summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509 (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Rename the ret variable in X509_OBJECT_new() to obj..tb2021-11-051-5/+5
| | | | ok jsing
* Garbage collect the unused skip member of X509_LOOKUP andtb2021-11-052-5/+1
| | | | | | the unused cache member of X509_STORE. ok jsing
* Use calloc() to remove the need of silly zeroing of most members.tb2021-11-051-28/+18
| | | | | | | Check for allocation failures and if one happens push an error on the stack and clean up using X509_STORE_free(). ok jsing
* Streamline and shorten x509_object_cmp() a bit.tb2021-11-051-11/+6
| | | | ok jsing
* Drop a bunch of unnecesary parentheses and unify the order in whichtb2021-11-051-17/+13
| | | | | | callbacks are called. ok jsing
* Cleanup X509_LOOKUP_new()tb2021-11-051-12/+11
| | | | | | | Switch from malloc() to calloc() and drop a bunch of initializations to 0. Call the returned object lu instead of the generic ret. ok jsing
* Garbage collect xobj->data.{ptr,pkey}tb2021-11-052-8/+6
| | | | | | | | | Both these are essentially unused. Remove the last use of data.ptr by initializing and copying the X509_OBJECT using memset() and struct assignment in X509_STORE_CTX_get_subject_by_name() and add a missing error check for X509_OBJECT_up_ref_count() while there. ok beck
* Cache sha512 hash and parsed not_before and not_after with X509 cert.beck2021-11-047-128/+135
| | | | | | | | | | | Replace sha1 hash use with sha512 for certificate comparisons internal to the library. use the cached sha512 for the validator's verification cache. Reduces our recomputation of hashes, and heavy use of time1 time conversion functions noticed bu claudio@ in rpki client. ok jsing@ tb@
* Fix five bugs in X509_REQ_to_X509(3):schwarze2021-11-031-11/+12
| | | | | | | | | | | | | | | | | | | | | | | | * memory leak in X509_set_subject_name(ret, X509_NAME_dup(xn)); * memory leak in X509_set_issuer_name(ret, X509_NAME_dup(xn)); * memory leak in X509_set_pubkey(ret, X509_REQ_get_pubkey(r)); * missing return value check of X509_REQ_get_pubkey(r); * missing return value check of X509_set_pubkey(...); Some of these bugs have survived for twenty-five years. I noticed the first two bugs while documenting the function, then found that a commit in the OpenSSL 1.1.1 branch, which is still under a free license, fixed all of them in 2016. In the function X509_REQ_to_X509(3), merge everything worth merging from OpenSSL 1.1.1, in particular the relevant parts of: * 222561fe Apr 30 17:33:59 2015 -0400 (err: label cleanup) * 0517538d Mar 17 00:15:48 2016 +0100 (the bugfix) * c5137473 Apr 3 23:37:32 2016 +0200 (code simplification) While here, delete some commented out code that is wrong in multiple ways and untouched since the SSLeay era. One code tweak for readability by tb@, and OK tb@.
* Some cleanup in X509_REQ_get_extensions(3), no functional change.schwarze2021-11-031-10/+6
| | | | | | | | | | | | | | In this function, merge everything that is worth merging from the OpenSSL 1.1.1 branch, which is still under a free license, mostly the relevant part of commit 9b0a4531 Mar 14 23:48:47 2015 +0000 to use X509_ATTRIBUTE_get0_type(3) rather than re-implementing it. While here, * use d2i_X509_EXTENSIONS(3) rather than ASN1_item_d2i(3); * test pointers explicitly against NULL, not with '!', as suggested by tb@; * drop some useless parentheses as suggested by tb@. OK tb@
* Fix two bugs in X509_REQ_add_extensions_nid(3)schwarze2021-11-031-32/+13
| | | | | | | | | | | | | | | | | | that i noticed while documneting the function: * missing return value check for ASN1_item_i2d(3) and * missing return value check for OBJ_nid2obj(3). In the function X509_REQ_add_extensions_nid(3), merge everything that is worth merging from the OpenSSL 1.1.1 branch, which is still under a free license; that's mostly parts of the commit 9b0a4531 Mar 14 23:48:47 2015 +0000 (containing the bugfix, even though the OpenSSL commit message did not mention the bugs) and some minor stylistic changes from 0f113f3e and 26a7d938. While here, use i2d_X509_EXTENSIONS(3) instead of the layer-violating call to ASN1_item_i2d(3), and include a few stylistic tweaks from tb@. OK tb@, and jsing@ agreed on the general direction.
