summaryrefslogtreecommitdiffstats
path: root/crypto/x509 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Update copyright yearMatt Caswell2020-05-1531-31/+31
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11839)
* Strengthen X509_STORE_CTX_print_verify_cb() to print expected host etc.Dr. David von Oheimb2020-05-056-91/+157
| | | | | | | | | | | Add X509_VERIFY_PARAM_get0_host(), X509_VERIFY_PARAM_get0_email(), and X509_VERIFY_PARAM_get1_ip_asc() to support this, as well as the internal helper function ipaddr_to_asc(), which is used also for simplifying other IP address output functions. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11693)
* coverity 1462560 Resource leakPauli2020-04-301-0/+1
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651)
* coverity 1462556 Resource leakPauli2020-04-301-1/+4
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651)
* Fix snprintf missing for windows buildShane Lontis2020-04-301-1/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11675)
* include/openssl/x509v3.h: restore previous stack definition arrangementRichard Levitte2020-04-291-0/+2
| | | | | | | | | | | | | | | | | | | | It turned out that configuration options may affect the definition and use of diverse stacks and how they relate to the underlying types. For example, the configuration option 'no-rfc3779' results in a build error around STACK_OF(IPAddressFamily) and related stacks. Previously, STACK_OF definitions were located near the definition of the underlying type, which are also affected by configuration options, which made this easier to maintain. We relocate the new stack definitions back to those locations for that reason. We apply the same type of relocation in other header files as well, following the general rule that it's better to use DEFINE_OR_DECLARE_STACK_OF after the type it defines a stack for has been defined. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11655)
* crypto/x509/v3_alt.c: make 'othername' a bit biggerRichard Levitte2020-04-271-1/+1
| | | | | | | | | We want to fill 'othername' with the contents of 'oline' (256 bytes) plus some additional text. We need to ensure that 'othername' is large enough to contain this. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11656)
* Add support for unusal 'othername' subjectAltNamesDirk-Willem van Gulik2020-04-251-1/+20
| | | | | | | | | | Increasingly certificates seem to have special things in the subjectAltName that have arbitrary strings in them. E.g. some (now) common in EU export certificates and, for a few years now, certificates issued to medical doctors (in for example the netherlands, the full spec is https://www.uziregister.nl/Media/Default/PDF/20200325%20CA%20model%20pasmodel%20certificaatprofielen%20v10_0.pdf, section 4.8, page 16 for an example of one country). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11599)
* Code cleanup in X509v3 String ExtentionsNikolay Morozov2020-04-242-4/+5
| | | | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11604)
* In OpenSSL builds, declare STACK for datatypes ...Rich Salz2020-04-2452-0/+158
| | | | | | | | | | | | | | | | | | | | | | ... and only *define* them in the source files that need them. Use DEFINE_OR_DECLARE which is set appropriately for internal builds and not non-deprecated builds. Deprecate stack-of-block Better documentation Move some ASN1 struct typedefs to types.h Update ParseC to handle this. Most of all, ParseC needed to be more consistent. The handlers are "recursive", in so far that they are called again and again until they terminate, which depends entirely on what the "massager" returns. There's a comment at the beginning of ParseC that explains how that works. {Richard Levtte} Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10669)
* Update copyright yearMatt Caswell2020-04-2322-22/+22
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11616)
* Add setter equivalents to X509_REQ_get0_signatureDirk-Willem van Gulik2020-04-211-0/+12
| | | | | | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10563)
* Prevent crash in X509_NAME_cmp() etc. when cert has no issuer or no serialNumberDr. David von Oheimb2020-04-181-1/+9
| | | | | | Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386)
* Introduce an internal version of X509_check_issued()Matt Caswell2020-04-162-4/+10
| | | | | | | | The internal version is library context aware. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11507)
* Create a libctx aware X509_verify_ex()Matt Caswell2020-04-162-8/+20
