aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/x509
Commit message (Collapse)AuthorAgeFilesLines
* Remove /* foo.c */ commentsRich Salz2016-01-2635-35/+0
| | | | | | | | | | | | This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Reject when explicit trust EKU are set and none match.Viktor Dukhovni2016-01-201-0/+15
| | | | | | | | | | | | | | | Returning untrusted is enough for for full chains that end in self-signed roots, because when explicit trust is specified it suppresses the default blanket trust of self-signed objects. But for partial chains, this is not enough, because absent a similar trust-self-signed policy, non matching EKUs are indistinguishable from lack of EKU constraints. Therefore, failure to match any trusted purpose must trigger an explicit reject. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Check Suite-B constraints with EE DANE recordsViktor Dukhovni2016-01-202-28/+46
| | | | | | | | | | | | | | When DANE-EE(3) matches or either of DANE-EE/PKIX-EE fails, we don't build a chain at all, but rather succeed or fail with just the leaf certificate. In either case also check for Suite-B violations. As unlikely as it may seem that anyone would enable both DANE and Suite-B, we should do what the application asks. Took the opportunity to eliminate the "cb" variables in x509_vfy.c, just call ctx->verify_cb(ok, ctx) Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Remove update tagsRich Salz2016-01-201-2/+0
| | | | | Also remove depend/local_depend. Reviewed-by: Richard Levitte <levitte@openssl.org>
* make EVP_PKEY opaqueDr. Stephen Henson2016-01-203-5/+5
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Drop cached certificate signature validity flagViktor Dukhovni2016-01-182-6/+1
| | | | | | | | | | It seems risky in the context of cross-signed certificates when the same certificate might have multiple potential issuers. Also rarely used, since chains in OpenSSL typically only employ self-signed trust-anchors, whose self-signatures are not checked, while untrusted certificates are generally ephemeral. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Remove some old makefile targetsRich Salz2016-01-171-12/+0
| | | | | | | | Remove lint, tags, dclean, tests. This is prep for a new makedepend scheme. This is temporary pending unified makefile, and might help it. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Empty SNI names are not validViktor Dukhovni2016-01-161-2/+2
| | | | | | | While empty inputs to SSL_set1_host() clear the reference identifier list. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add lookup_certs for a trusted stack.Dr. Stephen Henson2016-01-151-0/+21
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Cosmetic polish for last-resort depth 0 checkViktor Dukhovni2016-01-141-5/+5
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix last-resort depth 0 check when the chain has multiple certificatesViktor Dukhovni2016-01-141-4/+9
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Always initialize X509_STORE_CTX get_crl pointerViktor Dukhovni2016-01-141-0/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Move Makefiles to Makefile.inRich Salz2016-01-122-587/+75
| | | | | | | | | | Create Makefile's from Makefile.in Rename Makefile.org to Makefile.in Rename Makefiles to Makefile.in Address review feedback from Viktor and Richard Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* make updateRichard Levitte2016-01-121-303/+364
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* mem functions cleanupRich Salz2016-01-071-9/+10
| | | | | | | | | | | | | | | | | Only two macros CRYPTO_MDEBUG and CRYPTO_MDEBUG_ABORT to control this. If CRYPTO_MDEBUG is not set, #ifdef out the whole debug machinery. (Thanks to Jakob Bohm for the suggestion!) Make the "change wrapper functions" be the only paradigm. Wrote documentation! Format the 'set func' functions so their paramlists are legible. Format some multi-line comments. Remove ability to get/set the "memory debug" functions at runtme. Remove MemCheck_* and CRYPTO_malloc_debug_init macros. Add CRYPTO_mem_debug(int flag) function. Add test/memleaktest. Rename CRYPTO_malloc_init to OPENSSL_malloc_init; remove needless calls. Reviewed-by: Richard Levitte <levitte@openssl.org>
* DANE support for X509_verify_cert()Viktor Dukhovni2016-01-072-9/+401
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Only declare stacks in headersDr. Stephen Henson2016-01-073-10/+13
| | | | | | | Don't define stacks in C source files: it causes warnings about unused functions in some compilers. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Rename DECLARE*STACK_OF to DEFINE*STACK_OFDr. Stephen Henson2016-01-072-3/+3
| | | | | | | | | | Applications wishing to include their own stacks now just need to include DEFINE_STACK_OF(foo) in a header file. Reviewed-by: Richard Levitte <levitte@openssl.org>
* DANE support structures, constructructors and accessorsViktor Dukhovni2016-01-052-0/+25
| | | | | | | | | Also tweak some of the code in demos/bio, to enable interactive testing of BIO_s_accept's use of SSL_dup. Changed the sconnect client to authenticate the server, which now exercises the new SSL_set1_host() function. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix X509_STORE_CTX_cleanup()Viktor Dukhovni2016-01-031-17/+21
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Drop incorrect id == -1 case from X509_check_trustViktor Dukhovni2016-01-031-2/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* X509_verify_cert() cleanupViktor Dukhovni2016-01-032-343/+397
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Use X509_get0_pubkey where appropriateDr. Stephen Henson2015-12-313-6/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Rename some BUF_xxx to OPENSSL_xxxRich Salz2015-12-162-5/+5
