summaryrefslogtreecommitdiffstats
path: root/crypto/x509v3
AgeCommit message (Collapse)Author
2014-07-07Update API to use (char *) for email addresses and hostnamesViktor Dukhovni
Reduces number of silly casts in OpenSSL code and likely most applications. Consistent with (char *) for "peername" value from X509_check_host() and X509_VERIFY_PARAM_get0_peername(). (cherry picked from commit 297c67fcd817ea643de2fdeff4e434b050d571e2)
2014-07-07Set optional peername when X509_check_host() succeeds.Viktor Dukhovni
Pass address of X509_VERIFY_PARAM_ID peername to X509_check_host(). Document modified interface. (cherry picked from commit ced3d9158a7a8c676be504bb6cd3b5ffb7cc7f13)
2014-06-25More complete input validation of X509_check_mumbleViktor Dukhovni
(cherry picked from commit 29edebe95c2a51470c78c7e769c926719965eeb1)
2014-06-25Drop hostlen from X509_VERIFY_PARAM_ID.Viktor Dukhovni
Just store NUL-terminated strings. This works better when we add support for multiple hostnames. (cherry picked from commit b3012c698a086937319ed413a113ed7bec1edd1a)
2014-06-14Enforce _X509_CHECK_FLAG_DOT_SUBDOMAINS internal-onlyViktor Dukhovni
(cherry picked from commit d435e23959f1c2cb4feadbfba9ad884c59f37db9)
2014-06-12Client-side namecheck wildcards.Viktor Dukhovni
A client reference identity of ".example.com" matches a server certificate presented identity that is any sub-domain of "example.com" (e.g. "www.sub.example.com). With the X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS flag, it matches only direct child sub-domains (e.g. "www.sub.example.com"). (cherry picked from commit e52c52f10bb8e34aaf8f28f3e5b56939e8f6b357)
2014-06-12make updateDr. Stephen Henson
2014-06-11Separate the SCT List parser from the SCT List viewerRob Stradling
(cherry picked from commit fd2309aa29e3ea00e445f03407820398962c0b94)
2014-05-21Fixes to host checking.Viktor Dukhovni
Fixes to host checking wild card support and add support for setting host checking flags when verifying a certificate chain. (cherry picked from commit 397a8e747dc3f964196caed5ca4e08d4b598362a)
2014-04-15Extension checking fixes.Dr. Stephen Henson
When looking for an extension we need to set the last found position to -1 to properly search all extensions. PR#3309. (cherry picked from commit 300b9f0b704048f60776881f1d378c74d9c32fbd)
2014-02-25Don't use BN_ULLONG in n2l8 use SCTS_TIMESTAMP.Dr. Stephen Henson
2014-02-25Fix for v3_scts.cDr. Stephen Henson
Not all platforms define BN_ULLONG. Define SCTS_TIMESTAMP as a type which should work on all platforms.
2014-02-25Parse non-v1 SCTs less awkwardly.Rob Stradling
(cherry picked from commit 19f65ddbab30543415584ae7916e12a3c5249dba)
2014-02-20make updateDr. Stephen Henson
2014-02-20fix WIN32 warningsDr. Stephen Henson
2014-02-20Show the contents of the RFC6962 Signed Certificate Timestamp List ↵Rob Stradling
Certificate/OCSP Extensions. Add the RFC6962 OIDs to the objects table. (backport from master branch)
2014-02-14Include self-signed flag in certificates by checking SKID/AKID as wellDr. Stephen Henson
as issuer and subject names. Although this is an incompatible change it should have little impact in pratice because self-issued certificates that are not self-signed are rarely encountered. (cherry picked from commit b1efb7161f409c81178b9aa95583db3390f90b1b)
2014-02-02Add extension free function.Ben Laurie
2012-12-26Portability fix: use BIO_snprintf and pick up strcasecmp alternativeDr. Stephen Henson
definitions from e_os.h
2012-12-26Oops, add missing v3nametest.cDr. Stephen Henson
2012-12-19Backport X509 hostname, IP address and email checking code from HEAD.Dr. Stephen Henson
2012-12-19Check chain is not NULL before assuming we have a validated chain. TheDr. Stephen Henson
modification to the OCSP helper purpose breaks normal OCSP verification. It is no longer needed now we can trust partial chains.