| | | | | | | | | This is the same as X509_verify() except that it takes a libctx and propq parameter and signature verification is done using those. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11507)
* Teach d2i_PrivateKey et al about libctxMatt Caswell2020-04-151-0/+36
| | | | | | | | | The Ed448 private key decoding makes algorithm fetches. Therefore we teach d2i_PrivateKey et al about libctx and make sure it is passed through the layers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11494)
* Add manpage entry for X509_check_purpose()Jake Maynard2020-04-111-1/+3
| | | | | | | | Fixes #10263 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10301)
* Use the libctx and propq from the X509_STORE_CTXMatt Caswell2020-04-091-10/+40
| | | | | | | | | Now that X509_STORE_CTX contain a libctx we should use it in a couple of places where we cache the X509v3 extensions. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11457)
* Add X509_STORE_CTX_new_with_libctx()Matt Caswell2020-04-091-2/+24
| | | | | | | | | Make it possible to create an X509_STORE_CTX with an associated libctx and propq. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11457)
* Fix error reporting glitch in X509_STORE_CTX_print_verify_cb() in t_x509.cDr. David von Oheimb2020-04-071-1/+1
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11448)
* Set X509_V_ERR_INVALID_EXTENSION error for invalid basic constraintsTomas Mraz2020-04-061-0/+6
| | | | | | | | | | If we encounter certificate with basic constraints CA:false, pathlen present and X509_V_FLAG_X509_STRICT is set we set X509_V_ERR_INVALID_EXTENSION error. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11463)
* Allow certificates with Basic Constraints CA:false, pathlen:0Tomas Mraz2020-04-061-3/+7
| | | | | | | | | | | | | | | | | | | | | Do not mark such certificates with EXFLAG_INVALID although they violate the RFC 5280, they are syntactically correct and openssl itself can produce such certificates without any errors with command such as: openssl x509 -req -signkey private.pem -in csr.pem -out cert.pem \ -extfile <(echo "basicConstraints=CA:FALSE,pathlen:0") With the commit ba4356ae4002a04e28642da60c551877eea804f7 the EXFLAG_INVALID causes openssl to not consider such certificate even as leaf self-signed certificate which is breaking existing installations. Fixes: #11456 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11463)
* Chunk 10 of CMP contribution to OpenSSL: CMP http client and related testsDr. David von Oheimb2020-04-021-1/+1
| | | | | | | | | | | | | Also improve the generic HTTP client w.r.t. proxy and no_proxy options. Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712). Adds the CMP and CRMF API to libcrypto and the "cmp" app to the CLI. Adds extensive documentation and tests. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11404)
* Add the X509v3_cache_extensions() functionMatt Caswell2020-03-301-15/+17
| | | | | | | | | | Various functions cause the results of processing extensions to be cached. The processing itself requires a libctx, and so this implicit caching means that the default ctx is used which can lead to failures. By explicitly caching the extensions we can specify the libctx to be used. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11409)
* Issuer Sign Tool extention supportNikolay Morozov2020-03-254-1/+152
| | | | | | | | | | | Issuer Sign Tool (1.2.643.100.112) The name of the tool used to signs the subject (ASN1_SEQUENCE) This extention is required to obtain the status of a qualified certificate at Russian Federation. RFC-style description is available here: https://tools.ietf.org/html/draft-deremin-rfc4491-bis-04#section-5 Russian Federal Law 63 "Digital Sign" is available here: http://www.consultant.ru/document/cons_doc_LAW_112701/ Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11216)
* Constify various mostly X509-related parameter types in crypto/ and apps/Dr. David von Oheimb2020-03-2321-114/+128
| | | | | | | | | in particular X509_NAME*, X509_STORE{,_CTX}*, and ASN1_INTEGER *, also some result types of new functions, which does not break compatibility Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10504)
* Fix error handling in x509v3_cache_extensions and related functionsBernd Edlinger2020-03-216-57/+111
| | | | | | | | | | Basically we use EXFLAG_INVALID for all kinds of out of memory and all kinds of parse errors in x509v3_cache_extensions. [extended tests] Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10755)
* X509: Rename X509_set0_sm2_id() and friendsRichard Levitte2020-03-153-34/+18
