summaryrefslogtreecommitdiffstats
path: root/crypto/evp
AgeCommit message (Collapse)Author
2017-12-10Make BIO_METHOD struct definitions consistentDaniel Bevenius
I noticed that some of the BIO_METHOD structs are placing the name on the same line as the type and some don't. This commit places the name on a separate line for consistency (which looks like what the majority do) CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4878) (cherry picked from commit 27ab91951c96364351f1ea0652dbf14622440345)
2017-12-08Standardize syntax of sizeof(foo)Rich Salz
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4876)
2017-10-31EVP_PKEY_asn1_add0(): Check that this method isn't already registeredRichard Levitte
No two public key ASN.1 methods with the same pkey_id can be registered at the same time. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/4620)
2017-10-30Only reset the ctx when a cipher is givenKurt Roeckx
This restores the 1.0.2 behaviour Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Benjamin Kaduk <bkaduk@akamai.com> GH: #4613 (cherry picked from commit ffd23209933ea0ad5543f15ca6303d63d8dac826)
2017-10-12make updateDr. Stephen Henson
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4503)
2017-10-12Add EVP_PKEY_set1_engine() function.Dr. Stephen Henson
Add an ENGINE to EVP_PKEY structure which can be used for cryptographic operations: this will typically be used by an HSM key to redirect calls to a custom EVP_PKEY_METHOD. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4503) (cherry picked from commit d19b01ad79f9e2aac5c87496b5ca5f80016daeb7)
2017-10-12Fix memory leak on lookup failureDr. Stephen Henson
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4503) (cherry picked from commit 918a27facd3558444c69b1edbedb49478e82dff5)
2017-10-12Don't ignore passed ENGINE.Dr. Stephen Henson
If we are passed an ENGINE to use in int_ctx_new e.g. via EVP_PKEY_CTX_new() use it instead of the default. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4503) (cherry picked from commit c2976edf4b22691d8bebb0e3ca2db18b3d0c71c6)
2017-07-24evp/e_aes_cbc_hmac_sha256.c: give SHAEXT right priority.Andy Polyakov
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/3898) (cherry picked from commit d0f6eb1d8c84165c383a677266cfae9c0b162781)
2017-07-19Remove some dead codeMatt Caswell
The intention of the removed code was to check if the previous operation carried. However this does not work. The "mask" value always ends up being a constant and is all ones - thus it has no effect. This check is no longer required because of the previous commit. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3832) (cherry picked from commit d5475e319575a45b20f560bdfae56cbfb165cb01)
2017-07-19Fix undefined behaviour in e_aes_cbc_hmac_sha256.c and e_aes_cbc_hmac_sha1.cMatt Caswell
In TLS mode of operation the padding value "pad" is obtained along with the maximum possible padding value "maxpad". If pad > maxpad then the data is invalid. However we must continue anyway because this is constant time code. We calculate the payload length like this: inp_len = len - (SHA_DIGEST_LENGTH + pad + 1); However if pad is invalid then inp_len ends up -ve (actually large +ve because it is a size_t). Later we do this: /* verify HMAC */ out += inp_len; len -= inp_len; This ends up with "out" pointing before the buffer which is undefined behaviour. Next we calculate "p" like this: unsigned char *p = out + len - 1 - maxpad - SHA256_DIGEST_LENGTH; Because of the "out + len" term the -ve inp_len value is cancelled out so "p" points to valid memory (although technically the pointer arithmetic is undefined behaviour again). We only ever then dereference "p" and never "out" directly so there is never an invalid read based on the bad pointer - so there is no security issue. This commit fixes the undefined behaviour by ensuring we use maxpad in place of pad, if the supplied pad is invalid. With thanks to Brian Carpenter for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3832) (cherry picked from commit 335d0a4646981c9d96b62811bcfd69a96a1a67d9)
2017-07-14Fix gcc-7 warnings about missing fall thru comments.Bernd Edlinger
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3936)
2017-07-05Fix small UI issuesRichard Levitte
- in EVP_read_pw_string_min(), the return value from UI_add_* wasn't properly checked - in UI_process(), |state| was never made NULL, which means an error when closing the session wouldn't be accurately reported. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3849) (cherry picked from commit b96dba9e5ec7afc355be1eab915f69c8c0d51741)
2017-06-12Fix memleak in EVP_DigestSignFinal/VerifyFinal.Bernd Edlinger
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3658) (cherry picked from commit 19546246cf44d30043fb17d1899b2c325924ac8b)
2017-04-24check length sanity before correcting in EVP_CTRL_AEAD_TLS1_AADRich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3290)
