summaryrefslogtreecommitdiffstats
path: root/crypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Include a local static buffer for the SHA helper functionsPauli2021-06-161-0/+20
| | | | | | | | | This functionality existed in 1.1.1 but was lost. Fixes #15718 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15752)
* Add various OBJ functions as callbacksMatt Caswell2021-06-161-0/+37
| | | | | | | | | | | | | This enables providers to register new OIDs in the same libcrypto instance as is used by the application. Fixes #15624 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15681)
* Refactor OSSL_STORE_LOADER_do_all_provided() to behave like ↵Richard Levitte2021-06-151-32/+24
| | | | | | | | | | | | | | | | | | OSSL_STORE_LOADER_fetch() This is refactored to use inner_loader_fetch() without any given name, which is just there to ensure all decoder implementations are made into methods, and then use ossl_method_store_do_all() to list them all. This also adds the internal ossl_store_loader_do_all_prefetched(), which can be used if pre-fetching needs to be done separately from listing all the decoder implementations, or if listing may happen multiple times. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
* DECODER & ENCODER: Add better tracingRichard Levitte2021-06-151-0/+44
| | | | | | | | | Now that we have functions to get the name and properties of the diverse implementations, we can as well display them for clarity. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
* Adapt all public EVP_XXX_do_all_provided() for the changed evp_generic_do_all()Richard Levitte2021-06-1510-5/+12
| | | | | | | | | Fixes #15538 Fixes #14837 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
* Refactor evp_generic_do_all() to behave like evp_generic_fetch()Richard Levitte2021-06-152-42/+52
| | | | | | | | | | | | | | | | | | | This is refactored to use inner_evp_generic_fetch() without any given name, which is just there to ensure all decoder implementations are made into methods, and then use ossl_method_store_do_all() to list them all. This also adds the internal evp_generic_do_all_prefetched(), which can be used if pre-fetching needs to be done separately from listing all the decoder implementations, or if listing may happen multiple times. Fixes #15538 Fixes #14837 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
* Refactor OSSL_ENCODER_do_all_provided() to behave like OSSL_ENCODER_fetch()Richard Levitte2021-06-151-33/+22
| | | | | | | | | | | | | | | | | | | This is refactored to use inner_ossl_encoder_fetch() without any given name, which is just there to ensure all encoder implementations are made into methods, and then use ossl_method_store_do_all() to list them all. This also adds the internal ossl_encoder_do_all_prefetched(), which can be used if pre-fetching needs to be done separately from listing all the encoder implementations, or if listing may happen multiple times. Fixes #15538 Fixes #14837 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
* Refactor OSSL_DECODER_do_all_provided() to behave like OSSL_DECODER_fetch()Richard Levitte2021-06-151-33/+28
| | | | | | | | | | | | | | | | | | | This is refactored to use inner_ossl_decoder_fetch() without any given name, which is just there to ensure all decoder implementations are made into methods, and then use ossl_method_store_do_all() to list them all. This also adds the internal ossl_decoder_do_all_prefetched(), which can be used if pre-fetching needs to be done separately from listing all the decoder implementations, or if listing may happen multiple times. Fixes #15538 Fixes #14837 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
* Add the internal function ossl_method_store_do_all()Richard Levitte2021-06-151-0/+36
| | | | | | | | | | | | It will simply call the given callback for every method found in the given store. Fixes #15538 Fixes #14837 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
* CORE: Move away the allocation of the temporary no_cache method storeRichard Levitte2021-06-155-125/+186
| | | | | | | | | | | | | | | | | The responsibility for managing the temporary store for methods from algorithm implementations flaged "no_store" is moved up to the diverse method fetching functions. This allows them to allocate it "just in time", or in other words not at all if there is not such algorithm implementation. This makes this temporary store more flexible if it's needed outside of the core fetching functionality, and slightly faster when this temporary store isn't necessary at all. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15737)
* ASN1_parse_dump(): allow NULL BIO input, to simplify applications not ↵Dr. David von Oheimb2021-06-151-7/+8
| | | | | | | needing output Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
* BIO_write_ex(): Make handing of BIO b == NULL and dlen == 0 less redundantDr. David von Oheimb2021-06-151-7/+2
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
