summaryrefslogtreecommitdiffstats
path: root/crypto/x509/x_all.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Create a libctx aware X509_verify_ex()Matt Caswell2020-04-161-6/+18
| | | | | | | | | This is the same as X509_verify() except that it takes a libctx and propq parameter and signature verification is done using those. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11507)
* Teach d2i_PrivateKey et al about libctxMatt Caswell2020-04-151-0/+36
| | | | | | | | | The Ed448 private key decoding makes algorithm fetches. Therefore we teach d2i_PrivateKey et al about libctx and make sure it is passed through the layers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11494)
* Chunk 10 of CMP contribution to OpenSSL: CMP http client and related testsDr. David von Oheimb2020-04-021-1/+1
| | | | | | | | | | | | | Also improve the generic HTTP client w.r.t. proxy and no_proxy options. Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712). Adds the CMP and CRMF API to libcrypto and the "cmp" app to the CLI. Adds extensive documentation and tests. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11404)
* Fix error handling in x509v3_cache_extensions and related functionsBernd Edlinger2020-03-211-3/+5
| | | | | | | | | | Basically we use EXFLAG_INVALID for all kinds of out of memory and all kinds of parse errors in x509v3_cache_extensions. [extended tests] Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10755)
* X509: Rename X509_set0_sm2_id() and friendsRichard Levitte2020-03-151-8/+2
| | | | | | | | | | | | | | | | | - X509_set0_sm2_id() -> X509_set0_distinguishing_id() - X509_get0_sm2_id() -> X509_get0_distinguishing_id() - X509_REQ_set0_sm2_id -> X509_REQ_set0_distinguishing_id() - X509_REQ_get0_sm2_id -> X509_REQ_get0_distinguishing_id() The reason for this rename is that the SM2 ID isn't really a unique SM2 data item, but rather a re-use of the Distinguished that is defined in ISO/IEC 15946-3 as well as in FIPS 196, with no special attribution toward any algorithm in particular. Fixes #11293 Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/11302)
* Move OSSL_CMP_X509_digest() to x_all.c, renaming it to X509_digest_sig()Dr. David von Oheimb2020-03-101-0/+29
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11142)
* Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.cDr. David von Oheimb2020-02-101-10/+19
| | | | | | | | | | | | | | | | The new client has become an independent libcrpyto module in crypto/http/ and * can handle any types of requests and responses (ASN.1-encoded and plain) * does not include potentially busy loops when waiting for responses but * makes use of a new timeout mechanism integrated with socket-based BIO * supports the use of HTTP proxies and TLS, including HTTPS over proxies * supports HTTP redirection via codes 301 and 302 for GET requests * returns more useful diagnostics in various error situations Also adapts - and strongly simplifies - hitherto uses of HTTP in crypto/ocsp/, crypto/x509/x_all.c, apps/lib/apps.c, and apps/{ocsp,s_client,s_server}.c Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10667)
* Fix no-ecMatt Caswell2020-02-081-0/+2
| | | | | | | Recent SM2 related changes were not properly guarded with OPENSSL_NO_EC Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11029)
* Deprecate the ECDSA and EV_KEY_METHOD functions.Pauli2020-02-041-0/+6
| | | | | | | | Use of the low level ECDSA and EC_KEY_METHOD functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10960)
* X509: Refactor X509_verify() and X509_REQ_verify() for better streamliningRichard Levitte2020-02-021-139/+41
| | | | | | | | | | | | | | | | | | | | | The solution to incorporate the SM2 identity processing was an off the side hack that more or less duplicated the ASN1_item_verify() code with just a few lines being different. We replace this with a new function ASN1_item_verify_ctx(), which takes an EVP_MD_CTX pointer instead of an EVP_PKEY pointer, just like its sibling ASN1_item_sign_ctx(). This allows us to refactor X509_verify() and X509_REQ_verify() to simply create a local EVP_MD_CTX and an attached EVP_PKEY_CTX, which gets to hold the SM2 identity, if there is one, and then let ASN1_item_verify_ctx() to its job. This will also make it easier to adapt ASN1_item_verify_ctx() for provider based keys. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10942)
* PROV SERIALIZER: add common functionality to serialize keysRichard Levitte2019-11-291-0/+24
| | | | | | | | To support generic output of public keys wrapped in a X509_PUBKEY, additional PEM and i2d/d2i routines are added for that type. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
