summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509/ext_dat.h (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-09-21Move freeing and zeroing up to right after the while loop.tb1-5/+5
Requested by jsing
2020-09-20Avoid memleak caused by shadowingtb1-2/+5
The outer scope in x509_constraints_extract_names() contains a vname variable which will be freed on error, but an inner scope contains another vname that won't be freed, e.g., if x509_constraints_names_add fails. Found by llvm scan-build. ok beck
2020-09-20KNF/whitespace nitstb2-6/+7
2020-09-20Correct a 1 byte read overflow in x509_contraints_uri and addbeck2-4/+13
regress to catch it in the future. found by Guido Vranken's cryptofuzzer ok tb@
2020-09-20Document the public function SSL_set_SSL_CTX(3) from scratch,schwarze3-3/+72
which is undocumented in OpenSSL but mentioned in passing in one OpenSSL manual page, and which was recently mentioned by jsing@ when working on SSL_set_ciphersuites(3). With corrections from and OK inoguchi@.
2020-09-20Add guards around SSL_get0_peername that were accidentally omitted.tb1-1/+3
2020-09-20Fix a memory leak in x509_constraints_extract_namestb1-6/+6
If the default path of the switch is taken, vname will not be added to the names list and will leak when it is set to NULL. Simplify the logic by eliminating the add Boolean. Instead, free and zero vname in the default case and continue the while loop directly. At the bottom of the switch, add vname to the names list unconditionally zero it out since it's now owned by names. Found by Guido Vranken's cryptofuzzer ok beck
2020-09-19remove superfluous NULL checkbeck1-2/+2
ok tb@
2020-09-19Prepare to provide SSL_get0_peernametb2-2/+9
This is a convenience reacharound to libcrypto that trivially wraps X509_VERIFY_PARAM_get0_peername(). It is used by unbound 1.11.0 for better logging. As it's part of the API that landed with OpenSSL's DANE, more recent postfix snapshots use it as well. ok beck inoguchi jsing
2020-09-19Prepare to provide stubbed out versions for reading/writing 0-RTT datatb2-2/+41
We do not support this feature but need to provide OpenSSL's API since software assumes it's available whenever TLS1_3_VERSION is available. These are minimal stubs that should have a decent chance to interact reasonably with software expecting the tricky upstream semantics, but this will have to be sorted out with runtime testing, so will likely have to be refined and revisited. ok beck jsing
2020-09-19Prepare to provide SSL{,_CTX}_{get,set}_max_early_datatb2-2/+34
Similar to the SSL_SESSION versions, these are noops that are expected to be available by some configure tests. ok beck jsing
2020-09-19Prepare to provide SSL_SESSION_{set,get}_max_early_data()tb2-2/+18
Since we do not support 0-RTT, these are noops. Some software expects this API to be available if TLS1_3_VERSION is defined. ok beck jsing
2020-09-18If ssl_cert_dup() fails in SSL_set_SSL_CTX(3), return failureschwarze1-5/+10
rather than silently leaving a NULL pointer in ssl->cert. Kurt Roeckx fixed the same bug similarly in OpenSSL in 2015. While here, (1) make the code easier to read and more robust by returning right away when ssl still uses the context it was created from and the ctx argument is NULL, rather than doing a lot of work that changes nothing unless data is already corrupt, and (2) use the shorter and more inituitive SSL_CTX_up_ref(3) rather than manually calling CRYPTO_add(3), which means no functional change and is also in the OpenSSL 1.1 branch. OK tb@
2020-09-18add forgotten link to newish page SSL_set1_host(3)schwarze1-3/+4
and update merge notice
2020-09-18Move variable declaration to beginning of scope in order to make thistb1-3/+4
test compile and pass on sparc64.
2020-09-18make this test compile and pass on sparc64 by moving variable declarationstb1-4/+9
to the beginning of the respective scopes (and out of for loops)
2020-09-18move variable declaration up to top to make this compile and passtb1-1/+1
on sparc64
2020-09-18Use void function argument to appease gcc 4.2.1tb1-1/+1
2020-09-18fix "warning: value computed is not used"tb1-2/+2
Add a cast to tell gcc 4.2.1 that the return value is deliberately ignored. This makes the test compile and pass on sparc64.
2020-09-18fix "warning: function declaration isn't a prototype"tb1-3/+3
Make tests compile and pass on sparc64 with gcc 4.2.1 by properly declaring "static int foo()" as "static int foo(void)".
2020-09-18zap redundant linetb1-2/+1
2020-09-18hook symbols test to regresstb1-1/+2
2020-09-18Check availability of the symbols in Symbols.listtb2-0/+182
This regress parses Symbols.list and pulls all public headers out of libcrypto's Makefile to generate a simple program that uses all public symbols. A number of symbols need to be declared extern since they are unavailable in public headers and a handful must be skipped since they are apparently architecture dependent. This would have caught the recent breakage due to the accidental removal of the NAME_CONSTRAINTS_check() function and points out a number of places where cleanup may happen in the future. discussed with beck
2020-09-18Fix potential overflow in CN subject line parsing, thanks tobeck1-4/+5
ASN1_STRING - the gift that keeps on giving. Found by Guido Vranken's cryptofuzzer. ok tb@
2020-09-17Prepare to provide SSL_get_peer_tmp_key().jsing2-9/+20
OpenSSL effectively renamed SSL_get_server_tmp_key() to SSL_get_peer_tmp_key() and removed the client-side restriction. Prepare for a matching rename. ok tb@
2020-09-17Simplify SSL method lookups.jsing5-66/+44
There are three places where we call tls1_get_{client,server}_method() and if that returns NULL, call dtls1_get_{client,server}_method(). Simplify this by combining the lookup into a single function. While here also use uint16_t for version types. ok inoguchi@ millert@
2020-09-17Add a comment saying that the public function NAME_CONSTRAINTS_check(3)schwarze1-2/+5
is intentionally undocumented and needs to be deprecated. No change of the formatted text.
2020-09-17Install the new page SSL_set1_host(3), link to it from relevant places,schwarze6-22/+31
and add two other .Xrs that might help readers find their way. Update the merge notices of all files touched and merge a few trivial changes from the OpenSSL 1.1.1 branch. OK tb@