Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update (add quic)

Browse Source
This commit is contained in:
Hakase
2020-07-12 19:52:18 +09:00
parent 3a6d64bb68
commit e85ee33eee
501 changed files with 19166 additions and 10232 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/x509/v3_alt.c
+1 -1
View File
@@ -128,7 +128,7 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
BIO_snprintf(othername, sizeof(othername), "othername: %s:",
oline);
else
strncpy(othername, "othername:", sizeof(othername));
OPENSSL_strlcpy(othername, "othername:", sizeof(othername));
/* check if the value is something printable */
if (gen->d.otherName->value->type == V_ASN1_IA5STRING) {
crypto/x509/v3_ncons.c
+1 -1
View File
@@ -197,7 +197,7 @@ static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip)
int len2 = ip->length - len1;
char *ip1 = ipaddr_to_asc(ip->data, len1);
char *ip2 = ipaddr_to_asc(ip->data + len1, len2);
int ret = ret = ip1 != NULL && ip2 != NULL
int ret = ip1 != NULL && ip2 != NULL
&& BIO_printf(bp, "IP:%s/%s", ip1, ip2) > 0;
OPENSSL_free(ip1);
crypto/x509/x509_cmp.c
+1 -1
View File
@@ -300,7 +300,7 @@ int X509_check_private_key(const X509 *x, const EVP_PKEY *k)
xk = X509_get0_pubkey(x);
if (xk)
ret = EVP_PKEY_cmp(xk, k);
ret = EVP_PKEY_eq(xk, k);
else
ret = -2;
crypto/x509/x509_d2.c
+1 -4
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -73,8 +73,6 @@ int X509_STORE_load_store(X509_STORE *ctx, const char *uri)
return 1;
}
/* Deprecated */
#ifndef OPENSSL_NO_DEPRECATED_3_0
int X509_STORE_load_locations(X509_STORE *ctx, const char *file,
const char *path)
{
@@ -86,4 +84,3 @@ int X509_STORE_load_locations(X509_STORE *ctx, const char *file,
return 0;
return 1;
}
#endif
crypto/x509/x509_err.c
+2 -2
View File
@@ -20,10 +20,10 @@ static const ERR_STRING_DATA X509_str_reasons[] = {
{ERR_PACK(ERR_LIB_X509, 0, X509_R_BASE64_DECODE_ERROR),
"base64 decode error"},
{ERR_PACK(ERR_LIB_X509, 0, X509_R_CANT_CHECK_DH_KEY), "cant check dh key"},
{ERR_PACK(ERR_LIB_X509, 0, X509_R_CERT_ALREADY_IN_HASH_TABLE),
"cert already in hash table"},
{ERR_PACK(ERR_LIB_X509, 0, X509_R_CERTIFICATE_VERIFICATION_FAILED),
"certificate verification failed"},
{ERR_PACK(ERR_LIB_X509, 0, X509_R_CERT_ALREADY_IN_HASH_TABLE),
"cert already in hash table"},
{ERR_PACK(ERR_LIB_X509, 0, X509_R_CRL_ALREADY_DELTA), "crl already delta"},
{ERR_PACK(ERR_LIB_X509, 0, X509_R_CRL_VERIFY_FAILURE),
"crl verify failure"},
crypto/x509/x509_req.c
+1 -1
View File
@@ -85,7 +85,7 @@ int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
int ok = 0;
xk = X509_REQ_get_pubkey(x);
switch (EVP_PKEY_cmp(xk, k)) {
switch (EVP_PKEY_eq(xk, k)) {
case 1:
ok = 1;
break;
crypto/x509/x509_vfy.c
+39 -14
View File
@@ -139,10 +139,9 @@ static X509 *lookup_cert_match(X509_STORE_CTX *ctx, X509 *x)
xtmp = sk_X509_value(certs, i);
if (!X509_cmp(xtmp, x))
break;
xtmp = NULL;
}
if (i < sk_X509_num(certs))
X509_up_ref(xtmp);
else
if (xtmp != NULL && !X509_up_ref(xtmp))
xtmp = NULL;
sk_X509_pop_free(certs, X509_free);
return xtmp;
@@ -275,17 +274,24 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
return -1;
}
