From c5b1a831f54ee74ee3cdf4e77ec6190f403abd7d Mon Sep 17 00:00:00 2001
From: tb <>
Date: Sat, 16 Dec 2023 12:56:20 +0000
Subject: Annotate incorrect value for ub_email_address

The ub_email_address upper bound, 128, returned for NID_pkcs9_emailAddress,
doesn't match the PKCS#9 specification where it is 255.  This was adjusted
in RFC 5280:

   The ASN.1 modules in Appendix A are unchanged from RFC 3280, except
   that ub-emailaddress-length was changed from 128 to 255 in order to
   align with PKCS #9 [RFC2985].

Nobody seems to have noticed so far, so leave it at an XXX and a BUGS
entry for now. It also clearly has the wrong name.

Another mystery is why the RFCs suffix some upper bounds with length, but
not others. Also, OpenSSL chose to be inconsistent with that, because
inconsistency is one of the few things this library is really good at.
---
 src/lib/libcrypto/asn1/a_strnid.c             | 4 ++--
 src/lib/libcrypto/man/ASN1_STRING_TABLE_get.3 | 7 ++++++-
 2 files changed, 8 insertions(+), 3 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/libcrypto/asn1/a_strnid.c b/src/lib/libcrypto/asn1/a_strnid.c
index 0ba3c87545..58c6e5edab 100644
--- a/src/lib/libcrypto/asn1/a_strnid.c
+++ b/src/lib/libcrypto/asn1/a_strnid.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_strnid.c,v 1.28 2023/12/16 12:40:02 tb Exp $ */
+/* $OpenBSD: a_strnid.c,v 1.29 2023/12/16 12:56:20 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -172,7 +172,7 @@ LCRYPTO_ALIAS(ASN1_STRING_set_by_NID);
 #define ub_organization_name		64
 #define ub_organization_unit_name	64
 #define ub_title			64
-#define ub_email_address		128
+#define ub_email_address		128 /* XXX - bumped to 255 in RFC 5280 */
 #define ub_serial_number		64
 
 static const ASN1_STRING_TABLE tbl_standard[] = {
diff --git a/src/lib/libcrypto/man/ASN1_STRING_TABLE_get.3 b/src/lib/libcrypto/man/ASN1_STRING_TABLE_get.3
index 0fcc8a123d..7e3e360ac3 100644
--- a/src/lib/libcrypto/man/ASN1_STRING_TABLE_get.3
+++ b/src/lib/libcrypto/man/ASN1_STRING_TABLE_get.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ASN1_STRING_TABLE_get.3,v 1.1 2023/12/16 10:26:10 tb Exp $
+.\" $OpenBSD: ASN1_STRING_TABLE_get.3,v 1.2 2023/12/16 12:56:20 tb Exp $
 .\" checked up to:
 .\" OpenSSL ASN1_STRING_TABLE_add.pod 7b608d08 Jul 27 01:18:50 2017 +0800
 .\"
@@ -83,3 +83,8 @@ first appeared in OpenSSL 0.9.5 and have been available since
 .Ox 2.7 .
 .Sh BUGS
 Most aspects of the semantics considerably differ from OpenSSL.
+.Pp
+.Dv ub_email_address ,
+which should really be called
+.Dv ub_emailaddress_length ,
+was changed in RFC 5280 from 128 to 255 to match PKCS#9 (RFC 2985).
-- 
cgit v1.2.3-55-g6feb