summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Clarify comments at the start of {asid,addr}_validate_path_internal()tb2022-04-212-7/+7
| | | | Requested by jsing
* Avoid expensive RFC 3779 checks during cert verificationtb2022-04-213-16/+22
| | | | | | | | | | | | | | | X509v3_{addr,asid}_is_canonical() check that the ipAddrBlocks and autonomousSysIds extension conform to RFC 3779. These checks are not cheap. Certs containing non-conformant extensions should not be considered valid, so mark them with EXFLAG_INVALID while caching the extension information in x509v3_cache_extensions(). This way the expensive check while walking the chains during X509_verify_cert() is replaced with a cheap check of the extension flags. This avoids a lot of superfluous work when validating numerous certs with similar chains against the same roots as is done in rpki-client. Issue noticed and fix suggested by claudio ok claudio inoguchi jsing
* Fix X509_get_extension_flags()tb2022-04-211-2/+2
| | | | | | Ensure that EXFLAG_INVALID is set on X509_get_purpose() failure. ok inoguchi jsing
* KNF for a brace and zap trailing blank linetb2022-04-121-3/+3
|
* name constraints: be more careful with NULstb2022-03-262-12/+25
| | | | | | | | | | | | | | An IA5STRING is a Pascal string that can have embedded NULs and is not NUL terminated (except that for legacy reasons it happens to be). Instead of taking the strlen(), use the already known ASN.1 length and use strndup() instead of strdup() to generate NUL terminated strings after some existing code has checked that there are no embedded NULs. In v2i_GENERAL_NAME_ex() use %.*s to print the bytes. This is not optimal and might be switched to using strvis() later. ok beck inoguchi jsing
* Make gcc 4 happier about x509_addr.ctb2022-03-161-6/+8
| | | | | | | | | | gcc 4 on sparc64 issues a few 'warning: value computed is not used'. There are two cases: sk_set_cmp_function() returns the old comparison function of the stack which we don't care about. The one warning about an sk_delete() is about a return value that we know already and which we will free a few lines down. ok inoguchi miod
* Allow constraints of the form @domain.comtb2022-03-141-10/+17
| | | | | | | | | | Some things issue and expect that we support a non-standard extension of accepting any email address from a host by prefixing an email name constraint with @. This used to be the case with the old code as well. Pointed out and based on a diff by Alex Wilson. ok jsing
* Rework ownership handling in x509_constraints_validate()tb2022-03-143-39/+49
| | | | | | | | | | Instead of having the caller allocate and pass in a new x509_constraints_name struct, handle allocation inside x509_constraints_validate(). Also make the error optional. All this is done to simplify the call sites and to make it more obvious that there are no leaks. ok jsing
* Relax the check of x509_constraints_dirname()libressl-v3.5.1tb2022-03-131-2/+6
| | | | | | | | | The dirname constraint must be a prefix in DER format, so relax the check from requiring equal-length strings to allow shorter names also. From Alex Wilson ok jsing
* Add x509_constraints_validate() to x509_internal.htb2022-03-131-1/+3
| | | | | | From Alex Wilson ok jsing
* Check name constraints using the proper APItb2022-03-131-4/+21
| | | | | | | | The previous versions were too strict and disallowed leading dots. From Alex Wilson ok jsing
* style tweaktb2022-03-131-2/+2
|
* Add missing error check after strdup()tb2022-03-131-2/+5
| | | | | | From Alex Wilson ok jsing
* Pull a len == 0 check up before malloc(len) to avoid implementationtb2022-03-031-5/+5
| | | | | | defined behavior. ok deraadt inoguchi
* Unwrap a linetb2022-03-021-3/+2
|
* Get rid of SHA1 for comparing CRL's - use SHA512 just like we do for certs.beck2022-02-242-5/+5
| | | | ok tb@
* Fix length check of IP addresses for name constraintstb2022-02-111-2/+3
| | | | | | | | | An IP address in a name constraint is actually an IP address concatenated with a netmask, so it is twice as long as usual. This fixes a third bug introduced in r1.3 and reported by Volker Schlecht ok jsing
* Add missing error check for a2i_GENERAL_NAME()tb2022-02-111-1/+3
| | | | | | Fixes a segfault reported by Volker Schlecht. ok jsing
* Fix a double free in v2i_NAME_CONSTRAINTS()tb2022-02-111-2/+3
| | | | | | | | | | | a2i_GENERAL_NAME() modifies and returns the out argument that was passed in unless out == NULL, in which case it returns something freshly allocated. Thus, in v2i_GENERAL_NAME_ex() we must only free ret if out == NULL so v2i_NAME_CONSTRAINTS() can free correctly. Issue reported by Volker Schlecht ok jsing
* Remove a strange inheritance check from addr_validate_path_internal()tb2022-02-041-4/+1
| | | | | | | | The trust anchor can't inherit, but the code says that it can inherit just not if the leaf tries to inherit from that. This makes no sense and doesn't match what is done on the asid side. ok jsing
* X509_GET_PUBKEY(3) return value check in libcryptoinoguchi2022-01-221-2/+3
| | | | | | CID 345116 ok beck@ tb@
* X509_GET_PUBKEY(3) return value check in libcryptoinoguchi2022-01-221-3/+4
| | | | | | | | CID 25131 ok beck@ tb@ suggest using X509_REQ_get0_pubkey() and remove the EVP_PKEY_free() from tb@
* Remove header guard around RFC 3779 declarationstb2022-01-141-3/+1
| | | | ok inoguchi jsing
* Remove name_cmp from public visibilitytb2022-01-142-2/+3
| | | | ok inoguchi jsing
* Garbage collect the app_items field of ASN1_ADBtb2022-01-141-2/+1
| | | | | | | This is unused and was removed in OpenSSL 5b70372d when it was replaced with an ASN.1 ADB callback (which we don't support). ok inoguchi jsing
* Remove X509_OBJECT_free_contentstb2022-01-142-19/+11
| | | | | | | | Inline X509_OBJECT_free_contents() in X509_OBJECT_free() and remove this dangerous API. It was left over when x509_vfy.h was made opaque. ok inoguchi jsing
* Unifdef LIBRESSL_OPAQUE_* and LIBRESSL_NEXT_APItb2022-01-141-5/+1
| | | | | This marks the start of major surgery in libcrypto. Do not attempt to build the tree for a while (~50 commits).
