summaryrefslogtreecommitdiffstats
path: root/include
AgeCommit message (Collapse)Author
2020-04-24In OpenSSL builds, declare STACK for datatypes ...Rich Salz
... and only *define* them in the source files that need them. Use DEFINE_OR_DECLARE which is set appropriately for internal builds and not non-deprecated builds. Deprecate stack-of-block Better documentation Move some ASN1 struct typedefs to types.h Update ParseC to handle this. Most of all, ParseC needed to be more consistent. The handlers are "recursive", in so far that they are called again and again until they terminate, which depends entirely on what the "massager" returns. There's a comment at the beginning of ParseC that explains how that works. {Richard Levtte} Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10669)
2020-04-23Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11616)
2020-04-23EVP: add internal evp_keymgmt_util_get_deflt_digest_name() and use itRichard Levitte
evp_keymgmt_util_get_deflt_digest_name() is a refactor of the provider side key part of EVP_PKEY_get_default_digest_name(), that takes EVP_KEYMGMT and provider keydata pointers instead of an EVP_PKEY pointer. We also ensure that it uses SN_undef as the default name if the provider implementation gave us an empty string, since this is what EVP_PKEY_get_default_digest_name() responds when getting the digest name via a EVP_PKEY_ASN1_METHOD ctrl call that returns NID_undef. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11576)
2020-04-22params: add functionality to test if an OSSL_PARAM has been set.Pauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11588)
2020-04-22[crypto/ec] deprecate Jprojective_coordinates_GFp functionsBilly Brumley
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11527)
2020-04-21Add setter equivalents to X509_REQ_get0_signatureDirk-Willem van Gulik
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10563)
2020-04-20Fix DH_get_nid() so that it does not cache values.Shane Lontis
DH_set0_pqg() is now responsible for caching the nid, q and length. DH with or without named safe prime groups now default to using the maximum private key length (BN_num_bits(q) - 1) when generating a DH private key. The code is now shared between fips and non fips mode for DH key generation. The OSSL_PKEY_PARAM_DH_PRIV_LEN parameter can be used during keygen to override the maximum private key length to be in the range (2 * strength ... bits(q) - 1). Where the strength depends on the length of p. Added q = (p - 1) / 2 safe prime BIGNUMS so that the code is data driven (To simplify adding new names). The BIGNUMS were code generated. Fix error in documented return value for DH_get_nid Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11562)
2020-04-19genrsa: update command line app to use EVP callsPauli
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225)
2020-04-19dhparam: update command line app to use EVP callsPauli
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225)
2020-04-18Add CMP error reason 'missing reference cert'Dr. David von Oheimb
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386)
2020-04-18GOST2012 TLS ClientCertificateType Identifiers supportNikolay Morozov
For GOST2012-GOST8912-GOST8912 IANA introduce ClientCertificateType Identifiers https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-2 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11558)
2020-04-17GOST cipher names adjustmentDmitry Belyavskiy
The erroneously introduced names grasshopper-* replaced with kuznyechik-* according to official algorithm name translation. Too long symbolic names replaced with human-enterable ones. Also the mechanism of deprecating names in objects.txt is implemented Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11440)
2020-04-17ecx: check for errors creating public keys from private ones.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11371)
2020-04-17s390: ECX key generation fixes.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11371)
2020-04-17ecx: add key generation support.Pauli
Specifically for x25519, x448, ed25519 and ed448. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11371)
2020-04-16Introduce an internal version of X509_check_issued()Matt Caswell
The internal version is library context aware. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11507)
2020-04-16Create a libctx aware X509_verify_ex()Matt Caswell
This is the same as X509_verify() except that it takes a libctx and propq parameter and signature verification is done using those. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11507)
2020-04-16Add DH keygen to providersShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11332)
2020-04-15Add DSA keygen to providerShane Lontis
Moved some shared FFC code into the FFC files. Added extra paramgen parameters for seed, gindex. Fixed bug in ossl_prov util to print bignums. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11303)
2020-04-15Teach PEM_read_bio_PrivateKey about libctxMatt Caswell
Now that d2i_PrivateKey_ex() and other similar functions exist we should use it when loading a PEM PrivateKey. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11494)
2020-04-15Teach the OSSL_STORE code about libctxMatt Caswell
We restrict this to just the PrivateKey loading code at the moment. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11494)
2020-04-15Teach d2i_PrivateKey et al about libctxMatt Caswell
