aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/x509/x509_vpm.c
Commit message (Collapse)AuthorAgeFilesLines
* GH2176: Add X509_VERIFY_PARAM_get_timeRich Salz2017-01-121-0/+5
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2208)
* Add X509_VERIFY_PARAM inheritance flag set/getRich Salz2016-12-131-0/+11
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2079)
* Simplify and clean X509_VERIFY_PARAM new/free code.FdaSilvaYY2016-11-091-30/+13
| | | | | | | Split x509_verify_param_zero code to the right place Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Revert "Constify code about X509_VERIFY_PARAM"Rich Salz2016-09-211-2/+2
| | | | | | This reverts commit 81f9ce1e1965e0e33db6d2391285c4c1b6af0434. Reviewed-by: Matt Caswell <matt@openssl.org>
* Constify code about X509_VERIFY_PARAMFdaSilvaYY2016-09-181-2/+2
| | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1594)
* Make a2i_ipadd an internal functionRich Salz2016-06-091-0/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* crypto/x509/x509_vpm.c: Simplify int_x509_param_set1()Kurt Cancemi2016-06-081-6/+5
| | | | | | | This change also avoids calling strlen twice when srclen is 0 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Copyright consolidation 09/10Rich Salz2016-05-171-54/+5
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move peer chain security checks into x509_vfy.cViktor Dukhovni2016-04-031-0/+17
| | | | | | | | | | | | | | | | | | | A new X509_VERIFY_PARAM_set_auth_level() function sets the authentication security level. For verification of SSL peers, this is automatically set from the SSL security level. Otherwise, for now, the authentication security level remains at (effectively) 0 by default. The new "-auth_level" verify(1) option is available in all the command-line tools that support the standard verify(1) options. New verify(1) tests added to check enforcement of chain signature and public key security levels. Also added new tests of enforcement of the verify_depth limit. Updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Check chain extensions also for trusted certificatesViktor Dukhovni2016-01-311-3/+3
| | | | | | | | | This includes basic constraints, key usages, issuer EKUs and auxiliary trust OIDs (given a trust suitably related to the intended purpose). Added tests and updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Remove /* foo.c */ commentsRich Salz2016-01-261-1/+0
| | | | | | | | | | | | This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Empty SNI names are not validViktor Dukhovni2016-01-161-2/+2
| | | | | | | While empty inputs to SSL_set1_host() clear the reference identifier list. Reviewed-by: Rich Salz <rsalz@openssl.org>
* DANE support structures, constructructors and accessorsViktor Dukhovni2016-01-051-0/+18
| | | | | | | | | Also tweak some of the code in demos/bio, to enable interactive testing of BIO_s_accept's use of SSL_dup. Changed the sconnect client to authenticate the server, which now exercises the new SSL_set1_host() function. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Rename some BUF_xxx to OPENSSL_xxxRich Salz2015-12-161-4/+4
| | | | | | | | | Rename BUF_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} to OPENSSL_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} Add #define's for the old names. Add CRYPTO_{memdup,strndup}, called by OPENSSL_{memdup,strndup} macros. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove X509_VERIFY_PARAM_IDDr. Stephen Henson2015-11-261-56/+38
| | | | | | | Now that X509_VERIFY_PARAM is opaque X509_VERIFY_PARAM_ID is no longer needed. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Continue standardising malloc style for libcryptoMatt Caswell2015-11-091-4/+4
| | | | | | | Continuing from previous commit ensure our style is consistent for malloc return checks. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Add and use OPENSSL_zallocRich Salz2015-09-021-12/+2
| | | | | | | | | There are many places (nearly 50) where we malloc and then memset. Add an OPENSSL_zalloc routine to encapsulate that. (Missed one conversion; thanks Richard) Also fixes GH328 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Better handling of verify param id peername fieldViktor Dukhovni2015-09-021-1/+9
| | | | | | | | | | | | | Initialize pointers in param id by the book (explicit NULL assignment, rather than just memset 0). In x509_verify_param_zero() set peername to NULL after freeing it. In x509_vfy.c's internal check_hosts(), avoid potential leak of possibly already non-NULL peername. This is only set when a check succeeds, so don't need to do this repeatedly in the loop. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Identify and move common internal libcrypto header filesRichard Levitte2015-05-141-1/+1
| | | | | | | | | | | | | There are header files in crypto/ that are used by a number of crypto/ submodules. Move those to crypto/include/internal and adapt the affected source code and Makefiles. The header files that got moved are: crypto/cryptolib.h crypto/md32_common.h Reviewed-by: Rich Salz <rsalz@openssl.org>
* Use safer sizeof variant in mallocRich Salz2015-05-041-4/+4
| | | | | | | | | | | | | For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix cut/paste errorRich Salz2015-05-041-1/+1
