openbsd/src/lib, branch tb_20250802A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=tb_202508022025-08-02T06:16:35+00:00This commit was manufactured by cvs2git to create tag 'tb_20250802'.2025-08-02T06:16:35+00:00cvs2svnadmin@example.com2025-08-02T06:16:35+00:00urn:sha1:a397c95f8aea58533e72379d6e0de12683ecd0dcRework PKCS7_simple_smimecap()2025-07-31T02:24:21+00:00tb2025-07-31T02:24:21+00:00urn:sha1:939b14b31a0ec57a91982f54dd055e000bf5f6ac
This is nearly identical to CMS_add_simple_smimecap(). We can reuse
its doc comment mutatis mutandis and use the same construction.
Maybe this wants deduplicating. Maybe not.
ok kenjiro
Rework PKCS7_add1_attrib_digest()2025-07-31T02:21:01+00:00tb2025-07-31T02:21:01+00:00urn:sha1:0422dbe1ad1c175070e7cebc4bbb202b15ffea21
There's nothing really wrong here (at least when compared to the rest of
this file an hour or so ago), but we can make this look somewhat more like
code. That there's no bug here is not really related to the fact that it's
an add1 function, not an add0 one. In fact, it's kind of surprising that
the author had an uncharacteristic moment of lucidity and remembered to
free the last argument passed to PKCS7_add_signed_attribute() on failure.
ok kenjiro
Rewrite PKCS7_get_smimecap() to use d2i_X509_ALGORS()2025-07-31T02:10:55+00:00tb2025-07-31T02:10:55+00:00urn:sha1:4815d09a66fcc2a3ecabae72d77e841265da2451
Since we finally found a use for i2d_X509_ALGORS(), make use of its
sibling here. This avoids some ridiculous contortions in not quite
peak muppet code (obviously this was a first test run for the grand
finale in CMS).
ok kenjiro
Plug leaks due to misuse of PKCS7_add_signed_attribute()2025-07-31T02:02:35+00:00tb2025-07-31T02:02:35+00:00urn:sha1:5c9cc2d0035cb59dfcacb47001ca9b8392b3732b
set0/add0 functions that can fail are the worst. Without fail this trips
up both users and authors (by and large these are two identical groups
consisting of a single person), resulting in leaks and double frees.
In today's episode of spelunking in the gruesome gore provided by the
PKCS#7 and Time-Stamp protocol "implementations", we fix a couple of
leaks in PKCS7_add_attrib_smimecap() and ESS_add_signing_cert().
We do so by recalling that there is i2d_X509_ALGORS(), so we might
as well put it to use instead of inlining it poorly (aka, without
error checking). Normalize said error checking and ensure ownership
is handled correctly in the usual single-exit idiom.
ESS_add_signing_cert() can also make use of proper i2d handling, so
it's simpler and correct and in the end looks pretty much the same
as PKCS7_add_attrib_smimecap().
ok kenjiro
curve25519.c: zap trailing whitespace introduced in previous2025-07-29T10:52:20+00:00tb2025-07-29T10:52:20+00:00urn:sha1:ec8cce1dd4e99a67543a272dfa89573835b3d118PKCS7_add0_attrib_signing_time: tweak comment2025-07-28T04:29:00+00:00tb2025-07-28T04:29:00+00:00urn:sha1:24f1a240459f5178954a0c2f54c2afdd8a6f6e2eBelow STANDARDS, reference the two most relevant sections of RFC 5652.2025-07-27T19:31:20+00:00schwarze2025-07-27T19:31:20+00:00urn:sha1:e45df38fdf359c2b4dbbf04d6e24649c51a01b69
Given that RFC 5652 does not override the earlier (and simpler)
standards but instead strives to remain compatible, referencing
both the original and the latest versions seems helpful.
OK tb@
Remove DES_UNROLL from opensslconf.h.2025-07-27T13:27:09+00:00jsing2025-07-27T13:27:09+00:00urn:sha1:599b3fd3a83a856b8a4b92117e0c4e186c9a6f54
This is no longer used in the DES code.
ok tb@
Rework DES encryption/decryption loops.2025-07-27T13:26:24+00:00jsing2025-07-27T13:26:24+00:00urn:sha1:305717a23aaf1a0716fdfeb5149ac4a9b8e3393a
Use a slightly unrolled loop, which gets us half way between DES_UNROLL and
no DES_UNROLL. While we're not terribly concerned by DES performance, this
gets us a small gain on aarch64 and a small loss on arm. But above all, we
end up with simpler code.
ok tb@