aboutsummaryrefslogtreecommitdiff
path: root/crypto/x509v3/v3_purp.c
AgeCommit message (Collapse)AuthorFilesLines
2019-05-29Join the x509 and x509v3 directoriesRichard Levitte1-909/+0
This has been long overdue. Note that this does not join the X509 and X509V3 error modules, that will be too many macro changes at this stage. Fixes #8919 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8925)
2018-12-19X509_check_issued: check that signature algo matches signing key algoRichard Levitte1-2/+21
This implements 3.5.18 "Consistent Public Key and Signature Algorithms" from RFC 4158 "Internet X.509 Public Key Infrastructure: Certification Path Building" Ref: https://tools.ietf.org/html/rfc4158#section-3.5.18 Fixes #7899 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7919)
2018-12-06Following the license change, modify the boilerplates in crypto/x509v3/Richard Levitte1-1/+1
[skip ci] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7825)
2018-08-26x509v3/v3_purp.c: refine lock-free check in x509v3_cache_extensions.Andy Polyakov1-6/+10
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6996)
2018-08-07x509v3/v3_purp.c: re-implement lock-free check for extensions cache validity.Andy Polyakov1-0/+11
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6786)
2018-08-07x509v3/v3_purp.c: resolve Thread Sanitizer nit.Andy Polyakov1-4/+0
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6786)
2018-08-07Harmonize use of sk_TYPE_find's return value.Andy Polyakov1-3/+4
In some cases it's about redundant check for return value, in some cases it's about replacing check for -1 with comparison to 0. Otherwise compiler might generate redundant check for <-1. [Even formatting and readability fixes.] Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6860)
2018-05-03v3_purp.c: add locking to x509v3_cache_extensions()Dr. Matthias St. Pierre1-10/+14
Fixes #6121 Thanks to Mingtao Yang for reporting this bug. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6162)
2018-02-27Update copyright yearMatt Caswell1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org>
2018-02-19 Add X509_get0_authority_key_id() functionMassimiliano Pala1-0/+7
This function makes it easier to retrieve a reference to the authority key identifier (akid->keyid) inside a certificate. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5271)
2017-04-25Add support for custom signature parametersDr. Stephen Henson1-0/+1
Many signature types define the digest and public key type by a single OID such as ecdsa_with_sha256. Some types (RSA-PSS for example) use a single OID to indicate the signature scheme and additional parameters are encoded in the AlgorithmIdentifier. Add an X509_SIG_INFO structure to contain details about the signature type: specifically the digest algorithm, public key algorithm, security bits and various flags. This supports both existing algorithms and more complex types. Add accessors for the structure and a special case that retrieves signature information from a certificate. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3301)
2017-03-31Fix for #2730. Add CRLDP extension to list of supported extensionsJon Spillett1-0/+1
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3087)
2016-07-25Make it possible for external code to set the certiciate proxy path lengthRichard Levitte1-0/+14
This adds the functions X509_set_proxy_pathlen(), which sets the internal pc path length cache for a given X509 structure, along with X509_get_proxy_pathlen(), which retrieves it. Along with the previously added X509_set_proxy_flag(), this provides the tools needed to manipulate all the information cached on proxy certificates, allowing external code to do what's necessary to have them verified correctly by the libcrypto code. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-25Constify ... X509|X509_CRL|X509_REVOKED|_get_ext*()FdaSilvaYY1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1300)
2016-07-23Make it possible for external code to flag a certificate as a proxy one.Richard Levitte1-0/+5
This adds the function X509_set_proxy_flag(), which sets the internal flag EXFLAG_PROXY on a given X509 structure. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-20Remove pointless free loop in X509_PURPOSE_cleanup()Kurt Cancemi1-3/+0
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1194)
2016-06-15Constify input buffers of some X509V3 and X509_PURPOSE -related methodsFdaSilvaYY1-6/+6
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1215)
2016-06-08Add some accessor API'sRich Salz1-0/+9
GH1098: Add X509_get_pathlen() (and a test) GH1097: Add SSL_is_dtls() function. Documented. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-01Don't leak memory on int X509_PURPOSE_add() error pathMatt Caswell1-3/+10
The int X509_PURPOSE_add() function was leaking an X509_PURPOSE object on error. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-17Copyright consolidation 07/10Rich Salz1-54/+5
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-08Convert CRYPTO_LOCK_X509_* to new multi-threading APIAlessandro Ghedini1-4/+4
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-27Comment side-effect only calls of X509_check_purposeViktor Dukhovni1-0/+5
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-26Remove /* foo.c */ commentsRich Salz1-1/+0
This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-12-16Rename some BUF_xxx to OPENSSL_xxxRich Salz1-2/+2
Rename BUF_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} to OPENSSL_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} Add #define's for the old names. Add CRYPTO_{memdup,strndup}, called by OPENSSL_{memdup,strndup} macros. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-10-15Fix self signed handling.Dr. Stephen Henson1-9/+10
