openbsd/src/usr.bin/openssl/ca.c, branch OPENBSD_7_9A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_92025-12-21T07:14:47+00:00Reimplement ASN1_PRINTABLE_type() dance in ca.c2025-12-21T07:14:47+00:00tb2025-12-21T07:14:47+00:00urn:sha1:f6a49b32fda99b726ad5b4434bcade613dccf49e
In ca.c, there is some minimal validation of strings in the subject of
a certificate. ASN1_PRINTABLE_type() is silly API that only exists for
this one call. I want to remove a_print.c in the next major bump.
ASN1_PRINTABLE_type() returns V_ASN1_PRINTABLESTRING if all characters
belong to the specific subset of ASCII listed in X.680, 41.4, Table 10.
Otherwise it returns V_ASN1_T61STRING or V_ASN1_IA5STRING depending on
whether there is a character with the high bit set or not.
With this in mind, the logic in ca.c comes down to this: blindly allow
UTF-8, BMP and T61 strings. All other strings get rejected if the high
bit of some character is set, or if the string is printable and there
is a non-printable character.
ok jsing kenjiro
openssl ca: mechanical change to stop reaching into ASN1_STRING2025-11-27T08:24:30+00:00tb2025-11-27T08:24:30+00:00urn:sha1:9c2fb2d749c8780ed1220475b6050f4dbebf9d0a
ok kenjiro
Remove openssl ca -msie_hack2025-04-14T08:39:27+00:00tb2025-04-14T08:39:27+00:00urn:sha1:2dff8fa459400ed4bacc7ed81ae06ff6c0e179a3
The nineties called and wanted their garbage back.
ok jsing
openssl ca: use BN_bn2hex() rather than reimplementing it2025-02-25T09:49:33+00:00tb2025-02-25T09:49:33+00:00urn:sha1:bb2ae631a25155bd33aa98bd4c66dfc4a50f454e
ok jsing
Remove spkac handling from openssl(1) ca2024-07-08T05:56:17+00:00tb2024-07-08T05:56:17+00:00urn:sha1:466fd35ccdee1cbe42dfc7f2e4d3225c07427279
This is very poorly written code and now the only consumer of some
public API that should not have survived the turn of the millenium.
ok jsing
openssl ca: avoid double free for spkac files without default section2024-06-23T07:50:52+00:00tb2024-06-23T07:50:52+00:00urn:sha1:2ce7c4a21e1cf197d94a02dec415e9f55a6a7294
ok jsing
Zap a useless comment followed by a stray semicolon2024-02-04T13:08:29+00:00tb2024-02-04T13:08:29+00:00urn:sha1:0e3ffc21b85538d145bb3e56108f842f7735e886
Noticed by Christian Andersen
Kill last user of ASN1_time_parse() in the tree2023-11-13T12:43:08+00:00tb2023-11-13T12:43:08+00:00urn:sha1:8161eba73aec9d6c1be3143e72d0f95387a0aafe
ASN1_time_parse() was useful while OpenSSL didn't have something sort of
equivalent, but now they do. Let's retire ASN1_time_parse() to internal.
This will require some patching in ports, but shrug.
ok beck
Teach openssl ca about Ed25519 certificates2023-07-02T07:08:57+00:00tb2023-07-02T07:08:57+00:00urn:sha1:da52349d5b9adc2e36356a6b6bbe1116e2fef916
This adds a few logic curlies to end up setting the EVP_MD to EVP_md_null()
as required by the API. This way ASN1_item_sign() now knows how to behave.
"ok = (rv == 2);" beck
Rename struct ${app}_config to plain cfg2023-03-06T14:32:06+00:00tb2023-03-06T14:32:06+00:00urn:sha1:2ba7dcfcbc2ef5aaeb8eb14f36f83bd57c22bcae
All the structs are static and we need to reach into them many times.
Having a shorter name is more concise and results in less visual clutter.
It also avoids many overlong lines and we will be able to get rid of some
unfortunate line wrapping down the road.
Discussed with jsing