summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Prior to this we substring matched and allowed a leading .beck2026-04-132-5/+26
| | | | | | | | | | | on a SAN DNSname constraint. This is not correct, as with a DNSname constraint, it may exacly match or match zero or more additional components on the front of the candidte to match. Spotted by Haruto Kimura <hkimura2026@gmail.com> ok tb@ kenjiro@
* Stop Delta CRL processing if a CRL number is misssingtb2026-04-071-4/+8
| | | | | | | | | | | | | | | | A malformed Delta CRL could cause a crash. Funnily enough the deserializer recognizes this and marks such a CRL as invalid, but nothing ever checks the EXFLAG_INVALID for CRLs. For certificates this would usually result in verification failure due to x509v3_cache_extensions() failing. This is only reachable if the X509_V_FLAG_USE_DELTAS is used, which only a handful of ports do, plus openssl(1) does if you use the undocumented -use_deltas flag. Reported by Igor Morgenstern to OpenSSL who then sat on this since Jan 8 and assigned CVE-2026-28388. ok jsing
* x509v3.h: remove pointless #ifdef HEADER_CONF_Htb2026-04-061-3/+1
| | | | | | | | | x509v3.h has included conf.h since June 20, 1999, OpenSSL commit ba404b5e, so HEADER_CONF_H has been defined since then. Also since then, CONF_VALUE (only available via conf.h) has been used outside of HEADER_CONF_H, making that #ifdef doubly pointless. ok bcook jsing kenjiro
* Restore the previous behaviour with maximum verification depth.jsing2026-04-011-7/+7
| | | | | | | | | | | The maximum depth is not expected to include the leaf certificate - restore the decrement prior to checking, which means the previous behaviour is retained for the callback depth and the maximum depth. Reduce the maximum depth by one in order to avoid the overwrite that could previously occur. Thanks to anton@ for flagging the rust-openssl failure in regress. ok tb@
* Fix an off-by-one error in the X.509 verifier depth checking.jsing2026-03-311-6/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | In x509_verify_build_chains(), ensure that we check the current depth against max_depth prior to turning it into a legacy-style depth index. Additionally, add a guard to x509_verify_chain_append() so that we avoid exceeding the maximum certs per chain, even if we fail to handle this correctly elsewhere. Also prevent the legacy callback from being able to override the maximum verification depth. The current off-by-one allows for a 4 byte overwrite to occur on heap allocated memory - this will likely trigger a crash on OpenBSD (but may go unnoticed elsewhere). This is only reachable if a TLS client is talking to a malicious server or if a TLS server has client certificate verification enabled - in both cases the verification depth also needs to be set to the maximum allowed value of 32. It is worth noting that many TLS clients/servers set the maximum verification depth to a value that is much less than the default. A libtls client or server uses a default depth of 6 and is not impacted in this configuration. Thanks to Calif.io in collaboration with Claude and Anthropic Research, for reporting the issue. ok tb@
* replace buggy strncmp with strcmp found with clang-tidybcook2026-02-071-2/+2
| | | | | | Found the same fix from davidben in BoringSSL as well (https://boringssl-review.googlesource.com/c/boringssl/+/87927). OpenSSL appears to have accidentally changed the semantics here with the HAS_PREFIX macro, which appears to be incorrect. discussed w/ tb@ & beck@
* x509_utl.c: zap two useless commentstb2026-01-121-5/+1
|
* x509.h: annotate why X509_PKEY cannot be made opaquetb2026-01-011-1/+2
|
* X509_NAME_ENTRY_set_data: remove redundant parenthesestb2025-12-211-6/+6
|
* X509_NAME_ENTRY_set_data(): garbage collect unnecessary itb2025-12-211-5/+2
|
* X509_NAME_ENTRY_set_data: remove V_ASN1_APP_CHOOSE quirktb2025-12-211-7/+4
| | | | | | | This is the last remaining actual use of ASN1_PRINTABLE_type(), which will go away in the next major bump. ok kenjiro
* x509.h: add missing spaces after ,tb2025-12-111-63/+63
|
* Fix double free in certificate policies configurationtb2025-11-281-12/+7
| | | | | | | | In nref_nos(), nnums must not be freed on error because in the caller it is not->noticeref->noticenos and hangs off the POLICYQUALINFO qual which is freed as part of POLICYQUALINFO_free() in the error path. ok jsing kenjiro
* In nref_nos() don't leak the ASN1_INTEGER if the push failstb2025-11-031-2/+4
| | | | | | | (A much bigger problem here is a double free for which I will send out a diff shortly) From Niels Dossche
* x509_cpols: pass correct free function to sk_ASN1_INTEGER_free()tb2025-11-031-2/+2
| | | | from Niels Dossche
* x509_cpols: indent labels to make diffs more readabletb2025-11-031-8/+8
|
* Expose X509_VERIFY_PARAM_get_hostflags()tb2025-10-242-3/+4
| | | | | | | | | | | | | | This is needed by Python 3.14, extending the urllib3 nonsense further. This is a trivial getter and it is exercised by the libssl unit test I added for urllib3 (which can now use dynamic linking for libcrypto). Fixes https://github.com/libressl/portable/issues/1202 Thanks to @orbea for the report. ok kenjiro PS: X509_VERIFY_PARAM_get_flags() and X509_VERIFY_PARAM_get_peername() aren't const correct. Fixing this will require some doing...
