openbsd/src/lib/libtls/tls_ocsp.c, branch OPENBSD_7_9_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE2026-04-16T07:35:25+00:00libtls: consistently handle allocation failures2026-04-16T07:35:25+00:00tb2026-04-16T07:35:25+00:00urn:sha1:8662e35dbd36d8450a6d4c7188a65c580e4b339f
Use tls_set_errorx() or tls_error_setx() rather than the versions without
x for TLS_ERROR_OUT_OF_MEMORY. ENOMEM adds no further info.
From Michael Forney
ok bcook
libtls: prefer x version of error setting2026-04-16T07:28:00+00:00tb2026-04-16T07:28:00+00:00urn:sha1:4ab01251a636fac40d8a39e8cc3ba506580aa79b
If a check fails and errno is not necessarily set by the previous API call
use tls_set_errorx() or tls_error_setx() since turning an unrelated errno
into an error string is unhelpful.
From Michael Forney
ok bcook
libtls: const workarounds for X509_NAME in OCSP for OpenSSL 42026-03-28T11:49:31+00:00tb2026-03-28T11:49:31+00:00urn:sha1:f3cceccc18dfd4f96044df85f30c117f39b9cc9f
The API to look up a cert by subject or issuer name clearly only needs to
do name comparisons in a collection of certs so should by all means take a
const X509_NAME * as an argument. However, this isn't all that easy to do
and hence it's only in OpenSSL 4 that this obvious step was reached.
This means that there is no way around casting for older code. One could
cast the return value of X509_get_issuer_name() or the argument passed to
the two lookups by subject. jsing slightly prefers the second approach,
so this is what we do here.
ok djm jsing kenjiro
Add error code support to libtls2024-03-26T06:24:52+00:00joshua2024-03-26T06:24:52+00:00urn:sha1:bd68c6e1694d8d4eb801f32889da4cdde0b3c311
This adds tls_config_error_code() and tls_error_code(), which will become
public API at a later date.
Additional error codes will be added in follow-up commits.
ok jsing@ beck@
Convert libressl to use the BoringSSL style time conversions2024-03-24T11:30:12+00:00beck2024-03-24T11:30:12+00:00urn:sha1:0f167a53fa3e19b7e6bb0620e16c6d11f07f10ca
This gets rid of our last uses of timegm and gmtime in the
library and things that ship with it. It includes a bit
of refactoring in ocsp_cl.c to remove some obvious ugly.
ok tb@
Remove last caller of ASN1_time_parse(3) in libtls2023-11-13T10:56:19+00:00tb2023-11-13T10:56:19+00:00urn:sha1:687a261274bb4bb40ddf2906c38160413ceed08b
This one is slightly annoying since ASN1_TIME_to_tm(3) doesn't provide a
direct check for a GeneralizedTime, so call ASN1_GENERALIZEDTIME_check()
as well. This means LibreSSL parses the time twice. Shrug.
ok beck
add missing #include <string.h>; ok tb@2023-05-14T07:26:25+00:00op2023-05-14T07:26:25+00:00urn:sha1:751c792967481bc8add0d09d060248a9d59cfadfSimplify some code by using X509_STORE_CTX_get_obj_by_subject()2021-10-31T16:39:32+00:00tb2021-10-31T16:39:32+00:00urn:sha1:4b2d7af4c8adb53efa75fa9d33c763e5d15ef715
ok beck jsing
libtls: Don't reach into X509_STORE_CTX.2021-10-21T14:57:55+00:00tb2021-10-21T14:57:55+00:00urn:sha1:30a3fb2adcfed7598558c1a5958cd4666c0e1866
ok jsing
OCSP_basic_verify() doesn't set errno, so use tls_set_errorx()2021-03-23T20:04:29+00:00tb2021-03-23T20:04:29+00:00urn:sha1:9ed88205d42eaac13cb994ec2bfb335ddee622c8
ok inoguchi