summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove bogus cross reference to ui_create(3) reported by jmc@schwarze2017-01-061-6/+8
| | | | | | | | | and refer readers to the header file instead. I'm not convinced customized prompting is such a bright idea, it feels somewhat like overengineering, so i'm not documenting it right now. People who really feel compelled to roll their own prompting can go read the source code.
* Remove dangling .Xrs to PKCS7_final(3) reported by jmc@schwarze2017-01-062-6/+5
| | | | | | | | | and just use .Fn for now. Not counting constructors, destructors, decoders, encoders, and debuggers, six out of 24 public functions operating on PKCS7 objects are currently documented. I'm not documenting the remaining 18 ones at this point in time.
* Remove a dangling .Xr to PKCS7_SIGNER_INFO_sign(3) reported by jmc@schwarze2017-01-061-3/+3
| | | | | | | | | and just use .Fn for now. There are about two dozen interfaces dealing with PKCS7_SIGNER_INFO objects and none but the constructor, destructor, decoder, and encoder are documented so far. It makes no sense to document one random one, and i'm not going to document all of PKCS7_SIGNER_INFO right now.
* Remove a dangling cross reference reported by jmc@.schwarze2017-01-061-5/+8
| | | | | | I'm not convinced documenting EVP_MD_CTX_set_flags(3) would be wise. Instead, refer people to the header file to make it more obvious that they are tinkering with internals when using such flags.
* Add EVP_read_pw_string(3) to NAME and SYNOPSIS,schwarze2017-01-061-14/+29
| | | | | | | | | resolving a dangling cross reference reported by jmc@. Sort NAME and SYNOPSIS to agree with .Dt and DESCRIPTION. Unify parameter names. Delete a sentence about an implementation detail that is no longer true. Mention the length limitation of the *_string() variants.
* Delete a cross reference to the non-existent manual page BIO_set_flags(3),schwarze2017-01-061-11/+8
| | | | | | | | | | | | | reported by jmc@. Documenting that function would be a bad idea. All other flags are used internally and should better not be tampered with. It looks like an internal function that was made public by mistake, then abused for an unrelated user interface purpose: a classic case of botched user interface design. Instead, only show how to use this function for this one specific purpose. While here, delete a sentence from the DESCRIPTION that merely duplicated content from the BUGS section.
* Delete a sentence that attempted to explain an implementation detailschwarze2017-01-061-4/+2
| | | | | by referencing a non-existent manual page. Broken .Xr reported by jmc@.
* fix typos in cross references reported by jmc@schwarze2017-01-062-6/+6
|
* Delete bogus cross reference reported by jmc@.schwarze2017-01-061-5/+6
| | | | | Documenting these trivial PKCS7_type_is_*() macros does not seem useful, at least not right now.
* delete bogus cross references reported by jmc@schwarze2017-01-061-11/+7
| | | | and add some missing escaping of backslashes while here
* tweak previous;jmc2017-01-061-11/+13
|
* Also document the weird d2i_ASN1_UINTEGER(3), listed in <openssl/asn1.h>schwarze2017-01-051-1/+16
| | | | and in OpenSSL doc/man3/d2i_X509.pod (with wrong prototype).
* Write new d2i_ASN1_OCTET_STRING(3) manual page from scratch.schwarze2017-01-053-2/+373
| | | | | | All 36 functions listed in <openssl/asn1.h> and in OpenSSL doc/man3/d2i_X509.pod, six of them with wrong prototypes.
* Avoid a side-channel cache-timing attack that can leak the ECDSA privatejsing2017-01-051-1/+3
| | | | | | | | | keys when signing. This is due to BN_mod_inverse() being used without the constant time flag being set. This issue was reported by Cesar Pereida Garcia and Billy Brumley (Tampere University of Technology). The fix was developed by Cesar Pereida Garcia.
* minor tweaks;jmc2017-01-052-5/+5
|
* Complete rewrite, documenting 16 additional constructor/destructor pairs.schwarze2017-01-051-98/+189
| | | | | | | | | | | | While OpenSSL does not document them, they are public in <openssl/asn1.h>, and OpenSSL does document the related decoders and encoders. It makes no sense to me to document object methods without documenting the public constructors as well. While here: Bugfix: The type assigned by ASN1_STRING_new() was wrong. Remove implementation details. Add small amounts of useful auxiliary information.
