aboutsummaryrefslogtreecommitdiff
path: root/crypto/ocsp
AgeCommit message (Collapse)AuthorFilesLines
2019-10-09Explicitly test against NULL; do not use !p or similarRich Salz2-14/+11
Also added blanks lines after declarations in a couple of places. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9916)
2019-09-28Reorganize local header filesDr. Matthias St. Pierre9-8/+8
Apart from public and internal header files, there is a third type called local header files, which are located next to source files in the source directory. Currently, they have different suffixes like '*_lcl.h', '*_local.h', or '*_int.h' This commit changes the different suffixes to '*_local.h' uniformly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
2019-09-28Reorganize private crypto header filesDr. Matthias St. Pierre1-1/+1
Currently, there are two different directories which contain internal header files of libcrypto which are meant to be shared internally: While header files in 'include/internal' are intended to be shared between libcrypto and libssl, the files in 'crypto/include/internal' are intended to be shared inside libcrypto only. To make things complicated, the include search path is set up in such a way that the directive #include "internal/file.h" could refer to a file in either of these two directoroes. This makes it necessary in some cases to add a '_int.h' suffix to some files to resolve this ambiguity: #include "internal/file.h" # located in 'include/internal' #include "internal/file_int.h" # located in 'crypto/include/internal' This commit moves the private crypto headers from 'crypto/include/internal' to 'include/crypto' As a result, the include directives become unambiguous #include "internal/file.h" # located in 'include/internal' #include "crypto/file.h" # located in 'include/crypto' hence the superfluous '_int.h' suffixes can be stripped. The files 'store_int.h' and 'store.h' need to be treated specially; they are joined into a single file. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
2019-09-12util/mkerr.pl: make it not depend on the function codeRichard Levitte1-1/+1
The output C code was made to use ERR_func_error_string() to see if a string table was already loaded or not. Since this function returns NULL always, this check became useless. Change it to use ERR_reason_error_string() instead, as there's no reason to believe we will get rid of reason strings, ever. To top it off, we rebuild all affected C sources. Fixes #9756 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9756)
2019-07-16Regenerate mkerr filesRich Salz1-31/+2
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9058)
2019-05-29Join the x509 and x509v3 directoriesRichard Levitte1-1/+1
This has been long overdue. Note that this does not join the X509 and X509V3 error modules, that will be too many macro changes at this stage. Fixes #8919 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8925)
2019-05-27OCSP: fix memory leak in OCSP_url_svcloc_new method.FdaSilvaYY1-2/+2
Add a few coverage test case. Fixes #8949 [extended tests] Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8959)
2019-03-28Make OCSP_id_cmp and OCSP_id_issuer_cmp accept const paramsMatt Caswell1-2/+2
Fixes #8589 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8597)
2019-03-06constify *_dup() and *i2d_*() and related functions as far as possible, ↵David von Oheimb1-3/+3
introducing DECLARE_ASN1_DUP_FUNCTION Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8029)
2018-12-06Following the license change, modify the boilerplates in crypto/ocsp/Richard Levitte11-11/+11
[skip ci] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7805)
2018-09-11Update copyright yearMatt Caswell1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7176)
2018-09-03add getter for tbsResponseData and signatureAlgorithm on OCSP_BASICRESPPaul Kehrer1-0/+10
fixes #7081 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7082)
2018-09-03Check for a failure return from EVP_MD_CTX_new() in OCSP_basic_sign().Pauli1-0/+3
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7087)
2018-02-13Update copyright yearMatt Caswell1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org>
2018-02-09Small simplification in mkerr.plFdaSilvaYY1-2/+3
As suggested in https://github.com/openssl/openssl/pull/5275 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5288)
2018-01-24Add documentation for the OCSP_basic_sign() and OCSP_basic_sign_ctx() functions.David Cooper1-1/+1
Correct error return value in OCSP_basic_sign(). Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4190)
2018-01-24Make editorial changes suggested by Matt Caswell and fixed Travis failures.David Cooper1-4/+15
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4190)
2018-01-24Make editorial changes suggested by Rich Salz and add the -rsigopt option to ↵David Cooper1-2/+3
the man page for the ocsp command. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4190)
2018-01-24Add -rsigopt option to ocsp commandDavid Cooper3-5/+28
Add a -rsigopt option to the ocsp command that allows signature parameters to be provided for the signing of OCSP responses. The parameters that may be provided to -rsigopt are the same as may be provided to -sigopt in the ca, req, and x509 commands. This PR also defines a OCSP_basic_sign_ctx() function, which functions in the same way as OCSP_basic_sign(), except that it accepts a EVP_MD_CTX rather than a key and digest. The OCSP_basic_sign_ctx() function is used to implement the -rsigopt option in the ocsp command. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4190)
2017-12-12Fix more OCSP_resp_get0_signer() nitsBen Kaduk1-1/+1
Fix a typo for "retrieve" and some indentation. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4919)
2017-11-11Add an API to get the signer of an OCSP responseBenjamin Kaduk1-0/+9
Add a new function OCSP_resp_get0_signer() that looks in the certs bundled with the response as well as in additional certificates provided as a function argument, returning the certificate that signed the given response (if present). Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4573)
2017-11-07style : fix some if(...FdaSilvaYY1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4457)
