summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Move BN structs to bn_lcl.htb2022-01-142-50/+46
| | | | | | This makes all structs in bn.h opaque that are also opaque in OpenSSL. ok inoguchi jsing
* Remove BIO_s_file_internaltb2022-01-141-4/+1
| | | | | | | Pointed out by schwarze. How something with this name ever made its way into a public header will remain a mystery. ok inoguchi jsing
* Remove ASN1{_const,}_check_infinite_endtb2022-01-142-30/+2
| | | | | | Suggested by schwarze ok inoguchi jsing
* Remove ASN1{,_const}_CTXtb2022-01-141-35/+1
| | | | | | | These are leftovers of the old ASN.1 stuff. Nothing uses this. OpenSSL removed them in a469a677. ok inoguchi jsing
* Remove X509_OBJECT_free_contentstb2022-01-142-19/+11
| | | | | | | | Inline X509_OBJECT_free_contents() in X509_OBJECT_free() and remove this dangerous API. It was left over when x509_vfy.h was made opaque. ok inoguchi jsing
* Remove PEM_Seal{Init,Update,Final}tb2022-01-143-223/+3
| | | | | | This unused, bug-ridden API was removed in OpenSSL commit 0674427f. ok inoguchi jsing
* Unifdef LIBRESSL_OPAQUE_* and LIBRESSL_NEXT_APItb2022-01-1410-112/+10
| | | | | This marks the start of major surgery in libcrypto. Do not attempt to build the tree for a while (~50 commits).
* ASN1_{,F,T}BOOLEAN_it and the encoding and decoding API will movetb2022-01-125-147/+7
| | | | | | to internal only soon. Stop documenting them. ok inoguchi jsing
* Fix typo in header guardtb2022-01-121-3/+3
|
* Document EVP_AEAD_CTX_{new,free}() and adjust example code.tb2022-01-101-6/+45
| | | | looks good to jsing
* Remove a few unused defines from x509.htb2022-01-101-6/+1
| | | | | | | | As suggested by schwarze, this removes X509_EX_V_{INIT,NETSCAPE_HACK} and X509_EXT_PACK_{STRING,UNKNOWN} ok inoguchi jsing
* Prepare to provide the EVP_MD_meth_* APItb2022-01-102-2/+130
| | | | | | | | | This allows implementations to add their own EVP_MD_METHODs. Only the setters are provided. This is used by erlang for the otp_test_engine. ok inoguchi jsing
* Prepare to provide EVP_PKEY_{public,param}_checktb2022-01-108-8/+146
| | | | | | | | | | | | | | This implements checking of a public key and of key generation parameters for DH and EC keys. With the same logic and setters and const quirks as for EVP_PKEY_check(). There are a couple of quirks: For DH no default EVP_PKEY_check() is implemented, instead EVP_PKEY_param_check() calls DH_check_ex() even though DH_param_check_ex() was added for this purpose. EVP_PKEY_public_check() for EC curves also checks the private key if present. ok inoguchi jsing
* Provide DH_check*_ex and many error codestb2022-01-104-4/+102
| | | | | | | | | | | | | | | | | | | | | DH_check{,_pub_key}_ex() wrap their non-ex versions to translate the flags argument of the original functions into OpenSSL errors. For this almost a dozen new error codes need to be added. DH_params_check{,_ex}() is a new version of DH_check that only performs a cheap subset of the checks. They are needed to implement EVP_PKEY_{public,param}_check() (observe the consistent naming) although the actual implementation of EVP_PKEY_param_check() chose to use DH_check_ex(). As far as I can tell, the only raison d'être of the _ex functions and error codes is to spew them to stderr in a couple of openssl(1) commands. This couldn't have been solved differently... These functions will not be exposed publicly. ok inoguchi jsing
* Prepare to provide EVP_PKEY_check()tb2022-01-108-12/+89
| | | | | | | | | | | | | | | | | | This allows checking the validity of an EVP_PKEY. Only RSA and EC keys are supported. If a check function is set the EVP_PKEY_METHOD, it will be used, otherwise the check function on the EVP_PKEY_ASN1_METHOD is used. The default ASN.1 methods wrap RSA_check_key() and EC_KEY_check_key(), respectively. The corresponding setters are EVP_PKEY_{asn1,meth}_set_check(). It is unclear why the PKEY method has no const while the ASN.1 method has const. Requested by tobhe and used by PHP 8.1. Based on OpenSSL commit 2aee35d3 ok inoguchi jsing
* Prevent a double free in EVP_MD_CTX_copy_ex()tb2022-01-101-1/+3
| | | | | | | | NULL out two pointer values after memcpy() to avoid a double free. In the event that both in->pctx and in->md_data are non-NULL and the calloc() of out->md_data fails, a double free could occur. ok inoguchi jsing
* zap trailing whitespacetb2022-01-101-5/+5
|
* Check that the RSA exponent is neither even nor 1 in RSA_check_key()tb2022-01-101-1/+10
| | | | | | Part of OpenSSL commit 464d59a5 ok inoguchi jsing