Don't mark a certificate as self signed if keyUsage is present and certificate signing not asserted. PR#3979 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-09-22New function X509_get0_subject_key_id()Dr. Stephen Henson1-0/+7
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-03Revert "OPENSSL_NO_xxx cleanup: RFC3779"David Woodhouse1-0/+4
This reverts the non-cleanup parts of commit c73ad69017. We do actually have a reasonable use case for OPENSSL_NO_RFC3779 in the EDK2 UEFI build, since we don't have a strspn() function in our runtime environment and we don't want the RFC3779 functionality anyway. In addition, it changes the default behaviour of the Configure script so that RFC3779 support isn't disabled by default. It was always disabled from when it was first added in 2006, right up until the point where OPENSSL_NO_RFC3779 was turned into a no-op, and the code in the Configure script was left *trying* to disable it, but not actually working. Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-09-03Win32 build fix: include internal/numbers.h to get UIN32_MAXRichard Levitte1-0/+1
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-01functions to retrieve certificate flagsDr. Stephen Henson1-0/+22
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-14Identify and move common internal libcrypto header filesRichard Levitte1-1/+1
There are header files in crypto/ that are used by a number of crypto/ submodules. Move those to crypto/include/internal and adapt the affected source code and Makefiles. The header files that got moved are: crypto/cryptolib.h crypto/md32_common.h Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-11Use p==NULL not !p (in if statements, mainly)Rich Salz1-2/+3
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-06Use "==0" instead of "!strcmp" etcRich Salz1-1/+1
For the various string-compare routines (strcmp, strcasecmp, str.*cmp) use "strcmp()==0" instead of "!strcmp()" Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-04Use safer sizeof variant in mallocRich Salz1-1/+1
For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-03Add OSSL_NELEM macro.Dr. Stephen Henson1-3/+2
Add OSSL_NELEM macro to e_os.h to determine the number of elements in an array. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-02-06util/mkstack.pl now generates entire safestack.hRich Salz1-2/+0
The mkstack.pl script now generates the entire safestack.h file. It generates output that follows the coding style. Also, removed all instances of the obsolete IMPLEMENT_STACK_OF macro. Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-01-27OPENSSL_NO_xxx cleanup: SHARich Salz1-2/+0
Remove support for SHA0 and DSS0 (they were broken), and remove the ability to attempt to build without SHA (it didn't work). For simplicity, remove the option of not building various SHA algorithms; you could argue that SHA_224/256/384/512 should be kept, since they're like crypto algorithms, but I decided to go the other way. So these options are gone: GENUINE_DSA OPENSSL_NO_SHA0 OPENSSL_NO_SHA OPENSSL_NO_SHA1 OPENSSL_NO_SHA224 OPENSSL_NO_SHA256 OPENSSL_NO_SHA384 OPENSSL_NO_SHA512 Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-01-27OPENSSL_NO_xxx cleanup: RFC3779Rich Salz1-4/+0
Remove OPENSSL_NO_RFCF3779. Also, makevms.com was ignored by some of the other cleanups, so I caught it up. Sorry I ignored you, poor little VMS... Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-01-22Run util/openssl-format-source -v -c .Matt Caswell1-541/+609
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-30mark all block comments that need format preserving so thatTim Hudson1-2/+4
indent will not alter them when reformatting comments Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2014-04-15Extension checking fixes.Dr. Stephen Henson1-3/+3
When looking for an extension we need to set the last found position to -1 to properly search all extensions. PR#3309.
2012-12-15Check chain is not NULL before assuming we have a validated chain.Dr. Stephen Henson1-1/+1
The modification to the OCSP helper purpose breaks normal OCSP verification. It is no longer needed now we can trust partial chains.
2012-12-07Fix OCSP checking.Ben Laurie1-1/+1
2012-12-06Fix two bugs which affect delta CRL handling:Dr. Stephen Henson1-2/+2
Use -1 to check all extensions in CRLs. Always set flag for freshest CRL.
2012-01-26allow key agreement for SSL/TLS certificatesDr. Stephen Henson1-4/+9
2010-02-25Include self-signed flag in certificates by checking SKID/AKID as wellDr. Stephen Henson1-3/+8
as issuer and subject names. Although this is an incompatible change it should have little impact in pratice because self-issued certificates that are not self-signed are rarely encountered.
2010-02-24add anyExtendedKeyUsage OIDDr. Stephen Henson1-0/+4
2008-11-05Update obsolete email address...Dr. Stephen Henson1-1/+1
2008-10-22Create function of the form OBJ_bsearch_xxx() in bsearch typesafe macrosDr. Stephen Henson1-5/+5
with the appropriate parameters which calls OBJ_bsearch(). A compiler will typically inline this. This avoids the need for cmp_xxx variables and fixes unchecked const issues with CHECKED_PTR_OF()
2008-10-12Type-checked (and modern C compliant) OBJ_bsearch.Ben Laurie1-8/+8
2008-09-01Initial support for delta CRLs. If "use deltas" flag is set attempt to findDr. Stephen Henson1-2/+4
a delta CRL in addition to a full CRL. Check and search delta in addition to the base.
generated by cgit v1.1 at 2024-07-12 08:27:55 +0000