openbsd/src/lib/libtls/tls_peer.c, branch OPENBSD_6_8_BASE

Rework name verification code so that a match is indicated via an argument,

2017-04-10T17:11:13+00:00

rather than return codes. More strictly follow RFC 6125, in particular only check the CN if there are no SAN identifiers present in the certificate (per section 6.4.4). Previous behaviour questioned by Daniel Stenberg . ok beck@ jca@

Add tls_peer_cert_chain_pem - To retreive the peer certificate and chain

2017-04-05T03:19:22+00:00

as PEM format. This allows for it to be used or examined with tools external to libtls bump minor ok jsing@

Stick with the usual 'if NULL return NULL' idiom.

2016-08-22T17:08:10+00:00

ok beck@

Add tls_peer_cert_notbefore and tls_peer_cert_notafter to expose peer certificate

2015-10-07T23:33:38+00:00

validity times for tls connections. ok jsing@

Move connection info into it's own private structure allocated and filled in

2015-09-12T21:00:38+00:00

at handshake time. change accessors to return const char * to remove need for caller to free memory. ok jsing@

!= -> == that I broke while bikeshedding

2015-09-11T13:22:39+00:00

add tls_peer functions for checking names and issuers of peer certificates.

2015-09-11T12:56:55+00:00

ok jsing@

Provide tls_peer_cert_hash() which returns a hash of the raw certificate

2015-09-11T11:28:01+00:00

that was presented by the peer. The hash used is currently SHA256, however since we prefix the result with the hash name, we can change this in the future as the need arises. The same output can be generated by using: h=$(openssl x509 -outform der -in mycert.crt | sha256) printf "SHA256:${h}\n" ok beck@