summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2019-01-07Update generator copyright year.Viktor Dukhovni
Some Travis builds appear to fail because generated objects get 2019 copyrights now, and the diff complains. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7969)
2019-01-04Support _onexit() in preference to atexit() on WindowsMatt Caswell
This enables cleanup to happen on DLL unload instead of at process exit. [extended tests] Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7983)
2019-01-04Introduce a no-pinshared optionMatt Caswell
This option prevents OpenSSL from pinning itself in memory. Fixes #7598 [extended tests] Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7983)
2019-01-04Implement OPENSSL_INIT_NO_ATEXITMatt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7983)
2019-01-04Fix a RUN_ONCE bugMatt Caswell
We have a number of instances where there are multiple "init" functions for a single CRYPTO_ONCE variable, e.g. to load config automatically or to not load config automatically. Unfortunately the RUN_ONCE mechanism was not correctly giving the right return value where an alternative init function was being used. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7983)
2019-01-03make updateMatt Caswell
Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7973)
2018-12-31Fix cert with rsa instead of rsaEncryption as public key algorithmBernd Edlinger
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/7962) (cherry picked from commit 1f483a69bce11c940309edc437eee6e32294d5f2)
2018-12-23Do not complain when /dev/crypto does not exist.Jung-uk Kim
FreeBSD does not enable cryptodev(4) by default. OpenBSD disabled support for /dev/crypto by default from 4.9 and removed it from 5.7. Now the engine is properly enabled by default on BSD platforms (see #7885), it continuously complains: Could not open /dev/crypto: No such file or directory Hide the nagging error message behind ENGINE_DEVCRYPTO_DEBUG. CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7896) (cherry picked from commit c79a022da973140c141eeebff9170ca5702be0f9)
2018-12-23EVP_PKEY_size declared to take a const parameterShreya Bhandare
CLA: trivial Function EVP_PKEY_size has been modified to take a const parameter Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7892) (cherry picked from commit 47ec2367ebf6082abb103e66e609feb5c128d358)
2018-12-22Coverity fix in some crypto/asn1 codeFdaSilvaYY
Call to i2d method returns an int value. Fix: CID 1338183 (#1 of 1): Improper use of negative value (NEGATIVE_RETURNS) CID 1371691 (#1 of 1): Improper use of negative value (NEGATIVE_RETURNS) CID 1371692 (#1 of 1): Improper use of negative value (NEGATIVE_RETURNS) [extended tests] Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7359) (cherry picked from commit da84249be6492ccfc5ecad32ac367fd06e9bdbef)
2018-12-20Admit unknown pkey types at security level 0Ken Goldman
The check_key_level() function currently fails when the public key cannot be extracted from the certificate because its algorithm is not supported. However, the public key is not needed for the last certificate in the chain. This change moves the check for level 0 before the check for a non-NULL public key. For background, this is the TPM 1.2 endorsement key certificate. I.e., this is a real application with millions of certificates issued. The key is an RSA-2048 key. The TCG (for a while) specified Public Key Algorithm: rsaesOaep rather than the commonly used Public Key Algorithm: rsaEncryption because the key is an encryption key rather than a signing key. The X509 certificate parser fails to get the public key. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7906)
2018-12-14ERR: preserve system error number in a few more placesRichard Levitte
It turns out that intialization may change the error number, so we need to preserve the system error number in functions where initialization is called for. These are ERR_get_state() and err_shelve_state() Fixes #7897 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7902) (cherry picked from commit 91c5473035aaf2c0d86e4039c2a29a5b70541905)
2018-12-13Add missing OPENSSL_clear_free before using ec->keyMansour Ahmadi
Fixes #7657 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7877) (cherry picked from commit 4128136a28c3b7d3878daed728c49f18eb950adc)
2018-12-13add missing check for BN_mod_inverseMansour Ahmadi
Fixes #7650 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7876) (cherry picked from commit 55833a8de70589a5000044b6291e190f5a3826ae)
2018-12-13fix inconsistent flen check in rsa_pk1 and rsa_oaepMansour Ahmadi
Fixes #7117 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7880) (cherry picked from commit 4fea7005c3d08ed0d575bdea5082b7b0ce355237)
2018-12-11Disallow Ed448 signature malleabilityMatt Caswell
Check that s is less than the order before attempting to verify the signature as per RFC8032 5.2.7 Fixes #7706 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/7748) (cherry picked from commit 08afd2f37a4465c90b9b9e2081c9e8df4726db89)
2018-12-10eng_devcrypto: make sure digest can do copyEneas U de Queiroz
