A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9 2026-04-16T07:35:25+00:00 2026-04-16T07:35:25+00:00 tb 2026-04-16T07:35:25+00:00 urn:sha1:8662e35dbd36d8450a6d4c7188a65c580e4b339f Use tls_set_errorx() or tls_error_setx() rather than the versions without x for TLS_ERROR_OUT_OF_MEMORY. ENOMEM adds no further info. From Michael Forney ok bcook 2026-04-16T05:16:48+00:00 tb 2026-04-16T05:16:48+00:00 urn:sha1:d680a6fb78c5f1a30a0d45de7b989cee9631652a Like all proper libcrypto APIs, BIO_new_mem_buf() takes an int as a length argument. Check the size_t passed in to be at most INT_MAX to avoid issues with truncation and overflow like it's done everywhere else. After release this should probably be clamped down further since legitimate files (certs and keys) are nowhere near this large. Prompted by a diff by Michael Forney ok jsing 2024-06-11T16:35:24+00:00 op 2024-06-11T16:35:24+00:00 urn:sha1:90527c425b68e3277192a621ce09c1fc0f2a8b8d pthread -> mutex stdint -> uint8_t stdio.h -> asprintf stdlib.h -> calloc string.h -> memcpy ecdsa -> ECDSA_METHOD leftover, remove ec -> EC_KEY evp -> EVP_PKEY pem -> PEM_read_bio_X509 x509 -> X509 90% of the diff is from tb@, I only spotted the missing string.h :) ok tb@ 2024-03-28T06:55:02+00:00 joshua 2024-03-28T06:55:02+00:00 urn:sha1:d3012ebd0480445b9625c35635eb2e6849c6501a ok beck tb 2024-03-28T02:08:24+00:00 joshua 2024-03-28T02:08:24+00:00 urn:sha1:a7dd7b8d74e7f7e9f77b865ade3204f7e1c26188 ok jsing 2024-03-26T06:24:52+00:00 joshua 2024-03-26T06:24:52+00:00 urn:sha1:bd68c6e1694d8d4eb801f32889da4cdde0b3c311 This adds tls_config_error_code() and tls_error_code(), which will become public API at a later date. Additional error codes will be added in follow-up commits. ok jsing@ beck@ 2023-06-18T19:12:58+00:00 tb 2023-06-18T19:12:58+00:00 urn:sha1:5b4aa54e60e2d5fe326e551377f5d9278c8fbfb2 ... because RSA_meth_new() doesn't. So we can fortunately lose a few lines added in the previous commit. Three cheers for the masters of inconsistency. ok jsing 2023-06-18T17:50:28+00:00 tb 2023-06-18T17:50:28+00:00 urn:sha1:3bea7303183c6a111955e12c8c213b66ea3f3834 Previously, we would set the ECDSA_METHOD on the EC_KEY, which, by way of lovely indirection in our three crypto/ec* directories ended up having no effect on the default methods. Now that we set a new EC_KEY_METHOD, we need to make sure we still have the other handlers that we might need. Like so many things that were made opaque in the 1.1 re"design", the accessors were written without actual application code in mind. In particular, EC_KEY_METHOD lacks a dup(). This means we get to fetch the default methods with getters and then set them again on the new method. This is particularly awesome because once someone adds a new method to the opaque struct, all applications will have to adapt and do a get/set dance. So far this is very reminiscent of PostgreSQL with BIO_meth_* https://github.com/postgres/postgres/blob/a14e75eb0b6a73821e0d66c0d407372ec8376105/src/interfaces/libpq/fe-secure-openssl.c#L1921-L1928 Only it's worse here because someone wanted to be smart and save a few public functions, so we have to use getters that get several functions at once. Which in turn means we need to have function pointers with the precise signatures which are part of the struct that was made opaque. We will add a EC_KEY_METHOD_dup() in the next bump, but for now this is the best fix we can have. Whenever you think you've seen the worst turds in this code base, you find another one that could serve as an exemplar. ok jsing op 2023-06-18T17:24:09+00:00 tb 2023-06-18T17:24:09+00:00 urn:sha1:937d61f9ee1eedd96c77c2fd610a201a40c5776a Since libtls now sets the ex_data with EC_KEY_set_ex_data(), the do_sign() callback needs to have a matching change. ok jsing op 2023-06-18T11:43:03+00:00 op 2023-06-18T11:43:03+00:00 urn:sha1:d4df7cddd1d4ded9778f0ab6b2c234b2d54515c3 smtpd and the bits it needs in libtls are the only consumer left of ECDSA_METHOD, which is long deprecated. This paves the way for the removal in libcrypto. The diff is from gilles' work on OpenSMTPD-portable, libretls had a similar diff. ok tb@, jsing@