summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Fail early if an X509_VERIFY_PARAM is poisoned - don't allowbeck2018-04-081-8/+10
| | | | | this to be "overridden" by the user supplied callback. ok jsing@
* poison for X509_VERIFY_PARAM'sbeck2018-04-063-31/+54
| | | | | | | | | | | | Tighten up checks for various X509_VERIFY_PARAM functions, and allow for the verify param to be poisoned (preculding future successful cert validation) if the setting of host, ip, or email for certificate validation fails. (since many callers do not check the return code in the wild and blunder along anyway) Inspired by some discussions with Adam Langley. ok jsing@
* Fix two bugs in X509_NAME_add_entry(3):schwarze2018-04-041-7/+4
| | | | | | | | | | | | | | | | | | | | | | | | (1) Evaluate the "set" argument, which says whether to create a new RDN or to prepend or append to an existing one, before reusing it for a different purpose, i.e. for the "set" field of the new X509_NAME_ENTRY structure. (2) When incrementing of some "set" fields is needed, increment the correct ones: All those to the right of the newly inserted entry, but not the one of that entry itself. These two bugs caused wrong results whenever using loc != -1, i.e. whenever inserting rather than appending entries, even when using set == 0 only, that is, even when using single-values RDNs only. Both bugs have been continuously present since at least SSLeay-0.8.1 (released July 18, 1997) and the second one since at least SSLeay-0.8.0 (released June 25, 1997), so both are over twenty years old. I found these bugs by code inspection while trying to document the function X509_NAME_ENTRY_set(3), which is public, but undocumented in OpenSSL. OK beck@, jsing@
* Call strlen() if name length provided is 0, like OpenSSL does.beck2018-03-221-1/+3
| | | | | Issue notice by Christian Heimes <christian@python.org> ok deraadt@ jsing@
* Provide X509_STORE_get_ex_new_index macro.jsing2018-03-201-1/+5
|
* Provide X509_STORE_get0_param()tb2018-03-172-2/+9
| | | | ok jsing
* Provide X509_OBJECT_get_type(). Instead of the X509_LOOKUP_TYPE enumtb2018-03-172-2/+9
| | | | | | (which we don't have) it returns a plain int. ok jsing
* Provide X509_NAME_ENTRY_set()tb2018-03-172-2/+9
| | | | ok jsing
* Fix X509_get0_pubkey() - X509_get_pubkey() is a misnamed "get1" function,jsing2018-03-171-2/+4
| | | | | | so call X509_PUBKEY_get0() instead. Spotted by schwarze@ while documenting.
* Provide X509_PUBKEY_get0() by splitting X509_PUBKEY_get() and turning itjsing2018-03-171-1/+2
| | | | into a wrapper that calls X509_PUBKEY_get0() and up refs.
* Provide X509_REVOKED_dup().jsing2018-03-171-1/+2
|
* Provide X509_chain_up_ref().jsing2018-02-222-2/+21
| | | | From BoringSSL.
* Provide X509_STORE_get0_objects(), X509_STORE_get_ex_data() andjsing2018-02-222-2/+23
| | | | X509_STORE_set_ex_data().
* Provide X509_OBJECT_get0_X509() and X509_OBJECT_get0_X509_CRL().jsing2018-02-222-3/+20
|
* Provide X509_STORE_up_ref().jsing2018-02-222-4/+13
|
* Provide X509_STORE_CTX_get0_chain() and X509_STORE_CTX_get0_store().jsing2018-02-222-4/+20
|
* Provide X509_get0_tbs_sigalg().jsing2018-02-222-3/+10
|
* Provide X509_set1_notBefore() and X509_set1_notAfter().jsing2018-02-222-2/+16
|
* Provide X509_get0_pubkey().jsing2018-02-222-4/+11
|
* Provide X509_CRL_set1_lastUpdate() and X509_CRL_set1_nextUpdate().jsing2018-02-222-2/+16
|
* Provide X509_CRL_get0_extensions() and X509_CRL_get_signature_nid().jsing2018-02-221-1/+5
|
* Provide X509_CRL_up_ref().jsing2018-02-222-2/+11
|
* Provide X509_REQ_get_signature_nid().jsing2018-02-221-1/+3
|
* Provide X509_REVOKED_get0_extensions(), X509_REVOKED_get0_revocationDate()jsing2018-02-222-3/+24
| | | | and X509_REVOKED_get0_serialNumber().
* Provide X509_NAME_get0_der().jsing2018-02-201-1/+2
| | | | From OpenSSL.