Digest must be able to do partial-state copy to be used. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7585) (cherry picked from commit 16e252a01b754a13e83d5e5e87afbe389997926b)
2018-12-10eng_devcrypto: fix ctr modeEneas U de Queiroz
Make CTR mode behave like a stream cipher. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7585) (cherry picked from commit b5015e834aa7d3f0a5d7585a8fae05cecbdbb848)
2018-12-10eng_devcrypto: add cipher CTX copy functionEneas U de Queiroz
The engine needs a custom cipher context copy function to open a new /dev/crypto session. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7585) (cherry picked from commit 6d99e238397859f2df58c60e28905193b2dd6762)
2018-12-10eng_devcrypto: close session on cleanup, not finalEneas U de Queiroz
Close the session in digest_cleanup instead of digest_final. A failure in closing the session does not mean a previous successful digest final has failed as well. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7585) (cherry picked from commit a67203a19d379a8cc8b369587c60c46eb4e19014)
2018-12-10eng_devcrypto: fix copy of unitilialized digestEneas U de Queiroz
If the source ctx has not been initialized, don't initialize the copy either. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7585) (cherry picked from commit ae8183690fa53b978d4647563f5a521c4cafe94c)
2018-12-10eng_devcrypto: expand digest failure casesEneas U de Queiroz
Return failure when the digest_ctx is null in digest_update and digest_final, and when md is null in digest_final. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7585) (cherry picked from commit 4d9f99654441e36fdcb49540a1dbc9d4c70ccb68)
2018-12-10eng_devcrypto: don't leak methods tablesEneas U de Queiroz
Call functions to prepare methods after confirming that /dev/crytpo was sucessfully open and that the destroy function has been set. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7585) (cherry picked from commit d9d4dff5c640990d45af115353fc9f88a497a56c)
2018-12-10Preserve errno on dlopenMatt Caswell
For the same reasons as in the previous commit we must preserve errno across dlopen calls. Some implementations (e.g. solaris) do not preserve errno even on a successful dlopen call. Fixes #6953 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7680) (cherry picked from commit 3cb4e7dc1cf92022f62b9bbdd59695885a1265ff)
2018-12-10Make sure build_SYS_str_reasons() preserves errnoMatt Caswell
This function can end up being called during ERR_get_error() if we are initialising. ERR_get_error() must preserve errno since it gets called via SSL_get_error(). If that function returns SSL_ERROR_SYSCALL then you are supposed to inspect errno. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7680) (cherry picked from commit 71b1ceffc4c795f5db21861dd1016fbe23a53a53)
2018-12-10make updateRichard Levitte
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7852) (cherry picked from commit f2f734d4f9e34643a1d3e5b79d2447cd643519f8)
2018-12-10Prevent calling decryption in an encryption context and vice versaRichard Levitte
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7852) (cherry picked from commit a8bf2f8f24bda57c860e4356f31264fff63fe8b9)
2018-12-08err/err.c: improve err_clear_last_constant_time's portability.Andy Polyakov
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7850) (cherry picked from commit 91d0fd1c2753f0f7d6e0953eed3cfb6eb96d8ff4)
2018-12-07Make EVP_PKEY_asn1_add0() stricter about its inputRichard Levitte
It turns out that the strictness that was implemented in EVP_PKEY_asn1_new() (see Github openssl/openssl#6880) was badly placed for some usages, and that it's better to do this check only when the method is getting registered. Fixes #7758 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7847) (cherry picked from commit a86003162138031137727147c9b642d99db434b1)
2018-12-06curve25519.c: improve formula alignmentDr. Matthias St. Pierre
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7750) (cherry picked from commit 425dde5d75a6ffff9a1027107711b99da39e3519)
2018-12-06curve25519.c: reformat code to follow coding guidelinesDr. Matthias St. Pierre
Fixes #7698 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7750) (cherry picked from commit 3a17b9a46ecf54a30073534dff04e3223ff98813)
2018-12-05bn/bn_{div|shift}.c: introduce fixed-top interfaces.Andy Polyakov
Fixed-top interfaces tolerate zero-padded inputs and facilitate constant-time-ness. bn_div_fixed_top tolerates zero-padded dividend, but not divisor. It's argued that divisor's length is public even when value is secret. [extended tests] Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7589) (cherry picked from commit 3a4a88f436ed1dd1165e0b59c1ca4a25e9e1d690)
2018-12-05bn/bn_div.c: make conditional addition unconditionalAndy Polyakov
and add template for constant-time bn_div_3_words. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7589) (cherry picked from commit 3da2e9c4ee45989a426ff513dc6c6250d1e460de)
2018-12-05Configurations/10-main.conf: remove MIPS bn_div_3_words.Andy Polyakov
It's being replaced with constant-time alternative. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7589) (cherry picked from commit b34446cca2b1814fa674adc8076707d2b65a697f)
