openbsd/src/lib/libtls, branch libressl-v3.8.0A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=libressl-v3.8.02023-05-25T07:46:21+00:00Forcibly update the EVP_PKEY's internal key2023-05-25T07:46:21+00:00op2023-05-25T07:46:21+00:00urn:sha1:38d31da6097a882f2d9c61b4831257122ba27fc1
To aid privilege separation, libtls maintains application-specific data
on the key inside the EVP_PKEY abstraction because the EVP API doesn't
provide a way to do that on the EVP_PKEY itself.
OpenSSL 3 changed behavior of EVP_PKEY_get1_RSA() and related functions.
These now return a struct from some cache. Thus, modifying the RSA will
no longer modify the EVP_PKEY like it did previously, which was clearly
implied to be the case in the older documentation.
This is a subtle breaking change that affects several applications.
While this is documented, no real solution is provided. The transition
plan from one OpenSSL major version to the next one tends to involve
many #ifdef in the ecosystem, and the only suggestion provided by the
new documentation is to switch to a completely unrelated, new API.
Instead, forcibly reset the internal key on EVP_PKEY after modification,
this way the change is picked up also by OpenSSL 3.
Fixes issue 1171 in OpenSMTPD-portable
ok tb@, jsing@
add missing #include <string.h>; ok tb@2023-05-14T07:26:25+00:00op2023-05-14T07:26:25+00:00urn:sha1:751c792967481bc8add0d09d060248a9d59cfadftls_verify.c: give up on variable alignment in this file2023-05-11T07:35:27+00:00tb2023-05-11T07:35:27+00:00urn:sha1:01d52bf8f3e9786643d6b21f45d1f3e55558554c
The previous commit resulted in misalignment, which impacts my OCD worse
than no alignment at all. Alignment wasn't consistently done in this file
anyway. op tells me it won't affect current efforts in reducing the diff.
switch two ASN1_STRING_data() to ASN1_STRING_get0_data()2023-05-10T13:48:54+00:00op2023-05-10T13:48:54+00:00urn:sha1:94bce9f5994c2e7ffd19283a376cd464cbb32303
and while here mark as const data.
This diff is actually from gilles@, in OpenSMTPD-portable bundled
libtls.
ok tb@, jsing@
Use -Wshadow with clang2023-05-05T21:23:02+00:00tb2023-05-05T21:23:02+00:00urn:sha1:549cbe92324cb49a0d9fce29e4ece1813496c88b
ok jsing (a very long time ago)
Fix error handling in tls_check_common_name()2023-05-05T14:05:33+00:00tb2023-05-05T14:05:33+00:00urn:sha1:3f6684ef99f4b237e9f27aff6c9cbd5ec55f5939
A calloc failure should be a fatal error, so make it return -1.
Also switch the default rv to -1 and distinguish error cases with
acceptable situations with goto err/goto done.
ok jsing
Bump majors after symbol addition and removal2023-04-25T15:54:19+00:00tb2023-04-25T15:54:19+00:00urn:sha1:12a3e7c29fbada9585cf0815c5f421e63692ed60Drop X9.31 support from libtls2023-04-09T18:26:26+00:00tb2023-04-09T18:26:26+00:00urn:sha1:f5072cf9562fff0cb2416b6d99a9975b34d4bbf3
The TLS signer isn't exposed in public API (we should finally fix it...)
and it supports X9.31, a standard that has been retired and deprecated for
a very long time. libcrypto will stop supporting it soon, this step is
needed to prepare userland.
ok jsing
Crankl libcrypto/libssl/libtls minors after symbol addition2023-03-10T16:45:50+00:00tb2023-03-10T16:45:50+00:00urn:sha1:fade9f4f04b548ca781e7f632f1d2cbed088db59Bump libtls minor to match libcrypto and libssl2022-11-13T14:07:15+00:00tb2022-11-13T14:07:15+00:00urn:sha1:4fb26602f2e5c0701783dcb35eb1b94cb55cbbea