* Explicitly test against NULL; do not use !p or similarRich Salz2019-10-091-2/+4
| | | | | | | | Also added blanks lines after declarations in a couple of places. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9916)
* Reorganize private crypto header filesDr. Matthias St. Pierre2019-09-281-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, there are two different directories which contain internal header files of libcrypto which are meant to be shared internally: While header files in 'include/internal' are intended to be shared between libcrypto and libssl, the files in 'crypto/include/internal' are intended to be shared inside libcrypto only. To make things complicated, the include search path is set up in such a way that the directive #include "internal/file.h" could refer to a file in either of these two directoroes. This makes it necessary in some cases to add a '_int.h' suffix to some files to resolve this ambiguity: #include "internal/file.h" # located in 'include/internal' #include "internal/file_int.h" # located in 'crypto/include/internal' This commit moves the private crypto headers from 'crypto/include/internal' to 'include/crypto' As a result, the include directives become unambiguous #include "internal/file.h" # located in 'include/internal' #include "crypto/file.h" # located in 'include/crypto' hence the superfluous '_int.h' suffixes can be stripped. The files 'store_int.h' and 'store.h' need to be treated specially; they are joined into a single file. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
* Support SM2 certificate signingPaul Yang2019-06-281-20/+65
| | | | | | | | | | | SM2 certificate signing request can be created and signed by OpenSSL now, both in library and apps. Documentation and test cases are added. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9085)
* Make X509_set_sm2_id consistent with other settersPaul Yang2019-04-091-1/+4
| | | | | | | | | | | This commit makes the X509_set_sm2_id to 'set0' behaviour, which means the memory management is passed to X509 and user doesn't need to free the sm2_id parameter later. API name also changes to X509_set0_sm2_id. Document and test case are also updated. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8626)
* Support SM2 certificate verification杨洋2019-03-131-0/+110
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8321)
* constify *_dup() and *i2d_*() and related functions as far as possible, ↵David von Oheimb2019-03-061-34/+34
| | | | | | | | introducing DECLARE_ASN1_DUP_FUNCTION Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8029)
* Following the license change, modify the boilerplates in crypto/x509/Richard Levitte2018-12-061-1/+1
| | | | | | | [skip ci] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7824)
* Use safestack.h exclusively internally.Pauli2017-09-281-2/+1
| | | | | | | | | | | | Remove all stack headers from some includes that don't use them. Avoid a genearic untyped stack use. Update stack POD file to include the OPENSSL_sk_ API functions in the notes section. They were mentioned in the name section but not defined anywhere. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4430)
* Add -Wundef to --strict-warnings options.Bernd Edlinger2017-02-241-1/+1
| | | | | | | | | | | Avoid a -Wundef warning in refcount.h Avoid a -Wundef warning in o_str.c Avoid a -Wundef warning in testutil.h Include internal/cryptlib.h before openssl/stack.h to avoid use of undefined symbol OPENSSL_API_COMPAT. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2712)
* X509_CRL_digest() - ensure precomputed sha1 hash before returning itRichard Levitte2017-01-281-1/+1
| | | | | | | X509_CRL_digest() didn't check if the precomputed sha1 hash was actually present. This also makes sure there's an appropriate flag to check. Reviewed-by: Kurt Roeckx <kurt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2314)
* Fix no-ocspRichard Levitte2017-01-131-0/+1
| | | | | | | The use of EXFLAG_SET requires the inclusion of openssl/x509v3.h. openssl/ocsp.h does that, except when OCSP is disabled. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2227)
* Make X509_Digest,others publicRich Salz2017-01-121-0/+14
| | | | | | Also, if want SHA1 then use the pre-computed value if there. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2223)
* Copyright consolidation 09/10Rich Salz2016-05-171-54/+6
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix no-ocspMatt Caswell2016-04-061-0/+4
| | | | | | Misc fixes for no-ocsp Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove #error from include files.Rich Salz2016-03-211-6/+2
