summaryrefslogtreecommitdiff
path: root/src/lib/libc (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-11-18exptest: convert to opaque BN; minor KNF tweaks.tb1-40/+47
2021-11-18evptest: fix compilation with opaque EVP_{CIPHER,MD}_CTX. Uses atb1-22/+30
workaround for excessive malloc inspired by mariadb (just kidding).
2021-11-18ecdsatest: make this test compile with opaque EVP_MD_CTX.tb1-7/+8
2021-11-18dsatest: make this work with opaque BN. Some more fixes will be neededtb1-114/+124
for opaque DSA. I'll deal with that later. I also lobbed a KNF grenade in here.
2021-11-18dhtest: fix this to work with opaque BN. This will need more fixes totb1-48/+61
work with opaque DH, but one step at a time. While here, add a bunch of missing spaces to reduce the eyebleed.
2021-11-18bntest: Fix all but one test in this file to work with opaque BN.tb1-399/+563
The remaining test needs some thinking (or disabling once we flip the switch). It is currently marked with an XXX.
2021-11-18In x509_vfy.h rev. 1.35 and x509_lu.c rev. 1.34, tb@ providedschwarze2-13/+51
X509_OBJECT_new(3) and X509_OBJECT_free(3); document them. While here, stop talking about storing storing EVP_PKEY objects and plain C strings in X509_OBJECT objects. LibreSSL never fully supported that, and it certainly no longer supports that now.
2021-11-17In x509_vfy.h rev. 1.37 and x509_vfy.c rev. 1.91, tb@ providedschwarze9-46/+209
X509_STORE_CTX_set_verify(3) and X509_STORE_CTX_get_verify(3). Document them. In the next bump, tb@ will also provide X509_STORE_CTX_verify_fn(3) and X509_STORE_set_verify(3) and restore X509_STORE_set_verify_func(3) to working order. For efficiency of documentation work, already document those three, too, but keep the text temporariy .if'ed out until they become available. Delete X509_STORE_set_verify_func(3) from X509_STORE_set_verify_cb_func(3) because it was misplaced in that page: it is not related to the verification callback. tb@ agrees with the general direction.
2021-11-16In x509_vfy.h rev. 1.37 and x509_vfy.c rev. 1.91, tb@ providedschwarze1-8/+47
X509_STORE_CTX_get_verify_cb(3); document it.
2021-11-16Recently, tb@ provided the following functions:schwarze1-4/+71
X509_STORE_CTX_set_error_depth x509_vfy.h 1.37 x509_vfy.c 1.91 X509_STORE_CTX_set_current_cert x509_vfy.h 1.37 x509_vfy.c 1.91 X509_STORE_CTX_get_num_untrusted x509_vfy.h 1.36 x509_vfy.c 1.90 X509_STORE_CTX_set0_verified_chain x509_vfy.h 1.37 x509_vfy.c 1.91 Merge the documentation from the OpenSSL 1.1.1 branch, which is still under a free license; tweaked by me.
2021-11-15new manual page ASN1_BIT_STRING_set(3) documenting four BIT STRING accessorsschwarze4-3/+184
2021-11-15document ASN1_PRINTABLE_type(3) and ASN1_UNIVERSALSTRING_to_string(3)schwarze6-8/+172
2021-11-15document ASN1_item_pack(3) and ASN1_item_unpack(3)schwarze5-6/+94
2021-11-15document i2a_ASN1_STRING(3) and a2i_ASN1_STRING(3)schwarze3-3/+163
2021-11-14Fix a strange check in the auto DH codepathtb1-3/+5
The code assumes that the server certificate has an RSA key and bases the calculation of the size of the ephemeral DH key on this assumption. So instead of checking whether we have any key by inspecting the dh part of the union, let's check that we actually have an RSA key. While here, make sure that its length is non-negative. ok jsing
2021-11-14the last argument of BIO_gets(3) is called "size", not "len"schwarze1-6/+6
2021-11-14fix a typo; diff from Matthias Schmidt <xosc dot org> on tech@schwarze1-3/+3
2021-11-14Put curly brace on the correct line.jsing1-2/+3
2021-11-13Test ASN1_STRING_copy(3).schwarze2-1/+121
As a side effect, this also tests various aspects of ASN1_STRING_new(3), ASN1_STRING_set(3), ASN1_STRING_length_set(3), ASN1_STRING_get0_data(3), ASN1_STRING_length(3), and ASN1_STRING_type(3).
