summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2021-02-12Add OID for draft-ietf-opsawg-finding-geofeeds detached CMS signatureJob Snijders
RFC 8805 Geofeed files can be authenticated with RPKI CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14050)
2021-02-12EVP: fix reference counting for EVP_CIPHER.Pauli
Under some circumstances, the reference count for a cipher wasn't updated properly. This shows up best when fetches are not being queried but would be possible if the cache flushed at a bad time. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14126)
2021-02-12Prov: add an option to force provider fetches to not be cached.Pauli
If the macro OSSL_FORCE_NO_CACHE_FETCH is defined, no provider will have its fetches cached. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14126)
2021-02-12EVP: fix reference counting for digest operations.Pauli
The reference count wasn't being incremented but the EVP_MD pointer was being held. In a no cache build, this resulted in a failure on update in some circumstances. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14126)
2021-02-11X509_STORE_CTX_cleanup(): Use internally so no need to call explicitlyDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14088)
2021-02-11X509_STORE_CTX_get1_issuer(): Make preference on expired certs consistent ↵Dr. David von Oheimb
with find_issuer() Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14130)
2021-02-11x509_vfy.c: Make chain_build() error diagnostics to the pointDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14094)
2021-02-11Rename internal providercommonerr.h to less mouthful proverr.hTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14086)
2021-02-11Various cleanup of PROV_R_ reason codesTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14086)
2021-02-11Move the PROV_R reason codes to a public headerTomas Mraz
The PROV_R codes can be returned to applications so it is useful to have some common set of provider reason codes for the applications or third party providers. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14086)
2021-02-10include/openssl: add a few missing #pragma once directivesFdaSilvaYY
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/14096)
2021-02-10Replace provider digest flags with separate param fieldsShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13830)
2021-02-10Replace provider cipher flags with separate param fieldsShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13830)
2021-02-09x509_vfy.c: Sort out return values 0 vs. -1 (failure/internal error)Dr. David von Oheimb
Also simplify first part of verify_chain() Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14095)
2021-02-09X509_get_pubkey_parameters(): Correct failure behavior and its useDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14095)
2021-02-09x509_vfy.c: Fix various coding style and documentation style nitsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14127)
2021-02-09Deprecate BN_pseudo_rand() and BN_pseudo_rand_range()Tomas Mraz
The functions are obsolete aliases for BN_rand() and BN_rand_range() since 1.1.0. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14080)
2021-02-09Enhanced integer parsing in OSSL_PARAM_allocate_from_textPetr Gotthard
Fixes #14041 and additional bugs discovered by the newly created tests. This patch: - Introduces support for 0x prefixed integers - Fixes parsing of negative integers (negative numbers were shifted by -2) - Fixes ability to parse maximal unsigned numbers ("too small buffer" error used to be reported incorrectly) - Fixes a memory leak when OSSL_PARAM_allocate_from_text fails leaving a temporary BN allocated Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14093)
2021-02-08Simplify the EVP_PKEY_XXX_fromdata_XX methods.Shane Lontis
The existing names such as EVP_PKEY_param_fromdata_settable were a bit confusing since the 'param' referred to key params not OSSL_PARAM. To simplify the interface a 'selection' parameter will be passed instead. The changes are: (1) EVP_PKEY_fromdata_init() replaces both EVP_PKEY_key_fromdata_init() and EVP_PKEY_param_fromdata_init(). (2) EVP_PKEY_fromdata() has an additional selection parameter. (3) EVP_PKEY_fromdata_settable() replaces EVP_PKEY_key_fromdata_settable() and EVP_PKEY_param_fromdata_settable(). EVP_PKEY_fromdata_settable() also uses a selection parameter. Fixes #12989 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14076)
2021-02-07Fix race condition & allow operation cache to grow.Pauli
