summaryrefslogtreecommitdiff
path: root/src/lib
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib')
-rw-r--r--src/lib/libssl/src/ssl/ssl_asn1.c323
-rw-r--r--src/lib/libssl/ssl_asn1.c323
2 files changed, 594 insertions, 52 deletions
diff --git a/src/lib/libssl/src/ssl/ssl_asn1.c b/src/lib/libssl/src/ssl/ssl_asn1.c
index 97034c98c5..90071000de 100644
--- a/src/lib/libssl/src/ssl/ssl_asn1.c
+++ b/src/lib/libssl/src/ssl/ssl_asn1.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_asn1.c,v 1.33 2014/07/13 16:43:37 jsing Exp $ */ 1/* $OpenBSD: ssl_asn1.c,v 1.34 2014/07/13 17:56:56 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -61,10 +61,13 @@
61 61
62#include "ssl_locl.h" 62#include "ssl_locl.h"
63 63
64#include <openssl/asn1_mac.h>
65#include <openssl/objects.h> 64#include <openssl/objects.h>
66#include <openssl/x509.h> 65#include <openssl/x509.h>
67 66
67/* XXX - these are here to avoid including asn1_mac.h */
68int asn1_GetSequence(ASN1_const_CTX *c, long *length);
69void asn1_add_error(const unsigned char *address, int offset);
70
68typedef struct ssl_session_asn1_st { 71typedef struct ssl_session_asn1_st {
69 ASN1_INTEGER version; 72 ASN1_INTEGER version;
70 ASN1_INTEGER ssl_version; 73 ASN1_INTEGER ssl_version;
@@ -252,27 +255,52 @@ i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
252 /* 12 - SRP username. */ 255 /* 12 - SRP username. */
253 256
254 *pp = p; 257 *pp = p;
255 return (ret); 258 return (ret);
256} 259}
257 260
258SSL_SESSION * 261SSL_SESSION *
259d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length) 262d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
260{ 263{
261 int ssl_version = 0, i; 264 SSL_SESSION *ret = NULL;
262 long id; 265 ASN1_const_CTX c;
263 ASN1_INTEGER ai, *aip; 266 ASN1_INTEGER ai, *aip;
264 ASN1_OCTET_STRING os, *osp; 267 ASN1_OCTET_STRING os, *osp;
265 M_ASN1_D2I_vars(a, SSL_SESSION *, SSL_SESSION_new); 268 int ssl_version = 0, i;
269 int Tinf, Ttag, Tclass;
270 long Tlen;
271 long id;
272
273 c.pp = pp;
274 c.p = *pp;
275 c.q = *pp;
276 c.max = (length == 0) ? 0 : (c.p + length);
277 c.error = ERR_R_NESTED_ASN1_ERROR;
278
279 if (a == NULL || *a == NULL) {
280 if ((ret = SSL_SESSION_new()) == NULL) {
281 c.line = __LINE__;
282 goto err;
283 }
284 } else
285 ret = *a;
266 286
267 aip = &ai; 287 aip = &ai;
268 osp = &os; 288 osp = &os;
269 289
270 M_ASN1_D2I_Init(); 290 if (!asn1_GetSequence(&c, &length)) {
271 M_ASN1_D2I_start_sequence(); 291 c.line = __LINE__;
292 goto err;
293 }
272 294
273 ai.data = NULL; 295 ai.data = NULL;
274 ai.length = 0; 296 ai.length = 0;
275 M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER); 297 c.q = c.p;
298 if (d2i_ASN1_INTEGER(&aip, &c.p, c.slen) == NULL) {
299 c.line = __LINE__;
300 goto err;
301 }
302 c.slen -= (c.p - c.q);
303
276 if (ai.data != NULL) { 304 if (ai.data != NULL) {
277 free(ai.data); 305 free(ai.data);
278 ai.data = NULL; 306 ai.data = NULL;
@@ -280,7 +308,12 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
280 } 308 }
281 309
282 /* we don't care about the version right now :-) */ 310 /* we don't care about the version right now :-) */
283 M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER); 311 c.q = c.p;
312 if (d2i_ASN1_INTEGER(&aip, &c.p, c.slen) == NULL) {
313 c.line = __LINE__;
314 goto err;
315 }
316 c.slen -= (c.p - c.q);
284 ssl_version = (int)ASN1_INTEGER_get(aip); 317 ssl_version = (int)ASN1_INTEGER_get(aip);
285 ret->ssl_version = ssl_version; 318 ret->ssl_version = ssl_version;
286 if (ai.data != NULL) { 319 if (ai.data != NULL) {
@@ -291,7 +324,12 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
291 324
292 os.data = NULL; 325 os.data = NULL;
293 os.length = 0; 326 os.length = 0;
294 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING); 327 c.q = c.p;
328 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, c.slen) == NULL) {
329 c.line = __LINE__;
330 goto err;
331 }
332 c.slen -= (c.p - c.q);
295 if ((ssl_version >> 8) >= SSL3_VERSION_MAJOR) { 333 if ((ssl_version >> 8) >= SSL3_VERSION_MAJOR) {
296 if (os.length != 2) { 334 if (os.length != 2) {
