Repository: randombit/botan
Pull request #3261 (2023-02-08 08:10:09)

Backport: Doc/FIX: misleading usage of Credentials_Manager::cert_chain()
Backport of #3260.


Patch:
diff --git a/configure.py b/configure.py
index 7ff2ef2a2..72e02c37a 100755
--- a/configure.py
+++ b/configure.py
@@ -1747,12 +1747,13 @@ def yield_objectfile_list(sources, obj_dir, obj_suffix, options):
 
     for src in sources:
         (directory, filename) = os.path.split(os.path.normpath(src))
-        parts_in_src = directory.split('src' + os.sep)
-        parts = []
+        parts = directory.split(os.sep)
 
-        if len(parts_in_src) > 1:
-            parts = (parts_in_src[-1].split(os.sep))[1:]
-        elif not options.amalgamation or filename.find(options.name_amalgamation) == -1:
+        if 'src' in parts:
+            parts = parts[parts.index('src')+2:]
+        elif options.amalgamation and filename.find(options.name_amalgamation) != -1:
+            parts = []
+        else:
             raise InternalError("Unexpected file '%s/%s'" % (directory, filename))
 
         if parts != []:
diff --git a/doc/api_ref/tls.rst b/doc/api_ref/tls.rst
index fdffeda26..e5c4e9913 100644
--- a/doc/api_ref/tls.rst
+++ b/doc/api_ref/tls.rst
@@ -1556,9 +1556,18 @@ Server Code Example
              const std::string& type,
              const std::string& context) override
              {
-             // return the certificate chain being sent to the tls client
+             Botan::X509_Certificate server_cert("botan.randombit.net.crt");
+
+             // make sure that the server asked for your certificate's key type
+             // before handing it out to the implementation
+             const auto key_type = server_cert.subject_public_key_algo().get_oid().to_formatted_string();
+             const auto itr = std::find(cert_key_types.begin(), cert_key_types.end(), key_type);
+             if (itr == cert_key_types.end())
+                { return {}; }
+
+             // return the certificate chain being sent to the tls server
              // e.g., the certificate file "botan.randombit.net.crt"
-             return { Botan::X509_Certificate("botan.randombit.net.crt") };
+             return {server_cert};
              }
 
           Botan::Private_Key* private_key_for(const Botan::X509_Certificate& cert,
diff --git a/doc/support.rst b/doc/support.rst
index e94672c9e..7f0ffc2a0 100644
--- a/doc/support.rst
+++ b/doc/support.rst
@@ -9,7 +9,7 @@ For Botan 2, the tier-1 supported platforms are
 * Linux x86-64, GCC 4.8 or higher
 * Linux x86-64, Clang 3.5 or higher
 * Linux aarch64, GCC 4.8+
-* Linux ppc64le, GCC 8.1+
+* Linux ppc64le, GCC 4.8+
 * Windows x86-64, Visual C++ 2015 and 2017
 
 These platforms are all tested by continuous integration, and the developers
diff --git a/news.rst b/news.rst
index 12059f12d..f221dd2eb 100644
--- a/news.rst
+++ b/news.rst
@@ -1,18 +1,6 @@
 Release Notes
 ========================================
 
-Version 2.19.4, Not Yet Released
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-* Fix a bug in SHAKE_Cipher which could cause incorrect output
-  if set_key was called multiple times. (GH #3192)
-
-* Fix a bug in PKCS11 AttributeContainer where adding an attribute
-  that already existed could cause incorrect references to the
-  existing attributes. (GH #3185)
-
-* Fix a build time problem affecting VCpkg (GH #3071)
-
 Version 2.19.3, 2022-11-16
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
diff --git a/src/build-data/version.txt b/src/build-data/version.txt
index e7d44a0ab..b8fa21b26 100644
--- a/src/build-data/version.txt
+++ b/src/build-data/version.txt
@@ -1,7 +1,7 @@
 
 release_major = 2
 release_minor = 19
-release_patch = 4
+release_patch = 3
 release_suffix = ''
 release_so_abi_rev = 19
 
diff --git a/src/lib/prov/pkcs11/p11_object.cpp b/src/lib/prov/pkcs11/p11_object.cpp
index edda423f6..0b92d9bf8 100644
--- a/src/lib/prov/pkcs11/p11_object.cpp
+++ b/src/lib/prov/pkcs11/p11_object.cpp
@@ -59,20 +59,21 @@ void AttributeContainer::add_attribute(AttributeType attribute, const uint8_t* v
       if(existing_attribute.type == static_cast< CK_ATTRIBUTE_TYPE >(attribute))
          {
          // remove old entries
-         m_strings.remove_if([ &existing_attribute ](const std::string& data)
+         m_strings.erase(std::remove_if(m_strings.begin(), m_strings.end(), [ &existing_attribute ](const std::string& data)
             {
             return data.data() == existing_attribute.pValue;
-            });
+            }), m_strings.end());
 
