summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/dsa/dsa_lib.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2022-05-24Use asn1_abs_set_unused_bits() in asn1_str2type()tb1-5/+6
ok jsing
2022-05-24Recent changes to truncate(2) swapped the ordering of some validationsanton1-2/+2
causing EACCESS as opposed of ESDIR to be returned while trying to truncate a directory as a user lacking write permissions to the same directory. As this behavior is reasonable, change the truncate directory from /etc/ to /tmp which makes the test pass both as root and non-root.
2022-05-21Remove some unhelpful comments and spell NULL correctly.jsing1-10/+4
2022-05-21Factor out ASN1_ITYPE_EXTERN handling.jsing1-15/+32
Factor out the ef->asn1_ex_d2i() callback handling - this allows us to pull out all of the related variables into a self-contained function. ok tb@
2022-05-21Use 'at' for ASN1_TEMPLATE variable names rather than 'tt'.jsing1-52/+58
Also use array indexes for it->templates, rather than trying to be extra clever in for loops (suggested by tb@ during a review). No functional change. ok tb@
2022-05-21Remove _ex_ from all of the internal function names.jsing1-35/+35
It no longer makes sense to have "extended" versions of functions internally. No functional change. ok tb@
2022-05-21system(3) should ignore SIGINT and SIGQUIT until the shell exits.millert1-4/+17
This got broken when system.c was converted from signal(3) to sigaction(2). Also add SIGINT and SIGQUIT to the set of blocked signals and unblock them in the parent after the signal handlers are installed. Based on a diff from Leon Fischer. OK deraadt@
2022-05-20Drop *out == NULL check in ASN1_STRING_to_UTF8()tb1-2/+6
Unfortunately, several things in the ecosystem depend on the existing API behavior of being able to pass in an uninitialized pointer on the stack: haproxy, grpc, mongo-tools and others show up on the first two pages of Debian codesearch. ok jsing
2022-05-20Don't pass uninitialized pointer to ASN1_STRING_to_UTF8()tb1-2/+2
Exposed by recent rewrite of ASN1_STRING_to_UTF8(). Found via grep after fixing CID 352831. ok jsing
2022-05-20Don't pass uninitialized pointer to ASN1_STRING_to_UTF8()tb1-2/+2
Exposed by recent rewrite of ASN1_STRING_to_UTF8(). CID 352831 ok jsing
2022-05-19Reorder functions within file.jsing1-624/+608
Order functions by use, moving public API to the bottom and utility functions to the top. This makes the code more logical/readable, plus we can remove all except one of the static function prototypes. No functional change.
2022-05-19Rewrite the asn1_template_*() functions with CBS.jsing1-218/+168
Rewrite the asn1_template_*() functions with CBS, readable variable names and free then alloc. This was the last caller of asn1_check_eoc() and asn1_check_tag(), hence remove them and rename the _cbs suffixed versions in their place. ok tb@
2022-05-19Add missing space between No macro and "authority".tb1-3/+3
2022-05-17Refactor asn1_d2i_ex_primitive()jsing1-98/+146
Split the object content handling off into asn1_d2i_ex_primitive_content(), move the handling ov V_ASN1_ANY into asn1_d2i_ex_any() and move the MSTRING handling into asn1_d2i_ex_mstring(). This way we parse the header once (rather than twice for ANY and MSTRING), then process the content, while also avoiding complex special cases in a single code path. ok tb@
2022-05-17Refactor ASN.1 template functions before rewriting.jsing1-133/+145
Change asn1_template_ex_d2i() so that we short circuit in the no explicit tagging case. Split out the SET OF/SEQUENCE OF handling from asn1_template_noexp_d2i() into a asn1_template_stack_of_d2i() function and simplify the remaining code. ok tb@