* Remove a few unused defines from x509.htb2022-01-101-6/+1
| | | | | | | | As suggested by schwarze, this removes X509_EX_V_{INIT,NETSCAPE_HACK} and X509_EXT_PACK_{STRING,UNKNOWN} ok inoguchi jsing
* x509_cpols.c will need to include x509_lcl.h soontb2022-01-081-1/+2
|
* Add an essentially empty ocsp_local.h and include it in the filestb2022-01-071-1/+3
| | | | | | that will need it in the upcoming bump. discussed with jsing
* minor tweaks, no code changetb2022-01-061-4/+3
| | | | | Adjust a comment to reality, zap a stray empty line and fix whitespace before comment after #endif
* Prepare to provide X509_{set,get}_verify() and X509_STORE_get_verify_cb()tb2022-01-052-7/+37
| | | | | | | | | as well as the X509_STORE_CTX_verify_cb and X509_STORE_CTX_verify_fn types This will fix the X509_STORE_set_verify_func macro which is currently broken, as pointed out by schwarze. ok inoguchi jsing
* Unindent a few lines of code and avoid shadowed variables.tb2022-01-051-12/+7
|
* Rename {c,p}_{min,max} into {child,parent}_{min,max}tb2022-01-051-7/+8
|
* Two minor KNF tweakstb2022-01-051-5/+5
|
* Use child_aor and parent_aor instead of aorc and aorptb2022-01-051-15/+15
| | | | suggested by jsing
* Rename fp and fc into parent_af and child_af for readability.tb2022-01-051-24/+29
| | | | suggested by jsing
* Globally rename all IPAddressFamily *f into af since this is slightlytb2022-01-051-64/+65
| | | | | | more readable. Repeated complaints by jsing
* Add a helper function to turn unchecked (but sound) use oftb2022-01-051-13/+18
| | | | | | sk_find + sk_value into something easier to follow and swallow. ok inoguchi jsing
* Hoist IPAddressFamily_cmp() to the other IPAddressFamily functions.tb2022-01-051-29/+29
| | | | ok inoguchi jsing
* Call x a cert for readability.tb2022-01-051-13/+13
|
* Now that i is free, rename j to i for use as loop variable intb2022-01-051-10/+10
| | | | various loops in addr_validate_path_internal().
* In addr_validate_path_internal() rename i to depth because that'stb2022-01-051-17/+15
| | | | what it is.
* Turn the validation_err() macro into a functiontb2022-01-051-31/+44
| | | | | | | | | | | | validation_err() is an ugly macro with side effects and a goto in it. At the cost of a few lines of code we can turn this into a function where the side effects are explicit and ret is now explicitly set in the main body of addr_validate_path_internal(). We get to a point where it is halfway possible to reason about the convoluted control flow in this function. ok inoguchi jsing
* Move variable declarations in X509v3_addr_canonize() to the top oftb2022-01-051-17/+19
| | | | | | the function and unindent some code. ok inoguchi jsing
* Remove a bogus memcmp in range_should_be_prefix()tb2022-01-051-3/+6
| | | | | | | | | | | | | | | | | | range_should_be_prefix() currently always fails. The reason for this is that OpenSSL commit 42d7d7dd incorrectly moved a memcmp() out of an assertion. As a consequence, the library emits and accepts incorrectly encoded ipAddrBlock extensions since it will never detect ranges that MUST be encoded as a prefix according to RFC 3779, 2.2.3.7. The return -1 from this memcmp() indicates to the callers that the range should be expressed as a range, so callers must check beforehand that min <= max to be able to fail. Thus, remove this memcmp() and add a check to make_addressRange(), the only caller that didn't already ensure that min <= max. This fixes the noisy output in regress/lib/libcrypto/x509/rfc3779. ok inoguchi jsing
* Polish X509v3_addr_subset() a bittb2022-01-051-15/+28
| | | | | | | | | Use child and parent instead of a and b. Split unrelated checks. Use accessors and assign to local variables to avoid ugly line wrapping. Declare vriables up front instead of mixing declarations with assignments from function returns. ok inoguchi jsing
* Readability tweaks in addr_contains()tb2022-01-051-5/+13
| | | | | | Assign to local variables to avoid ugly line wrapping. ok inoguchi jsing
* Fix a bug in addr_contains() introduced in OpenSSL commit be71c372tb2022-01-051-2/+2
| | | | | | | by returning 0 instead of -1 on extract_min_max() failure. Callers would interpret -1 as success of addr_contains(). ok inoguchi jsing
* Readability tweaks in the print helper i2r_IPAddressOrRanges.tb2022-01-041-9/+17
| | | | | Assign repeated nested expressions to local variables and avoid some awkward line wrapping.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-24 16:07:57 +0000