commit 616d780

libtls-bearssl: Update to latest git

1@@ -1,6 +1,7 @@
2 cflags{
3 	'-std=c11', '-Wall', '-Wpedantic',
4 	'-D _DEFAULT_SOURCE',
5+	'-D LIBRESSL_INTERNAL',
6 	'-I $srcdir',
7 	'-isystem $builddir/pkg/bearssl/include',
8 }

 1@@ -1,22 +1,23 @@
 2-From ce2e99a74f9216fa5783a6bc943c228788fd469c Mon Sep 17 00:00:00 2001
 3+From 430580cf1df1fe85f7401ebf3e0005b9f72bfac7 Mon Sep 17 00:00:00 2001
 4 From: Michael Forney <mforney@mforney.org>
 5 Date: Thu, 13 May 2021 22:17:56 -0700
 6 Subject: [PATCH] Use patched bearssl flag to force CertificateRequest
 7 
 8 ---
 9- tls_server.c | 6 +-----
10- 1 file changed, 1 insertion(+), 5 deletions(-)
11+ tls_server.c | 7 +------
12+ 1 file changed, 1 insertion(+), 6 deletions(-)
13 
14 diff --git a/tls_server.c b/tls_server.c
15-index 2436036..7f578b8 100644
16+index 87bf4f4..f03d326 100644
17 --- a/tls_server.c
18 +++ b/tls_server.c
19-@@ -339,11 +339,7 @@ tls_accept_common(struct tls *ctx)
20+@@ -332,12 +332,7 @@ tls_accept_common(struct tls *ctx)
21  		if (tls_configure_x509(conn_ctx) != 0)
22  			goto err;
23  
24 -		if (ctx->config->ca_len == 0) {
25--			tls_set_errorx(ctx, "cannot verify client without trust anchors");
26+-			tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
27+-			    "cannot verify client without trust anchors");
28 -			goto err;
29 -		}
30 -
31@@ -25,5 +26,5 @@ index 2436036..7f578b8 100644
32  		    ctx->config->ca, ctx->config->ca_len);
33  
34 -- 
35-2.31.1
36+2.49.0
37 

 1@@ -1,45 +0,0 @@
 2-From 7701b90a015c4e4c2b6af6e8b53315dce1f6c780 Mon Sep 17 00:00:00 2001
 3-From: Michael Forney <mforney@mforney.org>
 4-Date: Sun, 29 Mar 2020 13:07:39 -0700
 5-Subject: [PATCH] Use patched bearssl method to retrieve validity period
 6-
 7----
 8- tls_conninfo.c | 22 ++++++++++++++++++----
 9- 1 file changed, 18 insertions(+), 4 deletions(-)
10-
11-diff --git a/tls_conninfo.c b/tls_conninfo.c
12-index ccce70d..1e9b57e 100644
13---- a/tls_conninfo.c
14-+++ b/tls_conninfo.c
15-@@ -162,10 +162,24 @@ static int
16- tls_get_peer_cert_times(struct tls *ctx, time_t *notbefore,
17-     time_t *notafter)
18- {
19--	/* XXX: BearSSL has no way to get certificate notBefore and
20--	 * notAfter */
21--	*notbefore = -1;
22--	*notafter = -1;
23-+	br_x509_decoder_context xc;
24-+	uint32_t notbefore_days, notbefore_seconds;
25-+	uint32_t notafter_days, notafter_seconds;
26-+	int err;
27-+
28-+	br_x509_decoder_init(&xc, NULL, NULL);
29-+	br_x509_decoder_push(&xc, ctx->peer_chain[0].data, ctx->peer_chain[0].data_len);
30-+
31-+	if ((err = br_x509_decoder_last_error(&xc)) != 0) {
32-+		tls_set_errorx(ctx, "%s", bearssl_strerror(err));
33-+		return (-1);
34-+	}
35-+
36-+	br_x509_decoder_get_notbefore(&xc, &notbefore_days, &notbefore_seconds);
37-+	br_x509_decoder_get_notafter(&xc, &notafter_days, &notafter_seconds);
38-+
39-+	*notbefore = 86400LL * (notbefore_days - 719528) + notbefore_seconds;
40-+	*notafter = 86400LL * (notafter_days - 719528) + notafter_seconds;
41- 
42- 	return (0);
43- }
44--- 
45-2.31.1
46-

1@@ -1 +1 @@
2-Subproject commit 28db202f76a6fc1bec6e0d58412e348b1a14fb37
3+Subproject commit 0d2b6e2aa5c5888f0d731b774a274cbea3ddb386

1@@ -1 +1 @@
2-0.5 r4
3+0.5-147-g0d2b6e2aa5