2022-05-17Expose asn1_abs_set_unused_bits() in asn1_locl.htb2-3/+4
Should have been part of a previous commit. ok jsing
2022-05-17Rewrite make_addressRange() using CBStb1-37/+104
Factor the trimming of the end and the counting of unused bits into helper functions and reuse an ASN.1 bit string API to set the unused bits and the ASN1_STRING_FLAG_BITS_SET. With a couple of explanatory comments it becomes much clearer what the code is actually doing and why. ok jsing
2022-05-17Simplify make_addressPrefix()tb1-21/+23
In order to set the BIT STRING containing an address prefix, use existing helper functions from the ASN.1 code instead of redoing everything by hand. Make the function single exit and rename a few variables to make it clearer what is being done. ok jsing
2022-05-16Add a simple test that exercises ASN1_STRING_to_UTF8() a little.tb2-1/+130
2022-05-16Clean up and fix ASN1_STRING_to_UTF8()tb1-12/+23
Instead of using a temporary variable on the stack, we can use the usual Henson mechanism for allocating the struct. Make the function single exit and throw an error instead of crashing or leaking if out is NULL or *out is non-NULL. tweaks/ok jsing
2022-05-16Remove a stray spacetb1-2/+2
2022-05-16Avoid use of uninitialized in ASN1_STRING_to_UTF8()tb1-4/+3
A long standing failure to initialize a struct on the stack fully was exposed by a recent refactoring. Fortunately, the uninitialized 'flag' member is only used to decide whether or not to call freezero(NULL, 0), so it is completely harmless. This is a first trivial fix, a better version will be landed separately with regress. Reported by Steffen Jaeckel, GH #760 ok beck
2022-05-16Rewrite asn1_item_ex_d2i_sequence() using CBS and readable variable names.jsing1-131/+113
Now that combine no longer exists, we can also free and reallocate. ok tb@
2022-05-14Add the two length tests. Can't currently run them because we need antb1-1/+6
echo server.
2022-05-13Tweak regress in such a way that it would have caught the bug intb1-1/+6
d2i_ASN1_OBJECT() fixed in a_object.c r1.48. from jsing
2022-05-13Fix d2i_ASN1_OBJECT()tb1-2/+2
Due to a confusion of two CBS, the API would incorrectly advance the *der_in pointer, resulting in a DER parse failure. Issue reported by Aram Sargsyan ok jsing
2022-05-12Call the ASN1_OP_D2I_PRE callback after ASN1_item_ex_new().jsing1-10/+8
In asn1_item_ex_d2i_choice(), only call the ASN1_OP_D2I_PRE callback after allocation has occurred via ASN1_item_ex_new(). This matches the sequence handling code and the documentation. Discussed with tb@
2022-05-12Small readability tweak suggested by jsingtb1-1/+3
2022-05-12Enable X509v3_asid_subset() tests now that they no longer segfault.tb1-7/+1
2022-05-12Rewrite and fix X509v3_asid_subset()tb1-12/+30
X509v3_asid_subset() assumes that both asnum and rdi are present while they are both marked OPTIONAL in RFC 3779, 3.2.3. It will crash if either one is missing. In RPKI land RDI is a MUST NOT use (e.g, RFC 6487, 4.8.11), so this API is currently useless (and seemingly unused). Pick apart an ugly logical pipeline and implement this check in a readable fashion. ok jsing
2022-05-12Rename asn1_enc_free() to asn1_enc_cleanup().jsing3-6/+6
This function does not actually free an ASN1_ENCODING, which are embedded in a struct. Name suggested by tb@
2022-05-12Rewrite asn1_item_ex_d2i_choice() using CBS.jsing1-73/+54
Now that combine no longer exists, we can also free and reallocate. ok tb@
2022-05-12Rewrite asn1_enc_save() using CBS.jsing3-46/+69
Rework and clean up other asn1_enc_* related functions while here. ok tb@
2022-05-12Use freezero() with ASN1_ENCODING.jsing1-3/+3
