| Commit message (Collapse) | Author | Files | Lines |
|---|
|
|
|
In asn1t.h r1.18 (commit 9b72422d) I removed the app_items member from
ASN1_ADB and failed to fix up the ASN1_ADB_END() macro that populates
the ASN1_ADB. This means ASN1_ADB_END() tried to initialize one member
too many and would thus cause a compilation failure, so nobody uses this
with LibreSSL. Internally, we have expanded all its uses.
We could leave it broken or fix it up. Take the opportunity to add an
unused adb_cb() argument instead, making the macro invocation compatible
with OpenSSL.
ok jsing kenjiro
|
|
|
|
These are used directly only as part of the ASN.1 item in the same file.
|
|
|
|
no binary change
|
|
A nasty quirk in the bit string handling is that the serialization
produced by i2d_ASN1_BIT_STRING() depends on whether the the magic
ASN1_STRING_FLAG_BITS_LEFT is set.
If ASN1_STRING_FLAG_BITS_LEFT is set, the number of unused bits is
carried in a->flags & 0x07 and the remainder of the bit string is
in a->data. This is terrible and undocumented but handled correctly.
If ASN1_STRING_FLAG_BITS_LEFT is not set, all trailing zero bits are
(intended to be) chopped off with all sorts of hilarious side effects.
I broke this quite thoroughly when I incorrectly ported an overflow
check from BoringSSL in:
https://github.com/openbsd/src/commit/f81cc285d2aed8b36615119a306533696f3eb66c
The result is that we currently return ret = a->length + 1 for both NULL
and non-NULL pp. The calls to asn1_ex_i2c() in asn1_i2d_ex_primitive()
thus report consistent lengths back, making it succeed.
asn1_i2d_ex_primitive() therefore skips a->length + 1 bytes, while
i2c_ASN1_BIT_STRING() only overwrites len + 1 bytes, which are possibly
fewer. So a caller passing in an output buffer containing garbage
(malloc) will get some of that garbage back in the encoding. Further,
i2c_ASN1_BIT_STRING() also advances that pointer by the possibly reduced
len + 1, but that fortunately doesn't matter since that's an effect
local to asn1_ex_i2c(), the only caller of i2c_ASN1_BIT_STRING().
The last bit is that the current behavior may set bogus unused bits
coming from the scanning backward madness. I added such an example in
the parent commit.
The fix is simple: use len after the truncation effect was established,
not the original a->length, turning this commit into what my backport
should have been.
This fixes the two currently failing regress tests, so remove expected
failure marker again.
ok jsing kenjiro
|
|
This is another test that fails due to the bug in i2c_ASN1_BIT_STRING().
|
|
This test fails, so mark the asn1basic test as an expected failure
|
|
There is a bug in i2c_ASN1_BIT_STRING() resulting in nonsense encoding of
some BIT STRINGs with trailing zeroes if ASN1_STRING_FLAG_BITS_LEFT is not
set (a rare corner case). This test currently passes when it shouldn't.
|
|
The /* should not happen */ happens if a->data is all zeroes (where
there used to be an OOB access a few years back), which is a legitimate
BIT STRING, so this is just nonsense.
ok jsing kenjiro
|
|
|
|
|
|
This is another one of these weird magic values that nothing outside
of libcrypto uses. Fix a confusing comment in long_i2c() while there.
The skipping behavior is used in particular for omitting the optional
length value in the non-standard OpenSSL-specific DHparam() ASN.1
encoding.
ok jsing kenjiro
|
|
Register sha3-{224,256,384,512} as dgst commands so they appear in
openssl help. Without this, SHA-3 support is easy to miss and looks
unsupported from the command line.
ok tb jsing
|
|
Remove an unused intermediate EVP_MD pointer and assign digests
directly to cfg.md.
ok tb joel
|
|
The ML-KEM code is doing a pretty poor job at cleaning up secrets it no
longer needs. This commit clears a few stack-based arrays containing
secrets or not obviously public information and stack-based structs
containing pointers to secrets.
