aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/x509
Commit message (Collapse)AuthorAgeFilesLines
* free NULL cleanup 5aRich Salz2015-04-3010-53/+37
| | | | | | | | | Don't check for NULL before calling a free routine. This gets X509_.*free: x509_name_ex_free X509_policy_tree_free X509_VERIFY_PARAM_free X509_STORE_free X509_STORE_CTX_free X509_PKEY_free X509_OBJECT_free_contents X509_LOOKUP_free X509_INFO_free Reviewed-by: Richard Levitte <levitte@openssl.org>
* free NULL cleanup 8Rich Salz2015-04-302-12/+7
| | | | | | | | | | Do not check for NULL before calling a free routine. This addresses: ASN1_BIT_STRING_free ASN1_GENERALIZEDTIME_free ASN1_INTEGER_free ASN1_OBJECT_free ASN1_OCTET_STRING_free ASN1_PCTX_free ASN1_SCTX_free ASN1_STRING_clear_free ASN1_STRING_free ASN1_TYPE_free ASN1_UTCTIME_free M_ASN1_free_of Reviewed-by: Richard Levitte <levitte@openssl.org>
* remove malloc castsRich Salz2015-04-284-7/+8
| | | | | | | Following ANSI C rules, remove the casts from calls to OPENSSL_malloc and OPENSSL_realloc. Reviewed-by: Richard Levitte <levitte@openssl.org>
* X509_VERIFY_PARAM_free: Check param for NULLKurt Roeckx2015-04-111-0/+2
| | | | Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org>
* Remove EXHEADER, TEST, APPS, links:, install: and uninstall: where relevantRichard Levitte2015-03-311-17/+1
| | | | | | | | | | | | With no more symlinks, there's no need for those variables, or the links target. This also goes for all install: and uninstall: targets that do nothing but copy $(EXHEADER) files, since that's now taken care of by the top Makefile. Also, removed METHTEST from test/Makefile. It looks like an old test that's forgotten... Reviewed-by: Rich Salz <rsalz@openssl.org>
* Stop symlinking, move files to intended directoryRichard Levitte2015-03-312-1876/+0
| | | | | | | | | | | | | Rather than making include/openssl/foo.h a symlink to crypto/foo/foo.h, this change moves the file to include/openssl/foo.h once and for all. Likewise, move crypto/foo/footest.c to test/footest.c, instead of symlinking it there. Originally-by: Geoff Thorpe <geoff@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove d2i_X509_PKEY and i2d_X509_PKEYDr. Stephen Henson2015-03-281-3/+0
| | | | | | | Remove partially implemented d2i_X509_PKEY and i2d_X509_PKEY: nothing uses them and they don't work properly. Update ordinals. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* free NULL cleanupRich Salz2015-03-282-8/+4
| | | | | | | | | EVP_.*free; this gets: EVP_CIPHER_CTX_free EVP_PKEY_CTX_free EVP_PKEY_asn1_free EVP_PKEY_asn1_set_free EVP_PKEY_free EVP_PKEY_free_it EVP_PKEY_meth_free; and also EVP_CIPHER_CTX_cleanup Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Remove X509_ATTRIBUTE hack.Dr. Stephen Henson2015-03-253-48/+9
| | | | | | | | | The X509_ATTRIBUTE structure includes a hack to tolerate malformed attributes that encode as the type instead of SET OF type. This form is never created by OpenSSL and shouldn't be needed any more. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* free NULL cleanupRich Salz2015-03-251-4/+2
| | | | | | | This commit handles BIO_ACCEPT_free BIO_CB_FREE BIO_CONNECT_free BIO_free BIO_free_all BIO_vfree Reviewed-by: Matt Caswell <matt@openssl.org>
* make dependDr. Stephen Henson2015-03-251-3/+20
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* make X509_NAME opaqueDr. Stephen Henson2015-03-256-18/+538
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix verify algorithm.Dr. Stephen Henson2015-03-241-0/+8
| | | | | | | | | | Disable loop checking when we retry verification with an alternative path. This fixes the case where an intermediate CA is explicitly trusted and part of the untrusted certificate list. By disabling loop checking for this case the untrusted CA can be replaced by the explicitly trusted case and verification will succeed. Reviewed-by: Matt Caswell <matt@openssl.org>
* make dependDr. Stephen Henson2015-03-241-2/+28