| | | | | | Was memset with wrong sizeof. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add OSSL_NELEM macro.Dr. Stephen Henson2015-05-031-5/+3
| | | | | | | Add OSSL_NELEM macro to e_os.h to determine the number of elements in an array. Reviewed-by: Tim Hudson <tjh@openssl.org>
* RT3776: Wrong size for mallocRich Salz2015-05-021-4/+4
| | | | | | Use sizeof *foo parameter, to avoid these errors. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* free NULL cleanup -- codaRich Salz2015-05-011-9/+5
| | | | | | | | After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: Tim Hudson <tjh@openssl.org>
* free null cleanup finaleRich Salz2015-05-011-17/+9
| | | | | | Don't check for NULL before calling OPENSSL_free Reviewed-by: Richard Levitte <levitte@openssl.org>
* free NULL cleanup 5aRich Salz2015-04-301-3/+3
| | | | | | | | | Don't check for NULL before calling a free routine. This gets X509_.*free: x509_name_ex_free X509_policy_tree_free X509_VERIFY_PARAM_free X509_STORE_free X509_STORE_CTX_free X509_PKEY_free X509_OBJECT_free_contents X509_LOOKUP_free X509_INFO_free Reviewed-by: Richard Levitte <levitte@openssl.org>
* free NULL cleanup 8Rich Salz2015-04-301-10/+6
| | | | | | | | | | Do not check for NULL before calling a free routine. This addresses: ASN1_BIT_STRING_free ASN1_GENERALIZEDTIME_free ASN1_INTEGER_free ASN1_OBJECT_free ASN1_OCTET_STRING_free ASN1_PCTX_free ASN1_SCTX_free ASN1_STRING_clear_free ASN1_STRING_free ASN1_TYPE_free ASN1_UTCTIME_free M_ASN1_free_of Reviewed-by: Richard Levitte <levitte@openssl.org>
* X509_VERIFY_PARAM_free: Check param for NULLKurt Roeckx2015-04-111-0/+2
| | | | Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org>
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-221-494/+466
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* mark all block comments that need format preserving so thatTim Hudson2014-12-301-1/+2
| | | | | | | indent will not alter them when reformatting comments Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Update API to use (char *) for email addresses and hostnamesViktor Dukhovni2014-07-071-14/+16
| | | | | | Reduces number of silly casts in OpenSSL code and likely most applications. Consistent with (char *) for "peername" value from X509_check_host() and X509_VERIFY_PARAM_get0_peername().
* New peername element in X509_VERIFY_PARAM_IDViktor Dukhovni2014-07-061-1/+8
| | | | Declaration, memory management, accessor and documentation.
* Multiple verifier reference identities.Viktor Dukhovni2014-06-221-8/+83
| | | | Implemented as STACK_OF(OPENSSL_STRING).
* Drop hostlen from X509_VERIFY_PARAM_ID.Viktor Dukhovni2014-06-221-5/+3
| | | | | Just store NUL-terminated strings. This works better when we add support for multiple hostnames.
* Rename vpm_int.h to x509_lcl.hDr. Stephen Henson2014-05-251-1/+1
|
* Fixes to host checking.Viktor Dukhovni2014-05-211-1/+8
| | | | | | Fixes to host checking wild card support and add support for setting host checking flags when verifying a certificate chain.
* Add opaque ID structure.Dr. Stephen Henson2013-12-131-27/+61
| | | | | | | | | | | | Move the IP, email and host checking fields from the public X509_VERIFY_PARAM structure into an opaque X509_VERIFY_PARAM_ID structure. By doing this the structure can be modified in future without risk of breaking any applications. (cherry picked from commit adc6bd73e3bd10ce6e76867482e8d137071298d7) Conflicts: crypto/x509/x509_vpm.c
* Integrate host, email and IP address checks into X509_verify.Dr. Stephen Henson2012-12-051-0/+97
| | | | | | Add new verify options to set checks. Remove previous -check* commands from s_client and s_server.
* verify parameter enumeration functionsDr. Stephen Henson2010-02-251-0/+21
|
* Update from 1.0.0-stableDr. Stephen Henson2009-06-301-1/+5
|
* Fix from stable branch.Dr. Stephen Henson2009-03-151-2/+13
|
* PR: 1778Dr. Stephen Henson2009-02-161-1/+1
| | | | Increase default verify depth to 100.
* Update obsolete email address...Dr. Stephen Henson2008-11-051-1/+1
|
* Create function of the form OBJ_bsearch_xxx() in bsearch typesafe macrosDr. Stephen Henson2008-10-221-6/+4
| | | | | | | | with the appropriate parameters which calls OBJ_bsearch(). A compiler will typically inline this. This avoids the need for cmp_xxx variables and fixes unchecked const issues with CHECKED_PTR_OF()
* Fix a shed load or warnings:Dr. Stephen Henson2008-10-201-2/+2
| | | | | Duplicate const. Use of ; outside function.
* Type-checked (and modern C compliant) OBJ_bsearch.Ben Laurie2008-10-121-7/+12
|
* Change safestack reimplementation to match 0.9.8.Dr. Stephen Henson2007-09-071-1/+1
| | | | Fix additional gcc 4.2 value not used warnings.
* Update from stable branch.Dr. Stephen Henson2006-05-031-0/+9
|
* Two new verify flags functions.Dr. Stephen Henson2005-09-021-0/+11
|
* New X509_VERIFY_PARAM structure and associated functionality.Dr. Stephen Henson2004-09-061-0/+400
This tidies up verify parameters and adds support for integrated policy checking. Add support for policy related command line options. Currently only in smime application. WARNING: experimental code subject to change.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-21 00:45:49 +0000