2012-12-14Backport OCSP fixes.Ben Laurie
2012-12-06Fix two bugs which affect delta CRL handling:Dr. Stephen Henson
Use -1 to check all extensions in CRLs. Always set flag for freshest CRL.
2012-04-06Backport: allow key agreement in SSL/TLS certificates (from HEAD)Dr. Stephen Henson
2012-02-23PR: 2696Dr. Stephen Henson
Submitted by: Rob Austein <sra@hactrn.net> Fix inverted range problem in RFC3779 code. Thanks to Andrew Chi for generating test cases for this bug.
2012-01-04Prevent malformed RFC3779 data triggering an assertion failure (CVE-2011-4577)Dr. Stephen Henson
2012-01-04fix warningsDr. Stephen Henson
2011-10-09PR: 2482Dr. Stephen Henson
Submitted by: Rob Austein <sra@hactrn.net> Reviewed by: steve Don't allow inverted ranges in RFC3779 code, discovered by Frank Ellermann.
2011-06-03Backport libcrypto audit: check return values of EVP functions insteadDr. Stephen Henson
of assuming they will always suceed.
2011-01-03oops missed an assertDr. Stephen Henson
2011-01-03PR: 2411Dr. Stephen Henson
Submitted by: Rob Austein <sra@hactrn.net> Reviewed by: steve Fix corner cases in RFC3779 code.
2011-01-03PR: 2410Dr. Stephen Henson
Submitted by: Rob Austein <sra@hactrn.net> Reviewed by: steve Use OPENSSL_assert() instead of assert().
2010-10-11PR: 2295Dr. Stephen Henson
Submitted by: Alexei Khlebnikov <alexei.khlebnikov@opera.com> Reviewed by: steve OOM checking. Leak in OOM fix. Fall-through comment. Duplicate code elimination.
2010-06-15Fix warnings (From HEAD, original patch by Ben).Dr. Stephen Henson
2010-05-22PR: 2251Dr. Stephen Henson
Submitted by: Ger Hobbelt <ger@hobbelt.com> Approved by: steve@openssl.org Memleak, BIO chain leak and realloc checks in v3_pci.c
2009-09-30PR: 2057Dr. Stephen Henson
Submitted by: Julia Lawall <julia@diku.dk> Approved by: steve@openssl.org Correct BIO_write, BIO_printf, i2a_ASN1_INTEGER and i2a_ASN1_OBJECT error handling in OCSP print routines.
2009-08-31Missing break.Dr. Stephen Henson
2009-07-27Change STRING to OPENSSL_STRING etc as common words suchDr. Stephen Henson
as "STRING" cause conflicts with other headers/libraries.
2009-05-30Ensure canonical encodings of X509_NAME structures are valid.Dr. Stephen Henson
2009-04-27v3_alt.c: otherName parsing fix from HEAD.Andy Polyakov
Submitted by: Love Hoernquist Aastrand
2009-04-19Fix error header files and error files too.Dr. Stephen Henson
2009-04-16PR: 1894Dr. Stephen Henson
Submitted by: Ger Hobbelt <ger@hobbelt.com> Approved by: steve@openssl.org Fix various typos and stuff.
2009-04-13PR: 1786Dr. Stephen Henson
Submitted by: Ger Hobbelt <ger@hobbelt.com> Approved by: steve@openssl.org Add missing IMPLEMENT.
2009-04-08PR: 1892Dr. Stephen Henson
Fix memory leak when email:move option used.
2009-04-03PR: 1613Dr. Stephen Henson
Submitted by: "Jean Rebiffe" <jrebiffe@gmail.com> Approved by: steve@openssl.org Free section.
2009-04-03Update from 0.9.8-stable.Dr. Stephen Henson
2009-03-15Use OPENSSL_assert() instead of assert.Dr. Stephen Henson
2009-03-14PR: 1864Dr. Stephen Henson
Submitted by: Ger Hobbelt <ger@hobbelt.com> Reviewed by: steve@openssl.org Check return value.
2009-03-14Update from stable branch.Dr. Stephen Henson
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-25 21:22:35 +0000