This fixes a race condition where the index to the cache location was found under a read lock and a later write lock set the cache entry. The issue being that two threads could get the same location index and then fight each other over writing the cache entry. The most likely outcome is a memory leak, however it would be possible to set up an invalid cache entry. The operation cache was a fixed sized array, once full an assertion failed. The other fix here is to convert this to a stack. The code is simplified and it avoids a cache overflow condition. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14062)
2021-02-06Add X509_STORE_CTX_verify(), which takes the first untrusted cert as default ↵Dr. David von Oheimb
target Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14021)
2021-02-05Remove OPENSSL_NO_EC guards from libsslMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05Make supported_groups code independent of EC and DHMatt Caswell
The supported groups code was checking the OPENSSL_NO_EC and OPENSSL_NO_DH guards in order to work, and the list of default groups was based on those guards. However we now need it to work even in a no-ec and no-dh build, because new groups might be added from providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05EVP: use evp_pkey_copy_downgraded() in EVP_PKEY_copy_parameters()Richard Levitte
We used evp_pkey_downgrade() on 'from', which permanently converts 'from' to have a legacy internal key. Now that we have evp_pkey_copy_downgraded(), it's better to use that (and thereby restore the constness contract). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13341)
2021-02-05ERR: Rebuild all generated error headers and source filesRichard Levitte
This is the result of 'make errors ERROR_REBUILD=-rebuild' Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13392)
2021-02-05RSA: properly generate algorithm identifier for RSA-PSS signaturesTomas Mraz
Fixes #13969 - properly handle the mandatory RSA-PSS key parameters - improve parameter checking when setting the parameters - compute the algorithm id at the time it is requested so it reflects the actual parameters set - when generating keys do not override previously set parameters with defaults - tests added to the test_req recipe that should cover the PSS signature handling Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13988)
2021-02-05Don't make pthreads mutexes recursive.Rich Salz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13924)
2021-02-05EVP: Adapt EVP_PKEY_{set1,get1}_encoded_public_key()Richard Levitte
These functions are modified to use EVP_PKEY_set_octet_string_param() and EVP_PKEY_get_octet_string_param() instead of evp_keymgmt_set_params() and evp_keymgmt_get_params(). To accomplish this fully, EVP_PKEY_get_octet_string_param() is changed slightly to populate |*out_sz| with the return size, even if getting the params resulted in an error. We also modify EVP_PKEY_get_utf8_string_param() to match EVP_PKEY_get_octet_string_param() Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05EVP: Modify the checks in EVP_PKEY_{set,get}_xxx_param() functionsRichard Levitte
The checks of the type of EVP_PKEY were from before we had the macro evp_pkey_is_provided(). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05EVP: Adapt the other EVP_PKEY_set_xxx_param() functionsRichard Levitte
They were calling evp_keymgmt_set_params() directly. Those calls are changed to go through EVP_PKEY_set_params(). We take the opportunity to constify these functions. They have to unconstify internally for the compiler to stop complaining when placing those pointers in an OSSL_PARAM element, but that's still better than forcing the callers to do that cast. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05EVP: Make EVP_PKEY_set_params() increment the dirty countRichard Levitte
When the internal key is changed, we must count it as muted, so that next time the affected key is considered for an operation, it gets re-exported to the signing provider. In other words, this will clear the EVP_PKEY export cache when the next export attempt occurs. This also updates evp_keymgmt_util_export_to_provider() to actually look at the dirty count for provider native origin keys, and act appropriately. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-04x509_vfy.c: Improve coding style and comments all over the fileDr. David von Oheimb
No changes in semantics. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13070)
2021-02-04Allow NULL arg to OPENSSL_sk_{dup,deep_copy} returning empty stackDr. David von Oheimb
This simplifies many usages Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14040)