| | | | | | | | Don't have #error statements in header files, but instead wrap the contents of that file in #ifndef OPENSSL_NO_xxx This means it is now always safe to include the header file. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove /* foo.c */ commentsRich Salz2016-01-261-1/+0
| | | | | | | | | | | | This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* embed CRL serial number and signature fieldsDr. Stephen Henson2015-10-151-2/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* embed certificate serial number and signature fieldsDr. Stephen Henson2015-10-151-3/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Embed various signature algorithms.Dr. Stephen Henson2015-09-171-14/+14
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Embed X509_REQ_INFODr. Stephen Henson2015-09-161-3/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Embed X509_CINFDr. Stephen Henson2015-09-161-8/+8
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* X509_CRL_INFO embedDr. Stephen Henson2015-09-161-6/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* make X509_REQ opaqueDr. Stephen Henson2015-08-311-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Identify and move common internal libcrypto header filesRichard Levitte2015-05-141-1/+1
| | | | | | | | | | | | | There are header files in crypto/ that are used by a number of crypto/ submodules. Move those to crypto/include/internal and adapt the affected source code and Makefiles. The header files that got moved are: crypto/cryptolib.h crypto/md32_common.h Reviewed-by: Rich Salz <rsalz@openssl.org>
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-221-317/+322
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Cleanup OPENSSL_NO_xxx, part 1master-pre-reformatRich Salz2015-01-141-9/+9
| | | | | | | | | | OPENSSL_NO_RIPEMD160, OPENSSL_NO_RIPEMD merged into OPENSSL_NO_RMD160 OPENSSL_NO_FP_API merged into OPENSSL_NO_STDIO Two typo's on #endif comments fixed: OPENSSL_NO_ECB fixed to OPENSSL_NO_OCB OPENSSL_NO_HW_SureWare fixed to OPENSSL_NO_HW_SUREWARE Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix various certificate fingerprint issues.Dr. Stephen Henson2015-01-051-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists. 1. Reject signatures with non zero unused bits. If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits. 2. Check certificate algorithm consistency. Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates. 3. Check DSA/ECDSA signatures use DER. Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch. This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes). CVE-2014-8275 Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Reencode with X509_CRL_ctx_sign too.Dr. Stephen Henson2013-06-051-0/+1
|
* Reencode certificates in X509_sign_ctx.Dr. Stephen Henson2013-05-021-0/+1
| | | | | | | Reencode certificates in X509_sign_ctx as well as X509_sign. This was causing a problem in the x509 application when it modified an existing certificate.
* add wrapper function for certificate downloadDr. Stephen Henson2012-11-291-0/+6
|
* Generalise OCSP I/O functions to support dowloading of other ASN1Dr. Stephen Henson2012-11-281-0/+8
| | | | structures using HTTP. Add wrapper function to handle CRL download.
* Add call to ENGINE_register_all_complete() to ENGINE_load_builtin_engines(),Dr. Stephen Henson2010-10-031-0/+1
| | | | | | | this means that some implementations will be used automatically, e.g. aesni, we do this for cryptodev anyway. Setup cpuid in ENGINE_load_builtin_engines() too as some ENGINEs use it.
* add X509_CRL_sign_ctx functionDr. Stephen Henson2010-03-141-0/+19
|
* remove SSLEAY_MACROS codeNils Larsch2006-11-061-1/+0
|
* Tidy up CRL handling by checking for critical extensions when it isDr. Stephen Henson2006-09-211-6/+0
| | | | | | | | loaded. Add new function X509_CRL_get0_by_serial() to lookup a revoked entry to avoid the need to access the structure directly. Add new X509_CRL_METHOD to allow common CRL operations (verify, lookup) to be redirected.
* makeNils Larsch2005-07-161-0/+4
| | | | | | | | ./configure no-deprecated [no-dsa] [no-dh] [no-ec] [no-rsa] make depend all test work again PR: 1159
* Give everything prototypes (well, everything that's actually used).Ben Laurie2005-03-311-68/+43
|
* Automatically mark the CRL cached encoding as invalid when some operationsDr. Stephen Henson2004-12-091-0/+1
| | | | are performed.
* (oops) Apologies all, that last header-cleanup commit was from the wrongGeoff Thorpe2004-04-191-0/+2
| | | | | tree. This further reduces header interdependencies, and makes some associated cleanups.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 23:55:40 +0100