summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509 (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove unused flags argument from the trust handlerstb2024-03-231-13/+13
| | | | | | | | The public X509_check_trust() takes a flag parameter which we must leave in place. However, we can stop passing the flag parameter around without ever looking at it. ok jsing
* Simplify X509_STORE_free()tb2024-03-221-11/+3
| | | | | | | This had an inlined version of sk_pop_free(). We can just call it the right way. ok jsing
* Remove sk_find_ex()tb2024-03-021-3/+1
| | | | | | | This API intends to find the closest match to the needle. M2Crypto exposes it because it can. This will be fixed by patching the port. ok jsing
* Make LHASH_OF() and STACK_OF() use opaque structstb2024-03-021-1/+2
| | | | | | | | | | | | | This removes internals of these two special snowflakes and will allow further simplifications. Unfortunately, there are some pieces of software that actually use LHASH_OF() (looking at you, pound, Ruby, and openssl(1)), so we get to keep exposing this garbage, at least for now. Expose lh_error() as a symbol to replace a macro reaching into _LHASH. lh_down_load() is no longer available. _LHASH and _STACK are now opaque, LHASH_NODE becomes internal-only. from jsing
* Remove X509_CRL_METHOD APItb2024-03-021-13/+1
| | | | | | I would keep repeating myself... In the bit bucket you go. ok jsing
* Garbage collect most of the public LOOKUP APItb2024-03-022-62/+4
| | | | | | | | Yet another bit of extensibility that no one ever really used. X509_LOOKUP_free() needs to stay because of ... rust-openssl (and kdelibs4support). ok jsing
* Expose X509_STORE_get1_objects()tb2024-03-021-3/+1
| | | | | | Safer replacement API for the unsafe X509_STORE_get0_objects(). ok jsing
* Make X509_CERT_AUX internaltb2024-03-022-12/+11
| | | | | | Another struct/API that should never have leaked out of the library. ok jsing
* Remove X509_TRUST from the public APItb2024-03-022-13/+11
| | | | | | With API and other users internal, this struct can now go. ok jsing
* Remove DECLARE_STACK_OF(X509_TRUST)tb2024-03-021-3/+1
| | | | | | Unused since the extensibility was neutered. ok jsing
* Remove unused public X509_TRUST APItb2024-03-022-92/+2
| | | | | | | Another thing that should never have leaked out of the library. It will become internal entirely, where the code can be simplified greatly. ok jsing
* const correct X509_PURPOSE_get0{,_{,s}name}()tb2024-03-022-10/+11
| | | | | | | Unfortunately, PHP and rust-openssl still need this API. At least we can make the table read-only now since we disabled its extensibility. ok jsing
* Make X509_PURPOSE opaquetb2024-03-022-11/+13
| | | | | | | Code using details of X509_PURPOSE does so by using API. So we can make this struct opaque. ok jsing
* Remove unused parts of the purpose APItb2024-03-025-54/+11
| | | | | | | | | Most of this is the ability to add custom purposes. Also the astounding X509_STORE_CTX_purpose_inherit(). The names are used by PHP, and M2Crypto exposes X509_check_purpose(), so these remain public. Some weird, most likely invalid, uses also remain in rust-openssl. ok jsing
* Remove X509V3_EXT extensibility APItb2024-03-022-40/+2
| | | | | | | | | | You used to be able to define your own X.509 extension handlers. Great. Even greater: the verifier would ignore any custom extensions. So this was only ever useful for serialization and deserialization. In other words, almost entirely pointless. The API was also unused except for a hack in kore-acme, which was fixed recently. ok jsing
* Remove X509_ALGOR_set_md()tb2024-03-021-4/+1
| | | | | | | | One of those void APIs that are super hard to use safely since they can fail but can't communicate failure. Nothing uses this. Internal uses have been converted to error checked X509_ALGOR_set_evp_md(). ok jsing
* Remove more PBE stuff from the public APItb2024-03-022-16/+13
| | | | | | | This is still needed internally for CMS and its predecessors. This removal will enable disentangling some of its innards. ok jsing
* Remove most PBEPARAM stuff from public visibilitytb2024-03-022-33/+33
| | | | | | The struct itself needs to remain public, unfortunately. ok jsing
* Small tweak for X509_check_purpose()tb2024-02-281-4/+6
| | | | ok jsing
* Use an accessor instead of reaching into X509_PURPOSEtb2024-02-281-2/+2
| | | | ok jsing
* Prepare to provide X509_STORE_get1_objects()tb2024-02-232-2/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The OpenSSL 1.1 API X509_STORE_get0_objects() is not thread safe. It exposes a naked internal pointer containing certificates, CRLs and cached objects added by X509_LOOKUP_hash_dir(). Thus, if the store is shared between threads, it is not possible to inspect this pointer safely since another thread could concurrently add to it. This may happen in particular during certificate verification. This API led to security issues in rust-openssl and is also problematic in current Python. Other consumers of X509_STORE_get0_objects() are haproxy, isync, openvpn. The solution is to take a snapshot of the state under a lock and return that. This is what X509_STORE_get1_objects() does. It returns a newly allocated stack that needs to be freed with sk_X509_OBJECT_pop_free(), passing X509_OBJECT_free as a second argument. Based on a diff by David Benjamin for BoringSSL. https://boringssl-review.googlesource.com/c/boringssl/+/65787 ok beck jsing PS: Variants of this have landed in Python and OpenSSL 3 as well. There the sk_*deep_copy() API is used, which in OpenSSL relies on evaluating function pointers after casts (BoringSSL fixed that). Instead of using this macro insanity and exposing that garbage in public, we can do this by implementing a pedestrian, static sk_X509_OBJECT_deep_copy() by hand.
