sync with OpenBSD -current
This commit is contained in:
parent
fa20b4dfa4
commit
56a087cff9
GPG key ID:
F42C07F07E2E35B7
61 changed files with 2001 additions and 1682 deletions
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: conf_mod.c,v 1.36 2024/03/20 22:11:07 tb Exp $ */
|
||||
/* $OpenBSD: conf_mod.c,v 1.37 2024/03/26 00:24:11 tb Exp $ */
|
||||
/* Written by Stephen Henson (steve@openssl.org) for the OpenSSL
|
||||
* project 2001.
|
||||
*/
|
||||
|
|
@ -279,62 +279,50 @@ module_find(char *name)
|
|||
static int
|
||||
module_init(CONF_MODULE *mod, char *name, char *value, const CONF *cnf)
|
||||
{
|
||||
int ret = 1;
|
||||
int init_called = 0;
|
||||
CONF_IMODULE *imod = NULL;
|
||||
int need_finish = 0;
|
||||
int ret = -1;
|
||||
|
||||
/* Otherwise add initialized module to list */
|
||||
imod = malloc(sizeof(CONF_IMODULE));
|
||||
if (!imod)
|
||||
if (name == NULL || value == NULL)
|
||||
goto err;
|
||||
|
||||
if ((imod = calloc(1, sizeof(*imod))) == NULL)
|
||||
goto err;
|
||||
|
||||
imod->mod = mod;
|
||||
imod->name = name ? strdup(name) : NULL;
|
||||
imod->value = value ? strdup(value) : NULL;
|
||||
imod->usr_data = NULL;
|
||||
|
||||
if (!imod->name || !imod->value)
|
||||
goto memerr;
|
||||
|
||||
/* Try to initialize module */
|
||||
if (mod->init) {
|
||||
ret = mod->init(imod, cnf);
|
||||
init_called = 1;
|
||||
/* Error occurred, exit */
|
||||
if (ret <= 0)
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (initialized_modules == NULL) {
|
||||
initialized_modules = sk_CONF_IMODULE_new_null();
|
||||
if (!initialized_modules) {
|
||||
CONFerror(ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if (!sk_CONF_IMODULE_push(initialized_modules, imod)) {
|
||||
CONFerror(ERR_R_MALLOC_FAILURE);
|
||||
if ((imod->name = strdup(name)) == NULL)
|
||||
goto err;
|
||||
if ((imod->value = strdup(value)) == NULL)
|
||||
goto err;
|
||||
|
||||
if (mod->init != NULL) {
|
||||
need_finish = 1;
|
||||
if (mod->init(imod, cnf) <= 0)
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (initialized_modules == NULL)
|
||||
initialized_modules = sk_CONF_IMODULE_new_null();
|
||||
if (initialized_modules == NULL)
|
||||
goto err;
|
||||
|
||||
if (!sk_CONF_IMODULE_push(initialized_modules, imod))
|
||||
goto err;
|
||||
imod = NULL;
|
||||
need_finish = 0;
|
||||
|
||||
mod->links++;
|
||||
|
||||
return ret;
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
/* We've started the module so we'd better finish it */
|
||||
if (mod->finish && init_called)
|
||||
err:
|
||||
if (need_finish && mod->finish != NULL)
|
||||
mod->finish(imod);
|
||||
|
||||
memerr:
|
||||
if (imod) {
|
||||
free(imod->name);
|
||||
free(imod->value);
|
||||
free(imod);
|
||||
}
|
||||
imodule_free(imod);
|
||||
|
||||
return -1;
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* Unload any dynamic modules that have a link count of zero:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: bio_enc.c,v 1.30 2024/02/18 15:44:10 tb Exp $ */
|
||||
/* $OpenBSD: bio_enc.c,v 1.31 2024/03/25 04:05:22 joshua Exp $ */
|
||||
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
||||
* All rights reserved.
|
||||
*
|
||||
|
|
@ -58,6 +58,7 @@
|
|||
|
||||
#include <errno.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#include <openssl/buffer.h>
|
||||
|
|
@ -83,7 +84,7 @@ typedef struct enc_struct {
|
|||
int cont; /* <= 0 when finished */
|
||||
int finished;
|
||||
int ok; /* bad decrypt */
|
||||
EVP_CIPHER_CTX cipher;
|
||||
EVP_CIPHER_CTX *cipher_ctx;
|
||||
/* buf is larger than ENC_BLOCK_SIZE because EVP_DecryptUpdate
|
||||
* can return up to a block more data than is presented to it
|
||||
*/
|
||||
|
|
@ -107,42 +108,51 @@ BIO_f_cipher(void)
|
|||
return (&methods_enc);
|
||||
}
|
||||
|
||||
static void
|
||||
bio_enc_ctx_free(BIO_ENC_CTX *ctx)
|
||||
{
|
||||
if (ctx == NULL)
|
||||
return;
|
||||
|
||||
EVP_CIPHER_CTX_free(ctx->cipher_ctx);
|
||||
freezero(ctx, sizeof(*ctx));
|
||||
}
|
||||
|
||||
static int
|
||||
enc_new(BIO *bi)
|
||||
{
|
||||
BIO_ENC_CTX *ctx;
|
||||
int ret = 0;
|
||||
|
||||
ctx = malloc(sizeof(BIO_ENC_CTX));
|
||||
if (ctx == NULL)
|
||||
return (0);
|
||||
EVP_CIPHER_CTX_legacy_clear(&ctx->cipher);
|
||||
if ((ctx = calloc(1, sizeof(BIO_ENC_CTX))) == NULL)
|
||||
goto err;
|
||||
if ((ctx->cipher_ctx = EVP_CIPHER_CTX_new()) == NULL)
|
||||
goto err;
|
||||
|
||||
ctx->buf_len = 0;
|
||||
