summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* sync with OpenSSL 1.1.1, which is still under a free license;schwarze2021-08-301-15/+107
| | | | | | | in particular, this includes new text by Matt Caswell from OpenSSL commit 721eb8f6 Nov 28 12:03:00 2019 +0000 and corrects a wrong argument type that i introduced into the SYNOPSIS; requested by tb@
* Ignore warning alert returns from servername callback in TLSv1.3tb2021-08-301-3/+7
| | | | | | | | | | | | | | | | If a servername callback returns SSL_TLSEXT_ERR_ALERT_WARNING, this results in a fatal error in TLSv1.3 since alert levels are implicit in the alert type and neither close_notify nor user_canceled make sense in this context. OpenSSL chose to ignore this, so we need to follow suit. Found via a broken servername callback in p5-IO-Socket-SSL which returns a Boolean instead of SSL_TLSEXT_ERR_*. This happened to have worked before TLSv1.3 since warning alerts are often ignored. This "fixes" sni.t and sni-verify.t in p5-IO-Socket-SSL. ok beck jsing
* Revert previous change that changed our default return for unable tobeck2021-08-301-11/+5
| | | | | | | | find leaf cert issuers. This breaks perl and ruby regress, as noticed by tb that "we tried this before". Jan's regress that cares about 21 vs 20 needs to change ok tb@
* Fix Jan's regress in openssl/x509 to do what it says it does,beck2021-08-301-5/+11
| | | | | | | | then fix the only thing it still has complaints about which is that we don't return the leaf version of the error code when we can't verify the leaf (as opposed to the rest of the chain) ok jan@ tb@
* Don't call the verify callback twice on success.beck2021-08-291-2/+1
| | | | | | | This fixes a problem in the perl regress where it notices the callback is called twice and complains. ok tb@ bluhm@
* Get rid of historical code to extract the roots in the legacy case.beck2021-08-283-78/+33
| | | | | | | | Due to the need to support by_dir, we use the get_issuer stuff when running in x509_vfy compatibility mode amyway - so just use it any time we are doing that. Removes a bunch of yukky stuff and a "Don't Look Ethel" ok tb@ jsing@
* Clean up and simplify ssl3_dispatch_alert() and ssl3_send_alert().jsing2021-08-281-30/+32
| | | | ok inoguchi@ tb@
* Zap blanks before tabs.tb2021-08-281-4/+4
|
* Remove the "dump_chain" flag and code. This was a workaround for a problem wherebeck2021-08-282-16/+4
| | | | | | | roots were not checked correctly before intermediates that has since been fixed and is no longer necessary. It is regress checked by case 2c in regress/lib/libcrypto/x509/verify.c ok jsing@ tb@
* Remove unused #include <assert.h>.tb2021-08-271-2/+1
| | | | | | | This is from upstream where there is an assert() that EVP_MD_size(digest) matches the length returned by HMAC(). We avoid asserts in our libraries. From Martin Vahlensieck
* Fix various read buffer overflow when printing ASN.1 strings (which aretb2021-08-244-14/+20
| | | | | | | | not necessarily NUL terminated). Same as schwarze's fix in t_x509a.c r1.9. From David Benjamin and Matt Caswell (part of the fixes in OpenSSL 1.1.1l) ok inoguchi
* Pull roots out of the trust store in the legacy xsc when building chainsbeck2021-08-193-8/+26
| | | | | | | to handly by_dir and fun things correctly. - fixes dlg@'s case and by_dir regress in openssl-ruby ok jsing@
* Import initial code for the SM2 ciphertb2021-08-187-0/+1870
