summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509/x509.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Unexport X509_NAME_print()tb2025-03-091-2/+1
| | | | | | | | | | Nothing uses this anymore. M2Crypto has been patched and a fix for opensc has been upstreamed. ok jsing This is the start of a major bump. Don't build the tree until I have synced sets in about 20 commits.
* Remove offensive whitespace from x509.htb2025-03-011-27/+27
|
* Expose X509_get_signature_infotb2024-08-311-3/+1
| | | | | | | | To compensate for all the removals, a single, small, constructive piece of this bump: expose X509_get_signature_info() so that libssl's security level API can handle RSA-PSS certificates correctly. ok beck jsing
* Make X509at_* API internaltb2024-08-311-21/+1
| | | | | | | | The only consumer, yara, has been adjusted. It will be some more work to remove this idiocy internally, but at least we will no longer have to care about external consumers. ok beck jsing
* Remove EVP_PKEY.*attr* APItb2024-08-311-19/+1
| | | | | | I ranted enough about this recently. PKCS#12. Microsoft. 'nuff said. ok beck jsing
* Remove X509_REQ_{set,get}_extension_nids()tb2024-08-311-3/+1
| | | | | | | | LibreSSL no longer supports non-standard OIDs for use in the extensions attribute of CSRs. The API that enabled that (and nobody used of course) can now go. ok beck jsing
* Make X509_VAL opaquetb2024-08-311-5/+2
| | | | | | | Nothing needs to reach into this structure, which is part of certificates. So hide its innards. ok beck jsing
* Remove X509_check_trust() and some related definestb2024-08-311-19/+1
| | | | | | | | | Someone thought it would be a good idea to append non-standard trust information to the certs in the trust store. This API is used to inspect that depending on the intended purpose of the cert. Only M2Crypto thought it necessary to expose this. It was adjusted. ok beck jsing
* Implement X509_get_signature_info()tb2024-08-281-1/+9
| | | | | | | | | | | | | | | | This is a slightly strange combination of OBJ_find_sigid_algs() and the security level API necessary because OBJ_find_sigid_algs() on its own isn't smart enough for the special needs of RSA-PSS and EdDSA. The API extracts the hash's NID and the pubkey's NID from the certificate's signatureAlgorithm and invokes special handlers for RSA-PSS and EdDSA for retrieving the corresponding information. This isn't entirely free for RSA-PSS, but for now we don't cache this information. The security bits calculation is a bit hand-wavy, but that's something that comes along with this sort of numerology. ok jsing
* piuid, psuid -> issuerUID, subjectUIDtb2024-06-121-3/+3
|
* Remove X509_CRL_METHOD APItb2024-03-021-13/+1
| | | | | | I would keep repeating myself... In the bit bucket you go. ok jsing
* Make X509_CERT_AUX internaltb2024-03-021-9/+1
| | | | | | Another struct/API that should never have leaked out of the library. ok jsing
* Remove X509_TRUST from the public APItb2024-03-021-12/+1
| | | | | | With API and other users internal, this struct can now go. ok jsing
* Remove DECLARE_STACK_OF(X509_TRUST)tb2024-03-021-3/+1
| | | | | | Unused since the extensibility was neutered. ok jsing
* Remove unused public X509_TRUST APItb2024-03-021-12/+1
| | | | | | | Another thing that should never have leaked out of the library. It will become internal entirely, where the code can be simplified greatly. ok jsing
* Remove X509_ALGOR_set_md()tb2024-03-021-4/+1
| | | | | | | | One of those void APIs that are super hard to use safely since they can fail but can't communicate failure. Nothing uses this. Internal uses have been converted to error checked X509_ALGOR_set_evp_md(). ok jsing
* Remove more PBE stuff from the public APItb2024-03-021-15/+1
| | | | | | | This is still needed internally for CMS and its predecessors. This removal will enable disentangling some of its innards. ok jsing
* Remove most PBEPARAM stuff from public visibilitytb2024-03-021-32/+1
| | | | | | The struct itself needs to remain public, unfortunately. ok jsing
* Fix a few bizarre line wraps in x509.htb2023-11-021-8/+5
|
* Hide X509_ALGOR_set_md() for LIBRESSL_INTERNALtb2023-10-261-1/+3
|
* Stop including ecdsa.h and ecdh.h internallytb2023-07-281-7/+1
| | | | | | | | These headers are now reduced to #include <openssl/ec.h> and are provided for compatiblity only. There's no point in using them. At the same time garbage collect the last uses of OPENSSL_NO_{ECDSA,ECDH} in our tree. ok jsing
* Remove NETSCAPE_CERT_SEQUENCEtb2023-04-251-17/+1
|
* Mark NETSCAPE_CERT_SEQUENCE for removaltb2023-04-241-2/+6
| | | | discussed with beck and jsing
* Sort X.509 error reasons, use next available error value, and alignjob2023-04-241-2/+2
| | | | | | error message with internal error code name. OK tb@ jsing@
* Add compliance checks for the X.509 version fieldjob2023-04-231-1/+2
| | | | | | | | | | | | | | Check whether the X.509 version is in the range of valid version values, and also checks whether the version is consistent with fields new to those versions (such as X.509 v3 extensions). X.690 section 11.5 states: "The encoding of a set value or a sequence value shall not include an encoding for any component value which is equal to its default value." However, enforcing version 1 (value 0) to be absent reportedly caused some issues as recent as July 2020, so accept version 1 even if it is explicitly encoded. OK tb@ beck@
