summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* LibreSSL : Truncated packet could crash via OOB readinoguchi2017-01-312-3/+10
| | | | | | | | This patch is originally from master branch of OpenSSL. - 2198b3a crypto/evp: harden AEAD ciphers. - 8e20499 crypto/evp: harden RC4_MD5 cipher. ok tom@
* Document functions returning standard moduli for DH key exchange.schwarze2017-01-312-1/+136
| | | | jsing@ confirmed that these are public and worth documenting.
* tweak previous;jmc2017-01-303-11/+11
|
* Document BN_set_flags(3) and BN_get_flags(3).schwarze2017-01-306-13/+159
| | | | jsing@ confirmed that these macros are public and worth documenting.
* Seriously warn against calling BN_init(3), BN_MONT_CTX_init(3),schwarze2017-01-293-12/+75
| | | | | | | and BN_RECP_CTX_init(3). They are not only deprecated but so dangerous that they are almost unusable. I found these scary traps while reading the code in order to document BN_set_flags(3). While here, delete ERR_get_error(3) from SEE ALSO.
* Send the function codes from the error functions to the bit bucket,beck2017-01-29273-3888/+2396
| | | | | | as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@
* Hide SSLerr() under #ifndef LIBRESSL_INTERNAL since we shouldn't bebeck2017-01-261-2/+4
| | | | | using it anymore ok jsing@
* Document ERR_load_BN_strings(3).schwarze2017-01-261-11/+47
| | | | | | | | | | | | | | | | | jsing@ confirmed that this function is public and worth documenting. This page needs much more work, it is outrageously incomplete and unclear. For example, it remains unexplained what error strings are, what "registering" means and what the benefit for the application is, what happens if it is not done, or what happens if an error occurs after calling ERR_free_strings(3). I tried to read the code, but it is so contorted that i postponed that work. For example, it looks like there are hooks for applications to replace the functions used for registering strings by other, application-supplied functions, and, of course, there are many levels of macro and function wrappers. For now, i only documented the most obvious BUGS.
* document BN_asc2bn(3);schwarze2017-01-251-3/+27
| | | | jsing@ confirmed that it is a public function worth documenting
* Construct a BN_gcd_nonct, based on BN_mod_inverse_no_branch, as suggestedbeck2017-01-256-10/+170
| | | | | | | | | | | by Alejandro Cabrera <aldaya@gmail.com> to avoid the possibility of a sidechannel timing attack during RSA private key generation. Modify BN_gcd to become not visible under LIBRESSL_INTERNAL and force the use of the _ct or _nonct versions of the function only within the library. ok jsing@
* use BN_div_nonct where it is safe to do so.beck2017-01-211-2/+2
| | | | ok guenther@
* Add ct and nonct versions of BN_mod_inverse for internal usebeck2017-01-2113-36/+67
| | | | ok jsing@
* Split out BN_div and BN_mod into ct and nonct versions for Internal use.beck2017-01-2117-58/+92
| | | | ok jsing@
* Make explicit _ct and _nonct versions of bn_mod_exp funcitons thatbeck2017-01-2114-39/+106
| | | | | | | | | | | | matter for constant time, and make the public interface only used external to the library. This moves us to a model where the important things are constant time versions unless you ask for them not to be, rather than the opposite. I'll continue with this method by method. Add regress tests for same. ok jsing@
* Place {DECLARE,IMPLEMENT}_OBJ_BSEARCH{_GLOBAL,}_CMP_FN macros undefjsing2017-01-211-1/+5
| | | | LIBRESSL_INTERNAL.
* Expand DECLARE_OBJ_BSEARCH_CMP_FN and IMPLEMENT_OBJ_BSEARCH_CMP_FN macros.jsing2017-01-216-28/+168
| | | | No change to generated assembly excluding line numbers.
