summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2019-11-07Add EVP functionality to create domain params and keys by user dataRichard Levitte
This is the EVP operation that corresponds to creating direct RSA, DH and DSA keys and set their numbers, to then assign them to an EVP_PKEY, but done entirely using an algorithm agnostic EVP interface. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10187)
2019-11-07Update source files for pre-3.0 deprecationRichard Levitte
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-07Update source files for deprecation at 3.0Richard Levitte
Previous macros suggested that from 3.0, we're only allowed to deprecate things at a major version. However, there's no policy stating this, but there is for removal, saying that to remove something, it must have been deprecated for 5 years, and that removal can only happen at a major version. Meanwhile, the semantic versioning rule is that deprecation should trigger a MINOR version update, which is reflected in the macro names as of this change. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-06Ensure EVP_get_digestbyname() and EVP_get_cipherbyname() know all aliasesMatt Caswell
Now that we have an EVP namemap containing all aliases that providers know about for any given algorithm, it is possible that an application attempts to look up a digest or a cipher via EVP_get_digestbyname() or EVP_get_cipherbyname() with an algorithm name that is unknown to the legacy method database. Therefore we extend those functions to additionally check the aliases in the namemap when searching for a method in the event that our initial lookup attempt fails. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10324)
2019-11-05EVP: Make the SIGNATURE implementation leanerRichard Levitte
Because the algorithm to use is decided already when creating an EVP_PKEY_CTX regardless of how it was created, it turns out that it's unnecessary to provide the SIGNATURE method explicitly, and rather always have it be fetched implicitly. This means fewer changes for applications that want to use new signature algorithms / implementations. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10303)
2019-11-05EVP: Make the KEYEXCH implementation leanerRichard Levitte
Because the algorithm to use is decided already when creating an EVP_PKEY_CTX regardless of how it was created, it turns out that it's unnecessary to provide the KEYEXCH method explicitly, and rather always have it be fetched implicitly. This means fewer changes for applications that want to use new key exchange algorithms / implementations. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10305)
2019-11-05s390x assembly pack: process x25519 and x448 non-canonical valuesPatrick Steuer
...in constant time. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10339)
2019-11-05s390x assembly pack: fix x448 handling of non-canonical valuesPatrick Steuer
The s390x x448 implementation does not correctly reduce non-canonical values i.e., u-coordinates >= p = 2^448 - 2^224 - 1. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10339)
2019-11-05s390x assembly pack: perlasm module updatePatrick Steuer
- add instructions: clfi, stck, stckf, kdsa - clfi and clgfi belong to extended-immediate (not long-displacement) - some cleanup Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10346)
2019-11-04Don't assume the type we read was the type we expectedMatt Caswell
i2v_GENERAL_NAME and GENERAL_NAME_print were assuming that the type of of a GENERAL_NAME (OTHERNAME) that we read in was the type we expected it to be. If its something else then this can cause unexpected behaviour. In the added fuzz test case an OOB read was occurring. This issue was recently added by commit 4baee2d. Credit to OSSFuzz for finding this issue. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10300)
2019-11-04Don't leak memory in the event of a failure in i2v_GENERAL_NAMESMatt Caswell
i2v_GENERAL_NAMES call i2v_GENERAL_NAME repeatedly as required. Each time i2v_GENERAL_NAME gets called it allocates adds data to the passed in stack and then returns a pointer to the stack, or NULL on failure. If the passed in stack is itself NULL then it allocates one. i2v_GENERAL_NAMES was not correctly handling the case where a NULL gets returned from i2v_GENERAL_NAME. If a stack had already been allocated then it just leaked it. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10300)
2019-11-03OSSL_STORE: add tracingRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8442)
2019-11-03X509_LOOKUP_store: new X509_LOOKUP_METHOD that works by OSSL_STORE URIRichard Levitte
This is a wrapper around OSSL_STORE. This also adds necessary support functions: - X509_STORE_load_file - X509_STORE_load_path - X509_STORE_load_store - SSL_add_store_cert_subjects_to_stack - SSL_CTX_set_default_verify_store - SSL_CTX_load_verify_file - SSL_CTX_load_verify_dir - SSL_CTX_load_verify_store and deprecates X509_STORE_load_locations and SSL_CTX_load_verify_locations, as they aren't extensible. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8442)
