aboutsummaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* Restrict digest algorithm used in KDFspohsingwu11 days1-1/+49
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23889)
* open brace '{' following struct go on the same lineDimitri Papadopoulos12 days1-2/+1
| | | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22097)
* that open brace { should be on the previous lineDimitri Papadopoulos12 days1-5/+3
| | | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22097)
* Remove trailing whitespaceDimitri Papadopoulos12 days4-5/+5
| | | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22097)
* fix: style nitsRichard Levitte13 days2-37/+36
| | | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/24854)
* fix: refactor the EVP_PKEY_OP checksRichard Levitte13 days2-15/+21
| | | | | | | | | | | | | | | | | | | | | | | | On the one hand, we have public macros that are collections of EVP_PKEY_OP bits, like EVP_PKEY_OP_TYPE_SIG, obviously meant to be used like this: if ((ctx->operation & EVP_PKEY_OP_TYPE_SIG) == 0) ... On the other hand, we also have internal test macros, like EVP_PKEY_CTX_IS_SIGNATURE_OP(), obviously meant to be used like this: if (EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx)) ... Unfortunately, these two sets of macros were completely separate, forcing developers to keep them both sync, manually. This refactor makes the internal macros use the corresponding public macros, and adds the missing public macros, for consistency. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/24854)
* Add an OPENSSL_strtoul wrapperNeil Horman2024-07-181-0/+1
| | | | | | | | utility function to give us sane checking on strtoul conversions Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24861)
* riscv: Fix cpuid_obj asm checks for sm4/sm3Hongren Zheng2024-07-121-1/+1
| | | | | | | | Similar to #22881 / #23752 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/24486)
* fix: drop DSA <=> dsaWithSHA1 aliasingRichard Levitte2024-07-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | For some reason, DSA has been aliased with dsaWithSHA1 for an eternity. They are not the same, though, and should never have been aliased in the first place. This was first discovered with 'openssl list': $ openssl list -signature-algorithms ... { 1.2.840.10040.4.1, 1.2.840.10040.4.3, 1.3.14.3.2.12, 1.3.14.3.2.13, 1.3.14.3.2.27, DSA, DSA-old, DSA-SHA, DSA-SHA1, DSA-SHA1-old, dsaEncryption, dsaEncryption-old, dsaWithSHA, dsaWithSHA1, dsaWithSHA1-old } @ default This isn't good at all, as it confuses the key algorithms signature function with a signature scheme that involves SHA1, and it makes it look like OpenSSL's providers offer a DSA-SHA1 implementation (which they currently do not do). Breaking this aliasing apart (i.e. aliasing DSA, DSA-old, dsaEncryption and dsaEncryption-old separately from the names that involve SHA) appears harmless as far as OpenSSL's test suite goes. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24828)
* Add FIPS indicator callback.slontis2024-07-114-1/+40
| | | | | | | | | | | | | | | | Add a FIPS indicator callback that can be set via OSSL_INDICATOR_set_callback(). This callback is intended to be run whenever a non approved algorithm check has occurred and strict checking has been disabled.The callback may be used to log non approved algorithms. The callback is passed a type and description string as well as the cbarg specified in OSSL_INDICATOR_set_callback. The return value can be either 0 or 1. A value of 0 can be used for testing purposes to force an error to occur from the algorithm that called the callback. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24623)
* add X509v3_add_extensions()Dr. David von Oheimb2024-07-101-0/+3
| | | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24792)
* refactor and constify X509_REQ_get_extensions()Dr. David von Oheimb2024-07-102-1/+7
| | | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24792)
* constify ossl_x509at_add1_attr()Dr. David von Oheimb2024-07-101-1/+1
| | | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24792)
* Extend TLSv1.3 record layer padding API callsStephen Farrell2024-07-101-1/+4
| | | | | | | | | | Added SSL_set_block_padding_ex() and SSL_CTX_set_block_padding_ex() to allow separate padding block size values for handshake messages and application data messages. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24796)
* Replace and Deprecate TS_VERIFY_CTX Functionserbsland-dev2024-07-101-0/+17
| | | | | | | | | | | | | | | | | | | | Fixes #18854 Replace and deprecate the functions `TS_VERIFY_CTX_set_data`, `TS_VERIFY_CTX_set_store`, `TS_VERIFY_CTX_set_certs`, `TS_VERIFY_CTX_set_imprint` with new versions: `TS_VERIFY_CTX_set0_data`, `TS_VERIFY_CTX_set0_store`, `TS_VERIFY_CTX_set0_certs` and `TS_VERIFY_CTX_set0_imprint`. The previous functions had poorly documented memory handling, potentially leading to memory leaks. The new functions improve memory management and provide clearer usage. Also, update existing code to use the new function calls instead of the deprecated ones. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24701)
* Change WININSTALLCONTEXT to OSSL_WINCTXNeil Horman2024-07-091-1/+1
| | | | | | | | Make it more in line with other command line defines, and a bit shorter Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24450)
* convert users of build time defaults to use new defaults apiNeil Horman2024-07-091-0/+1
