| Commit message (Collapse) | Author | Files | Lines |
|---|
|
pthread -> mutex
stdint -> uint8_t
stdio.h -> asprintf
stdlib.h -> calloc
string.h -> memcpy
ecdsa -> ECDSA_METHOD leftover, remove
ec -> EC_KEY
evp -> EVP_PKEY
pem -> PEM_read_bio_X509
x509 -> X509
90% of the diff is from tb@, I only spotted the missing string.h :)
ok tb@
|
|
OK tb@
|
|
The combination of two bugs made this unexpectedly work as intended. To
appreciate this, let's first note that
a) check_issued(..., child, parent) checks if child was issued by parent.
b) X509_check_issued(child, parent) checks if parent was issued by child.
Now like in the real world, b) will only be true in unusual circumstances
(child is known not to be self-issued at this point). X509_check_issued()
fails by returning something different from X509_V_OK, so
return X509_check_issued(child, parent) != X509_V_OK;
will return true if child was issued by parent since then parent was indeed
not issued by child. On the other hand, if child was not issued by parent,
the verifier will notice elsewhere, e.g., in a signature check.
Fix this by reversing the order of child and parent in the above return
line and check for equality instead. This is nearly impossible to detect
in regress.
ok beck
|
|
It's a trap!
|
|
This is a false positive but as is well-known, gcc is terrible at
understanding conditionally initialized variables and it is tedious
to explain this to downstream maintainers who look at warnings.
ok miod
|
|
Thanks to Viktor Szakats for figuring out that stdint.h was missing
in the portable tarballs.
|
|
|
|
ssh tools. The dynamic objects are entirely ret-clean, static binaries
will contain a blend of cleaning and non-cleaning callers.
|
|
|
|
|
|
|
|
|
|
requested by jsing on review
|
|
HMAC() and the one-step digests used to support passing a NULL buffer and
would return the digest in a static buffer. This design is firmly from the
nineties, not thread safe and it saves callers a single line. The few ports
that used to rely this were fixed with patches sent to non-hostile (and
non-dead) upstreams. It's early enough in the release cycle that remaining
uses hidden from the compiler should be caught, at least the ones that
matter.
There won't be that many since BoringSSL removed this feature in 2017.
https://boringssl-review.googlesource.com/14528
Add non-null attributes to the headers and add a few missing bounded
attributes.
ok beck jsing
|
|
|
|
|
|
failed was set to 0 at the top of the function, so failure and success
were indistinguishable. Move failed = 0 to the end so it can actually
fail.
|
|
|
|
|
|
When called with a pointer to NULL as an output buffer, one would expect
an i2d API to allocate the buffer and return it. The implementation here
is special and the allocation dance was forgotten, resulting in a SIGSEGV.
Add said dance.
ok jsing
|
|
This is what the (not quite appropriately) referenced ASN1_item_i2d()
page documents for errors, matches what the RETURN VALUE section has
been documenting for ages, matches BoringSSL, it's the usal behavior
for i2d_*. It's also what OpenSSL (of course incorrectly) documents.
discussed with jsing
|
|
|
|
|
|
When looking at this code I noticed a few leaks. Fixing those leaks
was straightforward, but following the code was really hard.
This attempts to make the logic a bit clearer. In short, there are
6 mutually exclusive modes for this function (passed in the variable
aptly called flags). The default mode is to append the extension of
type nid and to error if such an extension already exists. Then there
are other modes with varying degree of madness.
The existing code didn't make X509V3_ADD_REPLACE explicit, which is
confusing. Operations 6-15 would all be treated like X509V3_ADD_REPLACE
due to the way the function was written. Handle the supported operations
via a switch and error for operations 6-15. This and the elimination
of leaks are the only changes of behavior, as validated by relatively
extensive test coverage.
ok jsing
|
|
|
|
suggested by jsing
|
|
ok job jsing
|
|
ok job jsing
|
|
ENGINE, SSL and SSL_CTX remain even though the structs in the typedefs
don't exist as they are used as incomplete types.
feedback, ports bulk build and ok tb@
|
|
This functionality will be removed, so stop documenting it. Instead
mention that another implementation still supports this.
|
|
Also add a test case with a generalized time representing the moment
one second past the 32-bit epoch wrap.
|
|
|
|
They currently depend on bytestring.h pulling that in.
discussed with jsing
|
|
It wasn't quite right, but I also think the test is bogus.
|
|
|
|
|
|
ok jsing
|
|
The most terrible code in OpenSSL has its roots in libdes, which came
before SSLeay. Hello, LHASH. Hello speed app. Hello DES (obviously).
There are some diary-style changelog comments dating all the way back
to 1990.
/* This has some uglies in it but it works - even over sockets. */
Well, kind of:
* - This code cannot handle non-blocking sockets.
Also:
/* >output is a multiple of 8 byes, if len < rnum
* >we must be careful. The user must be aware that this
* >routine will write more bytes than he asked for.
* >The length of the buffer must be correct.
* FIXED - Should be ok now 18-9-90 - eay */
Or
/* This is really a bad error - very bad
* It will stuff-up both ends. */
Or
#ifdef _LIBC
extern unsigned long time();
extern int write();
#endif
I can't even...
Delete, delete, delete.
ok jsing
|
|
|
|
|
|
|
|
(where it doesn't conflict with a local variable)
|
|
|
|
|
|
|
|
|
|
|
|
This needs quite a bit of cleanup but let's have some tests rather than
none.
|
|
Take the MAC before clobbering the input value on decryption. Fixes hangs
during the QUIC handshake with HAProxy using TLS_CHACHA20_POLY1305_SHA256.
Found, issue pinpointed, and initial fix tested by Lucas Gabriel Vuotto:
Let me take this opportunity to thank the HAProxy team for going out of
their way to keep supporting LibreSSL. It's much appreciated.
See https://github.com/haproxy/haproxy/issues/2569
tweak/ok jsing
|
|
|
