summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2021-06-11BIO_write_ex: No error only on 0 bytes to writeTomas Mraz
Fixes #15682 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15672)
2021-06-11STORE: Make OSSL_STORE_LOADER_fetch() consistent with all other fetch functionsRichard Levitte
The argument order was different on this one. Fixes #15688 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15689)
2021-06-11dl_name_converter: Avoid unnecessary overallocationTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15680)
2021-06-11ossl_provider_set_module_path: Prevent potential UAFTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15680)
2021-06-10Fix use after free in OSSL_HTTP_REQ_CTX_set1_req()Tomas Mraz
Fixes #15647 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15648)
2021-06-10err: clear flags better when clearing errors.Pauli
An attempt to clear an error with malloced data didn't clear the flags. Now it clears all flags except the malloced flag. Fixes #12530 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15667)
2021-06-10sha: convert SHA one shot macros back to being functionsPauli
Fixes #15655 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15668)
2021-06-09DECODER & ENCODER: Add better tracingRichard Levitte
Now that we have functions to get the name and properties of the diverse implementations, we can as well display them for clarity. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-06-09DECODER: Adapt addition of extra decoder implementationsRichard Levitte
The new PKCS#8 decoder implementation decodes from DER to DER. OSSL_DECODER_CTX_add_extra() wasn't suited for this case; we had to modify it to walk through all existing decoder implementations, and filter out those that aren't suitable. This also turns out to fix the possibility to have more than one extra decoder implementation that produces the same type of encoding, for example several different wrapper formats that all decoder into DER. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-06-09Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8Richard Levitte
This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-06-09keymgmt: better detect when a key manager can be reusedPauli
Fixes #14159 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15652)
2021-06-08Simplify error reporting in X509_PUBKEY_get0()Matt Caswell
The X509_PUBKEY_get0() was attempting to recreate any errors that might have occurred from the earlier decode process when obtaining the EVP_PKEY. This is brittle at best and the approach would only work with legacy keys. We remove this and just report an error directly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Actually use a legacy route in pem_read_bio_key_legacy()Matt Caswell
The function pem_read_bio_key_legacy() is a fallback route if we failed to load a key via a provider. We should be using the legacy specific d2i functions to force legacy otherwise we end up using a provider anyway Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Only use the legacy route to decode a public key if we have toMatt Caswell
We should use a provider to decode a SubjectPublicKeyInfo structure if we can. We should only use the legacy route if we are forcing legacy, or if an ENGINE is in use. Fixes #15393 Fixes #15327 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Ensure that we consume all the data when decoding an SPKIMatt Caswell
If we are decoding a SubjectPublicKeyInfo structure then we must use all of the data and must not have bytes "left over". Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Use the right class/tag when decoding an embedded keyMatt Caswell
When a key (SubjectPublicKeyInfo) is embedded in some other structure it may use an implicit tag. However the decoders can only handle the universal class and don't know how to interpret the implicit tag. Therefore we modify the data into a form the decoders can handle. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Fix CTLOG_new_from_base64_ex()Matt Caswell
Ensure that the libctx/propq are passed to d2i_PUBKEY_ex() Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08evp: avoid some calls to EVP_CIPHER_CTX_get_iv_length() because it's been ↵Pauli
called already Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
2021-06-08evp: fix Coverity 1485670 argument cannot be negativePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
2021-06-08evp: fix Coverity 1485669 improper use of negative valuePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
2021-06-08evp: fix Coverity 1485668 argument cannot be negativePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
2021-06-08pkcs12: fix Coverity 1485667 logically dead codePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
2021-06-08evp: fix coverity 1485666 argument cannot be negativePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
2021-06-08evp: fix improper use of negative value issuesPauli
Coverity issues 1485662, 1485663 & 1485664. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
2021-06-08bio: improve error checking fixing coverity 1485659 & 1485665Pauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
2021-06-08Add aix64-gcc-as architecture and p2align callbackDaniel Bevenius
This commit adds an architecture named aix64-gcc-as which can generate assembler source code compatible with AIX assembler (as) instead of the GNU Assembler (gas). This architecture name is then used in a callback for the .p2align directive which is not available in AIX as. The motivation for this addition came out of an issue we ran into when working on upgrading OpenSSL in Node.js. We ran into the following compilation error on one of the CI machines that uses AIX: 05:39:05 Assembler: 05:39:05 crypto/bn/ppc64-mont-fixed.s: line 4: Error In Syntax This machine is using AIX Version 7.2 and does not have gas installed and the .p2align directive is causing this error. After asking around if it would be possible to install GAS on this machine I learned that AIX GNU utils are not maintained as well as the native AIX ones and we (Red Hat/IBM) have run into issues with the GNU utils in the past and if possible it would be preferable to be able to use the AIX native assembler. Refs: https://github.com/nodejs/node/pull/38512 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15638)
2021-06-08X509_digest_sig: Handle RSA-PSS and EDDSA certificatesTomas Mraz
