summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2021-04-12Add OSSL_PARAM_dup() and OSSL_PARAM_merge().Shane Lontis
These functions are prerequisites for implementing EVP_PKEY_todata(). OSSL_PARAM_dup() is required to make a deep copy of the exported params (since the provider export() uses a OSSL_PARAM_BLD which throws away the data after the call), and then use OSSL_PARAM_merge() to add some additional params that can be passed to the EVP_PKEY_todata(). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14785)
2021-04-12Add additional KMAC errorPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14810)
2021-04-09Inherit hostflags verify params even without hostsChristian Heimes
X509_VERIFY_PARAM_inherit() now copies hostflags independently of hosts. Previously hostflags were only copied when at least one host was set. Typically applications don't configure hosts on SSL_CTX. The change enables applications to configure hostflags on SSL_CTX and have OpenSSL copy the flags from SSL_CTX to SSL. Fixes: https://github.com/openssl/openssl/issues/14579 Signed-off-by: Christian Heimes <christian@python.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14743)
2021-04-08d2i_PrivateKey_decoder(): Fix premature exit on unsuccessful ↵Dr. David von Oheimb
OSSL_DECODER_CTX_new_for_pkey() Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14647)
2021-04-08PEM_X509_INFO_read_bio_ex(): Generalize to allow parsing any type of private keyDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14647)
2021-04-08d2i_PrivateKey{,_ex}() and PEM_X509_INFO_read_bio_ex(): Fix handling of ↵Dr. David von Oheimb
RSA/DSA/EC private key This is needed to correct d2i_PrivateKey() after it was changed by commit 576892d78f80cf9a. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14647)
2021-04-08Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14801)
2021-04-08curve448: Integrate 64-bit reference implementationAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Use constant time zero check functionAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Remove the unrolled loop versionAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Use NLIMBS where appropriate to simplify the codeAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Modernise reference 64-bit codeAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Rename arch_ref64 to arch_64Amitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08Partially Revert "Remove curve448 architecture specific files"Amitay Isaacs
This reverts commit 7e492f3372ed83af074a63d5920f13de7e3455b6. This brings back the 64-bit reference implementation for curve448. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Use relative includes to avoid explicit dependenciesAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08Use numbers definition of int128_t and uint128_tAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08param_build: check for the usage of secure memory better.Pauli
The param build now checks the string types and locates them in secure memory if the original string is. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14782)
2021-04-08property: lock the lib ctx when updating the property definition cachePauli
Although the store being used is adequately and properly locked, the library context is not. Due to the mechanisms used for fetching, it is possible for multiple stores to live within the same library context for short periods. This fix prevents threading issues resulting from such coincidences. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14773)
2021-04-08property: check return values from the property locking calls.Pauli
A failure to obtain a lock would have resulted in much badness, now it results in a failure return. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14773)
2021-04-08Fix more certificate related lib_ctx settings.Shane Lontis
Fixes #13732 Fix a few places that were not using the '_ex' variants of ASN1_item_sign/verify. Added X509_CRL_new_ex(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14752)
2021-04-08dh: fix coverity 1473238: argument cannot be negativePauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14620)
2021-04-08evp: fix coverity 1473631: argument cannot be negativePauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14620)
2021-04-08evp: fix coverity 1451509: argument cannot be negativePauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14620)
2021-04-08evp: fix coverity 1451510: argument cannot be negativePauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14620)
2021-04-08evp: fix coverity 1472682: argument cannot be negativePauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14620)
2021-04-07Disallow ASN.1 enumerated types to be treated as strings.Pauli
They are actually integers. Problem reported by: Scott McPeak <scott.g.mcpeak@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14774)
2021-04-07Remove locking in CRYPTO_secure_allocated()Pauli
The check for being in secure memory is against the arena. The arena is only ever modified by sh_init() and sh_done() and in both cases, it is done without locking. Thus, it is safe for the CRYPTO_secure_allocated() to not lock. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14775)
