summaryrefslogtreecommitdiffstats
path: root/crypto/evp
AgeCommit message (Collapse)Author
2022-06-21Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2022-06-15Fix a mem leak in evp_pkey_export_to_providerK1
If keymgmt is NULL, tmp_keymgmt is allocated and will not be freed. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18499) (cherry picked from commit 115eb945acd9a27bf81c6c8923f43768f9e487a8)
2022-06-10Check return of BIO_new() and always free pkey from evp_pkey_copy_downgraded()Tomas Mraz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18494) (cherry picked from commit d8732803c493cba7a863c5c16da62ee9d611c5ca)
2022-06-08Fix a mem leak in evp_pkey_copy_downgraded()Matt Caswell
If we get a failure during evp_pkey_copy_downgraded() and on entry *dest was NULL then we leak the EVP_PKEY that was automatically allocated and stored in *dest. Found due to this comment: https://github.com/openssl/openssl/pull/18355#issuecomment-1145028315 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/18470)
2022-06-02Fix possible null pointer dereference of evp_pkey_get_legacy()Zhou Qingyang
evp_pkey_get_legacy() will return NULL on failure, however several uses of it or its wrappers does not check the return value of evp_pkey_get_legacy(), which could lead to NULL pointer dereference. Fix those possible bugs by adding NULL checking. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17967) (cherry picked from commit b9a86d5dd8b5bd33be42390bcbb5121fe0ae71a1)
2022-05-27Fix the incorrect checks of EVP_CIPHER_CTX_set_key_lengthPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18397) (cherry picked from commit 8d9fec1781751d2106d899c6076eeb3da6930bfe)
2022-05-26Fix the defective check of EVP_PKEY_get_paramsPeiwei Hu
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18367) (cherry picked from commit 7e5e91176b770a68bdaf73a5c647f1fc0d7f2900)
2022-05-24Fix check of EVP_CIPHER_CTX_ctrlPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18368) (cherry picked from commit d649c51a5388912277dffb56d921eb720db54be1)
2022-05-13Always try locale initialization from OPENSSL_strcasecmpTomas Mraz
Fixes #18172 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18293)
2022-05-13int_ctx_new(): Revert extra ossl_init_casecmp callTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18293)
2022-05-09EVP_PKEY_Q_keygen: Call OPENSSL_init_crypto to init strcasecmpTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18247) (cherry picked from commit b807c2fbab2128cf3746bb2ebd51cbe3bb6914a9)
2022-05-05Make it possible to remove methods by the provider that provides themRichard Levitte
This adds ossl_method_store_remove_all_provided(), which selectively removes methods from the given store that are provided by the given provider. This also adds the EVP specific evp_method_store_remove_all_provided(), which matches ossl_method_store_remove_all_provided() but can also retrieve the correct store to manipulate for EVP functions. This allows us to modify ossl_provider_self_test() to do the job it's supposed to do, but through clearly defined functions instead of a cache flushing call that previously did more than that. ossl_provider_deactivate() is also modified to remove methods associated with the deactivated provider, and not just clearing the cache. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18151) (cherry picked from commit 2e4d0677ea858c619a33235265dbee19520a9d35)
2022-05-05Don't empty the method store when flushing the query cacheRichard Levitte
When evp_method_store_flush() flushed the query cache, it also freed all methods in the EVP method store, through an unfortunate call of ossl_method_store_flush_cache() with an argument saying that all methods should indeed be dropped. To undo some of the confusion, ossl_method_store_flush_cache() is renamed to ossl_method_store_cache_flush_all(), and limited to do only that. Some if the items in the internal ALGORITHM structure are also renamed and commented to clarify what they are for. Fixes #18150 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18151) (cherry picked from commit 60640d79ca7ea0980dc09c71fe6a297b5f8588a2)
2022-05-03Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-05-02fix_dh_paramgen_type: Avoid crash with invalid paramgen typeTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18202) (cherry picked from commit 359dad5178285d5471f2a57a5aa99c1f588dffcb)
2022-04-26Ensure we initialized the locale before evp_pkey_name2typeDmitry Belyavskiy
Fixes #18158 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18175)
2022-04-21str[n]casecmp => OPENSSL_strncasecmpDmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18103)
2022-04-11Crypto/evp: Fix null pointer dereferenceyuanjungong
Check the return value of EVP_KDF_fetch to avoid a potential null pointer dereference. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18062) (cherry picked from commit 5f1424c6bdca8ddb9d5d88a78a1d738be19c4ea8)
2022-04-03Fix Coverity 1503096: out-of-bounds accessPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/17898) (cherry picked from commit d1592f21c0d4c2c94a8c6004cf7b5cad2dcb2637)
2022-03-15Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2022-03-15Fix signed integer overflow in evp_encHugo Landau
