openssl/crypto
Dr. David von Oheimb 0b670a2101 x509_vfy.c: Improve key usage checks in internal_verify() of cert chains
If a presumably self-signed cert is last in chain we verify its signature
only if X509_V_FLAG_CHECK_SS_SIGNATURE is set. Upon this request we do the
signature verification, but not in case it is a (non-conforming) self-issued
CA certificate with a key usage extension that does not include keyCertSign.

Make clear when we must verify the signature of a certificate
and when we must adhere to key usage restrictions of the 'issuing' cert.
Add some comments for making internal_verify() easier to understand.
Update the documentation of X509_V_FLAG_CHECK_SS_SIGNATURE accordingly.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12375)
2020-07-16 15:48:53 +02:00
..
aes Avoid undefined behavior with unaligned accesses 2020-05-27 20:11:20 +02:00
aria Reorganize private crypto header files 2019-09-28 20:26:34 +02:00
asn1 deprecate engines in libcrypto 2020-07-16 09:12:27 +02:00
async Update copyright year 2020-07-16 14:47:04 +02:00
bf Update copyright year 2020-04-23 13:55:52 +01:00
bio Improve BIO_socket_wait(), BIO_wait(), BIO_connect_retry(), and their docs 2020-06-16 18:51:39 +02:00
bn Disable optimiization of BN_num_bits_word() for VS2005 ARM compiler due to 2020-07-15 23:03:22 +02:00
buffer Rework how our providers are built 2019-10-10 14:12:15 +02:00
camellia Update copyright year 2020-04-23 13:55:52 +01:00
cast Fix logic error for building x86 CAST assembly 2020-06-14 12:35:34 -07:00
chacha Update copyright year 2020-07-16 14:47:04 +02:00
cmac Revert "The EVP_MAC functions have been renamed for consistency. The EVP_MAC_CTX_*" 2020-07-16 14:21:07 +02:00
cmp Constify X509_check_akid and prefer using X509_get0_serialNumber over X509_get_serialNumber 2020-07-16 15:48:53 +02:00
cms Constify X509_check_akid and prefer using X509_get0_serialNumber over X509_get_serialNumber 2020-07-16 15:48:53 +02:00
comp Reorganize local header files 2019-09-28 20:26:35 +02:00
conf Update copyright year 2020-07-16 14:47:04 +02:00
crmf Revert "The EVP_MAC functions have been renamed for consistency. The EVP_MAC_CTX_*" 2020-07-16 14:21:07 +02:00
ct Update copyright year 2020-05-15 14:09:49 +01:00
des Build: Remove faulty DES assembler spec 2020-06-20 11:02:18 +02:00
dh Revert "kdf: make function naming consistent." 2020-07-16 14:21:07 +02:00
dsa Add multiple fixes for ffc key generation using invalid p,q,g parameters. 2020-07-09 13:43:10 +10:00
dso Changed uintptr_t to size_t. WinCE6 doesn't seem it have the definition. 2020-07-15 23:03:21 +02:00
ec Revert "kdf: make function naming consistent." 2020-07-16 14:21:07 +02:00
engine Update copyright year 2020-07-16 14:47:04 +02:00
err Update copyright year 2020-07-16 14:47:04 +02:00
ess Constify X509_check_akid and prefer using X509_get0_serialNumber over X509_get_serialNumber 2020-07-16 15:48:53 +02:00
evp Update copyright year 2020-07-16 14:47:04 +02:00
ffc Add multiple fixes for ffc key generation using invalid p,q,g parameters. 2020-07-09 13:43:10 +10:00
hmac coverity 1462580 Improper use of negative value 2020-04-30 20:21:33 +10:00
http Ensure a string is properly terminated in http_client.c 2020-07-03 17:18:41 +01:00
idea Update copyright year 2020-04-23 13:55:52 +01:00
include/internal Update copyright year 2020-05-15 14:09:49 +01:00
kdf Deprecate ERR_load_KDF_strings() 2019-11-12 13:30:35 +01:00
