summaryrefslogtreecommitdiffstats
path: root/crypto/x509
AgeCommit message (Collapse)Author
2020-04-23Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11616)
2020-04-21Add setter equivalents to X509_REQ_get0_signatureDirk-Willem van Gulik
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10563)
2020-04-18Prevent crash in X509_NAME_cmp() etc. when cert has no issuer or no serialNumberDr. David von Oheimb
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386)
2020-04-16Introduce an internal version of X509_check_issued()Matt Caswell
The internal version is library context aware. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11507)
2020-04-16Create a libctx aware X509_verify_ex()Matt Caswell
This is the same as X509_verify() except that it takes a libctx and propq parameter and signature verification is done using those. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11507)
2020-04-15Teach d2i_PrivateKey et al about libctxMatt Caswell
The Ed448 private key decoding makes algorithm fetches. Therefore we teach d2i_PrivateKey et al about libctx and make sure it is passed through the layers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11494)
2020-04-11Add manpage entry for X509_check_purpose()Jake Maynard
Fixes #10263 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10301)
2020-04-09Use the libctx and propq from the X509_STORE_CTXMatt Caswell
Now that X509_STORE_CTX contain a libctx we should use it in a couple of places where we cache the X509v3 extensions. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11457)
2020-04-08Add X509_STORE_CTX_new_with_libctx()Matt Caswell
Make it possible to create an X509_STORE_CTX with an associated libctx and propq. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11457)
2020-04-07Fix error reporting glitch in X509_STORE_CTX_print_verify_cb() in t_x509.cDr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11448)
2020-04-06Set X509_V_ERR_INVALID_EXTENSION error for invalid basic constraintsTomas Mraz
If we encounter certificate with basic constraints CA:false, pathlen present and X509_V_FLAG_X509_STRICT is set we set X509_V_ERR_INVALID_EXTENSION error. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11463)
2020-04-06Allow certificates with Basic Constraints CA:false, pathlen:0Tomas Mraz
Do not mark such certificates with EXFLAG_INVALID although they violate the RFC 5280, they are syntactically correct and openssl itself can produce such certificates without any errors with command such as: openssl x509 -req -signkey private.pem -in csr.pem -out cert.pem \ -extfile <(echo "basicConstraints=CA:FALSE,pathlen:0") With the commit ba4356ae4002a04e28642da60c551877eea804f7 the EXFLAG_INVALID causes openssl to not consider such certificate even as leaf self-signed certificate which is breaking existing installations. Fixes: #11456 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11463)
2020-04-02 Chunk 10 of CMP contribution to OpenSSL: CMP http client and related testsDr. David von Oheimb
Also improve the generic HTTP client w.r.t. proxy and no_proxy options. Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712). Adds the CMP and CRMF API to libcrypto and the "cmp" app to the CLI. Adds extensive documentation and tests. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11404)
2020-03-30Add the X509v3_cache_extensions() functionMatt Caswell
Various functions cause the results of processing extensions to be cached. The processing itself requires a libctx, and so this implicit caching means that the default ctx is used which can lead to failures. By explicitly caching the extensions we can specify the libctx to be used. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11409)
2020-03-25Issuer Sign Tool extention supportNikolay Morozov
Issuer Sign Tool (1.2.643.100.112) The name of the tool used to signs the subject (ASN1_SEQUENCE) This extention is required to obtain the status of a qualified certificate at Russian Federation. RFC-style description is available here: https://tools.ietf.org/html/draft-deremin-rfc4491-bis-04#section-5 Russian Federal Law 63 "Digital Sign" is available here: http://www.consultant.ru/document/cons_doc_LAW_112701/ Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11216)
2020-03-23Constify various mostly X509-related parameter types in crypto/ and apps/Dr. David von Oheimb
in particular X509_NAME*, X509_STORE{,_CTX}*, and ASN1_INTEGER *, also some result types of new functions, which does not break compatibility Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10504)