Fixes #17869. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17870) (cherry picked from commit 1832bb0f02e519a48f06a10467c7ce5f7f3feeeb)
2022-03-15Fixed typo in inner_evp_generic_fetch() error handlingOliver Roberts
Fixes #17876 CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17877) (cherry picked from commit ef9909f3c6471ba39be1e3d18a366044cbf30a19)
2022-03-15EVP_MD performance fix (refcount cache contention)Hugo Landau
Partial fix for #17064. Avoid excessive writes to the cache line containing the refcount for an EVP_MD object to avoid extreme cache contention when using a single EVP_MD at high frequency on multiple threads. This changes performance in 3.0 from being double that of 1.1 to only slightly higher than that of 1.1. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17857) (cherry picked from commit c0b7dac66edde45b8da80918f5b5b62d1e766a0c)
2022-03-08fetch: convert a NULL property query to ""Pauli
Previously, a NULL property query was never cached and this lead to a performance degregation. Now, such a query is converted to an empty string and cached. Fixes #17752 Fixes https://github.openssl.org/openssl/openssl/issues/26 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17769) (cherry picked from commit af788ad6c3624ccc4b49778a9ded2487b9dbeedd)
2022-02-03Fix copyrightsTodd Short
Add copyright to files that were missing it. Update license from OpenSSL to Apache as needed. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17606) (cherry picked from commit 9d987de3aabe54e65a55649a61953966f33b070b)
2022-01-17Properly return error on EVP_PKEY_CTX_set_dh_nid and ↵Tomas Mraz
EVP_PKEY_CTX_set_dhx_rfc5114 Fixes #17485 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17498) (cherry picked from commit f58bb2dd00c3004552c5c1e8d0f2c1390c004cf8)
2022-01-14EVP: fix evp_keymgmt_util_match so that it actually tries cross export the ↵manison
other way if the first attempt fails Fixes #17482 CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17487) (cherry picked from commit 37b850738cbab74413d41033b2a4df1d69e1fa4a)
2022-01-13Clear md_data only when necessaryMatt Caswell
PR #17255 fixed a bug in EVP_DigestInit_ex(). While backporting the PR to 1.1.1 (see #17472) I spotted an error in the original patch. This fixes it. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17473) (cherry picked from commit 8086b267fb3395c53cd5fc29eea68ba4826b333d)
2022-01-13drop unused callback variableGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17471) (cherry picked from commit 64a644530e023d3064db9027b0977d33b1d2ad9a)
2022-01-12EVP_DigestSignFinal: *siglen should not be read if sigret == NULLTomas Mraz
This fixes small regression from #16962. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17460) (cherry picked from commit a4e01187d3648d9ce99507097400902cf21f9b55)
2022-01-10Fix a leak in EVP_DigestInit_ex()Matt Caswell
If an EVP_MD_CTX is reused then memory allocated and stored in md_data can be leaked unless the EVP_MD's cleanup function is called. Fixes #17149 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/17255) (cherry picked from commit 357bccc8ba64ec8a5f587b04b5d6b6ca9e8dcbdc)
2022-01-10Ensure that MDs created via EVP_MD_meth_new() go down the legacy routeMatt Caswell
MDs created via EVP_MD_meth_new() are inherently legacy and therefore need to go down the legacy route when they are used. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/17255) (cherry picked from commit d9ad5b16b32172df6f7d02cfb1c339cc85d0db01)
2022-01-10EVP_PKEY_derive_set_peer_ex: Export the peer key to proper keymgmtTomas Mraz
The peer key has to be exported to the operation's keymgmt not the ctx->pkey's keymgmt. Fixes #17424 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17425) (cherry picked from commit 64a8f6008acce93d0bf184559c63e66c0cc0e23d)
2022-01-07EVP_PKEY_fromdata(): Do not return newly allocated pkey on failureTomas Mraz
Fixes #17407 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17411) (cherry picked from commit 5b03b89f7f925384c2768874c95f1af7053fd16f)
2021-12-17evp: address a use after free state when using HMAC and MD copy.Pauli
Fixes #17261 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17263) (cherry picked from commit ad2fcee1632d3f21a37e8e108d4c0dcf9099686d)
2021-12-13Fix EVP_PKEY_eq() to be possible to use with strictly private keysRichard Levitte
EVP_PKEY_eq() assumed that an EVP_PKEY always has the public key component if it has a private key component. However, this assumption no longer strictly holds true, at least for provider backed keys. EVP_PKEY_eq() therefore needs to be modified to specify that the private key should be checked too (at the discretion of what's reasonable for the implementation doing the actual comparison). Fixes #16267 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16765) (cherry picked from commit f3ba62653815b2f7991103cdbea1ac155c8c916a)
2021-11-27Fix EVP_PKEY_CTX_get_rsa_pss_saltlen() not returning a valueTom Cosgrove
When an integer value was specified, it was not being passed back via the orig_p2 weirdness. Regression test included. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17136) (cherry picked from commit 6f87463b62f9b2849510d74ff0fd6a62955ea947)
2021-11-24EVP_MD_CTX_copy_ex: Allow copying uninitialized digest contextsTomas Mraz
