openbsd/src/lib/libcrypto/x509/x509_lib.c, branch OPENBSD_7_9_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE2025-05-10T05:54:39+00:00Use err_local.h rather than err.h in most places2025-05-10T05:54:39+00:00tb2025-05-10T05:54:39+00:00urn:sha1:41e8f99dd1625a9f0c80ce9d4383e95b18e85709
ok jsing
Unify X.509v3 extension methods2024-07-13T15:08:58+00:00tb2024-07-13T15:08:58+00:00urn:sha1:3a6927c782869fec9a91b17f3757e56538e5d418
Use C99 initializers for all structs (some were forgotten).
Make all the structs static, call them x509v3_ext_* matching NID_*.
Add accessors called x509v3_ext_method_* and use these to implement
X509V3_EXT_get_nid().
This adds consistency and avoids a few contortions like grouping
a few extensions in arrays to save a couple externs.
ok beck jsing
Replace x with x509_exts in X509V3_add1_i2d() and X509V3_get_d2i()2024-06-17T05:38:08+00:00tb2024-06-17T05:38:08+00:00urn:sha1:36ba4338dd26479d21f17ef1e68268b408bebd30
requested by jsing on review
Rewrite X509V3_get_d2i()2024-06-17T05:31:26+00:00tb2024-06-17T05:31:26+00:00urn:sha1:e439b8d63e4da3a92c2f01e1a961af48d18eae31
This API is wrapped by nine *_get{,1}_ext_d2i() functions and they all
have the same defect: if an idx variable is passed in, multiple extensions
are handled incorrectly.
Clean up the mess that was the current implementation by replacing the
reimplementation of X509v3_get_ext_by_NID() with extra twists by actual
calls to the real thing. This way the madness is implemented explicitly
and can be explained in comments. The code still gets shorter.
In brief: always call this API with a known nid, pass crit, and a NULL idx.
If NULL is returned, crit != -1 is an error (malformed cert or allocation
failure).
ok jsing
Clean up and fix X509V3_EXT_add1_i2d()2024-05-28T15:40:38+00:00tb2024-05-28T15:40:38+00:00urn:sha1:b9c59e2e09e7a6efaa76dde887001001d9f0d3c3
When looking at this code I noticed a few leaks. Fixing those leaks
was straightforward, but following the code was really hard.
This attempts to make the logic a bit clearer. In short, there are
6 mutually exclusive modes for this function (passed in the variable
aptly called flags). The default mode is to append the extension of
type nid and to error if such an extension already exists. Then there
are other modes with varying degree of madness.
The existing code didn't make X509V3_ADD_REPLACE explicit, which is
confusing. Operations 6-15 would all be treated like X509V3_ADD_REPLACE
due to the way the function was written. Handle the supported operations
via a switch and error for operations 6-15. This and the elimination
of leaks are the only changes of behavior, as validated by relatively
extensive test coverage.
ok jsing
Move X509V3_add_standard_extensions out of the way2024-05-11T18:59:39+00:00tb2024-05-11T18:59:39+00:00urn:sha1:43ce2d5002d6da5cf3140ee842a4b00fcf765aff
This function is only used by OpenLDAP and it's been a noop since
forever. It has no business to be squeezed in between a number of
other, quite unrelated functions. It's distracting.
Make two NULL checks more explicit2024-05-11T18:52:52+00:00tb2024-05-11T18:52:52+00:00urn:sha1:f47857b47665544848b8c38d3c7635adaf3e239cUnwrap a line2024-05-11T18:48:47+00:00tb2024-05-11T18:48:47+00:00urn:sha1:920bfbfc69f0b881eb84487435b6af091c9f23b6Remove X509V3_EXT extensibility API2024-03-02T10:35:32+00:00tb2024-03-02T10:35:32+00:00urn:sha1:a3c990bc8f1fde064c43ffefb311482cb87ecd54
You used to be able to define your own X.509 extension handlers. Great.
Even greater: the verifier would ignore any custom extensions. So this
was only ever useful for serialization and deserialization. In other
words, almost entirely pointless. The API was also unused except for
a hack in kore-acme, which was fixed recently.
ok jsing
This table no longer needs to be sorted2024-01-25T15:09:22+00:00tb2024-01-25T15:09:22+00:00urn:sha1:279199e435fdb9797f7a038754e9fe9846c5a049