summaryrefslogtreecommitdiffstats
path: root/crypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Copyright year updatesTomas Mraz2024-09-05181-182/+182
| | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
* EVP_CIPHER_CTX_get_algor_params() may attempt to access params arrayAlexandr Nedvedicky2024-09-031-1/+3
| | | | | | | | | | | at position -1 (prams[=1]). The issue has been reported by coverity check. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25303)
* s390x: Disable HMAC hardware acceleration when an engine is used for the digestIngo Franzki2024-09-031-0/+36
| | | | | | | | | | | | | | | | | | | | | The TLSProxy uses the 'ossltest' engine to produce known output for digests and HMAC calls. However, when running on a s390x system that supports hardware acceleration of HMAC, the engine is not used for calculating HMACs, but the s390x specific HMAC implementation is used, which does produce correct output, but not the known output that the engine would produce. This causes some tests (i.e. test_key_share, test_sslextension, test_sslrecords, test_sslvertol, and test_tlsextms) to fail. Disable the s390x HMAC hardware acceleration if an engine is used for the digest of the HMAC calculation. This provides compatibility for engines that provide digest implementations, and assume that these implementations are also used when calculating an HMAC. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25287)
* Avoid type errors in EAI-related name check logic.Viktor Dukhovni2024-09-031-25/+53
| | | | | | | | | | | | | | | | | | | The incorrectly typed data is read only, used in a compare operation, so neither remote code execution, nor memory content disclosure were possible. However, applications performing certificate name checks were vulnerable to denial of service. The GENERAL_TYPE data type is a union, and we must take care to access the correct member, based on `gen->type`, not all the member fields have the same structure, and a segfault is possible if the wrong member field is read. The code in question was lightly refactored with the intent to make it more obviously correct. Fixes CVE-2024-6119 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
* Add support for elf_aux_info() on OpenBSDBrad Smith2024-09-022-4/+6
| | | | | | | | | CLA: trivial Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25346)
* Missing .rodata for AVX2/AVX512 codepathsTheo Buehler2024-09-025-7/+9
| | | | | | | | | This is a follow-up to #23997 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25340)
* Detect MinGW 32 bit for NO_INTERLOCKEDOR64Adam (ThinLinc team)2024-09-021-1/+1
| | | | | | | | | | Builds using 32 bit MinGW will fail, due to the same reasoning described in commit 2d46a44ff24173d2cf5ea2196360cb79470d49c7. CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25025)
* s390x: Fix HMAC digest detectionIngo Franzki2024-09-021-11/+5
| | | | | | | | | | | | | Use EVP_MD_is_a() instead of EVP_MD_get_type() to detect the digest type. EVP_MD_get_type() does not always return the expected NID, e.g. when running in the FIPS provider, EVP_MD_get_type() returns zero, causing to skip the HMAC acceleration path. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25304)
* Improve base64 BIO correctness and error reportingViktor Dukhovni2024-08-302-64/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also improve related documentation. - The BIO_FLAGS_BASE64_NO_NL flag did not behave as advertised, only leading and trailing, but not internal, whitespace was supported: $ echo 'AA AA' | openssl base64 -A -d | wc -c 0 - Switching from ignored leading input to valid base64 input misbehaved when the length of the skipped input was one more than the length of the second and subsequent valid base64 lines in the internal 1k buffer: $ printf '#foo\n#bar\nA\nAAA\nAAAA\n' | openssl base64 -d | wc -c 0 - When the underlying BIO is retriable, and a read returns less than 1k of data, some of the already buffered input lines that could have been decoded and returned were retained internally for a retry by the caller. This is somewhat surprising, and the new code decodes as many of the buffered lines as possible. Issue reported by Michał Trojnara. - After all valid data has been read, the next BIO_read(3) should return 0 when the input was all valid or -1 if an error was detected. This now occurs in more consistently, but further tests and code refactoring may be needed to ensure this always happens. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25253)
* s390x: support CPACF sha3/shake performance improvementsJoerg Schmidbauer2024-08-293-3/+12
| | | | | | | | | | | | | | | | | | On newer machines the SHA3/SHAKE performance of CPACF instructions KIMD and KLMD can be enhanced by using additional modifier bits. This allows the application to omit initializing the ICV, but also affects the internal processing of the instructions. Performance is mostly gained when processing short messages. The new CPACF feature is backwards compatible with older machines, i.e. the new modifier bits are ignored on older machines. However, to save the ICV initialization, the application must detect the MSA level and omit the ICV initialization only if this feature is supported. Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25235)