2020-03-21Fix error handling in x509v3_cache_extensions and related functionsBernd Edlinger
Basically we use EXFLAG_INVALID for all kinds of out of memory and all kinds of parse errors in x509v3_cache_extensions. [extended tests] Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10755)
2020-03-15X509: Rename X509_set0_sm2_id() and friendsRichard Levitte
- X509_set0_sm2_id() -> X509_set0_distinguishing_id() - X509_get0_sm2_id() -> X509_get0_distinguishing_id() - X509_REQ_set0_sm2_id -> X509_REQ_set0_distinguishing_id() - X509_REQ_get0_sm2_id -> X509_REQ_get0_distinguishing_id() The reason for this rename is that the SM2 ID isn't really a unique SM2 data item, but rather a re-use of the Distinguished that is defined in ISO/IEC 15946-3 as well as in FIPS 196, with no special attribution toward any algorithm in particular. Fixes #11293 Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/11302)
2020-03-10Move OSSL_CMP_X509_digest() to x_all.c, renaming it to X509_digest_sig()Dr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11142)
2020-02-29Rethink the EVP_PKEY cache of provider side keysRichard Levitte
The role of this cache was two-fold: 1. It was a cache of key copies exported to providers with which an operation was initiated. 2. If the EVP_PKEY didn't have a legacy key, item 0 of the cache was the corresponding provider side origin, while the rest was the actual cache. This dual role for item 0 made the code a bit confusing, so we now make a separate keymgmt / keydata pair outside of that cache, which is the provider side "origin" key. A hard rule is that an EVP_PKEY cannot hold a legacy "origin" and a provider side "origin" at the same time. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11148)
2020-02-28x509v3 subjectSignTool extention supportNikolay Morozov
Subject Sign Tool (1.2.643.100.111) The name of the tool used to signs the subject (UTF8String) This extention is required to obtain the status of a qualified certificate at Russian Federation. RFC-style description is available here: https://tools.ietf.org/html/draft-deremin-rfc4491-bis-04#section-5 Russian Federal Law 63 "Digital Sign" is available here: http://www.consultant.ru/document/cons_doc_LAW_112701/ Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11093)
2020-02-17chunk 7 of CMP contribution to OpenSSLDr. David von Oheimb
add CMP message validation and related tests; while doing so: * add ERR_add_error_mem_bio() to crypto/err/err_prn.c * move ossl_cmp_add_error_txt() as ERR_add_error_txt() to crypto/err/err_prn.c * add X509_STORE_CTX_print_verify_cb() to crypto/x509/t_x509.c, adding internally x509_print_ex_brief(), print_certs(), and print_store_certs() * move {ossl_cmp_,}X509_STORE_get1_certs() to crypto/x509/x509_lu.c Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/10620)
2020-02-14Adapt i2d_PUBKEY for provider only keysRichard Levitte
It uses EVP_PKEY serializers to get the desired results. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11078)
2020-02-12Add OSSL_SERIALIZER_PUBKEY_TO_DER_PQ and friendsRichard Levitte
It's already used internally, there's no reason the DER serializer propqueries shouldn't be present alongside the PEM and TEXT ones. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11055)
2020-02-12Deprecate the low level DSA functions.Pauli
Use of the low level DSA functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
2020-02-11X509_PUBKEY_set(): Fix memory leakRichard Levitte
With the provided method of creating the new X509_PUBKEY, an extra EVP_PKEY is created and needs to be properly cleaned away. (note: we could choose to keep it just as well, but there are consequences, explained in a comment in the code) Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11038)
2020-02-10Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.cDr. David von Oheimb
The new client has become an independent libcrpyto module in crypto/http/ and * can handle any types of requests and responses (ASN.1-encoded and plain) * does not include potentially busy loops when waiting for responses but * makes use of a new timeout mechanism integrated with socket-based BIO * supports the use of HTTP proxies and TLS, including HTTPS over proxies * supports HTTP redirection via codes 301 and 302 for GET requests * returns more useful diagnostics in various error situations Also adapts - and strongly simplifies - hitherto uses of HTTP in crypto/ocsp/, crypto/x509/x_all.c, apps/lib/apps.c, and apps/{ocsp,s_client,s_server}.c Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10667)
