summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Fix GOST test with disabled enginetb2023-06-191-1/+5
|
* Properly guard ENGINE usage with !OPENSSL_NO_ENGINEtb2023-06-191-1/+5
|
* Dedoxigenize ecdsa.htb2023-06-191-133/+5
| | | | | | | These functions are properly documented and upcoming surgery in here is going to be tricky enough without having to navigate around this noise. No code change.
* Turns out EC_KEY_METHOD_new() has dup built in...tb2023-06-181-21/+3
| | | | | | | ... because RSA_meth_new() doesn't. So we can fortunately lose a few lines added in the previous commit. Three cheers for the masters of inconsistency. ok jsing
* tls_signer: reinstate the default EC_KEY methodstb2023-06-181-2/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, we would set the ECDSA_METHOD on the EC_KEY, which, by way of lovely indirection in our three crypto/ec* directories ended up having no effect on the default methods. Now that we set a new EC_KEY_METHOD, we need to make sure we still have the other handlers that we might need. Like so many things that were made opaque in the 1.1 re"design", the accessors were written without actual application code in mind. In particular, EC_KEY_METHOD lacks a dup(). This means we get to fetch the default methods with getters and then set them again on the new method. This is particularly awesome because once someone adds a new method to the opaque struct, all applications will have to adapt and do a get/set dance. So far this is very reminiscent of PostgreSQL with BIO_meth_* https://github.com/postgres/postgres/blob/a14e75eb0b6a73821e0d66c0d407372ec8376105/src/interfaces/libpq/fe-secure-openssl.c#L1921-L1928 Only it's worse here because someone wanted to be smart and save a few public functions, so we have to use getters that get several functions at once. Which in turn means we need to have function pointers with the precise signatures which are part of the struct that was made opaque. We will add a EC_KEY_METHOD_dup() in the next bump, but for now this is the best fix we can have. Whenever you think you've seen the worst turds in this code base, you find another one that could serve as an exemplar. ok jsing op
* Switch tls_ecdsa_do_sign() to EC_KEY_get_ex_data()tb2023-06-181-3/+3
| | | | | | | Since libtls now sets the ex_data with EC_KEY_set_ex_data(), the do_sign() callback needs to have a matching change. ok jsing op
* libtls: switch ECDSA_METHOD usage to EC_KEY_METHODop2023-06-183-17/+12
| | | | | | | | | | | smtpd and the bits it needs in libtls are the only consumer left of ECDSA_METHOD, which is long deprecated. This paves the way for the removal in libcrypto. The diff is from gilles' work on OpenSMTPD-portable, libretls had a similar diff. ok tb@, jsing@
* Optimise bn_mul2_mulw_addtw() for aarch64.jsing2023-06-171-1/+28
| | | | | This provides significant performance gains for bn_sqr_comba4() and bn_sqr_comba8().
* Speed up Montgomery multiplication.jsing2023-06-171-10/+37
| | | | | | | | | | Factor out and optimise the inner loop for Montgomery multiplication, making use of bn_qwmulw_addqw_addw() to perform Montgomery multiplication by one word in larger steps. This provides a significant performance gain, especially on platforms where bn_qwmulw_addqw_addw() is (or can be) optimised. ok tb@
* Fix CRYPTO_get_ex_new_index() to return 1 or highertb2023-06-161-2/+2
| | | | | | | | | | Mixing SSL_{get,set}_ex_data() and and SSL_{get,set}_app_data() in the same application causes problems since they both place their data at the same spot. From Marc Aldorasi ok jsing
* Teach the grotty X509_certificate_type() about Ed25519 certstb2023-06-151-1/+4
| | | | ok jsing
* regentb2023-06-151-1/+9
|
* Add RSA with the sha3s to obj_xref.txttb2023-06-151-0/+4
| | | | ok jsing
* regen obj_xref.htb2023-06-151-12/+14
| | | | (this and the Ed25519 addition to obj_xref.txt were ok jsing)
* Add Ed25519 to the obj_xref table.tb2023-06-151-3/+6
| | | | | Also move part of for RSA-PSS to the top since it doesn't only apply to RSA-PSS.
