summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2020-04-18Prevent crash in X509_NAME_cmp() etc. when cert has no issuer or no serialNumberDr. David von Oheimb
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386)
2020-04-18Add CMP error reason 'missing reference cert'Dr. David von Oheimb
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386)
2020-04-18Add CMP fuzzing to fuzz/cmp.c, including a couple of helpers in crypto/cmp/Dr. David von Oheimb
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386)
2020-04-18Rename CMP_PROTECTEDPART to OSSL_CMP_PROTECTEDPART for consistencyDr. David von Oheimb
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386)
2020-04-17GOST cipher names adjustmentDmitry Belyavskiy
The erroneously introduced names grasshopper-* replaced with kuznyechik-* according to official algorithm name translation. Too long symbolic names replaced with human-enterable ones. Also the mechanism of deprecating names in objects.txt is implemented Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11440)
2020-04-17When calling the import_to function pass the libctx tooMatt Caswell
Previously import_to just took an EVP_PKEY as the argument. However we need to some additional context data as well - specifically the libctx. Therefore we pass an EVP_PKEY_CTX instead to hold the combination of both of these things. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11536)
2020-04-17Windows: Add type casting in CRYPTO_atomic_add to remove warningKochise
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11337)
2020-04-17pkey: free key manager on error pathPauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11371)
2020-04-17ecx: check for errors creating public keys from private ones.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11371)
2020-04-17s390: ECX key generation fixes.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11371)
2020-04-17ecx: add key generation support.Pauli
Specifically for x25519, x448, ed25519 and ed448. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11371)
2020-04-17EVP: Fix calls to evp_pkey_export_to_provider()Richard Levitte
The calls weren't quite right, as this function has changed its behaviour. We also change the internal documentation of this function, and document evp_pkey_downgrade(). Fixes #11549 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11550)
2020-04-16Introduce an internal version of X509_check_issued()Matt Caswell
The internal version is library context aware. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11507)
2020-04-16Create a libctx aware X509_verify_ex()Matt Caswell
This is the same as X509_verify() except that it takes a libctx and propq parameter and signature verification is done using those. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11507)
2020-04-16Put sys-specific files in build.infoRich Salz
Don't wrap whole files in if[n]def, test in build.info if they should be compiled. rand_win isn't done as there are multiple ways to say "this is windows." Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11263)
2020-04-16Use build.info, not ifdef for crypto modulesRich Salz
Don't wrap conditionally-compiled files in global ifndef tests. Instead, test if the feature is disabled and, if so, do not compile it. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11263)
2020-04-16Add DH keygen to providersShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11332)
2020-04-15Add DSA keygen to providerShane Lontis
Moved some shared FFC code into the FFC files. Added extra paramgen parameters for seed, gindex. Fixed bug in ossl_prov util to print bignums. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11303)
2020-04-15Teach PEM_read_bio_PrivateKey about libctxMatt Caswell
Now that d2i_PrivateKey_ex() and other similar functions exist we should use it when loading a PEM PrivateKey. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11494)
2020-04-15Teach the OSSL_STORE code about libctxMatt Caswell
We restrict this to just the PrivateKey loading code at the moment. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11494)
2020-04-15Use the libctx in Ed448 private key decodingMatt Caswell
The Ed448 private key deconding needs to use a library ctx. So we implement a priv_decode_with_libctx function for it. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11494)
2020-04-15Teach d2i_PrivateKey et al about libctxMatt Caswell
The Ed448 private key decoding makes algorithm fetches. Therefore we teach d2i_PrivateKey et al about libctx and make sure it is passed through the layers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11494)
2020-04-15EVP: fix memleak in evp_pkey_downgrade()Richard Levitte
The EVP_KEYMGMT pointer in the pkey is removed when downgrading, but wasn't necessarily freed when need, thus leaving an incorrect reference count. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11328)
2020-04-15EVP: Add a temporary SM2 hack to key generationRichard Levitte
The reason to do this is many-fold. We need EC key generation for other work. However, SM2 are currently closely related to EC keys with legacy methods, but not with provider methods. To avoid having to wait on provider support for SM2, we temporarly do an extra check for what the legacy methods identify as SM2 keys (either the EVP_PKEY_SM2 pkey id was used, or the SM2 curve), and redirect to legacy code in one case, and in the other case, we forcedly downgrade provider side EC keys with SM2 curves to legacy SM2 keys, using available tools. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11328)
2020-04-15EC: Refactor EVP_PKEY_CTX curve setting macros for param generationRichard Levitte
The macros are converted to functions, and are modified to support provider implementations. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11328)
2020-04-15PROV: Implement EC param / key generationRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11328)
2020-04-15KEYMGMT: Add functions to get param/key generation parametersRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11328)
2020-04-15Fix Dynamic engine loading so that the call to ENGINE_load_builtin_engines() ↵Shane Lontis
is performed. Fixes #11510 PR #11240 Added support for passing the libctx to the config loader. As part of this work the call to OPENSSL_load_builtin_modules() + ENGINE_load_builtin_engines() was deferred until module_run() is called. The call to ENGINE_load_builtin_engines() has been added to ENGINE_by_id(). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11543)
