summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Make internal header file names consistenttb2022-11-26426-932/+1498
| | | | | | | | | | | | | | | | Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook
* Remove BIGNUM consistency macros.jsing2022-11-2623-328/+24
| | | | | | | | | | | | Compiling with BN_DEBUG (and if you want to take it further, BN_DEBUG_RAND) supposedly adds consistency checks to the BN code. These are rarely if ever used and introduce a bunch of clutter in the code. Furthermore, there are hacks in place to undo things that the debugging code does. Remove all of this mess and instead rely on always enabled checks, more readable code and proper regress coverage to ensure correct behaviour. "Good riddance." tb@
* cms_lcl.h should not be part of SRCStb2022-11-261-2/+1
|
* In bio.h rev. 1.46/1.47 (Oct/Nov 2021), tb@ provided BIO_get_init(3).schwarze2022-11-251-5/+23
| | | | Document it.
* Major overhaul.schwarze2022-11-241-210/+216
| | | | | | | | | | Remove many statements that are no longer true after tb@, in July, massively improved the algorithms used by these functions and also did some cleanup of the interface. Instead, explain many aspects that were missing. Also use more descriptive argument names, drop some redundancy, and improve ordering in various respects. Feedback and enthusiastic OK from tb@.
* Merge the second y_bit check into the first one where it belongstb2022-11-241-5/+5
| | | | suggested by jsing
* Simplify y_bit handling in compressed coordinatestb2022-11-241-15/+2
| | | | | | | | If y_bit is set for a zero y, something is wrong and we can error directly. No need to run the non-trivial BN_kronecker() to check if BN_mod_sqrt() lied or not, only to set a more specific error code. ok jsing
* Clean up EC_METHOD and EC_GROUP definitionstb2022-11-241-102/+111
| | | | | | | Remove obvious comments, wrap long lines and general KNF cleanup. Format and rephrase the more important comments. Discussed with jsing
* Change bn_expand()/bn_wexpand() to indicate failure/success via 0/1.jsing2022-11-2415-83/+83
| | | | | | | | | Currently bn_expand()/bn_wexpand() return a BIGNUM *, however none of the callers use this (and many already treat it as a true/false value). Change these functions to return 0 on failure and 1 on success, revising callers that test against NULL in the process. ok tb@
* Call bn_expand() rather than handrolling an equivalent.jsing2022-11-241-5/+5
| | | | | | | The current code manually calculates words from bits and then calls bn_wexpand() - call bn_expand() with bits instead. ok tb@
* Fix leaks in ecx_set_{priv,pub}_key()tb2022-11-231-9/+9
| | | | | | | | When ecx_key_set_{priv,pub}() fails, ecx_key is leaked. CID 377014 From jsing
* Reverse arguments in CBS_dup()tb2022-11-231-2/+2
| | | | | | | | We want to copy the tls_content_cbs() into the cbs, not the other way around CID 377013 ok jsing
* Use bn_wexpand() rather than bn_expand() with sizeof(BN_ULONG).jsing2022-11-232-4/+4
| | | | | | | This also fixes a bug in BN_MONT_CTX_set(), where the sizeof(BN_ULONG) in the call to bn_expand() was not multiplied by eight (to get bits). ok tb@
* Ensure that bn_expand()/bn_wexpand() fail on negative sizes.jsing2022-11-231-1/+7
| | | | ok tb@
* Turn bn_wexpand() into a function.jsing2022-11-232-5/+13
| | | | | | | | Any sensible compiler will likely inline this anyway (and even if it does not, one extra function call/return is the least of the performance overhead for this code). ok tb@
* Move bn_expand() under bn_expand2().jsing2022-11-231-13/+13
| | | | | | No functional change. ok tb@
* Remove unused bn_dup_expand().jsing2022-11-232-56/+2
| | | | ok tb@
* Move #ifndef OPENSSL_NO_DEPRECATED.jsing2022-11-231-21/+21
| | | | | | | The BN_set_params()/BN_get_params() and associated unused variables are meant to be in this block, not things like BN_new() and BN_free(). ok tb@
* Remove bn_* defines/prototypes.jsing2022-11-231-4/+1
| | | | | | These now come directly via bn_lcl.h. ok tb@
* Fix some whitespace and comment formattingtb2022-11-221-37/+45
|
* Rename last OPENSSL_gmtime() to asn1_time_time_t_to_tm()tb2022-11-221-2/+2
| | | | | | | This rename was done before commit, but one instance was missed since it was hidden behind #ifdef SMALL_TIME_T. Spotted by Android CI.