* BIO: Make source file names in crypto/bio/ consistentDr. David von Oheimb2021-06-157-3/+3
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
* BIO_dum_indent_cb(): Fix handling of cb return valueDr. David von Oheimb2021-06-151-2/+5
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
* BIO: prevent crash on NULL BIO for prefix_ctrl() and thus for ↵Dr. David von Oheimb2021-06-151-2/+2
| | | | | | | BIO_set_prefix(), BIO_set_indent(), etc. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
* ASN1: rename asn1_par.c to asn1_parse.c for clarity; simplify asn1_parse2()Dr. David von Oheimb2021-06-152-11/+4
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15722)
* Use getauxval on Android with API level > 18Lars Immisch2021-06-151-0/+9
| | | | | | | | | | | | We received analytics that devices of the device family Oppo A37x are crashing with SIGILL when trying to load libcrypto.so. These crashes were fixed by using the system-supplied getauxval function. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11257)
* remove end of line whitespacePauli2021-06-151-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
* cms: free PKEY_CTXPauli2021-06-151-4/+5
| | | | | | | | Preventing a memory leak. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15731)
* cms: fix coverity 1485981: unchecked return valuePauli2021-06-151-2/+6
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15731)
* Add missing NULL check in OSSL_DECODER_from_bio().Shane Lontis2021-06-151-0/+5
| | | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15733)
* Avoid excessive OSSL_DECODER_do_all_provided callsMatt Caswell2021-06-141-3/+26
| | | | | | | | | | | | OSSL_DECODER_CTX_add_extra was calling OSSL_DECODER_do_all_provided in a loop which was resulting in a large number of calls. Since OSSL_DECODER_do_all_provided is quite "heavy" this was causing performance issues. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15716)
* Add a generic SubjectPublicKeyInfo decoderMatt Caswell2021-06-142-0/+46
| | | | | | | | | | | | | | | | Previously all the SubjectPublicKeyInfo decoders were specific to a key type. We would iterate over all them until a match was found for the correct key type. Each one would fully decode the key before then testing whether it was a match or not - throwing it away if not. This was very inefficient. Instead we introduce a generic SubjectPublicKeyInfo decoder which figures out what type of key is contained within it, before subsequently passing on the data to a key type specific SubjectPublicKeyInfo decoder. Fixes #15646 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15662)
* Fix DH/DHX named groups to not overwrite the private key length.Shane Lontis2021-06-141-2/+0
| | | | | | | | | | | | | | | | The only reason(s) the DH private key length should be set are: (1) The user sets it during key generation via EVP_PKEY_CTX_set_params using OSSL_PKEY_PARAM_DH_PRIV_LEN. (2) When loading a PKCS3 (DH) key the optional value 'privateValueLength' is set. Now that the named groups contain a value for 'q' there is no reason to automatically overwrite the private key length. Issue detected by @davidmakepeace Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15695)
* Add AES consttime code for no-asm configurationsBernd Edlinger2021-06-132-1/+632
| | | | | | | | | | | | | | | This adds optional constant time support for AES when building openssl for no-asm. Enable with: ./config no-asm -DOPENSSL_AES_CONST_TIME Disable with: ./config no-asm -DOPENSSL_NO_AES_CONST_TIME This is by default enabled. [extended tests] Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10828)
* d2i_X509: revert calling X509v3_cache_extensions()Dr. David von Oheimb2021-06-121-24/+1
| | | | | | | Fixes #13754 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15705)
* Rename OSSL_HTTP_set_request() to OSSL_HTTP_set1_request() for clarityDr. David von Oheimb2021-06-111-14/+14
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15697)
* HTTP client: Fix GET request handling when rctx is reused (keep-alive)Dr. David von Oheimb2021-06-111-15/+15
| | | | | | | This also updates the documentation of OSSL_HTTP_REQ_CTX_set1_req(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15697)
* Add support for ISO 8601 datetime formatWilliam Edmisten2021-06-112-7/+33
| | | | | | | | | | | | | | Fixes #5430 Added the configuration file option "date_opt" to the openssl applications ca, crl and x509. Added ASN1_TIME_print_ex which supports the new datetime format using the flag ASN1_DTFLGS_ISO8601 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14384)
* BIO_write_ex: No error only on 0 bytes to writeTomas Mraz2021-06-111-1/+7
| | | | | | | Fixes #15682 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15672)
* STORE: Make OSSL_STORE_LOADER_fetch() consistent with all other fetch functionsRichard Levitte2021-06-112-5/+5