* const correct X509_VERIFY_PARAM_get_hostflags()tb2025-10-101-2/+2
| | | | | | | This is currently an internal helper only used by a regress test. We'll have to expose in the public API for Python 3.14: https://github.com/libressl/portable/issues/1202
* Remove unused sequence member from x509_revoked_sttb2025-10-102-11/+2
| | | | | | | | | | | | | | | | | To allow binary search for looking up if a cert was revoked in a CRL, the list of revoked serial numbers is sorted in crl_lookup(). On the other hand, to be able to output the DER that was actually signed by the issuer, the original order needs to be remembered. Before the encoding was cached, there was a mechanism that would restore the original order on serialization using the .sequence member. This was done without a lock and was thus racy (hilarity would ensue if one thread performed a CRL lookup while another thread serialized the same CRL). When the racy mechanism was removed in 2004, the only reader of .sequence, X509_REVOKED_seq_cmp(), was also removed, and this piece of dead code was left behind. Garbage collect it. ok kenjiro
* Clean up and move define to correct place.beck2025-08-102-5/+3
| | | | ok tb@
* Ride the libcrypto bump with some simple cleanup:tb2025-07-161-20/+1
| | | | | | | | Remove BIO_s_log(): already unhooked in portable, completely unused. Remove X509_PKEY_new/free from public API. Remove PEM_X509_INFO_read() PEM_X509_INFO_write_bio(): all unused garbage. The simplify X509_PKEY_new/free was ok kenjiro.
* X509_verify(): sync with X509_CRL_verify()tb2025-07-101-2/+6
| | | | | | | Check X509_ALGOR_cmp() explicitly against 0 and add an explanatory comment referring to the relevant RFC 5280 sections. ok beck kenjiro
* x509.h: provide X509_FLAG_NO_IDStb2025-07-011-1/+2
|
* correct indentation, no functional changejsg2025-06-022-6/+8
| | | | found with smatch, ok tb@
* Use err_local.h rather than err.h in most placestb2025-05-1035-69/+73
| | | | ok jsing
* x509_policy: zap an extra stb2025-03-281-2/+2
|
* x509_policy: certificats -> certificatestb2025-03-281-2/+2
|
* x509_param_set_hosts_internal: rename vpm to param for consistencytb2025-03-191-11/+11
|
* X509_VERIFY_PARAM_lookup(): avoid passing stack garbage aroundtb2025-03-191-1/+2
| | | | ok jsing
* Rename pm to param, fix the type of idx and unindenttb2025-03-191-8/+6
| | | | ok jsing
* Introduce and use N_DEFAULT_VERIFY_PARAMStb2025-03-191-6/+9
| | | | ok jsing
* X509_VERIFY_PARAM_get0(): use consistent idiom for default_table accesstb2025-03-191-2/+3
| | | | ok jsing
* X509_VERIFY_PARAM_lookup(): remove unnecessary braces and add empty linetb2025-03-191-3/+3
| | | | ok jsing
* X509_VERIFY_PARAM_get_count(): make NULL check explicittb2025-03-191-2/+2
| | | | ok jsing
* X509_VERIFY_PARAM_get0: avoid out of bounds access when id < 0tb2025-03-191-1/+5
| | | | ok jsing
* Streamline X509_VERIFY_PARAM_add0_table()tb2025-03-121-17/+12
| | | | | | | Unindent, use correct type for idx (int rather than size_t) and make this mess a bit more pleasant on the eyes. ok jsing
* x509_vpm: remove unnecessary NULL check before sk_pop_free()tb2025-03-121-4/+2
| | | | ok jsing
* Unexport the weird X509_OBJECT_up_ref_count()tb2025-03-092-5/+5
| | | | | | | | It's only used in x509_lu.c, so move it there. X509_OBJECT is not itself refcounted. This API bumps the refcount of its cert or CRL member. This isn't really useful outside of the library. ok jsing
* Unexport X509_NAME_print()tb2025-03-091-2/+1
| | | | | | | | | | Nothing uses this anymore. M2Crypto has been patched and a fix for opensc has been upstreamed. ok jsing This is the start of a major bump. Don't build the tree until I have synced sets in about 20 commits.