| | | | | | | | | | | | | | | | Now that we can query for install time registry keys on windows, convert users of these macros to use the api instead Add a unit test to validate the functionality of our reg key lookups Add a test to check to make sure our registry key lookups work. note this test only runs on windows (clearly), but also only if the registry keys are set via an installer or some other manual process (to be done in the CI workflow) Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24450)
* Add defaults api to openssl buildNeil Horman2024-07-091-0/+5
| | | | | | | | | | | | | | | | Build time defaults aren't great for windows, in which various macros (like OPENSSLDIR) are selected at build time, but may be selected differently at install time. Add an internal defaults api to return the build time constants on unix systems, but instead query registry keys for the form: HLKM\SOFTWARE\OpenSSL-{version}-{wininstallcontext} Such that each built version of openssl may maintain its own set of registry keys to identify these locations, and be set administratiely as appropriate at install or run time Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24450)
* feat: support userNotice X.509v3 extensionJonathan M. Wilbur2024-07-041-2/+9
| | | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24761)
* threads_win: fix build error with VS2010 x86Georgi Valkov2024-07-011-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | InterlockedAnd64 and InterlockedAdd64 are not available on VS2010 x86. We already have implemented replacements for other functions, such as InterlockedOr64. Apply the same approach to fix the errors. A CRYPTO_RWLOCK rw_lock is added to rcu_lock_st. Replace InterlockedOr64 and InterlockedOr with CRYPTO_atomic_load and CRYPTO_atomic_load_int, using the existing design pattern. Add documentation and tests for the new atomic functions CRYPTO_atomic_add64, CRYPTO_atomic_and Fixes: libcrypto.lib(libcrypto-lib-threads_win.obj) : error LNK2019: unresolved external symbol _InterlockedAdd64 referenced in function _get_hold_current_qp libcrypto.lib(libcrypto-lib-threads_win.obj) : error LNK2019: unresolved external symbol _InterlockedOr referenced in function _get_hold_current_qp libcrypto.lib(libcrypto-lib-threads_win.obj) : error LNK2019: unresolved external symbol _InterlockedAnd64 referenced in function _update_qp libcrypto.lib(libcrypto-lib-threads_win.obj) : error LNK2019: unresolved external symbol _InterlockedOr64 referenced in function _ossl_synchronize_rcu Signed-off-by: Georgi Valkov <gvalkov@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24405)
* Support subjectDirectoryAttributes and associatedInformation extsJonathan M. Wilbur2024-06-242-0/+9
| | | | | | | | | Added tests for SDA and AI extensions. Added internal function ossl_print_attribute_value() with documentation. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24669)
* Add Version Check for CSR Verificationerbsland-dev2024-06-211-1/+2
| | | | | | | | | | Fixes #5738: This change introduces a check for the version number of a CSR document before its signature is verified. If the version number is not 1 (encoded as zero), the verification function fails with an `X509_R_UNSUPPORTED_VERSION` error. To minimize impact, this check is only applied when verifying a certificate signing request using the `-verify` argument, resulting in a `X509_REQ_verify` call. This ensures that malformed certificate requests are rejected by a certification authority, enhancing security and preventing potential issues. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24677)
* Fix handling of max_fragment_length extension for PSKFrederik Wedel-Heinen2024-06-201-0/+2
| | | | | | | | | | | | | | | A psk session was assumed to be a resumption which failed a check when parsing the max_fragment_length extension hello from the client. Relevant code from PR#18130 which was a suggested fix to the issue was cherry-picked. Fixes #18121 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24513)
* CMP: add support for requesting cert template using genm/genpRajeev Ranjan2024-06-204-0/+90
| | | | | | Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24409)
* Add support for targetingInformation X.509v3 extensionJonathan M. Wilbur2024-06-173-0/+42
| | | | | | | | | | Support for the targetingInformation X.509v3 extension defined in ITU-T Recommendation X.509 (2019), Section 17.1.2.2. This extension is used in attribute certificates. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22206)
* Allow group methods to customize initialization for speedWatson Ladd2024-06-051-0/+6
| | | | | | | | | | | This commit also adds an implementation for P256 that avoids some expensive initialization of Montgomery arithmetic structures in favor of precomputation. Since ECC groups are not always cached by higher layers this brings significant savings to TLS handshakes. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22746)
* enable AES-XTS optimization for AIXsanumesh2024-05-301-1/+3
| | | | | | | Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24518)
* uefi: add typedef for uintptr_tGerd Hoffmann2024-05-301-0/+1
| | | | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24459)
* ssl_sess.c: deprecate SSL_SESSION_get_time/SSL_SESSION_set_timeAlexander Kanavin2024-05-301-0/+5
| | | | | | | | | | | | | | Adjust the manpages at the same time so that only the new functions are being presented. Fixes: #23648 Signed-off-by: Alexander Kanavin <alex@linutronix.de> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24307)