ctx->buf_off = 0;
|
||||
ctx->cont = 1;
|
||||
ctx->finished = 0;
|
||||
ctx->ok = 1;
|
||||
|
||||
bi->init = 0;
|
||||
bi->ptr = (char *)ctx;
|
||||
bi->flags = 0;
|
||||
return (1);
|
||||
bi->ptr = ctx;
|
||||
ctx = NULL;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
bio_enc_ctx_free(ctx);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
enc_free(BIO *a)
|
||||
{
|
||||
BIO_ENC_CTX *b;
|
||||
|
||||
if (a == NULL)
|
||||
return (0);
|
||||
b = (BIO_ENC_CTX *)a->ptr;
|
||||
EVP_CIPHER_CTX_cleanup(&(b->cipher));
|
||||
freezero(a->ptr, sizeof(BIO_ENC_CTX));
|
||||
a->ptr = NULL;
|
||||
a->init = 0;
|
||||
a->flags = 0;
|
||||
return (1);
|
||||
return 0;
|
||||
|
||||
bio_enc_ctx_free(a->ptr);
|
||||
explicit_bzero(a, sizeof(*a));
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
|
|
@ -189,7 +199,7 @@ enc_read(BIO *b, char *out, int outl)
|
|||
/* Should be continue next time we are called? */
|
||||
if (!BIO_should_retry(b->next_bio)) {
|
||||
ctx->cont = i;
|
||||
i = EVP_CipherFinal_ex(&(ctx->cipher),
|
||||
i = EVP_CipherFinal_ex(ctx->cipher_ctx,
|
||||
(unsigned char *)ctx->buf,
|
||||
&(ctx->buf_len));
|
||||
ctx->ok = i;
|
||||
|
|
@ -199,7 +209,7 @@ enc_read(BIO *b, char *out, int outl)
|
|||
break;
|
||||
}
|
||||
} else {
|
||||
EVP_CipherUpdate(&(ctx->cipher),
|
||||
EVP_CipherUpdate(ctx->cipher_ctx,
|
||||
(unsigned char *)ctx->buf, &ctx->buf_len,
|
||||
(unsigned char *)&(ctx->buf[BUF_OFFSET]), i);
|
||||
ctx->cont = 1;
|
||||
|
|
@ -259,7 +269,7 @@ enc_write(BIO *b, const char *in, int inl)
|
|||
ctx->buf_off = 0;
|
||||
while (inl > 0) {
|
||||
n = (inl > ENC_BLOCK_SIZE) ? ENC_BLOCK_SIZE : inl;
|
||||
EVP_CipherUpdate(&(ctx->cipher),
|
||||
EVP_CipherUpdate(ctx->cipher_ctx,
|
||||
(unsigned char *)ctx->buf, &ctx->buf_len,
|
||||
(unsigned char *)in, n);
|
||||
inl -= n;
|
||||
|
|
@ -292,14 +302,14 @@ enc_ctrl(BIO *b, int cmd, long num, void *ptr)
|
|||
int i;
|
||||
EVP_CIPHER_CTX **c_ctx;
|
||||
|
||||
ctx = (BIO_ENC_CTX *)b->ptr;
|
||||
ctx = b->ptr;
|
||||
|
||||
switch (cmd) {
|
||||
case BIO_CTRL_RESET:
|
||||
ctx->ok = 1;
|
||||
ctx->finished = 0;
|
||||
EVP_CipherInit_ex(&(ctx->cipher), NULL, NULL, NULL, NULL,
|
||||
ctx->cipher.encrypt);
|
||||
EVP_CipherInit_ex(ctx->cipher_ctx, NULL, NULL, NULL, NULL,
|
||||
ctx->cipher_ctx->encrypt);
|
||||
ret = BIO_ctrl(b->next_bio, cmd, num, ptr);
|
||||
break;
|
||||
case BIO_CTRL_EOF: /* More to read */
|
||||
|
|
@ -320,7 +330,7 @@ enc_ctrl(BIO *b, int cmd, long num, void *ptr)
|
|||
break;
|
||||
case BIO_CTRL_FLUSH:
|
||||
/* do a final write */
|
||||
again:
|
||||
again:
|
||||
while (ctx->buf_len != ctx->buf_off) {
|
||||
i = enc_write(b, NULL, 0);
|
||||
if (i < 0)
|
||||
|
|
@ -330,7 +340,7 @@ again:
|
|||
if (!ctx->finished) {
|
||||
ctx->finished = 1;
|
||||
ctx->buf_off = 0;
|
||||
ret = EVP_CipherFinal_ex(&(ctx->cipher),
|
||||
ret = EVP_CipherFinal_ex(ctx->cipher_ctx,
|
||||
(unsigned char *)ctx->buf,
|
||||
&(ctx->buf_len));
|
||||
ctx->ok = (int)ret;
|
||||
|
|
@ -353,15 +363,14 @@ again:
|
|||
BIO_copy_next_retry(b);
|
||||
break;
|
||||
case BIO_C_GET_CIPHER_CTX:
|
||||
c_ctx = (EVP_CIPHER_CTX **)ptr;
|
||||
(*c_ctx) = &(ctx->cipher);
|
||||
c_ctx = ptr;
|
||||
*c_ctx = ctx->cipher_ctx;
|
||||
b->init = 1;
|
||||
break;
|
||||
case BIO_CTRL_DUP:
|
||||
dbio = (BIO *)ptr;
|
||||
dctx = (BIO_ENC_CTX *)dbio->ptr;
|
||||
EVP_CIPHER_CTX_legacy_clear(&dctx->cipher);
|
||||
ret = EVP_CIPHER_CTX_copy(&dctx->cipher, &ctx->cipher);
|
||||
dbio = ptr;
|
||||
dctx = dbio->ptr;
|
||||
ret = EVP_CIPHER_CTX_copy(dctx->cipher_ctx, ctx->cipher_ctx);
|
||||
if (ret)
|
||||
dbio->init = 1;
|
||||
break;
|
||||
|
|
@ -369,7 +378,8 @@ again:
|
|||
ret = BIO_ctrl(b->next_bio, cmd, num, ptr);
|
||||
break;
|
||||
}
|
||||
return (ret);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static long
|
||||
|
|
@ -408,7 +418,7 @@ BIO_set_cipher(BIO *b, const EVP_CIPHER *c, const unsigned char *k,
|
|||
|
||||
BIO_set_init(b, 1);
|
||||
|
||||
if (!EVP_CipherInit_ex(&(ctx->cipher), c, NULL, k, i, e))
|
||||
if (!EVP_CipherInit_ex(ctx->cipher_ctx, c, NULL, k, i, e))
|
||||
return 0;
|
||||
|
||||
if (cb != NULL)
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: evp_key.c,v 1.34 2024/02/18 15:45:42 tb Exp $ */
|
||||
/* $OpenBSD: evp_key.c,v 1.35 2024/03/25 10:58:06 joshua Exp $ */
|
||||
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
||||
* All rights reserved.
