summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Mop up unused AES_ASM and RSA_ASM defines.jsing2026-01-177-15/+7
| | | | These have not been used for quite some time.
* Use .section before .rodata to appease gas.jsing2026-01-178-22/+26
| | | | | | gas dislikes bare .rodata - add .section before .rodata to make it happier (LLVM does not care and is happy with either). For consistency, do the same with .text.
* Use local label prefix for loop labels.jsing2026-01-173-9/+9
|
* mlkem_internal.h: formate -> formattb2026-01-161-2/+2
|
* mlkem_internal.h: some very basic copy editingtb2026-01-161-6/+6
|
* mlkem.h: Thie -> This (2x)tb2026-01-161-3/+3
|
* mlkem.c: becuase -> becausetb2026-01-161-2/+2
|
* asn1t.h: whitespace tweakstb2026-01-161-81/+74
| | | | | | Add missing space after commas, shorten a couple comments in structs, reflow weirdly wrapped long comments and improve the random line breaks in typedefs and prototypes.
* asn1t.h: Otherwiser -> Otherwisetb2026-01-161-2/+2
|
* asn1t.h: more macro cleanup, add missing C99 initializers for ADB_ENTRY()tb2026-01-161-69/+99
| | | | ok kenjiro
* stack.c: avoid arithmetic on pointers to voidtb2026-01-141-2/+2
| | | | | | | | | | | | | | | | | In stack.c r1.34 I converted one 'char *' too many to 'void *', thereby relying on a gcc/clang extension which interprets the fictional void type as a type of size 1 (that's what the stack code wants, fortunately). As pointed out in the link below, -Wpointer-arith would have caught this: https://gcc.gnu.org/onlinedocs/gcc/Pointer-Arith.html MSVC flags this as follows: D:\a\portable\portable\crypto\stack\stack.c(211,23): error C2036: 'const void *': unknown size [D:\a\portable\portable\build\crypto\crypto_obj.vcxproj]. Pull in workaround from the portable repo which undoes the char * -> void * conversion. ok jsing millert
* x509_utl.c: zap two useless commentstb2026-01-121-5/+1
|
* More asn1t.h cleanuptb2026-01-111-58/+88
| | | | | | | | This converts more macros to C99 initializers. Rename flags and tags arguments by appending val because they collide with the field names. The remainder are whitespace changes. ok kenjiro
* asn1t.h: add C99 initializers for some ASN.1 templatestb2026-01-091-155/+195
| | | | | | | | | | | | | | This is a first pass at tidying up the unsightly mess that is asn1t.h. For better or worse, we have expanded the macros internally, and in base only rpki-client uses the templates. They are generally rarely used. Fortunately. Having C99 initializers helps a lot with debugging templated ASN.1 by combining cc -E with clang-format. They make the macros more readable, look tidier and help with grep. ok kenjiro
* asn1t.h: whitespace nittb2026-01-091-2/+2
|
* Fix ASN1_ADB_END macro, make it compatible with OpenSSLtb2026-01-071-4/+3
| | | | | | | | | | | | | | In asn1t.h r1.18 (commit 9b72422d) I removed the app_items member from ASN1_ADB and failed to fix up the ASN1_ADB_END() macro that populates the ASN1_ADB. This means ASN1_ADB_END() tried to initialize one member too many and would thus cause a compilation failure, so nobody uses this with LibreSSL. Internally, we have expanded all its uses. We could leave it broken or fix it up. Take the opportunity to add an unused adb_cb() argument instead, making the macro invocation compatible with OpenSSL. ok jsing kenjiro
* ASN.1 templates: make internal *_PUBKEY_it statictb2026-01-051-5/+5
|
* ASN.1 templates: make ASN1_EXTERN_FUNCS statictb2026-01-052-7/+7
| | | | These are used directly only as part of the ASN.1 item in the same file.