* ssl_sess.c: deprecate SSL_CTX_flush_sessions in favour of _ex() replacementAlexander Kanavin2024-05-301-0/+4
| | | | | | | | | | | | The original function is using long for time and is therefore not Y2038-safe. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24307)
* include/openssl/macros.h: define deprecation macros for 3.4Alexander Kanavin2024-05-301-0/+12
| | | | | | | | | Signed-off-by: Alexander Kanavin <alex@linutronix.de> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24307)
* Move stack of compression methods from libssl to OSSL_LIB_CTXsashan2024-05-285-14/+39
| | | | | | | | | | | The compression methods are now a global variable in libssl. This change moves it into OSSL library context. It is necessary to eliminate atexit call from libssl. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24414)
* When defining ossl_ssize_t = ssize_t, remember to include sys/types.hRichard Levitte2024-05-221-0/+1
| | | | | | | | | ssize_t isn't a C language type in any C language level, but is a POSIX type defined in <sys/types.h>, so make sure to include that before use. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24173)
* Optimizated calculation of shared power of 2 in bn_gcdAndrew Golovashevich2024-05-151-0/+18
| | | | | | | Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24332)
* Intentionally break EVP_DigestFinal for SHAKE128 and SHAKE256Tomas Mraz2024-05-151-2/+2
| | | | | | | | It will work only if OSSL_DIGEST_PARAM_XOFLEN is set. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/24105)
* Add support for integrity-only cipher suites for TLS v1.3Rajeev Ranjan2024-05-141-0/+6
| | | | | | | | | | | | | | | | | | - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
* Add reason codes with the correct offset for two alertsJacob Champion2024-05-141-0/+2
| | | | | | | | | | | | Fixes #24300. The current values of SSL_R_NO_APPLICATION_PROTOCOL and SSL_R_PSK_IDENTITY_NOT_FOUND don't allow for a correct lookup of the corresponding reason strings. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24351)
* Typo fixeswillmafh2024-05-131-1/+1
| | | | | | | | | | and an addition of an empty line to follow the code style CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23721)
* riscv: use hwprobe syscall for capability detectionHongren Zheng2024-05-092-33/+74
| | | | | | Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24172)
* Do not use bit fields for context data flag variablesTomas Mraz2024-05-091-1/+1
| | | | | | Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24275)
* Make conf_diagnostics apply also to the SSL conf errorsTomas Mraz2024-05-092-0/+3
| | | | | | Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24275)
* Move ossl_asn1_string_to_time_t() to libtestutilshridhar kalavagunta2024-05-071-1/+0
| | | | | | | | | | | It is not used anywhere else than in tests. Fixes #22965 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23269)
* Rename BN_generate_dsa_nonce() to ossl_bn_gen_dsa_nonce_fixed_top()Tomas Mraz2024-05-021-0/+4
| | | | | | | | | | | | And create a new BN_generate_dsa_nonce() that corrects the BIGNUM top. We do this to avoid leaking fixed top numbers via the public API. Also add a slight optimization in ossl_bn_gen_dsa_nonce_fixed_top() and make it LE/BE agnostic. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265)
* Add ossl_bn_priv_rand_range_fixed_top() and use it for EC/DSATomas Mraz2024-05-021-0/+2
| | | | | | Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265)
* Make ossl_gen_deterministic_nonce_rfc6979() constant timeTomas Mraz2024-05-022-0/+13
| | | | | | Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265)
* Make BN_generate_dsa_nonce() constant time and non-biasedTomas Mraz2024-05-021-0/+12
| | | | | | | | Co-authored-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265)
* CMP: add support for genm with crlStatusList and genp with crlsDr. David von Oheimb2024-05-013-1/+33
| | | | | | | | | | | | | | | | Introduce the capability to retrieve and update Certificate Revocation Lists (CRLs) in the CMP client, as specified in section 4.3.4 of RFC 9483. To request a CRL update, the CMP client can send a genm message with the option -infotype crlStatusList. The server will respond with a genp message containing the updated CRL, using the -infoType id-it-crls. The client can then save the CRL in a specified file using the -crlout parameter. Co-authored-by: Rajeev Ranjan <ranjan.rajeev@siemens.com> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23768)
* x509_acert: Load attributes from config file sectionDamian Hobson-Garcia2024-04-241-0/+2
| | | | | | | | | | | Several of the attribute values defined for use by attribute certificates use multi-valued data in an ASN.1 SEQUENCE. Allow reading of these values from a configuration file, similar to how generic X.509 extensions are handled. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15857)
* Add IETFAttrSyntax type supportDamian Hobson-Garcia2024-04-241-0/+27
| | | | | | | | | | | The IETFAtrrSyntax type is used for the values of several attributes defined in RFC 5755 for use with attribute certificates. Specifically this type is used with the "Charging Identity" and "Group" attributes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15857)
* x509_acert: Add and retrieve certificate extensionsDamian Hobson-Garcia2024-04-241-0/+5
| | | | | | | | Add API to manage attribute certificate extensions Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15857)
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-03 17:29:26 +0000