| | | | | | | | | | | | | | | | | This adds the SM2 algorithm defined in the Chinese standards GB/T 32918.1-2016, GB/T 32918.2-2016, GB/T 32918.3-2016, GB/T 32918.4-2016 and GB/T 32918.5-2017. This is an ISC licensed implementation contributed by Ribose.inc, based on the same code that was contributed to OpenSSL by Jack Lloyd. The port to LibreSSL was done by Ronald Tse and Nickolay Olshevsky. Github PR #105 I made quite a few cleanup passes on this, but more is needed, some of which will happen in-tree before this is linked to the build. ok deraadt inoguchi (a long time ago), jsing
* Add a check_trust call to the legacy chain validation on chain add, rememberingbeck2021-08-181-2/+10
| | | | | | | | | the result in order to return the same errors as OpenSSL users expect to override the generic "Untrusted cert" error. This fixes the openssl-ruby timestamp test. ok tb@
* Refactor the legacy chain validation from the chain adding code into itsbeck2021-08-181-52/+70
| | | | | | own function, in preparation for subesquent change. No functional change. ok tb@
* typo in commenttb2021-08-161-2/+2
|
* link X509_STORE_get_by_subject(3) and X509_ocspid_print(3) to the build,schwarze2021-08-061-1/+3
| | | | forgotten in earlier commits
* new manual page X509_ocspid_print(3)schwarze2021-08-063-6/+66
| | | | using input from tb@, and OK tb@ on an earlier version
* add a roff(7) comment marking the API function X509_get_default_private_dir()schwarze2021-08-061-2/+5
| | | | | as intentionally undocumented because it is trivial and unused in the wild; OK tb@
* SSL_CTX_remove_session() checks for a NULL session, avoid doing it twice.jsing2021-08-041-2/+2
| | | | Noted by tb@ during review of a larger change.
* Document X509_get_default_cert_dir_env(3)schwarze2021-08-031-8/+35
| | | | | | | | | and X509_get_default_cert_file_env(3). LibreSSL itself does not call getenv(3), but a few application programs including epic5, fetchmail, fossil, slic3r call these functions, so in case programmers find them in existing code, telling them what they do seems useful.
* Document X509_get_default_cert_area(3).schwarze2021-08-031-7/+41
| | | | | | | Put it into this page because this is the code actually using it. Despite its name and include file, it is unrelated to X.509 and unrelated to certificates: it is just the default directory containing the library configuration file, openssl.cnf(5).
* tweaks regarding X509_LOOKUP_by_subject(3):schwarze2021-08-021-8/+28
| | | | | | * document the X509_OBJECT output parameter * more precision regarding return values * clarify relationship with X509_LOOKUP_ctrl(3) for the dir lookup method
* new manual page X509_STORE_get_by_subject(3)schwarze2021-08-025-12/+212
|
* document X509_STORE_load_mem(3) and X509_STORE_add_lookup(3)schwarze2021-08-011-7/+67
|
* document X509_LOOKUP_mem(3) in X509_LOOKUP_hash_dir(3)schwarze2021-07-318-32/+636
| | | | and add a new manual page X509_LOOKUP_new(3)
* We have defines for alert levels - use them instead of magic numbers.jsing2021-07-312-7/+5
|
* Move the explanations related to *ptree closer together and correctschwarze2021-07-301-16/+19
| | | | | | | | | the lie that *ptree is set upon success - in some cases of success, it is set to NULL, whereas in some cases of failure, a non-trivial tree may be returned. beck@ pointed out that statements related to *ptree were scattered all over the place, and this patch works for him.
* Fix a documentation bug i introduced that tb@ pointed out:schwarze2021-07-291-12/+3
| | | | | X509_policy_check(3) never returns 2. If validation succeeds, it always returns 1.
* Document X509_STORE_set_verify_func(3), mostly using text from theschwarze2021-07-291-8/+32
| | | | | | | OpenSSL 1.1.1 branch, which is still under a free license, tweaked by me. While here, garbage collect the weird BUGS section.