2019-11-03OSSL_STORE: constify the criterion parameter a bit moreRichard Levitte
For some reason, OSSL_STORE_SEARCH_get0_name() and OSSL_STORE_find() accepted a non-const OSSL_STORE_SEARCH criterion, which isn't at all necessary. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8442)
2019-11-03Change EVP_PKEY_CTX_new_provided() to take a library context too.Richard Levitte
With provided algorithms, the library context is ever present, so of course it should be specified alongside the algorithm name and property query string. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10308)
2019-11-03Make EVP_PKEY_CTX initialization more preciseRichard Levitte
There is a vagueness around how the provider data (algorithm name and property query string) is initialized in the presence of an engine. This change modifies this slightly so that the algorithm name for use with providers is never set if the initilization was given an engine. This makes it easier for other functions to simply check ctx->algorithm to see if the context is meant to be used for strictly legacy stuff or not. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10308)
2019-11-03Fix --strict-warnings buildPatrick Steuer
The %zd format corresponds to ssize_t which is used for function to either return a valid size or a negative value to indicate an error. Since size_t is in [-1,SSIZE_MAX] it is not a portable way to represent a pointer diff. For the %td format which corresponds to ptrdiff_t is C11, we chose to cast to long instead as it is already done in other places. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10335)
2019-11-03s390x assembly pack: enable clang buildPatrick Steuer
clang imposes some restrictions on the assembler code that gcc does not. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10330)
2019-11-03Fix OSSL_PARAM_set_BN() to fill the given buffer correctly.Richard Levitte
OSSL_PARAM_set_BN() filled the buffer from the left with as many bytes as that the BIGNUM takes, regardless of buffer size or native endianness. This was due to BN_bn2nativepad() being given the size of the BIGNUM rather than the size of the buffer (which meant it never had to pad anything). The fix is to given BN_bn2nativepad() the size of the buffer instead. This aligns well with the corresponding _set_ functions for native integer types work. Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/10326)
2019-11-02VMS: Added new method to gather entropy on VMS, based on SYS$GET_ENTROPY.Richard Levitte
This system services is based on FreeBSD 12's getentropy(), and is therefore treated the same way as getentropy() with regards to amount of entropy bits per data bit. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8926)
2019-11-02BIO_s_connect: add an error state and use itRichard Levitte
If no connection could be made, addr_iter will eventually end up being NULL, and if the user didn't check the returned error value, the BIO_CONN_S_CONNECT code will be performed again and will crash. So instead, we add a state BIO_CONN_S_CONNECT_ERROR that we enter into when we run out of addresses to try. That state will just simply say "error" back, until the user does something better with the BIO, such as free it or reset it. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7630)
2019-11-02DRBG: add check for XOF so these can be disallowed by the DRBGsPauli
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10321)
2019-11-02DRBG: weaken the restriction on allowed digests.Pauli
The artificial restriction of digests for the HMAC and HASH DRBGs is lifted. Any fetchable digest is acceptable except XOF ones (such as SHAKE). In FIPS mode, the fetch remains internal to the provider so only a FIPS validated digest will be located. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10321)
2019-11-01s390x: fix build errorsPatrick Steuer
ecp_s390x_nistp.c and ecx_meth.c need to include s390x_arch.h. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10317)
2019-11-01fix for Missing null check after OPENSSL_zallocjayaram
Fixes #10283 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/10296)
2019-11-01md4/md5: macros should not include the line following themPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10311)
2019-11-01Fix potential memory leak in dh_ameth.cScott Wilson
Free dukm in error handling of dh_cms_encrypt() Fixes #10294 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/10310)
2019-10-31evp_pkey_ctx_free_old_ops(): Make sure to assign NULL to freed pointersRichard Levitte
Otherwise, should this function be called more than once on the same EVP_PKEY_CTX, we get double free issues. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10292)
2019-10-31[crypto/bn] fix a few small timing leaks in BN_lshift1 and BN_rshift1Billy Brumley
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10209)
2019-10-31Add support for in-kernel TLS (KTLS) on FreeBSD.Andrew Gallatin
- Check for the <sys/ktls.h> header to determine if KTLS support is available. - Populate a tls_enable structure with session key material for supported algorithms. At present, AES-GCM128/256 and AES-CBC128/256 with SHA1 and SHA2-256 HMACs are supported. For AES-CBC, only MtE is supported. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10045)
