1, so if you request 'tlsv1.1' you get no protocol, but 'all:!tlsv1.1' will enable the two supported protocols TLSv1.3 and TLSv1.2. Restore the defines to their original values and adjust the parsing code to set/unset them. Issue reported by Kenjiro Nakayama Fixes https://github.com/libressl/openbsd/issues/151 with/ok jsing 2024-03-27T07:35:30+00:00 joshua 2024-03-27T07:35:30+00:00 urn:sha1:2f91b3106eca7de0d2c1cd49842ac4b5e027fc63 This is an initial pass, defining the error code and using it for "too long"/length-related errors. ok beck jsing 2024-03-26T08:54:48+00:00 joshua 2024-03-26T08:54:48+00:00 urn:sha1:770136de1e8bfda122badbcfdd67920088e8d5fc ok jsing@ beck@ 2024-03-26T06:24:52+00:00 joshua 2024-03-26T06:24:52+00:00 urn:sha1:bd68c6e1694d8d4eb801f32889da4cdde0b3c311 This adds tls_config_error_code() and tls_error_code(), which will become public API at a later date. Additional error codes will be added in follow-up commits. ok jsing@ beck@ 2023-07-02T06:37:27+00:00 beck 2023-07-02T06:37:27+00:00 urn:sha1:908a2337ae4c28163a92b9fda969dbdd36bc634b With this change any requests from configurations to request versions of tls before tls 1.2 will use tls 1.2. This prepares us to deprecate tls 1.0 and tls 1.1 support from libssl. ok tb@ 2022-03-24T15:56:34+00:00 tb 2022-03-24T15:56:34+00:00 urn:sha1:3ec89a9ed2faefa8b6b6deaf561a2a72744e1335 should not be used. It will be revisited after release. ok beck inoguchi jsing 2022-02-01T17:18:38+00:00 jsing 2022-02-01T17:18:38+00:00 urn:sha1:1b0a76785c6e9fe8eb4f8f36bad366fe9a4d399c Rather than leaking libcrypto defines through the tls_sign_cb and tls_signer_sign() interfaces, provide and use our own TLS_PADDING_* defines. ok inoguchi@ tb@ 2022-02-01T17:13:10+00:00 jsing 2022-02-01T17:13:10+00:00 urn:sha1:f88d8440214889b6d855585bedc525a8ce92fc26 The current design of tls_sign_cb provides a pointer to a buffer where the signature needs to be copied, however it fails to provide a length which could result in buffer overwrites. Furthermore, tls_signer_sign() is designed such that it allocates and returns ownership to the caller. Revise tls_sign_cb so that the called function is expected to allocate a buffer, returning ownership of the buffer (along with its length) to the caller of the callback. This makes it far easier (and safer) to implement a tls_sign_cb callback, plus tls_signer_sign can be directly plugged in (with an appropriate cast). While here, rename and reorder some arguments - while we will normally sign a digest, there is no requirement for this to be the case hence use 'input' and 'input_len'. Move padding (an input) before the outputs and add some additional bounds/return value checks. This is technically an API/ABI break that would need a libtls major bump, however since nothing is using the signer interface (outside of regress), we'll ride the original minor bump. With input from tb@ ok inoguchi@ tb@ 2022-01-25T21:51:24+00:00 eric 2022-01-25T21:51:24+00:00 urn:sha1:bff2f4430c3c0f9cc4584883118372ffbdcbd1e6 to implement. Add a tls_config_set_sign_cb() function that allows to register a callback for the signing operation on a tls_config. When used, the context installs fake pivate keys internally, and the callback receives the hash of the public key. Add a tls_signer_*() set of functions to manage tls_signer objects. A tls_signer is an opaque structure on which keys are added. It is used to compute signatures with private keys identified by their associated public key hash. Discussed with and ok jsing@ tb@