| | | | | | | | | | | | | | | | | - X509_set0_sm2_id() -> X509_set0_distinguishing_id() - X509_get0_sm2_id() -> X509_get0_distinguishing_id() - X509_REQ_set0_sm2_id -> X509_REQ_set0_distinguishing_id() - X509_REQ_get0_sm2_id -> X509_REQ_get0_distinguishing_id() The reason for this rename is that the SM2 ID isn't really a unique SM2 data item, but rather a re-use of the Distinguished that is defined in ISO/IEC 15946-3 as well as in FIPS 196, with no special attribution toward any algorithm in particular. Fixes #11293 Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/11302)
* Move OSSL_CMP_X509_digest() to x_all.c, renaming it to X509_digest_sig()Dr. David von Oheimb2020-03-101-0/+29
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11142)
* Rethink the EVP_PKEY cache of provider side keysRichard Levitte2020-02-291-2/+2
| | | | | | | | | | | | | | | | | | | | The role of this cache was two-fold: 1. It was a cache of key copies exported to providers with which an operation was initiated. 2. If the EVP_PKEY didn't have a legacy key, item 0 of the cache was the corresponding provider side origin, while the rest was the actual cache. This dual role for item 0 made the code a bit confusing, so we now make a separate keymgmt / keydata pair outside of that cache, which is the provider side "origin" key. A hard rule is that an EVP_PKEY cannot hold a legacy "origin" and a provider side "origin" at the same time. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11148)
* x509v3 subjectSignTool extention supportNikolay Morozov2020-02-284-3/+73
| | | | | | | | | | | Subject Sign Tool (1.2.643.100.111) The name of the tool used to signs the subject (UTF8String) This extention is required to obtain the status of a qualified certificate at Russian Federation. RFC-style description is available here: https://tools.ietf.org/html/draft-deremin-rfc4491-bis-04#section-5 Russian Federal Law 63 "Digital Sign" is available here: http://www.consultant.ru/document/cons_doc_LAW_112701/ Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11093)
* chunk 7 of CMP contribution to OpenSSLDr. David von Oheimb2020-02-173-0/+142
| | | | | | | | | | | | | add CMP message validation and related tests; while doing so: * add ERR_add_error_mem_bio() to crypto/err/err_prn.c * move ossl_cmp_add_error_txt() as ERR_add_error_txt() to crypto/err/err_prn.c * add X509_STORE_CTX_print_verify_cb() to crypto/x509/t_x509.c, adding internally x509_print_ex_brief(), print_certs(), and print_store_certs() * move {ossl_cmp_,}X509_STORE_get1_certs() to crypto/x509/x509_lu.c Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/10620)
* Adapt i2d_PUBKEY for provider only keysRichard Levitte2020-02-141-11/+42
| | | | | | | It uses EVP_PKEY serializers to get the desired results. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11078)
* Add OSSL_SERIALIZER_PUBKEY_TO_DER_PQ and friendsRichard Levitte2020-02-121-1/+1
| | | | | | | | It's already used internally, there's no reason the DER serializer propqueries shouldn't be present alongside the PEM and TEXT ones. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11055)
* Deprecate the low level DSA functions.Pauli2020-02-111-0/+6
| | | | | | | | Use of the low level DSA functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
* X509_PUBKEY_set(): Fix memory leakRichard Levitte2020-02-111-0/+16
| | | | | | | | | | | With the provided method of creating the new X509_PUBKEY, an extra EVP_PKEY is created and needs to be properly cleaned away. (note: we could choose to keep it just as well, but there are consequences, explained in a comment in the code) Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11038)
* Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.cDr. David von Oheimb2020-02-101-10/+19
| | | | | | | | | | | | | | | | The new client has become an independent libcrpyto module in crypto/http/ and * can handle any types of requests and responses (ASN.1-encoded and plain) * does not include potentially busy loops when waiting for responses but * makes use of a new timeout mechanism integrated with socket-based BIO * supports the use of HTTP proxies and TLS, including HTTPS over proxies * supports HTTP redirection via codes 301 and 302 for GET requests * returns more useful diagnostics in various error situations Also adapts - and strongly simplifies - hitherto uses of HTTP in crypto/ocsp/, crypto/x509/x_all.c, apps/lib/apps.c, and apps/{ocsp,s_client,s_server}.c Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10667)
* Fix no-ecMatt Caswell2020-02-081-0/+2
