summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509v3 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Collapse the x509v3 directory into x509.jsing2020-06-0437-13636/+0
| | | | | | | This avoids the need to grep across directories to find functions and prepares for further rototilling and chainsawing. Discussed with tb@ (who also tested the release build)
* initialize safestack pointersbcook2019-05-083-6/+6
| | | | ok beck@, tb@
* Add error checking to i2v_POLICY_MAPPINGS().tb2019-04-221-9/+26
| | | | ok jsing
* Add error checking to i2v_POLICY_CONSTRAINTS().tb2019-04-221-5/+19
| | | | ok jsing
* Add error checking to i2v_EXTENDED_KEY_USAGE().tb2019-04-221-8/+23
| | | | ok jsing
* Add error checking to i2v_ASN1_BIT_STRING().tb2019-04-221-4/+18
| | | | ok jsing
* Add error checking to i2v_BASIC_CONSTRAINTS().tb2019-04-221-3/+18
| | | | ok jsing
* Add error checking to i2v_AUTHORITY_INFO_ACCESS(). While there, replacetb2019-04-221-19/+27
| | | | | | an ugly strlen + malloc + strcat/strcpy dance by a simple asprintf(). ok jsing
* Avoid potential double frees in i2v_AUTHORITY_KEYID(), i2v_GENERAL_NAME()tb2019-04-222-6/+22
| | | | | | | | | | | | | | and i2v_GENERAL_NAMES() by taking ownership of the extlist only if we were passed NULL. Otherwise it remains the caller's responsibility to free it. To do so, we allocate the extlist explicitly instead of using X509V3_add_value()'s implicit allocation feature. Preserve behavior in i2v_AUTHORITY_KEYID() by adding an explicit check that something was pushed onto the stack. The other i2v_* functions will receive a similar treatment in upcoming commits. ok jsing
* Add error checking to i2v_AUTHORITY_KEYID(), i2v_GENERAL_NAME()tb2019-04-212-32/+80
| | | | | | | and i2v_GENERAL_NAMES(). This fixes a couple of leaks and other ugliness. tweaks & ok jsing
* The noop v2i_PKEY_USAGE_PERIOD() has been commented out since becktb2019-04-211-14/+2
| | | | imported OpenSSL 0.9.4 in 1999. It won't ever be used.
* Fix awful whitespace in OBJ_bsearch_ext()tb2019-04-211-5/+6
|
* KNF: use proper wrapping of function return type and nametb2019-04-213-9/+9
|
* fix some style nits to reduce noise in an upcoming difftb2019-04-211-9/+8
|
* Rewrite & fix X509V3_add_value()tb2019-04-161-17/+24
| | | | | | | | | | | | | | X509V3_add_value() helpfully allocates a STACK_OF(CONF_VALUE) if it receives a pointer to a NULL pointer. If anything fails along the way, it is however the caller's responsibility to free it. This can easily be fixed by freeing *extlist in the error path and zeroing it to avoid a double free if there happens to be a caller out there that avoids the leak. Polish a few things so the function conforms a bit better to our usual style. tweak & ok jsing
* indent err: labelstb2019-04-161-7/+7
|
* wrap an overlong line and kill a space before a tabtb2019-04-161-3/+4
|
* Move function types to their own lines; rewrap.tb2019-04-161-30/+40
|
* Fix previous: I forgot to rename the bn_to_string() prototype.tb2019-04-141-2/+2
|
* Avoid quadratic behavior of decimal BIGNUM conversiontb2019-04-131-9/+36
| | | | | | | | | | | | | | | | | | | The complexity of BN_bn2dec(bn) is quadratic in the length of bn. This function is used for printing numbers in CRLs which are typically small. If a BN is larger than 127 bits, dump it as hex because that's cheap and for numbers this size not significantly harder for humans to parse. OpenSSL commit 10a3195fcf7d04ba519651cf12e945a8fe470a3c by David Benjamin (still under the old licence), but significantly simplified. Ideally, we would catch excessively large numbers on deserialization, but that is made trickier by the templated ASN1. Erroring out is also not an option since the relevant part of the x509v3/ directory doesn't like to do proper error checking (looking at you v2i and i2v). Timeout found by oss-fuzz, should fix issues #13823 and #14130. input & ok jsing
