summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2021-05-06coverity: fix 1478169: dereference after NULL checkPauli
The code path shouldn't occur in our code but could in an application. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15128)
2021-05-06Remove all trace of FIPS_mode functionsRich Salz
Removed error codes, and the mention of the functions. This removal is already documented in the CHANGES doc. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15140)
2021-05-05Fix missing symbols in no-cms and no-ts buildTomas Mraz
Fixes #15137 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15138)
2021-05-05mac: add EVP_MAC_finalXOF() functionPauli
Fixes #14140 Fixes #13232 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15061)
2021-05-05Add .includedir pragmaRich Salz
Also add a negative test, and fix typo's. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15090)
2021-05-05Allow absolute paths to be setRich Salz
It was a mistake to allow relative paths for include files (just like root shouldn't have "." in its PATH), but we probably can't change it now. Add a new pragma "abspath" that someone can put in the system-wide config file to require absolute paths. Also update the config documentation to better explain how file inclusion works. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15090)
2021-05-05Fix KMAC bounds checks.Shane Lontis
Setting an output length higher than 8191 was causing a buffer overflow. This was reported by Acumen (FIPS lab). The max output size has increased to ~2M and it now checks this during set_parameters. The encoder related functions now pass in the maximum size of the output buffer so they can correctly check their size. kmac_bytepad_encode_key() calls bytepad twice in order to calculate and check the length before encoding. Note that right_encode() is currently only used in one place but this may change if other algorithms are supported (such as TupleHash). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15106)
2021-05-04HTTP client: Correct the use of optional proxy URL and its documentationDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15104)
2021-05-04BIO_eof() and OSSL_STORE_eof(): Make sure to return 1 on error; improve ↵Dr. David von Oheimb
related doc Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04OSSL_DECODER_from_bio() Prevent spurious decoding error at EOFDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04OSSL_STORE_expect(): Improve error handling and documentationDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04Create libcrypto support for BIO_new_from_core_bio()Matt Caswell
Previously the concept of wrapping an OSSL_CORE_BIO in a real BIO was an internal only concept for our own providers. Since this is likely to be generally useful, we make it a part of the public API. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15072)
2021-05-01Use OCSP-specific error code for clarityDmitry Belyavskiy
Fixes #12735 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/xxxxx)
2021-04-30Fix typo in OSSL_DECODER_CTX_set_input_structureDaniel Bevenius
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15085)
2021-04-30STORE: Fix the repeated prompting of passphraseRichard Levitte
OSSL_STORE's loading function could prompt repeatedly for the same passphrase. It turns out that OSSL_STORE_load() wasn't caching the passphrase properly. Fixed in this change. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15064)
2021-04-30CORE: Rework the pre-population of the namemapRichard Levitte
The pre-population of names has become more thorough. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15066)
2021-04-30Remove dated term and fixed typo antherEric Curtin
Just something I noticed while reading this code. This was probably committed a very long time ago. Fixed typo anther -> another. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15078)
2021-04-30Add library context and property query support into the PKCS12 APIJon Spillett
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14434)
2021-04-29asn1_lib.c: ASN1_put_object: Remove comment about "class 0".Scott McPeak
ASN1_put_object() was preceded by the nonsensical comment: /* * class 0 is constructed constructed == 2 for indefinite length constructed */ This is the result of concatenating two sentences in 0f113f3ee4d by automated reformatting. The first sentence, "class 0 is constructed", goes back to d02b48c63a, the import of SSLeay 0.8.1b. Even in that context, it made little sense; class 0 means "universal", not constructed, and there is no special significance to class 0 in this function in any case. Therefore I have simply removed that first sentence. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14998)
2021-04-28Store the list of activated providers in the libctxMatt Caswell
The provider config module was storing the list of activated providers in a global variable. However, because different libctxs can each load providers via config files we need to keep the list of activated providers separate and in the libctx. Partially fixes #15030 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15033)
2021-04-28Properly protect access to the provider flag_activated fieldMatt Caswell
This was not always locked when it should be. Fixes #15005 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15010)
2021-04-28CMS ESS: Move four internal aux function to where they belong in crypto/cmsDr. David von Oheimb
Also constify and slightly refactor them. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14601)
2021-04-28TS ESS: Move four internal aux function to where they belong in crypto/tsDr. David von Oheimb
Also constify and slightly refactor them. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14601)
2021-04-28ESS: Export three core functions, clean up TS and CMS CAdES-BES usageDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14601)
2021-04-28Add X509 version constants.David Benjamin
The X509 version APIs return the numerical values of the version numbers, which are one off from the names. This is a bit confusing. Where they don't get it wrong (accidentally making an "X509v4" certificate), callers tend to try commenting every call site to explain the mismatch, including in OpenSSL itself. Define constants for these values, so code can be self-documenting and callers are nudged towards the right values. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14549)
2021-04-28Improve the implementation of X509_STORE_CTX_get1_issuer()Tomas Mraz
It is possible for the stack of X509_OBJECTs held in an X509_STORE_CTX to have a custom compare function associated with it. Normally (by default) this uses X509_NAME_cmp(). The X509_STORE_CTX_get1_issuer() function assumed that it would always be X509_NAME_cmp(). By implementing OPENSSL_sk_find_all() function we can avoid explicitly using X509_NAME_cmp() in X509_STORE_CTX_get1_issuer(). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14728)
2021-04-28Prefer fetch over legacy get_digestby/get_cipherbyTomas Mraz
Fixes #14198 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15028)
2021-04-28Rename some globals, add ossl prefix.Rich Salz
Fixes: 13562 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15035)
2021-04-27ASN1: Ensure that d2i_ASN1_OBJECT() frees the strings on ASN1_OBJECT reuseRichard Levitte
The 'sn' and 'ln' strings may be dynamically allocated, and the ASN1_OBJECT flags have a bit set to say this. If an ASN1_OBJECT with such strings is passed to d2i_ASN1_OBJECT() for reuse, the strings must be freed, or there is a memory leak. Fixes #14667 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14938) (cherry picked from commit 65b88a75921533ada8b465bc8d5c0817ad927947)
2021-04-27Deprecate EVP_PKEY_cmp() and EVP_PKEY_cmp_parameters().Shane Lontis
The replacement functions EVP_PKEY_eq() and EVP_PKEY_parameters_eq() already exist. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/14997)
2021-04-26Fixes related to separation of DH and DHX typesShane Lontis
Fix dh_rfc5114 option in genpkey. Fixes #14145 Fixes #13956 Fixes #13952 Fixes #13871 Fixes #14054 Fixes #14444 Updated documentation for app to indicate what options are available for DH and DHX keys. DH and DHX now have different keymanager gen_set_params() methods. Added CHANGES entry to indicate the breaking change. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14883)
2021-04-26Add type_name member to provided methods and use itTomas Mraz
Fixes #14701 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14898)
2021-04-23crypto/store/ossl_result.c: Better filtering of errorsRichard Levitte
The diverse variants of try_XXX() were filtering errors independently of each other. It's better done in ossl_store_handle_load_result() itself, where we have control over the overall success and failure of the attempts. Fixes #14973 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15008)
2021-04-23EVP: evp_keymgmt_util_try_import() should clean up on failed importRichard Levitte
If evp_keymgmt_util_try_import() allocated keydata, and the import itself fails, it should deallocate keydata. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15008)
2021-04-23Trivial shortcuts for EVP_PKEY_eq()Tomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14942)
2021-04-22Remove obsolete commentDr. Matthias St. Pierre
Fixes #14968 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14969)
2021-04-22Remove an unused parameterRich Salz
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14943)
2021-04-22http/http_lib.c: Include stdio.h for sscanf()Tomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14953)
2021-04-22Add RUN_ONCE support to zlib initTodd Short
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14940)
2021-04-22Fix potential NULL dereference in OSSL_PARAM_get_utf8_string()Tomas Mraz
Fixes Coverity ID 1476283 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14928)
2021-04-22Fix potential NULL dereference in ossl_ec_key_dup()Tomas Mraz
Fixes Coverity ID 1476282 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14928)
2021-04-22Removed dead code in linebuffer_ctrl()Tomas Mraz
Fixes Coverity CID 1476284 Also add possible number truncation check. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14928)
2021-04-22Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14986)
2021-04-22Fix build failure with MSVCTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14983)
2021-04-22Avoid the need for Configure time 128-bit int detectionMatt Caswell
We just detect this at compile time instead. This avoids cross-compilation problems where the host platform supports 128-bit ints, but the target platform does not (or vice versa). This was causing a problem on some platforms where, dependent on the CFLAGS, 128 bit ints were either supported or not. Fixes #14804 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14941)
2021-04-22Fix typosMichaM
CLA: trivial Signed-off-by: MichaM <contact-micha+github@posteo.de> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14879)
2021-04-21ASN.1: Add some sanity checks for input len <= 0; related coding improvementsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14357)
2021-04-21tasn_dec.c: Add checks for it == NULL arguments; improve coding styleDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14357)
2021-04-21STORE: Discard the error report filter in crypto/store/store_result.cRichard Levitte
The error report filter was fragile, as it could potentially have to be updated when other parts of libcrypto got updated, making a goose chase and a maintenance problem. We change this to regard d2i errors as something we don't care so much about, since they are mainly part of the guessing mechanism. The success of the ossl_store_handle_load_result() call is based on whether an object was actually created or not anyway. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14834)
2021-04-21ENCODER & DECODER: Allow decoder implementations to specify "carry on"Richard Levitte
So far, decoder implementations would return true (1) for a successful decode all the way, including what the callback it called returned, and false (0) in all other cases. This construction didn't allow to stop to decoding process on fatal errors, nor to choose what to report in the provider code. This is now changed so that decoders implementations are made to return false only on errors that should stop the decoding process from carrying on with other implementations, and return true for all other cases, even if that didn't result in a constructed object (EVP_PKEY for example), essentially making it OK to return "empty handed". The success of the decoding process is now all about successfully constructing the final object, rather than about the return value of the decoding chain. If no construction is attempted, the central decoding processing code concludes that whatever the input consisted of, it's not supported by the available decoder implementations. Fixes #14423 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14834)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-21 19:22:54 +0000