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* make X509_EXTENSION opaqueDr. Stephen Henson2015-03-235-7/+88
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove old ASN.1 code.Dr. Stephen Henson2015-03-235-20/+20
| | | | | | | | | Remove old M_ASN1_ macros and replace any occurences with the corresponding function. Remove d2i_ASN1_bytes, d2i_ASN1_SET, i2d_ASN1_SET: no longer used internally. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make X509_ATTRIBUTE opaque.Dr. Stephen Henson2015-03-166-51/+156
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove obsolete declarations.Dr. Stephen Henson2015-03-121-8/+0
| | | | | | | Remove DECLARE_ASN1_SET_OF and DECLARE_PKCS12_STACK_OF these haven't been used internally in OpenSSL for some time. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Merge OPENSSL_NO_EC{DH,DSA} into OPENSSL_NO_ECRich Salz2015-03-111-6/+0
| | | | | | Suggested by John Foley <foleyj@cisco.com>. Reviewed-by: Matt Caswell <matt@openssl.org>
* Check public key is not NULL.Dr. Stephen Henson2015-03-021-0/+2
| | | | | | | CVE-2015-0288 PR#3708 Reviewed-by: Matt Caswell <matt@openssl.org>
* Add flag to inhibit checking for alternate certificate chains. Setting thisMatt Caswell2015-02-252-2/+10
| | | | | | behaviour will force behaviour as per previous versions of OpenSSL Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* In certain situations the server provided certificate chain may no longer beMatt Caswell2015-02-251-70/+105
| | | | | | | | | | | | | valid. However the issuer of the leaf, or some intermediate cert is in fact in the trust store. When building a trust chain if the first attempt fails, then try to see if alternate chains could be constructed that are trusted. RT3637 RT3621 Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Remove obsolete IMPLEMENT_ASN1_SET_OFDr. Stephen Henson2015-02-092-6/+0
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org>
* Final (for me, for now) dead code cleanupRich Salz2015-02-081-6/+0
| | | | | | | This is a final pass looking for '#if 0'/'#if 1' controls and removing the appropriate pieces. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Remove X509_PAIRRich Salz2015-02-061-8/+0
| | | | | | Unused type; a pair X509 certificates. Intended for LDAP support. Reviewed-by: Richard Levitte <levitte@openssl.org>
* util/mkstack.pl now generates entire safestack.hRich Salz2015-02-064-14/+0
| | | | | | | | | The mkstack.pl script now generates the entire safestack.h file. It generates output that follows the coding style. Also, removed all instances of the obsolete IMPLEMENT_STACK_OF macro. Reviewed-by: Andy Polyakov <appro@openssl.org>
* "#if 0" removal: header filesRich Salz2015-01-271-10/+0
| | | | | | Remove all "#if 0" blocks from header files. Reviewed-by: Tim Hudson <tjh@openssl.org>
* OPENSSL_NO_xxx cleanup: SHARich Salz2015-01-272-11/+1
| | | | | | | | | | | | | | | Remove support for SHA0 and DSS0 (they were broken), and remove the ability to attempt to build without SHA (it didn't work). For simplicity, remove the option of not building various SHA algorithms; you could argue that SHA_224/256/384/512 should be kept, since they're like crypto algorithms, but I decided to go the other way. So these options are gone: GENUINE_DSA OPENSSL_NO_SHA0 OPENSSL_NO_SHA OPENSSL_NO_SHA1 OPENSSL_NO_SHA224 OPENSSL_NO_SHA256 OPENSSL_NO_SHA384 OPENSSL_NO_SHA512 Reviewed-by: Richard Levitte <levitte@openssl.org>
* OPENSSL_NO_xxx cleanup: RFC3779Rich Salz2015-01-272-4/+0
| | | | | | | | | Remove OPENSSL_NO_RFCF3779. Also, makevms.com was ignored by some of the other cleanups, so I caught it up. Sorry I ignored you, poor little VMS... Reviewed-by: Richard Levitte <levitte@openssl.org>
* OPENSSL_NO_xxx cleanup: many removalsRich Salz2015-01-273-30/+4
| | | | | | | | | | | | The following compile options (#ifdef's) are removed: OPENSSL_NO_BIO OPENSSL_NO_BUFFER OPENSSL_NO_CHAIN_VERIFY OPENSSL_NO_EVP OPENSSL_NO_FIPS_ERR OPENSSL_NO_HASH_COMP OPENSSL_NO_LHASH OPENSSL_NO_OBJECT OPENSSL_NO_SPEED OPENSSL_NO_STACK OPENSSL_NO_X509 OPENSSL_NO_X509_VERIFY This diff is big because of updating the indents on preprocessor lines. Reviewed-by: Richard Levitte <levitte@openssl.org>