* Remove ASN1_time_clamp_notafter() prototypetb2024-02-231-3/+1
| | | | | There is now a prototype in x509_internal.h, so no need to repeat that here.
* x509_asid: NULL out min/max on extract_min_max() failuretb2024-02-201-1/+3
| | | | requested by/ok jsing
* x509_asid: fix some KNF botchestb2024-02-191-37/+19
| | | | | | | | When this file was brought into KNF, a few things became particularly ugly. This makes {a,b}{,_{min,max}} have function scope in canonize/is_canonical, which removes unfortunate line wraps and some other silliness. ok job
* Use EVP_MD_CTX_legacy_clear() internallytb2024-02-181-3/+3
| | | | ok jsing
* Fix the verifier to use the trust storebeck2024-02-011-1/+13
| | | | the trust store is yet another obscure way to add a trust anchor
* This table no longer needs to be sortedtb2024-01-251-5/+1
|
* Remove the custom X509v3 extensions stacktb2024-01-251-105/+42
| | | | | | | | | | | | | | | This is essentially unused. The only consumer, www/kore,-acme is in the process of being fixed. It is also incomplete: in particular, the verifier doesn't learn about extensions added to the list, making the entire exercise rather pointless. So let's ditch that crap. This was the last consumer of the horror that is OBJ_bsearch_(). The even worse OBJ_bsearch_ex_() is still being "used" by M2Crypto... This prepares the removal of X509V3_EXT_{add{,_list,_alias},cleanup}(). and removes another piece of thread-unsafe global state. ok jsing
* Prepare for removing most of the X509_TRUST APItb2024-01-131-41/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | X509_check_trust() is of course used by the verifier. Unfortunately M2Crypto exposes it. The only other part of the X509_TRUST API that are still needed are the X509_TRUST_* macros in x509.h, as they are used via *_set_trust and indirectly via the purpose stuff. The rest will be removed. X509_TRUST_add() was defanged recently, in particular it no longer hangs strdup()'ed strings off the global struct. Nothing ever cleaned these up. TRUST_cleanup() attempted to do so, but since it checked the dynamic/dynamic strings flags in the wrong order, that cleanup call ended up doing nothing, so that code was removed at some point. As a consequence, the struct can now be made const. Use a CTASSERT() to ensure size assumptions on X509_TRUST_COUNT, X509_TRUST_MAX, and X509_TRUST_MIN hold true. Remove the global variable underlying X509_TRUST_set_default()'s functionality and move its accessor down to all the other functions that will be deleted. Inline a few things in X509_check_trust(), so we can excise the internals of X509_TRUST_get0(), X509_TRUST_get_by_id(). Since the default trust function can no longer be changed, call obj_trust() directly. ok jsing
* X509_TRUST: tidy up includestb2024-01-101-2/+4
|
* X509_TRUST: group together all trust_*() functionstb2024-01-101-33/+30
| | | | | Now they are next to the trstandard[] table and listed in the order they appear in the table.
* X509_TRUST: hoist trust_compat() to the other end of the filetb2024-01-101-12/+11
|
* X509_TRUST: start shuffling some code aroundtb2024-01-101-32/+31
| | | | | Hoist obj_trust() to the top and move the static default_trust() next to its setter.