297 c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH; 335 c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
@@ -309,9 +347,14 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
309 ret->cipher = NULL; 347 ret->cipher = NULL;
310 ret->cipher_id = id; 348 ret->cipher_id = id;
311 349
312 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING); 350 c.q = c.p;
313 i = SSL3_MAX_SSL_SESSION_ID_LENGTH; 351 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, c.slen) == NULL) {
352 c.line = __LINE__;
353 goto err;
354 }
355 c.slen -= (c.p - c.q);
314 356
357 i = SSL3_MAX_SSL_SESSION_ID_LENGTH;
315 if (os.length > i) 358 if (os.length > i)
316 os.length = i; 359 os.length = i;
317 if (os.length > (int)sizeof(ret->session_id)) /* can't happen */ 360 if (os.length > (int)sizeof(ret->session_id)) /* can't happen */
@@ -321,7 +364,12 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
321 OPENSSL_assert(os.length <= (int)sizeof(ret->session_id)); 364 OPENSSL_assert(os.length <= (int)sizeof(ret->session_id));
322 memcpy(ret->session_id, os.data, os.length); 365 memcpy(ret->session_id, os.data, os.length);
323 366
324 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING); 367 c.q = c.p;
368 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, c.slen) == NULL) {
369 c.line = __LINE__;
370 goto err;
371 }
372 c.slen -= (c.p - c.q);
325 if (os.length > SSL_MAX_MASTER_KEY_LENGTH) 373 if (os.length > SSL_MAX_MASTER_KEY_LENGTH)
326 ret->master_key_length = SSL_MAX_MASTER_KEY_LENGTH; 374 ret->master_key_length = SSL_MAX_MASTER_KEY_LENGTH;
327 else 375 else
@@ -330,9 +378,34 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
330 378
331 os.length = 0; 379 os.length = 0;
332 380
333 381 /* 1 - Time (INTEGER). */
382 /* XXX 2038 */
334 ai.length = 0; 383 ai.length = 0;
335 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 1); /* XXX 2038 */ 384 if (c.slen != 0L &&
385 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 1)) {
386 c.q = c.p;
387 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
388 if (Tinf & 0x80) {
389 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
390 c.line = __LINE__;
391 goto err;
392 }
393 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
394 Tlen = c.slen - (c.p - c.q) - 2;
395 if (d2i_ASN1_INTEGER(&aip, &c.p, Tlen) == NULL) {
396 c.line = __LINE__;
397 goto err;
398 }
399 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
400 Tlen = c.slen - (c.p - c.q);
401 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
402 c.error = ERR_R_MISSING_ASN1_EOS;
403 c.line = __LINE__;
404 goto err;
405 }
406 }
407 c.slen -= (c.p - c.q);
408 }
336 if (ai.data != NULL) { 409 if (ai.data != NULL) {
337 ret->time = ASN1_INTEGER_get(aip); 410 ret->time = ASN1_INTEGER_get(aip);
338 free(ai.data); 411 free(ai.data);
@@ -341,8 +414,33 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
341 } else 414 } else
342 ret->time = time(NULL); 415 ret->time = time(NULL);
343 416
417 /* 2 - Timeout (INTEGER). */
344 ai.length = 0; 418 ai.length = 0;
345 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 2); 419 if (c.slen != 0L &&
420 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 2)) {
421 c.q = c.p;
422 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
423 if (Tinf & 0x80) {
424 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
425 c.line = __LINE__;
426 goto err;
427 }
428 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
429 Tlen = c.slen - (c.p - c.q) - 2;
430 if (d2i_ASN1_INTEGER(&aip, &c.p, Tlen) == NULL) {
431 c.line = __LINE__;
432 goto err;
433 }
434 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
435 Tlen = c.slen - (c.p - c.q);
436 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
437 c.error = ERR_R_MISSING_ASN1_EOS;
438 c.line = __LINE__;
439 goto err;
440 }
441 }
442 c.slen -= (c.p - c.q);
443 }
346 if (ai.data != NULL) { 444 if (ai.data != NULL) {
347 ret->timeout = ASN1_INTEGER_get(aip); 445 ret->timeout = ASN1_INTEGER_get(aip);
348 free(ai.data); 446 free(ai.data);
@@ -351,16 +449,65 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
351 } else 449 } else
