summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* OpenBSD 6.7 errata 010, June 11, 2020 (6.7/010_x509.patch.sig)libressl-v3.1.3tb2020-06-101-8/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | original commit: CVSROOT: /cvs Module name: src Changes by: jsing@cvs.openbsd.org 2020/05/31 11:23:39 Modified files: lib/libcrypto/x509: x509_vfy.c Log message: When building a chain look for non-expired certificates first. Currently, when building a certificate chain we look up an issuer and if it is the only issuer certificate available we still use it even if it has expired. When X509_V_FLAG_TRUSTED_FIRST is not in use, untrusted certificates are processed first and if one of these happens to be expired it will be used to build the chain, even if there is another non-expired option in the trusted store. Rework this code so that we first look for a non-expired untrusted certificate. If one does not exist then we take a look in the trusted store to see if we would be able to build the chain and only if there is not, do we then look for an expired untrusted certificate. This makes certificate validation possible for various sites that are serving expired AddTrust certificates. Issue reported by Christian Heimes via GitHub. ok beck@ tb@
* add stdlib.h for reallocarraybcook2019-05-231-1/+2
|
* Fix a number of ASN1_INTEGER vs ASN1_STRING mixups coming from thetb2019-03-131-2/+2
| | | | | | | | | | | mechanical M_ASN1 macro expansion. The ASN1_INTEGER_cmp function takes signs into account while ASN1_STRING_cmp doesn't. The mixups mostly involve serialNumbers, which, in principle, should be positive. However, it is unclear whether that is checked or enforced anywhere in the code, so these are probably bugs. Patch from Holger Mikolon ok jsing
* Typo in comment.tb2019-03-061-2/+2
| | | | From Holger Mikolon
* Add const to EVP_PKCS82PKEY().tb2018-08-241-2/+2
| | | | | tested in a bulk by sthen ok jsing
* After removing support for broken PKCS#8 formats (it was high time),tb2018-08-241-8/+5
| | | | | | | | we can add const to PKCS8_pkey_get0(). In order for this to work, we need to sprinkle a few consts here and there. tested in a bulk by sthen ok jsing
* Remove EVP_PKEY2PKCS8_broken() and PKCS8_set_broken()tb2018-08-241-13/+8
| | | | | | | | | | | Provide PKCS8_pkey_add1_attr_by_NID() and PKCS8_pkey_get0_attrs(). Remove the whole broken code and simplify pkcs8_priv_key_info_st accordingly. Based on OpenSSL commit 54dbf42398e23349b59f258a3dd60387bbc5ba13 plus some const that was added later. tested in a bulk build by sthen ok jsing
* Provide X509_get0_serialNumber()tb2018-08-242-2/+9
| | | | | tested in a bulk by sthen ok jsing
* Turn a number of #defines into proper functions with prototypes matchingtb2018-08-243-17/+40
| | | | | | those that OpenSSL has had for ages. ok jsing
* Make X509_OBJECT_up_ref_count return an int.tb2018-08-242-9/+7
| | | | | | | Based on OpenSSL commit c5ebfcab713a82a1d46a51c8c2668c419425b387 tested in a bulk by sthen ok jsing
* Don't leak sktmp in X509_verify_cert().tb2018-08-191-5/+5
| | | | | | CID #118791 ok jsing mestre
* Remove unnecessary NULL check from get_cert_by_subject sincelibressl-v2.8.0bcook2018-08-051-3/+3
| | | | | | sk_BY_DIR_HASH_find already does it, removing ambiguity later in the function. ok tb@
* Add const to both arguments of X509_certificate_type() and clean uptb2018-05-302-17/+10
| | | | | | | | | | | | | a little: Use X509_get0_pubkey() in place of X509_get_pubkey() and EVP_PKEY_free(). Check return value of the former in the appropriate place and simplify the logic for dealing with the potentially NULL pkey argument (includes a neat tweak from jsing). Finally, kill an ugly comment that has been rotting for twenty years and merge the lines around it. tested in a bulk build by sthen ok jsing
* Add a const qualifier to the `name' argument oftb2018-05-302-6/+8
| | | | | | | X509_NAME_get_index_by_{OBJ,NID}(). tested in a bulk build by sthen suggested by & ok jsing
* Add const to the obj argument of X509_NAME_add_entry_by_OBJ()tb2018-05-192-5/+5
| | | | | tested in a bulk build by sthen ok jsing
* Add const to the 'obj' argument of X509_EXTENSION_create_by_OBJ().tb2018-05-192-5/+5
| | | | | tested in a bulk build by sthen ok jsing
* Fix eyesore indentation of member functions of X509_LOOKUP_METHOD.tb2018-05-181-12/+11
| | | | | Sprinkle a few spaces after commas while there. Omitted from earlier commit to reduce noise in the diff.
