| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Rather than making include/openssl/foo.h a symlink to
crypto/foo/foo.h, this change moves the file to include/openssl/foo.h
once and for all.
Likewise, move crypto/foo/footest.c to test/footest.c, instead of
symlinking it there.
Originally-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
|
|
|
|
|
|
| |
behaviour will force behaviour as per previous versions of OpenSSL
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
|
|
|
|
|
|
| |
Remove all "#if 0" blocks from header files.
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
|
|
|
|
|
|
|
|
|
|
|
| |
The following compile options (#ifdef's) are removed:
OPENSSL_NO_BIO OPENSSL_NO_BUFFER OPENSSL_NO_CHAIN_VERIFY
OPENSSL_NO_EVP OPENSSL_NO_FIPS_ERR OPENSSL_NO_HASH_COMP
OPENSSL_NO_LHASH OPENSSL_NO_OBJECT OPENSSL_NO_SPEED OPENSSL_NO_STACK
OPENSSL_NO_X509 OPENSSL_NO_X509_VERIFY
This diff is big because of updating the indents on preprocessor lines.
Reviewed-by: Richard Levitte <levitte@openssl.org>
|
|
|
|
| |
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
|
|
|
|
|
|
| |
Sometimes it fails to format them very well, and sometimes it corrupts them!
This commit moves some particularly problematic ones.
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
|
|
|
| |
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
|
|
|
| |
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
|
|
|
|
|
|
| |
indent will not alter them when reformatting comments
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
|
|
|
|
|
|
| |
Reduces number of silly casts in OpenSSL code and likely most
applications. Consistent with (char *) for "peername" value from
X509_check_host() and X509_VERIFY_PARAM_get0_peername().
|
|
|
|
| |
Declaration, memory management, accessor and documentation.
|
|
|
|
| |
Implemented as STACK_OF(OPENSSL_STRING).
|
|
|
|
|
|
| |
Fixes to host checking wild card support and add support for
setting host checking flags when verifying a certificate
chain.
|
|
|
|
|
|
|
|
|
|
|
|
| |
Move the IP, email and host checking fields from the public
X509_VERIFY_PARAM structure into an opaque X509_VERIFY_PARAM_ID
structure. By doing this the structure can be modified in future
without risk of breaking any applications.
(cherry picked from commit adc6bd73e3bd10ce6e76867482e8d137071298d7)
Conflicts:
crypto/x509/x509_vpm.c
|
|
|
|
|
| |
trusted store instead of the default which is to return an error if
we can't build the complete chain.
|
|
|
|
|
|
| |
Add new verify options to set checks.
Remove previous -check* commands from s_client and s_server.
|
|
|
|
| |
from X509_STORE_CTX.
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
information. Add more informative message to verify callback to indicate
when CRL path validation is taking place.
|
| |
|
| |
|
|
|
|
|
| |
a delta CRL in addition to a full CRL. Check and search delta in addition to
the base.
|
|
|
|
|
|
| |
Tidy CRL scoring system.
Add new CRL path validation error.
|
|
|
|
| |
and CRL signing keys.
|
|
|
|
| |
TODO: robustness checking on name forms.
|
| |
|
| |
|
|
|
|
| |
handling to support this.
|
|
|
|
| |
callbacks.
|
|
|
|
|
|
|
|
| |
based on subject name.
New thread safe functions to retrieve matching STACK from X509_STORE.
Cache some IDP components.
|
| |
|
|
|
|
| |
a security threat on unexpecting applications. Document and test.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
CA setting in each certificate on the chain is correct. As a side-
effect always do the following basic checks on extensions, not just
when there's an associated purpose to the check:
- if there is an unhandled critical extension (unless the user has
chosen to ignore this fault)
- if the path length has been exceeded (if one is set at all)
- that certain extensions fit the associated purpose (if one has been
given)
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
| |
This tidies up verify parameters and adds support for integrated policy
checking.
Add support for policy related command line options. Currently only in smime
application.
WARNING: experimental code subject to change.
|
| |
|
|
|
|
| |
when trying to build a shared library on VMS or Windows...
|
| |
|
|
|
|
|
|
| |
verified structure can contain its own CRLs (such as PKCS#7 signedData).
Tidy up some of the verify code.
|
|
|
|
| |
I'll remember to try to compile this with warnings enabled next time :-)
|
|
|
|
|
| |
This is currently *very* experimental and needs to be more fully integrated
with the main verification code.
|
|
|
|
|
|
| |
when X509_V_FLAG_X509_STRICT is set. Check for CRLSign in
CRL issuer certificates. Reject CRLs with unhandled (any)
critical extensions.
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
See the commit log message for that for more information.
NB: X509_STORE_CTX's use of "ex_data" support was actually misimplemented
(initialisation by "memset" won't/can't/doesn't work). This fixes that but
requires that X509_STORE_CTX_init() be able to handle errors - so its
prototype has been changed to return 'int' rather than 'void'. All uses of
that function throughout the source code have been tracked down and
adjusted.
|