summaryrefslogtreecommitdiff
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Document the change in default to comma plus space but leave out thetb2023-04-221-2/+5
| | | | compat nonsense
* Fix UTF-8 issuer printingtb2023-04-221-2/+6
| | | | | | | | | | | | | If no field separator is specified, default to using the comma plus space separation, unless the compat flag is set. Fixes an a bug with printing issuers and other things that contain UTF-8 Reported by Jean-Luc Duprat The very simple fix ix is a joint effort by Henson and Levitte Fixes libressl/portable issue #845 ok jsing
* Improve bn_montgomery_multiply_words()jsing2023-04-221-9/+16
| | | | | | | | | Pull a number of invariants into variables, which avoids repeated loading from memory on architectures where sufficient registers are available. Also keep track of the per-iteration carry in a variable, rather than unnecessarily reading from and writing to memory. This gives a reasonable performance gain on some architectures (e.g. armv7)
* Provide initial regress for BN_{asc,dec,hex}2bn()/BN_bn2{dec,hex}()jsing2023-04-222-1/+592
|
* cms_io: sort includestb2023-04-211-3/+4
|
* cms_io: reverse polarity of an if statement to unindenttb2023-04-211-10/+12
|
* cms_io: Remove a stupid else branchtb2023-04-211-4/+2
| | | | | If you can initialize with functions, you can also initialize with constants...
* Rewrap some lines. No binary changetb2023-04-211-10/+10
|
* Unwrap a linetb2023-04-211-3/+2
|
* s2i_ASN1_INTEGER: make error conditions more explicit, a few more tweakstb2023-04-211-10/+18
|
* s2i_ASN1_INTEGER.3: minor fixestb2023-04-211-4/+8
| | | | | Fix botched Xr and be more precise about errors by being less precise. Add a BUGS section.
* Uncomment and document X.509 verifier error codestb2023-04-211-10/+20
| | | | | | | | These are in actual use, so their meaning should be documented. The remaining commented codes are unused outside of x509_txt.c except for X509_V_ERR_INVALID_NON_CA which looks used at first glance, but it is actually in an unreachable path of the legacy verifier.
* Remove some (soon to be) outdated documentationtb2023-04-211-48/+3
| | | | | | | | | | The documentation of the BN_MOD_CTX has been out of sync with reality for decades. The structure is now opaque, so its members should not be documented this way. They internals aren't important for the rest of the page. BN_MOD_CTX_init() will soon be removed. It's useless unless you like leaks.
* remove duplicate includejsg2023-04-211-2/+1
| | | | ok otto@
* Remove the now unused x509_enum.ctb2023-04-212-65/+1
|
* Move the CRL reason method into x509_bitst.ctb2023-04-212-33/+33
| | | | | | | The CRL extension handler is completely misplaced in x509_enum.c. Move it to x509_bitst.c until we find a better home for it. This way it is next to the other two extension methods that have the extra usr_data contortion.
* Move i2s_ASN1_ENUMERATED_TABLE() next to i2s_ASN1_ENUMERATED()tb2023-04-212-17/+18
| | | | | These functions probably belong into asn1/ but they definitely don't belong into separate files.
* Tweak whitespace gone wrongtb2023-04-211-5/+4
|
* Stop using ENUMERATED_NAMEStb2023-04-211-3/+5
| | | | | | This is a public alias for the also public BIT_STRING_BITNAME. The ENUMERATED_NAMES type is used exactly twice, namely on two lines in this file. This is silly.
* Fix Dt and Xrtb2023-04-201-3/+3
|
* Flip the default of explicitText to UTF8Stringtb2023-04-201-2/+2
| | | | | | | | | | | While it may have been reasonable to use VisibleString back when this code was written, it's an anachronism nowadays. In particular, configuring BoringSSL reports that they have seen malformed certificates with exactly the issue caused by this unfortuante default. Reported by Alex Gaynor in OpenSSL issue 20772 ok jsing
* Link s2i_ASN1_INTEGER.3 to buildtb2023-04-201-1/+2
|
* Add documentation for s2i_ASN1_INTEGER and related functionstb2023-04-201-0/+195
| | | | | | | | | | | | | | | | These functions convert strings to internal objects and vice versa. This is a best effort, probably with a lot of room for improvement, which can happen in tree if anyone cares. It's better than nothing. Nothing in turn would be significantly better than the utter garbage a related project has managed to land as part of their efforts towards significant documentation improvements in a recent major relase. This leaves a dangling reference to the misnamed X509V3_METHOD_get_nid(3) which I may or may not fill in the future. I am unsure about the HISTORY section's precision, but that's what I got from cvs history. All these functions are about a quarter century old (and it shows), so I don't think it matters very much.
