summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2021-11-29Stop using BIO_s_file_inernal() in libssl.Theo Buehler
BIO_s_file_internal() should never have leaked out of libcrypto, but it did. As a first step of getting rid of it, stop using it internally. ok jsing
2021-11-29Convert server serialisation of DHE parameters/public key to new functions.Joel Sing
ok inoguchi@ tb@
2021-11-29Factor out/rewrite DHE key exchange.Joel Sing
This follows what was done previously for ECDHE EC point key exchange and will allow for deduplication and further code improvement. Convert the TLSv1.2 client to use the new DHE key exchange functions. ok inoguchi@ tb@
2021-11-29A few sys/param.h annotations lacked ALIGNBYTESTheo de Raadt
2021-11-29Niels agreed to remove the advertising clause; switching theseDamien Miller
to 3-term BSD license.
2021-11-28document ASN1_tag2bit(3)Ingo Schwarze
2021-11-28Document ASN1_object_size(3).Ingo Schwarze
While here, * call the function arguments "content_length" rather than just "length" to make it less likely that the reader confuses them with the total length returned by ASN1_object_size(3); * state that only the short form is supported for content_length <= 127; * add the missing STANDARDS section.
2021-11-28mark ASN1_check_infinite_end() and ASN1_const_check_infinite_end()Ingo Schwarze
as intentionally undocumented
2021-11-27new manual page BIO_f_asn1(3)Ingo Schwarze
2021-11-27Make brk() and sbrk() weak again to fix build with clang 13.Visa Hankala
OK jsg@
2021-11-27Fix incomplete initialization bug: BIO_new(BIO_f_asn1()) neglectedIngo Schwarze
initializing five of the fields in BIO_ASN1_BUF_CTX (prefix, prefix_free, suffix, suffix_free, ex_arg), inviting a segfault in a subsequent call from the application program to BIO_write(3) because subroutines of that function assume that the function pointers are either NULL or valid. Fix this by using the less error-prone calloc(3) idiom. While here, inline asn1_bio_init() at the only call site in asn1_bio_new() to simplify the code and make it easier to read. Bug found and initial patch by me, this version (with inlining) by and OK tb@.
2021-11-26Stop reaching into EVP_PKEY in the rest of libssl.Theo Buehler
ok inoguchi jsing
2021-11-26Simplify two weirdly formatted pieces of code in ssl_rsa.c and stopTheo Buehler
reaching into the EVP_PKEY struct. ok inoguchi jsing
2021-11-26spellingJonathan Gray
ok schwarze@
2021-11-26after the bugfix in x509_vfy.c rev. 1.100,Ingo Schwarze
replace the BUGS section with a shorter CAVEATS section
2021-11-26Bugfix in X509_get_pubkey_parameters(3):Ingo Schwarze
If EVP_PKEY_copy_parameters(3) fails - among other reasons, this may happen when out of memory - the pkey argument and/or the chain argument will not contain all the desired parameters after returning. Consequently, report the failure to the caller rather than silently ignoring it. OK tb@
2021-11-26Simplify the code in X509_get_pubkey_parameters(3)Ingo Schwarze
by using X509_get0_pubkey(3) instead of X509_get_pubkey(3); no functional change. OK tb@ This is similar to the relevant part of the follwoing commit from the OpenSSL 1.1.1 branch, which is still under a free licence, but without the bug that commit introduced into this function in OpenSSL: commit c01ff880d47392b82cce2f93ac4a9bb8c68f8cc7 Author: Dr. Stephen Henson <steve@openssl.org> Date: Mon Dec 14 13:13:32 2015 +0000
2021-11-25Document BIO_method_name(3).Ingo Schwarze
While here, also improve the rest of the page: * add missing BIO_TYPE_* constants * describe BIO_TYPE_START * better function argument names * more precision in the descriptions and regarding the RETURN VALUES * lots of wording improvements * improve the coding style below EXAMPLES * delete a BUGS section describing cretaceous behaviour
2021-11-24Describe what RES_USE_DNSSEC does and how it's affected by trust-adJeremie Courreges-Anglas
ok florian@
2021-11-24Fix OCSP_basic_verify() cert chain construction in case theTheo Buehler
OCSP_BASICRESP bs contains no certificates. From David von Oheimb (OpenSSL 121738d1) ok beck
2021-11-24Simplify slightly by using X509_get0_pubkey() thus eliminating theTheo Buehler
need for EVP_PKEY_free(). ok beck
2021-11-24Fix a whitespace error that has annoyed me for way too longTheo Buehler
2021-11-24Fix timestamp printing in Signed Certificate TimestampsTheo Buehler
Our ASN1_GENERALIZEDTIME_set() doesn't accept time strings with fractional seconds, so don't feed it milliseconds, but only seconds. Ensures that openssl x509 -text prints timestamps instead of skipping them. ok beck jsing
2021-11-24Add certificate transparency methods to the standard extensions.Theo Buehler
This way, CT extensions in certs will be parsed by the new CT code when they are encountered. This gets rid of a lot of gibberish when looking at a cert with 'openssl x509 -text -noout -in server.pem' ok beck jsing
2021-11-24add the missing const qualifiers below EXAMPLES;Ingo Schwarze
from <Malgorzata dot Olszowka at stunnel dot org> via OpenSSL commit 256989ce in the OpenSSL 1.1.1 branch, which is still under a free license
2021-11-24document ASN1_item_ndef_i2d(3)Ingo Schwarze
2021-11-24In some situations, the verifier would discard the error on an unvalidatedBob Beck
certificte chain. This would happen when the verification callback was in use, instructing the verifier to continue unconditionally. This could lead to incorrect decisions being made in software.