* Convert ARM assembly to unified syntax. Clang demands it, binutilspatrick2017-01-041-4/+5
| | | | | | supports it as long as it's marked as unified syntax. ok bcook@ kettenis@
* Write new d2i_ASN1_SEQUENCE_ANY(3) manual page from scratch.schwarze2017-01-042-1/+87
| | | | | | | | All four functions are listed in <openssl/asn1.h> and in OpenSSL doc/man3/d2i_X509.pod. Note that in the OpenSSL documentation, three of the four prototypes are incorrect.
* Remove superfluous datatype that is 32 by default. Clang complainspatrick2017-01-041-1/+1
| | | | | | | about it and it's ok to remove it. This only came up as our clang is targeted at armv7 which enables the NEON instructions. ok kettenis@
* Remove unnecessary casts of 'a' to char * since 'a' is already char *.millert2017-01-041-10/+10
| | | | | This is a remnant from the original 4.4BSD code that had 'a' as void * in the function args. No binary change. OK bluhm@
* Complete rewrite:schwarze2017-01-041-58/+72
| | | | | | | | | | | | | | | | Better one-line description. Specify the correct header file. Same parameter names as in ASN1_item_d2i(3). Lots of new information. The ASN1_OBJECT interfaces appear specifically designed to maximize the number and subtlety of traps, maybe in order to trap the wary along with the unwary. All the quirks, caveats, and bugs of ASN1_item_d2i(3) apply, and there are three additional ones on top in this page. It looks like that design approach was so successful that the designers managed to trap even themselves: see the new BUGS section.
* Describe what ASN1_OBJECT_new(3), ASN1_OBJECT_free(3), OBJ_dup(3),schwarze2017-01-042-34/+105
| | | | | | | | | | and OBJ_create(3) really do rather than making broad and incomplete statements that are only true in some cases. Improve the one-line descriptions. Some minor wording improvements while here. There is obviously more work to do in the vicinity...
* Document d2i_ASN1_TYPE(3) and i2d_ASN1_TYPE(3),schwarze2017-01-031-9/+46
| | | | | both listed in <openssl/asn1.h> and in OpenSSL doc/man3/d2i_X509.pod. Minor wording improvements while here.
* Document ASN1_TYPE_new(3) and ASN1_TYPE_free(3), even though OpenSSLschwarze2017-01-032-34/+106
| | | | | | | | | | | does not document them. By being in <openssl/asn1.h>, they are public, and it makes no sense to document accessors but not document constructors and destructors. Improve the one-line description. Mention various missing details. Many wording improvements. Add some cross references.
* If certificate verification has been disabled, do not attempt to load ajsing2017-01-031-5/+9
| | | | | | | CA chain or specify CA paths. This prevents attempts to access the file system, which may fail due to pledge. ok bluhm@
* Revert previous - the original code was correct since X509_verify_cert()jsing2017-01-031-5/+5
| | | | | | | | | | | should not have changed the X509_STORE_CTX error value on success and it was initialised to X509_V_OK by X509_STORE_CTX_init(). Other software also depends on this behaviour. Previously X509_verify_cert() was mishandling the X509_STORE_CTX error value when validating alternate chains. This has been fixed and further changes now explicitly ensure that the error value will be set to X509_V_OK if X509_verify_cert() returns success.
