summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509/x509_vfy.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* unifdef OPENSSL_NO_CHAIN_VERIFYtb2025-03-041-6/+3
| | | | ok jsing
* Cache CRLs in issuer cachetb2025-02-081-17/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | The issuer cache holds a pair of SHA-512 of parent and child cert plus the result of the signature verification. Since CRLs also have a cached hash of their DER, we can easily add them to the same cache. This way we also avoid the cost of repeated signature verification for CRLs. For ordinary workloads the cache is larger than necessary and it won't currently take up more space than ~8M anyway, so the cost of doing this is negligible. For applications like rpki-client where the same (CA, CRL) pair is used to verify multiple EE certs, the gain is significant. In fact, the current worst case is a single pair being used for > 50k EE certs, responsible for about 20-25% of the total runtime of an ordinary rpki-client run if a hw-accelerated version of SHA-2 is available and even more if it isn't. In both cases the cost of processing of this pair is reduced by more than an order of magnitude. The implementation is a translation of x509_verify_parent_signature() to the case of CRLs and is entirely trivial thanks to the cache's design. Found while investigating a performance bottleneck found by job tested by job ok beck
* Make use of X509_get_signature_info() in check_sig_level()tb2024-08-281-20/+3
| | | | | | | | | | | | | | | If an auth_level (i.e., security_level, but not quite, because Viktor) was set on the X509_VERIFY_PARAM in the X509_STORE_CTX, the verifier would reject RSA-PSS or EdDSA certificates for insufficient security bits due to incorrect use of OBJ_find_sigid_algs() (this was also a bug in the initial security level implementation in OpenSSL 1.1). Using X509_get_signature_info() fixes this while preserving behavior for all other algorithms. Reported by Steffen Ullrich as one of multiple issues with RSA-PSS. ok jsing
* x509_vfy.c: drop some unnecessary parenthesestb2024-08-041-6/+5
|
* Remove notBefore and notAfter cacheing.beck2024-04-081-21/+3
| | | | | | | | | | | | | | | | | | | | | | This cache was added because our time conversion used timegm() and gmtime() which aren't very cheap. These calls were noticably expensive when profiling things like rpki-client which do many X.509 validations. Now that we convert times using julien seconds from the unix epoch, BoringSSL style, instead of a julien days from a Byzantine date, we no longer use timegm() and gmtime(). Since the julien seconds calculaitons are cheap for conversion, we don't need to bother caching this, it doesn't have a noticable performance impact. While we are at this correct a bug where x509_verify_asn1_time_to_time_t was not NULL safe. Tested for performance regressions by tb@ and job@ ok tb@ job@
* Remove unused parts of the purpose APItb2024-03-021-10/+1
| | | | | | | | | Most of this is the ability to add custom purposes. Also the astounding X509_STORE_CTX_purpose_inherit(). The names are used by PHP, and M2Crypto exposes X509_check_purpose(), so these remain public. Some weird, most likely invalid, uses also remain in rust-openssl. ok jsing
* Use an accessor instead of reaching into X509_PURPOSEtb2024-02-281-2/+2
| | | | ok jsing
* Remove ASN1_time_clamp_notafter() prototypetb2024-02-231-3/+1
| | | | | There is now a prototype in x509_internal.h, so no need to repeat that here.