2019-10-31crypto/evp/evp_fetch.c: Make it more prominent that these functions are EVPRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10257)
2019-10-30Fix undefined array OPENSSL_ia32cap_P.Kelvin Lee
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/10274)
2019-10-29chunk 5 of CMP contribution to OpenSSLDr. David von Oheimb
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10036)
2019-10-28Allow EVP_PKEY_get0_RSA for RSA-PSS keysTobias Nießen
RSA-PSS keys use the same internal structure as RSA keys but do not allow accessing it through EVP_PKEY_get0_RSA. This commit changes that behavior. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10217)
2019-10-25Strip BOM on loading PEM filesDmitry Belyavskiy
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org>
2019-10-23Document "get/set-app-data" macros.Rich Salz
Documenting the macros removes 14 undocumented items. Merged three separate manpages into one. Rename the DRBG CRYPTO_EX define into RAND_DRBG, but keep the old one for API compatibility. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10216)
2019-10-23Update control logic for BN_gcdCesar Pereida Garcia
PR https://github.com/openssl/openssl/pull/10122 introduced changes to the BN_gcd function and the control logic inside it accessed `g->d[0]` irrespective of `g->top`. When BN_add is called, in case the result is zero, `BN_zero` is called. The latter behaves differently depending on the API compatibility level flag: normally `g->d[0]` is cleared but in `no-deprecated` builds only `g->top` is set to zero. This commit uses bitwise logic to ensure that `g` is treated as zero if `g->top` is zero, irrespective of `g->d[0]`. Co-authored-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10232)
2019-10-23Add KRB5KDF from RFC 3961Simo Sorce
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9949)
2019-10-23Deprecate EC_GROUP_clear_free()Nicola Tuveri
There is nothing confidential in `EC_GROUP` so really having a `EC_GROUP_clear_free` function at all does not make much sense anymore. See https://github.com/openssl/openssl/issues/9822 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9874)
2019-10-23Avoid using EC_GROUP_clear_free() internallyNicola Tuveri
There is nothing confidential in `EC_GROUP` so really having a `EC_GROUP_clear_free` function at all does not make much sense anymore. See https://github.com/openssl/openssl/issues/9822 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9874)
2019-10-21crypto/s390xcap.c: Add guards around the GETAUXVAL checksRichard Levitte
HWCAP_S390_VX is missing on SUSE Linux Enterprise Server 12 SP1, so we add a guard that checks the present of that macro. While we're at it, we do the same with HWCAP_S390_STFLE, for consistency. Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/9892)
2019-10-21crypto/evp/pmeth_lib.c: Fix copy'n'paste errorRichard Levitte
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10227)
2019-10-19Move random-related defines from e_os.h to rand_unix.cDr. Matthias St. Pierre
Fixes #10049 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10050)
2019-10-19rand_unix.c: correct include guard commentsDr. Matthias St. Pierre
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10050)
2019-10-17Replace BUF_ string function calls with OPENSSL_ onesRich Salz
Deprecate the BUF_ string macros Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10207)
2019-10-17Move BLAKE2 digests completely to the default providerRichard Levitte
This leaves minimal implementations of EVP_blake2b512 and EVP_blake2s256, that are now only there to provide a name for implicit fetches. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9075)
2019-10-17evp_keymgmt_export_to_provider(): adjust OSSL_PARAM array for transferRichard Levitte
It may be that the OSSL_PARAM array we used for getting parameter values for a key had a few too many entries. These are detected by their return_size == 0. Before making second export call, we prune away these items so we only ask for parameters that exist. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10190)
2019-10-17New RSA keymgmt implementation to handle import / export of RSA keysRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10190)
2019-10-17Added internal functions for easy getting and setting all RSA parameters.Richard Levitte
rsa_set0_all_params() is used to set all the primes, exponents and coefficients. rsa_get0_all_params() is used to get all the primes, exponents and coefficients. "All" includes p, q, dP, dQ and qInv without making them separate. All arrays of numbers are implemented as stacks to make dynamic use easier. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10190)
2019-10-17Constant-time GCD function.Cesar Pereida Garcia
This commit replaces the current `BN_gcd` function with a constant-time GCD implementation. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10122)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-22 16:35:03 +0000