2020-02-07Fix no-ecMatt Caswell
Recent SM2 related changes were not properly guarded with OPENSSL_NO_EC Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11029)
2020-02-05Stop accepting certificates signed using SHA1 at security level 1Kurt Roeckx
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> GH: #10786
2020-02-04Deprecate the ECDSA and EV_KEY_METHOD functions.Pauli
Use of the low level ECDSA and EC_KEY_METHOD functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10960)
2020-02-02X509: Refactor X509_verify() and X509_REQ_verify() for better streamliningRichard Levitte
The solution to incorporate the SM2 identity processing was an off the side hack that more or less duplicated the ASN1_item_verify() code with just a few lines being different. We replace this with a new function ASN1_item_verify_ctx(), which takes an EVP_MD_CTX pointer instead of an EVP_PKEY pointer, just like its sibling ASN1_item_sign_ctx(). This allows us to refactor X509_verify() and X509_REQ_verify() to simply create a local EVP_MD_CTX and an attached EVP_PKEY_CTX, which gets to hold the SM2 identity, if there is one, and then let ASN1_item_verify_ctx() to its job. This will also make it easier to adapt ASN1_item_verify_ctx() for provider based keys. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10942)
2020-01-28Adapt X509_PUBKEY_set() for use with provided implementationsRichard Levitte
We do this by letting a serializer serialize the provider side key to a DER blob formatted according to the SubjectPublicKeyInfo structure (see RFC 5280), and deserialize it in libcrypto using the usual d2i function. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10851)
2020-01-23Update man3/verify documentation, error textRich Salz
Move the x509_V_ERR_xxx definitions from openssl-verify to X509_STORE_CTX_get_error.pod. Add some missing ones. Consistently start with a lowercase letter, unless it's an acronym. Fix some markup mistakes in X509_verify_cert. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10132)
2019-12-11Add support for otherName:NAIRealm in outputJan-Frederik Rieckers
This commit adds support for displaying RFC 7585 otherName:NAIRealm in the text output of openssl CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10594)
2019-12-04add X509_cmp_timeframe() including its documentationDr. David von Oheimb
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10502)
2019-11-29PROV SERIALIZER: add common functionality to serialize keysRichard Levitte
To support generic output of public keys wrapped in a X509_PUBKEY, additional PEM and i2d/d2i routines are added for that type. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29Check the return from OPENSSL_buf2hexstr()Matt Caswell
The function OPENSSL_buf2hexstr() can return NULL if it fails to allocate memory so the callers should check its return value. Fixes #10525 Reported-by: Ziyang Li (@Liby99) Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10526)
2019-11-07Update source files for pre-3.0 deprecationRichard Levitte
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-04Don't assume the type we read was the type we expectedMatt Caswell
i2v_GENERAL_NAME and GENERAL_NAME_print were assuming that the type of of a GENERAL_NAME (OTHERNAME) that we read in was the type we expected it to be. If its something else then this can cause unexpected behaviour. In the added fuzz test case an OOB read was occurring. This issue was recently added by commit 4baee2d. Credit to OSSFuzz for finding this issue. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10300)
2019-11-04Don't leak memory in the event of a failure in i2v_GENERAL_NAMESMatt Caswell
i2v_GENERAL_NAMES call i2v_GENERAL_NAME repeatedly as required. Each time i2v_GENERAL_NAME gets called it allocates adds data to the passed in stack and then returns a pointer to the stack, or NULL on failure. If the passed in stack is itself NULL then it allocates one. i2v_GENERAL_NAMES was not correctly handling the case where a NULL gets returned from i2v_GENERAL_NAME. If a stack had already been allocated then it just leaked it. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10300)
2019-11-03X509_LOOKUP_store: new X509_LOOKUP_METHOD that works by OSSL_STORE URIRichard Levitte