* /usr/bin/unifdef -D MONT_MUL_MOD -D MONT_EXP_WORD -D RECP_MUL_MOD -m bn_exp.cbeck2017-01-211-23/+2
| | | | | with some style cleanup after. no binary change ok jsing@
* Expand DECLARE_OBJ_BSEARCH_CMP_FN and IMPLEMENT_OBJ_BSEARCH_CMP_FN macros.jsing2017-01-212-8/+38
| | | | No change to generated assembly excluding line numbers.
* fix bogus commentbeck2017-01-211-2/+2
| | | | ok jsing@
* Make return value of X509_verify_cert be consistent with the error code,beck2017-01-211-2/+10
| | | | | | with the caveat that we force V_OK when a user provided callback has us returning success. ok inoguchi@ jsing@
* Rework internal_verify, mostly from OpenSSL. so we can progressbeck2017-01-201-102/+102
| | | | | towards cleaning up the V_OK stuff. ok kinichiro@
* change two trailing Xr to Fn; ok schwarzejmc2017-01-122-6/+6
|
* Add support for AArch64.patrick2017-01-112-0/+182
|
* add missing comma in the NAME sectionschwarze2017-01-071-3/+3
|
* fix a typo in an .Xr reported by jmc@schwarze2017-01-071-3/+3
|
* Add and remove some blank lines, in order to make X509_verify_cert()jsing2017-01-071-6/+4
| | | | (slightly) more readable.
* a little more cleanup;jmc2017-01-075-23/+23
|
* Revert part of r1.54 as there are at least two situations where we are stilljsing2017-01-071-4/+2
| | | | | | | returning ok == 1, with ctx->error not being X509_V_OK. Hopefully we can restore this behaviour once these are ironed out. Discussed with beck@
* correctly mark all documented macros found in <openssl/bn.h>schwarze2017-01-073-9/+11
|
* Use .Fn rather than .Xr for X509_VERIFY_PARAM_lookup(),schwarze2017-01-071-3/+3
| | | | | | | | fixing a dead link reported by jmc@. Only about half of X509_VERIFY_PARAM is documented so far, and the extensible lookup table feels like one of the more arcane features and probably not the next thing to document.
* Document X509_NAME_hash(3), listed in <openssl/x509.h>;schwarze2017-01-071-3/+20
| | | | | | | jmc@ reported that X509_LOOKUP_hash_dir(3) references it. Even though OpenSSL does not document it, given that it is used for file names that users have to create, it is sufficiently exposed to users to be worth documenting.
* Write a new manual page X509_STORE_load_locations(3) from scratch.schwarze2017-01-072-1/+119
| | | | | | | | | | | Not documented by OpenSSL, but listed in <openssl/x509_vfy.h> and referenced from X509_LOOKUP_hash_dir(3), and clearly more important than the latter. Fixes three dead links reported by jmc@. Most of the information from SSL_CTX_load_verify_locations(3) should probably be moved here, but not all, since the SSL page also talks about SSL servers and clients and the like. As i'm not completely sure regarding the boundaries, i'm leaving that as it is for now.
* Remove cross references to the undocumented functions X509_STORE_new(3)schwarze2017-01-062-7/+4
| | | | | | | and X509_STORE_add_lookup(3) reported by jmc@. Even though these functions are public, they seem more useful internally than for application programs, so now is not the time to document them.
* Delete a sentence containing a cross reference to an undocumentedschwarze2017-01-061-6/+2
| | | | | | | function that had the the sole purpose of discouraging its use. Not talking about it at all discourages using it even more. Dangling cross reference reported by jmc@.
* resolve duplication of names and prototypes in manuals related to ex_dataschwarze2017-01-065-67/+23
| | | | and sprinkle cross references instead; more work is obviously needed here
* Replace two dangling .Xrs to sk_*() macros with .Fn; reported by jmc@.schwarze2017-01-061-4/+6
| | | | | | The safestack stuff is the most ill-designed user interface i have seen so far in OpenSSL. It looks positively undocumentable. At least i'm not trying to document it right now.