2018-12-03Disallow Ed25519 signature maleabilityMatt Caswell
Check that s is less than the order before attempting to verify the signature as per RFC8032 5.1.7 Fixes #7693 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7697) (cherry picked from commit 0ac8f35c04c4fcdee421170ae6351e42b9e84ce4)
2018-11-30rsa/rsa_ssl.c: make RSA_padding_check_SSLv23 constant-time.Andy Polyakov
Copy of RSA_padding_check_PKCS1_type_2 with a twist that rejects padding if nul delimiter is preceded by 8 consecutive 0x03 bytes. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 603221407ddc6404f8c417c6beadebf84449074c)
2018-11-30rsa/rsa_oaep.c: remove memcpy calls from RSA_padding_check_PKCS1_OAEP.Andy Polyakov
And make RSAErr call unconditional. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 75f5e944be97f28867e7c489823c889d89d0bd06)
2018-11-30rsa/rsa_pk1.c: remove memcpy calls from RSA_padding_check_PKCS1_type_2.Andy Polyakov
And make RSAErr call unconditional. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit e875b0cf2f10bf2adf73e0c2ec81428290f4660c)
2018-11-30rsa/rsa_ossl.c: make RSAerr call in rsa_ossl_private_decrypt unconditional.Andy Polyakov
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 89072e0c2a483f2ad678e723e112712567b0ceb1)
2018-11-30err/err.c: add err_clear_last_constant_time.Andy Polyakov
Expected usage pattern is to unconditionally set error and then wipe it if there was no actual error. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit f658a3b64d8750642f4975090740865f770c2a1b)
2018-11-26Clean up BN_consttime_swap.Billy Brumley
Updated "condition" logic lifted from Theo Buehler's LibreSSL commit https://github.com/libressl-portable/openbsd/commit/517358603b4be76d48a50007a0d414c2072697dd Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7619) (cherry picked from commit 900fd8f375ca758d182e894bc1556509b231dbc8)
2018-11-24VMS: fix collected error stringsRichard Levitte
It turns out that on VMS, strerror() returns messages with added spaces at the end. We wouldn't had noticed if it wasn't for perl trimming those spaces off for its own sake and thereby having test/recipes/02-test_errstr.t fail on VMS. The safe fix is to do the same trimming ourselves. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7701) (cherry picked from commit 9f15e5b911ba6053e09578f190354568e01c07d7)
2018-11-24Stop marking default digest for EC keys as mandatoryDavid Woodhouse
ASN1_PKEY_CTRL_DEFAULT_MD_NID is documented to return 2 for a mandatory digest algorithm, when the key can't support any others. That isn't true here, so return 1 instead. Partially fixes #7348 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit eb7eb1378cd15c4652884b3701d4c0ef27b5b8a6) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7609)
2018-11-23Smarter build of system error text databaseRichard Levitte
We stored copies of the system error texts in a fixed line size array, which is a huge waste. Instead, use a static memory pool and pack all the string in there. The wasted space at the end, if any, gives us some leeway for longer strings than we have measured so far. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7681) (cherry picked from commit 2c5b6bbb6797242f43b5a986e1c018943e5c1305)
2018-11-22rsa/rsa_ossl.c: cache MONT_CTX for public modulus earlier.Andy Polyakov
Blinding is performed more efficiently and securely if MONT_CTX for public modulus is available by the time blinding parameter are instantiated. So make sure it's the case. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7586) (cherry picked from commit 2cc3f68cde77af23c61fbad65470602ee86f2575)
2018-11-20Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7669)
2018-11-16sha/asm/sha512p8-ppc.pl: optimize epilogue.Andy Polyakov
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7643) (cherry picked from commit 6b956fe77b8aeb899ef7bdfa147a00bda51b804a)
2018-11-16sha/asm/sha512p8-ppc.pl: fix typo in prologue.Andy Polyakov
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7643) (cherry picked from commit 79d7fb990cd28bbe2888ed8f9051ab54c9f986b0)
2018-11-14DSA: Check for sanity of input parametersVitezslav Cizek
dsa_builtin_paramgen2 expects the L parameter to be greater than N, otherwise the generation will get stuck in an infinite loop. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (cherry picked from commit 3afd38b277a806b901e039c6ad281c5e5c97ef67) (Merged from https://github.com/openssl/openssl/pull/7493)
2018-11-12Fix SipHash init order.Richard Levitte
Setting the SipHash hash size and setting its key is done with two independent functions... and yet, the internals depend on both. Unfortunately, the function to change the size wasn't adapted for the possibility that the key was set first, with a different hash size. This changes the hash setting function to fix the internal values (which is easy, fortunately) according to the hash size. evpmac.txt value for digestsize:8 is also corrected. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7613) (cherry picked from commit 425036130dfb3cfbef5937772f7526ce60133264)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-26 21:49:47 +0000