summaryrefslogtreecommitdiff
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Minor tweaks to psk modes regresstb2022-06-061-3/+3
|
* move the calls to psk kex modes tests down to match order in ssl_tlsext.ctb2022-06-051-4/+4
|
* Add regress coverage for PSK kex modes tlsext handlers.tb2022-06-051-2/+210
|
* The parse stubs need to skip over the extension data.tb2022-06-041-3/+3
| | | | | | Found by anton with tlsfuzzer ok anton
* Tweak a comment using review feedback from jsingtb2022-06-041-4/+4
|
* Add stubbed out handlers for the pre_shared_key extensiontb2022-06-032-2/+65
| | | | ok jsing
* Implement handlers for the psk_key_exchange_modes extensions.tb2022-06-032-3/+96
| | | | ok jsing
* Add a use_psk_dhe_ke flag to the TLSv1.3 handshake structtb2022-06-031-1/+4
| | | | | | | This will be used to indicate client side support for DHE key establishment. ok jsing
* Ensure that a client who sent a PSK extension has also sent a PSKtb2022-06-031-4/+9
| | | | | | key exchange mode extension, as required by RFC 8446, 4.2.9. ok jsing
* Provide #defines for the two currently registered PskKeyExchangeModes.tb2022-06-031-1/+12
| | | | ok jsing
* Use consistent spacing around assignmentstb2022-06-021-4/+4
|
* Only constraints and verify need static linking in here.tb2022-06-022-5/+9
|
* *** empty log message ***mbuhl2022-05-284-11/+11
|
* Remove an unnecessary XXX comment. The suggested check is part oftb2022-05-251-5/+1
| | | | extract_min_max().
* Clean up ASN1_item_sign_ctx() a littletb2022-05-241-25/+38
| | | | | | | | | | | | | Instead of inl, outl, and outll, use in_len, out_len, and buf_out_len. Use the appropriate types for them. Check return values properly, check for overflow. Remove some unnecessary casts and add some for readability. Use asn1_abs_set_unused_bits() instead of inlining it. This removes the last direct consumer of ASN1_STRING_FLAG_BITS_LEFT outside of asn1/a_bitstr.c. The flag is still mentioned in x509/x509_addr.c but that will hopefully go away soon. tweaks/ok jsing
* Simplify ec_asn1_group2curve()tb2022-05-241-18/+21
| | | | | | | | Don't try to reuse curve->seed to avoid an allocation. Free it unconditionally and copy over the group->seed if it's available. Use asn1_abs_set_unused_bits() instead of inlining it. ok jsing
* Straightforward conversion of ecdh_cms_encrypt() totb2022-05-241-3/+3
| | | | | | asn1_abs_set_unused_bits() ok jsing
* Rewrite X509_PUBKEY_set0_param() to use asn1_abs_set_unused_bits()tb2022-05-241-10/+8
| | | | | | | This streamlines the logic and uses ASN1_STRING_set0() and asn1_abs_set_unused_bits() instead of inlining them. ok jsing
* Use asn1_abs_set_unused_bits() in asn1_str2type()tb2022-05-241-5/+6
| | | | ok jsing
* Recent changes to truncate(2) swapped the ordering of some validationsanton2022-05-241-2/+2
| | | | | | | causing EACCESS as opposed of ESDIR to be returned while trying to truncate a directory as a user lacking write permissions to the same directory. As this behavior is reasonable, change the truncate directory from /etc/ to /tmp which makes the test pass both as root and non-root.
* Remove some unhelpful comments and spell NULL correctly.jsing2022-05-211-10/+4
|
* Factor out ASN1_ITYPE_EXTERN handling.jsing2022-05-211-15/+32
| | | | | | | Factor out the ef->asn1_ex_d2i() callback handling - this allows us to pull out all of the related variables into a self-contained function. ok tb@
* Use 'at' for ASN1_TEMPLATE variable names rather than 'tt'.jsing2022-05-211-52/+58
| | | | | | | | | Also use array indexes for it->templates, rather than trying to be extra clever in for loops (suggested by tb@ during a review). No functional change. ok tb@
* Remove _ex_ from all of the internal function names.jsing2022-05-211-35/+35
| | | | | | | | | It no longer makes sense to have "extended" versions of functions internally. No functional change. ok tb@
* system(3) should ignore SIGINT and SIGQUIT until the shell exits.millert2022-05-211-4/+17
| | | | | | | This got broken when system.c was converted from signal(3) to sigaction(2). Also add SIGINT and SIGQUIT to the set of blocked signals and unblock them in the parent after the signal handlers are installed. Based on a diff from Leon Fischer. OK deraadt@
* Drop *out == NULL check in ASN1_STRING_to_UTF8()tb2022-05-201-2/+6
| | | | | | | | | Unfortunately, several things in the ecosystem depend on the existing API behavior of being able to pass in an uninitialized pointer on the stack: haproxy, grpc, mongo-tools and others show up on the first two pages of Debian codesearch. ok jsing
* Don't pass uninitialized pointer to ASN1_STRING_to_UTF8()tb2022-05-201-2/+2
| | | | | | | Exposed by recent rewrite of ASN1_STRING_to_UTF8(). Found via grep after fixing CID 352831. ok jsing
* Don't pass uninitialized pointer to ASN1_STRING_to_UTF8()tb2022-05-201-2/+2
| | | | | | | | Exposed by recent rewrite of ASN1_STRING_to_UTF8(). CID 352831 ok jsing
* Reorder functions within file.jsing2022-05-191-624/+608
| | | | | | | | Order functions by use, moving public API to the bottom and utility functions to the top. This makes the code more logical/readable, plus we can remove all except one of the static function prototypes. No functional change.