* Remove incorrect "r must not be a" commenttb2022-11-221-2/+1
| | | | | This was fixed by Eric A. Young in "a C2Net version of SSLeay" and committed to OpenSSL by Mark J. Cox in January 1999 (OpenSSL a0a54079).
* mention what BN_ULONG isschwarze2022-11-223-8/+33
|
* Remove the lie that BN_ULONG might be 16 bits wide.schwarze2022-11-221-9/+11
| | | | | | We don't install this page, but it might possibly still help developers working on internals of the BN library, so i'm not in a hurry to cvs rm this file.
* Better document BN_ULONG (in the DESCRIPTION near BN_num_bits_word(3))schwarze2022-11-221-40/+84
| | | | | | | | | | | and BN_BITS2 (below RETURN VALUES). While here, perform major reordering and rewriting for precision and readability, in particular: - Avoid misleading wordings like "size of a BIGNUM". - Drop the trivial example. - Move the pointers to RSA_size(3) and friends to CAVEATS. - Stop recommending 8*BN_num_bytes() in this context because it is wrong, too.
* Fix segfaults in BN_dec2bn() and BN_hex2bn()tb2022-11-221-3/+3
| | | | | | | | | bn_print.c r1.29 added length checks to avoid overflowing the BIGNUM. If these checks are hit in length-only mode, i.e., bn is NULL, the error path dereferences bn. Change goto err to an early return to avoid this. ok jsing
* document BN_nist_mod_521(3) and their four siblingsschwarze2022-11-213-3/+118
|
* Fix a surprising quirk in BN_GF2m_mod(3).schwarze2022-11-202-16/+14
| | | | | | | | | | | | | | | | | | | | | | | | All other wrappers in the same file that use a temporary array of degrees size that array dynamically, such that they are able to handle reducing polynomials of arbitrary lengths. BN_GF2m_mod(3) was the only one that used a static array of size 6 instead, limiting it to trinomials and pentanomials and causing it to fail for longer reducing polynomials. Make this more uniform and less surprising by using exactly the same code as in all the other wrappers, such that BN_GF2m_mod(3) works with reducing polynomials of arbitrary length, too, just like the others. Again, tb@ points out this quirk is very unlikely to cause vulnerabilities in practice because cryptographic applications do not use longer reducing polynomials. This patch is not expected to significantly impact performance because the relevant caller, BN_GF2m_mod_div(3), already uses dynamic allocation via BN_GF2m_mod_mul(3). OK tb@
* Fix an off-by-one bug in BN_GF2m_poly2arr(3).schwarze2022-11-201-4/+3
| | | | | | | | | | | | | | | | | | | | | If the last argument, the size of the output array, is too small to contain all degrees present in the input polynomial plus one for the terminating -1, the function is documented to return the size of the output array that would be needed (in comments in the source code, in the new manual page, and by the way how the function is used by other functions in the same file). However, in case of overflow, the existing code failed to include the element needed for the terminating -1 in the return value, wrongly indicating success if everything but the -1 did fit and reporting failure with a size that was still too small otherwise. According to tb@, this is very unlikely to cause vulnerabilities in practical applications because there is no real reason to pick a reducing polynomial longer than a pentanomial, because all known callers use either fixed size arrays of size 6 or dynamic allocation, because use of GF(2^m) is rare in practice, and GF(2^m) with custom reducing polynomials even more so. OK tb@
* Fix comment describing BN_mod_sqrt()tb2022-11-191-7/+9
| | | | | It was placed and formatted weirdly. Fix the title of the book referenced and complete the reference's information.
* Rework pkey_dsa_sign() and pkey_dsa_verify()tb2022-11-191-21/+25
| | | | | | | | | | Since DSA_sign() and DSA_verify() ignore their type argument, don't bother to determine it here. Check all size_t for overflow before passing them as int arguments. Follow OpenSSL and add a check to see if the tbs blob's length matches the one of the md, in case it is set on the EVP_PKEY_CTX. Fix return value check of DSA_sign(). ok jsing
* Rework DSA_sign() and DSA_verify()tb2022-11-191-20/+31
| | | | | | | | | | | Change DSA_sign() to single exit and check the signed i2d_DSA_SIG() return value before assigning it to an unsigned int. In DSA_verify() let d2i_DSA_SIG() handle the allocation, split error check of i2d_DSA_SIG() from signature check and change an unnecessary freezero() to free. ok jsing
* Fix an annoying quirk in the EC codetb2022-11-1920-243/+243
| | | | | | Dealing with elliptic curves makes some people think that it would be kind of neat to multiply types with variable names. Sometimes. Only in function definitions.
