aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/x509/x_all.c
Commit message (Collapse)AuthorAgeFilesLines
* Add -Wundef to --strict-warnings options.Bernd Edlinger2017-02-241-1/+1
| | | | | | | | | | | Avoid a -Wundef warning in refcount.h Avoid a -Wundef warning in o_str.c Avoid a -Wundef warning in testutil.h Include internal/cryptlib.h before openssl/stack.h to avoid use of undefined symbol OPENSSL_API_COMPAT. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2712)
* X509_CRL_digest() - ensure precomputed sha1 hash before returning itRichard Levitte2017-01-281-1/+1
| | | | | | | X509_CRL_digest() didn't check if the precomputed sha1 hash was actually present. This also makes sure there's an appropriate flag to check. Reviewed-by: Kurt Roeckx <kurt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2314)
* Fix no-ocspRichard Levitte2017-01-131-0/+1
| | | | | | | The use of EXFLAG_SET requires the inclusion of openssl/x509v3.h. openssl/ocsp.h does that, except when OCSP is disabled. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2227)
* Make X509_Digest,others publicRich Salz2017-01-121-0/+14
| | | | | | Also, if want SHA1 then use the pre-computed value if there. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2223)
* Copyright consolidation 09/10Rich Salz2016-05-171-54/+6
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix no-ocspMatt Caswell2016-04-061-0/+4
| | | | | | Misc fixes for no-ocsp Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove #error from include files.Rich Salz2016-03-201-6/+2
| | | | | | | | Don't have #error statements in header files, but instead wrap the contents of that file in #ifndef OPENSSL_NO_xxx This means it is now always safe to include the header file. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove /* foo.c */ commentsRich Salz2016-01-261-1/+0
| | | | | | | | | | | | This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* embed CRL serial number and signature fieldsDr. Stephen Henson2015-10-151-2/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* embed certificate serial number and signature fieldsDr. Stephen Henson2015-10-151-3/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Embed various signature algorithms.Dr. Stephen Henson2015-09-171-14/+14
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Embed X509_REQ_INFODr. Stephen Henson2015-09-161-3/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Embed X509_CINFDr. Stephen Henson2015-09-161-8/+8
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* X509_CRL_INFO embedDr. Stephen Henson2015-09-161-6/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* make X509_REQ opaqueDr. Stephen Henson2015-08-311-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Identify and move common internal libcrypto header filesRichard Levitte2015-05-141-1/+1
| | | | | | | | | | | | | There are header files in crypto/ that are used by a number of crypto/ submodules. Move those to crypto/include/internal and adapt the affected source code and Makefiles. The header files that got moved are: crypto/cryptolib.h crypto/md32_common.h Reviewed-by: Rich Salz <rsalz@openssl.org>
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-221-317/+322
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Cleanup OPENSSL_NO_xxx, part 1master-pre-reformatRich Salz2015-01-141-9/+9
| | | | | | | | | | OPENSSL_NO_RIPEMD160, OPENSSL_NO_RIPEMD merged into OPENSSL_NO_RMD160 OPENSSL_NO_FP_API merged into OPENSSL_NO_STDIO Two typo's on #endif comments fixed: OPENSSL_NO_ECB fixed to OPENSSL_NO_OCB OPENSSL_NO_HW_SureWare fixed to OPENSSL_NO_HW_SUREWARE Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix various certificate fingerprint issues.Dr. Stephen Henson2015-01-051-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists. 1. Reject signatures with non zero unused bits. If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits. 2. Check certificate algorithm consistency. Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates. 3. Check DSA/ECDSA signatures use DER. Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch. This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes). CVE-2014-8275 Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Reencode with X509_CRL_ctx_sign too.Dr. Stephen Henson2013-06-051-0/+1
|
* Reencode certificates in X509_sign_ctx.Dr. Stephen Henson2013-05-021-0/+1
| | | | | | | Reencode certificates in X509_sign_ctx as well as X509_sign. This was causing a problem in the x509 application when it modified an existing certificate.