lhash Rework how our providers are built 2019-10-10 14:12:15 +02:00
md2 Update copyright year 2020-04-23 13:55:52 +01:00
md4 Update copyright year 2020-04-23 13:55:52 +01:00
md5 Update copyright year 2020-04-23 13:55:52 +01:00
mdc2 Update copyright year 2020-04-23 13:55:52 +01:00
modes Revert "The EVP_MAC functions have been renamed for consistency. The EVP_MAC_CTX_*" 2020-07-16 14:21:07 +02:00
objects Fix many MarkDown issues in {NOTES*,README*,HACKING,LICENSE}.md files 2020-07-05 11:29:43 +02:00
ocsp Update copyright year 2020-05-15 14:09:49 +01:00
pem deprecate engines in libcrypto 2020-07-16 09:12:27 +02:00
perlasm Fix many MarkDown issues in {NOTES*,README*,HACKING,LICENSE}.md files 2020-07-05 11:29:43 +02:00
pkcs7 Constify X509_check_akid and prefer using X509_get0_serialNumber over X509_get_serialNumber 2020-07-16 15:48:53 +02:00
pkcs12 Update copyright year 2020-05-15 14:09:49 +01:00
poly1305 Update copyright year 2020-04-23 13:55:52 +01:00
property Fix CID #1465216 Resource leak in property_fetch 2020-07-08 11:19:08 +03:00
rand Update copyright year 2020-07-16 14:47:04 +02:00
rc2 Update copyright year 2020-04-23 13:55:52 +01:00
rc4 Update copyright year 2020-04-23 13:55:52 +01:00
rc5 Update copyright year 2020-04-23 13:55:52 +01:00
ripemd Update copyright year 2020-04-23 13:55:52 +01:00
rsa Fix potential double free in rsa_keygen pairwise test. 2020-06-23 12:28:48 +02:00
seed Update copyright year 2020-04-23 13:55:52 +01:00
serializer Fix memory leaks on OSSL_SERIALIZER_CTX_new_by_EVP_PKEY 2020-07-02 16:45:14 +03:00
sha Update copyright year 2020-07-16 14:47:04 +02:00
siphash Reorganize private crypto header files 2019-09-28 20:26:34 +02:00
sm2 Update copyright year 2020-04-23 13:55:52 +01:00
sm3 Cleanup legacy digest methods. 2019-12-18 14:46:01 +10:00
sm4 Reorganize private crypto header files 2019-09-28 20:26:34 +02:00
srp In OpenSSL builds, declare STACK for datatypes ... 2020-04-24 16:42:46 +02:00
stack Rework how our providers are built 2019-10-10 14:12:15 +02:00
store deprecate engines in libcrypto 2020-07-16 09:12:27 +02:00
ts deprecate engines in libcrypto 2020-07-16 09:12:27 +02:00
txt_db
ui Update copyright year 2020-06-04 14:33:57 +01:00
whrlpool Avoid undefined behavior with unaligned accesses 2020-05-27 20:11:20 +02:00
x509 x509_vfy.c: Improve key usage checks in internal_verify() of cert chains 2020-07-16 15:48:53 +02:00
alphacpuid.pl Update copyright year 2020-04-23 13:55:52 +01:00
arm64cpuid.pl Update copyright year 2020-04-23 13:55:52 +01:00
arm_arch.h Fix header file include guard names 2019-09-28 20:26:36 +02:00
armcap.c
armv4cpuid.pl Update copyright year 2020-04-23 13:55:52 +01:00
asn1_dsa.c Fix some typos 2019-12-11 19:04:01 +01:00
bsearch.c
build.info Remove explicit dependency on configdata.pm when processing .in files 2020-05-13 10:14:53 +02:00
c64xpluscpuid.pl Update copyright year 2020-04-23 13:55:52 +01:00
context.c CORE: Add an internal function to distinguish the global default context 2020-06-28 10:55:52 +02:00
core_algorithm.c CORE: perform post-condition in algorithm_do_this() under all circumstances 2020-07-05 14:07:14 +02:00
core_fetch.c Update copyright year 2020-06-04 14:33:57 +01:00
core_namemap.c namemap: change ossl_namemap_empty() to do what the documentation says. 2020-06-21 16:49:51 +10:00
cpt_err.c CORE: ossl_namemap_add_names(): new function to add multiple names 2019-11-29 20:42:12 +01:00
