summaryrefslogtreecommitdiff
path: root/src/lib/libtls/tls_verify.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Rework tls_check_subject_altname() error handlingtb2023-06-011-12/+13
| | | | | | | Default to having rv = -1 and explicitly goto done to set rv = 0. This matches other code better. ok jsing
* Check for X509_get_ext_d2i() failuretb2023-06-011-4/+10
| | | | | | | | | | X509_get_ext_d2i() (or rather X509V3_get_d2i()) can return NULL for various reasons. If it fails because the extension wasn't found, it sets *crit = -1. In any other case, e.g., the cert is bad or we ran out of memory in X509V3_EXT_d2i(), crit is set to something else, so we should actually error. ok jsing
* Correctly catch all return values from X509_NAME_get_index_by_NIDbeck2023-05-291-6/+11
| | | | | | And some comment requests, from jsing@ ok jsing@
* correct comment, spotted by tb@beck2023-05-281-4/+4
|
* Refactor tls_check_common_name to use lower level API.beck2023-05-281-12/+47
| | | | | | | | | | | | | | | | | | | | X509_NAME_get_text_by_NID is kind of a bad interface that we wish to make safer, and does not give us the visibility we really want here to detect hostile things. Instead call the lower level functions to do some better checking that should be done by X509_NAME_get_text_by_NID, but is not in the OpenSSL version. Specifically we will treat the input as hostile and fail if: 1) The certificate contains more than one CN in the subject. 2) The CN does not decode as UTF-8 3) The CN is of invalid length (must be between 1 and 64 bytes) 4) The CN contains a 0 byte 4) matches the existing logic, 1 and 2, and 3 are new checks. ok tb@
* tls_verify.c: give up on variable alignment in this filetb2023-05-111-6/+6
| | | | | | The previous commit resulted in misalignment, which impacts my OCD worse than no alignment at all. Alignment wasn't consistently done in this file anyway. op tells me it won't affect current efforts in reducing the diff.
* switch two ASN1_STRING_data() to ASN1_STRING_get0_data()op2023-05-101-5/+5
| | | | | | | | | and while here mark as const data. This diff is actually from gilles@, in OpenSMTPD-portable bundled libtls. ok tb@, jsing@
* Fix error handling in tls_check_common_name()tb2023-05-051-6/+10
| | | | | | | | A calloc failure should be a fatal error, so make it return -1. Also switch the default rv to -1 and distinguish error cases with acceptable situations with goto err/goto done. ok jsing
* Be consistent with the goto label names used in libtls code.jsing2018-02-051-7/+7
| | | | No change to generated assembly.
* Rework name verification code so that a match is indicated via an argument,jsing2017-04-101-33/+51
| | | | | | | | | | rather than return codes. More strictly follow RFC 6125, in particular only check the CN if there are no SAN identifiers present in the certificate (per section 6.4.4). Previous behaviour questioned by Daniel Stenberg <daniel at haxx dot se>. ok beck@ jca@
* Avoid signed vs unsigned comparisons.jsing2016-11-041-3/+4
| | | | ok miod@
* Add callback-based interface to libtls.bcook2016-09-041-1/+2
| | | | | | | This allows working with buffers and callback functions instead of directly on sockets or file descriptors. Original patch from Tobias Pape <tobias_at_netshed.de>. ok beck@
* Revert previous since it adds new symbols.jsing2016-08-021-2/+1
| | | | Requested by deraadt@
* Instead of declaring a union in multiple places, move it to tls_internal.h.jsing2015-09-291-9/+3
| | | | ok deraadt@
* clean some ugly intendation wartsderaadt2015-09-291-3/+9
|
* Do not match a wildcard against a name with no host part.beck2015-09-111-1/+4
| | | | ok jsing@
* add tls_peer functions for checking names and issuers of peer certificates.beck2015-09-111-4/+4
| | | | ok jsing@
* Indent labels with a space so that diff -p is more friendly.jsing2015-09-091-2/+2
| | | | Requested by bluhm@
* Improve libtls error messages.jsing2015-08-271-4/+4
| | | | | | | | | | | | The tls_set_error() function previously stored the errno but did nothing with it. Change tls_set_error() to append the strerror(3) of the stored errno so that we include useful information regarding failures. Provide a tls_set_errorx() function that does not store the errno or include strerror(3) in the error message. Call this function instead of tls_set_error() for errors where the errno value has no useful meaning. With feedback from and ok doug@
* Make functions that are internal to tls verify static.jsing2015-08-271-7/+8
| | | | | | Spotted by Marko Kreen. Rides libtls major bump.
* Reject dNSName of " " for subjectAltName extension.doug2015-04-291-1/+20
| | | | | | RFC 5280 says " " must not be used as a dNSName. ok jsing@ jca@
* Be consistent with naming - only use "host" and "hostname" when referringjsing2015-02-111-32/+32
| | | | | | | | | | to an actual host and use "servername" when referring to the name of the TLS server that we expect to be indentified in the server certificate. Likewise, rename verify_host to verify_name and use the term "name" throughout the verification code (rather than host or hostname). Requested by and ok tedu@
* Add size_t to int checks for SSL functions.doug2014-12-171-5/+13
| | | | | | | | | | libtls accepts size_t for lengths but libssl accepts int. This verifies that the input does not exceed INT_MAX. It also avoids truncating size_t when comparing with int and adds printf-style attributes for tls_set_error(). with input from deraadt@ and tedu@ ok tedu@
* Allow specific libtls hostname validation errors to propagate.bcook2014-12-071-15/+20
| | | | | | | | Remove direct calls to printf from the tls_check_hostname() path. This allows NUL byte error messages to bubble up to the caller, to be logged in a program-appropriate way. It also removes non-portable calls to getprogname(). ok jsing@
* Fix a memory leak in tls_check_subject_altname() by callingjsing2014-12-071-2/+2
| | | | | | | sk_GENERAL_NAME_pop_free() instead of sk_GENERAL_NAME_free(). The latter only frees the stack itself and does not free the items. From Basskrapfen on github.
* revert previous change for now, adjusting based on comments from jsing@bcook2014-12-071-17/+18
|
* Allow specific libtls hostname validation errors to propagate.bcook2014-12-071-18/+17
| | | | | | | | | | | | | Remove direct calls to printf from the tls_check_hostname() path. This allows NUL byte error messages to bubble up to the caller, to be logged in a program-appropriate way. It also removes non-portable calls to getprogname(). The semantics of tls_error() are changed slightly: the last error message is not necessarily preserved between subsequent calls into the library. When the previous call to libtls succeeds, client programs should treat the return value of tls_error() as undefined. ok tedu@
* Rename libressl to libtls to avoid confusion and to make it easier tojsing2014-10-311-0/+225
distinguish between LibreSSL (the project) and libressl (the library). Discussed with many.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-25 20:55:20 +0000