summaryrefslogtreecommitdiff
path: root/src/lib/libc/stdlib/system.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2023-11-19Unifdef OPENSSL_NO_ENGINE in engine.htb1-566/+8
Also rip out all the gross, useless comments. There's still too much garbage in here... ok jsing
2023-11-19Also mention ENGINE_{cleanup,{ctrl_cmd{,_string}()tb1-3/+29
2023-11-19Remove last OPENSSL_NO_ENGINE from libssl regresstb1-7/+1
2023-11-19Unifdef OPENSSL_NO_ENGINE in libcrypto regresstb8-68/+8
2023-11-19Missing periodtb1-2/+2
2023-11-19fix grammartb1-2/+2
2023-11-19Remove remaining ENGINE manualstb11-1988/+1
They document functionality that no longer exists.
2023-11-19Strip mention of ENGINE out of *_set_method.3tb3-98/+26
2023-11-19Strip out mentions of ENGINE_load_builtin_engines()tb1-7/+4
There's probably more that needs to be updated here, but that can be done another day.
2023-11-19ex data for ENGINEs is no longer a thingtb1-9/+2
2023-11-19Remove section explaining how great and flexible ENGINE is andtb1-28/+2
remove two Xr to ENGINE manuals.
2023-11-19Remove obsolete engine configuration sectiontb1-106/+2
2023-11-19Document the remaining ENGINE stubs in a single manualtb1-146/+103
2023-11-19EVP_PKEY_encrypt() simplify exampletb1-6/+4
In particular, do not use an uninitialized engine, simply pass NULL.
2023-11-19openssl pkcs12: rewrite without reaching into X509_ALGORtb1-7/+10
We can call ASN1_item_unpack() which will end up stuffing the same arguments into ASN1_item_d2i() as d2i_PBEPARAM(). This eliminates the last struct access into X509_ALGOR outside libcrypto in the base tree. ok jsing
2023-11-19openssl ts: convert to X509_ALGOR_set0()tb1-5/+8
ok jsing
2023-11-18Check for negative EVP_CIPHER_CTX_iv_length() return in libssltb2-9/+13
ok beck
2023-11-18Forgot to fix one unsigned int vs int confusiontb1-3/+3
CID 468015
2023-11-18Check for negative IV lengthtb5-27/+45
A recent change in EVP_CIPHER_CTX_iv_length() made it possible in principle that this function returns -1. This can only happen for an incorrectly set up EVP_CIPHER. Still it is better form to check for negative lengths before stuffing it into a memcpy(). It would probably be desirable to cap the iv_length to something large enough. This can be done another time. ok beck
2023-11-16Mention which functions are implemented as macros in the few casesschwarze13-34/+76
where that information was missing.
2023-11-16drop some duplicate statements about macrosschwarze4-23/+10
2023-11-16fix wrong macroschwarze1-3/+3
2023-11-16delete lots of stuff that no longer existsschwarze1-300/+17
2023-11-16fix typo: exdata -> ex_dataschwarze1-4/+4
2023-11-16Minimal fix to unbreak OPENSSL_{gmtime,timegm}(3)tb1-15/+18
I was told not to look since it will magically get fixed. Fine. I'd still have expected a minimal amount of care so that the manpage isn't totally dysfunctional and missing text in the right places. Sigh.
2023-11-15Drop some unnecessary parenthesestb1-19/+19
2023-11-15Shuffle getters and adders down a bittb1-34/+30
These use static helper functions which don't need prototypes this way.
2023-11-13Make X509_certificate_type() less badtb1-24/+29
This converts to proper single exit and undoes a number of unnecessarily silly muppet antics. ok beck
2023-11-13Garbage collect an incoherent export crypto checktb1-4/+1
Contrast "#define EVP_PKT_EXP 0x1000 /* <= 512 bit key */" with the diff: - /* /8 because it's 1024 bits we look for, not bytes */ - if (EVP_PKEY_size(pk) <= 1024 / 8) - ret |= EVP_PKT_EXP; EVP_PKT_EXP will be nuked at the next opportunity. discussed with jsing
2023-11-13Use a sensible variable name (i.e. nid) instead of i for a NIDtb1-5/+6
2023-11-13Use X509_get_signature_nid() instead of inlining ittb1-2/+2
ok beck jsing
2023-11-13X509_certificate_type() needs to know about RSA-PSStb1-1/+4
This doesn't do much right now, but is part of the tangle that is adding RSA-PSS support. ok beck jsing
2023-11-13Prepare to expose OPENSSL_gmtime and OPENSSL_timegm as publicbeck4-5/+68
This matches when BoringSSL has done, and allows for getting rid of the dependency on system timegm() and gmtime() in libtls. which will make life easier for portable, and remove our dependency on the potentially very slow system versions. ok tb@ - tb will handle the minor bump bits and expose on the next minor bump CVS :----------------------------------------------------------------------
2023-11-13Kill last user of ASN1_time_parse() in the treetb1-23/+3
ASN1_time_parse() was useful while OpenSSL didn't have something sort of equivalent, but now they do. Let's retire ASN1_time_parse() to internal. This will require some patching in ports, but shrug. ok beck
2023-11-13Check notBefore/notAfter validity with ASN1_TIME_to_tm(3)tb1-5/+3
ok beck
2023-11-13Replace ASN1_time_parse() with ASN1_TIME_to_tm()tb1-3/+4
Like in libtls, we use ASN1_GENERALIZEDTIME_check() to ensure we actually have a GeneralizedTime. ok beck
2023-11-13Remove last caller of ASN1_time_parse(3) in libtlstb1-3/+4
This one is slightly annoying since ASN1_TIME_to_tm(3) doesn't provide a direct check for a GeneralizedTime, so call ASN1_GENERALIZEDTIME_check() as well. This means LibreSSL parses the time twice. Shrug. ok beck