* Some fixes in ASN1_item_verify()tb2023-06-151-17/+8
| | | | | | | | Switch to using EVP_DigestVerify(). Move the freeing of in where it belongs (previously it would leak on EVP_DigestVerifyUpdate() failure), and use the proper idiom for ASN1_item_i2d() error checking. ok jsing
* Make another NULL check explicit and put a brace on the proper linetb2023-06-151-4/+3
|
* Rename a few variables and other cosmeticstb2023-06-151-23/+21
| | | | | | | Rename buf_in into in, buf_out into out, use in_len and out_len for their lengths, drop a couple of silly casts and remove some empty lines. ok jsing
* Switch ASN1_item_sign_ctx() to EVP_DigestSign()tb2023-06-151-9/+7
| | | | | | | | | This makes this function work with Ed25519 and cleans up a handful of ugly contortions: use EVP_DigestSign() to determine the signature length instead of using the strange EVP_PKEY_size() and garbage collect the now useless out_len. Also use calloc(). ok jsing
* Make NULL checks explicit in ASN1_item_sign_ctx()tb2023-06-151-6/+8
| | | | | | | Also move the NULL check for the EVP_MD into the rv == 2 path, which is the only branch where it is used. ok jsing
* ASN1_item_sign_ctx()tb2023-06-151-3/+7
| | | | | | Pull a NULL check for pkey->ameth up to before ameth is first accessed. An EVP_PKEY created with EVP_PKEY_new() has ameth == NULL, so this check makes sense, but it does not make sense to do it where it was.
* Fix a logic error in ASN1_item_sign_ctx()tb2023-06-151-5/+8
| | | | | | | | | | | If the item_sign() ASN.1 method returns 1, it supposedly handles everything and the goto err prior to r1.5 was actually a success path. Go figure. This is fortunately inconsequential since there are only two item_sign() methods, one for RSA and one for Ed25519, neither of which can return 1. They only return 0, 2, and 3. Pointed out by and ok jsing
* Move comment about ASN1_item_dup() where it belongstb2023-06-131-7/+7
| | | | | Reword it in such a way that it stands on its own and doesn't refer to a non-existent model above. Also tweak grammar and fix typos.
* Disallow aliasing of return value and modulustb2023-06-131-1/+44
| | | | | | | | | | | All the functions changed in this commit would silently misbehave if the return value aliases the modulus, most of the time they would succeed and return an incorrect result of 0 in that situation. This adjusts all the functions in BN_mod.c, others and documentation will follow later. Prompted by a bug report about BN_mod_inverse() by Guido Vranken. ok jsing
* Add a BN_R_INVALID_ARGUMENT error codetb2023-06-132-2/+4
| | | | | | | | | | One problem with OpenSSL error codes is that they tend to be too specific (another problem is that they are extremely ugly). So add an EINVAL-style error code. This will be used in an upcoming commit to disallow aliasing of the 'return value' with the modulus in BN_mod_* functions and should be applicable elsewhere, outside of this one narrow use case. ok jsing
* Remove prototypes for various ec_GF2m_* functions that no longer exist.jsing2023-06-121-13/+1
|
* Optimise quad word primitives on aarch64.jsing2023-06-121-1/+136
| | | | This provides a performance gain across most BN operations.
* Provide and use various quad word primitives.jsing2023-06-123-27/+120
| | | | | | | | This includes bn_qwaddqw(), bn_qwsubqw(), bn_qwmulw_addw() and bn_qwmulw_addqw_addw(). These can typically be optimised on architectures that have a reasonable number of general purpose registers. ok tb@
* Convert legacy server kex to one-shot sign/verifytb2023-06-112-47/+62
| | | | | | | | | | This converts ssl3_{get,send}_server_key_exchange() to EVP_DigestVerify() and EVP_DigestSign(). In order to do this, build the full signed_params up front and rework the way the key exchange parameters are constructed. This way we can do the verify and sign steps in one go and at the same use a more idiomatic approach with CBB/CBS. with/ok jsing
* Easy EVP_Digest{Sign,Verify} conversions for legacy stacktb2023-06-112-23/+8
| | | | | | | Convert ssl3_send_client_verify_{sigalgs,gost}() to EVP_DigestSign() and ssl3_get_cert_verify() to EVP_DigestVerify(). ok jsing
* remove unused args_st structjsg2023-06-112-12/+2
| | | | ok tb@
* remove chopup_args() unused since apps.c rev 1.31jsg2023-06-112-72/+2
| | | | ok tb@
* openssl enc: drop a few parens and unwrap a few linestb2023-06-111-20/+14
| | | | No binary change on amd64
* openssl enc: small style fixup after ZLIB unifdeftb2023-06-111-4/+2
|
* Unifdef ZLIBtb2023-06-112-44/+2
| | | | | This is very dead code: the openssl app was never compiled with -DZLIB after January 1, 2015.
