summaryrefslogtreecommitdiff
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Drop some unnecessary parenthesestb2023-11-151-19/+19
|
* Shuffle getters and adders down a bittb2023-11-151-34/+30
| | | | These use static helper functions which don't need prototypes this way.
* Make X509_certificate_type() less badtb2023-11-131-24/+29
| | | | | | | This converts to proper single exit and undoes a number of unnecessarily silly muppet antics. ok beck
* Garbage collect an incoherent export crypto checktb2023-11-131-4/+1
| | | | | | | | | | | | Contrast "#define EVP_PKT_EXP 0x1000 /* <= 512 bit key */" with the diff: - /* /8 because it's 1024 bits we look for, not bytes */ - if (EVP_PKEY_size(pk) <= 1024 / 8) - ret |= EVP_PKT_EXP; EVP_PKT_EXP will be nuked at the next opportunity. discussed with jsing
* Use a sensible variable name (i.e. nid) instead of i for a NIDtb2023-11-131-5/+6
|
* Use X509_get_signature_nid() instead of inlining ittb2023-11-131-2/+2
| | | | ok beck jsing
* X509_certificate_type() needs to know about RSA-PSStb2023-11-131-1/+4
| | | | | | | This doesn't do much right now, but is part of the tangle that is adding RSA-PSS support. ok beck jsing
* Prepare to expose OPENSSL_gmtime and OPENSSL_timegm as publicbeck2023-11-134-5/+68
| | | | | | | | | | | This matches when BoringSSL has done, and allows for getting rid of the dependency on system timegm() and gmtime() in libtls. which will make life easier for portable, and remove our dependency on the potentially very slow system versions. ok tb@ - tb will handle the minor bump bits and expose on the next minor bump CVS :----------------------------------------------------------------------
* Kill last user of ASN1_time_parse() in the treetb2023-11-131-23/+3
| | | | | | | | ASN1_time_parse() was useful while OpenSSL didn't have something sort of equivalent, but now they do. Let's retire ASN1_time_parse() to internal. This will require some patching in ports, but shrug. ok beck
* Check notBefore/notAfter validity with ASN1_TIME_to_tm(3)tb2023-11-131-5/+3
| | | | ok beck
* Replace ASN1_time_parse() with ASN1_TIME_to_tm()tb2023-11-131-3/+4
| | | | | | | Like in libtls, we use ASN1_GENERALIZEDTIME_check() to ensure we actually have a GeneralizedTime. ok beck
* Remove last caller of ASN1_time_parse(3) in libtlstb2023-11-131-3/+4
| | | | | | | | This one is slightly annoying since ASN1_TIME_to_tm(3) doesn't provide a direct check for a GeneralizedTime, so call ASN1_GENERALIZEDTIME_check() as well. This means LibreSSL parses the time twice. Shrug. ok beck
* Remove ASN1_time_parse() dependency in tls_conninfo.ctb2023-11-131-3/+3
| | | | | | | | | | During r2k22 ported some of the missing OpenSSL ASN.1 time API. This is a step towards removing the dependency of libtls on ASN1_time_parse(). The latter grew a dependency on CBS/CBB, and thus the choice is to pull in all this code or to use a no longer maintained version of the API. Both options are unappealing. ok beck
* Eliminate the timegm(3) dependency in libcryptotb2023-11-134-19/+36
| | | | | | | | | | | | | | | | | timegm(3) is not available on some operating systems we support in portable. We currently use musl's implementation, for which gcc-13 decided to emit warnings (which seem incorrect in general and are irrelevant in this case anyway). Instead of patching this up and diverge from upstream, we can avoid reports about compiler warnings by simply not depending on this function. Rework the caching of notBefore and notAfter by replacing timegm(3) with asn1_time_tm_to_time_t(3). Also make this API properly error checkable since at the time x509v3_cache_extensions(3) is called, nothing is known about the cert, in particular not whether it isn't malformed one way or the other. suggested by and ok beck
* split the Symbols.list up so that arch specific symbols do not end up everywhererobert2023-11-124-2/+7
| | | | ok tb@
* Fix a few bugs in X509v3_asid_add*()tb2023-11-111-38/+96
| | | | | | | | | | | | | | | | | | | | | | | | | These 'builder' functions, usually used together, can result in corrupt ASIdentifiers on failure. In general, no caller should ever try to recover from OpenSSL API failure. There are simply too many traps. We can still make an effort to leave the objects in unmodified state on failure. This is tricky because ownership transfer happens. Unfortunately a really clean version of this seems impossible, maybe a future iteration will bring improvements... The nasty bit here is that the caller of X509v3_asid_add_id_or_range() can't know from the return value whether ownership of min and max was transferred or not. An inspection of (*choice)->u.range is required. If a caller frees min and max after sk_ASIdOrRange_push() failed, there is a double free. All these complications could have been avoided if the API interface had simply used uint32_t instead of ASN1_INTEGERs. The entire RFC 3779 API was clearly written without proper review. I don't know if there ever was an actual consumer before rpki-client. If it existed, nobody with the requisite skill set looked at it in depth. ok beck for the general direction with a lot of input and ok jsing