* Add ED25519 and ED448 support for EVP_PKEY_{sign,verify}_init_ex2()Richard Levitte2024-08-291-0/+2
| | | | | | | | | | | In this mode, only the ph instances are supported, and must be set explicitly through a parameter. The caller is assumed to pass a prehash to EVP_PKEY_{sign,verify}(). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24975)
* Refactor OpenSSL 'EdDSA' EVP_SIGNATURE to allow use with EVP_PKEY functionsRichard Levitte2024-08-292-19/+4
| | | | | | | | | | | | Add EVP_PKEY_{sign,verify}_message support for our Ed25519 and Ed448 implementations, including ph and ctx variants. Tests are added with test_evp stanzas. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24975)
* EVP_MD_size() updatesslontis2024-08-2911-13/+20
| | | | | | | | | | For SHAKE algorithms we now return 0 from EVP_MD_size(). So all the places that check for < 0 needed to change to <= 0 (Otherwise the behaviour will be to digest nothing in most cases). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25285)
* Update code to use EVP_MD_xof()slontis2024-08-291-5/+5
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25285)
* XOF / EVP_MD_size() changes.slontis2024-08-292-13/+40
| | | | | | | | | | | | | | | | | | | | | Added the function EVP_MD_CTX_get_size_ex() which checks for XOF and does a ctx get rather than just returning EVP_MD_size(). SHAKE did not have a get_ctx_params() so that had to be added to return the xoflen. Added a helper function EVP_MD_xof() EVP_MD_CTX_size() was just an aliased macro for EVP_MD_size(), so to keep it the same I added an extra function. EVP_MD_size() always returns 0 for SHAKE now, since it caches the value of md_size at the time of an EVP_MD_fetch(). This is probably better than returning the incorrect initial value it was before e.g (16 for SHAKE128) and returning tht always instead of the set xoflen. Note BLAKE2B uses "size" instead of "xoflen" to do a similar thing. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25285)
* RSA decoder should check also sanity of p, q, e, d ... with respect to nsashan2024-08-282-0/+56
| | | | | | | | | | | | | | | | | | This issue has been discovered by osss-fuzzer [1]. The test function decodes RSA key created by fuzzer and calls EVP_PKEY_pairwise_check() which proceeds to ossl_bn_miller_rabin_is_prime() check which takes too long exceeding timeout (45secs). The idea is to fix OSSL_DECODER_from_data() code path so invalid RSA keys will be refused. [1] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69134 Test case generated by the fuzzer is added. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25190)
* feat: add support for issuedOnBehalfOf X.509v3 extensionJonathan M. Wilbur2024-08-274-1/+35
| | | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25241)
* fix coding styleRichard Levitte2024-08-271-73/+73
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25000)
* feat: Implement EVP_PKEY_CTX_{set,get}_algor_params() and ↵Richard Levitte2024-08-271-0/+116
| | | | | | | | | | | | | | | | | EVP_PKEY_CTX_get_algor() This should be sufficient to cover the intent with the following legacy ctrls: - EVP_PKEY_CTRL_PKCS7_ENCRYPT (through EVP_ASYM_CIPHER implementations) - EVP_PKEY_CTRL_PKCS7_DECRYPT (through EVP_ASYM_CIPHER implementations) - EVP_PKEY_CTRL_PKCS7_SIGN (through EVP_SIGNATURE implementations) - EVP_PKEY_CTRL_CMS_ENCRYPT (through EVP_ASYM_CIPHER implementations) - EVP_PKEY_CTRL_CMS_DECRYPT (through EVP_ASYM_CIPHER implementations) - EVP_PKEY_CTRL_CMS_SIGN (through EVP_SIGNATURE implementations) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25000)
* feat: Implement EVP_CIPHER_CTX_{set,get}_algor_params() and ↵Richard Levitte2024-08-273-44/+144
| | | | | | | | | | | EVP_CIPHER_CTX_get_algor() EVP_CIPHER_CTX_set_algor_params() and EVP_CIPHER_CTX_set_algor_params() can be used instead of EVP_CIPHER_asn1_to_param() and EVP_CIPHER_param_to_asn1(). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25000)
* fix: alias auditEntity OIDJonathan M. Wilbur2024-08-264-962/+966
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24754)
* feat: support auditIdentity X.509v3 extensionJonathan M. Wilbur2024-08-266-886/+908
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24754)
* fix: wrong name for OID -> auditIdentityJonathan M. Wilbur2024-08-263-1839/+1841
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24754)
* FIPS: Add EDDSA public key validation.slontis2024-08-232-0/+37
| | | | | | | | | | | | | | | EVP_PKEY_public_check() can be used by ED25519 and ED448 in order to determine if the public key is a valid point on the curve. The FIPS ACVP tests require public key validation tests. See https://github.com/usnistgov/ACVP-Server/blob/master/gen-val/json-files/EDDSA-KeyVer-1.0/internalProjection.json Note that this is NOT required to be called before EDDSA signature verification since it is done internally. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25265)