2021-04-07Make the lock in CRYPTO_secure_allocated() a read lockPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14775)
2021-04-07Fix typo in store_meth.cNan Xiao
CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14776)
2021-04-07Adds a new lock to read default_path and uses a strdup() on default_path ↵Sahana Prasad
before using it Fixes #14483 Signed-off-by: Sahana Prasad <sahana@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14650)
2021-04-07Ensure that the negative flag is correct set for ASN1 integer types.Pauli
Reported by: Scott McPeak <scott.g.mcpeak@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14768)
2021-04-07Check for integer overflow in i2a_ASN1_OBJECT and error out if found.Pauli
Problem reported by Scott McPeak <scott.g.mcpeak@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14768)
2021-04-06Deprecate the EVP_PKEY controls for CMS and PKCS#7Tomas Mraz
Improve the ossl_rsa_check_key() to prevent non-signature operations with PSS keys. Do not invoke the EVP_PKEY controls for CMS and PKCS#7 anymore as they are not needed anymore and deprecate them. Fixes #14276 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14760)
2021-04-02Include BN assembler alongside CPUID codeRichard Levitte
It turns out that some CPUID code requires the presence of some BN assembler code, so we make sure it's included in the same manner as the CPUID code itself. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14755)
2021-04-02Refactor CPUID codeRichard Levitte
We were using CPUID coded in several modules, but it was unclear how it actually got there, and could fail randomly. To remedy that, this change separates the CPUID C code from the rest of cryptlib.c, and ensures the right modules get both that and the assembler sources explicitly. Fixes #11281 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14755)
2021-04-02EVP: Add EVP_<TYPE>_description()Richard Levitte
The following operation types are covered: EVP_MD, EVP_CIPHER, EVP_MAC, EVP_RAND, EVP_KEYMGMT, EVP_SIGNATURE, EVP_ASYM_CIPHER, EVP_KEM, EVP_KEYEXCH, EVP_KDF. Also EVP_PKEY. For EVP_MD and EVP_CIPHER, OBJ_nid2ln() is used as a fallback for legacy implementations. For EVP_PKEY, the info field of the EVP_PKEY_ASN1_METHOD is used as a fallback for legacy implementations. Fixes #14514 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14656)
2021-04-02Add OSSL_STORE_LOADER_description()Richard Levitte
Fixes #14514 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14656)
2021-04-02Add OSSL_DECODER_description() and OSSL_ENCODER_description()Richard Levitte
Fixes #14514 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14656)
2021-04-02CORE: Add an algorithm_description field to OSSL_ALGORITHMRichard Levitte
This corresponds to the |info| field in EVP_PKEY_ASN1_METHOD, as well as the generic use of OBJ_nid2ln() as a one line description. We also add the base functionality to make use of this field. Fixes #14514 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14656)
2021-04-01Corrected missing definitions from NonStop SPT build.Randall S. Becker
This change includes swapping the PUT and SPT configuration, includes of sys/stat.h and sys/types.h in the correct scope to be picked up by SPT definitions. Fixes: #14698 Fixes: #14734 CLA: The author has the permission to grant the OpenSSL Team the right to use this change. Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14736)
2021-04-01DSA_generate_parameters_ex: use the old method for all small keysTomas Mraz
Fixes #14733 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14744)
2021-04-01Add "save-parameters" encoder parameterTomas Mraz
The parameter makes the dsa key encoder to skip saving the DSA key parameters similarly to what the legacy dsa key encoder did. Fixes #14362 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14746)
2021-04-01Avoid going through NID when unnecessaryTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14703)
2021-04-01EVP_CIPHER_type: fix misleading argument nameTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14703)
2021-04-01Drop TODO 3.0 as we cannot get rid of legacy nids in 3.0Tomas Mraz
Fixes #14393 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14703)
2021-04-01EVP_PKEY_CTRL_CIPHER can be used with encrypt/decrypt with GOSTTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14703)
2021-04-01Add a range check (from SP800-56Ar3) to DH key derivation.Shane Lontis
Fixes #14401 Note that this moves the public key check out of DH compute_key() since key validation does not belong inside this primitive.. The check has been moved to the EVP_PKEY_derive_set_peer() function so that it generally applies to all exchange operations.. Use EVP_PKEY_derive_set_peer_ex() to disable this behaviour. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14717)
2021-03-31OSSL_HTTP_REQ_CTX_transfer(): improve distinction of send error vs. receive ↵Dr. David von Oheimb
error Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14630)
2021-03-31OSSL_parse_url(): Improve handling of IPv6 addressesDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14630)
2021-03-31http_client.c: Prevent spurious error queue entry on NULL mem argumentDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14630)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-03 00:43:17 +0000