-         m_numerics.remove_if([ &existing_attribute ](const uint64_t& data)
+         m_numerics.erase(std::remove_if(m_numerics.begin(), m_numerics.end(), [ &existing_attribute ](const uint64_t& data)
             {
             return &data == existing_attribute.pValue;
-            });
+            }), m_numerics.end());
 
-         m_vectors.remove_if([ &existing_attribute ](const secure_vector<uint8_t>& data)
+         m_vectors.erase(std::remove_if(m_vectors.begin(),
+                                        m_vectors.end(), [ &existing_attribute ](const secure_vector<uint8_t>& data)
             {
             return data.data() == existing_attribute.pValue;
-            });
+            }), m_vectors.end());
 
          existing_attribute.pValue = const_cast< uint8_t* >(value);
          existing_attribute.ulValueLen = size;
diff --git a/src/lib/stream/shake_cipher/shake_cipher.cpp b/src/lib/stream/shake_cipher/shake_cipher.cpp
index f09ba03bc..f1920959e 100644
--- a/src/lib/stream/shake_cipher/shake_cipher.cpp
+++ b/src/lib/stream/shake_cipher/shake_cipher.cpp
@@ -44,7 +44,6 @@ void SHAKE_128_Cipher::key_schedule(const uint8_t key[], size_t length)
    m_state.resize(25);
    m_buffer.resize(SHAKE_128_BITRATE/8);
    zeroise(m_state);
-   m_buf_pos = 0;
 
    const size_t S_pos = SHA_3::absorb(SHAKE_128_BITRATE, m_state, 0, key, length);
    SHA_3::finish(SHAKE_128_BITRATE, m_state, S_pos, 0x1F, 0x80);


Test patch:
diff --git a/src/tests/test_pkcs11_high_level.cpp b/src/tests/test_pkcs11_high_level.cpp
index 7acb7e4b7..84c2c62c3 100644
--- a/src/tests/test_pkcs11_high_level.cpp
+++ b/src/tests/test_pkcs11_high_level.cpp
@@ -489,24 +489,9 @@ Test::Result test_attribute_container()
    attributes.add_binary(AttributeType::Value, bin);
 
    attributes.add_bool(AttributeType::Sensitive, true);
-   attributes.add_numeric(AttributeType::ObjectId, 10);
-   attributes.add_numeric(AttributeType::Id, 20);
-   attributes.add_numeric(AttributeType::PixelX, 30);
-   // Test that overwriting the existing Id attribute works. The numeric attributes above should not be affected by this.
-   attributes.add_numeric(AttributeType::Id, 21);
-   attributes.add_numeric(AttributeType::PixelY, 40);
-
-   result.test_eq("8 elements in attribute container", attributes.count(), 8);
-
-   const std::vector<Botan::PKCS11::Attribute>& storedAttributes = attributes.attributes();
-   result.test_int_eq("ObjectId type", storedAttributes.at(4).type, AttributeType::ObjectId);
-   result.test_int_eq("ObjectId value", *reinterpret_cast< uint64_t* >(storedAttributes.at(4).pValue), 10);
-   result.test_int_eq("Id type", storedAttributes.at(5).type, AttributeType::Id);
-   result.test_int_eq("Id value", *reinterpret_cast< uint64_t* >(storedAttributes.at(5).pValue), 21);
-   result.test_int_eq("PixelX type", storedAttributes.at(6).type, AttributeType::PixelX);
-   result.test_int_eq("PixelX value", *reinterpret_cast< uint64_t* >(storedAttributes.at(6).pValue), 30);
-   result.test_int_eq("PixelY type", storedAttributes.at(7).type, AttributeType::PixelY);
-   result.test_int_eq("PixelY value", *reinterpret_cast< uint64_t* >(storedAttributes.at(7).pValue), 40);
+   attributes.add_numeric(AttributeType::ObjectId, 12);
+
+   result.test_eq("Five elements in attribute container", attributes.count(), 5);
 
    return result;
    }