summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2020-07-16Update copyright yearRichard Levitte
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12463)
2020-07-16Revert "kdf: make function naming consistent."Matt Caswell
The commit claimed to make things more consistent. In fact it makes it less so. Revert back to the previous namig convention. This reverts commit 765d04c9460a304c8119f57941341a149498b9db. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12186)
2020-07-16Revert "The EVP_MAC functions have been renamed for consistency. The ↵Matt Caswell
EVP_MAC_CTX_*" The commit claimed to make things more consistent. In fact it makes it less so. Revert back to the previous namig convention. This reverts commit d9c2fd51e2e278bc3f7793a104ff7b4879f6d63a. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12186)
2020-07-16trace: condition out engine related tracingPauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12226)
2020-07-16deprecate engines in libcryptoPauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12226)
2020-07-15Enable WinCE build without deceiving _MSC_VER.aSoujyuTanaka
Reviewed-by: Mark J. Cox <mark@awe.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11526)
2020-07-15Disable optimiization of BN_num_bits_word() for VS2005 ARM compiler due toaSoujyuTanaka
its miscompilation of the function. https://mta.openssl.org/pipermail/openssl-users/2018-August/008465.html Reviewed-by: Mark J. Cox <mark@awe.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11526)
2020-07-15Changed uintptr_t to size_t. WinCE6 doesn't seem it have the definition.aSoujyuTanaka
Reviewed-by: Mark J. Cox <mark@awe.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11526)
2020-07-14DRBG: rename the DRBG taxonomy.Pauli
The existing wording didn't capture the reality of the default setup, this new nomenclature attempts to improve the situation. Reviewed-by: Mark J. Cox <mark@awe.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12366)
2020-07-11BN: Check endianness in run-time, in BN_native2bn() and BN_bn2nativepad()Richard Levitte
The code relied on B_ENDIAN being defined on all big-endian platform, which turned out to not always be the case. Fixes #12387 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/12390)
2020-07-11Add and use internal header that implements endianness checkRichard Levitte
This moves test/ossl_test_endian.h to include/internal/endian.h and thereby makes the macros in there our standard way to check endianness in run-time. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/12390)
2020-07-09Add multiple fixes for ffc key generation using invalid p,q,g parameters.Shane Lontis
Fixes #11864 - The dsa keygen assumed valid p, q, g values were being passed. If this is not correct then it is possible that dsa keygen can either hang or segfault. The fix was to do a partial validation of p, q, and g inside the keygen. - Fixed a potential double free in the dsa keypair test in the case when in failed (It should never fail!). It freed internal object members without setting them to NULL. - Changed the FFC key validation to accept 1024 bit keys in non fips mode. - Added tests that use both the default provider & fips provider to test these cases. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12176)
2020-07-08Fix CID 1454808: Error handling issues NEGATIVE_RETURNS (PKCS7_dataDecode())Shane Lontis
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12379)
2020-07-08Fix CID 1454806: NEGATIVE_RETURNS (cms_enc.c)Shane Lontis
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12379)
2020-07-08Fix CID 1463883 Dereference after null check (in ess_find_cert_v2())Shane Lontis
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12379)
2020-07-08Fix CID 1465214 Resource leak (in file_load.c)Shane Lontis
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12379)
2020-07-08Fix CID #1465216 Resource leak in property_fetchShane Lontis
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12379)
2020-07-08Fix OSSL_PROVIDER_get_capabilities()Matt Caswell
It is not a failure to call OSSL_PROVIDER_get_capabilities() with a provider loaded that has no capabilities. Fixes #12286 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12292)
2020-07-06[EC][ASN1] Detect missing OID when serializing EC parameters and keysNicola Tuveri
The following built-in curves do not have an assigned OID: - Oakley-EC2N-3 - Oakley-EC2N-4 In general we shouldn't assume that an OID is always available. This commit detects such cases, raises an error and returns appropriate return values so that the condition can be detected and correctly handled by the callers, when serializing EC parameters or EC keys with the default `ec_param_enc:named_curve`. Fixes #12306 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12313)
2020-07-05ERR: special case system errorsRichard Levitte
Because system errors can be any positive number that fits in an 'int' according to POSIX, we can't reasonably expect them to be in the 1..127 range, even though that's the most usual. Instead of packing them into the OpenSSL error code structure, we recognise them as a special case and mark them as such by storing them in our error queue with the highest bit set. We make OpenSSL specific error records have their highest bit cleared, and in doing so, we shift down the library section of the code by one bit. This still leaves a very large section for the reason codes. Of course, we must adapt the error code and reason string extraction and printing functions accordingly. With this, we also thrown away the pre-loaded array of system error strings, and extract them from the system when needed instead, i.e. when we create error strings. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/12343)
2020-07-05CORE: perform post-condition in algorithm_do_this() under all circumstancesRichard Levitte
When ossl_provider_query_operation() returned NULL, the post-condition callback wasn't called, and could make algorithm_do_this() falsely tell the caller that there was an error. Because of this, a provider that answered with NULL for a particular operation identity would effectively block the same query on all following providers. Fixes #12293 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12365)
2020-07-05Fix many MarkDown issues in {NOTES*,README*,HACKING,LICENSE}.md filesDr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12109)
2020-07-05Rename NOTES*, README*, VERSION, HACKING, LICENSE to .md or .txtDr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12109)
2020-07-05coverity 1464984: Null pointer dereferencesPauli
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12309)
