summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Unifdef LIBRESSL_HAS_POLICY_DAG and remove it from the Makefiletb2023-04-283-88/+3
| | | | with beck
* Take the old policy code behind the barntb2023-04-287-1900/+0
| | | | | | | | It can go play in the fields with all the other exponential time policy "code". discussed with jsing ok & commit message beck
* Silence gcc-4 warnings about sk_sort()tb2023-04-281-5/+6
| | | | | Tell it we deliberately ignore the return value, (we really don't care what the old comparison function was).
* Remove now no longer needed <assert.h>; sort headerstb2023-04-281-4/+2
| | | | ok jsing
* Deassert has_explicit_policy()tb2023-04-281-3/+4
| | | | | | | The only caller is X509_policy_check() which goes straight to error. with beck ok jsing
* Deassert delete_if() callbackstb2023-04-281-5/+7
| | | | | | | | Add sk_is_sorted() checks to the callers of sk_X509_POLICY_NODE_delete_if() and add a comment that this is necessary. with beck ok jsing
* Deassert x509_policy_level_find()tb2023-04-281-18/+27
| | | | | | | | Move the check that level->nodes is sorted to the call site and make sure that the logic is preserved and erroring does the right thing. with beck ok jsing
* Deassert X509_policy_check()tb2023-04-281-2/+3
| | | | | | | | Instead of asserting that i == num_certs - 2, simply make that an error check. with beck ok jsing
* Deassert x509_policy_level_add_nodes()tb2023-04-281-10/+1
| | | | | | | | | This assert is in debugging code that ensures that there are no duplicate nodes on this level. This is an expensive and unnecessary check. Duplicates already cause failures as ensured by regress. with beck ok jsing
* Deassert x509_policy_new()tb2023-04-281-3/+4
| | | | | | | Turn the check into an error which will make all callers error. with beck ok jsing
* Cleanup pass over x509_check_policy.ctb2023-04-281-73/+72
| | | | | | This hoists variable declarations to the top and compiles with -Wshadow. ok beck
* Convert size_t's used in conjuction with sk_X509_num back to int.beck2023-04-271-12/+12
| | | | | | | | | | | The lets the regress in x509/policy pass instead of infinite looping. The changes are necessry because our sk_num() returns an int with 0 for empty and -1 for NULL, wheras BoringSSL's returns a size_t with 0 for both an empty stack and a NULL stack. pair work with tb@ ok tb@ jsing@
* Remove braces around single lines statements using knfmt -stb2023-04-271-84/+49
| | | | Pointed out by anton
* Rework simple allocation and free functions in x509_policy.ctb2023-04-271-32/+36
| | | | | | | Use calloc() instead of malloc/memset and make free functions look the same as elsewhere in the tree. ok beck jsing
* Make x509_policy.c compile with gcc 4.tb2023-04-261-17/+26
| | | | ok beck
* Turn C++ comments into C comments and minor KNF fixupstb2023-04-261-170/+264
|
* KNF according to knfmt(1)tb2023-04-261-515/+600
|
* Zap trailing whitespacetb2023-04-261-3/+1
|
* Add RCS tagtb2023-04-261-0/+1
|
* Take X509_POLICY_NODE_print() behind the barntb2023-04-262-97/+2
| | | | | | | | This used to be public API but is now only used for debug code that has certainly never been used since it was released to the public. It drags that debug nonsense with it. ok beck
* Make the new policy code in x509_policy.c to be selectable at compile time.beck2023-04-2611-14/+101
| | | | | | | The old policy codes remains the default, with the new policy code selectable by defining LIBRESSL_HAS_POLICY_DAG. ok tb@ jsing@
* Add a shim to mimic the BoringSSL sk_delete_if function.beck2023-04-261-0/+23
| | | | | | | We add this locally as a function to avoid delving into the unholy macro madness of STACK_OF(3). ok tb@ jsing@
* Adapt the sk_find calls from BoringSSL's api to ours.beck2023-04-261-6/+5
| | | | ok tb@ jsing@
