| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
ok tb@
|
|
OPENSSL_cpu_caps() is currently machine dependent and exposes CPUID data
on amd64 and i386. However, what it is really used for is to indicate
whether specific algorithms are accelerated on the given hardware. Change
OPENSSL_cpu_caps() so that it returns a machine indepent value, which
decouples it from amd64/i386 and will allow it to be used appropriately
on other platforms in the future.
ok tb@
|
|
|
|
|
|
|
|
|
|
|
|
To compensate for all the removals, a single, small, constructive piece
of this bump: expose X509_get_signature_info() so that libssl's security
level API can handle RSA-PSS certificates correctly.
ok beck jsing
|
|
The only consumer, yara, has been adjusted. It will be some more work
to remove this idiocy internally, but at least we will no longer have
to care about external consumers.
ok beck jsing
|
|
functionality for shared libs.
Note that routines such as sslv2_init and friends that use RSA will
not work due to lack of RSA in this library.
Needs documentation and help from ports for easy upgrade to full
functionality where legally possible.
|
|
|
|
This allows us in particular to get rid of the MD Symbols.list which
were needed on amd64 and i386 for llvm 16 a while back. OPENSSL_ia32cap_P
was never properly exported since the symbols were marked .hidden in the
asm.
ok beck jsing
|
|
Long deprecated, last users have been fixed.
ok beck jsing
|
|
It's just gross. Only used by a popular disk encryption utility on an
all-too-popular OS one or two decades back.
ok beck jsing
|
|
Unfortunately we'll probably never be able to get rid of DES entirely.
One part of it that is old enough to be a grandparent can go, though.
ok beck jsing
|
|
ok beck jsing
|
|
I ranted enough about this recently. PKCS#12. Microsoft. 'nuff said.
ok beck jsing
|
|
Another bunch of const correctness fixes for global tables. These are
used to map ns cert types, key usage types and CRL reasons to strings
and vice versa. By the looks of it, nobody ever figured out how to use
this (need I mention that it's convoluted?).
ok beck jsing
|
|
With this another family of global tables becomes const as it should
always have been.
ok beck jsing
|
|
LibreSSL no longer supports non-standard OIDs for use in the extensions
attribute of CSRs. The API that enabled that (and nobody used of course)
can now go.
ok beck jsing
|
|
Nothing needs to reach into this structure, which is part of
certificates. So hide its innards.
ok beck jsing
|
|
Someone thought it would be a good idea to append non-standard trust
information to the certs in the trust store. This API is used to
inspect that depending on the intended purpose of the cert. Only
M2Crypto thought it necessary to expose this. It was adjusted.
ok beck jsing
|
|
Another unused bit of legacy API...
ok beck jsing
|
|
No longer used, never really needed.
ok beck jsing
|
|
These have always been unused, but the db_meth abstraction hid that
very well. Bye.
ok beck jsing
|
|
This internalizes a particularly scary layer of conf used for X.509
extensions. Again unused public API...
ok beck jsing
|
|
Thankfully sthen removed the out-of-support PHP versions 7.4 and 8.0,
which were the last users of this API, which in turn permitted much of
this conf rampage. Now the stub can join its guts in the attic.
ok beck jsing
|
|
Fortunately all projects who want to configure their extensions using
a dangerous string DSL/API figured out the fact that one was supposed to
be using the nconf version of these (the hint is the 'n', as in new).
ok beck jsing
|
|
This became obsolete with the automatic library initialization. Now it
is time for it to become an internal API.
ok beck jsing
|
|
This translation device from old to new conf guts will need to stay
for a while. However, it's only needed internally.
ok beck jsing
|
|
This is the next layer of unused cruft that can now go. The code lovingly
called it 'the "CONF classic" functions'. No tear was shed. Don't worry,
we still have the "New CONF" functions!
ok beck jsing
|
|
This permits another single-use-no-longer-public API to join the party
in the bit bucket.
ok beck jsing
|
|
The only project I'm aware of that ever used this was rust-openssl
and they did so for no good reason. So remove this API, the crate's
code is already adjusted accordingly.
ok beck jsing
|
|
ok beck jsing
|
|
While not all of this is strictly needed, it was simply incorrect. This
way another global which was modifiable for no good reason becomes const.
ok beck jsing
|
|
Now that we no longer need to hang a poor man's ctype substitute off
the conf structure, we can get rid of the otherwise unused meth_data
member. This allows us to const correct CONF_type_default. Hopefully
we can remove it soon.
ok beck jsing
|
|
Undocumented and entirely unused. Gets rid of a big, modifiable, global
table.
ok beck jsing
|
|
|
|
This makes the _CONF_* layer of the conf module internal and gets rid
of the entirely unused conf_api.h.
ok beck jsing
|
|
imodules are called imodules because they contain Information about
modules that have been Initialized. Which one of these two I it is
is anyone's best guess. Why anything outside of libcrypto would ever
possibly care will also remain a mystery.
Remove the old way of adding a conf module, user data, stop allowing
to set a method (it's opaque now, remember?) and drop a couple bits
more from the public api interface.
ok beck jsing
|
|
Much of conf is designed in such a way that you really have to reach into
its structs. This one piece can be hidden. It might even be removed soon.
ok beck jsing
|
|
It's time to start removing some horrors from the conf/ garbage. If the
current top layer wasn't terrible enough, you could always slap another
one on top of it and it would then be truly marvellous.
ok beck jsing
|
|
This API turned out to be a really bad idea. OpenSSL 3 extended it, with
the result that basically every key type had its own DoS issues fixed in
a recent security release. We eschewed these by having some upper bounds
that kick in when keys get insanely large.
Initially added on tobhe's request who fortunately never used it in iked,
this was picked up only by ruby/openssl (one of the rare projects doing
proper configure checks rather than branching on VERSION defines) and of
course xca, since it uses everything it can. So it was easy to get rid of
this again.
ok beck jsing
|
|
|
|
|
|
|
|
|
|
you can basically plug rdomains together and route between them
over rport interfaces. people keep asking me if this is so you can
leak routes between rdomains, and the answer is yes.
this is like pair(4) but cheaper because it avoids all the mucking
around with putting an ethernet header on the mbuf just to take it
off again later, and is more efficient with address space because
it's a p2p ip interface.
it has a small tweak from mvs@
ok denis@ claudio@
|