|
||||
*
|
||||
|
|
@ -135,7 +135,7 @@ EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
|
|||
const unsigned char *salt, const unsigned char *data, int datal,
|
||||
int count, unsigned char *key, unsigned char *iv)
|
||||
{
|
||||
EVP_MD_CTX c;
|
||||
EVP_MD_CTX *md_ctx;
|
||||
unsigned char md_buf[EVP_MAX_MD_SIZE];
|
||||
int niv, nkey, addmd = 0;
|
||||
unsigned int mds = 0, i;
|
||||
|
|
@ -156,27 +156,29 @@ EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
|
|||
if (data == NULL)
|
||||
return nkey;
|
||||
|
||||
EVP_MD_CTX_legacy_clear(&c);
|
||||
if ((md_ctx = EVP_MD_CTX_new()) == NULL)
|
||||
goto err;
|
||||
|
||||
for (;;) {
|
||||
if (!EVP_DigestInit_ex(&c, md, NULL))
|
||||
if (!EVP_DigestInit_ex(md_ctx, md, NULL))
|
||||
goto err;
|
||||
if (addmd++)
|
||||
if (!EVP_DigestUpdate(&c, &(md_buf[0]), mds))
|
||||
if (!EVP_DigestUpdate(md_ctx, &(md_buf[0]), mds))
|
||||
goto err;
|
||||
if (!EVP_DigestUpdate(&c, data, datal))
|
||||
if (!EVP_DigestUpdate(md_ctx, data, datal))
|
||||
goto err;
|
||||
if (salt != NULL)
|
||||
if (!EVP_DigestUpdate(&c, salt, PKCS5_SALT_LEN))
|
||||
if (!EVP_DigestUpdate(md_ctx, salt, PKCS5_SALT_LEN))
|
||||
goto err;
|
||||
if (!EVP_DigestFinal_ex(&c, &(md_buf[0]), &mds))
|
||||
if (!EVP_DigestFinal_ex(md_ctx, &(md_buf[0]), &mds))
|
||||
goto err;
|
||||
|
||||
for (i = 1; i < (unsigned int)count; i++) {
|
||||
if (!EVP_DigestInit_ex(&c, md, NULL))
|
||||
if (!EVP_DigestInit_ex(md_ctx, md, NULL))
|
||||
goto err;
|
||||
if (!EVP_DigestUpdate(&c, &(md_buf[0]), mds))
|
||||
if (!EVP_DigestUpdate(md_ctx, &(md_buf[0]), mds))
|
||||
goto err;
|
||||
if (!EVP_DigestFinal_ex(&c, &(md_buf[0]), &mds))
|
||||
if (!EVP_DigestFinal_ex(md_ctx, &(md_buf[0]), &mds))
|
||||
goto err;
|
||||
}
|
||||
i = 0;
|
||||
|
|
@ -210,7 +212,7 @@ EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
|
|||
rv = type->key_len;
|
||||
|
||||
err:
|
||||
EVP_MD_CTX_cleanup(&c);
|
||||
EVP_MD_CTX_free(md_ctx);
|
||||
explicit_bzero(md_buf, sizeof md_buf);
|
||||
return rv;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: evp_pbe.c,v 1.48 2024/03/24 06:48:03 tb Exp $ */
|
||||
/* $OpenBSD: evp_pbe.c,v 1.49 2024/03/25 11:38:47 joshua Exp $ */
|
||||
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
|
||||
* project 1999.
|
||||
*/
|
||||
|
|
@ -234,7 +234,7 @@ int
|
|||
PKCS5_PBE_keyivgen(EVP_CIPHER_CTX *cctx, const char *pass, int passlen,
|
||||
ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md, int en_de)
|
||||
{
|
||||
EVP_MD_CTX ctx;
|
||||
EVP_MD_CTX *md_ctx;
|
||||
unsigned char md_tmp[EVP_MAX_MD_SIZE];
|
||||
unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH];
|
||||
int i;
|
||||
|
|
@ -277,22 +277,23 @@ PKCS5_PBE_keyivgen(EVP_CIPHER_CTX *cctx, const char *pass, int passlen,
|
|||
else if (passlen == -1)
|
||||
passlen = strlen(pass);
|
||||
|
||||
EVP_MD_CTX_legacy_clear(&ctx);
|
||||
if ((md_ctx = EVP_MD_CTX_new()) == NULL)
|
||||
goto err;
|
||||
|
||||
if (!EVP_DigestInit_ex(&ctx, md, NULL))
|
||||
if (!EVP_DigestInit_ex(md_ctx, md, NULL))
|
||||
goto err;
|
||||
if (!EVP_DigestUpdate(&ctx, pass, passlen))
|
||||
if (!EVP_DigestUpdate(md_ctx, pass, passlen))
|
||||
goto err;
|
||||
if (!EVP_DigestUpdate(&ctx, salt, saltlen))
|
||||
if (!EVP_DigestUpdate(md_ctx, salt, saltlen))
|
||||
goto err;
|
||||
if (!EVP_DigestFinal_ex(&ctx, md_tmp, NULL))
|
||||
if (!EVP_DigestFinal_ex(md_ctx, md_tmp, NULL))
|
||||
goto err;
|
||||
for (i = 1; i < iter; i++) {
|
||||
if (!EVP_DigestInit_ex(&ctx, md, NULL))
|
||||
if (!EVP_DigestInit_ex(md_ctx, md, NULL))
|
||||
goto err;
|
||||
if (!EVP_DigestUpdate(&ctx, md_tmp, mdsize))
|
||||
if (!EVP_DigestUpdate(md_ctx, md_tmp, mdsize))
|
||||
goto err;
|
||||
if (!EVP_DigestFinal_ex (&ctx, md_tmp, NULL))
|
||||
if (!EVP_DigestFinal_ex(md_ctx, md_tmp, NULL))
|
||||
goto err;
|
||||
}
|
||||
if ((size_t)EVP_CIPHER_key_length(cipher) > sizeof(md_tmp)) {
|
||||
|
|
@ -315,7 +316,7 @@ PKCS5_PBE_keyivgen(EVP_CIPHER_CTX *cctx, const char *pass, int passlen,
|
|||
ret = 1;
|
||||
|
||||
err:
|
||||
EVP_MD_CTX_cleanup(&ctx);
|
||||
EVP_MD_CTX_free(md_ctx);
|
||||
PBEPARAM_free(pbe);
|
||||
|
||||
return ret;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: m_sigver.c,v 1.15 2024/02/18 15:45:42 tb Exp $ */
|
||||
/* $OpenBSD: m_sigver.c,v 1.18 2024/03/25 11:41:40 joshua Exp $ */
|
||||
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
|
||||
* project 2006.
