summaryrefslogtreecommitdiffstats
path: root/crypto/evp/pmeth_lib.c
AgeCommit message (Collapse)Author
6 daysFix regression of EVP_PKEY_CTX_add1_hkdf_info() with older providersTomas Mraz
If there is no get_ctx_params() implemented in the key exchange provider implementation the fallback will not work. Instead check the gettable_ctx_params() to see if the fallback should be performed. Fixes #24611 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/24661) (cherry picked from commit 663dbc9c9c897392a9f9d18aa9a8400ca024dc5d)
2024-04-17Handle empty param in EVP_PKEY_CTX_add1_hkdf_infotrinity-1686a
Fixes #24130 The regression was introduced in PR #23456. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24141) (cherry picked from commit 299996fb1fcd76eeadfd547958de2a1b822f37f5)
2024-04-09Fix EVP_PKEY_CTX_add1_hkdf_info() behaviorTodd Short
Fix #23448 `EVP_PKEY_CTX_add1_hkdf_info()` behaves like a `set1` function. Fix the setting of the parameter in the params code. Update the TLS_PRF code to also use the params code. Add tests. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23456) (cherry picked from commit 6b566687b58fde08b28e3331377f050768fad89b)
2024-03-20Copyright year updatesRichard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-01-15Move discovery of the legacy alg type into the keymgmtMatt Caswell
During creation of the EVP_PKEY_CTX we were trying to discover what legacy alg it corresponds to every time which was slow. Instead we move this into the construction of the EVP_KEYMGMT. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23265)
2023-09-22no-engine: fix signing with legacy app method based keysMatthias St. Pierre
Signing with an app method based key (i.e. an `EVP_PKEY` which wraps an `RSA` key with an application defined `RSA_METHOD`) used to work in 1.1.1. That feature was broken in commit 60488d2434, but later on fixed by @t8m in commit b247113c05 (see #14859). This commit corrects a minor flaw of the fix, which affects only `no-engine` builds: the special treatment for foreign keys is guarded by an `OPENSSL_NO_ENGINE` check. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22163)
2023-09-07Copyright year updatesMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2023-07-07Remove unused internal functionsatishkov
CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21329)
2023-06-14configure: introduce no-ecx to remove ECX related featureYi Li
This can effectively reduce the binary size for platforms that don't need ECX feature(~100KB). Signed-off-by: Yi Li <yi1.li@intel.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20781)
2023-03-27`EVP_PKEY_CTX_dup` segmentation fault fixafshinpir
CLA: trivial The the provider, context duplication method for signature, key exchange, asymmetric cipher, and key encapsulation is optional. But if they are missing, we will get a segmentation fault in `EVP_PKEY_CTX_dup` because they are called without null pointer checking. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20581)
2022-10-05Stop raising ERR_R_MALLOC_FAILURE in most placesRichard Levitte
Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
2022-05-13int_ctx_new(): Revert extra OPENSSL_init_crypto() callTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18282)
2022-05-03Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-04-29Ensure we initialized the locale before evp_pkey_name2typeDmitry Belyavskiy
Fixes #18158 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18199)
2021-10-28fix some code with obvious wrong coding stylex2018
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16918)
2021-10-27EVP: Reverse the fetch logic in all pkey using functionalityRichard Levitte
In all initializing functions for functionality that use an EVP_PKEY, the coded logic was to find an KEYMGMT implementation first, and then try to find the operation method (for example, SIGNATURE implementation) in the same provider. This implies that in providers where there is a KEYMGMT implementation, there must also be a SIGNATURE implementation, along with a KEYEXCH, ASYM_CIPHER, etc implementation. The intended design was, however, the opposite implication, i.e. that where there is a SIGNATURE implementation, there must also be KEYMGMT. This change reverses the logic of the code to be closer to the intended design. There is a consequence; we now use the query_operation_name function from the KEYMGMT of the EVP_PKEY given by the EVP_PKEY_CTX (ultimately given by the application). Previously, we used the query_operation_name function from the KEYMGMT found alongside the SIGNATURE implementation. Another minor consequence is that the |keymgmt| field in EVP_PKEY_CTX is now always a reference to the KEYMGMT of the |pkey| field if that one is given (|pkey| isn't NULL) and is provided (|pkey->keymgmt| isn't NULL). Fixes #16614 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725)
2021-09-03Fix double free in EVP_PKEY_CTX_dup()slontis
If the internal operations dupctx() fails then a free is done (e.g. EVP_KEYEXCH_free()). If this is not set to NULL the EVP_PKEY_CTX_free() will do a double free. This was found by testing kdf_dupctx() in kdf_exch.c (Note this always fails since the internal KDF's do not have a dup method). Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16495)
