openbsd/src/usr.bin/openssl/cms.c, branch OPENBSD_7_9_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE2025-12-20T07:02:37+00:00openssl: Remove -{,un}compress from cms "app"2025-12-20T07:02:37+00:00tb2025-12-20T07:02:37+00:00urn:sha1:c21eea145d12f7ab9b0fa83debe4931b485d1279
We haven't supported compiling against zlib in a very long time. These
are the only two calls to CMS_{,un}compress(3) in the ecosystem. I am
going to remove these two API stubs in the next major bump.
ok jsing kenjiro
openssl cms: switch to ASN1_STRING_get0_data()2025-11-27T08:27:31+00:00tb2025-11-27T08:27:31+00:00urn:sha1:a0443a8283b1ea5aa04375cf3487285eb68d97f7
The deprecated ASN1_STRING_data() will be removed in a future release.
This is one small step towards that.
ok kenjiro
openssl cms: switch default encryption from triple DES to AES-2562025-06-07T08:24:15+00:00tb2025-06-07T08:24:15+00:00urn:sha1:7b72154048126b0b3275f1155241bc13837e03c5
The old default is still available with "des3"
https://github.com/pyca/cryptography/issues/12949
https://github.com/libressl/portable/issues/1168
ok kenjiro
cms: disallow AEAD ciphers and AES XTS2025-05-10T05:25:43+00:00tb2025-05-10T05:25:43+00:00urn:sha1:a656363fbb9550a01cbf15c8cc74ef1a1064f9f6
The CMS code doesn't support RFC 5083/5084 authenticated enveloped data
and outputs garbage that even itself can't decrypt for a reason that I
have not tried to pinpoint. So refuse using AEAD ciphers and AES XTS for
enveloped data from the cms "app" and throw an error pointing out that
this isn't supported.
OpenSSL have since added incorrect support for AuthEnvelopedData (ASN.1
and code review are hard), so doing this right will need both correct and
interoperable code, which I doubt anyone will bother to write anytime soon.
Reported by Ben Cooper in https://github.com/libressl/portable/issues/1157
ok beck jsing
Add -CRLfile option to 'cms' sub command2024-08-12T15:34:58+00:00job2024-08-12T15:34:58+00:00urn:sha1:74ed67efcbb6bda895054baea22372140e2d3e99
This option allows to verify certs in a CMS object against additional
CRLs.
Ported from work by Tom Harrison from APNIC
OK tb@
Make a few purpose things const2023-11-21T17:56:19+00:00tb2023-11-21T17:56:19+00:00urn:sha1:cf8443276e8273969971b03dcddc0d59bc6eb1c9
This should allow us to constify a sizable table in libcrypto in an
upcoming bump.
Drop policy printing from openssl2023-04-14T15:27:13+00:00tb2023-04-14T15:27:13+00:00urn:sha1:c10c85651e3dc8e653705dc1c2dd2683fe0f6c66
Nothing really uses the policy tree. It's desgined with built-in DoS
capabilities directly from the RFC. It will be removed from the attack
surface and replaced with something equivalent that doesn't grow
exponentially with the depth.
This removes the only reason the policy tree itself ever leaked out of
the library.
ok jsing
Rename struct ${app}_config to plain cfg2023-03-06T14:32:06+00:00tb2023-03-06T14:32:06+00:00urn:sha1:2ba7dcfcbc2ef5aaeb8eb14f36f83bd57c22bcae
All the structs are static and we need to reach into them many times.
Having a shorter name is more concise and results in less visual clutter.
It also avoids many overlong lines and we will be able to get rid of some
unfortunate line wrapping down the road.
Discussed with jsing
openssl/cms: zap some trailing whitespace2023-03-05T13:08:22+00:00tb2023-03-05T13:08:22+00:00urn:sha1:4e7dac33e741d0213d9a2de12665bb52a037a8ffRemove the legacy interactive mode from openssl(1).2022-11-11T17:07:39+00:00joshua2022-11-11T17:07:39+00:00urn:sha1:273d9e16fc9e481283c2b2302b348e4863e29f28
This removes the legacy interactive mode from openssl(1) since it is
rarely used, complicates the code, and has also been removed from
OpenSSL in version 3.x.x.
ok tb@ jsing@