9bb80f4747
hx509: choose certificate time encoding portably
...
Select UTCTime versus GeneralizedTime with a helper that only performs
the 2050 comparison when the local time_t range can represent that value.
This avoids ILP32 type-limit problems while preserving GeneralizedTime
output on 64-bit and unsigned 32-bit time_t platforms.
2026-06-10 09:59:13 -05:00
82f7b8072c
Nix bashisms.
...
This isn't fully POSIX shell, because POSIX shell still doesn't have
`local' variable declarations, but at least it is reasonably portable
now.
fix https://github.com/heimdal/heimdal/issues/1299
2026-01-21 12:40:26 -06:00
4584b22511
hx509: Make fuzz_jose use getarg()
2026-01-21 11:45:28 -06:00
a0dcf9bffd
if a CSR has multiple extRequests, keep only last
...
The code already keeps the last entry, but it leaks the previous copies. @nicowilliams noticed this.
2026-01-19 00:18:47 -06:00
5589cf96c7
Sprinkle const and rk_UNCONST throughout the tests.
2026-01-18 19:06:17 -06:00
f6d1dfd60f
*.l: Fix old-style function definitions of yywrap.
2026-01-18 19:06:16 -06:00
76fbb83e86
hx509: Add a JWT fuzzer
2026-01-18 19:06:16 -06:00
220a47b000
hx509: Add JOSE functionality
2026-01-18 19:06:16 -06:00
cbe156d927
Use OpenSSL 3.x _only_ and implement RFC 8636
...
- No more OpenSSL 1.x support
- Remove 1DES and 3DES
- Remove NETLOGON, NTLM (client and 'digest' service)
2026-01-18 19:06:16 -06:00
02ce745c6e
sl: Fix OS X build (bison)
2026-01-18 16:09:31 -06:00
7439820618
hcrypto, otp: Remove hcrypto and otp!
...
We must switch to OpenSSL 3.x, and getting lib/hcrypto to provide
OpenSSL 3.x APIs is too large an undertaking. Plus the hcrypto backend
is not safe, not secure (probably has timing leaks galore), and no one
has the resources to make it a world-class crypto library, so it just
has to go.
2026-01-18 16:09:31 -06:00
e74f785367
hxtool: Fix leak in acert sub-command
2026-01-18 16:08:40 -06:00
50244ef92d
hxtool: Enable extended MANDOC generation
2026-01-18 16:08:39 -06:00
ff67770aa1
hx509: Quiet warnings
2026-01-18 16:08:39 -06:00
4a4567fa17
windows: No SSIZE_MAX on Windows...
2026-01-18 16:08:39 -06:00
aff90c322e
Fix spelling
2024-06-16 23:30:48 -04:00
c80c04b235
spelling fixes (underun prefered relase encyption confunder)
...
[abartlet@samba.org: From Samba debian package at
https://salsa.debian.org/samba-team/samba/-/blob/master/debian/patches/heimdal-spelling.patch?ref_type=heads ]
Signed-off-by: Andrew Bartlett <abartlet@samba.org >
2024-06-16 23:28:43 -04:00
3253c49544
hx509: Add support for CSRs w/ BasicConstraints (fix)
2023-11-29 13:16:16 -06:00
e8b42d9d42
hx509: Fix incorrect documentation comment
...
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-28 21:37:56 -05:00
bbe9c83b19
hx509: Remove unused variable
...
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-28 21:37:56 -05:00
59f89e4b15
hx509: Avoid misleading error message
...
If ‘keyid’ is an empty string, then the numeric error code that gets
appended to this error message may be mistaken for the key ID. Address
this by not mentioning any ID in such cases.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-28 21:37:56 -05:00
df6c33ff1e
hx509: Use NULL pointer constant
...
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-28 21:37:56 -05:00
05602c2286
hx509: Fix code spelling
...
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-28 21:34:35 -05:00
ef083a0e2c
hx509: Fix code spelling
...
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-28 21:34:35 -05:00
61bf5009a0
hx509: Fix spelling of error messages
...
