Age | Commit message (Collapse) | Author |
|
Sometimes it fails to format them very well, and sometimes it corrupts them!
This commit moves some particularly problematic ones.
Conflicts:
crypto/bn/bn.h
crypto/ec/ec_lcl.h
crypto/rsa/rsa.h
demos/engines/ibmca/hw_ibmca.c
ssl/ssl.h
ssl/ssl3.h
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
|
Conflicts:
ssl/s3_lib.c
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
|
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
|
indent will not alter them when reformatting comments
(cherry picked from commit 1d97c8435171a7af575f73c526d79e1ef0ee5960)
Conflicts:
crypto/bn/bn_lcl.h
crypto/bn/bn_prime.c
crypto/engine/eng_all.c
crypto/rc4/rc4_utl.c
crypto/sha/sha.h
ssl/kssl.c
ssl/t1_lib.c
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
|
Reduces number of silly casts in OpenSSL code and likely most
applications. Consistent with (char *) for "peername" value from
X509_check_host() and X509_VERIFY_PARAM_get0_peername().
(cherry picked from commit 297c67fcd817ea643de2fdeff4e434b050d571e2)
|
|
Declaration, memory management, accessor and documentation.
(cherry picked from commit 6e661d458f5aa8f52bf3d9098bd10025de5f08ea)
|
|
Implemented as STACK_OF(OPENSSL_STRING).
(cherry picked from commit 8abffa4a73fcbf6536e0a42d736ed9211a8204ea)
|
|
Fixes to host checking wild card support and add support for
setting host checking flags when verifying a certificate
chain.
(cherry picked from commit 397a8e747dc3f964196caed5ca4e08d4b598362a)
|
|
(cherry picked from commit 9b3d75706ef0114362f04665a3c745bfef59d023)
Conflicts:
crypto/x509/x509_vpm.c
|
|
Move the IP, email and host checking fields from the public
X509_VERIFY_PARAM structure into an opaque X509_VERIFY_PARAM_ID
structure. By doing this the structure can be modified in future
without risk of breaking any applications.
|
|
from X509_STORE_CTX.
|
|
(backport from HEAD)
|
|
Add new verify options to set checks.
(backport from HEAD)
|
|
store instead of the default which is to return an error if we can't build
the complete chain. [backport from HEAD]
|
|
|
|
information. Add more informative message to verify callback to indicate
when CRL path validation is taking place.
|
|
|
|
|
|
a delta CRL in addition to a full CRL. Check and search delta in addition to
the base.
|
|
Tidy CRL scoring system.
Add new CRL path validation error.
|
|
and CRL signing keys.
|
|
TODO: robustness checking on name forms.
|
|
|
|
|
|
handling to support this.
|
|
callbacks.
|
|
based on subject name.
New thread safe functions to retrieve matching STACK from X509_STORE.
Cache some IDP components.
|
|
|
|
a security threat on unexpecting applications. Document and test.
|
|
|
|
CA setting in each certificate on the chain is correct. As a side-
effect always do the following basic checks on extensions, not just
when there's an associated purpose to the check:
- if there is an unhandled critical extension (unless the user has
chosen to ignore this fault)
- if the path length has been exceeded (if one is set at all)
- that certain extensions fit the associated purpose (if one has been
given)
|
|
|
|
|
|
This tidies up verify parameters and adds support for integrated policy
checking.
Add support for policy related command line options. Currently only in smime
application.
WARNING: experimental code subject to change.
|
|
|
|
when trying to build a shared library on VMS or Windows...
|
|
|
|
verified structure can contain its own CRLs (such as PKCS#7 signedData).
Tidy up some of the verify code.
|
|
I'll remember to try to compile this with warnings enabled next time :-)
|
|
This is currently *very* experimental and needs to be more fully integrated
with the main verification code.
|
|
when X509_V_FLAG_X509_STRICT is set. Check for CRLSign in
CRL issuer certificates. Reject CRLs with unhandled (any)
critical extensions.
|
|
|
|
|
|
See the commit log message for that for more information.
NB: X509_STORE_CTX's use of "ex_data" support was actually misimplemented
(initialisation by "memset" won't/can't/doesn't work). This fixes that but
requires that X509_STORE_CTX_init() be able to handle errors - so its
prototype has been changed to return 'int' rather than 'void'. All uses of
that function throughout the source code have been tracked down and
adjusted.
|
|
|
|
sourcecode (including fgrep)
|
|
|
|
|
|
Tidy existing code.
|
|
inherited from X509_STORE.
Add CRL checking options to other applications.
|