|
||||
*/
|
||||
|
|
@ -141,32 +141,41 @@ EVP_DigestVerifyInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, const EVP_MD *type,
|
|||
return do_sigver_init(ctx, pctx, type, pkey, 1);
|
||||
}
|
||||
|
||||
static int
|
||||
evp_digestsignfinal_sigctx_custom(EVP_MD_CTX *ctx, unsigned char *sigret,
|
||||
size_t *siglen)
|
||||
{
|
||||
EVP_PKEY_CTX *pctx = ctx->pctx;
|
||||
EVP_PKEY_CTX *dctx = NULL;
|
||||
int ret = 0;
|
||||
|
||||
if (sigret == NULL)
|
||||
return pctx->pmeth->signctx(pctx, sigret, siglen, ctx);
|
||||
|
||||
/* XXX - support EVP_MD_CTX_FLAG_FINALISE? */
|
||||
if ((dctx = EVP_PKEY_CTX_dup(pctx)) == NULL)
|
||||
goto err;
|
||||
|
||||
if (!dctx->pmeth->signctx(dctx, sigret, siglen, ctx))
|
||||
goto err;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
EVP_PKEY_CTX_free(dctx);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
int
|
||||
EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen)
|
||||
{
|
||||
EVP_PKEY_CTX *pctx = ctx->pctx;
|
||||
int sctx;
|
||||
int r = 0;
|
||||
|
||||
if (pctx->pmeth->flags & EVP_PKEY_FLAG_SIGCTX_CUSTOM) {
|
||||
EVP_PKEY_CTX *dctx;
|
||||
if (pctx->pmeth->flags & EVP_PKEY_FLAG_SIGCTX_CUSTOM)
|
||||
return evp_digestsignfinal_sigctx_custom(ctx, sigret, siglen);
|
||||
|
||||
if (sigret == NULL)
|
||||
return pctx->pmeth->signctx(pctx, sigret, siglen, ctx);
|
||||
|
||||
/* XXX - support EVP_MD_CTX_FLAG_FINALISE? */
|
||||
if ((dctx = EVP_PKEY_CTX_dup(ctx->pctx)) == NULL)
|
||||
return 0;
|
||||
r = dctx->pmeth->signctx(dctx, sigret, siglen, ctx);
|
||||
EVP_PKEY_CTX_free(dctx);
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
if (ctx->pctx->pmeth->signctx)
|
||||
sctx = 1;
|
||||
else
|
||||
sctx = 0;
|
||||
if (sigret) {
|
||||
EVP_MD_CTX tmp_ctx;
|
||||
unsigned char md[EVP_MAX_MD_SIZE];
|
||||
|
|
@ -174,18 +183,20 @@ EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen)
|
|||
EVP_MD_CTX_legacy_clear(&tmp_ctx);
|
||||
if (!EVP_MD_CTX_copy_ex(&tmp_ctx, ctx))
|
||||
return 0;
|
||||
if (sctx)
|
||||
if (ctx->pctx->pmeth->signctx != NULL) {
|
||||
r = tmp_ctx.pctx->pmeth->signctx(tmp_ctx.pctx,
|
||||
sigret, siglen, &tmp_ctx);
|
||||
else
|
||||
r = EVP_DigestFinal_ex(&tmp_ctx, md, &mdlen);
|
||||
EVP_MD_CTX_cleanup(&tmp_ctx);
|
||||
return r;
|
||||
}
|
||||
r = EVP_DigestFinal_ex(&tmp_ctx, md, &mdlen);
|
||||
EVP_MD_CTX_cleanup(&tmp_ctx);
|
||||
if (sctx || !r)
|
||||
if (!r)
|
||||
return r;
|
||||
if (EVP_PKEY_sign(ctx->pctx, sigret, siglen, md, mdlen) <= 0)
|
||||
return 0;
|
||||
} else {
|
||||
if (sctx) {
|
||||
if (ctx->pctx->pmeth->signctx != NULL) {
|
||||
if (ctx->pctx->pmeth->signctx(ctx->pctx, sigret,
|
||||
siglen, ctx) <= 0)
|
||||
return 0;
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
/* $OpenBSD: hkdf.c,v 1.10 2023/07/07 13:54:46 beck Exp $ */
|
||||
/* Copyright (c) 2014, Google Inc.
