summaryrefslogtreecommitdiffstats
path: root/crypto/x509v3
AgeCommit message (Collapse)Author
2016-08-23Constify some X509_NAME, ASN1 printing codeFdaSilvaYY
ASN1_buf_print, asn1_print_*, X509_NAME_oneline, X509_NAME_print Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-23Constify some input parameters.FdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-18Constify i2a*Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-17Convert X509_CRL* functions to use const gettersMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
2016-08-16Add ASN1_STRING_get0_data(), deprecate ASN1_STRING_data().Dr. Stephen Henson
Deprecate the function ASN1_STRING_data() and replace with a new function ASN1_STRING_get0_data() which returns a constant pointer. Update library to use new function. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05Fix irregularities in GENERAL_NAME_print().Tomas Mraz
Add colon when printing Registered ID. Remove extra space when printing DirName. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1401)
2016-08-05spelling fixes, just comments and readme.klemens
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1413)
2016-08-04Constify two internal methodsFdaSilvaYY
- append_ia5 - old_entry_print Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-26Use sk_CONF_VALUE_pop_free in do_ext_nconf error path.David Benjamin
8605abf13523579ecab8b1f2a4bcb8354d94af79 fixed the nval leak, but it used free instead of pop_free. nval owns its contents, so it should be freed with pop_free. See the pop_free call a few lines down. This is a no-op as, in this codepath, we must have nval == NULL or sk_CONF_VALUE_num(nval) == 0. In those cases, free and pop_free are identical. However, variables should be freed consistently. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1351)
2016-07-25Make it possible for external code to set the certiciate proxy path lengthRichard Levitte
This adds the functions X509_set_proxy_pathlen(), which sets the internal pc path length cache for a given X509 structure, along with X509_get_proxy_pathlen(), which retrieves it. Along with the previously added X509_set_proxy_flag(), this provides the tools needed to manipulate all the information cached on proxy certificates, allowing external code to do what's necessary to have them verified correctly by the libcrypto code. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-25Constify ... X509|X509_CRL|X509_REVOKED|_get_ext*()FdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1300)
2016-07-25Constify (X509|X509V3|X509_CRL|X509_REVOKED)_get_ext_d2i ...FdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1300)
2016-07-25Constify i2s_ASN1_INTEGER, X509V3_get_d2iFdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1300)
2016-07-25Enforce and explicit some const castingFdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1300)
2016-07-25Constify SXNET_add_id_*FdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1300)
2016-07-23Make it possible for external code to flag a certificate as a proxy one.Richard Levitte
This adds the function X509_set_proxy_flag(), which sets the internal flag EXFLAG_PROXY on a given X509 structure. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-20Check for errors allocating the error strings.Kurt Roeckx
Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #1330
2016-07-11Add nameConstraints commonName checking.Dr. Stephen Henson
New hostname checking function asn1_valid_host() Check commonName entries against nameConstraints: any CN components in EE certificate which look like hostnames are checked against nameConstraints. Note that RFC5280 et al only require checking subject alt name against DNS name constraints. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-29SpellingFdaSilvaYY
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1264)
2016-06-20Remove pointless free loop in X509_PURPOSE_cleanup()Kurt Cancemi
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1194)
2016-06-16Spelling fixesFdaSilvaYY
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1219)
2016-06-15Constify input buffers of some X509V3 and X509_PURPOSE -related methodsFdaSilvaYY
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1215)
2016-06-14Remove an unused variable assignmentMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-11Specify array sizesKurt Roeckx
Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1172
2016-06-10Fix an error path leak in do_ext_nconf()Matt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-08Add some accessor API'sRich Salz
GH1098: Add X509_get_pathlen() (and a test) GH1097: Add SSL_is_dtls() function. Documented. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-04Constify X509V3_EXT_*_conf*FdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1074)
2016-06-04Constify s2i_ASN1_IA5STRINGFdaSilvaYY
Return directly NULL after ASN1_STRING_set, as it already has set an error code. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1074)
2016-06-04Constify s2i_ASN1_INTEGERFdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1074)
2016-06-03Fix threading issue that at best will leak memoryPauli
The problem is the checking in policy_cache_set, there is a race condition between the null check and obtaining the lock. The fix is in policy_cache_new to detect if the creation has happened already. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01Don't leak memory on set_reasons() error pathMatt Caswell
The set_reasons() function in v3_crld.c leaks a STACK_OF(CONF_VALUE) object on an error path. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01Don't leak memory on int X509_PURPOSE_add() error pathMatt Caswell
The int X509_PURPOSE_add() function was leaking an X509_PURPOSE object on error. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01Don't leak memory in v2i_POLICY_MAPPINGS() on error pathMatt Caswell
The v2i_POLICY_MAPPINGS() function leaked ASN1_OBJECT pointers on error paths. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01Don't leak memory from notice_section function on error pathMatt Caswell
The notice_section() function allocates a STACK_OF(CONF_VALUE) but then fails to free it on an error path. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01Don't leak memory in v2i_AUTHORITY_KEYIDMatt Caswell
The v2i_AUTHORITY_KEYID() function can leak memory under an error condition. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-28Change a call of OPENSSL_strcasecmp to strcasecmpRichard Levitte
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-05-23Remove unused error/function codes.Rich Salz
Add script to find unused err/reason codes Remove unused reason codes. Remove entries for unused functions Reviewed-by: Matt Caswell <matt@openssl.org>
2016-05-18Ensure verify error is set when X509_verify_cert() failsViktor Dukhovni
Set ctx->error = X509_V_ERR_OUT_OF_MEM when verificaiton cannot continue due to malloc failure. Also, when X509_verify_cert() returns <= 0 make sure that the verification status does not remain X509_V_OK, as a last resort set it it to X509_V_ERR_UNSPECIFIED, just in case some code path returns an error without setting an appropriate value of ctx->error. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-17Copyright consolidation 08/10Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-17Copyright consolidation 07/10Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-16Use OPENSSL_hexchar2intRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-28various spelling fixesFdaSilvaYY
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/952)
2016-04-28Free an ASN1_OBJECT in an error pathMatt Caswell
The r2i_certpol() function allocates an ASN1_OBJECT but can fail to free it in an error path. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-21Fix a missing return value check in v3_addrMatt Caswell
All other instances of extract_min_max are checked for an error return, except this one. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-20Remove --classic build entirelyRichard Levitte
The Unix build was the last to retain the classic build scheme. The new unified scheme has matured enough, even though some details may need polishing. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-18Make string_to_hex/hex_to_string publicRich Salz
Give the API new names, document it. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-18Rename some lowercase API'sRich Salz
Make OBJ_name_cmp internal Rename idea_xxx to IDEA_xxx Rename get_rfc_xxx to BN_get_rfc_xxx Rename v3_addr and v3_asid functions to X509v3_... Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-04Revert "various spelling fixes"Rich Salz
This reverts commit 620d540bd47a96fb6905fbbdd8ea5167a8841a3e. It wasn't reviewed. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-04various spelling fixesFdaSilvaYY
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-22Make X509_PUBKEY opaqueDr. Stephen Henson
Reviewed-by: Matt Caswell <matt@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-22 21:16:26 +0000