if (!X509_up_ref(ctx->cert)) {
X509err(X509_F_X509_VERIFY_CERT, ERR_R_INTERNAL_ERROR);
ctx->error = X509_V_ERR_UNSPECIFIED;
return -1;
}
/*
* first we make sure the chain we are going to build is present and that
* the first entry is in place
*/
if (((ctx->chain = sk_X509_new_null()) == NULL) ||
(!sk_X509_push(ctx->chain, ctx->cert))) {
if ((ctx->chain = sk_X509_new_null()) == NULL
|| !sk_X509_push(ctx->chain, ctx->cert)) {
X509_free(ctx->cert);
X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
ctx->error = X509_V_ERR_OUT_OF_MEM;
return -1;
}
X509_up_ref(ctx->cert);
ctx->num_untrusted = 1;
/* If the peer's public key is too weak, we can stop early. */
@@ -370,11 +376,15 @@ static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer)
static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
{
*issuer = find_issuer(ctx, ctx->other_ctx, x);
if (*issuer) {
X509_up_ref(*issuer);
return 1;
} else
return 0;
if (*issuer == NULL || !X509_up_ref(*issuer))
goto err;
return 1;
err:
*issuer = NULL;
return 0;
}
static STACK_OF(X509) *lookup_certs_sk(X509_STORE_CTX *ctx,
@@ -387,15 +397,21 @@ static STACK_OF(X509) *lookup_certs_sk(X509_STORE_CTX *ctx,
for (i = 0; i < sk_X509_num(ctx->other_ctx); i++) {
x = sk_X509_value(ctx->other_ctx, i);
if (X509_NAME_cmp(nm, X509_get_subject_name(x)) == 0) {
if (!X509_up_ref(x)) {
sk_X509_pop_free(sk, X509_free);
X509err(X509_F_LOOKUP_CERTS_SK, ERR_R_INTERNAL_ERROR);
ctx->error = X509_V_ERR_UNSPECIFIED;
return NULL;
}
if (sk == NULL)
sk = sk_X509_new_null();
if (sk == NULL || sk_X509_push(sk, x) == 0) {
if (sk == NULL || !sk_X509_push(sk, x)) {
X509_free(x);
sk_X509_pop_free(sk, X509_free);
X509err(X509_F_LOOKUP_CERTS_SK, ERR_R_MALLOC_FAILURE);
ctx->error = X509_V_ERR_OUT_OF_MEM;
return NULL;
}
X509_up_ref(x);
}
}
return sk;
@@ -3244,7 +3260,16 @@ static int build_chain(X509_STORE_CTX *ctx)
/* Drop this issuer from future consideration */
(void) sk_X509_delete_ptr(sktmp, xtmp);
if (!X509_up_ref(xtmp)) {
X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR);
trust = X509_TRUST_REJECTED;
ctx->error = X509_V_ERR_UNSPECIFIED;
search = 0;
continue;
}
if (!sk_X509_push(ctx->chain, xtmp)) {
X509_free(xtmp);
X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE);
trust = X509_TRUST_REJECTED;
ctx->error = X509_V_ERR_OUT_OF_MEM;
@@ -3252,7 +3277,7 @@ static int build_chain(X509_STORE_CTX *ctx)
continue;
}
X509_up_ref(x = xtmp);
x = xtmp;
++ctx->num_untrusted;
ss = cert_self_signed(ctx, xtmp);
if (ss < 0) {
crypto/x509/x_all.c
+10 -19
View File
@@ -20,7 +20,7 @@
#include <openssl/evp.h>
#include <openssl/x509.h>
#include "crypto/x509.h"
#include <openssl/http.h>
#include <openssl/ocsp.h>
#include <openssl/rsa.h>
#include <openssl/dsa.h>
#include <openssl/x509v3.h>
@@ -130,21 +130,11 @@ int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx)
&x->sig_alg, &x->signature, &x->cert_info, ctx);
}
#if !defined(OPENSSL_NO_SOCK)
static ASN1_VALUE *simple_get_asn1(const char *url, BIO *bio, BIO *rbio,
int timeout, const ASN1_ITEM *it)
#ifndef OPENSSL_NO_OCSP
int X509_http_nbio(OCSP_REQ_CTX *rctx, X509 **pcert)
{
return OSSL_HTTP_get_asn1(url, NULL, NULL /* no proxy used */, bio,