2017-03-25Don't access memory before checking the correct length in ↵Bernd Edlinger
aesni_cbc_hmac_sha256_ctrl in case EVP_CTRL_AEAD_TLS1_AAD. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3023) (cherry picked from commit 1b6f5a4d3b8cdb02e0bba6878a2b70c850522440)
2017-03-17Fixed PKCS5_PBKDF2_HMAC() to adhere to the documentation.Péter Budai
The documentation of this function states that the password parameter can be NULL. However, the implementation returns an error in this case due to the inner workings of the HMAC_Init_ex() function. With this change, NULL password will be treated as an empty string and PKCS5_PBKDF2_HMAC() no longer fails on this input. I have also added two new test cases that tests the handling of the special values NULL and -1 of the password and passlen parameters, respectively. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1692) (cherry picked from commit fa013b65241dfed9b7d9e10e0adfedc9869c797e)
2017-02-15Properly zero cipher_data for ChaCha20-Poly1305 on cleanupKazuki Yamaguchi
Fix a typo. Probably this has not been found because EVP_CIPHER_CTX is smaller than EVP_CHACHA_AEAD_CTX and heap overflow does not occur. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2294) (cherry picked from commit a8f957686675194d786b41f6e1f7c48bb85723ec)
2017-02-10Restore EVP_CIPH_FLAG_LENGTH_BITS working properlyLukasz Pawelczyk
EVP_CIPH_FLAG_LENGTH_BITS flag for CFB1 has been broken with the introduction of the is_partially_overlapping() check that did not take it into the account (treating number of bits passed as bytes). This remedies that and allows this flag to work as intended. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1942) (cherry picked from commit 64846096b18340b9a39ddd29a7a0e23c56f22959)
2017-02-07Fix a crash in EVP_CIPHER_CTX_cleanup due to cipher_data may be NULLBernd Edlinger
or EVP_CTRL_INIT/EVP_CTRL_COPY was not called or failed. If that happens in EVP_CipherInit_ex/EVP_CIPHER_CTX_copy set cipher = NULL, aes_gcm_cleanup should check that gctx != NULL before calling OPENSSL_cleanse. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2562) (cherry picked from commit 273a0218e65f1737cdbb0ef65a5ddebd601e6bef)
2017-02-05Combined patch against OpenSSL_1_1_0-stable branch for the following issues:Bernd Edlinger
Fixed a memory leak in ASN1_digest and ASN1_item_digest. Reworked error handling in asn1_item_embed_new. Fixed error handling in int_ctx_new and EVP_PKEY_CTX_dup. Fixed a memory leak in CRYPTO_free_ex_data. Reworked error handing in x509_name_ex_d2i, x509_name_encode and x509_name_canon. Check for null pointer in tls_process_cert_verify. Fixes #2103 #2104 #2105 #2109 #2111 #2115 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2163)
2017-01-26crypto/evp: harden AEAD ciphers.Andy Polyakov
Originally a crash in 32-bit build was reported CHACHA20-POLY1305 cipher. The crash is triggered by truncated packet and is result of excessive hashing to the edge of accessible memory. Since hash operation is read-only it is not considered to be exploitable beyond a DoS condition. Other ciphers were hardened. Thanks to Robert Święcki for report. CVE-2017-3731 Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-01-26crypto/evp: harden RC4_MD5 cipher.Andy Polyakov
Originally a crash in 32-bit build was reported CHACHA20-POLY1305 cipher. The crash is triggered by truncated packet and is result of excessive hashing to the edge of accessible memory (or bogus MAC value is produced if x86 MD5 assembly module is involved). Since hash operation is read-only it is not considered to be exploitable beyond a DoS condition. Thanks to Robert Święcki for report. CVE-2017-3731 Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-01-25Remove assert from is_partially_overlapping()Matt Caswell
This function is used to validate application supplied parameters. An assert should be used to check for an error that is internal to OpenSSL. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2275) (cherry picked from commit b153f0921bea38127de0b9440b0487db3004330d)
2017-01-25Fix the overlapping check for fragmented "Update" operationsMatt Caswell
When doing in place encryption the overlapping buffer check can fail incorrectly where we have done a partial block "Update" operation. This fixes things to take account of any pending partial blocks. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2275) (cherry picked from commit 7141ba31969d0b378d08104a51f8f99b9187b9d5)
2017-01-25Properly handle a partial block in OCB modeMatt Caswell
If we have previously been passed a partial block in an "Update" call then make sure we properly increment the output buffer when we use it. Fixes #2273 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2275) (cherry picked from commit 7c12c7b61c5b37c9dff930ccc68421fb7de00271)
