signify: check last block size for gzip
The gzip header contains a blocksize extended header. This patch adds the
parsing of an extra lastblocksize header. As the name indicates, this marks
the end of the recorded SHA512/256 blocks and allows checking the size of
the signed data. Once its presence is enforced, this will prevent length
extension attacks. While no such attack for SHA512/256 is known or even
expected to exist, having a tighter form is desirable anyway.
This header not yet emitted and the parser treats it as optional to allow
transitioning. In follow up steps the lastblock will be emitted on signing
and then its presence will be required.
looked over by op
from espie
libgcrypt: enable use of more riscv64 extensions
Contrary to Linux which implemented a new "hwprobe" syscall, OpenBSD
adds support for more RISC-V CPU-specific features through
elf_aux_info(AT_HWCAP2). Use this to enable more speedups in libgcrypt.
While here drop a workaround no longer needed for a type mismatch in RVV
code.
ok ajacoutot@
rpki-client: sync wth libcrypto bytestring.h r1.11
Provide CBS_ASN1_IA5_STRING
This will soon be needed in rpki-client for: fileName in Manifest fileList,
cPSuri in certificate policy qualifiers and uniformResourceIdentifier in
GeneralName, to name a few.
Per X.680, section 41, table 8, the universal class number is 22 == 0x16.
The naming of the constant matches BoringSSL's.
bytestring: provide CBS_ASN1_IA5STRING
This will soon be needed in rpki-client for: fileName in Manifest fileList,
cPSuri in certificate policy qualifiers and uniformResourceIdentifier in
GeneralName, to name a few.
Per X.680, section 41, table 8, the universal class number is 22 == 0x16.
The naming of the constant matches BoringSSL's.
ok kenjiro
nc: do not treat tls_read() failures as fatal with -k
tls_read() can fail because the peer sends a malformed record. If -k is
given, treat the failure gracefully, warn, and allow the caller to free
the failed resources before accepting another connection.
Fixes a bug introduced in r1.203 (Feb 2019)
Simplified version of a diff by Acts1631
ok kenjiro