* Add const to the 'x' and 'obj' arguments of:tb2018-05-182-14/+15
| | | | | | | | X509_get_ext(3), X509_get_ext_by_NID(3), X509_get_ext_by_OBJ(3), X509_get_ext_by_critical(3), X509_get_ext_count(3), X509_get_ext_d2i(3). tested in a bulk by sthen ok jsing
* Add const to both arguments of X509_check_private_key(3).tb2018-05-182-7/+6
| | | | | tested in a bulk build by sthen input & ok jsing
* Add const to the argument of X509_ATTRIBUTE_count(3).tb2018-05-182-4/+4
| | | | | tested in a bulk build by sthen ok jsing
* Add const qualifiers to the name and xp arguments of X509_TRUST_add(3),tb2018-05-182-10/+10
| | | | | | | X509_TRUST_get0_name(3), X509_TRUST_get_flags(3), and X509_TRUST_get_trust(3). tested in a bulk build by sthen ok jsing
* Add const qualifiers to the x and obj qualifiers oftb2018-05-182-17/+23
| | | | | | | | | X509_REVOKED_get_ext(3), X509_REVOKED_get_ext_count(3), X509_REVOKED_get_ext_by_NID(3), X509_REVOKED_get_ext_by_OBJ(3), X509_REVOKED_get_ext_by_critical(3), X509_REVOKED_get_ext_d2i(3). tested in a bulk build by sthen ok jsing
* Add a const qualifier to the 'X509_NAME *' argument oftb2018-05-181-4/+6
| | | | | | | X509_NAME_print{,_ex{,_fp}}(3). tested in a bulk build by sthen ok jsing
* Add const to the 'name' argument of X509_NAME_oneline(3).tb2018-05-182-4/+4
| | | | | tested in a bulk build by sthen ok jsing
* Add const to the 'obj' argument of X509_NAME_get_text_by_OBJ(3).tb2018-05-182-5/+5
| | | | | tested in a bulk by sthen ok jsing
* Add a const qualififer to the 'name' argument of X509_NAME_get_entry(3)tb2018-05-182-7/+7
| | | | | | | and to the 'obj' argument of X509_NAME_get_index_by_OBJ(3) tested in a bulk build by sthen ok jsing
* Add const to the argument of X509_NAME_entry_count().tb2018-05-182-4/+4
| | | | | tested in a bulk build by sthen ok jsing
* The 'bytes' arguments of X509_NAME_add_entry_by_NID(3) andtb2018-05-182-6/+6
| | | | | | | X509_NAME_add_entry_by_OBJ(3) are now const. tested in a bulk build by sthen ok jsing
* Add a const qualifier to the 'X509_NAME_ENTRY *ne' argument oftb2018-05-182-5/+7
| | | | | | | X509_NAME_add_entry(3). tested in a bulk build by sthen, ok jsing
* Add const to the argument of X509_NAME_ENTRY_get_data(3).tb2018-05-182-4/+4
| | | | | Tested in a bulk build by sthen ok jsing
* Add const qualifiers to the 'obj' and 'bytes' arguments oftb2018-05-182-10/+10
| | | | | | | | X509_NAME_ENTRY_create_by_NID(3), X509_NAME_ENTRY_create_by_OBJ(3), and X509_NAME_ENTRY_set_object(3). tested in a bulk build by sthen ok jsing
* X509_LOOKUP_by_alias() now takes a 'const char str *' andtb2018-05-182-9/+9
| | | | | | | X509_LOOKUP_by_fingerprint() 'const unsigned char *bytes'. tested in a bulk build by sthen ok jsing
* X509_EXTENSION_get_critical(3) now takes a 'const ASN1_OBJECT *obj' andtb2018-05-182-6/+7
| | | | | | | X509_EXTENSION_set_object(3) a 'const X509_EXTENSION *ex'. tested in a bulk build by sthen, ok jsing
* Add const qualifiers to the X509_CRL *x and ASN1_OBJECT *obj arguments oftb2018-05-182-16/+20
| | | | | | | | X509_CRL_get_ext_count(3), X509_CRL_get_ext_by_NID(3), X509_CRL_get_ext_by_OBJ(3), X509_CRL_get_ext_by_critical(3), X509_CRL_get_ext(3), X509_CRL_get_ext_d2i(3). ok jsing
* Add const qualifier to the argument of X509_get_issuer_name(3) andtb2018-05-132-6/+6
| | | | | | | X509_get_subject_name(3). tested in a bulk build by sthen ok jsing (as part of a larger diff)