* Fix a number of ASN1_INTEGER vs ASN1_STRING mixups coming from thetb2019-03-131-2/+2
| | | | | | | | | | | mechanical M_ASN1 macro expansion. The ASN1_INTEGER_cmp function takes signs into account while ASN1_STRING_cmp doesn't. The mixups mostly involve serialNumbers, which, in principle, should be positive. However, it is unclear whether that is checked or enforced anywhere in the code, so these are probably bugs. Patch from Holger Mikolon ok jsing
* Add a const qualifier to the aint argument of X509V3_add_value_int()tb2018-05-192-4/+4
| | | | | Tested in a bulk build by sthen ok jsing
* Add a const qualifier to the STACK_OF(X509_EXTENSION) * arguments oftb2018-05-193-8/+10
| | | | | | | | X509V3_get_d2i() and X509V3_extensions_print(), and one to the 'title' argument of the latter function. tested in a bulk build by sthen ok jsing
* Add a const qualifier to the 'key' argument of i2o_ECPublicKey() andtb2018-05-195-18/+22
| | | | | | | | | one to the last argument of each one of i2s_ASN1_OCTET_STRING(), s2i_ASN1_OCTET_STRING(), i2s_ASN1_INTEGER(), i2s_ASN1_ENUMERATED(), and i2s_ASN1_ENUMERATED_TABLE(). tested in a bulk build by sthen ok jsing
* The 'name', 'value' and 'section' arguments for a2i_GENERAL_NAME(),tb2018-05-184-28/+24
| | | | | | | | | | | X509V3_get_value_bool(), X509V3_add_value_bool_nf(), X509V3_get_value_int(), X509V3_get_string(), X509V3_get_section() are now const. While there, remove a stupid cast and two redundant checks. tested in a bulk build by sthen ok jsing
* Add const qualifiers to the 'name', 'sname' and 'X509_PURPOSE *'tb2018-05-182-15/+15
| | | | | | | | | arguments of X509_PURPOSE_add(3), X509_PURPOSE_get0_name(3), X509_PURPOSE_get0_sname(3), X509_PURPOSE_get_by_sname(3), X509_PURPOSE_get_id(3), X509_PURPOSE_get_trust(3). tested in a bulk build by sthen ok jsing
* Add const to the 'name', 'value', and 'section' arguments oftb2018-05-132-48/+61
| | | | | | | | | X509V3_EXT_{,n}conf_nid(3), X509_EXT_{,n}conf(3) X509V3{,_CRL,_REQ}_add_{,n}conf(3) as well as the get_string() and get_section() members of X509_CONF_METHOD_st. tested in a bulk build by sthen ok jsing
* Add const qualifiers to the char *zone and char *user arguments oftb2018-05-132-8/+13
| | | | | | | SXNET_add_id_INTEGER(3), SXNET_add_id_asc(3), SXNET_add_id_ulong(3) tested in a bulk by sthen ok jsing
* Add const to functions in asn1/asn1.h as they did in OpenSSL.tb2018-04-253-7/+7
| | | | | | | BIO_f_asn1() will be taken care of later. Tested in a bulk by sthen ok bcook jca jsing
* If X509_check_{host,email}() are called with a length of zero, use strlen()jsing2018-03-201-3/+7
| | | | | | | | | to determine the length. This is the documented behaviour and matches the OpenSSL implementation. Issue found by Michael Gmelin <freebsd at grem dot de>. ok tb@
* Allow leading . in nameConstraints. from openssl via jabberwock. ok jsingtedu2017-07-201-2/+2
|
* Distinguish between self-issued certificates and self-signed certificates.jsing2017-06-222-30/+40
| | | | | | | | | | | | | | The certificate verification code has special cases for self-signed certificates and without this change, self-issued certificates (which it seems are common place with openvpn/easyrsa) were also being included in this category. Based on BoringSSL. Thanks to Dale Ghent <daleg at elemental dot org> for assisting in identifying the issue and testing this fix. ok inoguchi@
* the XXXfree functions being called accept NULL, so don't check first.deraadt2017-05-023-26/+14
| | | | ok beck
* Send the function codes from the error functions to the bit bucket,beck2017-01-2920-256/+167
| | | | | | as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@
* Expand DECLARE_OBJ_BSEARCH_CMP_FN and IMPLEMENT_OBJ_BSEARCH_CMP_FN macros.jsing2017-01-212-8/+38
| | | | No change to generated assembly excluding line numbers.
