A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v3.2.0 2020-06-01T01:11:52+00:00 2020-06-01T01:11:52+00:00 bcook 2020-06-01T01:11:52+00:00 urn:sha1:a530903ba77b59c83670ee1290660474960bbf06 2020-05-31T18:03:32+00:00 jsing 2020-05-31T18:03:32+00:00 urn:sha1:354a3e8ef8994750d21e12eda969485e19c89844 Replace the only occurrence of ssl_max_server_version() with a call to ssl_downgrade_max_version() and remove ssl_max_server_version(). ok beck@ tb@ 2020-05-31T17:23:39+00:00 jsing 2020-05-31T17:23:39+00:00 urn:sha1:b58339bdd340fd191f9c64b87b63329517526f62 Currently, when building a certificate chain we look up an issuer and if it is the only issuer certificate available we still use it even if it has expired. When X509_V_FLAG_TRUSTED_FIRST is not in use, untrusted certificates are processed first and if one of these happens to be expired it will be used to build the chain, even if there is another non-expired option in the trusted store. Rework this code so that we first look for a non-expired untrusted certificate. If one does not exist then we take a look in the trusted store to see if we would be able to build the chain and only if there is not, do we then look for an expired untrusted certificate. This makes certificate validation possible for various sites that are serving expired AddTrust certificates. Issue reported by Christian Heimes via GitHub. ok beck@ tb@ 2020-05-31T16:36:35+00:00 jsing 2020-05-31T16:36:35+00:00 urn:sha1:059c16b3ca987ee98bd63a9cf4d0c58bfc02334e Previously only the enabled protocol versions were considered, however we also have to consider the method in use which may be version pinned. Found the hard way by danj@ with haproxy and force-tlsv12. ok beck@ inoguchi@ tb@ 2020-05-29T18:00:10+00:00 jsing 2020-05-29T18:00:10+00:00 urn:sha1:d1a8b3df6a3db04aefa03855f802f5bb704acb17 This allows an EC certificate to be selected and used, if the client sigalgs would allow it. With feedback from tb@ ok inoguchi@ tb@ 2020-05-29T17:54:58+00:00 jsing 2020-05-29T17:54:58+00:00 urn:sha1:7070918d4e1d615c3ccbeeb9ec2179558022a939 In this situation we cannot return zero bytes, as that signals EOF. Rather we need to return TLS13_IO_WANT_POLLIN so tell the caller to call us again, at which point we'll pull up the next record. ok tb@ 2020-05-29T17:47:30+00:00 jsing 2020-05-29T17:47:30+00:00 urn:sha1:e0e84f310956950abc8c5d9f225578b3f6945ee9 This makes SNI work correctly with TLSv1.3. Found the hard way by danj@, gonzalo@ and others. ok beck@ inoguchi@ tb@ 2020-05-29T17:39:42+00:00 jsing 2020-05-29T17:39:42+00:00 urn:sha1:0fa647cafcb45ea07c768d172165a3a041e8c58f ok beck@ inoguchi@ tb@ 2020-05-27T22:25:09+00:00 schwarze 2020-05-27T22:25:09+00:00 urn:sha1:865d79a51cfbda059a32d59a45f9a8981dc6b7ff The bug, present since 4.4BSD, was that a trailing dash in an option group, when the dash is not permitted as an option letter, resulted in the whole option group being returned as an argument, even though the previous option in the group was already parsed as an option: OPTS=abc ./getopt-test -a- -c arg ===>> OPT(a)ARG(-a-)ARG(-c)ARG(arg). Instead, treat the dash as an invalid option and continue parsing options: ===>> OPT(a)ERR(?-)OPT(c)ARG(arg). The undesirable behaviour was that allowing the dash as an option letter only allowed isolated dashes ("-") and trailing dashes in groups ("-a-"), but neither middle dashes in groups ("-a-b"), even though that already partially worked in 4.4BSD, nor leading dashes in groups ("--a"), even though that works on all other BSDs and on glibc. Also, while POSIX does not require that the dash can be used as an option letter at all, arguably, it encourages that letters either be fully supported or not supported at all. It is dubious whether supporting an option letter in some positions but not in others can be considered conforming. This patch makes OpenBSD behaviour identical to FreeBSD and NetBSD, improves compatibility with glibc (except that glibc does not support isolated "-"), improves compatibility with DragonFly (except that DragonFly is buggy when the dash option letter can take an optional argument but that argument is not present), improves compatibility with Illumos and Solaris 11 (except those do not support "-" and mishandle "--a"), and restores 4.4BSD behaviour for "-a-b". In no respect i'm aware of is compatibility with any other systems reduced. For the full rationale, see my mail to tech@ on 30 Mar 2020 14:26:41 +0200. Part of the problem was originally reported by an anonymous coward on tech@ on 12 Mar 2020 03:40:24 +0200, additional analysis was contributed by martijn@, and then the OP sent the final version of the patch i'm now committing on 17 Mar 2020 19:17:56 +0200. No licensing problem here because after the commit, the file does not contain a single word written by the OP. Also, the OP told me in private mail that he intends to publish the patch under the ISC license already contained in the file and that he wishes to be known by the pseudonym "0xef967c36". OK martijn@, and no objection when shown on tech@, but commit delayed to stay clear of the release. 2020-05-27T12:00:44+00:00 schwarze 2020-05-27T12:00:44+00:00 urn:sha1:f44dc3457b2a081f0f602f66a12246e4804f80b3 tweak and OK tb@