2020-07-05rand: avoid caching RNG parameters.Pauli
The strength and max_length DRBG parameters were being cached in the EVP_RAND layer. This commit removes the caching. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12321)
2020-07-05Refactor the EVP_RAND code to make locking issues less likelyPauli
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12321)
2020-07-05rand: fix recursive locking issue.Pauli
The calls to query the DRBG strength, state and maximum output size all used nested locks. This removes the nesting. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12321)
2020-07-03Ensure a string is properly terminated in http_client.cMatt Caswell
In HTTP_new_bio(), if the host has a trailing '/' we took a copy of the hostname but failed to terminate it properly. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12275)
2020-07-02Fix memory leaks on OSSL_SERIALIZER_CTX_new_by_EVP_PKEYNicola Tuveri
Fixes #12303 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12304)
2020-07-01X509v3_cache_extensions(): Improve coding style and doc, fix case 'sha1 == NULL'Dr. David von Oheimb
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-07-01Add X509_self_signed(), extending and improving documenation and testsDr. David von Oheimb
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-07-01Fix issue 1418 by moving check of KU_KEY_CERT_SIGN and weakening check_issued()Dr. David von Oheimb
Move check that cert signing is allowed from x509v3_cache_extensions() to where it belongs: internal_verify(), generalize it for proxy cert signing. Correct and simplify check_issued(), now checking self-issued (not: self-signed). Add test case to 25-test_verify.t that demonstrates successful fix Fixes #1418 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-07-01Optimization and safety precaution in find_issuer() of x509_vfy.c:Dr. David von Oheimb
candidate issuer cert cannot be the same as the subject cert 'x' Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-07-01Refactor (without semantic changes) crypto/x509/{v3_purp.c,x509_vfy.c}Dr. David von Oheimb
This prepares some corrections and improves readability (coding style). Among others, it adds the static function check_sig_alg_match() and the internal functions x509_likely_issued() and x509_signing_allowed(). Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-07-01Improve documentation, layout, and code comments regarding self-issued certs ↵Dr. David von Oheimb
etc. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-06-30Fix CID-1464802Shane Lontis
Improper use of negative value (It just needs to pass zero instead of -1). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12237)
2020-06-28Make the ASYNC code default libctx awareMatt Caswell
Since the default libctx is now stored in a thread local variable swapping in and out of fibres in the ASYNC code could mean that the "current" default libctx can get confused. Therefore we ensure that everytime we call async_fibre_swapcontext() we always restore the default libctx to whatever it was the last time the fibre ran. Similarly when async_fibre_swapcontext() returns we need to restore the current thread's default libctx. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12228)
2020-06-28CORE: Add an internal function to distinguish the global default contextRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12228)
2020-06-28CORE: Add OPENSSL_CTX_set0_default(), to set a default library contextRichard Levitte
Applications may want to set their own default library context, possibly per-thread. OPENSSL_CTX_set0_default() does that. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12228)
2020-06-25Update copyright yearMatt Caswell
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12273)
2020-06-24Make the naming scheme for dispatched functions more consistentDr. Matthias St. Pierre
The new naming scheme consistently usese the `OSSL_FUNC_` prefix for all functions which are dispatched between the core and providers. This change includes in particular all up- and downcalls, i.e., the dispatched functions passed from core to provider and vice versa. - OSSL_core_ -> OSSL_FUNC_core_ - OSSL_provider_ -> OSSL_FUNC_core_ For operations and their function dispatch tables, the following convention is used: Type | Name (evp_generic_fetch(3)) | ---------------------|-----------------------------------| operation | OSSL_OP_FOO | function id | OSSL_FUNC_FOO_FUNCTION_NAME | function "name" | OSSL_FUNC_foo_function_name | function typedef | OSSL_FUNC_foo_function_name_fn | function ptr getter | OSSL_FUNC_foo_function_name | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12222)
2020-06-24Rename <openssl/core_numbers.h> -> <openssl/core_dispatch.h>Dr. Matthias St. Pierre
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12222)
2020-06-24evp_rand: documentationPauli
EVP_RAND, the RNGs and provider-rand. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11682)
2020-06-24fips rand: DRBG KAT self test updates to provider model.Pauli
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11682)
2020-06-24CTR, HASH and HMAC DRBGs in providerPauli
Move the three different DRBGs to the provider. As part of the move, the DRBG specific data was pulled out of a common structure and into their own structures. Only these smaller structures are securely allocated. This saves quite a bit of secure memory: +-------------------------------+ | DRBG | Bytes | Secure | +--------------+-------+--------+ | HASH | 376 | 512 | | HMAC | 168 | 256 | | CTR | 176 | 256 | | Common (new) | 320 | 0 | | Common (old) | 592 | 1024 | +--------------+-------+--------+ Bytes is the structure size on the X86/64. Secure is the number of bytes of secure memory used (power of two allocator). Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11682)
2020-06-24rand: move drbg_{ctr,hash,hmac}.c without change to preserve historyDr. Matthias St. Pierre
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11682)
2020-06-24rand: move rand_{unix,vms,vxworks,win}.c without change to preserve historyDr. Matthias St. Pierre
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11682)
2020-06-24params: add OSSL_PARAM helpers for time_t.Pauli
POSIX mandates that time_t is a signed integer but it doesn't specify the lenght. Having wrappers lets uses ignore this. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11682)
2020-06-24CRNGT: continuous DRBG tests for providersPauli
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11682)
2020-06-24rand: set up EVP and DRBG infrastructure for RAND from providers.Pauli
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11682)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-03 15:54:29 +0000