aboutsummaryrefslogtreecommitdiff
path: root/crypto/x509/x509_vpm.c
AgeCommit message (Collapse)AuthorFilesLines
2018-12-06Following the license change, modify the boilerplates in crypto/x509/Richard Levitte1-1/+1
[skip ci] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7824)
2018-08-07Harmonize use of sk_TYPE_find's return value.Andy Polyakov1-5/+4
In some cases it's about redundant check for return value, in some cases it's about replacing check for -1 with comparison to 0. Otherwise compiler might generate redundant check for <-1. [Even formatting and readability fixes.] Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6860)
2018-05-02Make X509_VERIFY_PARAM_get_hostflags() take a const argMatt Caswell1-1/+1
Commit 5b748dea5 added this function which should have taken a const argument. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6154)
2018-05-01Add getter for X509_VERIFY_PARAM_get_hostflagsMatt Caswell1-0/+5
Fixes #5061 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6139)
2018-05-01Update copyright yearMatt Caswell1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6145)
2018-04-24Add missing malloc-return-null instanceRich Salz1-5/+4
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6071)
2017-09-29Remove unnecessary #include <openssl/lhash.h> directives.Pauli1-2/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4431)
2017-01-12GH2176: Add X509_VERIFY_PARAM_get_timeRich Salz1-0/+5
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2208)
2016-12-13Add X509_VERIFY_PARAM inheritance flag set/getRich Salz1-0/+11
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2079)
2016-11-09Simplify and clean X509_VERIFY_PARAM new/free code.FdaSilvaYY1-30/+13
Split x509_verify_param_zero code to the right place Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-09-21Revert "Constify code about X509_VERIFY_PARAM"Rich Salz1-2/+2
This reverts commit 81f9ce1e1965e0e33db6d2391285c4c1b6af0434. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-09-18Constify code about X509_VERIFY_PARAMFdaSilvaYY1-2/+2
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1594)
2016-06-09Make a2i_ipadd an internal functionRich Salz1-0/+1
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-08crypto/x509/x509_vpm.c: Simplify int_x509_param_set1()Kurt Cancemi1-6/+5
This change also avoids calling strlen twice when srclen is 0 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-05-17Copyright consolidation 09/10Rich Salz1-54/+5
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-03Move peer chain security checks into x509_vfy.cViktor Dukhovni1-0/+17
A new X509_VERIFY_PARAM_set_auth_level() function sets the authentication security level. For verification of SSL peers, this is automatically set from the SSL security level. Otherwise, for now, the authentication security level remains at (effectively) 0 by default. The new "-auth_level" verify(1) option is available in all the command-line tools that support the standard verify(1) options. New verify(1) tests added to check enforcement of chain signature and public key security levels. Also added new tests of enforcement of the verify_depth limit. Updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31Check chain extensions also for trusted certificatesViktor Dukhovni1-3/+3
This includes basic constraints, key usages, issuer EKUs and auxiliary trust OIDs (given a trust suitably related to the intended purpose). Added tests and updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-26Remove /* foo.c */ commentsRich Salz1-1/+0
This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-16Empty SNI names are not validViktor Dukhovni1-2/+2
While empty inputs to SSL_set1_host() clear the reference identifier list. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-05DANE support structures, constructructors and accessorsViktor Dukhovni1-0/+18
Also tweak some of the code in demos/bio, to enable interactive testing of BIO_s_accept's use of SSL_dup. Changed the sconnect client to authenticate the server, which now exercises the new SSL_set1_host() function. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-16Rename some BUF_xxx to OPENSSL_xxxRich Salz1-4/+4
Rename BUF_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} to OPENSSL_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} Add #define's for the old names. Add CRYPTO_{memdup,strndup}, called by OPENSSL_{memdup,strndup} macros. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-11-26Remove X509_VERIFY_PARAM_IDDr. Stephen Henson1-56/+38
Now that X509_VERIFY_PARAM is opaque X509_VERIFY_PARAM_ID is no longer needed. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-11-09Continue standardising malloc style for libcryptoMatt Caswell1-4/+4
Continuing from previous commit ensure our style is consistent for malloc return checks. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-09-02Add and use OPENSSL_zallocRich Salz1-12/+2
