summaryrefslogtreecommitdiff
path: root/lib/libcrypto
AgeCommit message (Collapse)Author
2021-10-21Bump to LibreSSL 3.5.0Theo Buehler
2021-10-20document ASN1_STRING_set_by_NID(3)Ingo Schwarze
and the three functions related to the global mask
2021-10-20new manual page ASN1_mbstring_copy(3)Ingo Schwarze
also documenting ASN1_mbstring_ncopy(3)
2021-10-20new manual page X509_ATTRIBUTE_get0_object(3)Ingo Schwarze
documenting the four X.501 Attribute read accessors
2021-10-20document X509_ATTRIBUTE_create(3) and X509_ATTRIBUTE_dup(3)Ingo Schwarze
2021-10-19document X509_get_pubkey_parameters(3) in a new manual pageIngo Schwarze
2021-10-19more precision, fewer wordsIngo Schwarze
2021-10-19document i2d_PrivateKey_bio(3) and i2d_PrivateKey_fp(3)Ingo Schwarze
2021-10-19install X509_PKEY_new(3)Ingo Schwarze
2021-10-19document X509_PKEY_new(3) and X509_PKEY_free(3)Ingo Schwarze
2021-10-18document X509_VERIFY_PARAM_inherit(3) and X509_VERIFY_PARAM_set1(3)Ingo Schwarze
2021-10-18split seven functions out of the page X509_VERIFY_PARAM_set_flags(3), whichIngo Schwarze
is becoming excessively long, into a new page X509_VERIFY_PARAM_new(3); no content change
2021-10-14Use unsigned char instead of u_char for two prototypes (like everywhereTheo Buehler
else in libcrypto's manuals and headers).
2021-10-06X509_STORE_CTX_init() allows the store to be NULL on init. Add checksClaudio Jeker
for a NULL ctx->ctx in the lookup functions using X509_STORE_CTX. This affects X509_STORE_get1_certs(), X509_STORE_get1_crls(), X509_STORE_CTX_get1_issuer() and X509_STORE_get_by_subject(). With this X509_verify_cert() no longer crashes with a NULL store. With and OK tb@
2021-09-30Enable X509_V_FLAG_TRUSTED_FIRST by default in the legacy verifier.Joel Sing
In order to work around the expired DST Root CA X3 certficiate, enable X509_V_FLAG_TRUSTED_FIRST in the legacy verifier. This means that the default chain provided by Let's Encrypt will stop at the ISRG Root X1 intermediate, rather than following the DST Root CA X3 intermediate. Note that the new verifier does not suffer from this issue, so only a small number of things will hit this code path. ok millert@ robert@ tb@
2021-09-30delete expired DST Root CA X3 to work around bugs various librariesTheo de Raadt
ok sthen, beck, jsing, tb, etc etc
2021-09-23Avoid a potential overread in x509_constraints_parse_mailbox()Joel Sing
The length checks need to be >= rather than > in order to ensure the string remains NUL terminated. While here consistently check wi before using it so we have the same idiom throughout this function. Issue reported by GoldBinocle on GitHub. ok deraadt@ tb@
2021-09-15bump to LibreSSL 3.4.1Theo Buehler
2021-09-14As suggested by tb@, merge the description of OPENSSL_EC_NAMED_CURVEIngo Schwarze
and OPENSSL_EC_EXPLICIT_CURVE from OpenSSL commit 146ca72c Feb 19 14:35:43 2015 +0000 after tb@ changed the default from 0 to OPENSSL_EC_NAMED_CURVE in ec/ec_lib.c rev. 1.41, which is the same default that OpenSSL uses since 1.1.0. While merging, drop the description of the pre-1.1.0 behaviour. It seems irrelevant to me because tb@ found no application in Debian codesearch using OPENSSL_EC_EXPLICIT_CURVE. A former devious default that was probably never relied upon by anyone does not need to be documented.
2021-09-13In X509_check_issued() do the same dance around x509v3_cache_extensions()Claudio Jeker
as in all other palces. Check the EXFLAG_SET flag first and if not set grab the CRYPTO_LOCK_X509 before calling x509v3_cache_extensions(). OK tb@ beck@
2021-09-12Default to using named curve parameter encodingTheo Buehler
The pre-OpenSSL 1.1.0 default was to use explicit curve parameter encoding. Most applications want to use named curve parameter encoding and have to opt into this explicitly. Stephen Henson changed this default in OpenSSL commit 86f300d3 6 years ago and provided a new OPENSSL_EC_EXPLICIT_CURVE define to opt back into the old default. According to Debian's codesearch, no application currently does this, which indicates that we currently have a bad default. In the future it is more likely that applications expect the new default, so we follow OpenSSL to avoid problems. Prompted by schwarze who noted that OPENSSL_EC_EXPLICIT_CURVE is missing. ok beck inoguchi jsing
2021-09-11Merge documentation of EC_GROUP_order_bits(3) from the OpenSSL 1.1.1Ingo Schwarze
branch, which is still under a free license. While here, also merge a few other improvements, mostly regarding EC_GROUP_get_order(3) and EC_GROUP_get_cofactor(3); in particular, some statements below RETURN VALUES were outright wrong. This patch includes a few minor tweaks and an addition to HISTORY by me. Feedback and OK tb@.