2020-04-14Add ex_data to EVP_PKEY.Aaron Thompson
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11515)
2020-04-14BIO_do_accept: correct error return valuescott
`BIO_do_accept` was returning incorrect values when unable to bind to a port. Fixes #7717 CLA: trivial Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11505)
2020-04-11Add manpage entry for X509_check_purpose()Jake Maynard
Fixes #10263 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10301)
2020-04-10EVP: legacy_ctrl_to_param() to handle provider side keysRichard Levitte
There was one spot where this function would look at ctx->pmeth directly to determine if it's for RSASSA-PSS, which fails when presented with an EVP_PKEY_CTX holding a provider side key. Switching to use EVP_PKEY_is_a() should make things better. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11501)
2020-04-10CMS KARI: Temporarly downgrade newly generated EVP_PKEYs to legacyRichard Levitte
The EVP_PKEY_ASN1_METHOD code used by CMS_RecipientInfo_kari_decrypt() and cms_RecipientInfo_kari_encrypt() is quite complex and needs more careful thought to work with provider side keys. Unfortunately, we need to get key generation in place, among others for ECC keys, so we add a temporary hack, similar to what's already done in TLS code, that downgrades a provider side EVP_PKEY to become EVP_PKEY_ASN1_METHOD / EVP_PKEY_METHOD based. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11501)
2020-04-09Add common internal crypto/ modules in liblegacy.aRichard Levitte
Just as for the FIPS module, there's code in the legacy module that need this. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11504)
2020-04-09Enable Ed25519 signing/verifying to use the libctxMatt Caswell
Ed25519 needs to fetch a digest and so needs to use the correct libctx. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11496)
2020-04-09Make the CT code library context awareMatt Caswell
Add the new functions CTLOG_STORE_new_with_libctx(), CTLOG_new_with_libctx() and CTLOG_new_from_base64_with_libctx() to pass in the library context/property query string to use a library context is to be used. We also add the function CT_POLICY_EVAL_CTX_new_with_libctx() to enable the creation of a CT_POLICY_EVAL_CTX to be associated with a libctx and property query string. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11483)
2020-04-09Enable export_to functions to have access to the libctxMatt Caswell
The EC export_to function calls EC_POINT_point2buf that can later generate a random number in some circumstances. Therefore we pass in a BN_CTX associated with the library context. This means we have to change the export_to function signature to accept the library context. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11493)
2020-04-09Add a null provider which implements no algorithms.Pauli
By loading the null provider into the default context, it is possible to verify that it is not accidentally being used. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11488)
2020-04-09Move legacy ciphers into the legacy providerShane Lontis
DES, idea, seed, rc2, rc4, rc5, cast and blowfish have been moved out of the default provider. Code shared between desx and tdes has been moved into a seperate file (cipher_tdes_common.c). 3 test recipes failed due to using app/openssl calls that used legacy ciphers. These calls have been updated to supply both the default and legacy providers. Fixed openssl app '-provider' memory leak Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11419)
2020-04-09Use the libctx and propq from the X509_STORE_CTXMatt Caswell
Now that X509_STORE_CTX contain a libctx we should use it in a couple of places where we cache the X509v3 extensions. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11457)
2020-04-08Add X509_STORE_CTX_new_with_libctx()Matt Caswell
Make it possible to create an X509_STORE_CTX with an associated libctx and propq. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11457)
2020-04-08EVP & TLS: Add necessary EC_KEY data extraction functions, and use themRichard Levitte
libssl code uses EVP_PKEY_get0_EC_KEY() to extract certain basic data from the EC_KEY. We replace that with internal EVP_PKEY functions. This may or may not be refactored later on. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11358)
2020-04-08EVP: add EVP_PKEY_is_a() and EVP_PKEY_can_sign()Richard Levitte
EVP_PKEY_is_a() is the provider side key checking function corresponding to checking EVP_PKEY_id() or an EVP_PKEY against macros like EVP_PKEY_EC. It also works with legacy internal keys. We also add a warning indoc/man3/EVP_PKEY_set1_RSA.pod regarding the reliability of certain functions that only understand legacy keys. Finally, we take the opportunity to clean up doc/man3/EVP_PKEY_set1_RSA.pod to better conform with man-page layout norms, see man-pages(7) on Linux. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11358)
2020-04-08AES CTR-DRGB: do not leak timing informationPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11147)
2020-04-08Integer overflow in ASN1_STRING_set.Pauli
Addressing a potential integer overflow condition. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11473)
2020-04-08params: avoid a core dump with a null pointer and a get string callPauli
Previous a get string (UTF8 or octet) params call would memcpy(2) from a NULL pointer if the OSSL_PARAM didn't have its data field set. This change makes the operation fail rather than core dump and it returns to param size (if set). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11474)
2020-04-07[crypto/ec] blind coordinates in ec_wNAF_mul for robustnessBilly Brumley
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Nicola Tuveri <nicola.tuveri@ibm.com> (Merged from https://github.com/openssl/openssl/pull/11439)
2020-04-07Fix the error handling in EC_POINTs_mulBernd Edlinger
This was pointed out by a false-positive -fsanitizer warning ;-) However from the cryptographical POV the code is wrong: A point R^0 on the wrong curve is infinity on the wrong curve. [extended tests] Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11475)
2020-04-07Fix misleading error msg for PBM check w/o secret in OSSL_CMP_validate_msg()Dr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11448)
2020-04-07Fix error reporting glitch in X509_STORE_CTX_print_verify_cb() in t_x509.cDr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11448)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-08 11:49:08 +0000