|
||||
/* $OpenBSD: hkdf.c,v 1.11 2024/03/25 13:09:13 jsing Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2014, Google Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and/or distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
|
|
@ -21,6 +22,7 @@
|
|||
#include <openssl/err.h>
|
||||
#include <openssl/hmac.h>
|
||||
|
||||
#include "bytestring.h"
|
||||
#include "evp_local.h"
|
||||
#include "hmac_local.h"
|
||||
|
||||
|
|
@ -73,51 +75,61 @@ HKDF_expand(uint8_t *out_key, size_t out_len,
|
|||
const uint8_t *info, size_t info_len)
|
||||
{
|
||||
const size_t digest_len = EVP_MD_size(digest);
|
||||
uint8_t previous[EVP_MAX_MD_SIZE];
|
||||
size_t n, done = 0;
|
||||
unsigned int i;
|
||||
uint8_t out_hmac[EVP_MAX_MD_SIZE];
|
||||
size_t n, remaining;
|
||||
uint8_t ctr;
|
||||
HMAC_CTX *hmac = NULL;
|
||||
CBB cbb;
|
||||
int ret = 0;
|
||||
HMAC_CTX hmac;
|
||||
|
||||
if (!CBB_init_fixed(&cbb, out_key, out_len))
|
||||
goto err;
|
||||
|
||||
if ((hmac = HMAC_CTX_new()) == NULL)
|
||||
goto err;
|
||||
if (!HMAC_Init_ex(hmac, prk, prk_len, digest, NULL))
|
||||
goto err;
|
||||
|
||||
remaining = out_len;
|
||||
ctr = 0;
|
||||
|
||||
/* Expand key material to desired length. */
|
||||
n = (out_len + digest_len - 1) / digest_len;
|
||||
if (out_len + digest_len < out_len || n > 255) {
|
||||
CRYPTOerror(EVP_R_TOO_LARGE);
|
||||
return 0;
|
||||
}
|
||||
while (remaining > 0) {
|
||||
if (++ctr == 0) {
|
||||
CRYPTOerror(EVP_R_TOO_LARGE);
|
||||
goto err;
|
||||
}
|
||||
|
||||
HMAC_CTX_init(&hmac);
|
||||
if (!HMAC_Init_ex(&hmac, prk, prk_len, digest, NULL))
|
||||
goto out;
|
||||
if (!HMAC_Update(hmac, info, info_len))
|
||||
goto err;
|
||||
if (!HMAC_Update(hmac, &ctr, 1))
|
||||
goto err;
|
||||
if (!HMAC_Final(hmac, out_hmac, NULL))
|
||||
goto err;
|
||||
|
||||
for (i = 0; i < n; i++) {
|
||||
uint8_t ctr = i + 1;
|
||||
size_t todo;
|
||||
if ((n = remaining) > digest_len)
|
||||
n = digest_len;
|
||||
|
||||
if (i != 0 && (!HMAC_Init_ex(&hmac, NULL, 0, NULL, NULL) ||
|
||||
!HMAC_Update(&hmac, previous, digest_len)))
|
||||
goto out;
|
||||
if (!CBB_add_bytes(&cbb, out_hmac, n))
|
||||
goto err;
|
||||
|
||||
if (!HMAC_Update(&hmac, info, info_len) ||
|
||||
!HMAC_Update(&hmac, &ctr, 1) ||
|
||||
!HMAC_Final(&hmac, previous, NULL))
|
||||
goto out;
|
||||
remaining -= n;
|
||||
|
||||
todo = digest_len;
|
||||
if (todo > out_len - done)
|
||||
todo = out_len - done;
|
||||
|
||||
memcpy(out_key + done, previous, todo);
|
||||
done += todo;
|
||||
if (remaining > 0) {
|
||||
if (!HMAC_Init_ex(hmac, NULL, 0, NULL, NULL))
|
||||
goto err;
|
||||
if (!HMAC_Update(hmac, out_hmac, digest_len))
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
|
||||
out:
|
||||
HMAC_CTX_cleanup(&hmac);
|
||||
explicit_bzero(previous, sizeof(previous));
|
||||
if (ret != 1)
|
||||
CRYPTOerror(ERR_R_CRYPTO_LIB);
|
||||
err:
|
||||
CBB_cleanup(&cbb);
|
||||
HMAC_CTX_free(hmac);
|
||||
explicit_bzero(out_hmac, sizeof(out_hmac));
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(HKDF_expand);
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: ts.h,v 1.23 2023/11/19 15:46:10 tb Exp $ */
|
||||
/* $OpenBSD: ts.h,v 1.24 2024/03/26 00:39:22 beck Exp $ */
|
||||
/* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL
|
||||
* project 2002, 2003, 2004.
|
||||
*/
|
||||
|
|
@ -389,8 +389,8 @@ int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
|
|||
'0' means sec, '3' msec, '6' usec, and so on. Default is 0. */
|
||||
int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx,
|
||||
unsigned clock_precision_digits);
|
||||
/* At most we accept usec precision. */
|
||||
#define TS_MAX_CLOCK_PRECISION_DIGITS 6
|
||||
/* At most we accept sec precision. */
|
||||
#define TS_MAX_CLOCK_PRECISION_DIGITS 0
|
||||
|
||||
/* No flags are set by default. */
|
||||
void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags);
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: ts_conf.c,v 1.13 2023/11/19 15:46:10 tb Exp $ */
|
||||
/* $OpenBSD: ts_conf.c,v 1.14 2024/03/26 00:39:22 beck Exp $ */
|
||||
/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
|
||||
* project 2002.
|
||||
*/
|
||||
|
|
@ -437,7 +437,8 @@ TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
|
|||
if (!NCONF_get_number_e(conf, section, ENV_CLOCK_PRECISION_DIGITS,
|
||||
&digits))
|
||||
digits = 0;
|
||||
if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) {
|
||||
/* We only support second precision, so reject everything else */
|
||||
if (digits != 0) {
|
||||
TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
|
||||
goto err;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: ts_rsp_sign.c,v 1.33 2024/03/24 11:30:12 beck Exp $ */
|
||||
/* $OpenBSD: ts_rsp_sign.c,v 1.35 2024/03/26 00:39:22 beck Exp $ */
|
||||
/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
|
||||
* project 2002.