Identify digest from sigalg params for RSA-PSS and fallback to SHA-256 for EDDSA. Fixes #15477 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15618)
2021-06-08Improve the documentation of cert path building and validationDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13735)
2021-06-08x509_vfy.c: Improve a couple of internally documenting commentsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13735)
2021-06-08x509_trs.c: rename to x509_trust.c and correct comment in trust_compat()Dr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13735)
2021-06-08BIO_write-ex(): Improve behavior in corner cases and documentationDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15608)
2021-06-08Add a gettable for provider ciphers to return the EVP_CIPH_RAND_KEY flagShane Lontis
Fixes #15531 DES and TDES set this flag which could possibly be used by applications. The gettable cipher param OSSL_CIPHER_PARAM_HAS_RAND_KEY has been added. Note that EVP_CIPHER_CTX_rand_key() uses this flag. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15606)
2021-06-07Elimination of some sources not needed in the FIPS_MODULETomas Mraz
Unfortunately in terms of fips.sources this does not mean much given the way how the .h files are added via the dependency information from the compiler. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15622)
2021-06-05property: move additional query functions to property_query.cPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15614)
2021-06-05property: improve ossl_property_find_property() functionPauli
This function searches a property list for a specific property and returns a pointer to the definition if found. The existing version was O(n) time, the improved O(log n). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15614)
2021-06-05Rename `n` field to `num_properties` in property definition structure.Pauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15614)
2021-06-05ENCODER: use property definitions instead of getting implementation parametersRichard Levitte
The OSSL_ENCODER library used to ask each encoder implementation for certain data in form of parameters to place them correctly in the encoder chain, if at all. These parameters were duplicates of properties of those same implementations, and therefore unnecessarily redundant. Now that we have functionality to query property definition values, those duplicates are no longer needed, and are therefore not looked at any more. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15570)
2021-06-05ENCODER: Drop OSSL_ENCODER_PARAM_INPUT_TYPERichard Levitte
This was a poor substitute for using the name of the decoder implementation, and since there is functionality to get the latter now, this parameter can be dropped. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15570)
2021-06-05DECODER: use property definitions instead of getting implementation parametersRichard Levitte
The OSSL_DECODER library used to ask each decoder implementation for certain data in form of parameters to place them correctly in the decoder chain, if at all. These parameters were duplicates of properties of those same implementations, and therefore unnecessarily redundant. Now that we have functionality to query property definition values, those duplicates are no longer needed, and are therefore not looked at any more. This adds the "global" error reason ERR_R_INVALID_PROPERTY_DEFINITION, which can be re-used elsewhere. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15570)
2021-06-05property: Add functionality to query data from a property definitionRichard Levitte
This required making some OSSL_PROPERTY types a little less private. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15570)
2021-06-05FIPS: don't include crypto/passphrase.c in libfips.aRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15615)
2021-06-05Ensure libctx/propq is propagated when handling X509_REQMatt Caswell
When we create via d2i or dup an X509_REQ we should ensure that the libctx is properly propagated. We also ensure we create X509_REQ objects with the proper libctx assigned in the CMP tests. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15591)
2021-06-05Give ASN.1 objects the ability to report their libctx/propqMatt Caswell
Some ASN.1 objects have an embedded libctx/propq. If they have one we give the ASN.1 code the ability to find these values and use them where needed. This is used for OSSL_CMP_MSG_dup() and X509_dup(). Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15591)
2021-06-05Make sure X509_dup() also dup's any associated EVP_PKEYMatt Caswell
Otherwise we can end up with a blank EVP_PKEY. If it is later recreated it can end up with the wrong libctx/propq. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15591)
2021-06-05Use the new ASN.1 libctx aware capabilities in CMPMatt Caswell
Make sure we pass the libctx/propq around everywhere that we need it to ensure we get provider keys when needed. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15591)
2021-06-05Use the new ASN.1 libctx aware functions in CMSMatt Caswell
Make sure we pass the libctx around when working with CMS structures Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15591)
2021-06-05Teach more of the ASN.1 code about libctx/propqMatt Caswell
Make sure we pass libctx/propq down to all the layers so that objects that are created during parsing have the right values. Then use this new capability for PKCS7. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15591)
2021-06-05Teach the ASN.1 code how to create embedded objects with libctx/propqMatt Caswell
An ASN.1 object such as an X509 may have embedded objects in it such as an X509_PUBKEY. If there is a libctx/propq in use then we need to make sure we pass these down to the constructors of these embedded objects. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15591)
2021-06-05Provide the ability to create an X509_PUBKEY with a libctx/propqMatt Caswell
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15591)
2021-06-04Check that we got the expected name type when verifying name constraintsMatt Caswell
If a SAN field contains an SmtpUTF8Mailbox name then it is expected to have a UTF8String type. We should verify that it really does before we attempt to use the value in it. Reported by Corey Bonnell Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15611)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-09 05:55:10 +0000