2017-01-25Don't use magic numbers in aes_ocb_cipher()Matt Caswell
Lots of references to 16 replaced by AES_BLOCK_SIZE. Also a few other style tweaks in that function Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2275) (cherry picked from commit 0ba5a9eaa0a6ae7fc25ee70eefc1f4fbdaf09483)
2017-01-24Cleanup EVP_CIPH/EP_CTRL duplicate definesTodd Short
Remove duplicate defines from EVP source files. Most of them were in evp.h, which is always included. Add new ones evp_int.h EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK is now always defined in evp.h, so remove conditionals on it Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2201) (cherry picked from commit 9d6fcd4295fef7ebc4232aab85718a99d36cc50a)
2017-01-24Add missing flags for EVP_chacha20()Kazuki Yamaguchi
ChaCha20 code uses its own custom cipher_data. Add EVP_CIPH_CUSTOM_IV and EVP_CIPH_ALWAYS_CALL_INIT so that the key and the iv can be set by different calls of EVP_CipherInit_ex(). Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2156) (cherry picked from commit c83680a04aac7a15e6ac48ed732b8322c4c9d49a)
2016-12-22Fix EVP_MD_meth_get_flagsTodd Short
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2134) (cherry picked from commit 8bfa99f04f9763a6a8d72a6d5c1f0a962f8a084b)
2016-12-20Reformat M_check_autoarg to match our coding styleRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2121) (cherry picked from commit 2629440d42e4d64cd0cb849c1b19fa87a4fcb90f)
2016-12-20M_check_autoarg: sanity check the keyRichard Levitte
For now, checking that the size is non-zero will suffice. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2120) (cherry picked from commit d7c8f142ea5953bf260b70a58739c1c9b0f038eb)
2016-11-25Fix ctrl operation for SHA1/MD5SHA1.Dr. Stephen Henson
This makes S/MIME and CMS signing in MIME format for SHA1 work again. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit a5abd438f85737ffa56320b67c5ef5525fc495c3)
2016-11-10chacha20/poly1305: make sure to clear the buffer at correct positionRichard Levitte
The offset to the memory to clear was incorrect, causing a heap buffer overflow. CVE-2016-7054 Thanks to Robert Święcki for reporting this Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit b8e4011fb26364e44230946b87ab38cc1c719aae)
2016-09-07GH1537: Avoid double-free in the EVP_PKEY APIAlex Gaynor
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit d65c3615f6c658478503f4862f8055203a98038c)
2016-08-26Improve the definition of STITCHED_CALL in e_rc4_hmac_md5.cRichard Levitte
The definition of STITCHED_CALL relies on OPENSSL_NO_ASM. However, when a configuration simply lacks the assembler implementation for RC4 (which is where we have implemented the stitched call), OPENSSL_NO_ASM isn't implemented. Better, then, to rely on specific macros that indicated that RC4 (and MD5) are implemented in assembler. For this to work properly, we must also make sure Configure adds the definition of RC4_ASM among the C flags. Reviewed-by: Andy Polyakov <appro@openssl.org> (cherry picked from commit 216e8d91033d237880cff7da0d02d46d47bae41b)
2016-08-24evp/bio_enc.c: stop using pointer arithmetic for error detection.Andy Polyakov
Thanks to David Benjamin for reporting this. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-21evp/bio_enc.c: refine non-overlapping logic.Andy Polyakov
RT#4628 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-17Convert X509* functions to use const gettersDr. Stephen Henson
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-17Constify private key decode.Dr. Stephen Henson
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-13Add point ctrls to X25519Dr. Stephen Henson
Add ctrl operations to set or retrieve encoded point in EVP_PKEY structures containing X25519 keys. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-13Add X25519 methods to internal tablesDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-10Fix spelling of error codeKurt Roeckx
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1421)
2016-08-04Constify some ASN1_OBJECT *obj input parametersFdaSilvaYY
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-02Fix some style issues...FdaSilvaYY
extra spacing and 80 cols Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1366)
2016-07-31evp/bio_enc.c: perform enc_read operation without using overlapping buffers.Andy Polyakov
Reviewed-by: Stephen Henson <steve@openssl.org>
2016-07-31evp/evp_enc.c: make assert error message more readableAndy Polyakov
and add EVPerr(PARTIALLY_OVERLAPPED) Reviewed-by: Stephen Henson <steve@openssl.org>
2016-07-26Note cipher BIO write errors too.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-26Set error if EVP_CipherUpdate fails.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-24Add EVP_ENCODE_CTX_copyJakub Zelenka
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1344)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-11 07:09:06 +0000