* Forgot to fix the RFC number in the new commenttb2023-11-091-2/+2
|
* Convert PKCS7_SIGNER_INFO_set() to X509_ALGOR_set0_by_nid()tb2023-11-091-5/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a straightforward conversion because I'm not going to start a cleanup here. Explain why this is not using X509_ALGOR_set_md(). See below. ok jca Let me include a beautiful note from RFC 5754 in its entirety: NOTE: There are two possible encodings for the AlgorithmIdentifier parameters field associated with these object identifiers. The two alternatives arise from the loss of the OPTIONAL associated with the algorithm identifier parameters when the 1988 syntax for AlgorithmIdentifier was translated into the 1997 syntax. Later, the OPTIONAL was recovered via a defect report, but by then many people thought that algorithm parameters were mandatory. Because of this history, some implementations encode parameters as a NULL element while others omit them entirely. The correct encoding is to omit the parameters field; however, when some uses of these algorithms were defined, it was done using the NULL parameters rather than absent parameters. For example, PKCS#1 [RFC3447] requires that the padding used for RSA signatures (EMSA-PKCS1-v1_5) MUST use SHA2 AlgorithmIdentifiers with NULL parameters (to clarify, the requirement "MUST generate SHA2 AlgorithmIdentifiers with absent parameters" in the previous paragraph does not apply to this padding).
* Convert ecx_item_sign() to X509_ALGOR_set0_by_nid()tb2023-11-091-8/+5
| | | | ok jca
* Convert asn1_item_sign() to X509_ALGOR_set0_by_nid()tb2023-11-091-8/+4
| | | | ok jca
* Fix X509_ALGOR_set0() usage in rsa_alg_set_oaep_padding()tb2023-11-091-4/+6
| | | | | | | | | | | Replace X509_ALGOR_set0() with X509_ALGOR_set0_by_nid(). This way there is no missing error checking for OBJ_nid2obj() and no nested functions. Slightly more importantly, this plugs two long standing potential leaks in this function (or previously rsa_cms_encrypt()) due to missing error checking: in the unlikely event that X509_ALGOR_set0() failed, astr/ostr would leak. ok jsing
* Use X509_ALGOR_set0_by_nid() in rsa_mgf1md_to_maskGenAlgorithm()tb2023-11-091-5/+2
| | | | ok jsing
* More minor cleanup in rsa_alg_set_oaep_padding()tb2023-11-081-4/+3
| | | | | Test and assign one more instance replace a useless comment by an empty line.
* Prepare further fixes of X509_ALGOR_set0() misusetb2023-11-081-8/+7
| | | | | | | | In rsa_alg_set_oaep_padding() rename los to ostr for consistency with astr, make it have function scope, free ostr in the error path and assume X509_ALGOR_set0() success. ok jca
* zap a stray spacetb2023-11-081-2/+2
|
* Rename os into astr in rsa_alg_set_oaep_padding()tb2023-11-081-6/+6
|
* Rename pkctx to pkey_ctx in rsa_alg_set_oaep_padding() and rsa_cms_encrypt()tb2023-11-081-9/+9
|
* Some simple cosmetics in rsa_alg_set_oaep_padding()tb2023-11-081-4/+8
| | | | | | | Rename rv into ret and split it on its own line, move labellen a bit down add some empty lines. To match style elsewhere. Most of this was requested by jsing
* Split OAEP padding handling into a helper functiontb2023-11-081-53/+59
| | | | | | | | This matches what is done for PKCS#1 1.5 and PSS. This function needs a lot of work still, but it's easier to do that without having to tiptoe around a lot of other garbage. ok jsing
* Move CMS_RecipientInfo_ktri_get0_algs() down a few lines and fix itstb2023-11-071-3/+6
| | | | error check
* Move CMS_RecipientInfo_get0_pkey_ctx() to first use of pkctxtb2023-11-071-3/+3
|
* Fix an error message left out in the mustDecodeHexString() conversiontb2023-11-071-2/+2
|
* Pull up the handling of the two webcrypto special snowflakestb2023-11-071-13/+9
|
* Drop a useless line and bump copyright yearstb2023-11-071-4/+3
|
* Unwrap a few linestb2023-11-071-72/+32
|
* Wrap hex.DecodeString() into mustDecodeHexString()tb2023-11-071-390/+78
| | | | | | | | | | | | | The hex decoding is only done from the JSON files provided by the wycheproof-testvectors package. Failure is always fatal. So there is no need for repeated error checks, and we can use an ergonomic wrapper. Also rework the calculation of the message digest from input data this had a similar deficit. All in all this shaves off about 10% of the code and removes a lot of tedious repetition.