* More comment realignmentmaster-post-reformatMatt Caswell2015-01-225-25/+25
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-2227-7749/+7581
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Move more comments that confuse indentMatt Caswell2015-01-221-3/+6
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* indent has problems with comments that are on the right hand side of a line.Matt Caswell2015-01-222-36/+67
| | | | | | | Sometimes it fails to format them very well, and sometimes it corrupts them! This commit moves some particularly problematic ones. Reviewed-by: Tim Hudson <tjh@openssl.org>
* More indent fixes for STACK_OFMatt Caswell2015-01-222-2/+2
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix indent issue with functions using STACK_OFMatt Caswell2015-01-222-4/+4
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Further comment changes for reformat (master)Matt Caswell2015-01-224-11/+12
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Cleanup OPENSSL_NO_xxx, part 1master-pre-reformatRich Salz2015-01-142-11/+11
| | | | | | | | | | OPENSSL_NO_RIPEMD160, OPENSSL_NO_RIPEMD merged into OPENSSL_NO_RMD160 OPENSSL_NO_FP_API merged into OPENSSL_NO_STDIO Two typo's on #endif comments fixed: OPENSSL_NO_ECB fixed to OPENSSL_NO_OCB OPENSSL_NO_HW_SureWare fixed to OPENSSL_NO_HW_SUREWARE Reviewed-by: Richard Levitte <levitte@openssl.org>
* Further comment amendments to preserve formatting prior to source reformatMatt Caswell2015-01-061-1/+2
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Constify ASN1_TYPE_cmp add X509_ALGOR_cmp.Dr. Stephen Henson2015-01-051-0/+1
| | | | Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Fix various certificate fingerprint issues.Dr. Stephen Henson2015-01-051-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists. 1. Reject signatures with non zero unused bits. If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits. 2. Check certificate algorithm consistency. Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates. 3. Check DSA/ECDSA signatures use DER. Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch. This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes). CVE-2014-8275 Reviewed-by: Emilia Käsper <emilia@openssl.org>
* mark all block comments that need format preserving so thatTim Hudson2014-12-305-6/+10
| | | | | | | indent will not alter them when reformatting comments Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Change all instances of OPENSSL_NO_DEPRECATED to OPENSSL_USE_DEPRECATEDMatt Caswell2014-12-181-1/+1
| | | | | | Introduce use of DECLARE_DEPRECATED Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove fipscanister build functionality from makefiles.Dr. Stephen Henson2014-12-081-1/+1
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove all .cvsignore filesRich Salz2014-11-281-4/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* RT1909: Omit version for v1 certificatesGeoff Keating2014-09-091-0/+6
| | | | | | | When calling X509_set_version to set v1 certificate, that should mean that the version number field is omitted. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* RT2841: Extra return in check_issuedPaul Suhler2014-09-081-1/+0
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Add i2d_re_X509_tbsEmilia Kasper2014-09-051-0/+2
| | | | | | | i2d_re_X509_tbs re-encodes the TBS portion of the certificate. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Dr Stephen Henson <steve@openssl.org>
* NETSCAPE_SPKI_b64_encode: free der_spki and b64_str on error pathJonas Maebe2014-08-171-0/+4
| | | | | Signed-off-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* get_cert_by_subject: check for NULL when allocating hentJonas Maebe2014-08-171-0/+7
| | | | | Signed-off-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-23 01:52:13 +0000