summaryrefslogtreecommitdiff
path: root/src/usr.bin/openssl/errstr.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-12-28Add a comment so I don't forget to think about input validationtb1-1/+3
in make_IPAddressFamily()
2021-12-28Convert make_IPAddressFamily to CBS/CBBtb1-13/+26
The IPAddrBlocks type, which represents the IPAddrBlocks extension, should have exactly one IPAddressFamily per AFI+SAFI combination to be delegated. make_IPAddressFamily() first builds up a search key from the afi and safi arguments and then looks for an existing IPAddressFamily with that key in the IPAddrBlocks that was passed in. It returns that if it finds it or allocates and adds a new one. This diff preserves the current behavior that the afi and *safi arguments are truncated to 2 and 1 bytes, respectively. This may change in the future. ok inoguchi jsing
2021-12-28Remove two pointless NULL checks and allocationstb1-7/+1
The ASN.1 template for IPAddressFamily doesn't mark either of its two members as optional, so they are allocated by IPAddressFamily_new(). ok inoguchi jsing
2021-12-28Check for trailing garbage in X509_addr_get_afi()tb1-1/+5
Per RFC 3779 2.2.3.3, the addressFamily field contains the 2-byte AFI and an optional 1-byte SAFI. Nothing else. The optional SAFI is nowhere exposed in the API. It is used expliclty only for pretty printing. There are implicit uses in a few places, notably for sorting/comparing where trailing garbage would be erroneously taken into account. Erroring in this situation will let us avoid this in upcoming revisions. ok inoguchi jsing
2021-12-28Convert X509v3_adr_get_afi() to CBStb1-6/+21
The manual byte bashing is performed more safely using this API which would have avoided the out-of-bounds read that this API had until a few years back. The API is somewhat strange in that it uses the reserved AFI 0 as an in-band error but it doesn't care about the reserved AFI 65535. ok inoguchi jsing
2021-12-27Pull BN_{new,init,clear,clear_free,free} up to the top of bn_lib.cjsing1-58/+58
Discussed with tb@
2021-12-27Provide a set of RSA and ECDSA test certificates/keys.jsing30-0/+919
These are generated using the make-certs.sh script.