2021-07-27Mark the EVP_PKEY_METHOD arg as const on some EVP_PKEY_meth_get_*() funcsMatt Caswell
Most EVP_PKEY_meth_get_*() functions mark the EVP_PKEY_METHOD argument as const. But 3 did not. We fix those to be consistent. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16128)
2021-07-26EVP: Add EVP_PKEY_get0_provider() and EVP_PKEY_CTX_get0_provider()Richard Levitte
Fixes #16058 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16063)
2021-07-23Fix potential problems with EVP_PKEY_CTX_new() with engine setTomas Mraz
If an engine is non-NULL in EVP_PKEY_CTX_new() call an assert might have been incorrectly triggered or the engine might be finished without being inited. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16137)
2021-07-22Fix custom EVP_PKEY_METHOD implementations where no engine is presentMatt Caswell
It is possible to have a custom EVP_PKEY_METHOD implementation without having an engine. In those cases we were failing to use that custom implementation. Fixes #16088 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16118)
2021-07-06fips module header inclusion fine-tunningTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15974)
2021-06-02evp: remove TODOsPauli
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15539)
2021-06-01Rename all getters to use get/get0 in nameTomas Mraz
For functions that exist in 1.1.1 provide a simple aliases via #define. Fixes #15236 Functions with OSSL_DECODER_, OSSL_ENCODER_, OSSL_STORE_LOADER_, EVP_KEYEXCH_, EVP_KEM_, EVP_ASYM_CIPHER_, EVP_SIGNATURE_, EVP_KEYMGMT_, EVP_RAND_, EVP_MAC_, EVP_KDF_, EVP_PKEY_, EVP_MD_, and EVP_CIPHER_ prefixes are renamed. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15405)
2021-05-24Rename the field 'provctx and data' to 'algctx' inside some objects containingShane Lontis
pointers to provider size algorithm contexts. Fixes #14284 The gettable_ctx_params methods were confusingly passing a 'provctx' and a provider context which are completely different objects. Some objects such as EVP_KDF used 'data' while others such as EVP_MD used 'provctx'. For libcrypto this 'ctx' is an opaque ptr returned when a providers algorithm implementation creates an internal context using a new_ctx() method. Hence the new name 'algctx'. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15275)
2021-05-20todo: remove TODO(3.0) from the sources.Pauli
Almost all were notes about wanting to deprecate CTRLs/utility functions. Fixes #15325 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15328)
2021-05-11Constify EVP_PKEY_CTX_set_params(), EVP_PKEY_CTX_{set,get}table_params(), etc.Dr. David von Oheimb
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14695)
2021-04-26Add type_name member to provided methods and use itTomas Mraz
Fixes #14701 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14898)
2021-04-19Detect low-level engine and app method based keysTomas Mraz
The low-level engine and app method based keys have to be treated as foreign and must be used with old legacy pmeths. Fixes #14632 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14859)
2021-03-20evp: fix coverity 1470561: resource leakPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14596)
2021-03-08Cache legacy keys instead of downgrading themMatt Caswell
If someone calls an EVP_PKEY_get0*() function then we create a legacy key and cache it in the EVP_PKEY - but it doesn't become an "origin" and it doesn't ever get updated. This will be documented as a restriction of the EVP_PKEY_get0*() function with provided keys. Fixes #14020 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14319)
2021-03-04Remove some of the TODO 3.0 in crypto/evp related to legacy support.Tomas Mraz
The legacy support stays in 3.0. The TODOs are dropped. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14404)
2021-03-03EVP_PKEY_CTX_get/settable_params: pass provider operation contextTomas Mraz
This allows making the signature operations return different settable params when the context is initialized with EVP_DigestSign/VerifyInit. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14338)
2021-02-26Fix external symbols related to ec & sm2 keysShane Lontis
Partial fix for #12964 This adds ossl_ names for the following symbols: ec_*, ecx_*, ecdh_*, ecdsa_*, sm2_* Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14231)
2021-02-26Fix external symbols related to dsa keysShane Lontis
Partial fix for #12964 This adds ossl_ names for the following symbols: dsa_check_pairwise, dsa_check_params, dsa_check_priv_key, dsa_check_pub_key, dsa_check_pub_key_partial, dsa_do_sign_int, dsa_ffc_params_fromdata, dsa_generate_ffc_parameters, dsa_generate_public_key, dsa_get0_params, dsa_key_fromdata, dsa_new_with_ctx, dsa_pkey_method, dsa_sign_int Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14231)
2021-02-26Fix external symbols related to dh keysShane Lontis
Partial fix for #12964 This adds ossl_ names for the following symbols: dh_new_by_nid_ex, dh_new_ex, dh_generate_ffc_parameters, dh_generate_public_key, dh_get_named_group_uid_from_size, dh_gen_type_id2name, dh_gen_type_name2id, dh_cache_named_group, dh_get0_params, dh_get0_nid, dh_params_fromdata, dh_key_fromdata, dh_params_todata, dh_key_todata, dh_check_pub_key_partial, dh_check_priv_key, dh_check_pairwise, dh_get_method, dh_buf2key, dh_key2buf, dh_KDF_X9_42_asn1, dh_pkey_method, dhx_pkey_method Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14231)
