summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Make structs in evp.h and hmac.h opaquetb2022-01-144-146/+142
| | | | | | This moves most structs to evp_locl.h and moves HMAC_CTX to hmac_local.h. ok inoguchi jsing
* Move BN structs to bn_lcl.htb2022-01-142-50/+46
| | | | | | This makes all structs in bn.h opaque that are also opaque in OpenSSL. ok inoguchi jsing
* Remove BIO_s_file_internaltb2022-01-141-4/+1
| | | | | | | Pointed out by schwarze. How something with this name ever made its way into a public header will remain a mystery. ok inoguchi jsing
* Remove ASN1{_const,}_check_infinite_endtb2022-01-142-30/+2
| | | | | | Suggested by schwarze ok inoguchi jsing
* Remove ASN1{,_const}_CTXtb2022-01-141-35/+1
| | | | | | | These are leftovers of the old ASN.1 stuff. Nothing uses this. OpenSSL removed them in a469a677. ok inoguchi jsing
* Remove X509_OBJECT_free_contentstb2022-01-142-19/+11
| | | | | | | | Inline X509_OBJECT_free_contents() in X509_OBJECT_free() and remove this dangerous API. It was left over when x509_vfy.h was made opaque. ok inoguchi jsing
* Remove PEM_Seal{Init,Update,Final}tb2022-01-143-223/+3
| | | | | | This unused, bug-ridden API was removed in OpenSSL commit 0674427f. ok inoguchi jsing
* Unifdef LIBRESSL_OPAQUE_* and LIBRESSL_NEXT_APItb2022-01-1410-112/+10
| | | | | This marks the start of major surgery in libcrypto. Do not attempt to build the tree for a while (~50 commits).
* zap some stray whitespacetb2022-01-121-2/+2
|
* ASN1_{,F,T}BOOLEAN_it and the encoding and decoding API will movetb2022-01-125-147/+7
| | | | | | to internal only soon. Stop documenting them. ok inoguchi jsing
* Only evp_pkey_check needs static linkingtb2022-01-121-2/+4
|
* Add a prototype for OBJ_bsearch_ so this test will keep workingtb2022-01-121-1/+6
| | | | | after the bump. Since this tests the public interfaces, we do not want to use LIBRESSL_INTERNAL/LIBRESSL_CRYPTO_INTERNAL here.
* Rework ecdsatest to build after the bump and link statically for nowtb2022-01-122-14/+26
|
* Rework dsatest to use accessors and link statically for nowtb2022-01-122-7/+7
|
* Rework dhtest to use accessors and link statically for nowtb2022-01-121-6/+6
| | | | For some reason CVS didn't want to commit this the first time around.
* Rework dhtest to use accessors and link statically for nowtb2022-01-121-3/+3
|
* Rework test to use EVP_AEAD_CTX_{new,free}() and link statically for nowtb2022-01-122-20/+32
|
* Fix typo in header guardtb2022-01-121-3/+3
|
* Fix asn1x509 build with opaque structures. Link statically for now.tb2022-01-122-20/+25
|
* Rework Makefile to use regress framework and link asn1basic statically.tb2022-01-122-14/+16
| | | | | It will need this for testing {d2i,i2d}_ASN1_BOOLEAN which will be moved to internal-only in the upcoming bump.
* forgot to zap some dead assignmentstb2022-01-111-4/+4
|
* Add regress for EVP_PKEY_{,public_,param_}check()tb2022-01-112-7/+415
|
* Revise for peer_cert.jsing2022-01-111-6/+6
|
* Remove peer_pkeys from SSL_SESSION.jsing2022-01-116-96/+58
| | | | | | | | | | peer_pkeys comes from some world where peers can send multiple certificates - in fact, one of each known type. Since we do not live in such a world, get rid of peer_pkeys and simply use peer_cert instead (in both TLSv1.2 and TLSv1.3, both clients and servers can only send a single leaf (aka end-entity) certificate). ok inoguchi@ tb@
* Simplify SSL_get_peer_certificate()jsing2022-01-111-10/+8
| | | | ok inoguchi@ tb@
* Rename 'peer' to 'peer_cert' in SSL_SESSION.jsing2022-01-118-37/+37
| | | | | | | The 'peer' member of SSL_SESSION is the leaf/end-entity certificate provided by our peer. Rename it since 'peer' on its own is unhelpful. ok inoguchi@ tb@
* Revise for changes to tls_key_share_peer_public()jsing2022-01-111-2/+4
|
* Plumb decode errors through key share parsing code.jsing2022-01-117-48/+106
| | | | | | | | | | | | Distinguish between decode errors and other errors, so that we can send a SSL_AD_DECODE_ERROR alert when appropriate. Fixes a tlsfuzzer failure, due to it expecting a decode error alert and not receiving one. Prompted by anton@ ok tb@
* Use SSL_AD_INTERNAL_ERROR for non-decoding alerts when parsing keyshares.jsing2022-01-111-4/+10
| | | | ok tb@
* Simplify tlsext_keyshare_server_parse()jsing2022-01-111-9/+5