* Rework X509_STORE_CTX_set_{purpose,trust}()tb2024-01-101-36/+35
| | | | | | | | | | | | | Split the two codepaths in x509_vfy_purpose_inherit() into its two callers. What remains is gross, but at least a reader has a chance of following all this nonsense without leaving a significant amount of hair behind. In short, purpose and trust are only overridden if they're not already set. Otherwise silently ignore valid purpose and trust identifiers that were passed in and succeed. Error on almost all invalid trust or purpose ids, except 0, because... well... who knows, really? ok jsing
* Fix copy-paste error that broke openssl-ruby and openssl regresstb2024-01-091-2/+2
| | | | Noticed by anton
* Disable X509_STORE_CTX_purpose_inherit()tb2024-01-081-23/+22
| | | | | | | | | | | | | | | | | | | | | | Nothing uses this function, except two internal callers. So split its guts temporarily into a helper function and disable the gross general case. The internal helper can be simplified by observing that def_purpose == 0: Overriding 0 by 0 doesn't do anything, so drop that bit. Rename ptmp into purp, and inline X509_PURPOSE_get_by_id(), i.e., make appropriate checks and subtract X509_PURPOSE_MIN. The fallback to X509_PURPOSE_get_by_id(0) will always fail since X509_PURPOSE_MIN == 1. So ditch that call. In particular, X509_STORE_CTX_set_purpose(ctx, X509_PURPOSE_ANY) fails in current because of this. That's nonsense. So remove the purp->trust == X509_TRUST_DEFAULT check as only change of behavior. This matches what OpenSSL do nowadays. They now set def_purpose = purpose if purpose != 0 and def_purpose == 0, so in all real-world uses of this function they will just fetch the same purpose again and do not check for default trust the second time around. Finally, X509_TRUST_get_by_id() is only used to ensure that a non-zero (or overridden) trust is between X509_TRUST_MIN and X509_TRUST_MAX. So expand that into its explicit form. ok jsing
* Minor cleanup in X509_STORE_CTX_purpose_inherit()tb2024-01-071-9/+10
| | | | | Make a few checks against 0 explicit to reduce noise in an upcoming diff and tiny KNF tweaks.
* Prefix get_trusted_issuer() with x509_vfy_tb2023-12-231-4/+3
|
* Rename check_hosts()tb2023-12-221-3/+3
|
* Replace check_trust() with its x509_vfy_ prefixed wrappertb2023-12-221-11/+4
|
* Replace check_chain_extensions() with its x509_vfy_ wrappertb2023-12-221-8/+2
|
* Replace check_id() with its x509_vfy_check_id() wrappertb2023-12-221-9/+4
|
* Remove a bunch of function pointers from X509_STORE_CTXtb2023-12-221-35/+17
| | | | | | | | | These are only ever set to one particular function which is either local to this file or part of the public API and we never added the public API to set them to something else. Prefix the local functions touched in this commit with x509_vfy_. More cleanup to follow. ok joshua jsing
* Remove cleanup() and get_crl() from X509_STORE_CTXtb2023-12-221-12/+2
| | | | ok jsing
* Remove unused function pointers from X509_STOREtb2023-12-221-46/+10
| | | | | | | | | The struct underlying the X509_STORE type is opaque ars and nothing uses the accessors that OpenSSL added blindly for these. Therefore we didn't add them in the first place. So this rips out several dozens of lines of dead code. ok beck joshua jsing
* Move the callers X509_STORE_CTX_purpose_inherit() down a bittb2023-11-271-15/+15
|
* Eliminate the timegm(3) dependency in libcryptotb2023-11-131-3/+2
