Per review feedback on #2017: a hand-rolled byte loop can in principle
be folded back into a short-circuiting compare by an aggressive optimizer.
Use CRYPTO_memcmp under HAVE_LIBSSL since OpenSSL is already a build
dependency for the SHA256 path. For non-OpenSSL builds, mark the
accumulator and pointers volatile and note in a comment that this is
best-effort.
cctz::parse into a microseconds time_point internally multiplies the
parsed seconds-since-epoch by 1,000,000 in signed int64. Years past ~292k
overflow, which is UB under UBSan or -ftrapv builds. In plain production
builds the overflow silently wraps and buffer playback shows a garbage
timestamp.
Reject anything with a year longer than 5 digits before calling into
cctz. 5 digits covers every realistic IRCv3 @time tag.
These days salted SHA-256 is considered quite weak for passwords.
Transparently upgrade existing hashes upon login.
Bump cmake requirement to able to use IMPORTED_TARGET, this will allow
further cleanup in next commits.
by calling CTable::SetStyle(CTable::ListStyle) one can switch from the
bulky and unreadable-on-narrow-devices-or-nonmonospaced-fonts tables to
a more compact list style of output. The first "column" will be bolded
for better visibility and seperated with a colon from the second.
This is currently designed to replace two column tables only.
The <memory> headers is needed for unique_ptr even when SSL is not
enabled. This fixes the following build failure:
src/Utils.cpp: In static member function 'static bool CUtils::CheckCIDR(const CString&, const CString&)':
src/Utils.cpp:674:5: error: 'unique_ptr' is not a member of 'std'
std::unique_ptr<addrinfo, decltype(deleter)> aiHost(aiHostC, deleter);
^
Close#1554
X509_get_subject_name() returns an internal pointer, which was destroyed
by X509_set_subject_name(), and then accessed again in
X509_set_issuer_name().
But X509_set_subject_name() isn't needed at all, because subject name
was modified in place.
If OpenSSL 1.1 is configured in such a way that features deprecated in 0.9.8 are not built, then compile errors would result here.
I also noticed a potential memory leak where pRSA was not always freed before early return from this function - fixed by using C++11 unique_ptr.
A few different implementations of computing the current time were
spread out through the code base, most of them using gettimeofday().
This centralizes the logic in CUtil::GetTime() for easier maintenance,
and also allows all call sites to get the benefit of the clock_gettime()
code path on systems that support it.
Alhuda Khan