* document X509_STORE_CTX_get0_parent_ctx(3)schwarze2021-07-291-4/+34
|
* document X509_STORE_CTX_set_app_data(3) and X509_STORE_CTX_get_app_data(3)schwarze2021-07-291-4/+51
|
* document X509_STORE_CTX_get0_policy_tree(3)schwarze2021-07-281-4/+41
| | | | and X509_STORE_CTX_get_explicit_policy(3)
* document X509_policy_tree_free(3)schwarze2021-07-281-3/+19
|
* consisely explain the meaning of return values rather than merelyschwarze2021-07-281-3/+20
| | | | refering to child object names defined in the standard
* Explain the meaning of the policy_oids input argument, correct theschwarze2021-07-281-14/+12
| | | | | | description of the *pexplicit_policy output argument and make it less technical, and drop the mention of the expected_policy_set because the library provides no accessor function for it.
* explicitely -> explicitly;jmc2021-07-281-4/+4
|
* new manual page X509_policy_check(3)schwarze2021-07-276-10/+198
|
* Add error checks for i2d_X509_NAME()tb2021-07-261-3/+5
| | | | | | | This avoids potential malloc(-1) and malloc(0), spotted by schwarze while documenting X509_ocspid_print(). ok schwarze
* new manual page X509_policy_tree_level_count(3)schwarze2021-07-264-6/+168
| | | | documenting the X509_POLICY_TREE object and its sub-objects
* Dedup dtls1_dispatch_alert()/ssl3_dispatch_alert().jsing2021-07-266-65/+26
| | | | | | | | The code for dtls1_dispatch_alert() and ssl3_dispatch_alert() is largely identical - with a bit of reshuffling we can use ssl3_dispatch_alert() for both protocols and remove the ssl_dispatch_alert function pointer. ok inoguchi@ tb@
* Document X509_STORE_CTX_set_trust(3), X509_STORE_CTX_set_purpose(3),schwarze2021-07-251-4/+226
| | | | | and X509_STORE_CTX_purpose_inherit(3). These functions look deceptively simple on first sight, but their semantics is surprisingly complicated.
* Two new manual pages X509_TRUST_set(3) and X509_check_trust(3)schwarze2021-07-248-12/+516
| | | | | documenting ten functions related to X509_TRUST objects, trust identifiers, and trust indices.
* Similar to x509/x509_purp.c rev. 1.5:schwarze2021-07-231-5/+1
| | | | | | | | | | | | | Delete some code from X509_TRUST_cleanup(3) that had no effect: it called a function on static objects that returns right away unless the argument is dynamically allocated. Pointed out by tb@. This commit is identical to: OpenSSL commit 5e6e650d62af09f47d63bfdd6c92e3b16e9da644 Author: Kurt Cancemi <kurt at x64architecture dot com> Date: Thu Jun 9 21:57:36 2016 -0400
* Delete some code from X509_PURPOSE_cleanup(3) that had no effect:schwarze2021-07-231-5/+1
| | | | | | | | | | | | | it called a function on static objects that returns right away unless the argument is dynamically allocated. OK jsing@ tb@ The useless code was independently discovered while writing documentation. This commit is identical to: OpenSSL commit fa3a0286d178eb3b87bf2eb5fd7af40f81453314 Author: Kurt Cancemi <kurt at x64architecture dot com> Date: Wed Jun 8 19:15:38 2016 -0400
* Add a roff(7) comment that X509_issuer_and_serial_hash() isschwarze2021-07-231-2/+4
| | | | | | intentionally undocumented because it uses MD5 only and is unused in real-world code according to codesearch.debian.net. No objection from tb@.
* Make MALLOC_STATS compile again; noted by Omar Polo and Joe Nelsonotto2021-07-231-2/+2
|
* clarify the meaning of the argument of X509_VERIFY_PARAM_set_purpose(3)schwarze2021-07-231-10/+16
|
* mention the possibility that user-defined purpose identifiers may haveschwarze2021-07-231-2/+13
| | | | been defined or user-supplied checking functions may have been installed
* new manual page X509_PURPOSE_set(3) documenting 11 functionsschwarze2021-07-234-5/+303
| | | | related to X509_PURPOSE objects, purpose identifiers, and purpose indices
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-18 04:07:23 +0000