* whitespacetb2022-11-1916-134/+134
|
* Fix whitespacetb2022-11-1911-63/+62
|
* Unindent and check some pointers explicitly against NULLtb2022-11-191-7/+9
|
* Remove HMAC PRIVATE KEY supporttb2022-11-191-64/+1
| | | | | | | | This is an undocumented feature of openssl genpkey for testing purposes. Emilia removed support for this 'bogus private key format' from OpenSSL in 2017 in commit c26f655fdd18ac19016c1c0496105f5256a1e84d. ok jsing
* Check os for NULL before dereferencing ittb2022-11-181-5/+5
| | | | | | Avoids a segfault when both priv == NULL and os == NULL. ok miod
* Include bytestring.h directly rather than pulling it in via asn1_locl.htb2022-11-181-1/+2
|
* Wire up HMAC to raw private key methodstb2022-11-181-2/+61
| | | | | | | | | | | | | | | Obviously, the brilliant API design kitchen decided that an interface carrying public and private key in its name (so that every sane person thinks of asymmetric cryptography), is also perfectly suitable for MACs. Wire up HMAC since Ruby's OpenSSL gem uses these bindings if the build system detects that EVP_PKEY_new_raw_public_key() is available in evp.h. While there, also add the missing pub_cmp() ameth, which obviously treats two things as equal by returning 1. Reported by jeremy and anton, fixes regress/lib/libssl/openssl-ruby tests ok jsing
* Change the pkey.ptr from char * to void *tb2022-11-186-16/+13
| | | | | | | | Now that EVP_PKEY is opaque, there is no reason to keep the ptr member of the pkey union as a weird char pointer, a void pointer will do. This avoids a few stupid casts and simplifies an upcoming diff. ok jsing
* group -> fieldtb2022-11-181-5/+5
| | | | discussed with schwarze
* polynominal -> polynomialtb2022-11-181-18/+18
| | | | ok schwarze
* new manual page BN_GF2m_add(3)schwarze2022-11-183-3/+527
| | | | concerning arithmetic in Galois fields of power-of-2 order
* Prevent Ed25519 signature malleabilitytb2022-11-171-1/+28
| | | | | | | | | | | | Add a check that ensures that the upper half s of an Ed25519 signature is bounded by the group order, i.e, 0 <= s < order. This is required by the Verify procedure in RFC 8032, section 5.1.7, step 1, and prevents simple modifications of signatures such as adding (a multiple of) the group order to the upper half of the signature. Found with EdDSA testcase 63 of project Wycheproof. ok beck jsing
* Revert "Check certificate extensions in trusted certificates"beck2022-11-173-64/+8
| | | | | | | | There are some possible strange side effects noticed by the openssl cms regress tests that I missed. Backing this out until I untangle it ok tb@
* tolower(3) guarantees to return its argument unchanged if it's notflorian2022-11-161-10/+3
| | | | | | | uppercase. While here use the correct idiom of casting to unsigned char. OK millert, farewell to ultrix deraadt
* mark BN_X931_derive_prime_ex, BN_X931_generate_prime_ex,schwarze2022-11-161-2/+8
| | | | | and BN_X931_generate_Xpq as intentionally undocumented because they are unused outside OpenSSL/LibreSSL and deprecated in OpenSSL 3.0
* expose the documentation of X509_STORE_CTX_verify_fn(3)schwarze2022-11-162-42/+26
| | | | | and X509_STORE_set_verify(3) and document X509_STORE_get_verify(3) which tb@ all provided with x509_vfy.h revisions 1.48 and 1.49
* document X509_STORE_CTX_verify_cb(3) and X509_STORE_get_verify_cb(3)schwarze2022-11-162-13/+40
| | | | which tb@ provided with x509_vfy.h revisions 1.48 and 1.49
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-04 10:36:47 +0000