2021-09-11Add BGPSec Router (RFC 8209) Key Purpose OIDJob Snijders
OK tb@
2021-09-11Merge documentation for BN_bn2binpad(3), BN_bn2lebinpad(3),Ingo Schwarze
and BN_lebin2bn(3) from the OpenSSL 1.1.1 branch, which is still under a free license. While here, tweak a number of details for clarity. OK tb@
2021-09-10Calling OpenSSL_add_all_digests() is no longer needed since the libraryTodd C. Miller
automatically initializes itself. OK tb@
2021-09-10crank major for libcrypto as wellTheo Buehler
'may as well' deraadt
2021-09-10Bump minor after symbol additionTheo Buehler
2021-09-10Add BN_bn2{,le}binpad(), BN_lebin2bn(), EC_GROUP_order_bits to Symbols.listTheo Buehler
ok beck inoguchi jsing
2021-09-10Uncomment LIBRESSL_HAS_{TLS1_3,DTLS1_2} in opensslfeatures.hTheo Buehler
2021-09-10Use BN_RAND_* instead of mysterious values in the documentation ofTheo Buehler
BN_rand_range() From OpenSSL 1.1.1l ok beck jsing
2021-09-10Expose EC_GROUP_order_bits() in <openssl/ec.h>Theo Buehler
ok beck jsing
2021-09-10Expose BN_bn2{,le}binpad() and BN_lebin2bn() in <openssl/bn.h>Theo Buehler
ok beck inoguchi
2021-09-10Expose BN_RAND_* in <openssl/bn.h>Theo Buehler
ok beck jsing
2021-09-10Prepare to provide BN_RAND_* flags for BN_rand_range()Theo Buehler
ok beck jsing
2021-09-09When calling the legacy callback, ensure we catch the case where itBob Beck
has decided to change a succeess to a failure and change the error code. Fixes a regression in the openssl-ruby tests which expect to test this functionality. ok tb@
2021-09-08Prepare to provide EC_GROUP_order_bits()Theo Buehler
ok jsing
2021-09-08Fix leak in cms_RecipientInfo_kekri_decrypt()Theo Buehler
Free ec->key before reassigning it. From OpenSSL 1.1.1, 58e1e397 ok inoguchi
2021-09-08Prepare to provide BN_bn2{,le}binpad() and BN_lebin2bn()Theo Buehler
As found by jsg and patrick, this is needed for newer uboot and will also be used in upcoming elliptic curve work. This is from OpenSSL 1.1.1l with minor style tweaks. ok beck inoguchi
2021-09-08Replace bare ; with continue;Job Snijders
OK tb@
2021-09-08Fix indentation of comments and labelsJob Snijders
OK tb@
2021-09-07Replace (&(x)) pattern with &xJob Snijders
No functional changes. OK tb@
2021-09-07KNFJob Snijders
OK tb@ jsing@ beck@
2021-09-03Add X509 Extensions for IP Addresses and AS IdentifiersJob Snijders
(subordinate code paths are include guarded) OK tb@
2021-09-03Call the callback on success in new verifier in a compatible wayBob Beck
when we succeed with a chain, and ensure we do not call the callback twice when the caller doesn't expect it. A refactor of the end of the legacy verify code in x509_vfy is probably overdue, but this should be done based on a piece that works. the important bit here is this allows the perl regression tests in tree to pass. Changes the previously committed regress tests to test the success case callbacks to be known to pass. ok bluhm@ tb@
2021-09-02Unroll ASN1_ITEM_ref()Job Snijders
OK @tb
2021-09-02Change OPENSSL_strdup() to strdup()Job Snijders
OK tb@
2021-09-02Change OPENSSL_malloc to calloc()Job Snijders
OK tb@
2021-09-02Repair unrolling of static ASN1_ITEM IPAddrBlocks_itJob Snijders
The conversion tool didn't handle 'static_ASN1_ITEM_TEMPLATE_END' OK tb@
2021-09-02Make v3_addr and v3_asid extern constJob Snijders
OK tb@
2021-09-02Add err.h for X509error() and friendsJob Snijders
OK tb@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-29 19:43:37 +0000