* Expand ASN1_ITEM_rptr macros - no change in preprocessor output.jsing2016-12-301-3/+3
|
* Expand ASN1_ITEM_ref and ASN1_ITEM_ptr macros - no change in generatedjsing2016-12-3022-66/+66
| | | | | | | | assembly. Of particular interest is ASN1_ITEM_ptr which does nothing and resulted in code like: if (method->it) ASN1_ITEM_free(..., ASN1_ITEM_ptr(method->it));
* Remove all DECLARE_ASN1_SET_OF macro usage - since 2000 these have beenjsing2016-12-271-7/+1
| | | | | nothing but markers for utils/mkstack.pl... and we removed the code that generated more macros from these markers in 2014.
* Expand DECLARE_ASN1_ITEM macros - no change in preprocessor output.jsing2016-12-271-6/+6
|
* Explicitly export a list of symbols from libcrypto.jsing2016-12-212-2/+9
| | | | | | | | | | | | | | | | Move the "internal" BN functions from bn.h to bn_lcl.h and stop exporting the bn_* symbols. These are documented as only being intended for internal use, so why they were placed in a public header is beyond me... This hides 363 previously exported symbols, most of which exist in headers that are not installed and were never intended to be public. This also removes a few crusty old things that should have died long ago (like _ossl_old_des_read_pw). But don't worry... there are still 3451 symbols exported from the library. With input and testing from inoguchi@. ok beck@ inoguchi@
* Stricter checks of ASN1_INTEGER to reject ASN1_NEG_INTEGER in places whenmiod2016-11-081-3/+9
| | | | | | they don't make sense. ok beck@
* Check BIO_new*() for failure.miod2016-11-051-2/+4
| | | | ok beck@ jsing@
* Expand DECLARE_ASN1_.*FUNCTIONS macros.jsing2016-09-041-32/+128
| | | | No change in preprocessed output, ignoring whitespace and line numbers.
* Bring in functions used by stunnel and exim from BoringSSL - this bringsbeck2016-09-032-2/+452
| | | | | | in X509_check_host, X509_check_email, X509_check_ip, and X509_check_ip_asc, with some cleanup on the way in by myself and jsing@ ok bcook@
* X509_free(3) is NULL-safe, so remove NULL checks before its calls.mmcc2016-03-111-3/+2
| | | | ok doug@
* initialize ext_len to 0.beck2015-12-141-2/+6
| | | | ok guenther@
* Replace M_ASN1_OCTET_STRING_(free|new) with ASN1_OCTET_STRING_(free|new).jsing2015-09-304-16/+16
|
* Replace M_ASN1_IA5STRING_(new|free) with ASN1_IA5STRING_(new|free). Samejsing2015-09-303-9/+9
| | | | with one s/M_ASN1_VISIBLESTRING_new/ASN1_VISIBLESTRING_new/.
* Replace M_ASN1_INTEGER_(new|free) with ASN1_INTEGER_(new|free) - this isjsing2015-09-302-10/+10
| | | | | | | different from the macro expansion, but the result is the same. Also replace some ASN1_STRING_dup() with ASN1_INTEGER_dup(). ok beck@ doug@
* Replace remaining M_ASN1_BIT_STRING_(new|free) macros with calls tojsing2015-09-291-4/+4
| | | | | | ASN1_BIT_STRING_(new|free). ok beck@ doug@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 01:01:12 +0000