| | | | | | | SSL_AD_DECODE_ERROR is the default alert for a TLS extension parsing failure - remove the various gotos and simply return 0 instead. ok tb@
* Wrap long linesinoguchi2022-01-111-42/+74
|
* Check function return valueinoguchi2022-01-111-32/+57
|
* Suppress warninginoguchi2022-01-111-1/+3
|
* Compare pointer variable with NULLinoguchi2022-01-111-44/+44
|
* Remove space between '*' and pointer variable.inoguchi2022-01-111-11/+9
|
* Convert openssl(1) smime option handlinginoguchi2022-01-111-357/+744
| | | | | | Apply new option handling to openssl(1) smime and no functional changes. input and ok jsing@
* Convert tls_bio_cb for opaque BIOtb2022-01-101-19/+46
| | | | joint with jsing
* Document EVP_AEAD_CTX_{new,free}() and adjust example code.tb2022-01-101-6/+45
| | | | looks good to jsing
* Unbreak tree. Sorry about that.tb2022-01-101-7/+7
|
* NULL out pointers after transferring them to the DSA object.tb2022-01-101-1/+9
|
* Dedup get_dsa*() code.tb2022-01-101-91/+60
| | | | Pointed out by jsing
* Convert testdsa to accessors for opaque DSAtb2022-01-101-30/+90
| | | | ok inoguchi jsing
* Remove a few unused defines from x509.htb2022-01-101-6/+1
| | | | | | | | As suggested by schwarze, this removes X509_EX_V_{INIT,NETSCAPE_HACK} and X509_EXT_PACK_{STRING,UNKNOWN} ok inoguchi jsing
* Prepare to provide the EVP_MD_meth_* APItb2022-01-102-2/+130
| | | | | | | | | This allows implementations to add their own EVP_MD_METHODs. Only the setters are provided. This is used by erlang for the otp_test_engine. ok inoguchi jsing
* Document openssl pkey -check,-pubcheck and param -checktb2022-01-101-2/+12
|
* Implement openssl pkey -{,pub}check and pkeyparam -checktb2022-01-104-10/+79
| | | | | | | These expose EVP_PKEY_{,public_,param_}check() to the command line. They are currently noops and will be enabled in the upcoming bump. ok inoguchi jsing
* Prepare to provide EVP_PKEY_{public,param}_checktb2022-01-108-8/+146
| | | | | | | | | | | | | | This implements checking of a public key and of key generation parameters for DH and EC keys. With the same logic and setters and const quirks as for EVP_PKEY_check(). There are a couple of quirks: For DH no default EVP_PKEY_check() is implemented, instead EVP_PKEY_param_check() calls DH_check_ex() even though DH_param_check_ex() was added for this purpose. EVP_PKEY_public_check() for EC curves also checks the private key if present. ok inoguchi jsing
* Provide DH_check*_ex and many error codestb2022-01-104-4/+102
| | | | | | | | | | | | | | | | | | | | | DH_check{,_pub_key}_ex() wrap their non-ex versions to translate the flags argument of the original functions into OpenSSL errors. For this almost a dozen new error codes need to be added. DH_params_check{,_ex}() is a new version of DH_check that only performs a cheap subset of the checks. They are needed to implement EVP_PKEY_{public,param}_check() (observe the consistent naming) although the actual implementation of EVP_PKEY_param_check() chose to use DH_check_ex(). As far as I can tell, the only raison d'être of the _ex functions and error codes is to spew them to stderr in a couple of openssl(1) commands. This couldn't have been solved differently... These functions will not be exposed publicly. ok inoguchi jsing
* Prepare to provide EVP_PKEY_check()tb2022-01-108-12/+89
| | | | | | | | | | | | | | | | | | This allows checking the validity of an EVP_PKEY. Only RSA and EC keys are supported. If a check function is set the EVP_PKEY_METHOD, it will be used, otherwise the check function on the EVP_PKEY_ASN1_METHOD is used. The default ASN.1 methods wrap RSA_check_key() and EC_KEY_check_key(), respectively. The corresponding setters are EVP_PKEY_{asn1,meth}_set_check(). It is unclear why the PKEY method has no const while the ASN.1 method has const. Requested by tobhe and used by PHP 8.1. Based on OpenSSL commit 2aee35d3 ok inoguchi jsing
* Prevent a double free in EVP_MD_CTX_copy_ex()tb2022-01-101-1/+3
| | | | | | | | NULL out two pointer values after memcpy() to avoid a double free. In the event that both in->pctx and in->md_data are non-NULL and the calloc() of out->md_data fails, a double free could occur. ok inoguchi jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-29 14:54:51 +0000