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-28 21:34:35 -05:00
2ad736a579
hx509: Fix EACCES / ENOMEM confusion
2023-11-08 14:22:02 -06:00
be0d1e68e5
hx509: Add support for CSRs w/ BasicConstraints
2023-11-08 14:22:02 -06:00
a840986dc0
hx509: Check return value of RAND_bytes()
...
Found by Coverity (Samba CID 1544600).
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-02 20:19:54 -05:00
d1b9d2c2f9
hx509: Add missing format specifier
...
Found by Coverity (Samba CID 1544604).
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-02 20:19:54 -05:00
7ee2ddd71a
hx509: Use correct format specifier
...
Found by Coverity (Samba CID 1544606).
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-02 20:19:54 -05:00
13f96a2c89
hx509: Don’t pass excess arguments to variadic functions
...
Found by Coverity (Samba CID 1544609).
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-02 20:19:54 -05:00
d71035e2d1
hdb: Initialize ‘tm’ structure
...
‘tm’ must be initialized prior to calling strptime().
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2023-11-02 20:19:54 -05:00
ca0e53b64f
Pass -d to yacc(1) so it generates the header file.
...
Bison must generate this unsolicited, but BSD yacc does not.
The makefiles for lib/com_err and lib/sl already did this; this
change just adds it to lib/asn1 and lib/hx509 too.
fix https://github.com/heimdal/heimdal/issues/1100
2023-06-21 16:07:16 -05:00
e8e8b78d65
hx509/hxtool.c: ensure parse_bytes() result does not overflow
2023-06-20 12:57:28 -05:00
a142767598
Fix ctype.h misuse.
...
Excluded: libtomath and libedit files, most of which appear to be
testing or example code not involved in production, and which are
derived from an upstream that should perhaps have patches submitted
upstream instead.
fix https://github.com/heimdal/heimdal/issues/1111
2023-05-26 14:10:11 -05:00
485b5d575a
hxtool: Check hx509_request_init() return
2023-01-04 16:17:57 -06:00
8b44896bc1
hx509: Fix harmless TOCTOU in load_crl()
2023-01-04 00:43:35 -06:00
64254d64dd
hx509: Fix ENOMEM free of garbage encoding PKCS#10
2023-01-04 00:43:35 -06:00
1473b96d1c
hx509: Fix leak in templated certificates
2023-01-04 00:43:35 -06:00
06fdd14d4d
hx509: Quiet static analyzer false positives
2023-01-04 00:43:35 -06:00
42fff5ec5f
hx509: Add content and some EXAMPLES to hxtool(1)
...
hxtool is a very useful command, with a very user-friendly interface, at
least compared to OpenSSL's openssl(1). We should document it better.
Currently there are no manual pages for hxtool(1)'s subcommands, though
their --help message is pretty self-explanatory. Now the hxtool(1) page
provides better clues to the user, including examples.
2022-12-19 17:03:38 -06:00
d24b7fd8b2
hx509: Add hxtool cc --no-root-certs, --no-private-keys, and --append options
2022-12-19 16:26:03 -06:00
6def4750bc
hx509: Add HX509_CERTS_STORE_NO_ROOTS flag
...
This will allow us to add a --no-roots option to
hxtool copy-certificate
which is convenient when copying certificate chains from stores that may
include root CA certificates.
2022-12-19 16:24:23 -06:00
49c00512a7
hx509: Don't check if non-self-signed certs have a self-signing capable signature alg
...
We don't need the _hx509_self_signed_valid() check if the certificate is
not self-signed.
2022-12-19 16:23:03 -06:00
168124cd09
hx509: Add hx509_cert_is_{ca,root,self_signed}()
...
These are convenient utility functions.
2022-12-19 16:21:42 -06:00
4da64d119e
hx509: Return better error in CSR authorization functions
2022-12-05 23:01:52 -06:00
ce1dd5fc76
hx509: Export missing CSR authz symbols
2022-12-05 23:01:52 -06:00
5dd018b7ed
hx509: Get i2d_PUBKEY() prototype from correct header
2022-11-22 15:33:03 -06:00
264f0bd1a2
hx509: OpenSSL 3.0 support
2022-11-22 11:34:54 -05:00
0d5b238186
hx509: PKCS#12 missing error check
2022-11-22 11:34:54 -05:00
Roland C. Dowdeswell