* s390x: Fix memory leak in s390x_HMAC_CTX_copy()Ingo Franzki2024-08-231-0/+1
| | | | | | | | | | | | When s390x_HMAC_CTX_copy() is called, but the destination context already has a buffer allocated, it is not freed before duplicating the buffer from the source context. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/25238)
* ossl_ht_insert(): Allow for 4 iterations of grow_hashtable()Tomas Mraz2024-08-221-1/+1
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25273)
* Replace PKCS#1 v1.5 padding in RSA PCTJoachim Vandersmissen2024-08-211-19/+55
| | | | | | | | | | | | | | | | | After December 31, 2023, SP 800-131Ar2 [0] no longer allows PKCS#1 v1.5 padding for RSA "key-transport" (aka encryption and decryption). There's a few good options to replace this usage in the RSA PCT, but the simplest is verifying m = (m^e)^d mod n, (where 1 < m < (n − 1)). This is specified in SP 800-56Br2 (Section 6.4.1.1) [1] and allowed by FIPS 140-3 IG 10.3.A. In OpenSSL, this corresponds to RSA_NO_PADDING. [0]: https://doi.org/10.6028/NIST.SP.800-131Ar2 [1]: https://doi.org/10.6028/NIST.SP.800-56Br2 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23832)
* Replace PKCS#1 v1.5 encryption in RSA PCTJoachim Vandersmissen2024-08-211-27/+13
| | | | | | | | | | | | | | | After December 31, 2023, SP 800-131Ar2 [0] no longer allows PKCS#1 v1.5 padding for RSA "key-transport" (aka encryption and decryption). There's a few good options to replace this usage in the RSA PCT, but signature generation and verification using PKCS#1 v1.5 padding (which remains approved) is the simplest. [0]: https://doi.org/10.6028/NIST.SP.800-131Ar2 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23832)
* Fix error handling in OBJ_add_objectBernd Edlinger2024-08-211-4/+16
| | | | | | | | | | | | | | | This fixes the possible memory leak in OBJ_add_object when a pre-existing object is replaced by a new one, with identical NID, OID, and/or short/long name. We do not try to delete any orphans, but only mark them as type == -1, because the previously returned pointers from OBJ_nid2obj/OBJ_nid2sn/OBJ_nid2ln may be cached by applications and can thus not be cleaned up before the application terminates. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22534)
* x_attrib: fix a memory leakBeat Bolli2024-08-211-2/+3
| | | | | | | | | | | | | | | The X509_NAME object needs to be free'd even if printing it fails. Introduced in be5adfd6e3 ("Support subjectDirectoryAttributes and associatedInformation exts", 2024-06-18), but subsequently moved in 7bcfb41489 ("ossl_print_attribute_value(): use a sequence value only if type is a sequence", 2024-08-05). Signed-off-by: Beat Bolli <dev@drbeat.li> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25207)
* hashtable.c: Code style fixesTomas Mraz2024-08-211-6/+6
| | | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24504)
* core_namemap.c: 2048 hashtable buckets should be sufficientTomas Mraz2024-08-211-1/+1
| | | | | | | | | | It is unlikely we would need more than 4000 names and even with more names (up to 8192) it would still work, just the performance fo the namemap would degrade. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24504)
* For lockless reads use the whole hashtable for colliding entriesTomas Mraz2024-08-211-43/+71
| | | | | | | | | | | | Instead of just using the neighborhood, fill subsequent neighborhoods with colliding entries. If the hashtable is properly sized, it won't degrade performance too much. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24504)
* Use the new hashtable for core_namemapTomas Mraz2024-08-213-128/+142
| | | | | | | | | | | | This replaces LHASH in core_namemap with the new hashtable and adds a reverse mapping in form of stack of stacks instead of iterating the existing hash table members. The new hashtable is used in lockless-read mode. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24504)
* hashtable: Support lockless readsTomas Mraz2024-08-212-6/+13
| | | | | | | | | Also build it in the FIPS provider too and properly report error on insert when hashtable cannot be grown. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24504)
* hashtable.c: Avoid infinite loop in ossl_ht_insert()Tomas Mraz2024-08-211-8/+10
| | | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24504)
* some performance improvementsNeil Horman2024-08-211-11/+12
| | | | | | Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24504)
* alternate collision checking supportNeil Horman2024-08-211-17/+43
| | | | | | | | | | | Add full key matching to hashtable the idea is that on a hash value match we do a full memory comparison of the unhashed key to validate that its actually the key we're looking for Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24504)
* Enable RSA-SM3 in the default providerRichard Levitte2024-08-211-0/+16
| | | | | | | | | | | | It turns out that we didn't allow the combination RSA + SM3 anywhere. This is perfectly reasonable in the FIPS module, but less so in the default provider. This change enables it in the default provider, and adds a simple evp_test stanza for the RSA-SM3 signature scheme. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23416)