* Move the now internal X.509-related structs into x509_lcl.h.tb2021-11-0135-404/+417
| | | | | | | | Garbage collect the now unused LIBRESSL_CRYPTO_INTERNAL and LIBRESSL_OPAQUE_X509. Include "x509_lcl.h" where needed and fix a couple of unnecessary reacharounds. ok jsing
* In X509_STORE_CTX_get_obj_from_subject() rename X509_OBJECT fromtb2021-11-011-6/+6
| | | | | | the generic 'ret' to obj' in X509. Requested by jsing
* Unifdef LIBRESSL_NEW_API. Now that the library is bumped, this istb2021-11-014-37/+4
| | | | | | no longer needed. ok jsing
* Hide struct internals under LIBRESSL_CRYPTO_INTERNAL so that othertb2021-10-312-17/+17
| | | | | | parts of LibreSSL can no longer reach into them. discussed with beck, jsing
* Remove the unused X509_OBJECTS struct.tb2021-10-311-8/+1
| | | | ok beck jsing
* Remove the unused X509_CERT_PAIR struct and the assicated API.tb2021-10-311-12/+1
| | | | ok beck jsing
* Remove the unused X509_CERT_FILE_CTX struct.tb2021-10-311-9/+1
| | | | ok beck jsing
* Prepare to provide X509_STORE_CTX_get_obj_by_subject(), a wrappertb2021-10-312-2/+22
| | | | | | | around X509_STORE_get_by_subject() that eliminates the need of allocating an object on the heap by hand. ok beck inoguchi jsing
* Switch various X509 API to use the new X509_LOOKUP_TYPE to matchtb2021-10-312-29/+32
| | | | | | OpenSSL's signatures. ok beck inoguchi jsing
* Provide the X509_LOOKUP_TYPE enum.tb2021-10-311-6/+6
| | | | | | Remove the now unused X509_LU_{RETRY,FAIL,PKEY}. ok beck inoguchi jsing
* Prepare definitions X509_STORE_set_verify{,_cb}_func() that work withtb2021-10-311-3/+8
| | | | | | opaque structs. ok beck inoguchi jsing
* Prepare to make various structs in x509_vfy.h opaque.tb2021-10-311-26/+37
| | | | ok beck inoguchi jsing
* Actually error in X509_check_purpose() if x509v3_cache_extensions()tb2021-10-291-2/+2
| | | | | | | | | indicates failure. The previous "error return" X509_V_ERR_UNSPECIFIED translates to 1, i.e., success. This changes to the intended behavior of x509_purp.c r1.3 and matches OpenSSL. This will need various adjustments in the documentation. ok jsing
* Bring back r1.3, ok becktb2021-10-281-3/+47
| | | | | | | | | | | Original commit message from beck: Validate Subject Alternate Names when they are being added to certificates. With this change we will reject adding SAN DNS, EMAIL, and IP addresses that are malformed at certificate creation time. ok jsing@ tb@
* Revert version 1.3 - not allowing the creation of bogus certificatesbeck2021-10-271-47/+3
| | | | | | | | | breaks the ruby regression tests that expect to make bogus certificates and see that they are rejected :( I am reverting this for now to make the regress tests pass, and will bring it back if we decide to patch the regress tests to remove the problem cases
* Add RFC 3779 checks to both legacy and new verifierjob2021-10-262-2/+20
| | | | OK beck@
* Validate Subject Alternate Names when they are being added to certificates.beck2021-10-263-9/+61
| | | | | | | With this change we will reject adding SAN DNS, EMAIL, and IP addresses that are malformed at certificate creation time. ok jsing@ tb@
* Add missing RCS markerstb2021-10-252-0/+2