* add wrapper function for certificate downloadDr. Stephen Henson2012-11-291-0/+6
|
* Generalise OCSP I/O functions to support dowloading of other ASN1Dr. Stephen Henson2012-11-281-0/+8
| | | | structures using HTTP. Add wrapper function to handle CRL download.
* Add call to ENGINE_register_all_complete() to ENGINE_load_builtin_engines(),Dr. Stephen Henson2010-10-031-0/+1
| | | | | | | this means that some implementations will be used automatically, e.g. aesni, we do this for cryptodev anyway. Setup cpuid in ENGINE_load_builtin_engines() too as some ENGINEs use it.
* add X509_CRL_sign_ctx functionDr. Stephen Henson2010-03-141-0/+19
|
* remove SSLEAY_MACROS codeNils Larsch2006-11-061-1/+0
|
* Tidy up CRL handling by checking for critical extensions when it isDr. Stephen Henson2006-09-211-6/+0
| | | | | | | | loaded. Add new function X509_CRL_get0_by_serial() to lookup a revoked entry to avoid the need to access the structure directly. Add new X509_CRL_METHOD to allow common CRL operations (verify, lookup) to be redirected.
* makeNils Larsch2005-07-161-0/+4
| | | | | | | | ./configure no-deprecated [no-dsa] [no-dh] [no-ec] [no-rsa] make depend all test work again PR: 1159
* Give everything prototypes (well, everything that's actually used).Ben Laurie2005-03-311-68/+43
|
* Automatically mark the CRL cached encoding as invalid when some operationsDr. Stephen Henson2004-12-091-0/+1
| | | | are performed.
* (oops) Apologies all, that last header-cleanup commit was from the wrongGeoff Thorpe2004-04-191-0/+2
| | | | | tree. This further reduces header interdependencies, and makes some associated cleanups.
* use a generic EC_KEY structure (EC keys are not ECDSA specific)Bodo Möller2002-08-071-29/+28
| | | | Submitted by: Nils Larsch
* ECDSA supportBodo Möller2002-02-131-0/+53
| | | | Submitted by: Nils Larsch <nla@trustcenter.de>
* Retain compatibility of EVP_DigestInit() and EVP_DigestFinal()Dr. Stephen Henson2001-10-161-1/+1
| | | | | | with existing code. Modify library to use digest *_ex() functions.
* More linker bloat reorganisation:Dr. Stephen Henson2001-07-271-54/+0
| | | | | | | | | | | | | | | | | | | | | Split private key PEM and normal PEM handling. Private key handling needs to link in stuff like PKCS#8. Relocate the ASN1 *_dup() functions, to the relevant ASN1 modules using new macro IMPLEMENT_ASN1_DUP_FUNCTION. Previously these were all in crypto/x509/x_all.c along with every ASN1 BIO/fp function which linked in *every* ASN1 function if a single dup was used. Move the authority key id ASN1 structure to a separate file. This is used in the X509 routines and its previous location linked in all the v3 extension code. Also move ASN1_tag2bit to avoid linking in a_bytes.c which is now largely obsolete. So far under Linux stripped binary with single PEM_read_X509 is now 238K compared to 380K before these changes.
* Initial support for ASN1_ITEM_FUNCTION option toDr. Stephen Henson2001-02-231-48/+48
| | | | | | | | change the way ASN1 modules are exported. Still needs a bit of work for example the hack which a dummy function prototype to avoid compilers warning about multiple ;s.
* Make all configuration macros available for application by makingRichard Levitte2001-02-191-10/+10
| | | | | | | | | | | | sure they are available in opensslconf.h, by giving them names starting with "OPENSSL_" to avoid conflicts with other packages and by making sure e_os2.h will cover all platform-specific cases together with opensslconf.h. I've checked fairly well that nothing breaks with this (apart from external software that will adapt if they have used something like NO_KRB5), but I can't guarantee it completely, so a review of this change would be a good thing.