The Ed448 private key decoding makes algorithm fetches. Therefore we teach d2i_PrivateKey et al about libctx and make sure it is passed through the layers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11494)
2020-04-15EC: Refactor EVP_PKEY_CTX curve setting macros for param generationRichard Levitte
The macros are converted to functions, and are modified to support provider implementations. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11328)
2020-04-15KEYMGMT: Add functions to get param/key generation parametersRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11328)
2020-04-15mkerr: remove legacy guards from generated error headersDr. Matthias St. Pierre
In pull request #9333, legacy guards were added to the generated error headers, but the mkerr.pl script was not adjusted accordingly. So the legacy guards were removed by subsequent `make update` calls. Fixing the mkerr.pl script properly was disproportionately complicated by the fact that adding legacy guards only made sense for files which already existed in version 1.1.1. To keep things simple, it was decided to drop the legacy guards from the generated headers entirely. Fixes #10569 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11541)
2020-04-14Add ex_data to EVP_PKEY.Aaron Thompson
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11515)
2020-04-10CMS KARI: Temporarly downgrade newly generated EVP_PKEYs to legacyRichard Levitte
The EVP_PKEY_ASN1_METHOD code used by CMS_RecipientInfo_kari_decrypt() and cms_RecipientInfo_kari_encrypt() is quite complex and needs more careful thought to work with provider side keys. Unfortunately, we need to get key generation in place, among others for ECC keys, so we add a temporary hack, similar to what's already done in TLS code, that downgrades a provider side EVP_PKEY to become EVP_PKEY_ASN1_METHOD / EVP_PKEY_METHOD based. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11501)
2020-04-09Enable Ed25519 signing/verifying to use the libctxMatt Caswell
Ed25519 needs to fetch a digest and so needs to use the correct libctx. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11496)
2020-04-09Make the CT code library context awareMatt Caswell
Add the new functions CTLOG_STORE_new_with_libctx(), CTLOG_new_with_libctx() and CTLOG_new_from_base64_with_libctx() to pass in the library context/property query string to use a library context is to be used. We also add the function CT_POLICY_EVAL_CTX_new_with_libctx() to enable the creation of a CT_POLICY_EVAL_CTX to be associated with a libctx and property query string. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11483)
2020-04-09Enable export_to functions to have access to the libctxMatt Caswell
The EC export_to function calls EC_POINT_point2buf that can later generate a random number in some circumstances. Therefore we pass in a BN_CTX associated with the library context. This means we have to change the export_to function signature to accept the library context. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11493)
2020-04-08Add X509_STORE_CTX_new_with_libctx()Matt Caswell
Make it possible to create an X509_STORE_CTX with an associated libctx and propq. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11457)
2020-04-08EVP & TLS: Add necessary EC_KEY data extraction functions, and use themRichard Levitte
libssl code uses EVP_PKEY_get0_EC_KEY() to extract certain basic data from the EC_KEY. We replace that with internal EVP_PKEY functions. This may or may not be refactored later on. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11358)
2020-04-08EVP: add EVP_PKEY_is_a() and EVP_PKEY_can_sign()Richard Levitte
EVP_PKEY_is_a() is the provider side key checking function corresponding to checking EVP_PKEY_id() or an EVP_PKEY against macros like EVP_PKEY_EC. It also works with legacy internal keys. We also add a warning indoc/man3/EVP_PKEY_set1_RSA.pod regarding the reliability of certain functions that only understand legacy keys. Finally, we take the opportunity to clean up doc/man3/EVP_PKEY_set1_RSA.pod to better conform with man-page layout norms, see man-pages(7) on Linux. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11358)
2020-04-08params: add a warning about the PTR types.Pauli
The warning is deter the unsure -- if in doubt the PTR type is almost certainly NOT what you should be using. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11480)
2020-04-07Fix misleading error msg for PBM check w/o secret in OSSL_CMP_validate_msg()Dr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11448)
2020-04-07PROV: Add the beginning of a DER writing libraryRichard Levitte
This library is meant to be small and quick. It's based on WPACKET, which was extended to support DER writing. The way it's used is a bit unusual, as it's used to write the structures backward into a given buffer. A typical quick call looks like this: /* * Fill in this structure: * * something ::= SEQUENCE { * id OBJECT IDENTIFIER, * x [0] INTEGER OPTIONAL, * y [1] BOOLEAN OPTIONAL, * n INTEGER * } */ unsigned char buf[nnnn], *p = NULL; size_t encoded_len = 0; WPACKET pkt; int ok; ok = WPACKET_init_der(&pkt, buf, sizeof(buf) && DER_w_start_sequence(&pkt, -1) && DER_w_bn(&pkt, -1, bn) && DER_w_boolean(&pkt, 1, bool) && DER_w_precompiled(&pkt, -1, OID, sizeof(OID)) && DER_w_end_sequence(&pkt, -1) && WPACKET_finish(&pkt) && WPACKET_get_total_written(&pkt, &encoded_len) && (p = WPACKET_get_curr(&pkt)) != NULL; Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11450)
2020-04-04Add "endfirst" writing to WPACKETMatt Caswell