2023-11-13Remove ASN1_time_parse() dependency in tls_conninfo.ctb1-3/+3
During r2k22 ported some of the missing OpenSSL ASN.1 time API. This is a step towards removing the dependency of libtls on ASN1_time_parse(). The latter grew a dependency on CBS/CBB, and thus the choice is to pull in all this code or to use a no longer maintained version of the API. Both options are unappealing. ok beck
2023-11-13Eliminate the timegm(3) dependency in libcryptotb4-19/+36
timegm(3) is not available on some operating systems we support in portable. We currently use musl's implementation, for which gcc-13 decided to emit warnings (which seem incorrect in general and are irrelevant in this case anyway). Instead of patching this up and diverge from upstream, we can avoid reports about compiler warnings by simply not depending on this function. Rework the caching of notBefore and notAfter by replacing timegm(3) with asn1_time_tm_to_time_t(3). Also make this API properly error checkable since at the time x509v3_cache_extensions(3) is called, nothing is known about the cert, in particular not whether it isn't malformed one way or the other. suggested by and ok beck
2023-11-12split the Symbols.list up so that arch specific symbols do not end up everywhererobert4-2/+7
ok tb@
2023-11-11Fix a few bugs in X509v3_asid_add*()tb1-38/+96
These 'builder' functions, usually used together, can result in corrupt ASIdentifiers on failure. In general, no caller should ever try to recover from OpenSSL API failure. There are simply too many traps. We can still make an effort to leave the objects in unmodified state on failure. This is tricky because ownership transfer happens. Unfortunately a really clean version of this seems impossible, maybe a future iteration will bring improvements... The nasty bit here is that the caller of X509v3_asid_add_id_or_range() can't know from the return value whether ownership of min and max was transferred or not. An inspection of (*choice)->u.range is required. If a caller frees min and max after sk_ASIdOrRange_push() failed, there is a double free. All these complications could have been avoided if the API interface had simply used uint32_t instead of ASN1_INTEGERs. The entire RFC 3779 API was clearly written without proper review. I don't know if there ever was an actual consumer before rpki-client. If it existed, nobody with the requisite skill set looked at it in depth. ok beck for the general direction with a lot of input and ok jsing
2023-11-09Forgot to fix the RFC number in the new commenttb1-2/+2
2023-11-09Convert PKCS7_SIGNER_INFO_set() to X509_ALGOR_set0_by_nid()tb1-5/+11
This is a straightforward conversion because I'm not going to start a cleanup here. Explain why this is not using X509_ALGOR_set_md(). See below. ok jca Let me include a beautiful note from RFC 5754 in its entirety: NOTE: There are two possible encodings for the AlgorithmIdentifier parameters field associated with these object identifiers. The two alternatives arise from the loss of the OPTIONAL associated with the algorithm identifier parameters when the 1988 syntax for AlgorithmIdentifier was translated into the 1997 syntax. Later, the OPTIONAL was recovered via a defect report, but by then many people thought that algorithm parameters were mandatory. Because of this history, some implementations encode parameters as a NULL element while others omit them entirely. The correct encoding is to omit the parameters field; however, when some uses of these algorithms were defined, it was done using the NULL parameters rather than absent parameters. For example, PKCS#1 [RFC3447] requires that the padding used for RSA signatures (EMSA-PKCS1-v1_5) MUST use SHA2 AlgorithmIdentifiers with NULL parameters (to clarify, the requirement "MUST generate SHA2 AlgorithmIdentifiers with absent parameters" in the previous paragraph does not apply to this padding).
2023-11-09Convert ecx_item_sign() to X509_ALGOR_set0_by_nid()tb1-8/+5
ok jca
2023-11-09Convert asn1_item_sign() to X509_ALGOR_set0_by_nid()tb1-8/+4
ok jca
2023-11-09Fix X509_ALGOR_set0() usage in rsa_alg_set_oaep_padding()tb1-4/+6
Replace X509_ALGOR_set0() with X509_ALGOR_set0_by_nid(). This way there is no missing error checking for OBJ_nid2obj() and no nested functions. Slightly more importantly, this plugs two long standing potential leaks in this function (or previously rsa_cms_encrypt()) due to missing error checking: in the unlikely event that X509_ALGOR_set0() failed, astr/ostr would leak. ok jsing
2023-11-09Use X509_ALGOR_set0_by_nid() in rsa_mgf1md_to_maskGenAlgorithm()tb1-5/+2
ok jsing
2023-11-08More minor cleanup in rsa_alg_set_oaep_padding()tb1-4/+3
Test and assign one more instance replace a useless comment by an empty line.
2023-11-08Prepare further fixes of X509_ALGOR_set0() misusetb1-8/+7
In rsa_alg_set_oaep_padding() rename los to ostr for consistency with astr, make it have function scope, free ostr in the error path and assume X509_ALGOR_set0() success. ok jca
2023-11-08zap a stray spacetb1-2/+2
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-10 20:27:53 +0000