* Exercise d2i_IPAddrBlocks() and X509v3_addr_subset() a little bittb2023-04-201-9/+34
|
* Fix botched line wraptb2023-04-191-4/+3
|
* interop: work around extreme REGRESS_SKIP_SLOW slownesstb2023-04-193-8/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A few years back beck introduced REGRESS_SKIP_SLOW dances with the idea that this should speed up the interop tests for us devs because this also checked interop between opensslX and opensslY, which we don't particularly care about. This never really worked. On a mac m1 mini the result is this: REGRESS_SKIP_SLOW unset 9m56.69s real 3m42.24s user 3m00.70s system REGRESS_SKIP_SLOW=yes 11m04.61s real 7m29.61s user 1m40.29s system The problem is that REGRESS_SKIP_SLOW simply wasn't designed to handle the huge number of tests we have here. There are many nested .for loops resulting in several thousand tests. Each test has a name of length ~80. REGRESS_SKIP_SLOW concatenates them into a several hundred kilobytes long string in REGRESS_SKIP_TARGETS, iterates over all regress targets and tests with ".if ${REGRESS_SKIP_TARGETS:M${RT}}" if it should skip them. This means that during a regress run, make spends a lot of time linearly scanning a huge string. I ran into this when I added OpenSSL 3.0 tests to the already existing 1.0.2 and 1.1 tests with the result that with REGRESS_SLOW_TARGTS set it took the better part of an hour while without it it took about 15 min. The hack here is simply to avoid using REGRESS_SLOW_TARGTES here and handle the situation differently. patch, REGRESS_SKIP_SLOW=yes 5m42.32s real 2m09.98s user 1m45.21s system The real solution would be to fix this in bsd.regress.mk, which someone who understands make well is very welcome to do. For now, I'm happy with this. Debugged with jsing a few months ago
* remove duplicate includesjsg2023-04-192-4/+2
|
* remove duplicate includesjsg2023-04-191-2/+1
| | | | ok tb@
* Rename Hex array to hex_digits.jsing2023-04-191-5/+5
| | | | ok tb@
* Move the BN_bn2bin()/BN_bin2bn() family to bn_convert.cjsing2023-04-192-182/+183
|
* Reorder functions.jsing2023-04-191-102/+102
| | | | No functional change.
* Move BN_options() from bn_convert.c to bn_lib.cjsing2023-04-192-21/+21
|
* unifdef BN_RECURSIONjsing2023-04-195-594/+5
| | | | | | | | | | | | This removes a bunch of incomplete and scary code, which potentially leaks secrets and is not constant time. A performance gain is achieved on arm64 for sizes that we care about, while a minimal decrease in performance is noted for larger sizes on some other platforms. While we will potentially reimplement Karatsuba (or Toom-Cook) at a later date, it will be easier and safer to do it from a clean slate. ok tb@
* Use NULL, not 0 for pointers and use an explicit comparison against NULL.tb2023-04-181-3/+3
|
* ectest: Remove #if 1tb2023-04-181-3/+1
|
* Unifdef OPENSSL_NO_EC_NISTP_64_GCC_128tb2023-04-181-203/+1
|
* Remove prototypes under OPENSSL_NO_EC_NISTP_64_GCC_128tb2023-04-181-18/+1
| | | | | | | The code was deleted a while back, the prototypes remained. We had OPENSSL_NO_EC_NISTP_64_GCC_128 in opensslfeatures.h since forever. discussed with jsing
* Move x509.h inclusion into alphabetical ordertb2023-04-181-3/+2
|
* Bring includes into canonical ordertb2023-04-186-37/+35
| | | | Requested by jsing
* Sigh cvs... Also drop OPENSSL_NO_DEPRECATED from ec.htb2023-04-181-3/+1
|
* Move some includes out of OPENSSL_NO_DEPRECATEDtb2023-04-189-27/+9
| | | | | | | | | | | | | Some headers were included conditionally on OPENSSL_NO_DEPRECATED in hopes that eventually the mess of everything includes everything will magically resolve itself. Of course everyone would end up building openssl with OPENSSL_NO_DEPRECATED over time... Right. Surprisingly, the ecosystem has come to rely on these implicit inclusions, so about two dozen ports would fail to build because of this. Patching this would be easy but really not worth the effort. ok jsing
* ectest: drop a broken #if 0 /* optional */ piece of codetb2023-04-181-20/+5
| | | | | This places a point at infinity and then fails. Fix some wacky indentation in the vicinity.
* ec_point_conversion: drop test for sect571k1tb2023-04-181-350/+2
| | | | Maybe it should be replaced by another test, although P-256 seems enough.
* ectest: drop some gross unused macrostb2023-04-181-49/+1
|
* ectest: unifdef OPENSSL_NO_EC2Mtb2023-04-181-418/+1
|
* Skip binary curves in ec_point_conversiontb2023-04-171-3/+14
|
* Switch all ec tests to using dynamic linkingtb2023-04-173-8/+14
| | | | | This only requires very minor changes and simplifies testing quite a bit. Some of the changes can be undone after the next bump.
* Simplify Makefiletb2023-04-171-12/+1
|
* Drop GF2m teststb2023-04-171-647/+1
| | | | The code they test will go away soon.
* Allow overriding the bc implementation used in run-bctb2023-04-171-2/+7
| | | | | | | | | | | | While base bc is great, it uses libcrypto's BIGNUM implementation. This implies that the independent verification of the bn_test isn't as independent as it should be. With this commit, run-bc picks up bn-gh if it is installed. This appears to work on amd64, arm64 and sparc64 (where gbc is busted). I will send PRs to the regress maintainers once I will have tested this a bit more thoroughly. Committing this early since I juggle way too many diffs already.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-11 01:22:04 +0000