cryptlib.c Reorganize private crypto header files 2019-09-28 20:26:34 +02:00
ctype.c Reorganize private crypto header files 2019-09-28 20:26:34 +02:00
cversion.c Cleanup include/openssl/opensslv.h.in 2019-11-08 16:12:57 +01:00
der_writer.c DER writer: Add the possibility to abandon empty SEQUENCEs 2020-05-14 12:16:35 +02:00
dllmain.c Reorganize private crypto header files 2019-09-28 20:26:34 +02:00
ebcdic.c
ex_data.c Fix the parameter types of the CRYPTO_EX_dup function type. 2020-05-23 15:31:14 +02:00
getenv.c
ia64cpuid.S
info.c Print CPUINFO also for s390 processors 2020-06-22 02:35:01 +02:00
init.c Update copyright year 2020-07-16 14:47:04 +02:00
initthread.c Make the naming scheme for dispatched functions more consistent 2020-06-24 22:01:22 +02:00
LPdir_nyi.c
LPdir_unix.c Fix a -Warray-bounds gcc warning in OPENSSL_DIR_read 2019-11-09 10:49:34 +01:00
LPdir_vms.c
LPdir_win32.c
LPdir_win.c
LPdir_wince.c
mem_clr.c
mem_sec.c Fix wrong return value check of mmap function 2020-06-23 10:08:28 +10:00
mem.c Rename FIPS_MODE to FIPS_MODULE 2020-04-28 15:37:37 +02:00
mips_arch.h Fix header file include guard names 2019-09-28 20:26:36 +02:00
o_dir.c
o_fopen.c
o_init.c
o_str.c Enable WinCE build without deceiving _MSC_VER. 2020-07-15 23:03:22 +02:00
o_time.c Update copyright year 2020-07-16 14:47:04 +02:00
packet.c WPACKET: don't write DER length when we don't want to 2020-05-04 05:50:06 +02:00
param_build_set.c Add EVP_PKEY_gettable_params support for accessing EVP_PKEY key data fields 2020-04-01 15:51:18 +10:00
param_build.c params: add OSSL_PARAM helpers for time_t. 2020-06-24 20:05:41 +10:00
params_from_text.c params: handle the modified sentinel. 2020-04-25 18:46:01 +10:00
params.c params: add OSSL_PARAM helpers for time_t. 2020-06-24 20:05:41 +10:00
pariscid.pl Update copyright year 2020-04-23 13:55:52 +01:00
ppc_arch.h Fix header file include guard names 2019-09-28 20:26:36 +02:00
ppccap.c Update copyright year 2020-05-15 14:09:49 +01:00
ppccpuid.pl Update copyright year 2020-04-23 13:55:52 +01:00
provider_conf.c In OpenSSL builds, declare STACK for datatypes ... 2020-04-24 16:42:46 +02:00
provider_core.c Fix OSSL_PROVIDER_get_capabilities() 2020-07-08 08:55:56 +01:00
provider_local.h
provider_predefined.c Rename FIPS_MODE to FIPS_MODULE 2020-04-28 15:37:37 +02:00
provider.c Add the OSSL_PROVIDER_get_capabilities() API function 2020-06-19 10:19:31 +01:00
README-sparse_array.md Fix many MarkDown issues in {NOTES*,README*,HACKING,LICENSE}.md files 2020-07-05 11:29:43 +02:00
s390x_arch.h Update copyright year 2020-04-23 13:55:52 +01:00
s390xcap.c crypto/s390xcap.c: Add guards around the GETAUXVAL checks 2019-10-21 15:14:09 +02:00
s390xcpuid.pl Update copyright year 2020-04-23 13:55:52 +01:00
self_test_core.c Rename FIPS_MODE to FIPS_MODULE 2020-04-28 15:37:37 +02:00
sparc_arch.h Fix header file include guard names 2019-09-28 20:26:36 +02:00
sparccpuid.S
sparcv9cap.c Update copyright year 2020-04-23 13:55:52 +01:00
sparse_array.c Reorganize private crypto header files 2019-09-28 20:26:34 +02:00
threads_none.c
threads_pthread.c Update copyright year 2020-05-15 14:09:49 +01:00
threads_win.c Update copyright year 2020-04-23 13:55:52 +01:00
trace.c Update copyright year 2020-07-16 14:47:04 +02:00
uid.c
vms_rms.h
x86_64cpuid.pl Update copyright year 2020-04-23 13:55:52 +01:00
x86cpuid.pl Update copyright year 2020-04-23 13:55:52 +01:00