summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/evp/pmeth_gn.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Remove EVP_PKEY_*check againtb2024-08-311-29/+1
| | | | | | | | | | | | | | | This API turned out to be a really bad idea. OpenSSL 3 extended it, with the result that basically every key type had its own DoS issues fixed in a recent security release. We eschewed these by having some upper bounds that kick in when keys get insanely large. Initially added on tobhe's request who fortunately never used it in iked, this was picked up only by ruby/openssl (one of the rare projects doing proper configure checks rather than branching on VERSION defines) and of course xca, since it uses everything it can. So it was easy to get rid of this again. ok beck jsing
* Remove the pkey_{,public_,param_}check() handlerstb2024-08-291-49/+11
| | | | | | | | This disables the EVP_PKEY_*check() API and makes it fail (more precisely indicate lack of support) on all key types. This is an intermediate step to full removal. Removal is ok beck jsing
* Avoid NULL dereference in EVP_PKEY_paramgen()tb2024-04-171-6/+8
| | | | | | | | If EVP_PKEY_new() returns NULL, it would be passed to the paramgen() pmeth which would typically dereference it. This is identical to a recent change in keygen(). ok jsing
* Garbage collect various *_init() pmethstb2024-04-121-19/+9
| | | | | | | | It's unclear whether the functions these support were ever really used for anything else than kicking off an overenginerred state machine. ok jsing
* Fix a potential NULL-deref in EVP_PKEY_keygen()tb2024-04-121-6/+8
| | | | | | | After a EVP_PKEY_new() failure, a NULL pointer would be passed to the keygen pmeth, which could result in tears. ok beck jsing
* Hide public symbols in evp.hbeck2024-04-091-1/+12
| | | | | | largely mechanically done by the guentherizer 9000 ok tb@
* Fix bounds check in EVP_PKEY_CTX_get_keygen_info()tb2024-01-011-2/+2
| | | | | | | | | Replace > with >= for the upper array bound to disallow a 4 byte overread. For RSA you can read the padding mode and for DH past the DH_PKEY_CTX. Unfortunately, Ruby thought it important to use this, so we can't kill it easily. ok miod
* Ignore ENGINE at the API boundarytb2023-11-291-2/+2
| | | | | | | | This removes the remaining ENGINE members from various internal structs and functions. Any ENGINE passed into a public API is now completely ignored functions returning an ENGINE always return NULL. ok jsing
* Unbreak the namespace build after a broken mk.conf and tool misfire hadbeck2023-07-071-12/+1
| | | | | | | | me aliasing symbols not in the headers I was procesing. This unbreaks the namespace build so it will pass again ok tb@
* Hide symbols in hkdf, evp, err, ecdsa, and ecbeck2023-07-071-1/+12
| | | | | | (part 2 of commit) ok jsing@
* Make internal header file names consistenttb2022-11-261-4/+4
| | | | | | | | | | | | | | | | Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook
* Prepare to provide EVP_PKEY_{public,param}_checktb2022-01-101-1/+43
| | | | | | | | | | | | | | This implements checking of a public key and of key generation parameters for DH and EC keys. With the same logic and setters and const quirks as for EVP_PKEY_check(). There are a couple of quirks: For DH no default EVP_PKEY_check() is implemented, instead EVP_PKEY_param_check() calls DH_check_ex() even though DH_param_check_ex() was added for this purpose. EVP_PKEY_public_check() for EC curves also checks the private key if present. ok inoguchi jsing
* Prepare to provide EVP_PKEY_check()tb2022-01-101-1/+23
| | | | | | | | | | | | | | | | | | This allows checking the validity of an EVP_PKEY. Only RSA and EC keys are supported. If a check function is set the EVP_PKEY_METHOD, it will be used, otherwise the check function on the EVP_PKEY_ASN1_METHOD is used. The default ASN.1 methods wrap RSA_check_key() and EC_KEY_check_key(), respectively. The corresponding setters are EVP_PKEY_{asn1,meth}_set_check(). It is unclear why the PKEY method has no const while the ASN.1 method has const. Requested by tobhe and used by PHP 8.1. Based on OpenSSL commit 2aee35d3 ok inoguchi jsing
* Add #include "bn_lcl.h" to the files that will soon need it.tb2021-12-041-1/+2
| | | | ok inoguchi jsing
* Add semicolon that will become non-optional once BN_GENCB_set() willtb2021-11-181-2/+2
| | | | move from an awful macro to a proper function.
* Send the function codes from the error functions to the bit bucket,beck2017-01-291-11/+7
| | | | | | as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@
* if (x) FOO_free(x) -> FOO_free(x).miod2014-07-121-3/+2
| | | | | | | Improves readability, keeps the code smaller so that it is warmer in your cache. review & ok deraadt@
* Only import cryptlib.h in the four source files that actually need it.jsing2014-07-111-4/+6
| | | | | | | | Remove the openssl public includes from cryptlib.h and add a small number of includes into the source files that actually need them. While here, also sort/group/tidy the includes. ok beck@ miod@
* tags as requested by miod and teduderaadt2014-06-121-1/+1
|
* KNF.jsing2014-05-071-64/+69
|
* import OpenSSL-1.0.1cdjm2012-10-131-2/+3
|
* import OpenSSL-1.0.0adjm2010-10-011-0/+220
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-28 08:54:38 +0000