| | | | | | | | | Rename BUF_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} to OPENSSL_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} Add #define's for the old names. Add CRYPTO_{memdup,strndup}, called by OPENSSL_{memdup,strndup} macros. Reviewed-by: Tim Hudson <tjh@openssl.org>
* New function X509_get0_pubkeyDr. Stephen Henson2015-12-144-24/+18
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* make updateDr. Stephen Henson2015-12-091-50/+16
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Cleanup: fix all sources that used EVP_MD_CTX_(create|init|destroy)Richard Levitte2015-12-071-4/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Adjust all accesses to EVP_MD_CTX to use accessor functions.Richard Levitte2015-12-071-14/+17
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* ex_data part 2: doc fixes and CRYPTO_free_ex_index.Rich Salz2015-12-012-20/+0
| | | | | | | | | | Add CRYPTO_free_ex_index (for shared libraries) Unify and complete the documentation for all "ex_data" API's and objects. Replace xxx_get_ex_new_index functions with a macro. Added an exdata test. Renamed the ex_data internal datatypes. Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove X509_VERIFY_PARAM_IDDr. Stephen Henson2015-11-263-73/+49
| | | | | | | Now that X509_VERIFY_PARAM is opaque X509_VERIFY_PARAM_ID is no longer needed. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove useless locking codeAlessandro Ghedini2015-11-241-2/+0
| | | | | | | | | Follow-up to 070c233. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@akamai.com> GH: #454
* Fix a few missed "if (!ptr)" cleanupsRich Salz2015-11-231-3/+2
| | | | | And a scalar !x --> x==0 test Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Patch containing TLS implementation for GOST 2012Dmitry Belyavsky2015-11-231-0/+2
| | | | | | | | This patch contains the necessary changes to provide GOST 2012 ciphersuites in TLS. It requires the use of an external GOST 2012 engine. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* make updateRichard Levitte2015-11-171-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Use accessors for X509_print_ex().Dr. Stephen Henson2015-11-143-148/+85
| | | | | | | | | | | Print certificate details using accessor functions. Since X509_CERT_AUX_print is only used in one place and can't be used by applications (it uses an internal X509_CERT_AUX structure) this has been removed and replaced by a function X509_aux_print which takes an X509 pointer instead. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add new X509 accessorsDr. Stephen Henson2015-11-142-0/+37
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Continue standardising malloc style for libcryptoMatt Caswell2015-11-097-23/+28
| | | | | | | Continuing from previous commit ensure our style is consistent for malloc return checks. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Rebuild error source files.Dr. Stephen Henson2015-11-051-6/+6
| | | | | | | Rebuild error source files: the new mkerr.pl functionality will now pick up and translate static function names properly. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove useless codeAlessandro Ghedini2015-10-232-3/+0
| | | | | | | RT#4081 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* embed CRL serial number and signature fieldsDr. Stephen Henson2015-10-154-21/+16
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* embed certificate serial number and signature fieldsDr. Stephen Henson2015-10-155-22/+18
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* embed value field of X509_EXTENSIONDr. Stephen Henson2015-10-153-4/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix more d2i cases to properly update the input pointerKurt Roeckx2015-10-031-3/+1
| | | | | | | Thanks to David Benjamin <davidben@google.com> for pointing them out. Reviewed-by: Steve Henson <steve@openssl.org> MR #1198
* Remove BIO_s_file_internal macro.Rich Salz2015-10-021-2/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix no-stdio buildDavid Woodhouse2015-09-293-7/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Much related/similar work also done by Ivan Nestlerode <ivan.nestlerode@sonos.com> +Replace FILE BIO's with dummy ops that fail. +Include <stdio.h> for sscanf() even with no-stdio (since the declaration is there). We rely on sscanf() to parse the OPENSSL_ia32cap environment variable, since it can be larger than a 'long'. And we don't rely on the availability of strtoull(). +Remove OPENSSL_stderr(); not used. +Make OPENSSL_showfatal() do nothing (currently without stdio there's nothing we can do). +Remove file-based functionality from ssl/. The function prototypes were already gone, but not the functions themselves. +Remove unviable conf functionality via SYS_UEFI +Add fallback definition of BUFSIZ. +Remove functions taking FILE * from header files. +Add missing DECLARE_PEM_write_fp_const +Disable X509_LOOKUP_hash_dir(). X509_LOOKUP_file() was already compiled out, so remove its prototype. +Use OPENSSL_showfatal() in CRYPTO_destroy_dynlockid(). +Eliminate SRP_VBASE_init() and supporting functions. Users will need to build the verifier manually instead. +Eliminate compiler warning for unused do_pk8pkey_fp(). +Disable TEST_ENG_OPENSSL_PKEY. +Disable GOST engine as is uses [f]printf all over the place. +Eliminate compiler warning for unused send_fp_chars(). Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Tim Hudson <tjh@openssl.org>
* make updateDr. Stephen Henson2015-09-221-11/+10
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* header includesDr. Stephen Henson2015-09-223-9/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix path in commentsDr. Stephen Henson2015-09-227-7/+7
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* make dependDr. Stephen Henson2015-09-221-0/+117
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Move certificate request and CRL routines to x509 dir.Dr. Stephen Henson2015-09-2210-2/+1928
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-12 21:32:51 +0000