summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* ct.h: move two asterisks to the proper placetb2024-08-081-3/+3
|
* ui_util.c needs stdio.h and ui.h, but not ui_compat.h and ui_local.htb2024-08-081-4/+3
|
* x509_vfy.c: drop some unnecessary parenthesestb2024-08-041-6/+5
|
* The EC_KEY method should use the EC_KEY index, not RSAtb2024-08-031-2/+2
| | | | | | Unbreaks ssh's t-agent-pkcs11-cert regress reported by anton. ok jsing
* Bump CRYPTO_EX_DATA_MAX_INDEX to 32tb2024-08-031-2/+2
| | | | | | | | | rust-openssl tests do something weird and need lots of ex data (one index for each registered callback, for example). This makes the regress pass again. noticed by anton ok jsing
* Use proper size for allocating indexestb2024-08-031-2/+2
| | | | | | | | | It's a double pointer, so we should allocate a pointer size, not the entire struct. This saves roughly 500B per class. CID 507397 ok jsing
* free class->indexes in CRYPTO_cleanup_all_ex_data()tb2024-08-021-1/+2
| | | | ok jsing
* Rewrite CRYPTO_EX_DATA.jsing2024-08-023-639/+419
| | | | | | | | | | | | | | | | | | | | | | | | | CRYPTO_EX_DATA exists as a way to allow an application to attach data to various components in libcrypto and libssl. The general idea is that there are various "classes" (e.g. RSA) and an application can get an "index" (which can have new/dup/free functions provided). The application can then use the index to store a pointer to some form of data within that class, for later retrieval. However, even by OpenSSL standards, this is an insane API. The current implementation allows for data to be set without calling new, indexes can be used without allocation, new can be called without actually getting an index and dup can be called either after new or without new (see regress and RSA_get_ex_new_index(3)/CRYPTO_set_ex_data(3) for more details). On top of this, the previous "overhaul" of the code was written to be infinitely extensible. For now, the rewrite intends to maintain the existing behaviour - once we bed this down we can attempt to ratchet the API requirements and require some sort of sensible sequence. The only intentional change is that there is now a hard limit on the number of indexes that can be allocated (previously there was none, relying only on ENOMEM). ok tb@
* typo: regresss -> regresstb2024-07-291-2/+2
|
* Mark X509at_get_attr{,_count}() and X509at_delete_attr() as unusedtb2024-07-261-4/+4
| | | | ok jsing
* Disable X509at_get_attr{,_count}() and X509at_delete_attr()tb2024-07-261-12/+7
| | | | | | | | | These are (not so) thin wrappers around the stack API and only make things unreadable by adding an unneccesary layer of indirection and repeating checks already present in the stack API. X509at_delete_attr() is a masterpiece. ok jsing
* Inline last user of X509at_get_attr()tb2024-07-261-2/+2
| | | | ok jsing
* Inline trivial X509at_* calls in x509_reqtb2024-07-261-4/+4
| | | | ok jsing
* Inline a few trivial X509at_* calls in cmstb2024-07-261-7/+7
| | | | ok jsing
* Put opening brace on correct linetb2024-07-261-4/+3
|
* BUF_MEM_new.3: add a touch of KNFtb2024-07-241-4/+3
|
* Add back a .tb2024-07-211-2/+2
|
* Unify description of the obsolete ENGINE parametertb2024-07-2114-142/+130
| | | | | | | This uses the same language in most manuals mentioning the obsolete ENGINE parameters. Make it clear that it is always ignored and that NULL should be passed. Always call it engine instead of a mix of e pe, impl, eng.
* Drop ENGINE from EVP_PKEY_derive exampletb2024-07-211-5/+4
|
* Garbage collect ENGINE "use" from EVP_PKEY_decrypt() exampletb2024-07-211-5/+4
|
* Make example slightly less terrible by dropping the ENGINE "handling"tb2024-07-211-5/+4
|
* Switch the EVP_PKEY_*attr* API to LCRYPTO_UNUSED()tb2024-07-151-10/+10
| | | | This would have prevented the PKCS12 oopsie.
