i2t_ASN1_OBJECT threw and was declared without parameters. It now
prints an object's long name, or its short name, or its dotted OID, as
OBJ_obj2txt does in LibreSSL 2.5.4, the version string the module
holds: the NID is the object's own or found by the same binary search
over the same order, an unassigned NID reports OBJ_R_UNKNOWN_NID for
each name lookup, a truncated subidentifier returns 0 after the parts
already written, and arcs past 64 bits are printed exactly.
The 956 objects (short and long names, NID, OID) and their search order
are generated from 2.5.4's objects.txt and obj_mac.num with its own
objects.pl and obj_dat.pl, so d2i code can later hand out the same
static objects LibreSSL does.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
SSL_get_ex_new_index and SSL_CTX_get_ex_new_index took the new, dup and
free callbacks as void*, which a caller passing real callbacks can't
convert to. They now take LibreSslExNew, LibreSslExDup and
LibreSslExFree, the guest-ABI forms of CRYPTO_EX_new, CRYPTO_EX_dup and
CRYPTO_EX_free from LibreSSL 2.5.4's ossl_typ.h. Reported by @MarcZX10.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
SSLeay() returns 0x20000000, the value measured on a PS5 with firmware
13.40 and the SSLEAY_VERSION_NUMBER of LibreSSL 2.5.4, which the module
is. The guest_libressl_version test checks it.
SSL_get_ex_new_index and SSL_CTX_get_ex_new_index number their indices
per class from 0, SSL_get_ex_data_X509_STORE_CTX_idx allocates its
class-5 index once, and CRYPTO_cleanup_all_ex_data releases every class.
An allocation failure returns -1 with ERR_R_MALLOC_FAILURE queued.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Both exports threw and were declared without parameters. They follow
LibreSSL 2.5.4, unchanged in 2.7: X509_LOOKUP_file returns the static
80-byte file method, and X509_STORE_add_lookup returns the store's
lookup for a method, or mallocs a 32-byte lookup owned by the store and
pushes it on the store's methods, growing the stack the way sk_insert
does. X509_STORE_free now frees the store's lookups.
The file method's ctrl, which loads PEM files, throws: there is no
certificate model yet. Callbacks of guest-supplied methods throw
instead of being called.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Both exports threw and were declared without parameters. They follow
LibreSSL 2.5.4, unchanged in 2.7: set_hostflags stores the host
matching flags in the verify parameters' identity, and set1_ip_asc
parses an IPv4 or IPv6 address the way a2i_ipadd does, copies the 4 or
16 bytes into a guest malloc block that replaces the previous address,
and returns 0 without touching it for text the parser rejects. IPv4
parts are read with the guest sscanf, as the module would.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The three exports threw and were declared without parameters. They now
follow LibreSSL 2.5.4, the version the firmware 13.40 measurements
identify: X509_STORE_new allocates the 136-byte store with an empty
object cache, an empty lookup method stack and 64-byte verify
parameters at depth -1, X509_STORE_free drops a reference and frees the
store with its stacks, verify parameters and their host names, peer
name, email and IP, and X509_STORE_set_flags ORs the flags into the
verify parameters and adds the policy check for any policy flag.
No export adds certificates, CRLs or lookup methods yet, so freeing a
store that holds them, or verify parameters holding policy objects,
throws instead of freeing objects with no model.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
CRYPTO_num_locks, CRYPTO_set_locking_callback, CRYPTO_set_add_lock_callback,
CRYPTO_THREADID_set_callback and CRYPTO_THREADID_set_numeric threw. They
now follow LibreSSL 2.5.4's cryptlib.c, the version identified in the
firmware 13.40 measurements: CRYPTO_num_locks returns 41, the setters
store their callbacks, CRYPTO_THREADID_set_callback keeps the first
non-null one and returns 0 once one is set, and
CRYPTO_THREADID_set_numeric clears the {ptr, val} structure and stores a
64-bit value. The callbacks are never called, because the module exports
none of CRYPTO_lock, CRYPTO_add_lock or CRYPTO_THREADID_current; the debt
entry records it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
JaceTheBlu