openbsd/src/usr.bin/openssl/verify.c, branch OPENBSD_7_9_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE 2023-11-21T17:56:19+00:00 Make a few purpose things const 2023-11-21T17:56:19+00:00 tb 2023-11-21T17:56:19+00:00 urn:sha1:cf8443276e8273969971b03dcddc0d59bc6eb1c9 This should allow us to constify a sizable table in libcrypto in an upcoming bump. Drop policy printing from openssl 2023-04-14T15:27:13+00:00 tb 2023-04-14T15:27:13+00:00 urn:sha1:c10c85651e3dc8e653705dc1c2dd2683fe0f6c66 Nothing really uses the policy tree. It's desgined with built-in DoS capabilities directly from the RFC. It will be removed from the attack surface and replaced with something equivalent that doesn't grow exponentially with the depth. This removes the only reason the policy tree itself ever leaked out of the library. ok jsing Rename struct ${app}_config to plain cfg 2023-03-06T14:32:06+00:00 tb 2023-03-06T14:32:06+00:00 urn:sha1:2ba7dcfcbc2ef5aaeb8eb14f36f83bd57c22bcae All the structs are static and we need to reach into them many times. Having a shorter name is more concise and results in less visual clutter. It also avoids many overlong lines and we will be able to get rid of some unfortunate line wrapping down the road. Discussed with jsing Remove the legacy interactive mode from openssl(1). 2022-11-11T17:07:39+00:00 joshua 2022-11-11T17:07:39+00:00 urn:sha1:273d9e16fc9e481283c2b2302b348e4863e29f28 This removes the legacy interactive mode from openssl(1) since it is rarely used, complicates the code, and has also been removed from OpenSSL in version 3.x.x. ok tb@ jsing@ Only print the certificate file once on verifification failure. 2021-02-15T17:57:58+00:00 jsing 2021-02-15T17:57:58+00:00 urn:sha1:0b461778dac5c3e797692a7881d2230184e8922d Noted by Steffen Ullrich. ok tb@ Wrap remaining overlong lines. 2020-11-03T18:50:25+00:00 tb 2020-11-03T18:50:25+00:00 urn:sha1:967041bbea862bbcf15a686ce4d864db93926c07 garbage collect an essentially unused variable and wrap some overlong 2020-11-03T18:47:19+00:00 tb 2020-11-03T18:47:19+00:00 urn:sha1:c1c7dbb08d1491db8dd43c17dc3e3d45fd69e71c lines * ptr -> *ptr 2020-11-03T18:42:52+00:00 tb 2020-11-03T18:42:52+00:00 urn:sha1:0a0d1e90811ea1d87743eb96667619fb172f6f5a X509_verify_cert()'s return value is not reliable if the callback 2020-11-03T18:39:18+00:00 tb 2020-11-03T18:39:18+00:00 urn:sha1:05ba144d4debddd80fff1d1822c0d8ad682cc3cd returns 1. verify.c's cb() ignores a bunch of things to display as much info as possible. Thus, check the error code on the store ctx as well, similar to OpenSSL commit d9e309a6 (old licence). This makes openssl verify error on expired certs, at least with the legacy verify code. While here, fix a number of style issues, simplify and plug a leak. ok inoguchi Add a -legacy_verify flag to force use of the old validator for debugging 2020-10-26T11:48:39+00:00 tb 2020-10-26T11:48:39+00:00 urn:sha1:627936cdee4d4bdaad7d9d6ab7583eb17d5a6a60 and testing purposes. ok beck inoguchi jsing