* Use C99 initializers for test_sha_mdtb2022-01-091-13/+12
| | | | ok inoguchi jsing
* Add an essentially empty comp_local.h and include it where it willtb2022-01-095-4/+22
| | | | | | be needed. discussed with jsing
* Prepare to provide EVP_MD_CTX{,_set}_pkey_ctx()tb2022-01-094-5/+55
| | | | | | | | | | | | | This API with very strange ownership handling is used by Ruby 3.1, unfortunately. For unclear reasons, it was decided that the caller retains ownership of the pctx passed in. EVP_PKEY_CTX aren't refcounted, so a flag was added to make sure that md_ctx->pctx is not freed in EVP_MD_CTX_{cleanup,reset}(). Since EVP_MD_CTX_copy_ex() duplicates the md_ctx->pctx, the flag also needs to be unset on the duplicated EVP_MD_CTX. ok inoguchi jsing
* Prepare to provide OBJ_length() and OBJ_get0_data()tb2022-01-082-2/+28
| | | | | | | | OBJ_length() turns the int obj->length into a size_t, so add an overflow check. While obj->length should never be negative, who knows... ok jsing
* tiny whitespace tweaktb2022-01-081-2/+2
|
* x509_cpols.c will need to include x509_lcl.h soontb2022-01-081-1/+2
|
* Prepare to provide EVP_AEAD_CTX_{new,free}()tb2022-01-072-3/+29
| | | | ok jsing
* A few more files need asn1_locl.h.tb2022-01-073-3/+8
|
* include asn1_locl.h where it will be needed for the bump.tb2022-01-077-7/+19
| | | | discussed with jsing
* Prepare to make RSA and RSA_METHOD opaque by including rsa_locl.htb2022-01-079-9/+19
| | | | | | where it will be needed in the upcoming bump. discussed with jsing
* Add an essentially empty ocsp_local.h and include it in the filestb2022-01-0710-9/+95
| | | | | | that will need it in the upcoming bump. discussed with jsing
* gost needs to look into ecs_locl.htb2022-01-072-2/+4
|
* Prepare the move of DSA_SIG, DSA_METHOD and DSA to dsa_locl.h bytb2022-01-0710-10/+25
| | | | | | including the local header where it will be needed. discussed with jsing
* Add an essentially empty dh_local.h and include it in the files wheretb2022-01-0710-9/+88
| | | | | | it will be needed in the upcoming bump. discussed with jsing
* zap trailing whitespacetb2022-01-071-9/+9
|
* Add a new, mostly empty, bio_local.h and include it in the filestb2022-01-0723-22/+128
| | | | | | that will need it in the upcoming bump. discussed with jsing
* Convert SCT verification to CBB.jsing2022-01-061-56/+57
| | | | ok inoguchi@ tb@
* Sync from libssl.jsing2022-01-062-2/+21
|
* minor tweaks, no code changetb2022-01-061-4/+3
| | | | | Adjust a comment to reality, zap a stray empty line and fix whitespace before comment after #endif
* Prepare to provide DSA_bits()tb2022-01-052-2/+11
| | | | | | Used by Qt5 and Qt6 and slightly reduces the patching in there. ok inoguchi jsing
* Prepare to provide BIO_set_retry_reason()tb2022-01-052-2/+11
| | | | | | Needed by freerdp. ok inoguchi jsing
* Prepare to provide a number of RSA accessorstb2022-01-052-2/+67
| | | | | | | This adds RSA_get0_{n,e,d,p,q,dmp1,dmq1,iqmp,pss_params}() which will be exposed in the upcoming bump. ok inoguchi jsing
* Prepare to provide ECDSA_SIG_get0_{r,s}()tb2022-01-052-2/+19
| | | | ok inoguchi jsing
* Prepare to provide DH_get_length()tb2022-01-052-2/+11
| | | | | | Will be needed by openssl(1) dhparam. ok inoguchi jsing
* Prepare to provide DSA_get0_{p,q,g,{priv,pub}_key}()tb2022-01-052-2/+39
| | | | ok inoguchi jsing
* Prepare to provide DH_get0_{p,q,g,{priv,pub}_key}()tb2022-01-052-2/+39
| | | | | | | | | | | These are accessors that allow getting one specific DH member. They are less error prone than the current getters DH_get0_{pqg,key}(). They are used by many ports and will also be used in base for this reason. Who can remember whether the pub_key or the priv_key goes first in DH_get0_key()? ok inoguchi jsing
* Prepare to provide BIO_set_next().tb2022-01-052-2/+11
| | | | | | This will be needed in libssl and freerdp after the next bump. ok inoguchi jsing
* Prepare to provide X509_{set,get}_verify() and X509_STORE_get_verify_cb()tb2022-01-052-7/+37
| | | | | | | | | as well as the X509_STORE_CTX_verify_cb and X509_STORE_CTX_verify_fn types This will fix the X509_STORE_set_verify_func macro which is currently broken, as pointed out by schwarze. ok inoguchi jsing
* Unindent a few lines of code and avoid shadowed variables.tb2022-01-051-12/+7
|
* Rename {c,p}_{min,max} into {child,parent}_{min,max}tb2022-01-051-7/+8
|
* Two minor KNF tweakstb2022-01-051-5/+5
|
* Use child_aor and parent_aor instead of aorc and aorptb2022-01-051-15/+15
| | | | suggested by jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-29 08:08:18 +0000