* Delete a cross reference to the undocumented function X509_check_purpose(3)schwarze2017-01-061-3/+2
| | | | | | | | | that wasn't accompanied by any related information. Reported by jmc@. There are a dozen functions handling X509_PURPOSE objects, all undocumented, a host of defines, and it seems that a callback is required. So this seems complicated, i doubt that is much used in practice, and i'm not diving into it at this point in time.
* Remove bogus cross reference to ui_create(3) reported by jmc@schwarze2017-01-061-6/+8
| | | | | | | | | and refer readers to the header file instead. I'm not convinced customized prompting is such a bright idea, it feels somewhat like overengineering, so i'm not documenting it right now. People who really feel compelled to roll their own prompting can go read the source code.
* Remove dangling .Xrs to PKCS7_final(3) reported by jmc@schwarze2017-01-062-6/+5
| | | | | | | | | and just use .Fn for now. Not counting constructors, destructors, decoders, encoders, and debuggers, six out of 24 public functions operating on PKCS7 objects are currently documented. I'm not documenting the remaining 18 ones at this point in time.
* Remove a dangling .Xr to PKCS7_SIGNER_INFO_sign(3) reported by jmc@schwarze2017-01-061-3/+3
| | | | | | | | | and just use .Fn for now. There are about two dozen interfaces dealing with PKCS7_SIGNER_INFO objects and none but the constructor, destructor, decoder, and encoder are documented so far. It makes no sense to document one random one, and i'm not going to document all of PKCS7_SIGNER_INFO right now.
* Remove a dangling cross reference reported by jmc@.schwarze2017-01-061-5/+8
| | | | | | I'm not convinced documenting EVP_MD_CTX_set_flags(3) would be wise. Instead, refer people to the header file to make it more obvious that they are tinkering with internals when using such flags.
* Add EVP_read_pw_string(3) to NAME and SYNOPSIS,schwarze2017-01-061-14/+29
| | | | | | | | | resolving a dangling cross reference reported by jmc@. Sort NAME and SYNOPSIS to agree with .Dt and DESCRIPTION. Unify parameter names. Delete a sentence about an implementation detail that is no longer true. Mention the length limitation of the *_string() variants.
* Delete a cross reference to the non-existent manual page BIO_set_flags(3),schwarze2017-01-061-11/+8
| | | | | | | | | | | | | reported by jmc@. Documenting that function would be a bad idea. All other flags are used internally and should better not be tampered with. It looks like an internal function that was made public by mistake, then abused for an unrelated user interface purpose: a classic case of botched user interface design. Instead, only show how to use this function for this one specific purpose. While here, delete a sentence from the DESCRIPTION that merely duplicated content from the BUGS section.
* Delete a sentence that attempted to explain an implementation detailschwarze2017-01-061-4/+2
| | | | | by referencing a non-existent manual page. Broken .Xr reported by jmc@.
* fix typos in cross references reported by jmc@schwarze2017-01-062-6/+6
|
* Delete bogus cross reference reported by jmc@.schwarze2017-01-061-5/+6
| | | | | Documenting these trivial PKCS7_type_is_*() macros does not seem useful, at least not right now.
* delete bogus cross references reported by jmc@schwarze2017-01-061-11/+7
| | | | and add some missing escaping of backslashes while here
* tweak previous;jmc2017-01-061-11/+13
|
* Also document the weird d2i_ASN1_UINTEGER(3), listed in <openssl/asn1.h>schwarze2017-01-051-1/+16
| | | | and in OpenSSL doc/man3/d2i_X509.pod (with wrong prototype).
* Write new d2i_ASN1_OCTET_STRING(3) manual page from scratch.schwarze2017-01-053-2/+373
| | | | | | All 36 functions listed in <openssl/asn1.h> and in OpenSSL doc/man3/d2i_X509.pod, six of them with wrong prototypes.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-22 12:26:41 +0000