| Commit message (Collapse) | Author | Files | Lines |
|
|
|
This currently only covers Ed25519 using the c2sp-testvectors package
and checks that our Ed25519 implementation behaves as expected from a
"ref10" implementation.
This test has Go and c2sp-testvectors as a hard dependency. It will
optionally pick up any OpenSSL package installed on the system and
test that as well.
https://github.com/C2SP/CCTV
https://github.com/C2SP/CCTV/tree/main/ed25519
|
|
|
|
|
|
|
|
|
|
This is a bit of a strange one. When this function was moved and renamed,
somehow checks for NULL pointers and 0 length were lost. Whether that was
due to great review missing it or great review suggesting it, is unclear.
Now the function can actually legitimately be called with a length of 0
(as ASN.1 OCTET STRINGS can have length 0) and "" is the appropriate
representation for that, so the fix is to allocate a 0 octet. That much
was correct. What was completely missed is that a long can be negative
which will then still lead to an out-of-bounds access. So fix that as
well.
Finally, don't malloc 3 * len + 1 without overflow checking. Rather
use calloc's internal checks. The + 1 isn't really needed anyway.
All this is still really gross and can be done much more cleanly and
safely with CBB/CBS. This will done later once we have better regress
coverage.
ok jsing
|
|
|
|
compat nonsense
|
|
If no field separator is specified, default to using the comma plus space
separation, unless the compat flag is set.
Fixes an a bug with printing issuers and other things that contain UTF-8
Reported by Jean-Luc Duprat
The very simple fix ix is a joint effort by Henson and Levitte
Fixes libressl/portable issue #845
ok jsing
|
|
Pull a number of invariants into variables, which avoids repeated loading
from memory on architectures where sufficient registers are available.
Also keep track of the per-iteration carry in a variable, rather than
unnecessarily reading from and writing to memory.
This gives a reasonable performance gain on some architectures (e.g. armv7)
|
|
|
|
|
|
|
|
If you can initialize with functions, you can also initialize with
constants...
|
|
|
|
|
|
|
|
Fix botched Xr and be more precise about errors by being less precise.
Add a BUGS section.
|
|
These are in actual use, so their meaning should be documented.
The remaining commented codes are unused outside of x509_txt.c
except for X509_V_ERR_INVALID_NON_CA which looks used at first
glance, but it is actually in an unreachable path of the legacy
verifier.
|
|
The documentation of the BN_MOD_CTX has been out of sync with reality
for decades. The structure is now opaque, so its members should not be
documented this way. They internals aren't important for the rest of
the page.
BN_MOD_CTX_init() will soon be removed. It's useless unless you like
leaks.
|
|
ok otto@
|
|
|
|
The CRL extension handler is completely misplaced in x509_enum.c.
Move it to x509_bitst.c until we find a better home for it. This
way it is next to the other two extension methods that have the
extra usr_data contortion.
|
|
These functions probably belong into asn1/ but they definitely don't
belong into separate files.
|
|
|
|
This is a public alias for the also public BIT_STRING_BITNAME. The
ENUMERATED_NAMES type is used exactly twice, namely on two lines in this
file. This is silly.
|
|
|
|
While it may have been reasonable to use VisibleString back when this
code was written, it's an anachronism nowadays. In particular, configuring
BoringSSL reports that they have seen malformed certificates with exactly
the issue caused by this unfortuante default.
Reported by Alex Gaynor in OpenSSL issue 20772
ok jsing
|
|
|