| | | | | | | | | | | | | | | | | timegm(3) is not available on some operating systems we support in portable. We currently use musl's implementation, for which gcc-13 decided to emit warnings (which seem incorrect in general and are irrelevant in this case anyway). Instead of patching this up and diverge from upstream, we can avoid reports about compiler warnings by simply not depending on this function. Rework the caching of notBefore and notAfter by replacing timegm(3) with asn1_time_tm_to_time_t(3). Also make this API properly error checkable since at the time x509v3_cache_extensions(3) is called, nothing is known about the cert, in particular not whether it isn't malformed one way or the other. suggested by and ok beck
* Remove dead code.beck2023-06-081-13/+3
| | | | | | | | must_be_ca can no longer be 0 after the proxy cert code got nuked, so change this to an if. must_be_ca is now -1 for a leaf, or 1 for a non leaf. ok tb@
* Merge X509_VERIFY_PARAM_ID into X509_VERIFY_PARAMtb2023-05-281-13/+12
| | | | | | | | | | Back in the day when essentially every struct was open to all applications, X509_VERIFY_PARAM_ID provided a modicum of opacity. This indirection is now no longer needed with X509_VERIFY_PARAM being opaque itself, so stop using X509_VERIFY_PARAM_ID and merge it into X509_VERIFY_PARAM. This is a first small step towards cleaning up the X509_VERIFY_PARAM mess. ok jsing
* Rename arguments of X509_STORE_CTX_init()tb2023-05-141-5/+5
| | | | | | | | | | It is higly confusing to call the list of untrusted certs chain, when you're later going to call X509_STORE_CTX_get0_chain() to get a completely unrelated chain by the verifier. Other X509_STORE_CTX APIs call this list of certs 'untrusted', so go with that. At the same time, rename the x509 into leaf, which is more explicit. suggested by/ok jsing
* Rename the other_ctx in X509_STORE_CTX into trustedtb2023-05-081-10/+10
| | | | | | | | | | | | | | | | The other_ctx is a strong contender for the worst name of a struct member in OpenSSL. It's a void * member whose only purpose ever was to be set to a STACK_OF(X509) * via X509_STORE_CTX_trusted_stack() (yes, this is obviously a setter, why do you ask?) and then to be used by the get_issuer() callback (which of course isn't there to find any old issuer, but only to look for issuers among the 'trusted' certs). Anyway, we may want to rename untrusted into intermediates and trusted into roots later on, but for now let's match the lovely public API. While there rename get_issuer_sk() into get_trusted_issuer() which is a more accurate and slightly less silly name. ok jsing
* X509_verify_cert(): Garbage collect the unused roots variabletb2023-05-081-4/+1
| | | | | | | | | roots was used to store the trusted stack or pull the roots out of the X509_STORE before beck unmooned Ethel in x509_vfy.c r1.88. Since then this variable is effectively unused. It seems the STACK_OF(3) madness is too complicated for -Wunused-but-set-variable to notice. ok miod
* Send x509_subject_cmp() to the attictb2023-04-301-9/+1
| | | | | | This helper has been inside #if 0 for nearly 25 years. Let it go. If we should ever need it, I'm quite confident that we will be able to come up with its one line body on our own.
* Zap extra blank linetb2023-04-301-2/+1
|
* Enable policy checking by default now that we are DAG implementation based.beck2023-04-281-2/+2
| | | | | | | This ensures that we will no longer silently ignore a certificate with a critical policy extention by default. ok tb@
* Unifdef LIBRESSL_HAS_POLICY_DAG and remove it from the Makefiletb2023-04-281-61/+1
| | | | with beck
* Make the new policy code in x509_policy.c to be selectable at compile time.beck2023-04-261-1/+41
| | | | | | | The old policy codes remains the default, with the new policy code selectable by defining LIBRESSL_HAS_POLICY_DAG. ok tb@ jsing@
* Use X509_STORE_CTX_get1_{certs,crls}() instead of an aliastb2023-04-251-3/+3
|
* Move the policy tree code to internal-onlytb2023-04-251-15/+1
| | | | | A few hooks remain in the legacy validator, which will soon be replaced with something better. The rest of the tentacles are now largely contained.
