openbsd/src/lib/libcrypto/x509/x509_req.c, branch OPENBSD_7_9_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE2025-05-10T05:54:39+00:00Use err_local.h rather than err.h in most places2025-05-10T05:54:39+00:00tb2025-05-10T05:54:39+00:00urn:sha1:41e8f99dd1625a9f0c80ce9d4383e95b18e85709
ok jsing
Remove X509_REQ_{set,get}_extension_nids()2024-08-31T10:16:52+00:00tb2024-08-31T10:16:52+00:00urn:sha1:6b73d9352a214f801122b7ee10c167492ca9e38e
LibreSSL no longer supports non-standard OIDs for use in the extensions
attribute of CSRs. The API that enabled that (and nobody used of course)
can now go.
ok beck jsing
Inline trivial X509at_* calls in x509_req2024-07-26T13:24:39+00:00tb2024-07-26T13:24:39+00:00urn:sha1:325dd354d5eb34757c9fe279d89e8ce92ae4fa0c
ok jsing
Tiny style tweaks in X509_REQ_add_extension_nid()2024-05-09T14:29:08+00:00tb2024-05-09T14:29:08+00:00urn:sha1:0237c345d79efede83c051a8ba41d75fd5a80520
Test & assign and use ret instead of rv.
ok jsing
Streamline X509_REQ_check_private_key() a bit2024-05-09T14:27:21+00:00tb2024-05-09T14:27:21+00:00urn:sha1:56b0c4cefcfe68f7e94c8c3ba1a7fea169d66646
Use better variable names, split the success from the error path and
return directly rather than using an ok variable.
ok jsing
Zap some extra parentheses in X509_REQ_get_pubkey()2024-05-09T14:22:16+00:00tb2024-05-09T14:22:16+00:00urn:sha1:19d90b842d842f5ff87f6b5a02a970d42f1489b6
ok jsing
Clean up X509_to_X509_REQ()2024-05-09T14:20:57+00:00tb2024-05-09T14:20:57+00:00urn:sha1:9c19406a5c1bf474e2b3d120084072041d261c61
Use better variable names. X509_REQ_new() sets the version to the only
specified version, so there is no point to set it. Extract the subject
name, then assign to make it more obvious that we error happens if the
cert has a missing subject. Switch to X509_get0_pubkey() to avoid some
strange dance with a strangely named variable to adjust the refcount.
ok jsing
Further simplify X509_REQ_get_extensions()2024-05-09T14:00:52+00:00tb2024-05-09T14:00:52+00:00urn:sha1:4d4c216ae350a301fd01dd521f9b3260fc9db17b
Instead of inlining a poor version of ASN1_TYPE_unpack_sequence() with
missing error checks, just call the real thing. It's safer and simpler.
ok jsing
Simplify X509_REQ_get_extensions()2024-05-08T08:20:08+00:00tb2024-05-08T08:20:08+00:00urn:sha1:0545b7fda04ee1a8a0fcc9978f5622784b152278
Now that we know the two OIDs we need to look for when checking for the
extension list attribute in a certification request, we can simplify this
quite a bit. There is one change of behavior. Attribute value sets are not
supposed to be empty and it makes no sense to return an empty stack of
extensions in that case, return NULL instead, matching BoringSSL.
This removes last use of ext_nids and ext_nid_list[], so these two bits
of unprotected global mutable state can now join the party in the attic.
ok jsing
Simplify X509_REQ_extension_nid()2024-05-08T08:11:50+00:00tb2024-05-08T08:11:50+00:00urn:sha1:ffb8206b50bbd81b1f29efa652218fd949b207af
Now that the global ext_nids[] array can no longer be modified by the
application, we can simplify this by returning the two possible NIDs
that we accept in the extension list attribute in PKCS#10 certification
requests.
The year is 2024. This API is entirely unused by the ecosystem. Well not
entirely! One small village of indomitable rare API use still holds out
against the cleansers. You may have guessed it: security/xca.
ok jsing