* Bring includes into canonical ordertb2023-04-181-19/+15
| | | | Requested by jsing
* Move some includes out of OPENSSL_NO_DEPRECATEDtb2023-04-181-3/+1
| | | | | | | | | | | | | Some headers were included conditionally on OPENSSL_NO_DEPRECATED in hopes that eventually the mess of everything includes everything will magically resolve itself. Of course everyone would end up building openssl with OPENSSL_NO_DEPRECATED over time... Right. Surprisingly, the ecosystem has come to rely on these implicit inclusions, so about two dozen ports would fail to build because of this. Patching this would be easy but really not worth the effort. ok jsing
* Expose X509_CRL_get0_sigalg() and X509_get0_uidstb2023-03-101-5/+1
|
* Introduce X509_get0_uids() accessor functionjob2023-02-231-1/+5
| | | | | | | By introducing X509_get0_uids(), one can add RPKI profile compliance checks to conform the absence of the issuerUID and subjectUID. OK tb@ jsing@
* Prepare to provide X509_CRL_get0_sigalg()tb2022-12-261-1/+5
| | | | | | | | | This is an obvious omission from the OpenSSL 1.1 and OpenSSL 3 API which does not provide a way to access the tbs sigalg of a CRL. This is needed in security/pivy. From Alex Wilson ok jsing
* spelling fixes; from paul tagliamontejmc2022-12-261-2/+2
| | | | | | | i removed the arithmetics -> arithmetic changes, as i felt they were not clearly correct ok tb
* Remove mkerr.pl remnants from LibreSSLkn2022-07-121-5/+1
| | | | | | | This script is not used at all and files are edited by hand instead. Thus remove misleading comments incl. the obsolete script/config. Feedback OK jsing tb
* Remove a few unused defines from x509.htb2022-01-101-6/+1
| | | | | | | | As suggested by schwarze, this removes X509_EX_V_{INIT,NETSCAPE_HACK} and X509_EXT_PACK_{STRING,UNKNOWN} ok inoguchi jsing
* If X509_load_cert_crl_file(3) does not find any certificatesschwarze2021-11-101-1/+2
| | | | | | | | | | | | | | | | | | and/or CRLs in the PEM input file (for example, if the file is empty), provide an error message in addition to returning 0. This merges another part of this OpenSSL commit, which is still under a free license: commit c0452248ea1a59a41023a4765ef7d9825e80a62b Author: Rich Salz <rsalz@openssl.org> Date: Thu Apr 20 15:33:42 2017 -0400 I did *not* add the similar message types X509_R_NO_CERTIFICATE_FOUND and X509_R_NO_CRL_FOUND because both code inspection and testing have shown that the code generating them is unreachable. OK tb@
* Move the now internal X.509-related structs into x509_lcl.h.tb2021-11-011-209/+7
| | | | | | | | Garbage collect the now unused LIBRESSL_CRYPTO_INTERNAL and LIBRESSL_OPAQUE_X509. Include "x509_lcl.h" where needed and fix a couple of unnecessary reacharounds. ok jsing
* Unifdef LIBRESSL_NEW_API. Now that the library is bumped, this istb2021-11-011-14/+1
| | | | | | no longer needed. ok jsing
* Hide struct internals under LIBRESSL_CRYPTO_INTERNAL so that othertb2021-10-311-12/+12
| | | | | | parts of LibreSSL can no longer reach into them. discussed with beck, jsing
* Remove the unused X509_OBJECTS struct.tb2021-10-311-8/+1
| | | | ok beck jsing
* Remove the unused X509_CERT_PAIR struct and the assicated API.tb2021-10-311-12/+1
| | | | ok beck jsing
* Prepare to make many of the structs in x509.h opaque.tb2021-10-231-76/+86
| | | | ok beck jsing
* Prepare to provide X509_re_X509*_tbs()tb2021-10-231-1/+11
| | | | ok beck jsing
* Prepare to provide X509_SIG_get{0,m}.tb2021-10-231-1/+8
| | | | ok beck jsing
* Prepare to provide X509_REQ_pubkey_get0()tb2021-10-221-1/+4
| | | | ok jsing
* Prepare to make X509 opaque.tb2021-10-211-4/+7
| | | | ok jsing
* Prepare to provide X509_get_X509_PUBKEY() as a function.tb2021-10-211-4/+6
| | | | ok jsing
* Lay groundwork to support X.509 v3 extensions for IP Addresses and AS ↵job2021-09-021-1/+5
| | | | | | | | | | | Identifiers These extensions are defined in RFC 3779 and used in the RPKI (RFC 6482, RFC 8360). Imported from OpenSSL 1.1.1j (aaf2fcb575cdf6491b98ab4829abf78a3dec8402b8b81efc8f23c00d443981bf) This changeset is a no-op, as there are 10+ issues and at least 2 security issues. Work will continue in-tree. OK tb@, discussed with beck@
* Provide missing prototype for d2i_DSAPrivateKey_fp(3)tb2021-03-311-1/+2
| | | | ok bcook inoguchi jsing
* Add const to EVP_PKCS82PKEY().tb2018-08-241-2/+2
| | | | | tested in a bulk by sthen ok jsing
* After removing support for broken PKCS#8 formats (it was high time),tb2018-08-241-8/+5
| | | | | | | | we can add const to PKCS8_pkey_get0(). In order for this to work, we need to sprinkle a few consts here and there. tested in a bulk by sthen ok jsing
* Remove EVP_PKEY2PKCS8_broken() and PKCS8_set_broken()tb2018-08-241-13/+8
| | | | | | | | | | | Provide PKCS8_pkey_add1_attr_by_NID() and PKCS8_pkey_get0_attrs(). Remove the whole broken code and simplify pkcs8_priv_key_info_st accordingly. Based on OpenSSL commit 54dbf42398e23349b59f258a3dd60387bbc5ba13 plus some const that was added later. tested in a bulk build by sthen ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-28 11:28:07 +0000