aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/ess
Commit message (Collapse)AuthorAgeFilesLines
* Generate the error headers and tables at build timeBob Beck2026-09-011-48/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Teach util/mkerr.pl two new modes. -emit FILE writes one generated error file to standard output as a pure function of openssl.ec and openssl.txt, with no source scan and no state update; every file in the openssl.ec L table becomes a GENERATE rule driven by it, and the generated error headers join the mandatory generated headers. -state scans the sources and maintains openssl.txt but writes no other files; "make errors" now uses it, so the developer flow only curates the state and the build emits everything else. Reason-code assignment moves out of the header emission into its own pass, the three emitters become subroutines writing to a filehandle, and the up-to-date stamp moves from the statefile's own timestamp to a separate gitignored stamp file, since the statefile is now a build input whose timestamp must track its content. Removing the committed copies also retires 15 that had silently drifted from the generator's output, among them crypto/bio/bio_err.c, which was missing the reason strings for three BIO error codes that exist in the state file. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 14:03:03 2026 Merged-from: https://github.com/openssl/openssl/pull/32243
* Copyright year updatesopenssl-machine2026-03-101-1/+1
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Tue Mar 10 14:37:54 2026 Release: yes
* Use the appropriate libctx when executing CMS_SignerInfo_verifyNeil Horman2026-02-181-12/+16
| | | | | | | | | | | | | | | | | | | | | @beldmit found some odd fips behavior when running cms tests after attempting to remove the EVP_get_digestbyname call from the find routine in cms when doing certificate signer validation. It was occuring because the cms app, being an applet in openssl uses the app libctx to load all the provided configuration, which implies the fips and base providers are loaded to that ctx. However, in the find routine (part of cms), it only ever fetches algorithms from the default libctx, leading to failed lookups, and consequently, CMS errors. Fix it by using the appropriate libctx, which in this case can be fetched from the SignerInfo data, which initializes its libctx member to the app libctx in all cases. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> MergeDate: Wed Feb 18 16:28:44 2026 (Merged from https://github.com/openssl/openssl/pull/30034)
* X509_ALGOR_set_md(): Add return value to indicate success or failureDr. David von Oheimb2026-02-041-6/+1
| | | | | | Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/17495)
* Missed a spot!Richard Levitte2025-12-171-3/+3
| | | | | | | | | | For some reason, source reformatting didn't catch everything. Reviewed-by: Paul Yang <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29383)
* 4.0-POST-CLANG-FORMAT-WEBKIT4.0-POST-CLANG-FORMAT-WEBKITBob Beck2025-12-093-58/+59
| | | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29242)
* Copyright year updatesTomas Mraz2024-09-051-1/+1
| | | | | Reviewed-by: Neil Horman <[email protected]> Release: yes
* ess_lib.c: Changed ERR_LIB_CMS to ERR_LIB_ESSleerubin132024-04-301-1/+1
| | | | | | | | | | | | This fixes an incorrect error message. Fixes #24224 CLA: trivial Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/24290)
* Stop raising ERR_R_MALLOC_FAILURE in most placesRichard Levitte2022-10-051-33/+86
| | | | | | | | | | | | | | | | | | | | | | | Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Hugo Landau <[email protected]> (Merged from https://github.com/openssl/openssl/pull/19301)
* err: rename err_load_xxx_strings_int functionsPauli2021-05-261-1/+1
| | | | | | | | The new names are ossl_err_load_xxx_strings. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15446)
* Fix missing symbols in no-cms and no-ts buildTomas Mraz2021-05-051-7/+1
| | | | | | | Fixes #15137 Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15138)
* CMS ESS: Move four internal aux function to where they belong in crypto/cmsDr. David von Oheimb2021-04-281-62/+2
| | | | | | | Also constify and slightly refactor them. Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/14601)
* TS ESS: Move four internal aux function to where they belong in crypto/tsDr. David von Oheimb2021-04-281-87/+0
| | | | | | | Also constify and slightly refactor them. Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/14601)
* ESS: Export three core functions, clean up TS and CMS CAdES-BES usageDr. David von Oheimb2021-04-282-42/+43
| | | | | Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/14601)
* Prefer fetch over legacy get_digestby/get_cipherbyTomas Mraz2021-04-281-16/+34
| | | | | | | Fixes #14198 Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15028)
* Add more negative checks for integers passed to OPENSSL_malloc().Shane Lontis2021-04-161-0/+4
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/14830)
* Fix usages of const EVP_MD.Shane Lontis2021-03-221-1/+1
| | | | | | | | Partially fixes #13837 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/14474)
* Add ossl_ x509 symbolsShane Lontis2021-03-181-1/+1
| | | | | | | Partial fix for #12964 Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/14473)
* TS and CMS CAdES-BES: Refactor check_signing_certs() funcs into common ESS funcDr. David von Oheimb2021-03-183-88/+80
| | | | | | | Also constify related CMS/PKCS7 functions and improve error codes thrown. Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/14503)
* TS ESS: Invert the search logic of ts_check_signing_certs() to correctly ↵Dr. David von Oheimb2021-03-181-0/+39
| | | | | | | | | cover cert ID list Fixes #14190 Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/14503)
* Update copyright yearMatt Caswell2021-03-111-1/+1
| | | | | Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/14512)
* Fix external symbols for cms.Shane Lontis2021-02-222-19/+19
| | | | | | | | | Partial fix for #12964 This adds ossl_ names for symbols related to cms_* and ess_* Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/14241)
* ERR: Rebuild all generated error headers and source filesRichard Levitte2020-11-241-1/+2
| | | | | | | This is the result of 'make errors ERROR_REBUILD=-rebuild' Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/13390)
* Convert all {NAME}err() in crypto/ to their corresponding ERR_raise() callRichard Levitte2020-11-131-8/+8