* Pull out, rework and dedup the code that determines the highest sharedjsing2017-01-034-79/+62
| | | | | | version. ok beck@ doug@
* It takes a special style of creative writing to be unspecific about the errorbeck2017-01-031-15/+5
| | | | | | return code of a function in a man page. Let's remove the ambiguity and half truths in here. ok jsing@
* Add a small bit of belt and suspenders around ERR_V_OK with X509_STORE_ctxbeck2017-01-031-2/+20
| | | | | | | and X509_verify_cert - We at least make it so an an init'ed ctx is not "valid" until X509_verify_cert has actually been called, And we make it impossible to return success without having the error set to ERR_V_OK. ok jsing@
* bring in boring's internal check_trust function to fix a bug introducedbeck2017-01-031-24/+79
| | | | | | when we went to alternate cert chains. this correctly does not clobber the ctx->error when using an alt chain. ok jsing@
* fix cert verify. a cert with an alt chain may verify but leave an errortedu2017-01-021-5/+5
| | | | | | in the context. don't look for errors in case of success. fixes spurious verify errors. guilty change tracked and fix tested by sthen
* Various work on cert.pem, ok bcook@sthen2017-01-011-969/+869
| | | | | | | | | | | | | | - print/sort using the full certificate subject rather than a pretty-printed subset (as done in the current version of format-pem.pl); previously this was resulting in a problem where a CN conflict resulted in the GlobalSign R2 CA accidentally getting dropped in r1.10; problem found by Steven McDonald - remove CA certificates that are no longer present in the CA store of the release branch of Mozilla - possible now that libressl has support for alternate chains (libcrypto/x509/x509_vfy.c r1.52) - add new CA certificates from Mozilla's store from those organisations which we already list
* Add support for SSL_get_server_tmp_key().jsing2016-12-302-3/+74
| | | | ok doug@
* Pull out (and largely rewrite) the code that determines the enabledjsing2016-12-303-40/+54
| | | | | | | | | | protocol version range. This also fixes a bug whereby if all protocols were disabled, the client would still use TLSv1.2 in the client hello, only to have if fail with unsupported version when it received and processed the server hello. ok doug@
* Place ASN_ITEM_{ptr,rptr,ref} and DECLARE_ASN1_ITEM under #ifndefjsing2016-12-301-2/+4
| | | | LIBRESSL_INTERNAL.
* Expand ASN1_ITEM_rptr macros - no change in preprocessor output.jsing2016-12-302-9/+9
|
* Expand ASN1_ITEM_rptr and ASN1_ITEM_ptr macros - no change in generatedjsing2016-12-309-33/+33
| | | | assembly.
* Expand ASN1_ITEM_ref and ASN1_ITEM_ptr macros - no change in generatedjsing2016-12-3022-66/+66
| | | | | | | | assembly. Of particular interest is ASN1_ITEM_ptr which does nothing and resulted in code like: if (method->it) ASN1_ITEM_free(..., ASN1_ITEM_ptr(method->it));
* Expand ASN1_ITEM_rptr macros - no change in generated assembly.jsing2016-12-302-6/+6
|
* Expand ASN1_ITEM_rptr macros - no change in generated assembly.jsing2016-12-3010-37/+37
|
* Expand ASN1_ITEM_rptr macro - no change in generated assembly.jsing2016-12-302-4/+4
|
* Expand ASN1_ITEM_rptr macros - no change in generated assembly.jsing2016-12-302-55/+55
|
* Remove now unused c2l, c2ln, l2c, n2l, l2cn and n2l3 macros.jsing2016-12-302-53/+2
|
* Explicitly include openssl/opensslconf.h in headers that use OPENSSL_NO_*jsing2016-12-302-2/+4
| | | | defines - do not rely on another heading making those available for us.
* Place M_PKCS12_* compatibility macros under #ifndef LIBRESSL_INTERNAL.jsing2016-12-301-1/+5
|
* Expand M_PKCS12_* "compatibility" macros. No change to generated assembly.jsing2016-12-303-10/+10
|
* Write d2i_ASN1_NULL(3) manual page from scratch.schwarze2016-12-292-1/+86
| | | | | | | | | | | Both functions are listed in <openssl/asn1.h> and in OpenSSL doc/man3/d2i_X509.pod. After reading the code, i'm not amused. You wouldn't think that it might take eight stack levels to decode a constant sixteen bit value that does not even allow a single content octet, or would you? Nota bene, this is an average of four stack levels for each non-zero bit decoded... :-(
* fix typo; from OpenSSLschwarze2016-12-291-4/+4
| | | | | | commit 67adf0a7c273a82901ce8705ae8d71ee2f1c959c Author: Markus Triska <triska@metalevel.at> Date: Sun Dec 25 19:58:38 2016 +0100
* Write documentation for <openssl/x509v3.h> DER decoding andschwarze2016-12-289-8/+861
| | | | | encoding functions from scratch. All 46 functions are listed in OpenSSL doc/man3/d2i_X509.pod.
* add missing .Vt macrosschwarze2016-12-282-8/+15
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-03 17:09:57 +0000