openbsd/src/lib/libtls/tls_conninfo.c, branch OPENBSD_7_9A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_92026-03-28T11:33:33+00:00libtls: simple cases of const for X509_NAME *2026-03-28T11:33:33+00:00tb2026-03-28T11:33:33+00:00urn:sha1:cb80f3489708580ad1f1d4b027d1c0b23fa3f15a
After the const sprinkling in OpenSSL 1.1, X509_get_{issuer,subject}_name()
still returned a non-const pointer for unclear reasons. In OpenSSL 4,
the return value also grew a const qualifier, so move the two "name" in
tls_conninfo.c and the "subject_name" in tls_verify.c to const. They are
only used for further processing by already const correct functions (at
least as far as X509_NAME is concerned).
ok djm jsing kenjiro
Provide tls_peer_cert_common_name()2024-12-10T08:40:30+00:00tb2024-12-10T08:40:30+00:00urn:sha1:d3da05396af6da5d0c94da0425031aa4fd529ac9
There is currently no sane way of getting your hands on the common name or
subject alternative name of the peer certificate from libtls. It is possible
to extract it from the peer cert's PEM by hand, but that way lies madness.
While the common name is close to being deprecated in the webpki, it is
still the de facto standard to identify client certs. It would be nice to
have a way to access the subject alternative names as well, but this is a
lot more difficult to expose in a clean and sane C interface due to its
multivaluedness.
Initial diff from henning, with input from beck, jsing and myself
henning and bluhm have plans of using this in syslogd.
ok beck
Fix previous commit.2024-03-26T06:31:22+00:00jsing2024-03-26T06:31:22+00:00urn:sha1:e382a20db9324b738a67c68ab2ca9180ad743fc6Add error code support to libtls2024-03-26T06:24:52+00:00joshua2024-03-26T06:24:52+00:00urn:sha1:bd68c6e1694d8d4eb801f32889da4cdde0b3c311
This adds tls_config_error_code() and tls_error_code(), which will become
public API at a later date.
Additional error codes will be added in follow-up commits.
ok jsing@ beck@
Convert libressl to use the BoringSSL style time conversions2024-03-24T11:30:12+00:00beck2024-03-24T11:30:12+00:00urn:sha1:0f167a53fa3e19b7e6bb0620e16c6d11f07f10ca
This gets rid of our last uses of timegm and gmtime in the
library and things that ship with it. It includes a bit
of refactoring in ocsp_cl.c to remove some obvious ugly.
ok tb@
Remove ASN1_time_parse() dependency in tls_conninfo.c2023-11-13T10:51:49+00:00tb2023-11-13T10:51:49+00:00urn:sha1:f3a0b367152681ccbb4de822d60575d8e43d9522
During r2k22 ported some of the missing OpenSSL ASN.1 time API. This is
a step towards removing the dependency of libtls on ASN1_time_parse().
The latter grew a dependency on CBS/CBB, and thus the choice is to pull
in all this code or to use a no longer maintained version of the API.
Both options are unappealing.
ok beck
add missing #include <string.h>; ok tb@2023-05-14T07:26:25+00:00op2023-05-14T07:26:25+00:00urn:sha1:751c792967481bc8add0d09d060248a9d59cfadfRemove memset that was made redundant with the ASN1_time_parse()2021-01-05T15:57:38+00:00tb2021-01-05T15:57:38+00:00urn:sha1:c2affb92204dca1446bbdf5b7404fda1dc41e2c2
fix in libcrypto/asn1/a_time_tm.c r1.16.
Suggested by jsing
Provide tls_conn_cipher_strength().2019-11-02T13:37:59+00:00jsing2019-11-02T13:37:59+00:00urn:sha1:914deddb0bc7631f9603d3f22c07d8b3b6031d80
This returns the strength in bits of the symmetric cipher used for the
connection.
Diff from gilles@
ok tb@
Tidy/standardise some code.2018-02-10T04:48:44+00:00jsing2018-02-10T04:48:44+00:00urn:sha1:0865717e89a23608e9e870a932e575c2eee93965