352 ret->timeout = 3; 450 ret->timeout = 3;
353 451
452 /* 3 - Peer (X509). */
354 if (ret->peer != NULL) { 453 if (ret->peer != NULL) {
355 X509_free(ret->peer); 454 X509_free(ret->peer);
356 ret->peer = NULL; 455 ret->peer = NULL;
357 } 456 }
358 M_ASN1_D2I_get_EXP_opt(ret->peer, d2i_X509, 3); 457 if (c.slen != 0L &&
458 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 3)) {
459 c.q = c.p;
460 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
461 if (Tinf & 0x80) {
462 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
463 c.line = __LINE__;
464 goto err;
465 }
466 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
467 Tlen = c.slen - (c.p - c.q) - 2;
468 if (d2i_X509(&ret->peer, &c.p, Tlen) == NULL) {
469 c.line = __LINE__;
470 goto err;
471 }
472 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
473 Tlen = c.slen - (c.p - c.q);
474 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
475 c.error = ERR_R_MISSING_ASN1_EOS;
476 c.line = __LINE__;
477 goto err;
478 }
479 }
480 c.slen -= (c.p - c.q);
481 }
359 482
483 /* 4 - Session ID (OCTET STRING). */
360 os.length = 0; 484 os.length = 0;
361 os.data = NULL; 485 os.data = NULL;
362 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 4); 486 if (c.slen != 0L &&
363 487 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 4)) {
488 c.q = c.p;
489 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
490 if (Tinf & 0x80) {
491 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
492 c.line = __LINE__;
493 goto err;
494 }
495 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
496 Tlen = c.slen - (c.p - c.q) - 2;
497 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, Tlen) == NULL) {
498 c.line = __LINE__;
499 goto err;
500 }
501 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
502 Tlen = c.slen - (c.p - c.q);
503 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
504 c.error = ERR_R_MISSING_ASN1_EOS;
505 c.line = __LINE__;
506 goto err;
507 }
508 }
509 c.slen -= (c.p - c.q);
510 }
364 if (os.data != NULL) { 511 if (os.data != NULL) {
365 if (os.length > SSL_MAX_SID_CTX_LENGTH) { 512 if (os.length > SSL_MAX_SID_CTX_LENGTH) {
366 c.error = SSL_R_BAD_LENGTH; 513 c.error = SSL_R_BAD_LENGTH;
@@ -376,8 +523,33 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
376 } else 523 } else
377 ret->sid_ctx_length = 0; 524 ret->sid_ctx_length = 0;
378 525
526 /* 5 - Verify_result. */
379 ai.length = 0; 527 ai.length = 0;
380 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 5); 528 if (c.slen != 0L &&
529 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 5)) {
530 c.q = c.p;
531 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
532 if (Tinf & 0x80) {
533 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
534 c.line = __LINE__;
535 goto err;
536 }
537 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
538 Tlen = c.slen - (c.p - c.q) - 2;
539 if (d2i_ASN1_INTEGER(&aip, &c.p, Tlen) == NULL) {
540 c.line = __LINE__;
541 goto err;
542 }
543 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
544 Tlen = c.slen - (c.p - c.q);
545 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
546 c.error = ERR_R_MISSING_ASN1_EOS;
547 c.line = __LINE__;
548 goto err;
549 }
550 }
551 c.slen -= (c.p - c.q);
552 }
381 if (ai.data != NULL) { 553 if (ai.data != NULL) {
382 ret->verify_result = ASN1_INTEGER_get(aip); 554 ret->verify_result = ASN1_INTEGER_get(aip);
383 free(ai.data); 555 free(ai.data);
@@ -386,9 +558,34 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
386 } else 558 } else
387 ret->verify_result = X509_V_OK; 559 ret->verify_result = X509_V_OK;
388 560
561 /* 6 - HostName (OCTET STRING). */
389 os.length = 0; 562 os.length = 0;
390 os.data = NULL; 563 os.data = NULL;
391 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 6); 564 if (c.slen != 0L &&
565 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 6)) {
566 c.q = c.p;
567 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
568 if (Tinf & 0x80) {
569 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
570 c.line = __LINE__;
571 goto err;
572 }
573 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