* Add the STACK_OF declarations we require.beck2023-04-261-2/+46
| | | | ok tb@ jsing@
* Change OPENSSL_malloc|free|memset and friends to the normal versions.beck2023-04-261-6/+6
| | | | ok tb@ jsing@
* Fix error code goopbeck2023-04-261-5/+8
| | | | ok tb@ jsing@
* Use the correct headers to compile with libresslbeck2023-04-261-5/+4
|
* Import policy.c from BoringSSL as x509_policy.cbeck2023-04-261-0/+790
| | | | | | | | | | | This is an implementation of the X509 policy processing using a DAG instead of a tree to avoid the problem of exponential expansion of the policy tree as specified in RFC 5280 For details see: https://boringssl-review.googlesource.com/c/boringssl/+/55762 ok tb@ jsing@
* Remove proxy cert remnantstb2023-04-253-489/+1
|
* Remove NETSCAPE_CERT_SEQUENCEtb2023-04-251-17/+1
|
* Move the policy STACK_OF stuff to pcy_int.h as welltb2023-04-251-2/+44
|
* Remove SXNETtb2023-04-252-438/+1
| | | | Unused and no authorative information was found online in 2016
* Use X509_STORE_CTX_get1_{certs,crls}() instead of an aliastb2023-04-251-3/+3
|
* X509_STORE_get1_{certs,crls} become X509_STORE_CTX_*tb2023-04-252-25/+2
| | | | This matches the OpenSSL 1.1 API a bit better.
* Move the policy tree code to internal-onlytb2023-04-255-69/+40
| | | | | A few hooks remain in the legacy validator, which will soon be replaced with something better. The rest of the tentacles are now largely contained.
* Use proper fix for the recent x400Address issuetb2023-04-252-6/+4
| | | | | | From David Benjamin (BoringSSL) ok beck
* Remove v3_sxnet from the standard extensionstb2023-04-251-3/+2
|
* Invalidate the DER cache earlier on in X509 setter functionsjob2023-04-251-1/+8
| | | | | | | Note that it is important to invalidate the cache before returning, as the return might bubble up an error. OK tb@ jsing@
* Use X509_set_version() and X509_REQ_set_version() instead doing it by handjob2023-04-252-11/+4
| | | | | | | A small side-effect in X509_to_X509_REQ() is that 'x->req_info->enc.modified' now earlier on is set to 1. OK tb@ jsing@
* Future users of libcrypto will also have to do without strong extranettb2023-04-241-1/+5
| | | | | | support. discussed with beck and jsing
* Mark NETSCAPE_CERT_SEQUENCE for removaltb2023-04-241-2/+6
| | | | discussed with beck and jsing
* Sort X.509 error reasons, use next available error value, and alignjob2023-04-242-4/+4
| | | | | | error message with internal error code name. OK tb@ jsing@
* Replace X509v3_get_ext_count() with X509_get_ext_count()job2023-04-231-2/+2
| | | | Error introduced in 1.24
* In the case of V1 certs, the extension count should be exactly 0job2023-04-231-2/+2
| | | | OK tb@
* If extensions are encountered on a X.509 V1 cert, mark as invalidjob2023-04-231-2/+5
| | | | | | | While there, explicitly check for 0 - as X509_get_version() is a wrapper around the less than beloved ASN1_INTEGER_get(). OK tb@
* Add compliance checks for the X.509 version fieldjob2023-04-232-2/+4
| | | | | | | | | | | | | | Check whether the X.509 version is in the range of valid version values, and also checks whether the version is consistent with fields new to those versions (such as X.509 v3 extensions). X.690 section 11.5 states: "The encoding of a set value or a sequence value shall not include an encoding for any component value which is equal to its default value." However, enforcing version 1 (value 0) to be absent reportedly caused some issues as recent as July 2020, so accept version 1 even if it is explicitly encoded. OK tb@ beck@
* Drop some extra parenthesestb2023-04-231-2/+2
|
* Drop a superfluous isneg check.tb2023-04-231-2/+2
|
* Add missing NULL check for BN_new()tb2023-04-231-2/+5
|
* Initialize ishex and isneg at the top and drop some elsestb2023-04-231-6/+4
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-28 06:37:40 +0000