This is a wrapper around OSSL_STORE. This also adds necessary support functions: - X509_STORE_load_file - X509_STORE_load_path - X509_STORE_load_store - SSL_add_store_cert_subjects_to_stack - SSL_CTX_set_default_verify_store - SSL_CTX_load_verify_file - SSL_CTX_load_verify_dir - SSL_CTX_load_verify_store and deprecates X509_STORE_load_locations and SSL_CTX_load_verify_locations, as they aren't extensible. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8442)
2019-11-03Fix --strict-warnings buildPatrick Steuer
The %zd format corresponds to ssize_t which is used for function to either return a valid size or a negative value to indicate an error. Since size_t is in [-1,SSIZE_MAX] it is not a portable way to represent a pointer diff. For the %td format which corresponds to ptrdiff_t is C11, we chose to cast to long instead as it is already done in other places. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10335)
2019-10-17Rename internal function name_cmp() to v3_name_cmp()Richard Levitte
"name_cmp" caused a clash when linking with the static libcrypto. The slight rename is better than nothing, as v3_ is an already existing prefix. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9979)
2019-10-11Stop using EVP_MD_CTX_FLAG_NON_FIPS_ALLOWRichard Levitte
This is a flag that has lost its relevance. The new mechanism to do the same thing is to fetch the needed digest explicitly with "-fips" as property query, i.e. we remove any requirement for that property to be set when fetching, even if the default property query string requires its presence. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10138)
2019-10-09Explicitly test against NULL; do not use !p or similarRich Salz
Also added blanks lines after declarations in a couple of places. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9916)
2019-09-28Fix header file include guard namesDr. Matthias St. Pierre
Make the include guards consistent by renaming them systematically according to the naming conventions below For the public header files (in the 'include/openssl' directory), the guard names try to match the path specified in the include directives, with all letters converted to upper case and '/' and '.' replaced by '_'. For the private header files files, an extra 'OSSL_' is added as prefix. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
2019-09-28Reorganize public header files (part 1)Dr. Matthias St. Pierre
Rename <openssl/ossl_typ.h> to <openssl/types.h>. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
2019-09-28Reorganize local header filesDr. Matthias St. Pierre
Apart from public and internal header files, there is a third type called local header files, which are located next to source files in the source directory. Currently, they have different suffixes like '*_lcl.h', '*_local.h', or '*_int.h' This commit changes the different suffixes to '*_local.h' uniformly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
2019-09-28Reorganize private crypto header filesDr. Matthias St. Pierre
Currently, there are two different directories which contain internal header files of libcrypto which are meant to be shared internally: While header files in 'include/internal' are intended to be shared between libcrypto and libssl, the files in 'crypto/include/internal' are intended to be shared inside libcrypto only. To make things complicated, the include search path is set up in such a way that the directive #include "internal/file.h" could refer to a file in either of these two directoroes. This makes it necessary in some cases to add a '_int.h' suffix to some files to resolve this ambiguity: #include "internal/file.h" # located in 'include/internal' #include "internal/file_int.h" # located in 'crypto/include/internal' This commit moves the private crypto headers from 'crypto/include/internal' to 'include/crypto' As a result, the include directives become unambiguous #include "internal/file.h" # located in 'include/internal' #include "crypto/file.h" # located in 'include/crypto' hence the superfluous '_int.h' suffixes can be stripped. The files 'store_int.h' and 'store.h' need to be treated specially; they are joined into a single file. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
2019-09-24Support printing out some otherName variantsDmitry Belyavskiy
The supported variants are - SmtpUTF8Name - xmppAddr - MS UPN - SRVName Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9965)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-11 21:28:12 +0000