openbsd/src/lib/libcrypto/evp/pmeth_gn.c, branch OPENBSD_7_9_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE2025-05-10T05:54:39+00:00Use err_local.h rather than err.h in most places2025-05-10T05:54:39+00:00tb2025-05-10T05:54:39+00:00urn:sha1:41e8f99dd1625a9f0c80ce9d4383e95b18e85709
ok jsing
Remove EVP_PKEY_*check again2024-08-31T09:14:21+00:00tb2024-08-31T09:14:21+00:00urn:sha1:4d0ecb9ca6915541794e3cc736907b89e9a1dd6c
This API turned out to be a really bad idea. OpenSSL 3 extended it, with
the result that basically every key type had its own DoS issues fixed in
a recent security release. We eschewed these by having some upper bounds
that kick in when keys get insanely large.
Initially added on tobhe's request who fortunately never used it in iked,
this was picked up only by ruby/openssl (one of the rare projects doing
proper configure checks rather than branching on VERSION defines) and of
course xca, since it uses everything it can. So it was easy to get rid of
this again.
ok beck jsing
Remove the pkey_{,public_,param_}check() handlers2024-08-29T16:58:19+00:00tb2024-08-29T16:58:19+00:00urn:sha1:c8099c070f0c547b73edced83591dbd871254307
This disables the EVP_PKEY_*check() API and makes it fail (more precisely
indicate lack of support) on all key types.
This is an intermediate step to full removal.
Removal is ok beck jsing
Avoid NULL dereference in EVP_PKEY_paramgen()2024-04-17T08:24:11+00:00tb2024-04-17T08:24:11+00:00urn:sha1:45a8e0db1f38d21dc63b95b0d633001999317a8c
If EVP_PKEY_new() returns NULL, it would be passed to the paramgen() pmeth
which would typically dereference it. This is identical to a recent change
in keygen().
ok jsing
Garbage collect various *_init() pmeths2024-04-12T09:41:39+00:00tb2024-04-12T09:41:39+00:00urn:sha1:7998df60d7c72723241b97acb596059b0acf7304
It's unclear whether the functions these support were ever really
used for anything else than kicking off an overenginerred state
machine.
ok jsing
Fix a potential NULL-deref in EVP_PKEY_keygen()2024-04-12T02:56:15+00:00tb2024-04-12T02:56:15+00:00urn:sha1:0a205e68cd412068ae18a91fae04a368561d093d
After a EVP_PKEY_new() failure, a NULL pointer would be passed to the
keygen pmeth, which could result in tears.
ok beck jsing
Hide public symbols in evp.h2024-04-09T13:52:42+00:00beck2024-04-09T13:52:42+00:00urn:sha1:9835bb3c82adc630df1f3aaa7dfbf7f0506b0bc4
largely mechanically done by the guentherizer 9000
ok tb@
Fix bounds check in EVP_PKEY_CTX_get_keygen_info()2024-01-01T18:33:04+00:00tb2024-01-01T18:33:04+00:00urn:sha1:9812b741aad62722b8886907a81243c5c70ae750
Replace > with >= for the upper array bound to disallow a 4 byte
overread. For RSA you can read the padding mode and for DH past
the DH_PKEY_CTX. Unfortunately, Ruby thought it important to use
this, so we can't kill it easily.
ok miod
Ignore ENGINE at the API boundary2023-11-29T21:35:57+00:00tb2023-11-29T21:35:57+00:00urn:sha1:69bbc5fea4f411f0c0033ecb0fc5126c895ea82a
This removes the remaining ENGINE members from various internal structs
and functions. Any ENGINE passed into a public API is now completely
ignored functions returning an ENGINE always return NULL.
ok jsing
Unbreak the namespace build after a broken mk.conf and tool misfire had2023-07-07T19:37:54+00:00beck2023-07-07T19:37:54+00:00urn:sha1:1ca8095297adf80b48019b5a2d18010ff9e3427f
me aliasing symbols not in the headers I was procesing.
This unbreaks the namespace build so it will pass again
ok tb@