summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2021-06-16DSO: Fix the VMS DSO name converter to actually do somethingRichard Levitte
This function has never before actually done its work. This wasn't discovered before, because its output wasn't important before the FIPS provider self test started using its value. This function is now made to insert the VMS DSO extension (".EXE") at the end of the filename, being careful to make sure what can be a typical VMS generation number (separated from the file name with a ';') remains at the end. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15765)
2021-06-16HTTP client: fix use of OSSL_HTTP_adapt_proxy(), which is needed also in cmp.cDr. David von Oheimb
For this reason, export this function, which allows removing http_local.h Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15764)
2021-06-16X509_digest_sig(): Improve default hash for EdDSA and allow to return the ↵Dr. David von Oheimb
chosen default Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15762)
2021-06-16CORE: Do a bit of cleanup of core fetchingRichard Levitte
Some data, like the library context, were passed both through higher level callback structures and through arguments to those same higher level callbacks. This is a bit unnecessary, so we rearrange the callback arguments to simply pass that callback structure and rely on the higher level fetching functionality to pick out what data they need from that structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15750)
2021-06-16Fix DH private key check.Shane Lontis
A recent addition removed setting the dh private key length when a safe prime group is used. The private key validation check was relying on this being set for safe primes. Setting the upper bound no longer checks the length if the value is zero. This caused a failure in the daily build of acvp_tests. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15760)
2021-06-16Clean up the encoder/decoder/loader stores before providersMatt Caswell
We already had the evp method store being cleaned up before the provider store was. This prevents issues where the method clean up functions cause providers to clean up, which then needs access to the provider store. We extend the same thinking to the encoder/decoder/loader stores. Fixes #15727 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15741)
2021-06-16Include a local static buffer for the SHA helper functionsPauli
This functionality existed in 1.1.1 but was lost. Fixes #15718 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15752)
2021-06-16Add various OBJ functions as callbacksMatt Caswell
This enables providers to register new OIDs in the same libcrypto instance as is used by the application. Fixes #15624 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15681)
2021-06-15Refactor OSSL_STORE_LOADER_do_all_provided() to behave like ↵Richard Levitte
OSSL_STORE_LOADER_fetch() This is refactored to use inner_loader_fetch() without any given name, which is just there to ensure all decoder implementations are made into methods, and then use ossl_method_store_do_all() to list them all. This also adds the internal ossl_store_loader_do_all_prefetched(), which can be used if pre-fetching needs to be done separately from listing all the decoder implementations, or if listing may happen multiple times. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
2021-06-15DECODER & ENCODER: Add better tracingRichard Levitte
Now that we have functions to get the name and properties of the diverse implementations, we can as well display them for clarity. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
2021-06-15Adapt all public EVP_XXX_do_all_provided() for the changed evp_generic_do_all()Richard Levitte
Fixes #15538 Fixes #14837 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
2021-06-15Refactor evp_generic_do_all() to behave like evp_generic_fetch()Richard Levitte
This is refactored to use inner_evp_generic_fetch() without any given name, which is just there to ensure all decoder implementations are made into methods, and then use ossl_method_store_do_all() to list them all. This also adds the internal evp_generic_do_all_prefetched(), which can be used if pre-fetching needs to be done separately from listing all the decoder implementations, or if listing may happen multiple times. Fixes #15538 Fixes #14837 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
2021-06-15Refactor OSSL_ENCODER_do_all_provided() to behave like OSSL_ENCODER_fetch()Richard Levitte
This is refactored to use inner_ossl_encoder_fetch() without any given name, which is just there to ensure all encoder implementations are made into methods, and then use ossl_method_store_do_all() to list them all. This also adds the internal ossl_encoder_do_all_prefetched(), which can be used if pre-fetching needs to be done separately from listing all the encoder implementations, or if listing may happen multiple times. Fixes #15538 Fixes #14837 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
2021-06-15Refactor OSSL_DECODER_do_all_provided() to behave like OSSL_DECODER_fetch()Richard Levitte
This is refactored to use inner_ossl_decoder_fetch() without any given name, which is just there to ensure all decoder implementations are made into methods, and then use ossl_method_store_do_all() to list them all. This also adds the internal ossl_decoder_do_all_prefetched(), which can be used if pre-fetching needs to be done separately from listing all the decoder implementations, or if listing may happen multiple times. Fixes #15538 Fixes #14837 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
2021-06-15Add the internal function ossl_method_store_do_all()Richard Levitte
It will simply call the given callback for every method found in the given store. Fixes #15538 Fixes #14837 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
2021-06-15CORE: Move away the allocation of the temporary no_cache method storeRichard Levitte
The responsibility for managing the temporary store for methods from algorithm implementations flaged "no_store" is moved up to the diverse method fetching functions. This allows them to allocate it "just in time", or in other words not at all if there is not such algorithm implementation. This makes this temporary store more flexible if it's needed outside of the core fetching functionality, and slightly faster when this temporary store isn't necessary at all. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15737)
2021-06-15ASN1_parse_dump(): allow NULL BIO input, to simplify applications not ↵Dr. David von Oheimb
needing output Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
2021-06-15BIO_write_ex(): Make handing of BIO b == NULL and dlen == 0 less redundantDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
2021-06-15BIO: Make source file names in crypto/bio/ consistentDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
2021-06-15BIO_dum_indent_cb(): Fix handling of cb return valueDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
2021-06-15BIO: prevent crash on NULL BIO for prefix_ctrl() and thus for ↵Dr. David von Oheimb
BIO_set_prefix(), BIO_set_indent(), etc. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