* Provide X509_REQ_get0_signature()jsing2018-02-201-1/+4
|
* Provide X509_CRL_get0_{last,next}Update() and X509_CRL_get0_signature().jsing2018-02-201-1/+6
|
* Provide X509_get0_extensions() and X509_get0_signature()jsing2018-02-172-3/+11
|
* Provide X509_STORE_CTX_get0_{cert,untrusted}() andjsing2018-02-142-3/+31
| | | | X509_STORE_CTX_set0_{trusted_stack,untrusted}().
* Provide X509_get{0,m}_not{Before,After}().jsing2018-02-142-5/+37
|
* Provide X509_get_signature_nid().jsing2018-02-141-1/+3
|
* Expose X509_VERIFY_PARAM_* functions that appeared in the OpenSSL 1.0.2jsing2018-02-101-1/+16
| | | | API and are now in use by various libraries and applications.
* Please variable decl before code.deraadt2017-12-091-2/+2
|
* Make the symbol for ASN1_time_tm_clamp_notafter visible so libtlsbeck2017-08-271-1/+3
| | | | | can get at it, so libtls can also deal with notafter's past the realm of 32 bit time in portable
* Add ability to clamp a notafter to values representable in a 32 bit time_tbeck2017-08-131-5/+21
| | | | | | This will only be used in portable. As noted, necessary to make us conformant to RFC 5280 4.1.2.5. ok jsing@ bcook@
* Revert previous change that forced consistency between return value andbeck2017-04-281-10/+2
| | | | | | | error code, since this breaks the documented API. Under certain circumstances this will result in incorrect successful certiticate verification (where a user supplied callback always returns 1, and later code checks the error code to potentially abort post verification)
* revert previous accidental commitbeck2017-04-281-2/+10
|
* *** empty log message ***beck2017-04-281-10/+2
|
* Kill leak introduced with refactorbeck2017-02-051-3/+6
| | | | ok jsing@
* Send the function codes from the error functions to the bit bucket,beck2017-01-2915-178/+98
| | | | | | as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@
* fix bogus commentbeck2017-01-211-2/+2
| | | | ok jsing@
* Make return value of X509_verify_cert be consistent with the error code,beck2017-01-211-2/+10
| | | | | | with the caveat that we force V_OK when a user provided callback has us returning success. ok inoguchi@ jsing@
* Rework internal_verify, mostly from OpenSSL. so we can progressbeck2017-01-201-102/+102
| | | | | towards cleaning up the V_OK stuff. ok kinichiro@
* Add and remove some blank lines, in order to make X509_verify_cert()jsing2017-01-071-6/+4
| | | | (slightly) more readable.
* Revert part of r1.54 as there are at least two situations where we are stilljsing2017-01-071-4/+2
| | | | | | | returning ok == 1, with ctx->error not being X509_V_OK. Hopefully we can restore this behaviour once these are ironed out. Discussed with beck@
* Add a small bit of belt and suspenders around ERR_V_OK with X509_STORE_ctxbeck2017-01-031-2/+20
| | | | | | | and X509_verify_cert - We at least make it so an an init'ed ctx is not "valid" until X509_verify_cert has actually been called, And we make it impossible to return success without having the error set to ERR_V_OK. ok jsing@
* bring in boring's internal check_trust function to fix a bug introducedbeck2017-01-031-24/+79
| | | | | | when we went to alternate cert chains. this correctly does not clobber the ctx->error when using an alt chain. ok jsing@
* Expand ASN1_ITEM_rptr macros - no change in generated assembly.jsing2016-12-302-55/+55
|
* Remove all DECLARE_ASN1_SET_OF macro usage - since 2000 these have beenjsing2016-12-271-8/+1
| | | | | nothing but markers for utils/mkstack.pl... and we removed the code that generated more macros from these markers in 2014.
* Explicitly export a list of symbols from libcrypto.jsing2016-12-212-1/+9
| | | | | | | | | | | | | | | | Move the "internal" BN functions from bn.h to bn_lcl.h and stop exporting the bn_* symbols. These are documented as only being intended for internal use, so why they were placed in a public header is beyond me... This hides 363 previously exported symbols, most of which exist in headers that are not installed and were never intended to be public. This also removes a few crusty old things that should have died long ago (like _ossl_old_des_read_pw). But don't worry... there are still 3451 symbols exported from the library. With input and testing from inoguchi@. ok beck@ inoguchi@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-31 15:16:33 +0000