summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509/x509_asid.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Rewrite and fix X509v3_asid_subset()tb2022-05-121-12/+30
| | | | | | | | | | | | X509v3_asid_subset() assumes that both asnum and rdi are present while they are both marked OPTIONAL in RFC 3779, 3.2.3. It will crash if either one is missing. In RPKI land RDI is a MUST NOT use (e.g, RFC 6487, 4.8.11), so this API is currently useless (and seemingly unused). Pick apart an ugly logical pipeline and implement this check in a readable fashion. ok jsing
* Clarify comments at the start of {asid,addr}_validate_path_internal()tb2022-04-211-4/+4
| | | | Requested by jsing
* Avoid expensive RFC 3779 checks during cert verificationtb2022-04-211-5/+7
| | | | | | | | | | | | | | | X509v3_{addr,asid}_is_canonical() check that the ipAddrBlocks and autonomousSysIds extension conform to RFC 3779. These checks are not cheap. Certs containing non-conformant extensions should not be considered valid, so mark them with EXFLAG_INVALID while caching the extension information in x509v3_cache_extensions(). This way the expensive check while walking the chains during X509_verify_cert() is replaced with a cheap check of the extension flags. This avoids a lot of superfluous work when validating numerous certs with similar chains against the same roots as is done in rpki-client. Issue noticed and fix suggested by claudio ok claudio inoguchi jsing
* No need for assert.h in here.tb2021-12-251-2/+1
|
* Use C99 initializers for v3_addr, v3_asid and v3_ct_scts[]tb2021-12-251-12/+15
| | | | | | as is done for most other X.509 v3 extension methods. discussed with jsing
* KNF nittb2021-12-241-2/+2
|
* Remove asserts from asid_validate_path_internal()tb2021-12-241-11/+22
| | | | | | | | | | | The first asserts ensure that things checked in the callers hold true. Turn them into error checks and set the error on the X509_STORE_CTX if it's present. Checking sk_value(..., i) with i < sk_num(...) isn't useful, particularly if that check is done via an assert. Turn one remaining assert into a NULL check. Finally, simplify the sk_num() checks in the callers. ok jsing
* Turn asserts in ASIdentifierChoice_canonize() into error checkstb2021-12-241-3/+5
| | | | | | | | | The first assert ensures that a stack that was just sorted in a stronger sense is sorted in a weak sense and the second assert ensures that the result of the canonization procedure is canonical. All callers check for error, so these asserts don't do anything useful. ok jsing
* Remove assert from extract_min_max() (again)tb2021-12-241-3/+1
| | | | | | All callers ensure that aor != NULL, so this isn't necessary. ok jsing
* Revert previous. The commit contained more than intended.tb2021-12-241-25/+14
|
* Turn asserts in ASIdentifierChoice_canonize() into error checkstb2021-12-241-12/+25
| | | | | | | | | The first assert ensure that a stack that was just sorted in a stronger sense is sorted in a weak sense and the second assert ensures that the result of the canonization procedure is canonical. All callers check for error, so these asserts don't do anything useful. ok jsing
* Remove assert from extract_min_max()tb2021-12-241-3/+1
| | | | | | All callers ensure that aor != NULL, so this isn't necessary. ok jsing
* Fix indent of a comment.tb2021-12-241-2/+2
|
* Reinstate the licenses that were replaced with a license stubtb2021-12-181-6/+54
| | | | in OpenSSL commit d2e9e320.
* Move the now internal X.509-related structs into x509_lcl.h.tb2021-11-011-1/+3
| | | | | | | | Garbage collect the now unused LIBRESSL_CRYPTO_INTERNAL and LIBRESSL_OPAQUE_X509. Include "x509_lcl.h" where needed and fix a couple of unnecessary reacharounds. ok jsing
* Add missing RCS markerstb2021-10-251-0/+1
|
* Zap two unused includesjca2021-10-251-2/+0
| | | | Spotted by egcc. ok tb@
* Fix indentation of comments and labelsjob2021-09-081-85/+85
| | | | OK tb@
* Replace (&(x)) pattern with &xjob2021-09-071-16/+16
| | | | | | No functional changes. OK tb@
* KNFjob2021-09-071-575/+607
| | | | OK tb@ jsing@ beck@
* Unroll ASN1_ITEM_ref()job2021-09-021-1/+1
| | | | OK @tb
* Change OPENSSL_strdup() to strdup()job2021-09-021-1/+1
| | | | OK tb@
* Change OPENSSL_malloc to calloc()job2021-09-021-1/+2
| | | | OK tb@
* Add err.h for X509error() and friendsjob2021-09-021-0/+1
| | | | OK tb@
* Fix OPENSSL_assert() and assert()job2021-09-021-26/+13
| | | | OK tb@
* Fix header file includesjob2021-09-021-5/+6
| | | | OK tb@
* Move the error put functions from X509V3err() to X509V3error()job2021-09-021-29/+17
| | | | OK tb@
* Unroll ASN1_SEQUENCE() ASN1_CHOICE() ASN1_ITEM_TEMPLATE()job2021-09-021-22/+106
| | | | OK jsing@
* OPENSSL_assert() is not appropriate in this contextjob2021-09-021-2/+3
| | | | | | Feedback from tb@ OK tb@
* Replace ossl_assert()/assert() with OPENSSL_assert()job2021-09-021-10/+10
| | | | OK tb@
* Replace OPENSSL_free() with free()job2021-09-021-4/+4
| | | | OK tb@
* Unroll IMPLEMENT_ASN1_FUNCTIONS()job2021-09-021-4/+98
| | | | OK jsing@
* Lay groundwork to support X.509 v3 extensions for IP Addresses and AS ↵job2021-09-021-0/+894
Identifiers These extensions are defined in RFC 3779 and used in the RPKI (RFC 6482, RFC 8360). Imported from OpenSSL 1.1.1j (aaf2fcb575cdf6491b98ab4829abf78a3dec8402b8b81efc8f23c00d443981bf) This changeset is a no-op, as there are 10+ issues and at least 2 security issues. Work will continue in-tree. OK tb@, discussed with beck@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-29 16:44:33 +0000