* Refactor OpenSSL 'RSA' EVP_SIGNATURE to also include RSA+hash compositesRichard Levitte2024-08-211-0/+4
| | | | | | | | | | | | | | | | | (in the code, "sigalg" is used to refer to these composite algorithms, which is a nod to libcrypto and libssl, where that term is commonly used for composite algorithms) To make this implementation possible, wrappers were added around the hash function itself, allowing the use of existing hash implementations through their respective OSSL_DISPATCH tables, but also retaining the dynamic fetch of hash implementations when the digest_sign / digest_verify functionality is used. This wrapper allows implementing the RSA+hash composites through simple initializer function and a custom OSSL_DISPATCH table for each. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23416)
* Implement functionality for direct use of composite signature algorithmsRichard Levitte2024-08-214-147/+522
| | | | | | | | | | | | | | | | | | | | | | | | The following API groups are extended with a new init function, as well as an update and final function, to allow the use of explicitly fetched signature implementations for any composite signature algorithm, like "sha1WithRSAEncryption": - EVP_PKEY_sign - EVP_PKEY_verify - EVP_PKEY_verify_recover To support this, providers are required to add a few new functions, not the least one that declares what key types an signature implementation supports. While at this, the validity check in evp_signature_from_algorithm() is also refactored; the SIGNATURE provider functionality is too complex for counters. It's better, or at least more readable, to check function combinations. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23416)
* When calling ASN1_item_i2d () check both returned length and allocated pointerXZ-X2024-08-205-5/+9
| | | | | | | Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24979)
* Add FIPS self test updatesslontis2024-08-201-5/+20
| | | | | | | | | | | | | | | | After reviewing the FIPS 140-3 IG self tests requirements the following were added: - TDES Decryption (Not sure why this was missing) - DH changed to use ffdhe2048 instead of P,Q,G params. - Signature code has been changed to use a msg rather than a digest as input. (Since some digests dont provide the one shot API, the EVP_DigestSignFinal and EVP_DigestVerifyFinal needed to be exposed to the FIPS provider). The code is now shared between ED and the other key types. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25217)
* s390x: Add hardware acceleration for HMACIngo Franzki2024-08-195-4/+392
| | | | | | | | | | | | | | | | The CPACF instruction KMAC provides support for accelerating the HMAC algorithm on newer machines for HMAC with SHA-224, SHA-256, SHA-384, and SHA-512. Preliminary measurements showed performance improvements of up to a factor of 2, dependent on the message size, whether chunking is used and the size of the chunks. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25161)
* s390x: Add defines for new CPACF functionsIngo Franzki2024-08-191-1/+10
| | | | | | | | | | | | Add defines for new CPACF functions codes, its required MSA levels, and document how to disable these functions via the OPENSSL_s390xcap environment variable. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25161)
* Explicitly include e_os.h for close()Tomas Mraz2024-08-191-0/+1
| | | | | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25229) (cherry picked from commit 0c0c6954bf4fa7b56e21e1393c9e5e5d55c1b2d6)
* RAND_write_file(): Avoid potential file descriptor leakshridhar kalavagunta2024-08-191-1/+9
| | | | | | | | | | | If fdopen() call fails we need to close the fd. Also return early as this is most likely some fatal error. Fixes #25064 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25081)
* We can't check policy if we got an empty stack of certsDmitry Belyavskiy2024-08-171-0/+2
| | | | | | Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25186)
* Fix unpredictible refcount handling of d2i functionsBernd Edlinger2024-08-161-1/+5
| | | | | | | | | | | | | | | | | | | | | | The passed in reference of a ref-counted object is free'd by d2i functions in the error handling. However if it is not the last reference, the in/out reference variable is not set to null here. This makes it impossible for the caller to handle the error correctly, because there are numerous cases where the passed in reference is free'd and set to null, while in other cases, where the passed in reference is not free'd, the reference is left untouched. Therefore the passed in reference must be set to NULL even when it was not the last reference. Fixes #23713 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22809)
* Add FIPS Indicator for ECDH cofactor.slontis2024-08-151-0/+1
| | | | | | | | | | | FIPS KAS requires use of ECC CDH. The EC 'B' and 'K' curves have a cofactor that is not 1, and this MUST be multiplied by the private key when deriving the shared secret. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25139)
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-29 16:38:24 +0100