While ASN1_ENCODING is currently only used with types that should only contain public information, we assume that ASN.1 may contain sensitive information, hence use freezero() here instead of free(). ok deraadt@ tb@
2022-05-12Remove ASN1_AFLG_BROKEN.jsing2-19/+3
This workaround was used by ASN1_BROKEN_SEQUENCE, which existed for NETSCAPE_ENCRYPTED_PKEY. Remove the workaround since the only consumer has already been removed. ok tb@
2022-05-12Add a few more testcases for X509v3_asid_subset()tb1-1/+144
2022-05-10Add a BUGS section to describe the problem of potential lies andtb1-2/+17
indicating a workaround. input/ok jsing
2022-05-10X509_check_ca() has 5 return values but still can't failtb1-3/+1
The values 0, 1, 3, 4, 5 all have some meaning, none of which is failure. If caching of X509v3 extensions fails, returning X509_V_ERR_UNSPECIFIED, i.e., 1 is a bad idea since that means the cert is a CA with appropriate basic constraints. Revert to OpenSSL behavior which is to ignore failure to cache extensions at the risk of reporting lies. Since no return value can indicate failure, we can't fix this in X509_check_ca() itself. Application code will have to call (and check) the magic X509_check_purpose(x, -1, -1) to ensure extensions are cached, then X509_check_ca() can't lie. ok jsing
2022-05-10If Ruby 3.1 isn't available, try to fall back to Ruby 3.0 so thattb1-1/+5
regress on bluhm's test machines have a chance to pass on slower architectures while package builds catch up.
2022-05-10Rewrite asn1_item_ex_d2i() using CBS.jsing1-58/+125
This requires a few wrappers to call into some non-CBS functions, however we can now remove the asn1_d2i_ex_primitive() wrapper as there are no longer any non-CBS callers. ok tb@
2022-05-10Remove ASN.1 combining.jsing5-82/+37
This was an option used to combine ASN.1 into a single structure, which was only ever used by DSAPublicKey and X509_ATTRIBUTE. Since they no longer use it we can mop this up and simplify all of the related code. ok tb@
2022-05-09Simplify X509_ATTRIBUTE ASN.1 encoding.jsing6-101/+34
For some unknown historical reason, X509_ATTRIBUTE allows for a single ASN.1 value or an ASN.1 SET OF, rather than requiring an ASN.1 SET OF. Simplify encoding and remove support for single values - this is similar to OpenSSL e20b57270dec. This removes the last use of COMBINE in the ASN.1 decoder. ok tb@
2022-05-08Remove openssl/cterr.h and inline it in openssl/ct.htb4-133/+58
ok jsing
2022-05-08Default Ruby is now 3.1tb1-2/+2
2022-05-07Sort alphabetically so that future omissions will be easier to spot.tb1-35/+35
discussed with jsing
2022-05-07Split asn1_item_ex_d2i() into three.jsing1-223/+287
Factor out the handling of CHOICE and SEQUENCE into their own functions. This reduces complexity, reduces indentation and will allow for further clean up. ok beck@ tb@
2022-05-07zap stray tabtb1-2/+2
2022-05-07KNF nitstb1-7/+7
2022-05-07Rewrite asn1_d2i_ex_primitive() with CBS.jsing1-72/+86
ok tb@
2022-05-07Refactor asn1_ex_c2i()jsing1-39/+59
The asn1_ex_c2i() function currently handles the V_ASN1_ANY case inline, which means there multiple special cases, with pointer fudging and restoring. Instead, split asn1_ex_c2i() into three functions - one that only handles storage into a primitive type (asn1_ex_c2i_primitive()), one that handles the V_ASN1_ANY case (asn1_ex_c2i_any()) and calls asn1_ex_c2i_primitive() with the correct pointer and an asn1_ex_c2i() that handles the custom functions case, before dispatching to asn1_ex_c2i_any() or asn1_ex_c2i_primitive(), as appropriate. This results in cleaner and simpler code. With input from and ok tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-24 17:19:20 +0000