574 Tlen = c.slen - (c.p - c.q) - 2;
575 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, Tlen) == NULL) {
576 c.line = __LINE__;
577 goto err;
578 }
579 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
580 Tlen = c.slen - (c.p - c.q);
581 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
582 c.error = ERR_R_MISSING_ASN1_EOS;
583 c.line = __LINE__;
584 goto err;
585 }
586 }
587 c.slen -= (c.p - c.q);
588 }
392 if (os.data) { 589 if (os.data) {
393 ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length); 590 ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length);
394 free(os.data); 591 free(os.data);
@@ -397,21 +594,74 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
397 } else 594 } else
398 ret->tlsext_hostname = NULL; 595 ret->tlsext_hostname = NULL;
399 596
597 /* 7 - PSK identity hint (OCTET STRING). */
598 /* 8 - PSK identity (OCTET STRING). */
400 599
600 /* 9 - Ticket lifetime. */
401 ai.length = 0; 601 ai.length = 0;
402 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 9); 602 if (c.slen != 0L &&
603 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 9)) {
604 c.q = c.p;
605 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
606 if (Tinf & 0x80) {
607 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
608 c.line = __LINE__;
609 goto err;
610 }
611 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
612 Tlen = c.slen - (c.p - c.q) - 2;
613 if (d2i_ASN1_INTEGER(&aip, &c.p, Tlen) == NULL) {
614 c.line = __LINE__;
615 goto err;
616 }
617 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
618 Tlen = c.slen - (c.p - c.q);
619 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
620 c.error = ERR_R_MISSING_ASN1_EOS;
621 c.line = __LINE__;
622 goto err;
623 }
624 }
625 c.slen -= (c.p - c.q);
626 }
403 if (ai.data != NULL) { 627 if (ai.data != NULL) {
404 ret->tlsext_tick_lifetime_hint = ASN1_INTEGER_get(aip); 628 ret->tlsext_tick_lifetime_hint = ASN1_INTEGER_get(aip);
405 free(ai.data); 629 free(ai.data);
406 ai.data = NULL; 630 ai.data = NULL;
407 ai.length = 0; 631 ai.length = 0;
408 } else if (ret->tlsext_ticklen && ret->session_id_length) 632 } else if (ret->tlsext_ticklen && ret->session_id_length)
409 ret->tlsext_tick_lifetime_hint = -1; 633 ret->tlsext_tick_lifetime_hint = -1;
410 else 634 else
411 ret->tlsext_tick_lifetime_hint = 0; 635 ret->tlsext_tick_lifetime_hint = 0;
412 os.length = 0; 636 os.length = 0;
413 os.data = NULL; 637 os.data = NULL;
414 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 10); 638
639 /* 10 - Ticket (OCTET STRING). */
640 if (c.slen != 0L &&
641 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 10)) {
642 c.q = c.p;
643 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
644 if (Tinf & 0x80) {
645 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
646 c.line = __LINE__;
647 goto err;
648 }
649 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
650 Tlen = c.slen - (c.p - c.q) - 2;
651 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, Tlen) == NULL) {
652 c.line = __LINE__;
653 goto err;
654 }
655 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
656 Tlen = c.slen - (c.p - c.q);
657 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
658 c.error = ERR_R_MISSING_ASN1_EOS;
659 c.line = __LINE__;
660 goto err;
661 }
662 }
663 c.slen -= (c.p - c.q);
664 }
415 if (os.data) { 665 if (os.data) {
416 ret->tlsext_tick = os.data; 666 ret->tlsext_tick = os.data;
417 ret->tlsext_ticklen = os.length; 667 ret->tlsext_ticklen = os.length;
@@ -420,5 +670,26 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
420 } else 670 } else
421 ret->tlsext_tick = NULL; 671 ret->tlsext_tick = NULL;
422 672
423 M_ASN1_D2I_Finish(a, SSL_SESSION_free, SSL_F_D2I_SSL_SESSION); 673 /* 11 - Compression method (OCTET STRING). */
674 /* 12 - SRP username (OCTET STRING). */
675
676 if (!asn1_const_Finish(&c)) {
677 c.line = __LINE__;
678 goto err;
679 }
680
681 *pp = c.p;
682 if (a != NULL)
683 *a = ret;
684
685 return (ret);
686
687err:
688 ERR_PUT_error(ERR_LIB_SSL, SSL_F_D2I_SSL_SESSION,
689 c.error, __FILE__, c.line);
690 asn1_add_error(*pp, (int)(c.q - *pp));