* Unifdef ZLIBtb2023-06-117-739/+7
| | | | | | | This has long been unused code and compilation with -DZLIB was broken for a long time after BIO was made opaque. ok jsing
* Convert EVP_Digest{Sign,Verify}* to one-shot for TLSv1.3tb2023-06-102-22/+10
| | | | | | | Using one-shot EVP_DigestSign() and EVP_DigestVerify() is slightly shorter and is needed for Ed25519 support. ok jsing
* File new test-bleichenbacher-timing-pregenerate.py under failing teststb2023-06-101-1/+3
| | | | until someone finds time and motivation to figure out how to use this.
* Remove dead code.beck2023-06-081-13/+3
| | | | | | | | must_be_ca can no longer be 0 after the proxy cert code got nuked, so change this to an if. must_be_ca is now -1 for a leaf, or 1 for a non leaf. ok tb@
* From the description of "openssl verify", delete the duplicate andschwarze2023-06-081-130/+9
| | | | | | | outdated list of error messages. Instead, refer to the master copy of that list in X509_STORE_CTX_get_error(3). Suggested by and OK tb@, and beck@ also agrees with the idea.
* Add portable version and m88k-specific version lb() function, becauseaoyama2023-06-071-1/+21
| | | | | | unfortunately gcc3 does not have __builtin_clz(). ok miod@ otto@
* Refer to the field "thisUpdate" instead of the non-existent "lastUpdate".schwarze2023-06-071-4/+10
| | | | | Similar to X509_get0_notBefore(3) rev. 1.6. Requested by and OK tb@.
* In 1995, Eric A. Young chose a confusing name for the "lastUpdate" fieldschwarze2023-06-062-12/+20
| | | | | | | | | | | | | | | of the X509_CRL_INFO object. It should have been called "thisUpdate" like in RFC 5280 section 5.1 (and in its precursor RFC 2459). Then again, RFC 2459 was only published in 1999, so maybe the terminology wasn't firmly established yet when Young wrote his code several years earlier - just guessing, neither we nor the OpenSSL folks appear to know the real reasons... Anyway, we have been stuck with the "lastUpdate" names in the API for more than two decades now, so clarify in the documentation what they refer to and what they really mean. Requested by and OK tb@.
* Fix typo in comment: exta -> extratb2023-06-061-2/+2
|
* Fix copy+paste error in x509 asn regressjob2023-06-051-3/+3
|
* Improve the description of CMS_get0_signers()job2023-06-051-3/+3
| | | | | | | | | | Suggestion from Małgorzata Olszówka, they noted: "The original wording suggests that it is required to execute CMS_get0_signers() after CMS_verify(), while it is CMS_get0_signers() that requires prior successful invocation of CMS_verify()." OK tb@
* Reinstate bn_isqrt.c r1.8 and crypto_lock.c r1.3tb2023-06-042-8/+5
| | | | | | | | | | | | | | | This traded local copies of CTASSERT() to the one in crypto_internal.h. This change was backed out due to SHA-512 breakage on STRICT_ALIGNMENT architectures still using Fred Flintstone's gcc without asm sha512. Original commit message: Use crypto_internal.h's CTASSERT() Now that this macro is available in a header, let's use that version rather than copies in several .c files. discussed with jsing
* Make ruby-openssl cope with default ruby changetb2023-06-041-2/+2
|
* bn_mod_inverse tweakstb2023-06-041-2/+4
| | | | | Provide prototype that is hidden behind LIBRESSL_INTERNAL for portable and or in result for future extensibility.
* More thorough write-afetr-free checks.otto2023-06-043-25/+54
| | | | | | | | | | | | | | | | | | | On free, chunks (the pieces of a pages used for smaller allocations) are junked and then validated after they leave the delayed free list. So after free, a chunk always contains junk bytes. This means that if we start with the right contents for a new page of chunks, we can *validate* instead of *write* junk bytes when (re)-using a chunk. With this, we can detect write-after-free when a chunk is recycled, not justy when a chunk is in the delayed free list. We do a little bit more work on initial allocation of a page of chunks and when re-using (as we validate now even on junk level 1). Also: some extra consistency checks for recallocaray(3) and fixes in error messages to make them more consistent, with man page bits. Plus regress additions.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-03 05:32:58 +0000