summaryrefslogtreecommitdiffstats
path: root/crypto/x509/x509_lcl.h
Commit message (Collapse)AuthorAgeFilesLines
* Update copyright yearMatt Caswell2018-06-201-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6538)
* Add APIs for custom X509_LOOKUP_METHOD creationMingtao Yang2018-05-301-2/+2
| | | | | | | | | | | | | | OpenSSL 1.1.0 made the X509_LOOKUP_METHOD structure opaque, so applications that were previously able to define a custom lookup method are not able to be ported. This commit adds getters and setters for each of the current fields of X509_LOOKUP_METHOD, along with getters and setters on several associated opaque types (such as X509_LOOKUP and X509_OBJECT). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6152)
* Add support for custom signature parametersDr. Stephen Henson2017-04-251-0/+3
| | | | | | | | | | | | | | | | | | Many signature types define the digest and public key type by a single OID such as ecdsa_with_sha256. Some types (RSA-PSS for example) use a single OID to indicate the signature scheme and additional parameters are encoded in the AlgorithmIdentifier. Add an X509_SIG_INFO structure to contain details about the signature type: specifically the digest algorithm, public key algorithm, security bits and various flags. This supports both existing algorithms and more complex types. Add accessors for the structure and a special case that retrieves signature information from a certificate. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3301)
* Add X509_VERIFY_PARAM inheritance flag set/getRich Salz2016-12-131-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2079)
* Add support for reference counting using C11 atomicsKurt Roeckx2016-11-171-1/+3
| | | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1500
* Constify inputs of two X509_LOOKUP_METHOD methodsFdaSilvaYY2016-08-041-2/+2
| | | | | | | ... get_by_fingerprint() and get_by_alias() Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Use X509_LOOKUP_TYPE for lookup type consistently.Dr. Stephen Henson2016-07-261-7/+8
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add setter and getter for X509_STORE's check_policyRichard Levitte2016-07-251-0/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Copyright consolidation 09/10Rich Salz2016-05-171-54/+5
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Make many X509_xxx types opaque.Rich Salz2016-04-151-0/+65
| | | | | | | | | Make X509_OBJECT, X509_STORE_CTX, X509_STORE, X509_LOOKUP, and X509_LOOKUP_METHOD opaque. Remove unused X509_CERT_FILE_CTX Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Move peer chain security checks into x509_vfy.cViktor Dukhovni2016-04-031-0/+1
| | | | | | | | | | | | | | | | | | | A new X509_VERIFY_PARAM_set_auth_level() function sets the authentication security level. For verification of SSL peers, this is automatically set from the SSL security level. Otherwise, for now, the authentication security level remains at (effectively) 0 by default. The new "-auth_level" verify(1) option is available in all the command-line tools that support the standard verify(1) options. New verify(1) tests added to check enforcement of chain signature and public key security levels. Also added new tests of enforcement of the verify_depth limit. Updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Tidy up x509_vfy callback handlingViktor Dukhovni2016-04-031-1/+2
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Remove /* foo.c */ commentsRich Salz2016-01-261-1/+0
| | | | | | | | | | | | This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Only declare stacks in headersDr. Stephen Henson2016-01-071-0/+7
| | | | | | | Don't define stacks in C source files: it causes warnings about unused functions in some compilers. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove X509_VERIFY_PARAM_IDDr. Stephen Henson2015-11-261-6/+1
| | | | | | | Now that X509_VERIFY_PARAM is opaque X509_VERIFY_PARAM_ID is no longer needed. Reviewed-by: Tim Hudson <tjh@openssl.org>
* embed value field of X509_EXTENSIONDr. Stephen Henson2015-10-151-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Move certificate request and CRL routines to x509 dir.Dr. Stephen Henson2015-09-221-0/+18
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* make X509_VERIFY_PARAM opaqueDr. Stephen Henson2015-05-021-0/+18
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove X509_ATTRIBUTE hack.Dr. Stephen Henson2015-03-251-11/+1
| | | | | | | | | The X509_ATTRIBUTE structure includes a hack to tolerate malformed attributes that encode as the type instead of SET OF type. This form is never created by OpenSSL and shouldn't be needed any more. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* make X509_EXTENSION opaqueDr. Stephen Henson2015-03-231-0/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make X509_ATTRIBUTE opaque.Dr. Stephen Henson2015-03-161-0/+16
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-221-13/+13
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Update API to use (char *) for email addresses and hostnamesViktor Dukhovni2014-07-071-1/+1
| | | | | | Reduces number of silly casts in OpenSSL code and likely most applications. Consistent with (char *) for "peername" value from X509_check_host() and X509_VERIFY_PARAM_get0_peername().
* New peername element in X509_VERIFY_PARAM_IDViktor Dukhovni2014-07-061-0/+1
| | | | Declaration, memory management, accessor and documentation.
* Multiple verifier reference identities.Viktor Dukhovni2014-06-221-1/+1
| | | | Implemented as STACK_OF(OPENSSL_STRING).
* Drop hostlen from X509_VERIFY_PARAM_ID.Viktor Dukhovni2014-06-221-1/+0
| | | | | Just store NUL-terminated strings. This works better when we add support for multiple hostnames.
* Don't use expired certificates if possible.Dr. Stephen Henson2014-05-251-0/+2
| | | | | | | | When looking for the issuer of a certificate, if current candidate is expired, continue looking. Only return an expired certificate if no valid certificates are found. PR#3359
* Rename vpm_int.h to x509_lcl.hDr. Stephen Henson2014-05-251-0/+70
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-17 07:25:01 +0000