2017-11-07Remove 4 broken macros from ocsp.hMatt Caswell1-0/+16
There were 4 macros in ocsp.h that have not worked since 1.1.0 because they attempt to access the internals of an opaque structure. For OCSP_REQUEST_sign() applications should use OCSP_request_sign() instead. For OCSP_BASICRESP_sign() applications should use OCSP_basic_sign() instead. For OCSP_REQUEST_verify() applications should use OCSP_request_verify() instead. For OCSP_BASICRESP_verify() applications should use OCSP_basic_verify() instead. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4635)
2017-10-18Remove parentheses of return.KaoruToda1-17/+17
Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-08-30Move e_os.h to be the very first include.Pauli1-1/+1
cryptilib.h is the second. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4188)
2017-08-22This has been added to avoid the situation where some host ctype.h functionsPauli1-7/+7
return true for characters > 127. I.e. they are allowing extended ASCII characters through which then cause problems. E.g. marking superscript '2' as a number then causes the common (ch - '0') conversion to number to fail miserably. Likewise letters with diacritical marks can also cause problems. If a non-ASCII character set is being used (currently only EBCDIC), it is adjusted for. The implementation uses a single table with a bit for each of the defined classes. These functions accept an int argument and fail for values out of range or for characters outside of the ASCII set. They will work for both signed and unsigned character inputs. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4102)
2017-08-16Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULLDavid von Oheimb1-0/+2
Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-06-27Fix return-value checks in OCSP_resp_get1_id()Benjamin Kaduk1-1/+1
Commit db17e43d882ecde217e1dce4a2b8c76c3ed134bf added the function but would improperly report success if the underlying dup operation failed. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3775)
2017-06-21Add OCSP_resp_get1_id() accessorSascha Steinbiss1-1/+22
Adding a get1 style accessor as brought up in mailing list post https://mta.openssl.org/pipermail/openssl-users/2016-November/004796.html Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1876)
2017-06-07make error tables const and separate header fileRich Salz1-62/+70
Run perltidy on util/mkerr Change some mkerr flags, write some doc comments Make generated tables "const" when genearting lib-internal ones. Add "state" file for mkerr Renerate error tables and headers Rationalize declaration of ERR_load_XXX_strings Fix out-of-tree build Add -static; sort flags/vars for options. Also tweak code output Moved engines/afalg to engines (from master) Use -static flag Standard engine #include's of errors Don't linewrap err string tables unless necessary Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3392)
2017-05-11Fix gcc-7 warnings.Bernd Edlinger1-0/+3
- Mostly missing fall thru comments - And uninitialized value used in sslapitest.c Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3440)
2016-09-22Add OCSP_RESPID_match()Matt Caswell1-1/+27
Add a function for testing whether a given OCSP_RESPID matches with a certificate. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-22Add the ability to set OCSP_RESPID fieldsMatt Caswell1-10/+37
OCSP_RESPID was made opaque in 1.1.0, but no accessors were provided for setting the name/key value for the OCSP_RESPID. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-25Fix an uninitialised read on an error pathMatt Caswell1-1/+1
Found by Coverity. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-23Constify some inputs buffersFdaSilvaYY1-2/+2
remove useless cast to call ASN1_STRING_set Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-23Check for error return from ASN1_object_sizeMatt Caswell1-0/+3
Otherwise we try to malloc a -1 size. Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-08-19Add X509_get0_serialNumber() and constify OCSP_cert_to_id()Dr. Stephen Henson1-6/+7
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-17Convert OCSP* functions to use const gettersMatt Caswell1-5/+3
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
2016-08-05spelling fixes, just comments and readme.klemens1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1413)
2016-08-04Constify some ASN1_OBJECT *obj input parametersFdaSilvaYY1-4/+5
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-30Ignore the serial number for now and just do the rest.Richard J. Moore1-2/+2
Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1367)
2016-07-30Make some more X509 functions const.Richard J. Moore1-2/+2
Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1367)
2016-07-20Check for errors allocating the error strings.Kurt Roeckx1-1/+2
Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #1330
2016-07-20OCSP_request_add0_id() inconsistent error returnTodd Short1-1/+3
There are two failure cases for OCSP_request_add_id(): 1. OCSP_ONEREQ_new() failure, where |cid| is not freed 2. sk_OCSP_ONEREQ_push() failure, where |cid| is freed This changes makes the error behavior consistent, such that |cid| is not freed when sk_OCSP_ONEREQ_push() fails. OpenSSL only takes ownership of |cid| when the function succeeds. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1289)
2016-07-13Add OCSP accessors.Dr. Stephen Henson1-0/+23
RT#4605 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-05Add checks on sk_TYPE_push() returned valueFdaSilvaYY1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-18Useless header include of openssl/rand.hFdaSilvaYY3-3/+0
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1168)
2016-06-02Tidy up OCSP print handling.Dr. Stephen Henson1-8/+11
Also fixes -Wstrict-oveflow warning on this file. RT#4474 (partial) Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-23Remove unused error/function codes.Rich Salz1-15/+1
Add script to find unused err/reason codes Remove unused reason codes. Remove entries for unused functions Reviewed-by: Matt Caswell <matt@openssl.org>
2016-05-17Manual fixes after copyright consolidationRich Salz1-51/+6
Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.1 at 2024-07-14 08:14:32 +0000