Fixes #17117 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17118) (cherry picked from commit 9ece8323ea2230092227bf20e5d93012d15d92e9)
2021-11-15Add null digest implementation to the default providerTomas Mraz
This is necessary to keep compatibility with 1.1.1. Fixes #16660 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17016) (cherry picked from commit bef9b48e5071cdd2b41a4f486d1bcb5e14b2a5c3)
2021-11-12do_sigver_init: Allow reinitialization of an existing operation.Tomas Mraz
Fixes #16936 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16964) (cherry picked from commit ae6b68b761b9c5f30897747487ea943ccfab53ba)
2021-11-08Address coverity 1493382 argument cannot be negativePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16962) (cherry picked from commit fe4125382301201e42a3251544cda429bba0c9d7)
2021-11-08Address Coverity 1493387 Logically dead codePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16962) (cherry picked from commit 182cc644b3a3690bddfecba925486fefa421d6ec)
2021-11-07avoid a NULL dereference when getting digestPauli
Fixes #16961 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/16969) (cherry picked from commit ab547fc005307ecf48451638e947cdabca147159)
2021-11-05Fix for a segv interrupt that occurs when fix_dh_rfc5114 is called withPhil Mesnier
ctx->p2 being a null pointer. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16913)
2021-11-02Fix incorrect return check of BN_bn2nativepadPW Hu
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16943) (cherry picked from commit 944fcfc69d16dfd20decdd9cd105436f0043dbe0)
2021-10-27CORE: Encure that cached fetches can be done per providerRichard Levitte
This mostly entails passing around a provider pointer, and handling queries that includes a pointer to a provider, where NULL means "any". This also means that there's a need to pass the provider pointer, not just down to the cache functions, but also be able to get it from ossl_method_store_fetch(). To this end, that function's OSSL_PROVIDER pointer argument is modified to be a pointer reference, so the function can answer back what provider the method comes from. Test added. Fixes #16614 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725) (cherry picked from commit dc010ca6ec01d313a84c3c4b040232655a1772ad)
2021-10-27EVP: For all operations that use an EVP_PKEY, check that there is oneRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725) (cherry picked from commit 433e13455ede1a39d415b690b8a564b4f36b8dee)
2021-10-27EVP: Allow a fallback for operations that work with an EVP_PKEYRichard Levitte
Functions like EVP_PKEY_sign_init() do an implicit fetch of the operation implementation (EVP_SIGNATURE in this case), then get the KEYMGMT from the same provider, and tries to export the key there if necessary. If an export of the key isn't possible (because the provider that holds the key is an HSM and therefore can't export), we would simply fail without looking any further. This change modifies the behaviour a bit by trying a second fetch of the operation implementation, but specifically from the provider of the EVP_PKEY that's being used. This is done with the same properties that were used with the initial operation implementation fetch, and should therefore be safe, allowing only what those properties allow. Fixes #16614 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725) (cherry picked from commit 839ffdd11cd48d329a1d89565d62e0be082f9d08)
2021-10-27EVP: Add internal functions to fetch type specific EVP methods from providerRichard Levitte
Added functions: evp_signature_fetch_from_prov(), evp_asym_cipher_fetch_from_prov(), evp_keyexch_fetch_from_prov(), evp_kem_fetch_from_prov() These are all like the public conterparts, except they all take a provider instead of a library context as first argument. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725) (cherry picked from commit ff7781462dd04ab99c159136b47672252bad7fa8)
2021-10-27EVP: Reverse the fetch logic in all pkey using functionalityRichard Levitte
In all initializing functions for functionality that use an EVP_PKEY, the coded logic was to find an KEYMGMT implementation first, and then try to find the operation method (for example, SIGNATURE implementation) in the same provider. This implies that in providers where there is a KEYMGMT implementation, there must also be a SIGNATURE implementation, along with a KEYEXCH, ASYM_CIPHER, etc implementation. The intended design was, however, the opposite implication, i.e. that where there is a SIGNATURE implementation, there must also be KEYMGMT. This change reverses the logic of the code to be closer to the intended design. There is a consequence; we now use the query_operation_name function from the KEYMGMT of the EVP_PKEY given by the EVP_PKEY_CTX (ultimately given by the application). Previously, we used the query_operation_name function from the KEYMGMT found alongside the SIGNATURE implementation. Another minor consequence is that the |keymgmt| field in EVP_PKEY_CTX is now always a reference to the KEYMGMT of the |pkey| field if that one is given (|pkey| isn't NULL) and is provided (|pkey->keymgmt| isn't NULL). Fixes #16614 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725) (cherry picked from commit 5246183e7a9f9fb1819d50ab40e2fecc68235e0d)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-22 05:03:07 +0000