| | | | | | | Recent SM2 related changes were not properly guarded with OPENSSL_NO_EC Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11029)
* Stop accepting certificates signed using SHA1 at security level 1Kurt Roeckx2020-02-051-0/+14
| | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> GH: #10786
* Deprecate the ECDSA and EV_KEY_METHOD functions.Pauli2020-02-041-0/+6
| | | | | | | | Use of the low level ECDSA and EC_KEY_METHOD functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10960)
* X509: Refactor X509_verify() and X509_REQ_verify() for better streamliningRichard Levitte2020-02-021-139/+41
| | | | | | | | | | | | | | | | | | | | | The solution to incorporate the SM2 identity processing was an off the side hack that more or less duplicated the ASN1_item_verify() code with just a few lines being different. We replace this with a new function ASN1_item_verify_ctx(), which takes an EVP_MD_CTX pointer instead of an EVP_PKEY pointer, just like its sibling ASN1_item_sign_ctx(). This allows us to refactor X509_verify() and X509_REQ_verify() to simply create a local EVP_MD_CTX and an attached EVP_PKEY_CTX, which gets to hold the SM2 identity, if there is one, and then let ASN1_item_verify_ctx() to its job. This will also make it easier to adapt ASN1_item_verify_ctx() for provider based keys. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10942)
* Adapt X509_PUBKEY_set() for use with provided implementationsRichard Levitte2020-01-281-8/+35
| | | | | | | | | | We do this by letting a serializer serialize the provider side key to a DER blob formatted according to the SubjectPublicKeyInfo structure (see RFC 5280), and deserialize it in libcrypto using the usual d2i function. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10851)
* Update man3/verify documentation, error textRich Salz2020-01-231-11/+10
| | | | | | | | | | | | Move the x509_V_ERR_xxx definitions from openssl-verify to X509_STORE_CTX_get_error.pod. Add some missing ones. Consistently start with a lowercase letter, unless it's an acronym. Fix some markup mistakes in X509_verify_cert. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10132)
* Add support for otherName:NAIRealm in outputJan-Frederik Rieckers2019-12-111-0/+11
| | | | | | | | | | | This commit adds support for displaying RFC 7585 otherName:NAIRealm in the text output of openssl CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10594)
* add X509_cmp_timeframe() including its documentationDr. David von Oheimb2019-12-042-1/+26
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10502)
* PROV SERIALIZER: add common functionality to serialize keysRichard Levitte2019-11-291-0/+24
| | | | | | | | To support generic output of public keys wrapped in a X509_PUBKEY, additional PEM and i2d/d2i routines are added for that type. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
* Check the return from OPENSSL_buf2hexstr()Matt Caswell2019-11-291-1/+10
| | | | | | | | | | | | The function OPENSSL_buf2hexstr() can return NULL if it fails to allocate memory so the callers should check its return value. Fixes #10525 Reported-by: Ziyang Li (@Liby99) Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10526)
* Update source files for pre-3.0 deprecationRichard Levitte2019-11-072-2/+2
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
* Don't assume the type we read was the type we expectedMatt Caswell2019-11-041-10/+37
| | | | | | | | | | | | | | | i2v_GENERAL_NAME and GENERAL_NAME_print were assuming that the type of of a GENERAL_NAME (OTHERNAME) that we read in was the type we expected it to be. If its something else then this can cause unexpected behaviour. In the added fuzz test case an OOB read was occurring. This issue was recently added by commit 4baee2d. Credit to OSSFuzz for finding this issue. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10300)
* Don't leak memory in the event of a failure in i2v_GENERAL_NAMESMatt Caswell2019-11-041-2/+15
| | | | | | | | | | | | | | | i2v_GENERAL_NAMES call i2v_GENERAL_NAME repeatedly as required. Each time i2v_GENERAL_NAME gets called it allocates adds data to the passed in stack and then returns a pointer to the stack, or NULL on failure. If the passed in stack is itself NULL then it allocates one. i2v_GENERAL_NAMES was not correctly handling the case where a NULL gets returned from i2v_GENERAL_NAME. If a stack had already been allocated then it just leaked it. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10300)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-09 21:20:26 +0100