|
||||
*/
|
||||
|
|
@ -90,9 +90,6 @@ static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed);
|
|||
static int TS_TST_INFO_content_new(PKCS7 *p7);
|
||||
static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc);
|
||||
|
||||
static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision(
|
||||
ASN1_GENERALIZEDTIME *, time_t, long, unsigned);
|
||||
|
||||
/* Default callbacks for response generation. */
|
||||
|
||||
static ASN1_INTEGER *
|
||||
|
|
@ -434,7 +431,7 @@ LCRYPTO_ALIAS(TS_RESP_CTX_get_tst_info);
|
|||
int
|
||||
TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, unsigned precision)
|
||||
{
|
||||
if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)
|
||||
if (precision > 0)
|
||||
return 0;
|
||||
ctx->clock_precision_digits = precision;
|
||||
return 1;
|
||||
|
|
@ -650,8 +647,7 @@ TS_RESP_create_tst_info(TS_RESP_CTX *ctx, ASN1_OBJECT *policy)
|
|||
!TS_TST_INFO_set_serial(tst_info, serial))
|
||||
goto end;
|
||||
if (!(*ctx->time_cb)(ctx, ctx->time_cb_data, &sec, &usec) ||
|
||||
!(asn1_time = TS_RESP_set_genTime_with_precision(NULL, sec, usec,
|
||||
ctx->clock_precision_digits)) ||
|
||||
((asn1_time = ASN1_GENERALIZEDTIME_set(NULL, sec)) == NULL) ||
|
||||
!TS_TST_INFO_set_time(tst_info, asn1_time))
|
||||
goto end;
|
||||
|
||||
|
|
@ -984,75 +980,3 @@ err:
|
|||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
static ASN1_GENERALIZEDTIME *
|
||||
TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time,
|
||||
time_t sec, long usec, unsigned precision)
|
||||
{
|
||||
struct tm *tm = NULL;
|
||||
char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS];
|
||||
char usecstr[TS_MAX_CLOCK_PRECISION_DIGITS + 2];
|
||||
char *p;
|
||||
int rv;
|
||||
|
||||
if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)
|
||||
goto err;
|
||||
|
||||
if (OPENSSL_gmtime(&sec, tm) == NULL)
|
||||
goto err;
|
||||
|
||||
/*
|
||||
* Put "genTime_str" in GeneralizedTime format. We work around the
|
||||
* restrictions imposed by rfc3280 (i.e. "GeneralizedTime values MUST
|
||||
* NOT include fractional seconds") and OpenSSL related functions to
|
||||
* meet the rfc3161 requirement: "GeneralizedTime syntax can include
|
||||
* fraction-of-second details".
|
||||
*/
|
||||
if (precision > 0) {
|
||||
/* To make things a bit harder, X.690 | ISO/IEC 8825-1 provides
|
||||
the following restrictions for a DER-encoding, which OpenSSL
|
||||
(specifically ASN1_GENERALIZEDTIME_check() function) doesn't
|
||||
support:
|
||||
"The encoding MUST terminate with a "Z" (which means "Zulu"
|
||||
time). The decimal point element, if present, MUST be the
|
||||
point option ".". The fractional-seconds elements,
|
||||
if present, MUST omit all trailing 0's;
|
||||
if the elements correspond to 0, they MUST be wholly
|
||||
omitted, and the decimal point element also MUST be
|
||||
omitted." */
|
||||
(void) snprintf(usecstr, sizeof(usecstr), ".%06ld", usec);
|
||||
/* truncate and trim trailing 0 */
|
||||
usecstr[precision + 1] = '\0';
|
||||
p = usecstr + strlen(usecstr) - 1;
|
||||
while (p > usecstr && *p == '0')
|
||||
*p-- = '\0';
|
||||
/* if we've reached the beginning, delete the . too */
|
||||
if (p == usecstr)
|
||||
*p = '\0';
|
||||
|
||||
} else {
|
||||
/* empty */
|
||||
usecstr[0] = '\0';
|
||||
}
|
||||
rv = snprintf(genTime_str, sizeof(genTime_str),
|
||||
"%04d%02d%02d%02d%02d%02d%sZ",
|
||||
tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
|
||||
tm->tm_hour, tm->tm_min, tm->tm_sec, usecstr);
|
||||
if (rv < 0 || rv >= sizeof(genTime_str))
|
||||
goto err;
|
||||
|
||||
/* Now call OpenSSL to check and set our genTime value */
|
||||
if (!asn1_time && !(asn1_time = ASN1_GENERALIZEDTIME_new()))
|
||||
goto err;
|
||||
if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str)) {
|
||||
ASN1_GENERALIZEDTIME_free(asn1_time);
|
||||
goto err;
|
||||
}
|
||||
|
||||
return asn1_time;
|
||||
|
||||
err:
|
||||
TSerror(TS_R_COULD_NOT_SET_TIME);
|
||||
return NULL;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: x509_cmp.c,v 1.43 2024/02/18 15:45:42 tb Exp $ */
|
||||
/* $OpenBSD: x509_cmp.c,v 1.44 2024/03/25 03:41:16 joshua Exp $ */
|
||||
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
||||
* All rights reserved.
