OpenSSL Security Advisory (14 December 2021)

Re:OpenSSL Security Advisory (14 December 2021) by rurban on Tuesday December 14, 2021 @05:56PM (#29559282)

Now look at their insane API.

The ssl verify returns

    Verify a certificate chain
    * Return codes:
    *  1: Verify success
    *  0: Verify failure or error
    * -1: Retry required
    */

But the x509 cert verify returns -1 for verification error.

[ Parent | on HN ]

Re:OpenSSL Security Advisory (14 December 2021) by mjg59 on Tuesday December 14, 2021 @09:36PM (#29561391)

Right. Previously the return code from x509_verify_cert was returned directly to the caller, which was incorrect - ssl_verify_chain_cert was supposed to return -1 if the caller should retry, but would end up doing so on any error that was returned from x509_verify_cert. So the patch is correct.

If your argument is that the return codes should be consistent across different layers of OpenSSL then I'm not going to disagree, but this is a large old codebase and this isn't some unique case.

[ Parent | on HN ]

Re:OpenSSL Security Advisory (14 December 2021) by dc-programmer on Tuesday December 14, 2021 @11:10PM (#29561990)

I’m pretty sure this has caused CVEs before. Folks will check !ret and call it a day.

[ Parent | on HN ]

Re:OpenSSL Security Advisory (14 December 2021) by GoblinSlayer on Wednesday December 15, 2021 @03:04AM (#29563216)

You just never used OpenSSL, their API is legendary.

[ Parent | on HN ]