Support the concept of writing to the end of the packet first. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11462)
2020-04-03Add data driven SELF TEST code for signatures and key agreementShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11036)
2020-04-02HTTP client: make server/proxy and port params more consistent; minor other ↵Dr. David von Oheimb
improvements Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11404)
2020-04-02 Chunk 10 of CMP contribution to OpenSSL: CMP http client and related testsDr. David von Oheimb
Also improve the generic HTTP client w.r.t. proxy and no_proxy options. Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712). Adds the CMP and CRMF API to libcrypto and the "cmp" app to the CLI. Adds extensive documentation and tests. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11404)
2020-04-02TLS Cipher Suite 0xC102 SupportNikolay Morozov
For GOST2012-GOST8912-GOST8912 was used 0xFF85 identifier, but new identifier 0xc102 was assigned. Because of old software we will support both numbers. https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-2 https://datatracker.ietf.org/doc/draft-smyshlyaev-tls12-gost-suites/ Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11403)
2020-04-01Add EVP_PKEY_gettable_params support for accessing EVP_PKEY key data fieldsShane Lontis
Currently only RSA, EC and ECX are supported (DH and DSA need to be added to the keygen PR's seperately because the fields supported have changed significantly). The API's require the keys to be provider based. Made the keymanagement export and get_params functions share the same code by supplying support functions that work for both a OSSL_PARAM_BLD as well as a OSSL_PARAM[]. This approach means that complex code is not required to build an empty OSSL_PARAM[] with the correct sized fields before then doing a second pass to populate the array. The RSA factor arrays have been changed to use unique key names to simplify the interface needed by the user. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11365)
2020-03-30Add the X509v3_cache_extensions() functionMatt Caswell
Various functions cause the results of processing extensions to be cached. The processing itself requires a libctx, and so this implicit caching means that the default ctx is used which can lead to failures. By explicitly caching the extensions we can specify the libctx to be used. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11409)
2020-03-28Param build: make structures opaque.Pauli
Since this is public, it is best to make the underlying structure opaque. This means converting from stack allocation to dynamic allocation for all usages. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11390)
2020-03-28Param builder: make the OSSL_PARAM_BLD APIs public.Pauli
The catalyst for this is the difficult of passing BNs through the other OSSL_PARAM APIs. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11390)
2020-03-27Make SRP library context awareMatt Caswell
In order for the TLS SRP tests to pass when using a non-default library context the underlying SRP calls need to be library context aware. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11410)
2020-03-27Add OCSP_RESPID_set_by_key_ex() and OCSP_RESPID_match_ex()Matt Caswell
OCSP_RESPID_set_by_key() calculates a SHA1 hash of the supplied certificate. We need to be able to specify which libctx and property query string is used to fetch that algorithm so we introduce OCSP_RESPID_set_by_key_ex() which does the same thing but enables you to speicfy the library context and propery query string explicitly. OCSP_RESPID_match() matches with certificates based on the SHA1 hash. Therefore for the same reason we introduce OCSP_RESPID_match_ex(). Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11407)
2020-03-27Put an error on the stack in the event of a fetch failureMatt Caswell
Fetch failures are a common problem and it is useful to have detailed information about what was requested in the event of a failure. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11405)
2020-03-25EVP: Implement support for key downgrading in backendsRichard Levitte
Downgrading EVP_PKEYs from containing provider side internal keys to containing legacy keys demands support in the EVP_PKEY_ASN1_METHOD. This became a bit elaborate because the code would be almost exactly the same as the import functions int EVP_KEYMGMT. Therefore, we end up moving most of the code to common backend support files that can be used both by legacy backend code and by our providers. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11375)
2020-03-25EVP: Downgrade keys rather than upgradeRichard Levitte
Upgrading EVP_PKEYs from containing legacy keys to containing provider side keys proved to be risky, with a number of unpleasant corner cases, and with functions like EVP_PKEY_get0_DSA() failing unexpectedly. We therefore change course, and instead of upgrading legacy internal keys to provider side internal keys, we downgrade provider side internal keys to legacy ones. To be able to do this, we add |import_from| and make it a callback function designed for evp_keymgmt_export(). This means that evp_pkey_upgrade_to_provider() is replaced with evp_pkey_downgrade(). EVP_PKEY_copy_parameters() is the most deeply affected function of this change. Fixes #11366 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11375)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-13 23:34:29 +0000