2021-11-13Fix a nasty quirk in ASN1_STRING_copy(3).schwarze1-2/+2
In case of failure, it reported the failure but corrupted the type of the destination string. Instead, let's make sure that in case of failure, existing objects remain in their original state. OK tb@
2021-11-13Document the interactions of X509_V_FLAG_USE_CHECK_TIME,schwarze1-6/+35
X509_V_FLAG_NO_CHECK_TIME, X509_VERIFY_PARAM_set_time(3), X509_VERIFY_PARAM_set_flags(3), and X509_VERIFY_PARAM_clear_flags(3) in detail because the API design is both surprising and surprisingly complicated in this respect, and the resulting nasty traps have already caused bugs in the past.
2021-11-13Mark the public X509_VP_FLAG_* constants as intentionally undocumented.schwarze1-2/+11
With LibreSSL, they can only be used internally in the library itself, and even with OpenSSL, no real-world application code uses them. OK tb@
2021-11-13Fix a bug in check_crl_time() that could result in incompleteschwarze1-8/+8
verification, accepting CRLs that ought to be rejected, if an unusual combination of verification flags was specified. If time verification was explicitly requested with X509_V_FLAG_USE_CHECK_TIME, it was skipped on CRLs if X509_V_FLAG_NO_CHECK_TIME was also set, even though the former is documented to override the latter both in the OpenSSL and in the LibreSSL X509_VERIFY_PARAM_set_flags(3) manual page. The same bug in x509_check_cert_time() was already fixed by beck@ in rev. 1.57 on 2017/01/20. This syncs the beginning of the function check_crl_time() with the OpenSSL 1.1.1 branch, which is still under a free license. OK beck@ This teaches that having too many flags and options is bad because they breed bugs, and even more so if they are poorly designed to override each other in surprising ways.
2021-11-13document ASN1_STRING_copy(3)schwarze1-4/+43
2021-11-12Document the public constants X509_V_FLAG_POLICY_MASKschwarze1-9/+43
and X509_V_FLAG_USE_CHECK_TIME. While here, fix a typo and improve the wording for X509_V_FLAG_NOTIFY_POLICY.
2021-11-12mention what X509_cmp_time(3) does with a cmp_time argument of NULLschwarze1-3/+7
2021-11-12As pointed out by tb@, LibreSSL no longer supports user-definedschwarze4-56/+21
X509_LOOKUP_METHODs because these objects are now opaque. Simplify the documentation accordingly, shortening it by about 35 input lines in total, but continue providing the information which RETURN VALUES functions might return with other implementations of the library. OK tb@
2021-11-12In x509_vfy.h rev. 1.41, tb@ provided X509_STORE_CTX_get_by_subject(3),schwarze3-18/+53
changed the return type of X509_OBJECT_get_type(3) and argument types of X509_LOOKUP_by_subject(3), X509_LOOKUP_by_issuer_serial(3), X509_LOOKUP_by_fingerprint(3), X509_LOOKUP_by_alias(3), X509_OBJECT_idx_by_subject(3), X509_OBJECT_retrieve_by_subject(3), and X509_STORE_get_by_subject(3) from int to X509_LOOKUP_TYPE, and in rev. 1.42, he provided X509_STORE_CTX_get_obj_by_subject(3). Adjust the documentation. Joint work with and OK tb@.
2021-11-11mention the public constants XN_FLAG_SEP_MASK and XN_FLAG_FN_MASKschwarze1-2/+6
2021-11-11Mention the X509v3_KU_* aliases for the KU_* constantsschwarze1-2/+16
because some third party application code uses them. List the full names (even though they are long) such that they can be found with "man -k Dv=...".
2021-11-11Explicitly list all public functions in roff(7) commentsschwarze1-6/+33
that are related to this page but intentionally undocumented, to better support grepping the source directory for function names.
2021-11-11new manual page X509_policy_tree_get0_policies(3),schwarze4-6/+110
also documenting X509_policy_tree_get0_user_policies(3)
2021-11-10Merge a few additional X509error(ERR_R_MALLOC_FAILURE) callsschwarze1-39/+28
and various style improvements from the OpenSSL 1.1.1 branch, which is still under a free license. - No need to #include <openssl/lhash.h>. - BUF_MEM_free(3) and sk_pop_free(3) can handle NULL. - sk_value(3) can handle -1. - Test pointers with "== NULL" rather than with "!". - Use the safer "p = malloc(sizeof(*p))" idiom. - return is not a function. - Delete very wrong commented out code. Including parts of the these commits from the 2015 to 2018 time range: 25aaa98a b4faea50 90945fa3 f32b0abe 26a7d938 7fcdbd83 208056b2 5b37fef0 Requested by and OK tb@.