691 if (ret != NULL && (a == NULL || *a != ret))
692 SSL_SESSION_free(ret);
693
694 return (NULL);
424} 695}
diff --git a/src/lib/libssl/ssl_asn1.c b/src/lib/libssl/ssl_asn1.c
index 97034c98c5..90071000de 100644
--- a/src/lib/libssl/ssl_asn1.c
+++ b/src/lib/libssl/ssl_asn1.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_asn1.c,v 1.33 2014/07/13 16:43:37 jsing Exp $ */ 1/* $OpenBSD: ssl_asn1.c,v 1.34 2014/07/13 17:56:56 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -61,10 +61,13 @@
61 61
62#include "ssl_locl.h" 62#include "ssl_locl.h"
63 63
64#include <openssl/asn1_mac.h>
65#include <openssl/objects.h> 64#include <openssl/objects.h>
66#include <openssl/x509.h> 65#include <openssl/x509.h>
67 66
67/* XXX - these are here to avoid including asn1_mac.h */
68int asn1_GetSequence(ASN1_const_CTX *c, long *length);
69void asn1_add_error(const unsigned char *address, int offset);
70
68typedef struct ssl_session_asn1_st { 71typedef struct ssl_session_asn1_st {
69 ASN1_INTEGER version; 72 ASN1_INTEGER version;
70 ASN1_INTEGER ssl_version; 73 ASN1_INTEGER ssl_version;
@@ -252,27 +255,52 @@ i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
252 /* 12 - SRP username. */ 255 /* 12 - SRP username. */
253 256
254 *pp = p; 257 *pp = p;
255 return (ret); 258 return (ret);
256} 259}
257 260
258SSL_SESSION * 261SSL_SESSION *
259d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length) 262d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
260{ 263{
261 int ssl_version = 0, i; 264 SSL_SESSION *ret = NULL;
262 long id; 265 ASN1_const_CTX c;
263 ASN1_INTEGER ai, *aip; 266 ASN1_INTEGER ai, *aip;
264 ASN1_OCTET_STRING os, *osp; 267 ASN1_OCTET_STRING os, *osp;
265 M_ASN1_D2I_vars(a, SSL_SESSION *, SSL_SESSION_new); 268 int ssl_version = 0, i;
269 int Tinf, Ttag, Tclass;
270 long Tlen;
271 long id;
272
273 c.pp = pp;
274 c.p = *pp;
275 c.q = *pp;
276 c.max = (length == 0) ? 0 : (c.p + length);
277 c.error = ERR_R_NESTED_ASN1_ERROR;
278
279 if (a == NULL || *a == NULL) {
280 if ((ret = SSL_SESSION_new()) == NULL) {
281 c.line = __LINE__;
282 goto err;
283 }
284 } else
285 ret = *a;
266 286
267 aip = &ai; 287 aip = &ai;
268 osp = &os; 288 osp = &os;
269 289
270 M_ASN1_D2I_Init(); 290 if (!asn1_GetSequence(&c, &length)) {
271 M_ASN1_D2I_start_sequence(); 291 c.line = __LINE__;
292 goto err;
293 }
272 294
273 ai.data = NULL; 295 ai.data = NULL;
274 ai.length = 0; 296 ai.length = 0;
275 M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER); 297 c.q = c.p;
298 if (d2i_ASN1_INTEGER(&aip, &c.p, c.slen) == NULL) {
299 c.line = __LINE__;
300 goto err;
301 }
302 c.slen -= (c.p - c.q);
303
276 if (ai.data != NULL) { 304 if (ai.data != NULL) {
277 free(ai.data); 305 free(ai.data);
278 ai.data = NULL; 306 ai.data = NULL;
@@ -280,7 +308,12 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
280 } 308 }
281 309
282 /* we don't care about the version right now :-) */ 310 /* we don't care about the version right now :-) */
283 M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER); 311 c.q = c.p;
312 if (d2i_ASN1_INTEGER(&aip, &c.p, c.slen) == NULL) {
313 c.line = __LINE__;
314 goto err;
315 }
316 c.slen -= (c.p - c.q);
284 ssl_version = (int)ASN1_INTEGER_get(aip); 317 ssl_version = (int)ASN1_INTEGER_get(aip);
285 ret->ssl_version = ssl_version; 318 ret->ssl_version = ssl_version;
286 if (ai.data != NULL) { 319 if (ai.data != NULL) {
@@ -291,7 +324,12 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
291 324
292 os.data = NULL; 325 os.data = NULL;
293 os.length = 0; 326 os.length = 0;
294 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING); 327 c.q = c.p;
328 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, c.slen) == NULL) {
329 c.line = __LINE__;
330 goto err;
331 }
332 c.slen -= (c.p - c.q);
295 if ((ssl_version >> 8) >= SSL3_VERSION_MAJOR) { 333 if ((ssl_version >> 8) >= SSL3_VERSION_MAJOR) {
296 if (os.length != 2) { 334 if (os.length != 2) {
297 c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH; 335 c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
@@ -309,9 +347,14 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