* Use maps to retrieve various AES variantstb2023-11-071-60/+72
|
* Convert hashEvpMdFromString() to a maptb2023-11-071-26/+19
|
* Add stringer interfaces to the test groupstb2023-11-071-102/+126
| | | | This simplifies and unifies a lot of error messages.
* Inline rsa_ctx_to_pss_string()tb2023-11-071-16/+6
| | | | | | After previous refactoring, rsa_all_set_pss_padding() is the last remaining caller of the weirdly named and ugly rsa_all_set_pss_padding(). This can be handled in a few simple lines now that this mess has slightly cleaner code.
* Rename pkctx to pkey_ctx in rsa_{cms,item}_sign()tb2023-11-071-26/+26
|
* Trivial cleanup in rsa_cms_sign()tb2023-11-071-5/+5
| | | | | Check and assign the EVP_PKEY_CTX and move the extraction of the algorithm identifier from the signer info a few lines down.
* Rework RSA_PKCS1_PSS_PADDING handling in rsa_item_sign()tb2023-11-071-14/+4
| | | | | | | | | | The current convoluted mess can be handled with two calls to the new rsa_alg_set_pss_padding() helper. Not that this would be obvious at all. This fixes two more leaks in case of X509_ALGOR_set0() failure. ok jsing
* Add a helper to set RSASSA-PSS padding parameterstb2023-11-071-10/+29
| | | | | | | | | | | | This sets the AlgorithmIdentifier's algorithm to id-RSASSA-PSS with appropriate RSASSA-PSS parameters. This pulls a chunk of code out of rsa_cms_sign() and rewrites it with proper error checking, thereby fixing a long-standing leak. This helper can also be used in rsa_item_sign(), but that part is a bit special, and will therefore be commmitted separately. ok jsing
* Add a helper to set RSA PKCS #1 v1.5 padding OIDtb2023-11-071-12/+15
| | | | | | | | This removes a few duplicated and unchecked X509_ALGOR_set0() calls and factors them into a helper function that sets the AlgorithmIdentifier on the recipient info or signer info to rsaEncryption with null parameters. ok jsing
* Pull everything except the actual run call out of the closuretb2023-11-061-11/+9
| | | | | | | | The determination of the test group type and the JSON unmarshalling can be done before the closure without performance impact. This is more readable and eliminates the need of a temporary variable again. Suggested by jsing
* Introduce testGroupFromAlgorithm()tb2023-11-061-50/+54
| | | | | This factors another ugly switch into a helper function. This should probably become a map eventually, but for now keep things straightforward.
* Add a wycheproofTestGroupRunner interfacetb2023-11-061-72/+26
| | | | | This allows us to use a simpler way of running the individual test groups and gets rid of an ugly mostly copy-pasted switch inside a closure.
* Add aliases for AES AEAD constructions and ChaChatb2023-11-061-9/+12
| | | | | These used the wycheproofTestGroupAead type but an upcoming change requires to change this. Introduce the aliases now to make the next diff cleaner.
* Fix a for loop bug introduced in the concurrency refactortb2023-11-061-3/+4
| | | | | | | | | | | | | Due to Go's idiosyncratic semantics of for loops, tests would only run some of the test groups in the JSON file because by the time the closure is called, the array index could be changed. For example, on fast 8 core machines, the CMAC tests would run the last test group with key size 320 eight times rather than each of the eight test groups once. Make a copy of the pointer before passing it to the closure to avoid this issue. Simpler version of my initial fix from jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-28 15:14:05 +0000