* Various function for commmon operations.Dr. Stephen Henson2001-02-021-0/+9
|
* ASN1_ITEM versions of ASN1_d2i_{fp, bio} and replacement ofDr. Stephen Henson2000-12-301-54/+34
| | | | | | most of the old wrappers. A few of the old versions remain because they are non standard and the corresponding ASN1 code has not been reimplemented yet.
* Replace the old ASN1_dup() with ASN1_item_dup() andDr. Stephen Henson2000-12-291-23/+11
| | | | zap some evil function pointers casts along the way...
* Add NO_ASN1_OLD to remove some old style functions:Dr. Stephen Henson2000-12-281-13/+13
| | | | | | | | | | currently OpenSSL itself wont compile with this set because some old style stuff remains. Change old functions X509_sign(), X509_verify() etc to use new item based functions. Replace OCSP function declarations with DECLARE macros.
* Add 'rsautl' low level RSA utility.Dr. Stephen Henson2000-09-031-0/+22
| | | | | | | | Add DER public key routines. Add -passin argument to 'ca' utility. Document sign and verify options to dgst.
* The previous commit to crypto/stack/*.[ch] pulled the type-safety stringsGeoff Thorpe2000-06-011-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | yet tighter, and also put some heat on the rest of the library by insisting (correctly) that compare callbacks used in stacks are prototyped with "const" parameters. This has led to a depth-first explosion of compiler warnings in the code where 1 constification has led to 3 or 4 more. Fortunately these have all been resolved to completion and the code seems cleaner as a result - in particular many of the _cmp() functions should have been prototyped with "const"s, and now are. There was one little problem however; X509_cmp() should by rights compare "const X509 *" pointers, and it is now declared as such. However, it's internal workings can involve recalculating hash values and extensions if they have not already been setup. Someone with a more intricate understanding of the flow control of X509 might be able to tighten this up, but for now - this seemed the obvious place to stop the "depth-first" constification of the code by using an evil cast (they have migrated all the way here from safestack.h). Fortunately, this is the only place in the code where this was required to complete these type-safety changes, and it's reasonably clear and commented, and seemed the least unacceptable of the options. Trying to take the constification further ends up exploding out considerably, and indeed leads directly into generalised ASN functions which are not likely to cooperate well with this.
* Fix c_rehash script, add -fingerprint option to crl.Dr. Stephen Henson2000-05-181-0/+12
|
* Fix some of the command line password stuff. New functionDr. Stephen Henson2000-01-011-55/+6
| | | | | | | that can automatically determine the type of a DER encoded "traditional" format private key and change some of the d2i functions to use it instead of requiring the application to work out the key type.
* New {i2d,d2i}_PrivateKey_{bio, fp} functions.Dr. Stephen Henson1999-12-261-0/+71
|
* Allow passwords to be included on command line for a fewDr. Stephen Henson1999-12-241-0/+23
| | | | more utilities.
* Initial trust code: allow setting of trust checking functionsDr. Stephen Henson1999-11-271-3/+3
| | | | | | | | | | | | | in a table. Doesn't do too much yet. Make the -<digestname> options in 'x509' affect all relevant options. Change the name of the 'notrust' options to 'reject' as this causes less confusion and is a better description of the effect. A few constification changes.
* Transparent support for PKCS#8 private keys in RSA/DSA.Dr. Stephen Henson1999-11-211-8/+32
| | | | | | | | New universal public key format. Fix CRL+cert load problem in by_file.c Make verify report errors when loading files or dirs
* Add support for public key input and output in rsa and dsa utilities with someDr. Stephen Henson1999-10-041-0/+25
| | | | | | | new DSA public key functions that were missing. Also beginning of a cache for X509_EXTENSION structures: this will allow them to be accessed more quickly for things like certificate chain verification...
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-23 21:13:33 +0000