309 ret->cipher = NULL; 347 ret->cipher = NULL;
310 ret->cipher_id = id; 348 ret->cipher_id = id;
311 349
312 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING); 350 c.q = c.p;
313 i = SSL3_MAX_SSL_SESSION_ID_LENGTH; 351 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, c.slen) == NULL) {
352 c.line = __LINE__;
353 goto err;
354 }
355 c.slen -= (c.p - c.q);
314 356
357 i = SSL3_MAX_SSL_SESSION_ID_LENGTH;
315 if (os.length > i) 358 if (os.length > i)
316 os.length = i; 359 os.length = i;
317 if (os.length > (int)sizeof(ret->session_id)) /* can't happen */ 360 if (os.length > (int)sizeof(ret->session_id)) /* can't happen */
@@ -321,7 +364,12 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
321 OPENSSL_assert(os.length <= (int)sizeof(ret->session_id)); 364 OPENSSL_assert(os.length <= (int)sizeof(ret->session_id));
322 memcpy(ret->session_id, os.data, os.length); 365 memcpy(ret->session_id, os.data, os.length);
323 366
324 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING); 367 c.q = c.p;
368 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, c.slen) == NULL) {
369 c.line = __LINE__;
370 goto err;
371 }
372 c.slen -= (c.p - c.q);
325 if (os.length > SSL_MAX_MASTER_KEY_LENGTH) 373 if (os.length > SSL_MAX_MASTER_KEY_LENGTH)
326 ret->master_key_length = SSL_MAX_MASTER_KEY_LENGTH; 374 ret->master_key_length = SSL_MAX_MASTER_KEY_LENGTH;
327 else 375 else
@@ -330,9 +378,34 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
330 378
331 os.length = 0; 379 os.length = 0;
332 380
333 381 /* 1 - Time (INTEGER). */
382 /* XXX 2038 */
334 ai.length = 0; 383 ai.length = 0;
335 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 1); /* XXX 2038 */ 384 if (c.slen != 0L &&
385 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 1)) {
386 c.q = c.p;
387 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
388 if (Tinf & 0x80) {
389 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
390 c.line = __LINE__;
391 goto err;
392 }
393 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
394 Tlen = c.slen - (c.p - c.q) - 2;
395 if (d2i_ASN1_INTEGER(&aip, &c.p, Tlen) == NULL) {
396 c.line = __LINE__;
397 goto err;
398 }
399 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
400 Tlen = c.slen - (c.p - c.q);
401 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
402 c.error = ERR_R_MISSING_ASN1_EOS;
403 c.line = __LINE__;
404 goto err;
405 }
406 }
407 c.slen -= (c.p - c.q);
408 }
336 if (ai.data != NULL) { 409 if (ai.data != NULL) {
337 ret->time = ASN1_INTEGER_get(aip); 410 ret->time = ASN1_INTEGER_get(aip);
338 free(ai.data); 411 free(ai.data);
@@ -341,8 +414,33 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
341 } else 414 } else
342 ret->time = time(NULL); 415 ret->time = time(NULL);
343 416
417 /* 2 - Timeout (INTEGER). */
344 ai.length = 0; 418 ai.length = 0;
345 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 2); 419 if (c.slen != 0L &&
420 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 2)) {
421 c.q = c.p;
422 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
423 if (Tinf & 0x80) {
424 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
425 c.line = __LINE__;
426 goto err;
427 }
428 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
429 Tlen = c.slen - (c.p - c.q) - 2;
430 if (d2i_ASN1_INTEGER(&aip, &c.p, Tlen) == NULL) {
431 c.line = __LINE__;
432 goto err;
433 }
434 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
435 Tlen = c.slen - (c.p - c.q);
436 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
437 c.error = ERR_R_MISSING_ASN1_EOS;
438 c.line = __LINE__;
439 goto err;
440 }
441 }
442 c.slen -= (c.p - c.q);
443 }
346 if (ai.data != NULL) { 444 if (ai.data != NULL) {
347 ret->timeout = ASN1_INTEGER_get(aip); 445 ret->timeout = ASN1_INTEGER_get(aip);
348 free(ai.data); 446 free(ai.data);
@@ -351,16 +449,65 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
351 } else 449 } else
352 ret->timeout = 3; 450 ret->timeout = 3;
353 451
452 /* 3 - Peer (X509). */
354 if (ret->peer != NULL) { 453 if (ret->peer != NULL) {