2021-11-10If X509_load_cert_crl_file(3) does not find any certificatesschwarze3-3/+7
and/or CRLs in the PEM input file (for example, if the file is empty), provide an error message in addition to returning 0. This merges another part of this OpenSSL commit, which is still under a free license: commit c0452248ea1a59a41023a4765ef7d9825e80a62b Author: Rich Salz <rsalz@openssl.org> Date: Thu Apr 20 15:33:42 2017 -0400 I did *not* add the similar message types X509_R_NO_CERTIFICATE_FOUND and X509_R_NO_CRL_FOUND because both code inspection and testing have shown that the code generating them is unreachable. OK tb@
2021-11-10Sync some code style improvements from the OpenSSL 1.1.1 branch,schwarze1-10/+9
which is still under a free license. No functional change. - No need to #include <openssl/lhash.h> here. - return is not a function. - Do not use the pointless macro BIO_s_file_internal(). - No need to check for NULL before X509_CRL_free(3). This includes parts of the following OpenSSL commits from the 2015 to 2017 timeframe: 222561fe, 9982cbbb, f32b0abe, 26a7d938 OK tb@
2021-11-10Merge two bug fixes from the OpenSSL 1.1.1 branch, which is stillschwarze1-8/+4
under a free license: 1. If the three X509_load_*(3) functions are called with a NULL file argument, do not return 1 to the caller because the return value 1 means "i loaded one certificate or CRL into the store". 2. When calling PEM load functions, do not ask the user for a password in an interactive manner. This includes parts of the following commits: commit c0452248ea1a59a41023a4765ef7d9825e80a62b Author: Rich Salz <rsalz@openssl.org> Date: Thu Apr 20 15:33:42 2017 -0400 Message: [...] Remove NULL checks and allow a segv to occur. [...] commit db854bb14a7010712cfc02861731399b1b587474 Author: Bernd Edlinger <bernd.edlinger@hotmail.de> Date: Mon Aug 7 18:02:53 2017 +0200 Message: Avoid surpising password dialog in X509 file lookup. OK tb@
2021-11-09Switch to <endian.h> from <machine/endian.h> for better portability.bcook12-30/+26
ok tb@
2021-11-09Split a new page X509_load_cert_file(3) with three functionsschwarze7-112/+157
out of X509_LOOKUP_hash_dir(3) because both groups of functions differ substantially in purpose and structure. Rewrite the complete text of X509_load_cert_file(3) from scratch for correctness and clarity. This fixes several documentation errors: 1. The names of the constants were wrong, lacking the "X509_" prefix. 2. None of these functions support X509_FILETYPE_DEFAULT, neither in OpenSSL nor in LibreSSL. 3. The memory cache does not contain X509_STORE objects; instead, the X509_STORE object *is* the memory cache.
2021-11-09Add ASPA OIDjob2-0/+2
draft-ietf-sidrops-aspa-profile OK tb@
2021-11-08Replace <sys/limits.h> with <limits.h>bcook1-2/+2
ok tb@
2021-11-08Document X509_gmtime_adj(3).schwarze1-23/+67
While here, improve some argument names, improve ordering of the material, and mention the meaning of negative and of large arguments,
2021-11-07In X509_STORE_CTX, rename the X509_STORE store rather than ctx.tb3-15/+15
ok gnezdo jsing
2021-11-07In X509_STORE_CTX rename the misnamed last_untrusted to num_untrustedtb3-17/+17
ok jsing
2021-11-07new manual pagesschwarze6-5/+288
ASN1_item_digest(3), ASN1_item_sign(3), and ASN1_item_verify(3)
2021-11-06Improve formatting. The line breaks in the lists of methods were very ugly.schwarze1-116/+76
While here, put descriptions right after the prototypes they describe. No content change.
2021-11-06Start cleaning up X509_STORE_get1_issuer()tb1-15/+37
Get rid of the last X509_OBJECT_free_contents() call by moving the object from the stack to the heap. I deliberately kept the obj variable to keep obj and pobj separate. Rename the out parameter from issuer to out_issuer to ensure that we only assign it when we have acquired a reference that we can return. Add a new X509 *issuer. In the first part of the function, acquire an extra reference before check_issuer/check_time. In the second part of the function, acquire a reference inside the lock to avoid a race. Deal with ret only in one place. ok jsing
2021-11-06In X509_STORE_get1_issuer() do not call the verify callback fromtb1-3/+3
x509_check_cert_time(). Matches a change made in OpenSSL 70dd3c65. ok jsing
2021-11-06Fix indent.jsing1-8/+7
2021-11-06Refactor X509_STORE_get1_certs()tb1-27/+30
Split the retrieval of the certs in the store's cache that match the desired subject into a separate function. This greatly simplifies locking, error handling and the flow of the function. with/ok jsing
2021-11-05typo: a static objects -> a static objecttb1-3/+3
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-25 07:09:06 +0000