rbio, NULL /* no callback for SSL/TLS */, NULL,
NULL /* headers */, 1024 /* maxline */,
0 /* max_resp_len */, timeout,
NULL /* expected_content_type */, it);
}
X509 *X509_load_http(const char *url, BIO *bio, BIO *rbio, int timeout)
{
return (X509 *)simple_get_asn1(url, bio, rbio, timeout,
ASN1_ITEM_rptr(X509));
return OCSP_REQ_CTX_nbio_d2i(rctx,
(ASN1_VALUE **)pcert, ASN1_ITEM_rptr(X509));
}
#endif
@@ -176,11 +166,12 @@ int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx)
&x->crl, ctx);
}
#if !defined(OPENSSL_NO_SOCK)
X509_CRL *X509_CRL_load_http(const char *url, BIO *bio, BIO *rbio, int timeout)
#ifndef OPENSSL_NO_OCSP
int X509_CRL_http_nbio(OCSP_REQ_CTX *rctx, X509_CRL **pcrl)
{
return (X509_CRL *)simple_get_asn1(url, bio, rbio, timeout,
ASN1_ITEM_rptr(X509_CRL));
return OCSP_REQ_CTX_nbio_d2i(rctx,
(ASN1_VALUE **)pcrl,
ASN1_ITEM_rptr(X509_CRL));
}
#endif
crypto/x509/x_pubkey.c
+31 -7
View File
@@ -30,7 +30,7 @@ struct X509_pubkey_st {
EVP_PKEY *pkey;
};
static int x509_pubkey_decode(EVP_PKEY **pk, X509_PUBKEY *key);
static int x509_pubkey_decode(EVP_PKEY **pk, const X509_PUBKEY *key);
/* Minor tweak to operation: free up EVP_PKEY */
static int pubkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
@@ -151,7 +151,7 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
*/
static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
static int x509_pubkey_decode(EVP_PKEY **ppkey, const X509_PUBKEY *key)
{
EVP_PKEY *pkey = EVP_PKEY_new();
@@ -188,7 +188,7 @@ static int x509_pubkey_decode(EVP_PKEY **ppkey, X509_PUBKEY *key)
return 0;
}
EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
EVP_PKEY *X509_PUBKEY_get0(const X509_PUBKEY *key)
{
EVP_PKEY *ret = NULL;
@@ -216,11 +216,14 @@ EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key)
return NULL;
}
EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
EVP_PKEY *X509_PUBKEY_get(const X509_PUBKEY *key)
{
EVP_PKEY *ret = X509_PUBKEY_get0(key);
if (ret != NULL)
EVP_PKEY_up_ref(ret);
if (ret != NULL && !EVP_PKEY_up_ref(ret)) {
X509err(X509_F_X509_PUBKEY_GET, ERR_R_INTERNAL_ERROR);
ret = NULL;
}
return ret;
}
@@ -450,7 +453,7 @@ int X509_PUBKEY_set0_param(X509_PUBKEY *pub, ASN1_OBJECT *aobj,
int X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg,
const unsigned char **pk, int *ppklen,
X509_ALGOR **pa, X509_PUBKEY *pub)
X509_ALGOR **pa, const X509_PUBKEY *pub)
{
if (ppkalg)
*ppkalg = pub->algor->algorithm;
@@ -469,3 +472,24 @@ ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)
return NULL;
return x->cert_info.key->public_key;
}
/* Returns 1 for equal, 0, for non-equal, < 0 on error */
int X509_PUBKEY_eq(const X509_PUBKEY *a, const X509_PUBKEY *b)
{
X509_ALGOR *algA, *algB;
EVP_PKEY *pA, *pB;
if (a == b)
return 1;
if (a == NULL || b == NULL)
return 0;
if (!X509_PUBKEY_get0_param(NULL, NULL, NULL, &algA, a) || algA == NULL
|| !X509_PUBKEY_get0_param(NULL, NULL, NULL, &algB, b) || algB == NULL)
return -2;
if (X509_ALGOR_cmp(algA, algB) != 0)
return 0;
if ((pA = X509_PUBKEY_get0(a)) == NULL
|| (pB = X509_PUBKEY_get0(b)) == NULL)
return -2;
return EVP_PKEY_eq(pA, pB);
}