* Rework X509_STORE_CTX_set_{purpose,trust}()tb2024-01-101-36/+35
| | | | | | | | | | | | | Split the two codepaths in x509_vfy_purpose_inherit() into its two callers. What remains is gross, but at least a reader has a chance of following all this nonsense without leaving a significant amount of hair behind. In short, purpose and trust are only overridden if they're not already set. Otherwise silently ignore valid purpose and trust identifiers that were passed in and succeed. Error on almost all invalid trust or purpose ids, except 0, because... well... who knows, really? ok jsing
* Fix copy-paste error that broke openssl-ruby and openssl regresstb2024-01-091-2/+2
| | | | Noticed by anton
* Disable X509_STORE_CTX_purpose_inherit()tb2024-01-081-23/+22
| | | | | | | | | | | | | | | | | | | | | | Nothing uses this function, except two internal callers. So split its guts temporarily into a helper function and disable the gross general case. The internal helper can be simplified by observing that def_purpose == 0: Overriding 0 by 0 doesn't do anything, so drop that bit. Rename ptmp into purp, and inline X509_PURPOSE_get_by_id(), i.e., make appropriate checks and subtract X509_PURPOSE_MIN. The fallback to X509_PURPOSE_get_by_id(0) will always fail since X509_PURPOSE_MIN == 1. So ditch that call. In particular, X509_STORE_CTX_set_purpose(ctx, X509_PURPOSE_ANY) fails in current because of this. That's nonsense. So remove the purp->trust == X509_TRUST_DEFAULT check as only change of behavior. This matches what OpenSSL do nowadays. They now set def_purpose = purpose if purpose != 0 and def_purpose == 0, so in all real-world uses of this function they will just fetch the same purpose again and do not check for default trust the second time around. Finally, X509_TRUST_get_by_id() is only used to ensure that a non-zero (or overridden) trust is between X509_TRUST_MIN and X509_TRUST_MAX. So expand that into its explicit form. ok jsing
* Inline X509_{TRUST,PUPROSE}_set() in their only callerstb2024-01-081-3/+16
| | | | | | They are now unused and will join the exodus to the attic in the next bump. ok jsing
* Fix logic error (&& -> ||)tb2024-01-081-2/+2
| | | | CID 477172
* Minor cleanup in X509_STORE_CTX_purpose_inherit()tb2024-01-071-9/+10
| | | | | Make a few checks against 0 explicit to reduce noise in an upcoming diff and tiny KNF tweaks.
* purpose/trust: Improve comments about COUNT/MAX confusiontb2024-01-072-4/+10
|
* Remove X509_TRUST extensibilitytb2024-01-071-102/+10
| | | | | | | | This is pretty much identical to the X509_PURPOSE case: remove the stack used for extending and overriding the trust table and make X509_TRUST_add() always fail. Simplify some other bits accordingly. ok jsing
* Remove X509_CRL_METHOD internalstb2024-01-061-3/+1
| | | | | | | | | | | | | | | Another complication of dubious value that nobody's ever used. crl_init(), crl_free() and the meth_data are dead weight, as are their accessors. Inline def_crl_verify() in X509_CRL_verify() so that the latter becomes the trivial wrapper of ASN1_item_verify() that one would expect it to be. It is quite unclear what kind of customization would make sense here... def_crl_lookup() is renamed into crl_lookup() and its two callers, X509_CRL_lookup_by_{serial,cert}(), are moved below it so that we don't need a prototype. ok jsing
* Remove X509_PURPOSE extensibilitytb2024-01-061-112/+10
| | | | | | | | | | | | | | | | | | | Another bit of global state without lock protection. The by now familiar complications of a stack to make this user configurable, which, of course, no one ever did. The table is not currently const, and the API exposes its entries directly, so anyone can modify it. This fits very well with the safety guarantees of Rust's 'static lifetime, which is how rust-openssl exposes it (for no good reason). Remove the stack and make the X509_PURPOSE_add() API always fail. Simplify the other bits accordingly. In addition, this API inflicts the charming difference between purpose identifiers and purpose indexes (the former minus one) onto the user. Neither of the two obvious solutions to avoid this trap seems to have crossed the implementer's mind. ok jsing
* KNF nittb2023-12-311-2/+2
|
* Sort the NIDs by nametb2023-12-311-8/+8
| | | | requested by jsing
* Replace the sorted extensions lookup with a switchtb2023-12-311-58/+23
| | | | | | | | | If all you have is OBJ_bsearch_(), everything looks like a nail. This changes a binary search over a list of 12 elements with a lookup via a switch. switch suggested by claudio ok jsing
* Make x509_issuer_cache_free_oldest() statictb2023-12-301-2/+2
| | | | | This is an internal function and you can't hold the required mutex to call it anyway since that's internal, too.
* One more missing void was hiding heretb2023-12-301-2/+2
|
* Some BoringSSL devs spent too much time with C++tb2023-12-302-4/+4
|
* Use a void pointer rather than char for method_datatb2023-12-292-9/+7
| | | | | This way we don't need to cast from BY_DIR * to char * and back in its only consumer, the lovely by_dir.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-19 17:40:04 +0000