* Rewrite the asn1_template_*() functions with CBS.jsing2022-05-191-218/+168
| | | | | | | | | | Rewrite the asn1_template_*() functions with CBS, readable variable names and free then alloc. This was the last caller of asn1_check_eoc() and asn1_check_tag(), hence remove them and rename the _cbs suffixed versions in their place. ok tb@
* Add missing space between No macro and "authority".tb2022-05-191-3/+3
|
* Refactor asn1_d2i_ex_primitive()jsing2022-05-171-98/+146
| | | | | | | | | | Split the object content handling off into asn1_d2i_ex_primitive_content(), move the handling ov V_ASN1_ANY into asn1_d2i_ex_any() and move the MSTRING handling into asn1_d2i_ex_mstring(). This way we parse the header once (rather than twice for ANY and MSTRING), then process the content, while also avoiding complex special cases in a single code path. ok tb@
* Refactor ASN.1 template functions before rewriting.jsing2022-05-171-133/+145
| | | | | | | | | | | Change asn1_template_ex_d2i() so that we short circuit in the no explicit tagging case. Split out the SET OF/SEQUENCE OF handling from asn1_template_noexp_d2i() into a asn1_template_stack_of_d2i() function and simplify the remaining code. ok tb@
* Expose asn1_abs_set_unused_bits() in asn1_locl.htb2022-05-172-3/+4
| | | | | | Should have been part of a previous commit. ok jsing
* Rewrite make_addressRange() using CBStb2022-05-171-37/+104
| | | | | | | | | | Factor the trimming of the end and the counting of unused bits into helper functions and reuse an ASN.1 bit string API to set the unused bits and the ASN1_STRING_FLAG_BITS_SET. With a couple of explanatory comments it becomes much clearer what the code is actually doing and why. ok jsing
* Simplify make_addressPrefix()tb2022-05-171-21/+23
| | | | | | | | | In order to set the BIT STRING containing an address prefix, use existing helper functions from the ASN.1 code instead of redoing everything by hand. Make the function single exit and rename a few variables to make it clearer what is being done. ok jsing
* Add a simple test that exercises ASN1_STRING_to_UTF8() a little.tb2022-05-162-1/+130
|
* Clean up and fix ASN1_STRING_to_UTF8()tb2022-05-161-12/+23
| | | | | | | | | Instead of using a temporary variable on the stack, we can use the usual Henson mechanism for allocating the struct. Make the function single exit and throw an error instead of crashing or leaking if out is NULL or *out is non-NULL. tweaks/ok jsing
* Remove a stray spacetb2022-05-161-2/+2
|
* Avoid use of uninitialized in ASN1_STRING_to_UTF8()tb2022-05-161-4/+3
| | | | | | | | | | | | A long standing failure to initialize a struct on the stack fully was exposed by a recent refactoring. Fortunately, the uninitialized 'flag' member is only used to decide whether or not to call freezero(NULL, 0), so it is completely harmless. This is a first trivial fix, a better version will be landed separately with regress. Reported by Steffen Jaeckel, GH #760 ok beck
* Rewrite asn1_item_ex_d2i_sequence() using CBS and readable variable names.jsing2022-05-161-131/+113
| | | | | | Now that combine no longer exists, we can also free and reallocate. ok tb@
* Add the two length tests. Can't currently run them because we need antb2022-05-141-1/+6
| | | | echo server.
* Tweak regress in such a way that it would have caught the bug intb2022-05-131-1/+6
| | | | | | d2i_ASN1_OBJECT() fixed in a_object.c r1.48. from jsing
* Fix d2i_ASN1_OBJECT()tb2022-05-131-2/+2
| | | | | | | | | Due to a confusion of two CBS, the API would incorrectly advance the *der_in pointer, resulting in a DER parse failure. Issue reported by Aram Sargsyan ok jsing
* Call the ASN1_OP_D2I_PRE callback after ASN1_item_ex_new().jsing2022-05-121-10/+8
| | | | | | | | In asn1_item_ex_d2i_choice(), only call the ASN1_OP_D2I_PRE callback after allocation has occurred via ASN1_item_ex_new(). This matches the sequence handling code and the documentation. Discussed with tb@
* Small readability tweak suggested by jsingtb2022-05-121-1/+3
|
* Enable X509v3_asid_subset() tests now that they no longer segfault.tb2022-05-121-7/+1
|
* Rewrite and fix X509v3_asid_subset()tb2022-05-121-12/+30
| | | | | | | | | | | | X509v3_asid_subset() assumes that both asnum and rdi are present while they are both marked OPTIONAL in RFC 3779, 3.2.3. It will crash if either one is missing. In RPKI land RDI is a MUST NOT use (e.g, RFC 6487, 4.8.11), so this API is currently useless (and seemingly unused). Pick apart an ugly logical pipeline and implement this check in a readable fashion. ok jsing
* Rename asn1_enc_free() to asn1_enc_cleanup().jsing2022-05-123-6/+6
| | | | | | | This function does not actually free an ASN1_ENCODING, which are embedded in a struct. Name suggested by tb@
* Rewrite asn1_item_ex_d2i_choice() using CBS.jsing2022-05-121-73/+54
| | | | | | Now that combine no longer exists, we can also free and reallocate. ok tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-21 11:48:22 +0000