355 X509_free(ret->peer); 454 X509_free(ret->peer);
356 ret->peer = NULL; 455 ret->peer = NULL;
357 } 456 }
358 M_ASN1_D2I_get_EXP_opt(ret->peer, d2i_X509, 3); 457 if (c.slen != 0L &&
458 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 3)) {
459 c.q = c.p;
460 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
461 if (Tinf & 0x80) {
462 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
463 c.line = __LINE__;
464 goto err;
465 }
466 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
467 Tlen = c.slen - (c.p - c.q) - 2;
468 if (d2i_X509(&ret->peer, &c.p, Tlen) == NULL) {
469 c.line = __LINE__;
470 goto err;
471 }
472 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
473 Tlen = c.slen - (c.p - c.q);
474 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
475 c.error = ERR_R_MISSING_ASN1_EOS;
476 c.line = __LINE__;
477 goto err;
478 }
479 }
480 c.slen -= (c.p - c.q);
481 }
359 482
483 /* 4 - Session ID (OCTET STRING). */
360 os.length = 0; 484 os.length = 0;
361 os.data = NULL; 485 os.data = NULL;
362 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 4); 486 if (c.slen != 0L &&
363 487 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 4)) {
488 c.q = c.p;
489 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
490 if (Tinf & 0x80) {
491 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
492 c.line = __LINE__;
493 goto err;
494 }
495 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
496 Tlen = c.slen - (c.p - c.q) - 2;
497 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, Tlen) == NULL) {
498 c.line = __LINE__;
499 goto err;
500 }
501 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
502 Tlen = c.slen - (c.p - c.q);
503 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
504 c.error = ERR_R_MISSING_ASN1_EOS;
505 c.line = __LINE__;
506 goto err;
507 }
508 }
509 c.slen -= (c.p - c.q);
510 }
364 if (os.data != NULL) { 511 if (os.data != NULL) {
365 if (os.length > SSL_MAX_SID_CTX_LENGTH) { 512 if (os.length > SSL_MAX_SID_CTX_LENGTH) {
366 c.error = SSL_R_BAD_LENGTH; 513 c.error = SSL_R_BAD_LENGTH;
@@ -376,8 +523,33 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
376 } else 523 } else
377 ret->sid_ctx_length = 0; 524 ret->sid_ctx_length = 0;
378 525
526 /* 5 - Verify_result. */
379 ai.length = 0; 527 ai.length = 0;
380 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 5); 528 if (c.slen != 0L &&
529 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 5)) {
530 c.q = c.p;
531 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
532 if (Tinf & 0x80) {
533 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
534 c.line = __LINE__;
535 goto err;
536 }
537 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
538 Tlen = c.slen - (c.p - c.q) - 2;
539 if (d2i_ASN1_INTEGER(&aip, &c.p, Tlen) == NULL) {
540 c.line = __LINE__;
541 goto err;
542 }
543 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
544 Tlen = c.slen - (c.p - c.q);
545 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
546 c.error = ERR_R_MISSING_ASN1_EOS;
547 c.line = __LINE__;
548 goto err;
549 }
550 }
551 c.slen -= (c.p - c.q);
552 }
381 if (ai.data != NULL) { 553 if (ai.data != NULL) {
382 ret->verify_result = ASN1_INTEGER_get(aip); 554 ret->verify_result = ASN1_INTEGER_get(aip);
383 free(ai.data); 555 free(ai.data);
@@ -386,9 +558,34 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
386 } else 558 } else
387 ret->verify_result = X509_V_OK; 559 ret->verify_result = X509_V_OK;
388 560
561 /* 6 - HostName (OCTET STRING). */
389 os.length = 0; 562 os.length = 0;
390 os.data = NULL; 563 os.data = NULL;
391 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 6); 564 if (c.slen != 0L &&
565 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 6)) {
566 c.q = c.p;
567 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
568 if (Tinf & 0x80) {
569 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
570 c.line = __LINE__;
571 goto err;
572 }
573 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
574 Tlen = c.slen - (c.p - c.q) - 2;
575 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, Tlen) == NULL) {
576 c.line = __LINE__;