ok jsing kenjiro
|
|
RANK768 and RANK1024 are awfully short and generic names for public
constants. Before we make it worse with similarly named constants for
ML-DSA, let's fix this. This follows the naming convention used by the
other macros in the mlkem code.
ok kenjiro jsing
|
|
|
|
|
|
Formerly used by ASN1_STRING_TABLE_{add,cleanup}() which were removed two
years ago. Annotate why STABLE_NO_MASK stays: as usual, security/xca ends
up being the sole consumer of some nonsense. Apparently it needs its own
reimplementation of ASN1_STRING_set_by_NID(), another removable public API
that should never have been exposed.
ok kenjiro
|
|
Contrary to naming, the '"June" MMX version' of gcm_ghash_4bit_mmx() uses
SSE, while the 'pure-MMX "May" version' does not. This detail got missed
when I was untangling OPENSSL_IA32_SSE2.
Found the hard way by Tate Baldwin and Dennis Camera.
|
|
|
|
|
|
alright. go home.
|
|
All other public APIs call group->meth->... not point->meth->...
|
|
This is the only public API that doesn't check for compatibility between
group and point. Add the missing check.
ok jsing kenjiro
|
|
The method will currently always be identical since all groups use the
EC_GFp_mont_method(). Use the ec_group_and_point_compatible() check to
ensure this and if both group and point have a nid set, check that they
are identical.
ok jsing kenjiro
|
|
Check that a given group and point are reasonably compatible. First see
if they use the same method. Compare nids if both have nid != NID_undef.
ok jsing kenjiro
|
|
It is annoying that an EC_POINT does not really know on what EC_GROUP it
lives. Adding a refcount to EC_GROUP is slightly tricky, so instead use
a nid which we will know unless the group was constructed by hand.
ok jsing kenjiro
|
|
|
|
|
|
|
|
ok kenjiro
|
|
ok kenjiro
|
|
This is the last remaining actual use of ASN1_PRINTABLE_type(), which will
go away in the next major bump.
ok kenjiro
|
|
ok jsing kenjiro
|
|
The only thing CONF_DEBUG has done in ages is defining NDEBUG in a file
that does not contain a single assert. Kill it.
ok jsing kenjiro
|
|
In ca.c, there is some minimal validation of strings in the subject of
a certificate. ASN1_PRINTABLE_type() is silly API that only exists for
this one call. I want to remove a_print.c in the next major bump.
ASN1_PRINTABLE_type() returns V_ASN1_PRINTABLESTRING if all characters
belong to the specific subset of ASCII listed in X.680, 41.4, Table 10.
Otherwise it returns V_ASN1_T61STRING or V_ASN1_IA5STRING depending on
whether there is a character with the high bit set or not.
With this in mind, the logic in ca.c comes down to this: blindly allow
UTF-8, BMP and T61 strings. All other strings get rejected if the high
bit of some character is set, or if the string is printable and there
is a non-printable character.
ok jsing kenjiro
|
|
|
|
|
|
|
|
|
|
|
|
|
|
What Netscape fucked up just had to be embraced by secure boot and
other nonsense. First OpenSSL wanted to be strict (which we inherited)
then Rich Salz Postel-ized this and made OpenSSL bypass this check by
default and added a flag to be strict 10 years ago.
Now sthen found that PHP 8.5 uses/exposes this flag.
Follows OpenSSL 6b2ebe43 (2016)
ok kenjiro
|
|
|
|
We haven't supported compiling against zlib in a very long time. These
are the only two calls to CMS_{,un}compress(3) in the ecosystem. I am
going to remove these two API stubs in the next major bump.
ok jsing kenjiro
|
|
Exercises the batshit crazy truncation behavior of ASN1_BIT_STRING_set_bit()
Based on https://boringssl-review.googlesource.com/c/boringssl/+/48225
(still under ISC).
|
|
While the latter is more general in that it also works on 1-complement
achitectures, we don't care about that. Adjust documentation and the
only error check for it in libcrypto.
ok deraadt
|