* Fix PKCS12_create()tb2024-07-151-6/+21
| | | | | | | | | | This tries to copy some microsoft attributes which are not usually present and chokes on the now disabled EVP_PKEY_*attr* API. Instead of reviving about four layers of traps and indirection, just inline the two functions in a way that should be more obvious. found by anton via the ruby-openssl tests ok jsing
* Rewrite EVP_PKEY_add1_attr_by_NID()tb2024-07-141-11/+41
| | | | | | | Instead of jumping through many layers that cause headache, we can achieve the same in an entirely straightforward way without losing clarity. ok jsing
* Disable most EVP_PKEY_*attr* APItb2024-07-141-14/+17
| | | | | | | | There is a single consumer of this entire family of function, namely the openssl(1) pkcs12 command uses EVP_PKEY_add1_attr_by_NID, so leave that one intact for now. ok jsing
* Remove lhash_local.h.jsing2024-07-144-99/+26
| | | | | | | | | lhash_local.h was previously needed since conf/conf_api.c and objects/obj_dat.c were fiddling with lhash internals when deleting via a callback. Since we no longer need to do that, inline the structs in lhash.c and remove the header. ok tb@
* "please refer" -> "refer"jsg2024-07-141-3/+3
| | | | | missed in 2022 "remove please from manual pages" commit ok tb@
* Unify X.509v3 extension methodstb2024-07-1321-376/+691
| | | | | | | | | | | | Use C99 initializers for all structs (some were forgotten). Make all the structs static, call them x509v3_ext_* matching NID_*. Add accessors called x509v3_ext_method_* and use these to implement X509V3_EXT_get_nid(). This adds consistency and avoids a few contortions like grouping a few extensions in arrays to save a couple externs. ok beck jsing
* Fix the horrible and undocumented behaviour of X509_check_trustbeck2024-07-124-54/+73
| | | | | | | | | | | | | | | | | | | | Of allowing you to pass in a NID directly, instead of a trust_id, and have it work, as long as the trust_id's and the NID's did not overlap. This screwball behaviour was depended upon by the OCSP code that called X509_check_trust with the NID, instead of the trust id, so let's fix that. We also rename the confusingly named X509_TRUST_DEFAULT to X509_TRUST_ACCEPT_ALL which makes a lot more sense, and rototill this to remove the confusingly named static functions. This will shortly be follwed up by making this function private, so we have not bothered to fix the amazingly obtuse man page as it will be taken behind the barn at that time. ok tb@
* Clean up in X509_check_trust.beck2024-07-121-14/+8
| | | | | | | | | | | | | | | The XXX comment in here is now outdated. Our behaviour matches boringssl in that passing in a 0 trust gets the default behavior, which is to trust the certificate only if it has EKU any, or is self signed. Remove the goofy unused nid argument to "trust_compat" and rename it to what it really does, instead of some bizzare abstraction to something simple so the code need not change if we ever change our mind on what "compat" is for X.509, which will probably only happen when we are back to identifying things by something more sensible like recognizable grunts and smells. ok jsing@
* Drop the unused evp includetb2024-07-121-2/+1
|
* Rename the sk in this file to extstb2024-07-121-16/+16
|
* Avoid using ret for an X509_EXTENSIONtb2024-07-121-16/+16
| | | | | | | Instead rename the **ext in this file to **out_ext, freeing up ext in X509_EXTENSION_create_by_OBJ() Appeases some jsing grumbling on review
* Tweak variable names in X509v3_add_ext()tb2024-07-121-12/+12
| | | | | | x -> out_ext, sk -> exts requested by jsing on review
* Rename crit to critical in this filetb2024-07-121-10/+10
| | | | requested by jsing on review
* Simplify X509_EXTENSION_get_critical()tb2024-07-121-4/+3
| | | | | | This is a silly API, but there are worse. ok jsing
* Lose a few extra lines in X509_EXTENSION_set_object()tb2024-07-121-4/+2
| | | | ok jsing
* Streamline X509_EXTENSION_create_by_OBJ()tb2024-07-121-9/+10
| | | | ok jsing
* Clean up X509_EXTENSION_create_by_NID()tb2024-07-121-9/+5
| | | | | | | | Remove unnecessary ret parameter and freeing of obj (which looks like a double free or freeing of unallocated memory but actually isn't due to various magic flags). Also make this const correct. ok jsing
* Rewrite X509v3_add_ext()tb2024-07-121-24/+23
| | | | | | | | | | | | | This is another brilliancy straight out of muppet labs. Overeager and misguided sprinkling of NULL checks, going through the trademark poor code review, made this have semantics not matching what almost every other function with this signature would be doing in OpenSSL land. This is a long standing mistake we can't fix without introducing portability traps, but at least annotate it. Simplify the elaborate dance steps and make this resemble actual code. ok jsing
* Simplify X509v3_get_ext() and X509v3_delete_ext()tb2024-07-121-7/+1
| | | | | | Drop unnecessary checks that are part of the stack API. ok jsing
* Align X509v3_get_ext_by_critical() with X509v3_get_ext_by_OBJ()tb2024-07-121-12/+9
| | | | | | Plus, replace a manual check with a call to X509_EXTENSION_get_critical(). ok jsing
* Clean up X509v3_get_ext_by_OBJ()tb2024-07-121-11/+7
| | | | | | | | Like most of its siblings, this function can be simplified significantly by making proper use of the API that is being built. Drop unnecessary NULL checks and other weirdness and add some const correctness. ok jsing
* Despite being an ELF citizen, hppa is its own special snowflake and requiresmiod2024-07-111-1/+5
| | | | | | | different asm stanzas to produce strong aliases. This unbreaks libcrypto (and thus ssh, among other things) on hppa after the recent switch to LIBRESSL_CRYPTO_NAMESPACE.
* Remove the static symbols.namespace, and just generate the _libre_beck2024-07-102-3359/+3
| | | | | | symbols from symbols.list now that we have everything hidden ok tb@
* forgot to add a history section for the TLS PRF APItb2024-07-101-1/+4
|
* link EVP_PKEY_CTX_set_tls1_prf_md.3 to buildtb2024-07-101-1/+2
|
* Import EVP_PKEY_CTX_set_tls1_prf_md.3 from OpenSSL 1.1.1tb2024-07-101-0/+168
| | | | | With only slight application of color to this entelodont's lips. It's the usual deal - hard to say what's worse, the code or its docs...
* Including kdf.h isn't enough, you also need evp.htb2024-07-101-2/+3
| | | | | It will be a cold day in hell before I see an OpenSSL manpage without mistakes in it.
* Unwrap two linestb2024-07-101-7/+4
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-17 00:32:54 +0000