* x509_vfy.c and x509_vpm.c don't need vpm_int.h anymoretb2023-04-161-2/+3
|
* More ProxyCertInfo tentacles go to the attictb2023-04-161-34/+4
| | | | | | | | This removes ProxyCertInfo from extension caching, issuer checking and it also drops the special path validation for proxy certs from the legacy verifier. ok jsing
* libressl *_namespace.h: adjust *_ALIAS() to require a semicolontb2023-02-161-56/+56
| | | | | | | | | | LCRYPTO_ALIAS() and LSSL_ALIAS() contained a trailing semicolon. This does not conform to style(9), breaks editors and ctags and (most importantly) my workflow. Fix this by neutering them with asm("") so that -Wpedantic doesn't complain. There's precedent in libc's namespace.h fix suggested by & ok jsing
* spelling fixes; from paul tagliamontejmc2022-12-261-2/+2
| | | | | | | i removed the arithmetics -> arithmetic changes, as i felt they were not clearly correct ok tb
* Retire X509_V_FLAG_CB_ISSUER_CHECKtb2022-12-011-16/+8
| | | | | | | | | This flag has been deprecated in OpenSSL 1.1 and has not had an effect since. This way we can simplify the default check_issued() callback, which helpfully has its arguments reversed compared to the public API X509_check_issued(). ok jsing
* Getters and setters for the check_issued() callbacktb2022-12-011-1/+23
| | | | | | | | | | | | | | | Open62541 uses X509_STORE_CTX_get_check_issued(), so provide it along with X509_STORE_{get,set}_check_issued(). As you would expect, they all return or take an X509_STORE_CTX_check_issued_fn. The getters aren't const in OpenSSL 1.1, but they now are in OpenSSL 3... These will be made available in the next minor bump and will ship in the stable release of LibreSSL 3.7 Part of OpenSSL commit 1060a50b See also https://github.com/libressl-portable/portable/issues/748 ok beck jsing
* Make internal header file names consistenttb2022-11-261-2/+2
| | | | | | | | | | | | | | | | Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook
* Revert "Check certificate extensions in trusted certificates"beck2022-11-171-46/+3
| | | | | | | | There are some possible strange side effects noticed by the openssl cms regress tests that I missed. Backing this out until I untangle it ok tb@
* Hide public symbols in libcrypto/x509 .c filesbeck2022-11-141-1/+53
| | | | ok tb@
* Check certificate extensions in trusted certificates.beck2022-11-131-3/+46
| | | | | | | | | | | | | | | | | | Historically the standards let the implementation decide to either check or ignore the certificate properties of trust anchors. You could either use them simply as a source of a public key which was trusted for everything, or you were also permitted to check the certificate properties and fully enforce them. Hooray for freedumb. OpenSSL changed to checking these with : commit 0daccd4dc1f1ac62181738a91714f35472e50f3c Author: Viktor Dukhovni <openssl-users@dukhovni.org> Date: Thu Jan 28 03:01:45 2016 -0500 BoringSSL currently does not check them, as it also inherited the previous OpenSSL behaviour. It will change to check them in the future. (https://bugs.chromium.org/p/boringssl/issues/detail?id=533)
* Switch loop bounds from size_t to int in check_hosts()tb2022-08-311-2/+2
| | | | | | | | | sk_num() can return a negative value, in which case the upper bound is SIZE_MAX, which results in a very long for loop. CID 153997 ok jsing
* Allow security_level to mestastasize into the verifiertb2022-06-271-1/+142
| | | | | | | | The tentacles are everywhere. This checks that all certs in a chain have keys and signature algorithms matching the requirements of the security_level configured in the verify parameters. ok beck jsing
* X509_GET_PUBKEY(3) return value check in libcryptoinoguchi2022-01-221-2/+3
| | | | | | CID 345116 ok beck@ tb@
* Bugfix in X509_get_pubkey_parameters(3):schwarze2021-11-261-3/+5
| | | | | | | | | | If EVP_PKEY_copy_parameters(3) fails - among other reasons, this may happen when out of memory - the pkey argument and/or the chain argument will not contain all the desired parameters after returning. Consequently, report the failure to the caller rather than silently ignoring it. OK tb@
* Simplify the code in X509_get_pubkey_parameters(3)schwarze2021-11-261-8/+4
| | | | | | | | | | | | | | | by using X509_get0_pubkey(3) instead of X509_get_pubkey(3); no functional change. OK tb@ This is similar to the relevant part of the follwoing commit from the OpenSSL 1.1.1 branch, which is still under a free licence, but without the bug that commit introduced into this function in OpenSSL: commit c01ff880d47392b82cce2f93ac4a9bb8c68f8cc7 Author: Dr. Stephen Henson <steve@openssl.org> Date: Mon Dec 14 13:13:32 2015 +0000
* In some situations, the verifier would discard the error on an unvalidatedbeck2021-11-241-2/+6
| | | | | | certificte chain. This would happen when the verification callback was in use, instructing the verifier to continue unconditionally. This could lead to incorrect decisions being made in software.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-21 07:26:00 +0000