* a_bitstr: remove parentheses in return statementstb2026-01-041-5/+5
| | | | no binary change
* i2c_ASN1_BIT_STRING() vs ASN1_STRING_FLAG_BITS_LEFTtb2026-01-041-10/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A nasty quirk in the bit string handling is that the serialization produced by i2d_ASN1_BIT_STRING() depends on whether the the magic ASN1_STRING_FLAG_BITS_LEFT is set. If ASN1_STRING_FLAG_BITS_LEFT is set, the number of unused bits is carried in a->flags & 0x07 and the remainder of the bit string is in a->data. This is terrible and undocumented but handled correctly. If ASN1_STRING_FLAG_BITS_LEFT is not set, all trailing zero bits are (intended to be) chopped off with all sorts of hilarious side effects. I broke this quite thoroughly when I incorrectly ported an overflow check from BoringSSL in: https://github.com/openbsd/src/commit/f81cc285d2aed8b36615119a306533696f3eb66c The result is that we currently return ret = a->length + 1 for both NULL and non-NULL pp. The calls to asn1_ex_i2c() in asn1_i2d_ex_primitive() thus report consistent lengths back, making it succeed. asn1_i2d_ex_primitive() therefore skips a->length + 1 bytes, while i2c_ASN1_BIT_STRING() only overwrites len + 1 bytes, which are possibly fewer. So a caller passing in an output buffer containing garbage (malloc) will get some of that garbage back in the encoding. Further, i2c_ASN1_BIT_STRING() also advances that pointer by the possibly reduced len + 1, but that fortunately doesn't matter since that's an effect local to asn1_ex_i2c(), the only caller of i2c_ASN1_BIT_STRING(). The last bit is that the current behavior may set bogus unused bits coming from the scanning backward madness. I added such an example in the parent commit. The fix is simple: use len after the truncation effect was established, not the original a->length, turning this commit into what my backport should have been. This fixes the two currently failing regress tests, so remove expected failure marker again. ok jsing kenjiro
* i2c_ASN1_BIT_STRING(): zap nonsensical commenttb2026-01-041-2/+2
| | | | | | | | The /* should not happen */ happens if a->data is all zeroes (where there used to be an OOB access a few years back), which is a legitimate BIT STRING, so this is just nonsense. ok jsing kenjiro
* a_bitstr.c: whitespace nittb2026-01-041-2/+2
|
* Unexport ASN1_LONG_UNDEFtb2026-01-022-7/+8
| | | | | | | | | | This is another one of these weird magic values that nothing outside of libcrypto uses. Fix a confusing comment in long_i2c() while there. The skipping behavior is used in particular for omitting the optional length value in the non-standard OpenSSL-specific DHparam() ASN.1 encoding. ok jsing kenjiro
* mlkem: clear a few (pointers to) secretstb2026-01-012-13/+47
| | | | | | | | | The ML-KEM code is doing a pretty poor job at cleaning up secrets it no longer needs. This commit clears a few stack-based arrays containing secrets or not obviously public information and stack-based structs containing pointers to secrets. ok jsing kenjiro
* Rename RANK{768,1024} to MLKEM{768,1024}_RANKtb2026-01-014-47/+47
| | | | | | | | | RANK768 and RANK1024 are awfully short and generic names for public constants. Before we make it worse with similarly named constants for ML-DSA, let's fix this. This follows the naming convention used by the other macros in the mlkem code. ok kenjiro jsing
* x509.h: annotate why X509_PKEY cannot be made opaquetb2026-01-011-1/+2
|
* Remove STABLE_FLAGS_MALLOCtb2025-12-312-5/+5
| | | | | | | | | | Formerly used by ASN1_STRING_TABLE_{add,cleanup}() which were removed two years ago. Annotate why STABLE_NO_MASK stays: as usual, security/xca ends up being the sole consumer of some nonsense. Apparently it needs its own reimplementation of ASN1_STRING_set_by_NID(), another removable public API that should never have been exposed. ok kenjiro
* Require SSE in order to use gcm_{gmult,ghash}_4bit_mmx().jsing2025-12-311-2/+2
| | | | | | | | Contrary to naming, the '"June" MMX version' of gcm_ghash_4bit_mmx() uses SSE, while the 'pure-MMX "May" version' does not. This detail got missed when I was untangling OPENSSL_IA32_SSE2. Found the hard way by Tate Baldwin and Dennis Camera.
* Provide CRYPTO_CPU_CAPS_I386_SSEjsing2025-12-312-3/+6
|
* Use group method on point_{set_to,is_at}_infinity()tb2025-12-261-3/+3
| | | | All other public APIs call group->meth->... not point->meth->...