| | | | | | | | | | The argument order was different on this one. Fixes #15688 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15689)
* dl_name_converter: Avoid unnecessary overallocationTomas Mraz2021-06-111-1/+1
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15680)
* ossl_provider_set_module_path: Prevent potential UAFTomas Mraz2021-06-111-0/+1
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15680)
* Fix use after free in OSSL_HTTP_REQ_CTX_set1_req()Tomas Mraz2021-06-101-9/+16
| | | | | | | | Fixes #15647 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15648)
* err: clear flags better when clearing errors.Pauli2021-06-101-0/+3
| | | | | | | | | | | An attempt to clear an error with malloced data didn't clear the flags. Now it clears all flags except the malloced flag. Fixes #12530 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15667)
* sha: convert SHA one shot macros back to being functionsPauli2021-06-101-0/+26
| | | | | | | | Fixes #15655 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15668)
* DECODER & ENCODER: Add better tracingRichard Levitte2021-06-093-16/+71
| | | | | | | | | Now that we have functions to get the name and properties of the diverse implementations, we can as well display them for clarity. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
* DECODER: Adapt addition of extra decoder implementationsRichard Levitte2021-06-094-69/+114
| | | | | | | | | | | | | | The new PKCS#8 decoder implementation decodes from DER to DER. OSSL_DECODER_CTX_add_extra() wasn't suited for this case; we had to modify it to walk through all existing decoder implementations, and filter out those that aren't suitable. This also turns out to fix the possibility to have more than one extra decoder implementation that produces the same type of encoding, for example several different wrapper formats that all decoder into DER. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
* Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8Richard Levitte2021-06-095-7/+7
| | | | | | | | | | | | | | | | | | | This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
* keymgmt: better detect when a key manager can be reusedPauli2021-06-091-2/+10
| | | | | | | Fixes #14159 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15652)
* Simplify error reporting in X509_PUBKEY_get0()Matt Caswell2021-06-081-20/+8
| | | | | | | | | | The X509_PUBKEY_get0() was attempting to recreate any errors that might have occurred from the earlier decode process when obtaining the EVP_PKEY. This is brittle at best and the approach would only work with legacy keys. We remove this and just report an error directly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
* Actually use a legacy route in pem_read_bio_key_legacy()Matt Caswell2021-06-083-18/+20
| | | | | | | | | | The function pem_read_bio_key_legacy() is a fallback route if we failed to load a key via a provider. We should be using the legacy specific d2i functions to force legacy otherwise we end up using a provider anyway Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
* Only use the legacy route to decode a public key if we have toMatt Caswell2021-06-081-2/+19
| | | | | | | | | | | | We should use a provider to decode a SubjectPublicKeyInfo structure if we can. We should only use the legacy route if we are forcing legacy, or if an ENGINE is in use. Fixes #15393 Fixes #15327 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
* Ensure that we consume all the data when decoding an SPKIMatt Caswell2021-06-081-2/+13
| | | | | | | | If we are decoding a SubjectPublicKeyInfo structure then we must use all of the data and must not have bytes "left over". Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
* Use the right class/tag when decoding an embedded keyMatt Caswell2021-06-081-1/+25
| | | | | | | | | | When a key (SubjectPublicKeyInfo) is embedded in some other structure it may use an implicit tag. However the decoders can only handle the universal class and don't know how to interpret the implicit tag. Therefore we modify the data into a form the decoders can handle. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
* Fix CTLOG_new_from_base64_ex()Matt Caswell2021-06-081-1/+1
| | | | | | | Ensure that the libctx/propq are passed to d2i_PUBKEY_ex() Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
* evp: avoid some calls to EVP_CIPHER_CTX_get_iv_length() because it's been ↵Pauli2021-06-081-2/+2
| | | | | | | called already Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
* evp: fix Coverity 1485670 argument cannot be negativePauli2021-06-081-4/+7
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
* evp: fix Coverity 1485669 improper use of negative valuePauli2021-06-081-0/+4
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
* evp: fix Coverity 1485668 argument cannot be negativePauli2021-06-081-1/+5
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15635)
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-06 01:21:16 +0100