2021-11-24libkeynote: stop reaching into EVP_PKEY internals.Theo Buehler
Use EVP_PKEY_get0_RSA() instead of pPublicKey->pkey.rsa. Fix a couple of leaks in the vicinity: we need a reference on the RSA, which is what keynote_free_key() frees, not on the EVP_PKEY. Also, don't leak the entire certificate on success. ok beck
2021-11-24Make the certificate transparency code build with the rest of the libraryBob Beck
Do not expose it yet, this will wait for an upcoming bump ok tb@
2021-11-23Transform a mangled comment into something intelligible.Theo Buehler
from beck
2021-11-23document ASN1_TYPE_set_int_octetstring(3) and ASN1_TYPE_get_int_octetstring(3)Ingo Schwarze
2021-11-23Use LIBRESSL_NEXT_API to document the commented-out functions that areTheo Buehler
not yet available. ok schwarze
2021-11-23document ASN1_TYPE_set_octetstring(3) and ASN1_TYPE_get_octetstring(3)Ingo Schwarze
2021-11-23document a2i_ASN1_INTEGER(3),Ingo Schwarze
i2a_ASN1_ENUMERATED(3), and a2i_ASN1_ENUMERATED(3)
2021-11-23re-align these copies of the a2i_*(3) code with f_string.c rev. 1.19Ingo Schwarze
to fix the same double-counting of the backslash and to make the parsing stricter in the same way; OK tb@
2021-11-23In DH_set0_pqg() also set dh->length if q is set to match what OpenSSL do.Theo Buehler
ok inoguchi jsing
2021-11-22Implement rfc6840 (AD flag processing) if using trusted name serversJeremie Courreges-Anglas
libc can't do DNSSEC validation but it can ask a "security-aware" resolver to do so. Let's send queries with the AD flag set when appropriate, and let applications look at the AD flag in responses in a safe way, ie clear the AD flag if the resolvers aren't trusted. By default we only trust resolvers if resolv.conf(5) only lists name servers on localhost - the obvious candidates being unwind(8) and unbound(8). For non-localhost resolvers, an admin who trusts *all the name servers* listed in resolv.conf(5) *and the network path leading to them* can annotate this with "options trust-ad". AD flag processing gives ssh -o VerifyHostkeyDNS=Yes a chance to fetch SSHFP records in a secure manner, and tightens the situation for other applications, eg those using RES_USE_DNSSEC for DANE. It should be noted that postfix currently assumes trusted name servers by default and forces RES_TRUSTAD if available. RES_TRUSTAD and "options trust-ad" were first introduced in glibc by Florian Weimer. Florian Obser (florian@) contributed various improvements, fixed a bug and added automatic trust for name servers on localhost. ok florian@ phessler@
2021-11-22Fix typoJob Snijders
thanks Matthias Schmidt
2021-11-22new manual page ASN1_NULL_new(3), also documenting ASN1_NULL_free(3)Ingo Schwarze
2021-11-22new manual page a2d_ASN1_OBJECT(3);Ingo Schwarze
while here, add a few STANDARDS references
2021-11-22document ASN1_OBJECT_create(3)Ingo Schwarze
2021-11-21improve legibility of structs in several manpagesJan Klemkow
General uses tabs for general indentation and 4 spaces on tight spots. Also uses extra space to align pointers and non-pointers as we do this on certain places in our source. with improvements from schwarze@ OK schwarze@
2021-11-21In asn1.h rev. 1.55 and asn1/a_time.c rev. 1.28, beck@Ingo Schwarze
provided ASN1_TIME_diff(3). Merge the documentation from the OpenSSL 1.1.1 branch, which is still under a free license.
2021-11-21oops, i forgot the STANDARDS sectionIngo Schwarze
2021-11-21new manual page d2i_ASN1_BOOLEAN(3) also documenting i2d_ASN1_BOOLEAN(3)Ingo Schwarze
2021-11-20sortTheo Buehler
2021-11-20Provide the bytestring APIs for libcrypto internal use.Joel Sing
Bring a copy of the bytestring APIs (CBB/CBS) from libssl, for use in libcrypto - these are not exposed publicly. Discussed with beck@ and tb@
2021-11-20Document ASN1_INTEGER_cmp(3) and ASN1_INTEGER_dup(3).Ingo Schwarze
While here, also improve the description of ASN1_INTEGER_set(3) and add a BUGS section explaining that several of these functions do not provide type safety.
2021-11-20Improve the description of ASN1_OCTET_STRING_cmp(3),Ingo Schwarze
ASN1_OCTET_STRING_dup(3), and ASN1_OCTET_STRING_set(3). Explicitly say that they do not provide any type safety and explain what that means.
2021-11-20Make these files compile - not hooked up to build yet.Bob Beck
ok jsing@ tb@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-30 01:08:31 +0000