2021-02-23EVP: Make checks in evp_pkey_ctx_store_cached_data() more restrictedRichard Levitte
It would check the keytype and optype before determining if it even supported the ctrl command number. This turned out to be disruptive, so we make it check that it supports the request ctrl command number first. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13913)
2021-02-23EVP: Adapt the EVP_PKEY_CTX ctrl functionsRichard Levitte
legacy_ctrl_to_param() and legacy_ctrl_str_to_param() are now replaced with calls to evp_pkey_ctx_ctrl_to_param() and evp_pkey_ctx_ctrl_str_to_param(). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13913)
2021-02-23EVP: Adapt diverse OSSL_PARAM setters and gettersRichard Levitte
EVP_PKEY_get_group_name() now simply calls EVP_PKEY_get_utf8_string_param(). EVP_PKEY_CTX_set_group_name() now simply calls EVP_PKEY_CTX_set_params(). EVP_PKEY_get_bn_param(), EVP_PKEY_get_octet_string_param(), EVP_PKEY_get_utf8_string_param() and EVP_PKEY_get_int_param() can now handle legacy EVP_PKEYs by calling evp_pkey_get_params_to_ctrl(). EVP_PKEY_CTX_get_params() can now handle a legacy backed EVP_PKEY_CTX by calling evp_pkey_ctx_get_params_to_ctrl(). Note: EVP_PKEY_CTX_set_params() doesn't call the translator yet. Should it ever? Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13913)
2021-02-23EVP: Make evp_pkey_ctx_{set,get}_params_strict() legacy awareRichard Levitte
In the interest of calling these functions on legacy EVP_PKEY contexts, only check the settable / gettable params for provider side keys, leaving to the translated EVP_PKEY_CTX_ctrl() call check the ctrl commands on its own. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13913)
2021-02-23EVP: Make evp_pkey_ctx_state() available to all of EVPRichard Levitte
This will help with transitioning diverse functions to be able to use the ctrl<->OSSL_PARAM translators. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13913)
2021-02-23EVP: Implement EVP_PKEY_CTX_is_a()Richard Levitte
This does what was previously done by looking at pctx->pmeth->pkey_id, but handles both legacy and provider side contexts, and is supposed to become a replacement for the old way. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13913)
2021-02-18Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14235)
2021-02-03EVP: Fix evp_pkey_ctx_store_cached_data() to handle provider backed EVP_PKEY_CTXRichard Levitte
It assumed there would always be a non-NULL ctx->pmeth, leading to a crash when that isn't the case. Since it needs to check 'keytype' when that one isn't -1, we also add a corresponding check for the provider backed EVP_PKEY_CTX case. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13973)
2021-02-03EVP: Don't find standard EVP_PKEY_METHODs automaticallyRichard Levitte
EVP_PKEY_meth_find() got called automatically any time a new EVP_PKEY_CTX allocator was called with some sort of key type data. Since we have now moved all our standard algorithms to our providers, this is no longer necessary. We do retain looking up EVP_PKEY_METHODs that are added by the calling application. Fixes #11424 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13973)
2021-01-28EVP: fix keygen for EVP_PKEY_RSA_PSSDaniel Bevenius
This commit attempts to fix the an issue when generating a key of type EVP_PKEY_RSA_PSS. Currently, EVP_PKEY_CTX_set_rsa_keygen_bits will return -1 if the key id is not of type EVP_PKEY_RSA. This commit adds EVP_PKEY_RSA_PSS to also be accepted. The macro EVP_PKEY_CTX_set_rsa_pss_keygen_md si converted into a function and it is now called in legacy_ctrl_to_param. Fixes #12384 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13099)
2020-12-20Drop OPENSSL_NO_RSA everywhereRichard Levitte
The configuration option 'no-rsa' was dropped with OpenSSL 1.1.0, so this is simply a cleanup of the remains. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13700)
2020-12-17EVP: Fix memory leak in EVP_PKEY_CTX_dup()Richard Levitte
In most error cases, EVP_PKEY_CTX_dup() would only free the EVP_PKEY_CTX without freeing the duplicated contents. Fixes #13503 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13661)
2020-12-16Drop unnecessary checks of OPENSSL_NO_DH, OPENSSL_NO_DSA and OPENSSL_NO_ECRichard Levitte
The apps, the CMS library and the X.509 library are primarly affected. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13589)
2020-12-16EVP_PKEY & EC_KEY: Make EC EVP_PKEY_CTX parameter ctrls / setters more availableRichard Levitte
EVP_PKEY_CTX_set_ec_ functions were only available when EC was enabled ('no-ec' not configured). However, that makes it impossible to use these functions with an engine or a provider that happens to implement EC_KEY. This change solves that problem by shuffling these functions to more appropriate places. Partially fixes #13550 squash! EVP_PKEY & EC_KEY: Make EC EVP_PKEY_CTX parameter ctrls / setters more available By consequence, there are a number of places where we can remove the check of OPENSSL_NO_EC. This requires some re-arrangements of internal tables to translate between numeric identities and names. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13589)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-27 15:12:52 +0000