| | | | | | | | | | This includes error reporting for libcrypto sub-libraries in surprising places. This was done using util/err-to-raise Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/13318)
* Fix safestack issues in ess.hMatt Caswell2020-09-131-3/+0
| | | | | | Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in x509v3.hMatt Caswell2020-09-131-1/+0
| | | | | | Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in x509.hMatt Caswell2020-09-131-1/+0
| | | | | | Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/12781)
* Add X509 related libctx changes.Shane Lontis2020-07-241-2/+3
| | | | | | | | | | | | | - In order to not add many X509_XXXX_with_libctx() functions the libctx and propq may be stored in the X509 object via a call to X509_new_with_libctx(). - Loading via PEM_read_bio_X509() or d2i_X509() should pass in a created cert using X509_new_with_libctx(). - Renamed some XXXX_ex() to XXX_with_libctx() for X509 API's. - Removed the extra parameters in check_purpose.. - X509_digest() has been modified so that it expects a const EVP_MD object() and then internally it does the fetch when it needs to (via ASN1_item_digest_with_libctx()). - Added API's that set the libctx when they load such as X509_STORE_new_with_libctx() so that the cert chains can be verified. Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/12153)
* Constify X509_check_akid and prefer using X509_get0_serialNumber over ↵Dr. David von Oheimb2020-07-161-2/+2
| | | | | | | X509_get_serialNumber Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/12375)
* Fix CID 1463883 Dereference after null check (in ess_find_cert_v2())Shane Lontis2020-07-081-1/+3
| | | | | Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/12379)
* Fix `no-ts` builds.FdaSilvaYY2020-06-211-1/+2
| | | | | | | | | | `ess_lib.c` is called from `cms` and `ts` modules. Fixes #12155 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/12209)
* crypto/cms: add CAdES-BES signed attributes validationFdaSilvaYY2020-05-274-9/+162
| | | | | | | | | | | | | | | | for signing certificate V2 and signing certificate extensions. CAdES: lowercase name for now internal methods. crypto/cms: generated file changes. Add some CHANGES entries. [extended tests] Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/8098)
* In OpenSSL builds, declare STACK for datatypes ...Rich Salz2020-04-241-0/+5
| | | | | | | | | | | | | | | | | | | | | | ... and only *define* them in the source files that need them. Use DEFINE_OR_DECLARE which is set appropriately for internal builds and not non-deprecated builds. Deprecate stack-of-block Better documentation Move some ASN1 struct typedefs to types.h Update ParseC to handle this. Most of all, ParseC needed to be more consistent. The handlers are "recursive", in so far that they are called again and again until they terminate, which depends entirely on what the "massager" returns. There's a comment at the beginning of ParseC that explains how that works. {Richard Levtte} Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/10669)
* Fix error handling in x509v3_cache_extensions and related functionsBernd Edlinger2020-03-211-2/+3
| | | | | | | | | | Basically we use EXFLAG_INVALID for all kinds of out of memory and all kinds of parse errors in x509v3_cache_extensions. [extended tests] Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/10755)
* Reorganize private crypto header filesDr. Matthias St. Pierre2019-09-282-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, there are two different directories which contain internal header files of libcrypto which are meant to be shared internally: While header files in 'include/internal' are intended to be shared between libcrypto and libssl, the files in 'crypto/include/internal' are intended to be shared inside libcrypto only. To make things complicated, the include search path is set up in such a way that the directive #include "internal/file.h" could refer to a file in either of these two directoroes. This makes it necessary in some cases to add a '_int.h' suffix to some files to resolve this ambiguity: #include "internal/file.h" # located in 'include/internal' #include "internal/file_int.h" # located in 'crypto/include/internal' This commit moves the private crypto headers from 'crypto/include/internal' to 'include/crypto' As a result, the include directives become unambiguous #include "internal/file.h" # located in 'include/internal' #include "crypto/file.h" # located in 'include/crypto' hence the superfluous '_int.h' suffixes can be stripped. The files 'store_int.h' and 'store.h' need to be treated specially; they are joined into a single file. Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/9333)
* util/mkerr.pl: make it not depend on the function codeRichard Levitte2019-09-121-1/+1
| | | | | | | | | | | | | | | | The output C code was made to use ERR_func_error_string() to see if a string table was already loaded or not. Since this function returns NULL always, this check became useless. Change it to use ERR_reason_error_string() instead, as there's no reason to believe we will get rid of reason strings, ever. To top it off, we rebuild all affected C sources. Fixes #9756 Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/9756)
* Regenerate mkerr filesRich Salz2019-07-161-20/+2
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/9058)
* constify *_dup() and *i2d_*() and related functions as far as possible, ↵David von Oheimb2019-03-061-5/+5
| | | | | | | | introducing DECLARE_ASN1_DUP_FUNCTION Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/8029)
* crypto/cms: Add support for CAdES Basic Electronic Signatures (CAdES-BES)Antonio Iacono2019-01-274-0/+382
A CAdES Basic Electronic Signature (CAdES-BES) contains, among other specifications, a collection of Signing Certificate reference attributes, stored in the signedData ether as ESS signing-certificate or as ESS signing-certificate-v2. These are described in detail in Section 5.7.2 of RFC 5126 - CMS Advanced Electronic Signatures (CAdES). This patch adds support for adding ESS signing-certificate[-v2] attributes to CMS signedData. Although it implements only a small part of the RFC, it is sufficient many cases to enable the `openssl cms` app to create signatures which comply with legal requirements of some European States (e.g Italy). Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Matthias St. Pierre <[email protected]> (Merged from https://github.com/openssl/openssl/pull/7893)
generated by cgit (git 2.51.2) at 2026-10-25 12:49:49 +0100