| Commit message (Collapse) | Author | Files | Lines |
|---|
|
|
|
|
|
|
|
|
|
Instead of using s_client and s_server and complicated shell scripts,
we can reuse the framework from the ssl_get_shared_cipher() regress
test and inspect the verify return value directly.
Discussed with beck jan jsing
|
|
If a servername callback returns SSL_TLSEXT_ERR_ALERT_WARNING, this
results in a fatal error in TLSv1.3 since alert levels are implicit
in the alert type and neither close_notify nor user_canceled make
sense in this context. OpenSSL chose to ignore this, so we need to
follow suit.
Found via a broken servername callback in p5-IO-Socket-SSL which
returns a Boolean instead of SSL_TLSEXT_ERR_*. This happened to
have worked before TLSv1.3 since warning alerts are often ignored.
This "fixes" sni.t and sni-verify.t in p5-IO-Socket-SSL.
ok beck jsing
|
|
suggested from tb@
|
|
ok tb@
|
|
our verifier to return 21 results in other regress failures in
ruby and perl.
|
|
find leaf cert issuers. This breaks perl and ruby regress, as noticed
by tb that "we tried this before".
Jan's regress that cares about 21 vs 20 needs to change
ok tb@
|
|
then fix the only thing it still has complaints about which
is that we don't return the leaf version of the error code
when we can't verify the leaf (as opposed to the rest of the chain)
ok jan@ tb@
|
|
Even if the buffer is guaranteed to be NUL-terminated in a particular
case, it is still setting a bad example. Besides, it is unclear
to me whether there is any such guarantee in the case at hand.
Checking that would require auditing all of d2i_X509_bio(3),
ASN1_item_d2i_bio(&NETSCAPE_X509_it, ...), PEM_read_bio_X509_AUX(3),
and PKCS12_parse(3), since no such guarantee is documented for any
of these functions, and even then it would remain fragile with
respect to later changes of implementation details.
In the worst case, this could potentially result in a read buffer
overrun.
OK tb@ on an earlier version of this patch.
While we are here, deraadt@ requested to not use the word "string" in the
name of a variable that is not a string in the sense of the C language.
|
|
This fixes a problem in the perl regress where it notices the
callback is called twice and complains.
ok tb@ bluhm@
|
|
This makes some tests run from the Makefile behave as they should.
|
|
|
|
noted by inoguchi
|
|
|
|
doc fixes/ok jmc
ok beck
|
|
Due to the need to support by_dir, we use the get_issuer stuff when running
in x509_vfy compatibility mode amyway - so just use it any time we are
doing that. Removes a bunch of yukky stuff and a "Don't Look Ethel"
ok tb@ jsing@
|
|
ok inoguchi@ tb@
|
|
|
|
generate certdirs by jsing, and make chicken sacrifies by tb.
ok tb@ jsing@
|
|
|
|
|
|
|
|
roots were not checked correctly before intermediates that has since been fixed
and is no longer necessary. It is regress checked by case 2c in
regress/lib/libcrypto/x509/verify.c
ok jsing@ tb@
|
|
|
|
suggested from tb@ for do_updatedb(),
and applied the same for do_body() and do_revoke().
|
|
comments from tb@
|
|
suggested from tb@
|
|
pointed out by tb@
|
|
Some functions are used without verifying the return value in openssl(1) ca.
This diff adds checking for the function return value.
With this diff, I changed return value of the write_new_certificate from void
to int to return the condition to the caller.
ok and comments from tb@
|
|
|
|
This is from upstream where there is an assert() that EVP_MD_size(digest)
matches the length returned by HMAC(). We avoid asserts in our libraries.
From Martin Vahlensieck
|
|
not necessarily NUL terminated). Same as schwarze's fix in t_x509a.c r1.9.
From David Benjamin and Matt Caswell (part of the fixes in OpenSSL 1.1.1l)
ok inoguchi
|
|
to handly by_dir and fun things correctly. - fixes dlg@'s case and
by_dir regress in openssl-ruby
ok jsing@
|
|
Part of Github PR #105
|
|
This adds the SM2 algorithm defined in the Chinese standards
GB/T 32918.1-2016, GB/T 32918.2-2016, GB/T 32918.3-2016,
GB/T 32918.4-2016 and GB/T 32918.5-2017.
This is an ISC licensed implementation contributed by Ribose.inc, based
on the same code that was contributed to OpenSSL by Jack Lloyd. The port
to LibreSSL was done by Ronald Tse and Nickolay Olshevsky.
Github PR #105
I made quite a few cleanup passes on this, but more is needed, some
of which will happen in-tree before this is linked to the build.
ok deraadt inoguchi (a long time ago), jsing
|
|
the result in order to return the same errors as OpenSSL users expect to override
the generic "Untrusted cert" error.
This fixes the openssl-ruby timestamp test.
ok tb@
|
|
own function, in preparation for subesquent change. No functional change.
ok tb@
|
|
|
|
|
|
forgotten in earlier commits
|
|
using input from tb@, and OK tb@ on an earlier version
|
|
as intentionally undocumented because it is trivial and unused in the wild;
OK tb@
|
|
Noted by tb@ during review of a larger change.
|
|
and X509_get_default_cert_file_env(3).
LibreSSL itself does not call getenv(3), but a few application programs
including epic5, fetchmail, fossil, slic3r call these functions, so in
case programmers find them in existing code, telling them what they do
seems useful.
|
|
Put it into this page because this is the code actually using it.
Despite its name and include file, it is unrelated to X.509
and unrelated to certificates: it is just the default directory
containing the library configuration file, openssl.cnf(5).
|
|
* document the X509_OBJECT output parameter
* more precision regarding return values
* clarify relationship with X509_LOOKUP_ctrl(3) for the dir lookup method
|
|
|