* Add compatibility check to EC_POINT_mul()tb2025-12-261-1/+7
| | | | | | | This is the only public API that doesn't check for compatibility between group and point. Add the missing check. ok jsing kenjiro
* Replace group->meth != point->meth checkstb2025-12-263-17/+21
| | | | | | | | | The method will currently always be identical since all groups use the EC_GFp_mont_method(). Use the ec_group_and_point_compatible() check to ensure this and if both group and point have a nid set, check that they are identical. ok jsing kenjiro
* Add ec_group_and_point_compatible() helpertb2025-12-262-2/+13
| | | | | | | Check that a given group and point are reasonably compatible. First see if they use the same method. Compare nids if both have nid != NID_undef. ok jsing kenjiro
* Add nid to EC_POINT for compat checkingtb2025-12-262-2/+6
| | | | | | | | It is annoying that an EC_POINT does not really know on what EC_GROUP it lives. Adding a refcount to EC_GROUP is slightly tricky, so instead use a nid which we will know unless the group was constructed by hand. ok jsing kenjiro
* X509_NAME_ENTRY_set_data: remove redundant parenthesestb2025-12-211-6/+6
|
* X509_NAME_ENTRY_set_data(): garbage collect unnecessary itb2025-12-211-5/+2
|
* Garbage collect V_ASN1_APP_CHOOSEtb2025-12-211-2/+1
| | | | ok kenjiro
* Stop documenting V_ASN1_APP_CHOOSE quirktb2025-12-212-22/+4
| | | | ok kenjiro
* X509_NAME_ENTRY_set_data: remove V_ASN1_APP_CHOOSE quirktb2025-12-211-7/+4
| | | | | | | This is the last remaining actual use of ASN1_PRINTABLE_type(), which will go away in the next major bump. ok kenjiro
* stack: switch data from char ** to void **tb2025-12-212-15/+15
| | | | ok jsing kenjiro
* conf_api: remove CONF_DEBUG and disabling of assert()tb2025-12-211-6/+1
| | | | | | | The only thing CONF_DEBUG has done in ages is defining NDEBUG in a file that does not contain a single assert. Kill it. ok jsing kenjiro
* conf_api: add empty line between !openssl and openssl includestb2025-12-201-1/+2
|
* conf_api: remove a few rather useless history tidbitstb2025-12-201-5/+1
|
* This function have -> This function hastb2025-12-201-2/+2
|
* These function -> These functionstb2025-12-201-3/+3
|
* This functions -> This functiontb2025-12-203-9/+9
|
* pkcs7: add PKCS7_NO_DUAL_CONTENT flag/behaviortb2025-12-203-12/+27
| | | | | | | | | | | | | What Netscape fucked up just had to be embraced by secure boot and other nonsense. First OpenSSL wanted to be strict (which we inherited) then Rich Salz Postel-ized this and made OpenSSL bypass this check by default and added a flag to be strict 10 years ago. Now sthen found that PHP 8.5 uses/exposes this flag. Follows OpenSSL 6b2ebe43 (2016) ok kenjiro
* BN_get_word(): return (BN_ULONG)-1 on error rather than BN_MASK2tb2025-12-153-7/+7
| | | | | | | | While the latter is more general in that it also works on 1-complement achitectures, we don't care about that. Adjust documentation and the only error check for it in libcrypto. ok deraadt
* x509.h: add missing spaces after ,tb2025-12-111-63/+63
|
* Remove last internal use of ASN1_STRING_data()tb2025-12-071-13/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | PKCS5_pbe_set0_algor() is no longer public, but its parameters are provided directly via public API, namely the wonderful PKCS8_encrypt() and PKCS12_pack_p7encdata(). Muppetry abounds. To wit: If saltlen < 0, the call to ASN1_STRING_set(pbe->salt, NULL, saltlen) would error. Let's do that up front in a more obvious way. We don't care about side-effects to pbe->salt since we free it on error anyway. If saltlen == 0, we default it to PKCS5_PBE1_SALT_LEN. This is particularly funky in case the caller passed in salt != NULL, in which case we can only hope and pray this buffer is long enough. If the caller passed a salt, copy it to pbe->salt via ASN1_STRING_set(). If there's no salt, allocate a buffer of the appropriate length, fill it with random and transfer ownership to pbe->salt via ASN1_STRING_set0(). There's a change of behavior in that this will not be NUL-terminated (why should it be?). If we wanted to preserve behavior, we'd just use calloc(1, saltlen + 1) instead of the malloc(). The exit path is quite special, too, but I didn't want to change this right now. tweaks/ok kenjiro
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-06-02 10:16:24 +0000