summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/pkcs7
diff options
context:
space:
mode:
authortb <>2024-06-24 06:43:23 +0000
committertb <>2024-06-24 06:43:23 +0000
commit9bdf4013203aab2bc8161884feb7398faa560fa4 (patch)
tree5e01786fba8689c1ae97aaf149972572fbcd4015 /src/lib/libcrypto/pkcs7
parent8352adcf928da844a48a04816460acf0524fada9 (diff)
downloadopenbsd-9bdf4013203aab2bc8161884feb7398faa560fa4.tar.gz
openbsd-9bdf4013203aab2bc8161884feb7398faa560fa4.tar.bz2
openbsd-9bdf4013203aab2bc8161884feb7398faa560fa4.zip
libcrypto: constify most error string tables
These constitute the bulk of the remaining global mutable state in libcrypto. This commit moves most of them into data.rel.ro, leaving out ERR_str_{functs,libraries,reasons} (which require a slightly different approach) and SYS_str_reasons which is populated on startup. The main observation is that if ERR_load_strings() is called with a 0 lib argument, the ERR_STRING_DATA argument is not actually modified. We could use this fact to cast away const on the caller side and be done with it. We can make this cleaner by adding a helper ERR_load_const_strings() which explicitly avoids the assignment to str->error overriding the error code already set in the table. In order for this to work, we need to sprinkle some const in err/err.c. CMS called ERR_load_strings() with non-0 lib argument, but this didn't actually modify the error data since it ored in the value already stored in the table. Annoyingly, we need to cast const away once, namely in the call to lh_insert() in int_err_set_item(). Fixing this would require changing the public API and is going to be tricky since it requires that the LHASH_DOALL_FN_* types adjust. ok jsing
Diffstat (limited to 'src/lib/libcrypto/pkcs7')
-rw-r--r--src/lib/libcrypto/pkcs7/pkcs7err.c12
1 files changed, 7 insertions, 5 deletions
diff --git a/src/lib/libcrypto/pkcs7/pkcs7err.c b/src/lib/libcrypto/pkcs7/pkcs7err.c
index d3ca0ec6df..d4e6d7cf77 100644
--- a/src/lib/libcrypto/pkcs7/pkcs7err.c
+++ b/src/lib/libcrypto/pkcs7/pkcs7err.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: pkcs7err.c,v 1.15 2023/02/16 08:38:17 tb Exp $ */ 1/* $OpenBSD: pkcs7err.c,v 1.16 2024/06/24 06:43:22 tb Exp $ */
2/* ==================================================================== 2/* ====================================================================
3 * Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved. 3 * Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved.
4 * 4 *
@@ -60,17 +60,19 @@
60#include <openssl/err.h> 60#include <openssl/err.h>
61#include <openssl/pkcs7.h> 61#include <openssl/pkcs7.h>
62 62
63#include "err_local.h"
64
63#ifndef OPENSSL_NO_ERR 65#ifndef OPENSSL_NO_ERR
64 66
65#define ERR_FUNC(func) ERR_PACK(ERR_LIB_PKCS7,func,0) 67#define ERR_FUNC(func) ERR_PACK(ERR_LIB_PKCS7,func,0)
66#define ERR_REASON(reason) ERR_PACK(ERR_LIB_PKCS7,0,reason) 68#define ERR_REASON(reason) ERR_PACK(ERR_LIB_PKCS7,0,reason)
67 69
68static ERR_STRING_DATA PKCS7_str_functs[]= { 70static const ERR_STRING_DATA PKCS7_str_functs[] = {
69 {ERR_FUNC(0xfff), "CRYPTO_internal"}, 71 {ERR_FUNC(0xfff), "CRYPTO_internal"},
70 {0, NULL} 72 {0, NULL}
71}; 73};
72 74
73static ERR_STRING_DATA PKCS7_str_reasons[]= { 75static const ERR_STRING_DATA PKCS7_str_reasons[] = {
74 {ERR_REASON(PKCS7_R_CERTIFICATE_VERIFY_ERROR), "certificate verify error"}, 76 {ERR_REASON(PKCS7_R_CERTIFICATE_VERIFY_ERROR), "certificate verify error"},
75 {ERR_REASON(PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER), "cipher has no object identifier"}, 77 {ERR_REASON(PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER), "cipher has no object identifier"},
76 {ERR_REASON(PKCS7_R_CIPHER_NOT_INITIALIZED), "cipher not initialized"}, 78 {ERR_REASON(PKCS7_R_CIPHER_NOT_INITIALIZED), "cipher not initialized"},
@@ -135,8 +137,8 @@ ERR_load_PKCS7_strings(void)
135{ 137{
136#ifndef OPENSSL_NO_ERR 138#ifndef OPENSSL_NO_ERR
137 if (ERR_func_error_string(PKCS7_str_functs[0].error) == NULL) { 139 if (ERR_func_error_string(PKCS7_str_functs[0].error) == NULL) {
138 ERR_load_strings(0, PKCS7_str_functs); 140 ERR_load_const_strings(PKCS7_str_functs);
139 ERR_load_strings(0, PKCS7_str_reasons); 141 ERR_load_const_strings(PKCS7_str_reasons);
140 } 142 }
141#endif 143#endif
142} 144}