* Add const qualifier to the ASN1_OBJECT * parameter oftb2018-05-132-5/+5
| | | | | | | X509v3_get_ext_by_OBJ(3). tested in a bulk build by sthen ok jsing (as part of a larger diff)
* Add a const qualifier to the ASN1_OBJECT * argument of the following:tb2018-05-133-12/+13
| | | | | | | | EVP_PKEY_get_attr_by_OBJ(3), X509at_get_attr_by_OBJ(3), X509at_get0_data_by_OBJ(3), X509_REQ_get_attr_by_OBJ(3) tested in a bulk by sthen ok beck (as part of a larger diff)
* Convert a handful of X509_*() functions to take const as in OpenSSL.tb2018-05-013-14/+15
| | | | | tested in a bulk by sthen ok jsing
* Fix whitespace on a few lines to reduce noise in an upcoming diff.tb2018-05-011-5/+5
|
* Fail early if an X509_VERIFY_PARAM is poisoned - don't allowbeck2018-04-081-8/+10
| | | | | this to be "overridden" by the user supplied callback. ok jsing@
* poison for X509_VERIFY_PARAM'sbeck2018-04-063-31/+54
| | | | | | | | | | | | Tighten up checks for various X509_VERIFY_PARAM functions, and allow for the verify param to be poisoned (preculding future successful cert validation) if the setting of host, ip, or email for certificate validation fails. (since many callers do not check the return code in the wild and blunder along anyway) Inspired by some discussions with Adam Langley. ok jsing@
* Fix two bugs in X509_NAME_add_entry(3):schwarze2018-04-041-7/+4
| | | | | | | | | | | | | | | | | | | | | | | | (1) Evaluate the "set" argument, which says whether to create a new RDN or to prepend or append to an existing one, before reusing it for a different purpose, i.e. for the "set" field of the new X509_NAME_ENTRY structure. (2) When incrementing of some "set" fields is needed, increment the correct ones: All those to the right of the newly inserted entry, but not the one of that entry itself. These two bugs caused wrong results whenever using loc != -1, i.e. whenever inserting rather than appending entries, even when using set == 0 only, that is, even when using single-values RDNs only. Both bugs have been continuously present since at least SSLeay-0.8.1 (released July 18, 1997) and the second one since at least SSLeay-0.8.0 (released June 25, 1997), so both are over twenty years old. I found these bugs by code inspection while trying to document the function X509_NAME_ENTRY_set(3), which is public, but undocumented in OpenSSL. OK beck@, jsing@
* Call strlen() if name length provided is 0, like OpenSSL does.beck2018-03-221-1/+3
| | | | | Issue notice by Christian Heimes <christian@python.org> ok deraadt@ jsing@
* Provide X509_STORE_get_ex_new_index macro.jsing2018-03-201-1/+5
|
* Provide X509_STORE_get0_param()tb2018-03-172-2/+9
| | | | ok jsing
* Provide X509_OBJECT_get_type(). Instead of the X509_LOOKUP_TYPE enumtb2018-03-172-2/+9
| | | | | | (which we don't have) it returns a plain int. ok jsing
* Provide X509_NAME_ENTRY_set()tb2018-03-172-2/+9
| | | | ok jsing
* Fix X509_get0_pubkey() - X509_get_pubkey() is a misnamed "get1" function,jsing2018-03-171-2/+4
| | | | | | so call X509_PUBKEY_get0() instead. Spotted by schwarze@ while documenting.
* Provide X509_PUBKEY_get0() by splitting X509_PUBKEY_get() and turning itjsing2018-03-171-1/+2
| | | | into a wrapper that calls X509_PUBKEY_get0() and up refs.
* Provide X509_REVOKED_dup().jsing2018-03-171-1/+2
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 05:21:28 +0000