* Rename X509V3_get_section() to X509V3_get0_section()tb2025-03-065-13/+13
| | | | | | | | This makes it clear for those fluent in OpenSSL API gibberish that nothing needs to be freed here. This is because it returns something hanging off a hash entry owned by cnf. ok jsing
* Garbage collect X509V3_section_free()tb2025-03-065-20/+6
| | | | | | | | Historically, X509V3_section_free() could be customized by the conf db method to release memory allocated by X509V3_get_section(). This is no longer supported, so it is always a noop and can be removed. ok jsing
* unifdef OPENSSL_NO_CHAIN_VERIFYtb2025-03-041-6/+3
| | | | ok jsing
* Remove offensive whitespace from x509.htb2025-03-011-27/+27
|
* Remove unused name member from x509_sttb2025-02-211-2/+1
| | | | | | | As far as I can tell this has never been used since the beginning of git history with SSLeay 0.8.1b, so we can simplify the x509_cb() a little. ok jsing miod
* Remove unused valid member of x509_sttb2025-02-201-2/+1
| | | | | | internal_verify() (now x509_vfy_internal_verify()) used to cache the validity of the signature of a cert in this field. This is no longer the case since x509_vfy.c 1.57 (2017).
* Cache CRLs in issuer cachetb2025-02-082-18/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | The issuer cache holds a pair of SHA-512 of parent and child cert plus the result of the signature verification. Since CRLs also have a cached hash of their DER, we can easily add them to the same cache. This way we also avoid the cost of repeated signature verification for CRLs. For ordinary workloads the cache is larger than necessary and it won't currently take up more space than ~8M anyway, so the cost of doing this is negligible. For applications like rpki-client where the same (CA, CRL) pair is used to verify multiple EE certs, the gain is significant. In fact, the current worst case is a single pair being used for > 50k EE certs, responsible for about 20-25% of the total runtime of an ordinary rpki-client run if a hw-accelerated version of SHA-2 is available and even more if it isn't. In both cases the cost of processing of this pair is reduced by more than an order of magnitude. The implementation is a translation of x509_verify_parent_signature() to the case of CRLs and is entirely trivial thanks to the cache's design. Found while investigating a performance bottleneck found by job tested by job ok beck
* x509_verify_parent_signature(): no need to bump pkey's refcounttb2025-02-081-4/+2
| | | | | | | The parent certificate outlives the signature check, so we don't have to take a refcount of its pubkey and then release it again. ok beck
* x509_verify: missing verify error on cached signature mismatchtb2025-02-081-2/+5
| | | | | | | | If a signature mismatch is cached, the same error should be passed to the verify callback as if the mismatch was detected by doing the calculation, rather than falling back to the "unable to find the issuer cert locally". ok beck
* x509_obj.c: be better at sortingtb2025-01-271-2/+2
|
* x509_obj.c: fix includestb2025-01-261-4/+5
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-08-27 22:59:54 +0000