|
* Zap two unused includesjca2021-10-252-4/+0
| | | | Spotted by egcc. ok tb@
* Prepare to provide a number of X509_STORE_CTX_* setters.tb2021-10-242-2/+52
| | | | ok beck jsing
* Prepare to provide X509_STORE_CTX_get_num_untrusted()tb2021-10-242-2/+11
| | | | ok beck jsing
* Prepare to provide X509_OBJECT_{new,free}()tb2021-10-242-3/+25
| | | | ok beck inoguchi jsing
* Declare STACK_OF(GENERAL_NAMES)tb2021-10-231-3/+4
| | | | ok jsing
* KNF a particularly ugly commenttb2021-10-231-17/+16
|
* Zap trailing whitespacetb2021-10-231-13/+13
|
* Prepare to make many of the structs in x509.h opaque.tb2021-10-231-76/+86
| | | | ok beck jsing
* Prepare to provide X509_re_X509*_tbs()tb2021-10-233-3/+27
| | | | ok beck jsing
* Prepare to provide X509_get_extension_flags()tb2021-10-232-2/+13
| | | | ok beck jsing
* Prepare to provide X509_SIG_get{0,m}.tb2021-10-231-1/+8
| | | | ok beck jsing
* Prepare to provide X509_get_{extended_,}key_usage()tb2021-10-222-2/+32
| | | | ok beck jsing
* Prepare to provide X509_REQ_pubkey_get0()tb2021-10-222-2/+13
| | | | ok jsing
* Simplify a return value check for X509_STORE_get_by_subject() nowtb2021-10-211-18/+7
| | | | | | | that we know that it only returns 0 or 1. Eliminate the last uses of X509_LU_{FAIL,RETRY}. ok jsing
* Set enc.modified if the X509_REQ is going to be modified.tb2021-10-211-1/+4
| | | | ok jsing
* Sync parts of X509_STORE_get_by_subject() with OpenSSLtb2021-10-211-13/+7
| | | | | | | | | | | Initialize stmp.type and stmp.data.ptr so that a user-defined lookup method need not take responsibility of initializing those. Get rid of current_method, which was never really used. Stop potentially returning a negative value since most callers assume Boolean return values already. In addition, garbage collect the pointless j variable. ok jsing
* Prepare to make X509 opaque.tb2021-10-211-4/+7
| | | | ok jsing
* Add XKU_ANYEKU #define and use it to cache the anyExtendedKeyUsagetb2021-10-212-3/+8
| | | | | | | extension. This is part of OpenSSL commit df4c395c which didn't make it into our tree for some reason. ok jsing
* Prepare to provide X509_get_X509_PUBKEY() as a function.tb2021-10-212-5/+15
| | | | ok jsing
* X509_STORE_CTX_init() allows the store to be NULL on init. Add checksclaudio2021-10-061-1/+11
| | | | | | | | for a NULL ctx->ctx in the lookup functions using X509_STORE_CTX. This affects X509_STORE_get1_certs(), X509_STORE_get1_crls(), X509_STORE_CTX_get1_issuer() and X509_STORE_get_by_subject(). With this X509_verify_cert() no longer crashes with a NULL store. With and OK tb@
* Enable X509_V_FLAG_TRUSTED_FIRST by default in the legacy verifier.jsing2021-09-301-1/+2
| | | | | | | | | | | | In order to work around the expired DST Root CA X3 certficiate, enable X509_V_FLAG_TRUSTED_FIRST in the legacy verifier. This means that the default chain provided by Let's Encrypt will stop at the ISRG Root X1 intermediate, rather than following the DST Root CA X3 intermediate. Note that the new verifier does not suffer from this issue, so only a small number of things will hit this code path. ok millert@ robert@ tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-27 13:13:27 +0000