openbsd/src/lib/libcrypto, branch tb_20210818A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=tb_202108182021-08-18T16:06:57+00:00This commit was manufactured by cvs2git to create tag 'tb_20210818'.2021-08-18T16:06:57+00:00cvs2svnadmin@example.com2021-08-18T16:06:57+00:00urn:sha1:d56c8fa8260d226f98b26f017b45b9c2b135f38dImport initial code for the SM2 cipher2021-08-18T16:04:32+00:00tb2021-08-18T16:04:32+00:00urn:sha1:a20accd2bfd8ef02b4b4e6d1e5e7cb57e0a536e4
This adds the SM2 algorithm defined in the Chinese standards
GB/T 32918.1-2016, GB/T 32918.2-2016, GB/T 32918.3-2016,
GB/T 32918.4-2016 and GB/T 32918.5-2017.
This is an ISC licensed implementation contributed by Ribose.inc, based
on the same code that was contributed to OpenSSL by Jack Lloyd. The port
to LibreSSL was done by Ronald Tse and Nickolay Olshevsky.
Github PR #105
I made quite a few cleanup passes on this, but more is needed, some
of which will happen in-tree before this is linked to the build.
ok deraadt inoguchi (a long time ago), jsing
Add a check_trust call to the legacy chain validation on chain add, remembering2021-08-18T15:32:38+00:00beck2021-08-18T15:32:38+00:00urn:sha1:3a5e633f2def93f8e8c43882018f2f5efb474848
the result in order to return the same errors as OpenSSL users expect to override
the generic "Untrusted cert" error.
This fixes the openssl-ruby timestamp test.
ok tb@
Refactor the legacy chain validation from the chain adding code into its2021-08-18T15:10:46+00:00beck2021-08-18T15:10:46+00:00urn:sha1:54eced1b0209560349d92f6b59f1ee964afb1dde
own function, in preparation for subesquent change. No functional change.
ok tb@
link X509_STORE_get_by_subject(3) and X509_ocspid_print(3) to the build,2021-08-06T21:50:54+00:00schwarze2021-08-06T21:50:54+00:00urn:sha1:97c6e4ce5291e57bb264ab5855d94e78b09cf897
forgotten in earlier commits
new manual page X509_ocspid_print(3)2021-08-06T21:45:55+00:00schwarze2021-08-06T21:45:55+00:00urn:sha1:172327ff6e7395b57b84c156f9f430cee461e85a
using input from tb@, and OK tb@ on an earlier version
add a roff(7) comment marking the API function X509_get_default_private_dir()2021-08-06T19:09:56+00:00schwarze2021-08-06T19:09:56+00:00urn:sha1:11e33693517266d4557f25304a7ba8843d4535fe
as intentionally undocumented because it is trivial and unused in the wild;
OK tb@
Document X509_get_default_cert_dir_env(3)2021-08-03T19:47:39+00:00schwarze2021-08-03T19:47:39+00:00urn:sha1:47d24879f9ff720528a57ca26e679e90aa5cf66d
and X509_get_default_cert_file_env(3).
LibreSSL itself does not call getenv(3), but a few application programs
including epic5, fetchmail, fossil, slic3r call these functions, so in
case programmers find them in existing code, telling them what they do
seems useful.
Document X509_get_default_cert_area(3).2021-08-03T18:49:30+00:00schwarze2021-08-03T18:49:30+00:00urn:sha1:417c7b471eb496adbbf5040263f69563a125d430
Put it into this page because this is the code actually using it.
Despite its name and include file, it is unrelated to X.509
and unrelated to certificates: it is just the default directory
containing the library configuration file, openssl.cnf(5).
tweaks regarding X509_LOOKUP_by_subject(3):2021-08-02T16:29:27+00:00schwarze2021-08-02T16:29:27+00:00urn:sha1:6dbfb9ae626efeea8c3b616973cdb8713e23e1b9
* document the X509_OBJECT output parameter
* more precision regarding return values
* clarify relationship with X509_LOOKUP_ctrl(3) for the dir lookup method