|
||||
*
|
||||
|
|
@ -91,34 +91,35 @@ unsigned long
|
|||
X509_issuer_and_serial_hash(X509 *a)
|
||||
{
|
||||
unsigned long ret = 0;
|
||||
EVP_MD_CTX ctx;
|
||||
EVP_MD_CTX *md_ctx;
|
||||
unsigned char md[16];
|
||||
char *f;
|
||||
char *f = NULL;
|
||||
|
||||
EVP_MD_CTX_legacy_clear(&ctx);
|
||||
f = X509_NAME_oneline(a->cert_info->issuer, NULL, 0);
|
||||
if (f == NULL)
|
||||
if ((md_ctx = EVP_MD_CTX_new()) == NULL)
|
||||
goto err;
|
||||
if (!EVP_DigestInit_ex(&ctx, EVP_md5(), NULL))
|
||||
|
||||
if ((f = X509_NAME_oneline(a->cert_info->issuer, NULL, 0)) == NULL)
|
||||
goto err;
|
||||
if (!EVP_DigestUpdate(&ctx, (unsigned char *)f, strlen(f)))
|
||||
if (!EVP_DigestInit_ex(md_ctx, EVP_md5(), NULL))
|
||||
goto err;
|
||||
free(f);
|
||||
f = NULL;
|
||||
if (!EVP_DigestUpdate(&ctx,
|
||||
if (!EVP_DigestUpdate(md_ctx, (unsigned char *)f, strlen(f)))
|
||||
goto err;
|
||||
if (!EVP_DigestUpdate(md_ctx,
|
||||
(unsigned char *)a->cert_info->serialNumber->data,
|
||||
(unsigned long)a->cert_info->serialNumber->length))
|
||||
goto err;
|
||||
if (!EVP_DigestFinal_ex(&ctx, &(md[0]), NULL))
|
||||
if (!EVP_DigestFinal_ex(md_ctx, &(md[0]), NULL))
|
||||
goto err;
|
||||
|
||||
ret = (((unsigned long)md[0]) | ((unsigned long)md[1] << 8L) |
|
||||
((unsigned long)md[2] << 16L) | ((unsigned long)md[3] << 24L)) &
|
||||
0xffffffffL;
|
||||
|
||||
err:
|
||||
EVP_MD_CTX_cleanup(&ctx);
|
||||
EVP_MD_CTX_free(md_ctx);
|
||||
free(f);
|
||||
return (ret);
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(X509_issuer_and_serial_hash);
|
||||
#endif
|
||||
|
|
@ -285,24 +286,27 @@ LCRYPTO_ALIAS(X509_NAME_hash);
|
|||
unsigned long
|
||||
X509_NAME_hash_old(X509_NAME *x)
|
||||
{
|
||||
EVP_MD_CTX md_ctx;
|
||||
EVP_MD_CTX *md_ctx;
|
||||
unsigned long ret = 0;
|
||||
unsigned char md[16];
|
||||
|
||||
if ((md_ctx = EVP_MD_CTX_new()) == NULL)
|
||||
return ret;
|
||||
|
||||
/* Make sure X509_NAME structure contains valid cached encoding */
|
||||
i2d_X509_NAME(x, NULL);
|
||||
EVP_MD_CTX_legacy_clear(&md_ctx);
|
||||
if (EVP_DigestInit_ex(&md_ctx, EVP_md5(), NULL) &&
|
||||
EVP_DigestUpdate(&md_ctx, x->bytes->data, x->bytes->length) &&
|
||||
EVP_DigestFinal_ex(&md_ctx, md, NULL))
|
||||
if (EVP_DigestInit_ex(md_ctx, EVP_md5(), NULL) &&
|
||||
EVP_DigestUpdate(md_ctx, x->bytes->data, x->bytes->length) &&
|
||||
EVP_DigestFinal_ex(md_ctx, md, NULL))
|
||||
ret = (((unsigned long)md[0]) |
|
||||
((unsigned long)md[1] << 8L) |
|
||||
((unsigned long)md[2] << 16L) |
|
||||
((unsigned long)md[3] << 24L)) &
|
||||
0xffffffffL;
|
||||
EVP_MD_CTX_cleanup(&md_ctx);
|
||||
|
||||
return (ret);
|
||||
EVP_MD_CTX_free(md_ctx);
|
||||
|
||||
return ret;
|
||||
}
|
||||
LCRYPTO_ALIAS(X509_NAME_hash_old);
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: x509_trs.c,v 1.49 2024/03/25 00:46:57 tb Exp $ */
|
||||
/* $OpenBSD: x509_trs.c,v 1.54 2024/03/25 04:03:26 tb Exp $ */
|
||||
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
|
||||
* project 1999.
|
||||
*/
|
||||
|
|
@ -68,18 +68,12 @@
|
|||
#include "x509_internal.h"
|
||||
#include "x509_local.h"
|
||||
|
||||
typedef struct x509_trust_st {
|
||||
int trust;
|
||||
int (*check_trust)(struct x509_trust_st *, X509 *);
|
||||
int nid;
|
||||
} X509_TRUST;
|
||||
|
||||
static int
|
||||
obj_trust(int id, X509 *x)
|
||||
obj_trust(int id, const X509 *x)
|
||||
{
|
||||
const X509_CERT_AUX *aux;
|
||||
ASN1_OBJECT *obj;
|
||||
int i, nid;
|
||||
X509_CERT_AUX *aux;
|
||||
|
||||
if ((aux = x->aux) == NULL)
|
||||
return X509_TRUST_UNTRUSTED;
|
||||
|
|
@ -102,90 +96,39 @@ obj_trust(int id, X509 *x)
|
|||
}
|
||||
|
||||
static int
|
||||
trust_compat(X509_TRUST *trust, X509 *x)
|
||||
trust_compat(int nid, const X509 *x)
|
||||
{
|
||||
/* Extensions already cached in X509_check_trust(). */
|
||||
if (x->ex_flags & EXFLAG_SS)
|
||||
if ((x->ex_flags & EXFLAG_SS) != 0)
|
||||
return X509_TRUST_TRUSTED;
|
||||
else
|
||||
return X509_TRUST_UNTRUSTED;
|
||||
}
|
||||
|
||||
static int
|
||||
trust_1oidany(X509_TRUST *trust, X509 *x)
|
||||
{
|
||||
if (x->aux && (x->aux->trust || x->aux->reject))
|
||||
return obj_trust(trust->nid, x);
|
||||
/* we don't have any trust settings: for compatibility
|
||||
* we return trusted if it is self signed
|
||||
*/
|
||||
return trust_compat(trust, x);
|
||||
}
|
||||
|
||||
static int
|
||||
trust_1oid(X509_TRUST *trust, X509 *x)
|
||||
{
|
||||
if (x->aux)
|
||||
return obj_trust(trust->nid, x);
|
||||
return X509_TRUST_UNTRUSTED;
|
||||
}
|
||||
|
||||
/* WARNING: the following table should be kept in order of trust