2021-06-15ASN1: rename asn1_par.c to asn1_parse.c for clarity; simplify asn1_parse2()Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
2021-06-15Use getauxval on Android with API level > 18Lars Immisch
We received analytics that devices of the device family Oppo A37x are crashing with SIGILL when trying to load libcrypto.so. These crashes were fixed by using the system-supplied getauxval function. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11257)
2021-06-15remove end of line whitespacePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
2021-06-15cms: free PKEY_CTXPauli
Preventing a memory leak. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15731)
2021-06-15cms: fix coverity 1485981: unchecked return valuePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15731)
2021-06-15Add missing NULL check in OSSL_DECODER_from_bio().Shane Lontis
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15733)
2021-06-14Avoid excessive OSSL_DECODER_do_all_provided callsMatt Caswell
OSSL_DECODER_CTX_add_extra was calling OSSL_DECODER_do_all_provided in a loop which was resulting in a large number of calls. Since OSSL_DECODER_do_all_provided is quite "heavy" this was causing performance issues. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15716)
2021-06-14Add a generic SubjectPublicKeyInfo decoderMatt Caswell
Previously all the SubjectPublicKeyInfo decoders were specific to a key type. We would iterate over all them until a match was found for the correct key type. Each one would fully decode the key before then testing whether it was a match or not - throwing it away if not. This was very inefficient. Instead we introduce a generic SubjectPublicKeyInfo decoder which figures out what type of key is contained within it, before subsequently passing on the data to a key type specific SubjectPublicKeyInfo decoder. Fixes #15646 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15662)
2021-06-14Fix DH/DHX named groups to not overwrite the private key length.Shane Lontis
The only reason(s) the DH private key length should be set are: (1) The user sets it during key generation via EVP_PKEY_CTX_set_params using OSSL_PKEY_PARAM_DH_PRIV_LEN. (2) When loading a PKCS3 (DH) key the optional value 'privateValueLength' is set. Now that the named groups contain a value for 'q' there is no reason to automatically overwrite the private key length. Issue detected by @davidmakepeace Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15695)
2021-06-13Add AES consttime code for no-asm configurationsBernd Edlinger
This adds optional constant time support for AES when building openssl for no-asm. Enable with: ./config no-asm -DOPENSSL_AES_CONST_TIME Disable with: ./config no-asm -DOPENSSL_NO_AES_CONST_TIME This is by default enabled. [extended tests] Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10828)
2021-06-12d2i_X509: revert calling X509v3_cache_extensions()Dr. David von Oheimb
Fixes #13754 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15705)
2021-06-11Rename OSSL_HTTP_set_request() to OSSL_HTTP_set1_request() for clarityDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15697)
2021-06-11HTTP client: Fix GET request handling when rctx is reused (keep-alive)Dr. David von Oheimb
This also updates the documentation of OSSL_HTTP_REQ_CTX_set1_req(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15697)
2021-06-11Add support for ISO 8601 datetime formatWilliam Edmisten
Fixes #5430 Added the configuration file option "date_opt" to the openssl applications ca, crl and x509. Added ASN1_TIME_print_ex which supports the new datetime format using the flag ASN1_DTFLGS_ISO8601 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14384)
2021-06-11BIO_write_ex: No error only on 0 bytes to writeTomas Mraz
Fixes #15682 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15672)
2021-06-11STORE: Make OSSL_STORE_LOADER_fetch() consistent with all other fetch functionsRichard Levitte
The argument order was different on this one. Fixes #15688 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15689)
2021-06-11dl_name_converter: Avoid unnecessary overallocationTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15680)
2021-06-11ossl_provider_set_module_path: Prevent potential UAFTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15680)
2021-06-10Fix use after free in OSSL_HTTP_REQ_CTX_set1_req()Tomas Mraz
Fixes #15647 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15648)
2021-06-10err: clear flags better when clearing errors.Pauli
An attempt to clear an error with malloced data didn't clear the flags. Now it clears all flags except the malloced flag. Fixes #12530 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15667)
2021-06-10sha: convert SHA one shot macros back to being functionsPauli
Fixes #15655 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15668)
2021-06-09DECODER & ENCODER: Add better tracingRichard Levitte
Now that we have functions to get the name and properties of the diverse implementations, we can as well display them for clarity. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-06-09DECODER: Adapt addition of extra decoder implementationsRichard Levitte
The new PKCS#8 decoder implementation decodes from DER to DER. OSSL_DECODER_CTX_add_extra() wasn't suited for this case; we had to modify it to walk through all existing decoder implementations, and filter out those that aren't suitable. This also turns out to fix the possibility to have more than one extra decoder implementation that produces the same type of encoding, for example several different wrapper formats that all decoder into DER. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-06-09Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8Richard Levitte
This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-06-09keymgmt: better detect when a key manager can be reusedPauli
Fixes #14159 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15652)
2021-06-08Simplify error reporting in X509_PUBKEY_get0()Matt Caswell
The X509_PUBKEY_get0() was attempting to recreate any errors that might have occurred from the earlier decode process when obtaining the EVP_PKEY. This is brittle at best and the approach would only work with legacy keys. We remove this and just report an error directly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Actually use a legacy route in pem_read_bio_key_legacy()Matt Caswell
The function pem_read_bio_key_legacy() is a fallback route if we failed to load a key via a provider. We should be using the legacy specific d2i functions to force legacy otherwise we end up using a provider anyway Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Only use the legacy route to decode a public key if we have toMatt Caswell
We should use a provider to decode a SubjectPublicKeyInfo structure if we can. We should only use the legacy route if we are forcing legacy, or if an ENGINE is in use. Fixes #15393 Fixes #15327 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Ensure that we consume all the data when decoding an SPKIMatt Caswell
If we are decoding a SubjectPublicKeyInfo structure then we must use all of the data and must not have bytes "left over". Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-14 13:37:08 +0000