There are many places (nearly 50) where we malloc and then memset. Add an OPENSSL_zalloc routine to encapsulate that. (Missed one conversion; thanks Richard) Also fixes GH328 Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-09-02Better handling of verify param id peername fieldViktor Dukhovni1-1/+9
Initialize pointers in param id by the book (explicit NULL assignment, rather than just memset 0). In x509_verify_param_zero() set peername to NULL after freeing it. In x509_vfy.c's internal check_hosts(), avoid potential leak of possibly already non-NULL peername. This is only set when a check succeeds, so don't need to do this repeatedly in the loop. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-14Identify and move common internal libcrypto header filesRichard Levitte1-1/+1
There are header files in crypto/ that are used by a number of crypto/ submodules. Move those to crypto/include/internal and adapt the affected source code and Makefiles. The header files that got moved are: crypto/cryptolib.h crypto/md32_common.h Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-04Use safer sizeof variant in mallocRich Salz1-4/+4
For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-04Fix cut/paste errorRich Salz1-1/+1
Was memset with wrong sizeof. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-03Add OSSL_NELEM macro.Dr. Stephen Henson1-5/+3
Add OSSL_NELEM macro to e_os.h to determine the number of elements in an array. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-02RT3776: Wrong size for mallocRich Salz1-4/+4
Use sizeof *foo parameter, to avoid these errors. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-05-01free NULL cleanup -- codaRich Salz1-9/+5
After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-01free null cleanup finaleRich Salz1-17/+9
Don't check for NULL before calling OPENSSL_free Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30free NULL cleanup 5aRich Salz1-3/+3
Don't check for NULL before calling a free routine. This gets X509_.*free: x509_name_ex_free X509_policy_tree_free X509_VERIFY_PARAM_free X509_STORE_free X509_STORE_CTX_free X509_PKEY_free X509_OBJECT_free_contents X509_LOOKUP_free X509_INFO_free Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30free NULL cleanup 8Rich Salz1-10/+6
Do not check for NULL before calling a free routine. This addresses: ASN1_BIT_STRING_free ASN1_GENERALIZEDTIME_free ASN1_INTEGER_free ASN1_OBJECT_free ASN1_OCTET_STRING_free ASN1_PCTX_free ASN1_SCTX_free ASN1_STRING_clear_free ASN1_STRING_free ASN1_TYPE_free ASN1_UTCTIME_free M_ASN1_free_of Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-11X509_VERIFY_PARAM_free: Check param for NULLKurt Roeckx1-0/+2
Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org>
2015-01-22Run util/openssl-format-source -v -c .Matt Caswell1-494/+466
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-30mark all block comments that need format preserving so thatTim Hudson1-1/+2
indent will not alter them when reformatting comments Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2014-07-07Update API to use (char *) for email addresses and hostnamesViktor Dukhovni1-14/+16
Reduces number of silly casts in OpenSSL code and likely most applications. Consistent with (char *) for "peername" value from X509_check_host() and X509_VERIFY_PARAM_get0_peername().
2014-07-06New peername element in X509_VERIFY_PARAM_IDViktor Dukhovni1-1/+8
Declaration, memory management, accessor and documentation.
2014-06-22Multiple verifier reference identities.Viktor Dukhovni1-8/+83
Implemented as STACK_OF(OPENSSL_STRING).
2014-06-22Drop hostlen from X509_VERIFY_PARAM_ID.Viktor Dukhovni1-5/+3
Just store NUL-terminated strings. This works better when we add support for multiple hostnames.
2014-05-25Rename vpm_int.h to x509_lcl.hDr. Stephen Henson1-1/+1
2014-05-21Fixes to host checking.Viktor Dukhovni1-1/+8
Fixes to host checking wild card support and add support for setting host checking flags when verifying a certificate chain.
2013-12-13Add opaque ID structure.Dr. Stephen Henson1-27/+61
Move the IP, email and host checking fields from the public X509_VERIFY_PARAM structure into an opaque X509_VERIFY_PARAM_ID structure. By doing this the structure can be modified in future without risk of breaking any applications. (cherry picked from commit adc6bd73e3bd10ce6e76867482e8d137071298d7) Conflicts: crypto/x509/x509_vpm.c
2012-12-05Integrate host, email and IP address checks into X509_verify.Dr. Stephen Henson1-0/+97
Add new verify options to set checks. Remove previous -check* commands from s_client and s_server.
2010-02-25verify parameter enumeration functionsDr. Stephen Henson1-0/+21
2009-06-30Update from 1.0.0-stableDr. Stephen Henson1-1/+5
2009-03-15Fix from stable branch.Dr. Stephen Henson1-2/+13
2009-02-16PR: 1778Dr. Stephen Henson1-1/+1
Increase default verify depth to 100.
2008-11-05Update obsolete email address...Dr. Stephen Henson1-1/+1
generated by cgit v1.1 at 2024-07-13 21:06:39 +0000