|
||||
* and without any gaps so we can just subtract the minimum trust
|
||||
* value to get an index into the table
|
||||
*/
|
||||
static int
|
||||
trust_1oidany(int nid, const X509 *x)
|
||||
{
|
||||
/* Inspect the certificate's trust settings if there are any. */
|
||||
if (x->aux != NULL && (x->aux->trust != NULL || x->aux->reject != NULL))
|
||||
return obj_trust(nid, x);
|
||||
|
||||
static const X509_TRUST trstandard[] = {
|
||||
{
|
||||
.trust = X509_TRUST_COMPAT,
|
||||
.check_trust = trust_compat,
|
||||
},
|
||||
{
|
||||
.trust = X509_TRUST_SSL_CLIENT,
|
||||
.check_trust = trust_1oidany,
|
||||
.nid = NID_client_auth,
|
||||
},
|
||||
{
|
||||
.trust = X509_TRUST_SSL_SERVER,
|
||||
.check_trust = trust_1oidany,
|
||||
.nid = NID_server_auth,
|
||||
},
|
||||
{
|
||||
.trust = X509_TRUST_EMAIL,
|
||||
.check_trust = trust_1oidany,
|
||||
.nid = NID_email_protect,
|
||||
},
|
||||
{
|
||||
.trust = X509_TRUST_OBJECT_SIGN,
|
||||
.check_trust = trust_1oidany,
|
||||
.nid = NID_code_sign,
|
||||
},
|
||||
{
|
||||
.trust = X509_TRUST_OCSP_SIGN,
|
||||
.check_trust = trust_1oid,
|
||||
.nid = NID_OCSP_sign,
|
||||
},
|
||||
{
|
||||
.trust = X509_TRUST_OCSP_REQUEST,
|
||||
.check_trust = trust_1oid,
|
||||
.nid = NID_ad_OCSP,
|
||||
},
|
||||
{
|
||||
.trust = X509_TRUST_TSA,
|
||||
.check_trust = trust_1oidany,
|
||||
.nid = NID_time_stamp,
|
||||
},
|
||||
};
|
||||
/* For compatibility we return trusted if the cert is self signed. */
|
||||
return trust_compat(NID_undef, x);
|
||||
}
|
||||
|
||||
#define X509_TRUST_COUNT (sizeof(trstandard) / sizeof(trstandard[0]))
|
||||
static int
|
||||
trust_1oid(int nid, const X509 *x)
|
||||
{
|
||||
if (x->aux != NULL)
|
||||
return obj_trust(nid, x);
|
||||
|
||||
CTASSERT(X509_TRUST_MIN == 1 && X509_TRUST_MAX == X509_TRUST_COUNT);
|
||||
return X509_TRUST_UNTRUSTED;
|
||||
}
|
||||
|
||||
int
|
||||
X509_check_trust(X509 *x, int trust_id, int flags)
|
||||
{
|
||||
const X509_TRUST *trust;
|
||||
int idx;
|
||||
int rv;
|
||||
|
||||
if (trust_id == -1)
|
||||
return 1;
|
||||
|
|
@ -194,29 +137,39 @@ X509_check_trust(X509 *x, int trust_id, int flags)
|
|||
if (!x509v3_cache_extensions(x))
|
||||
return X509_TRUST_UNTRUSTED;
|
||||
|
||||
/*
|
||||
* XXX beck/jsing This enables self signed certs to be trusted for
|
||||
* an unspecified id/trust flag value (this is NOT the
|
||||
* X509_TRUST_DEFAULT), which was the longstanding
|
||||
* openssl behaviour. boringssl does not have this behaviour.
|
||||
*
|
||||
* This should be revisited, but changing the default "not default"
|
||||
* may break things.
|
||||
*/
|
||||
if (trust_id == 0) {
|
||||
int rv;
|
||||
switch (trust_id) {
|
||||
case 0:
|
||||
/*
|
||||
* XXX beck/jsing This enables self signed certs to be trusted
|
||||
* for an unspecified id/trust flag value (this is NOT the
|
||||
* X509_TRUST_DEFAULT), which was the longstanding openssl
|
||||
* behaviour. boringssl does not have this behaviour.
|
||||
*
|
||||
* This should be revisited, but changing the default
|
||||
* "not default" may break things.
|
||||
*/
|
||||
rv = obj_trust(NID_anyExtendedKeyUsage, x);
|
||||
if (rv != X509_TRUST_UNTRUSTED)
|
||||
return rv;
|
||||
return trust_compat(NULL, x);
|
||||
}
|
||||
|
||||
if (trust_id < X509_TRUST_MIN || trust_id > X509_TRUST_MAX)
|
||||
return trust_compat(NID_undef, x);
|
||||
case X509_TRUST_COMPAT:
|
||||
return trust_compat(NID_undef, x);
|
||||
case X509_TRUST_SSL_CLIENT:
|
||||
return trust_1oidany(NID_client_auth, x);
|
||||
case X509_TRUST_SSL_SERVER:
|
||||
return trust_1oidany(NID_server_auth, x);
|
||||
case X509_TRUST_EMAIL:
|
||||
return trust_1oidany(NID_email_protect, x);
|
||||
case X509_TRUST_OBJECT_SIGN:
|
||||
return trust_1oidany(NID_code_sign, x);
|
||||
case X509_TRUST_OCSP_SIGN:
|
||||
return trust_1oid(NID_OCSP_sign, x);
|
||||
case X509_TRUST_OCSP_REQUEST:
|
||||
return trust_1oid(NID_ad_OCSP, x);
|
||||
case X509_TRUST_TSA:
|
||||
return trust_1oidany(NID_time_stamp, x);
|
||||
default:
|
||||
return obj_trust(trust_id, x);
|
||||
|
||||
idx = trust_id - X509_TRUST_MIN;
|
||||
trust = &trstandard[idx];
|
||||
|
||||
return trust->check_trust((X509_TRUST *)trust, x);
|
||||
}
|
||||
}
|
||||
LCRYPTO_ALIAS(X509_check_trust);
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: x509rset.c,v 1.12 2023/02/16 08:38:17 tb Exp $ */
|
||||
/* $OpenBSD: x509rset.c,v 1.14 2024/03/25 12:10:57 jsing Exp $ */
|
||||
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
||||
* All rights reserved.
|
||||
*
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue