summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2021-04-18CORE: pre-populate the namemap with legacy OIDs tooRichard Levitte
This also pre-populates the namemap with names derived from the internal EVP_PKEY_ASN1_METHODs. This requires attention, as they contain aliases that we may want (RSA == rsaEncryption), as well as aliases that we absolutely do not want (SM2 == EC). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14498)
2021-04-18CORE: Register all legacy "names" when generating the initial namemapRichard Levitte
When generating the initial namemap from EVP cipher and digest names, we din't do it quite as thoroughly as necessary, which meant that so called "long names" weren't necessarily registered, and if anyone ever tried to check the algorithm of an EVP_CIPHER or EVP_MD using a so called "long name" would fail. This doesn't deal with the fact that "long names" have a distinct role as human readable descriptors, useful for printouts. Further changes are necessary to deal with this. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14498)
2021-04-18Modify OBJ_nid2sn(OBJ_obj2nid(...)) occurences to use OBJ_obj2txt()Richard Levitte
The intention is to allow for OIDs for which libcrypto has no information, but are still fetchable for OSSL_ALGORITHM implementations that specify an OID amongst their names. Fixes #14278 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14498)
2021-04-18Add "origin" field to EVP_CIPHER, EVP_MDRich Salz
Add a "where did this EVP_{CIPHER,MD} come from" flag: global, via fetch, or via EVP_{CIPHER,MD}_meth_new. Update EVP_{CIPHER,MD}_free to handle all three origins. The flag is deliberately right before some function pointers, so that compile-time failures (int/pointer) will occur, as opposed to taking a bit in the existing "flags" field. The "global variable" flag is non-zero, so the default case of using OPENSSL_zalloc (for provider ciphers), will do the right thing. Ref-counting is a no-op for Make up_ref no-op for global MD and CIPHER objects Deprecate EVP_MD_CTX_md(). Added EVP_MD_CTX_get0_md() (same semantics as the deprecated function) and EVP_MD_CTX_get1_md(). Likewise, deprecate EVP_CIPHER_CTX_cipher() in favor of EVP_CIPHER_CTX_get0_cipher(), and add EVP_CIPHER_CTX_get1_CIPHER(). Refactor EVP_MD_free() and EVP_MD_meth_free() to call new common evp_md_free_int() function. Refactor EVP_CIPHER_free() and EVP_CIPHER_meth_free() to call new common evp_cipher_free_int() function. Also change some flags tests to explicit test == or != zero. E.g., if (flags & x) --> if ((flags & x) != 0) if (!(flags & x)) --> if ((flags & x) == 0) Only done for those lines where "get0_cipher" calls were made. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14193)
2021-04-18Standard style for all EVP_xxx_free routinesRich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14193)
2021-04-17OSSL_CMP_CTX_new(): Fix distinction of out-of-memory and other errorsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14889)
2021-04-17Fix naming for EVP_RAND_CTX_gettable functions.Pauli
Change: EVP_RAND_gettable_ctx_params -> EVP_RAND_CTX_gettable_params EVP_RAND_settable_ctx_params -> EVP_RAND_CTX_settable_params Which brings them in line with the other similar functions for other algorithm types. Fixes #14880 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14893)
2021-04-16Add more negative checks for integers passed to OPENSSL_malloc().Shane Lontis
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14830)
2021-04-16SipHash: Fix CTRL API for the digest size.Pauli
Adds a mapping from "digestsize" to "size" for setting a param. Fixes #14370 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14850)
2021-04-15Add EVP_PKEY_todata() and EVP_PKEY_export() functions.Shane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14800)
2021-04-15Rename EVP_PKEY_get0_first_alg_name to EVP_PKEY_get0_type_nameTomas Mraz
We use type elsewhere and documenting the 'first' in the name of the call is a little bit superfluous making the name too mouthful. Also rename EVP_PKEY_typenames_do_all to EVP_PKEY_type_names_do_all to keep the words separated by underscore. Fixes #14701 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14868)
2021-04-15Do not allow creating empty RSA keys by duplicationTomas Mraz
Also avoid crashing in rsa_get_params on empty keys. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14793)
2021-04-15Remove keymgmt_copy function from the provider APITomas Mraz
It is superceded by the keymgmt_dup. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14793)
2021-04-15Add selection support to the provider keymgmt_dup functionTomas Mraz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14793)
2021-04-15Implement provider-side keymgmt_dup functionTomas Mraz
To avoid mutating key data add OSSL_FUNC_KEYMGMT_DUP function to the provider API and implement it for all asym-key key managements. Use it when copying everything to an empty EVP_PKEY which is the case with EVP_PKEY_dup(). Fixes #14658 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14793)
2021-04-14cmp_util.c: Fix OSSL_CMP_log_open() in case OPENSSL_NO_TRACEDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14842)
2021-04-14Document the invariants for the empty X509_NAME encodingTomas Mraz
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/14832)
2021-04-14X509_NAME_cmp: if canon_enclen is 0 for both names return 0Tomas Mraz
We do not care whether canon_enc is NULL in this case. Fixes #14813 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/14832)
2021-04-14bio_printf: add \0 terminators for error returns in floating point conversions.Pauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14829)
2021-04-14bio: add a malloc failed error to BIO_printPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14829)
2021-04-14Add some additional NULL checks to prevent segfaults.Shane Lontis
Fixes #14809 PR #14752 attempted to pass the libctx, propq in a few places related to X509 signing. There were a few places that needed additional NULL checks so that they behavethe same as they did before. OCSP_basic_sign() was changed to call EVP_DigestSignInit_ex() which passed the parameter EVP_MD_name(dgst). Since dgst can be NULL EVP_MD_name() was segfaulting. Adding an additional NULL check EVP_MD_name() resolves this issue. The other NULL checks are required to produce errors rather than segfaults if the certificate is NULL. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14826)
2021-04-14Add domain parameter match check for DH and ECDH key exchange.Shane Lontis
Fixes #14808 Validation checks were moved into EVP_PKEY_derive_set_peer() which broke an external negative test. Originally the old code was semi working by checking the peers public key was in the range of other parties p. It was not actually ever checking that the domain parameters were consistent between the 2 parties. It now checks the parameters match as well as validating the peers public key. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14823)
2021-04-14Remove a TODO(3.0) from X509_PUBKEY_setMatt Caswell
The comment talks about the EVP_PKEY that is contained within an X509_PUBKEY object and whether it has to be exactly the same as the one passed by the caller in X509_PUBKEY_set(). IMO it does, so the TODO should be dropped. Fixes #14378 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14845)
2021-04-14crypto: raise error on malloc failureFdaSilvaYY
clean a few style nits. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14806)
2021-04-12Remove the function EVP_PKEY_set_alias_typeMatt Caswell
OTC recently voted that EVP_PKEY types will be immutable in 3.0. This means that EVP_PKEY_set_alias_type can no longer work and should be removed entirely (applications will need to be rewritten not to use it). It was primarily used for SM2 which no longer needs this call. Applications should generate SM2 keys directly (without going via an EC key first), or otherwise when loading keys they should automatically be detected as SM2 keys. Fixes #14379 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14803)
2021-04-12Replace OSSL_PARAM_BLD_free_params() with OSSL_PARAM_free().Shane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14785)
2021-04-12Add OSSL_PARAM_dup() and OSSL_PARAM_merge().Shane Lontis
These functions are prerequisites for implementing EVP_PKEY_todata(). OSSL_PARAM_dup() is required to make a deep copy of the exported params (since the provider export() uses a OSSL_PARAM_BLD which throws away the data after the call), and then use OSSL_PARAM_merge() to add some additional params that can be passed to the EVP_PKEY_todata(). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14785)
2021-04-12Add additional KMAC errorPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14810)
2021-04-09Inherit hostflags verify params even without hostsChristian Heimes
X509_VERIFY_PARAM_inherit() now copies hostflags independently of hosts. Previously hostflags were only copied when at least one host was set. Typically applications don't configure hosts on SSL_CTX. The change enables applications to configure hostflags on SSL_CTX and have OpenSSL copy the flags from SSL_CTX to SSL. Fixes: https://github.com/openssl/openssl/issues/14579 Signed-off-by: Christian Heimes <christian@python.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14743)
2021-04-08d2i_PrivateKey_decoder(): Fix premature exit on unsuccessful ↵Dr. David von Oheimb
OSSL_DECODER_CTX_new_for_pkey() Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14647)
2021-04-08PEM_X509_INFO_read_bio_ex(): Generalize to allow parsing any type of private keyDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14647)
2021-04-08d2i_PrivateKey{,_ex}() and PEM_X509_INFO_read_bio_ex(): Fix handling of ↵Dr. David von Oheimb
RSA/DSA/EC private key This is needed to correct d2i_PrivateKey() after it was changed by commit 576892d78f80cf9a. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14647)
2021-04-08Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14801)
2021-04-08curve448: Integrate 64-bit reference implementationAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Use constant time zero check functionAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Remove the unrolled loop versionAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Use NLIMBS where appropriate to simplify the codeAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Modernise reference 64-bit codeAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Rename arch_ref64 to arch_64Amitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08Partially Revert "Remove curve448 architecture specific files"Amitay Isaacs
This reverts commit 7e492f3372ed83af074a63d5920f13de7e3455b6. This brings back the 64-bit reference implementation for curve448. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08curve448: Use relative includes to avoid explicit dependenciesAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08Use numbers definition of int128_t and uint128_tAmitay Isaacs
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14784)
2021-04-08param_build: check for the usage of secure memory better.Pauli
The param build now checks the string types and locates them in secure memory if the original string is. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14782)
2021-04-08property: lock the lib ctx when updating the property definition cachePauli
Although the store being used is adequately and properly locked, the library context is not. Due to the mechanisms used for fetching, it is possible for multiple stores to live within the same library context for short periods. This fix prevents threading issues resulting from such coincidences. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14773)
2021-04-08property: check return values from the property locking calls.Pauli
A failure to obtain a lock would have resulted in much badness, now it results in a failure return. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14773)
2021-04-08Fix more certificate related lib_ctx settings.Shane Lontis
Fixes #13732 Fix a few places that were not using the '_ex' variants of ASN1_item_sign/verify. Added X509_CRL_new_ex(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14752)
2021-04-08dh: fix coverity 1473238: argument cannot be negativePauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14620)
2021-04-08evp: fix coverity 1473631: argument cannot be negativePauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14620)
2021-04-08evp: fix coverity 1451509: argument cannot be negativePauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14620)
2021-04-08evp: fix coverity 1451510: argument cannot be negativePauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14620)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-28 00:17:25 +0000