2021-02-04Fix a use after free issue when a provider context is being used and isn't ↵Pauli
cached Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14053)
2021-02-03EC: Reverse the default asn1_flag in a new EC_GROUPRichard Levitte
The default was OPENSSL_EC_NAMED_CURVE, but that's not true until a curve name has been set, so we change the initial value to OPENSSL_EC_EXPLICIT_CURVE and let EC_GROUP_set_curve_name() change it to OPENSSL_EC_NAMED_CURVE. Submitted by Matt Caswell Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13973)
2021-02-03EVP: Fix evp_pkey_ctx_store_cached_data() to handle provider backed EVP_PKEY_CTXRichard Levitte
It assumed there would always be a non-NULL ctx->pmeth, leading to a crash when that isn't the case. Since it needs to check 'keytype' when that one isn't -1, we also add a corresponding check for the provider backed EVP_PKEY_CTX case. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13973)
2021-02-03EVP: Don't find standard EVP_PKEY_METHODs automaticallyRichard Levitte
EVP_PKEY_meth_find() got called automatically any time a new EVP_PKEY_CTX allocator was called with some sort of key type data. Since we have now moved all our standard algorithms to our providers, this is no longer necessary. We do retain looking up EVP_PKEY_METHODs that are added by the calling application. Fixes #11424 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13973)
2021-02-02dh_cms_set_peerkey: Pad the public key to p sizeTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13958)
2021-02-02Ensure the EVP_PKEY operation_cache is appropriately lockedMatt Caswell
The EVP_PKEY operation_cache caches references to provider side key objects that have previously been exported for this EVP_PKEY, and their associated key managers. The cache may be updated from time to time as the EVP_PKEY is exported to more providers. Since an EVP_PKEY may be shared by multiple threads simultaneously we must be careful to ensure the cache updates are locked. Fixes #13818 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13987)
2021-02-02Always ensure we hold ctx->lock when calling CRYPTO_get_ex_data()Matt Caswell
Otherwise we can get data races. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13987)
2021-02-02Refactor RAND_get0_primary() lockingMatt Caswell
Make sure we never read or write to dgbl->primary outside of a lock. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13987)
2021-02-02Deprecate X509_certificate_typeRich Salz
Fixes: #13997 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14002)
2021-02-02Add some PKIX-RPKI objectsJob Snijders
References: RFC6482 - A Profile for Route Origin Authorizations (ROAs) RFC6484 - Certificate Policy (CP) for the RPKI RFC6493 - The RPKI Ghostbusters Record RFC8182 - The RPKI Repository Delta Protocol (RRDP) RFC8360 - RPKI Validation Reconsidered draft-ietf-sidrops-rpki-rta - A profile for RTAs CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13948)
2021-02-02Constify OSSL_HTTP_REQ_CTX_get0_mem_bio()Dr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13960)
2021-02-02HTTP: add more error detection to low-level APIDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13960)
2021-02-02HTTP: Fix mistakes and unclarities on maxline and max_resp_len paramsDr. David von Oheimb
Also rename internal structure fields iobuf(len) to readbuf(len) for clarity Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13960)
2021-02-02OSSL_HTTP_REQ_CTX_nbio(): Revert to having state var that keeps req len ↵Dr. David von Oheimb
still to send Otherwise, sending goes wrong in case BIO_write(rctx->wbio, ...) is incomplete at first. Fixes #13938 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13960)
2021-01-28EVP: fix keygen for EVP_PKEY_RSA_PSSDaniel Bevenius
This commit attempts to fix the an issue when generating a key of type EVP_PKEY_RSA_PSS. Currently, EVP_PKEY_CTX_set_rsa_keygen_bits will return -1 if the key id is not of type EVP_PKEY_RSA. This commit adds EVP_PKEY_RSA_PSS to also be accepted. The macro EVP_PKEY_CTX_set_rsa_pss_keygen_md si converted into a function and it is now called in legacy_ctrl_to_param. Fixes #12384 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13099)
2021-01-28check_sig_alg_match(): weaken sig nid comparison to allow RSA{,PSS} key ↵Dr. David von Oheimb
verify RSA-PSS This is an upstream fix for #13931 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13968)
2021-01-28Fix rsa_pss_asn1_meth to refert to rsa_sig_info_setDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13968)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-22 19:46:15 +0000