577 goto err;
578 }
579 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
580 Tlen = c.slen - (c.p - c.q);
581 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
582 c.error = ERR_R_MISSING_ASN1_EOS;
583 c.line = __LINE__;
584 goto err;
585 }
586 }
587 c.slen -= (c.p - c.q);
588 }
392 if (os.data) { 589 if (os.data) {
393 ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length); 590 ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length);
394 free(os.data); 591 free(os.data);
@@ -397,21 +594,74 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
397 } else 594 } else
398 ret->tlsext_hostname = NULL; 595 ret->tlsext_hostname = NULL;
399 596
597 /* 7 - PSK identity hint (OCTET STRING). */
598 /* 8 - PSK identity (OCTET STRING). */
400 599
600 /* 9 - Ticket lifetime. */
401 ai.length = 0; 601 ai.length = 0;
402 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 9); 602 if (c.slen != 0L &&
603 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 9)) {
604 c.q = c.p;
605 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
606 if (Tinf & 0x80) {
607 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
608 c.line = __LINE__;
609 goto err;
610 }
611 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
612 Tlen = c.slen - (c.p - c.q) - 2;
613 if (d2i_ASN1_INTEGER(&aip, &c.p, Tlen) == NULL) {
614 c.line = __LINE__;
615 goto err;
616 }
617 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
618 Tlen = c.slen - (c.p - c.q);
619 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
620 c.error = ERR_R_MISSING_ASN1_EOS;
621 c.line = __LINE__;
622 goto err;
623 }
624 }
625 c.slen -= (c.p - c.q);
626 }
403 if (ai.data != NULL) { 627 if (ai.data != NULL) {
404 ret->tlsext_tick_lifetime_hint = ASN1_INTEGER_get(aip); 628 ret->tlsext_tick_lifetime_hint = ASN1_INTEGER_get(aip);
405 free(ai.data); 629 free(ai.data);
406 ai.data = NULL; 630 ai.data = NULL;
407 ai.length = 0; 631 ai.length = 0;
408 } else if (ret->tlsext_ticklen && ret->session_id_length) 632 } else if (ret->tlsext_ticklen && ret->session_id_length)
409 ret->tlsext_tick_lifetime_hint = -1; 633 ret->tlsext_tick_lifetime_hint = -1;
410 else 634 else
411 ret->tlsext_tick_lifetime_hint = 0; 635 ret->tlsext_tick_lifetime_hint = 0;
412 os.length = 0; 636 os.length = 0;
413 os.data = NULL; 637 os.data = NULL;
414 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 10); 638
639 /* 10 - Ticket (OCTET STRING). */
640 if (c.slen != 0L &&
641 *c.p == (V_ASN1_CONSTRUCTED | V_ASN1_CONTEXT_SPECIFIC | 10)) {
642 c.q = c.p;
643 Tinf = ASN1_get_object(&c.p, &Tlen, &Ttag, &Tclass, c.slen);
644 if (Tinf & 0x80) {
645 c.error = ERR_R_BAD_ASN1_OBJECT_HEADER;
646 c.line = __LINE__;
647 goto err;
648 }
649 if (Tinf == (V_ASN1_CONSTRUCTED + 1))
650 Tlen = c.slen - (c.p - c.q) - 2;
651 if (d2i_ASN1_OCTET_STRING(&osp, &c.p, Tlen) == NULL) {
652 c.line = __LINE__;
653 goto err;
654 }
655 if (Tinf == (V_ASN1_CONSTRUCTED + 1)) {
656 Tlen = c.slen - (c.p - c.q);
657 if(!ASN1_const_check_infinite_end(&c.p, Tlen)) {
658 c.error = ERR_R_MISSING_ASN1_EOS;
659 c.line = __LINE__;
660 goto err;
661 }
662 }
663 c.slen -= (c.p - c.q);
664 }
415 if (os.data) { 665 if (os.data) {
416 ret->tlsext_tick = os.data; 666 ret->tlsext_tick = os.data;
417 ret->tlsext_ticklen = os.length; 667 ret->tlsext_ticklen = os.length;
@@ -420,5 +670,26 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
420 } else 670 } else
421 ret->tlsext_tick = NULL; 671 ret->tlsext_tick = NULL;
422 672
423 M_ASN1_D2I_Finish(a, SSL_SESSION_free, SSL_F_D2I_SSL_SESSION); 673 /* 11 - Compression method (OCTET STRING). */
674 /* 12 - SRP username (OCTET STRING). */
675
676 if (!asn1_const_Finish(&c)) {
677 c.line = __LINE__;
678 goto err;
679 }
680
681 *pp = c.p;
682 if (a != NULL)
683 *a = ret;
684
685 return (ret);
686
687err:
688 ERR_PUT_error(ERR_LIB_SSL, SSL_F_D2I_SSL_SESSION,
689 c.error, __FILE__, c.line);
690 asn1_add_error(*pp, (int)(c.q - *pp));
691 if (ret != NULL && (a == NULL || *a != ret))
692 SSL_SESSION_free(ret);
693
694 return (NULL);
424} 695}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-22 23:34:11 +0000