aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/store
Commit message (Collapse)AuthorAgeFilesLines
* Prefer ARRAY_SIZE(...)Dimitri Papadopoulos2024-07-221-1/+3
| | | | | | | | | | | In OpenSSL, it's actually OSSL_NELEM() in "internal/nelem.h". Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22097)
* Adding missing NULL pointer checkafshinpir2024-04-151-2/+3
| | | | | | | | | | | | CLA: trivial In the provider store API, it is not necessary to provide both open and attach method at the same time and providing at least one of them is enough. Adding some null pointer checks to prevent exceptions in case of not providing both methods at the same time. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23703)
* Add OPENSSL_free to avoid mem leakJiasheng Jiang2024-04-011-1/+3
| | | | | | | | | Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23955)
* store/store_lib.c: Add the checks for the EVP_MD_CTX_get_size()Jiasheng Jiang2024-04-011-2/+7
| | | | | | | | | | | | Add the checks for the return value of EVP_MD_CTX_get_size() before explicitly cast them to size_t to avoid the integer overflow. Fixes: fac8673b8a ("STORE: Add the possibility to search for specific information") Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23955)
* Copyright year updatesMatt Caswell2023-09-281-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
* Allow to pass a passprase callback at store openSimo Sorce2023-09-193-12/+31
| | | | | | | | | | | | | | | | | | Some PKCS11 modules require authentication early on to be able to preload objects, which we want to do to avoid costly roundtrips when the HSM is actually reached over a network (Cloud HSM). Unfortunately at open time we can't interact with the user becaue the callbacks are only passed at object load time. later on. This patch corrects this issue by providing a more feature rich open call for providers. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20131)
* Store: API for deletionDmitry Belyavskiy2023-09-153-1/+53
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21901)
* Remove repeated wordsDimitri Papadopoulos2023-09-111-1/+1
| | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21468)
* OSSL_STORE: Fix error flag clearing and setting (provider path only)Richard Levitte2023-09-081-2/+2
| | | | | | | | | | | | | | | | When the provider's load function returned with an error, the libcrypto error flag was only set if EOF hadn't been reached. This is troublesome, as an error can very well occur during the last load before EOF is reached! Also, the error flag was never reset, even though documentation specifies that it should indicate an error in the last load (i.e. not the one before that). Fixes #21968 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21976)
* Copyright year updatesMatt Caswell2023-09-073-3/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
* store: update to structure based atomicsPauli2023-07-012-6/+4
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21260)
* OSSL_STORE and PKCS#12: Check if there is a MAC to verify before promptingRichard Levitte2023-06-261-1/+3
| | | | | | | | | | | | | | | | When a DER object with unknown contents comes all the way to ossl_store_handle_load_result(), and it attempts to decode them as different objects, the PKCS#12 decoding attempt would (almost) always prompt for a passphrase, even if there isn't a MAC to verify it against in the PKCS#12 object. This change checks if there is a MAC to verify against before attempting to prompt for a passphrase, leading to less surprising behavior. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21197)
* crypto/*: Fix various typos, repeated words, align some spelling to LDP.FdaSilvaYY2022-10-121-1/+1
| | | | | | | | | | | | partially revamped from #16712 - fall thru -> fall through - time stamp -> timestamp - host name -> hostname - ipv6 -> IPv6 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19059)
* Stop raising ERR_R_MALLOC_FAILURE in most placesRichard Levitte2022-10-052-44/+23
| | | | | | | | | | | | | | | | | | | | | | | Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
* "Reserve" the method store when constructing methodsRichard Levitte2022-07-201-0/+24
| | | | | | | | | | | | | | | | | | | | Introducing the concept of reserving the store where a number of provided operation methods are to be stored. This avoids racing when constructing provided methods, which is especially pertinent when multiple threads are trying to fetch the same method, or even any implementation for the same given operation type. This introduces a |biglock| in OSSL_METHOD_STORE, which is separate from the |lock| which is used for more internal and finer grained locking. Fixes #18152 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18153)
* store_result: Add fallback for fetching the keymgmt from the provider of the ↵Tomas Mraz2022-06-281-2/+20
| | | | | | | | | | store Fixes #17531 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17554)
* Add deprecation macro for 3.1 and deprecate OPENSSL_LH_statsHugo Landau2022-06-221-1/+1
| | | | | | Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17937)
* Fix inadvertent NULL assignments in ternary opsClemens Lang2022-06-051-1/+1
| | | | | | | | | | | | | As identified by both clang with a warning and $> git grep -P '(?<![!=])= NULL \?' Signed-off-by: Clemens Lang <cllang@redhat.com> CLA: trivial Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18469)
* Fix Coverity 1503329 use after freePauli2022-05-061-0/+2
| | | | | | | | Another false positive tagged as such Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/18014)
* Remove the _fetch_by_number functionsPauli2022-05-062-34/+6
| | | | | | | | | | | | These functions are unused and untested. They are also implemented rather inefficiently. If we ever needed them in the future, they'd almost surely need to be rewritten more efficiently. Fixes #18227 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18237)
* Add method store cache flush and method removal to non-EVP operationsRichard Levitte2022-05-051-0/+19
| | | | | | | | | | | | evp_method_store_flush() and evp_method_store_remove_all_provided() only cover EVP operations, but not encoders, decoders and store loaders. This adds corresponding methods for those as well. Without this, their method stores are never cleaned up when the corresponding providers are deactivated or otherwise modified. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18151)
* Update copyright yearMatt Caswell2022-05-033-3/+3
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
* str[n]casecmp => OPENSSL_strncasecmpDmitry Belyavskiy2022-04-222-2/+2
| | | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18069)
* Refactor OSSL_LIB_CTX to avoid using CRYPTO_EX_DATAHugo Landau2022-04-011-21/+2
| | | | | | | | | | | | | This refactors OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA. The assorted objects to be managed by OSSL_LIB_CTX are hardcoded and are initialized eagerly rather than lazily, which avoids the need for locking on access in most cases. Fixes #17116. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17881)
* fetch: convert a NULL property query to ""Pauli2022-02-281-3/+4
| | | | | | | | | | | | | Previously, a NULL property query was never cached and this lead to a performance degregation. Now, such a query is converted to an empty string and cached. Fixes #17752 Fixes https://github.openssl.org/openssl/openssl/issues/26 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17769)
* Move e_os.h to include/internalRichard Levitte2022-02-052-2/+2
| | | | | | | | | | | | Including e_os.h with a path from a header file doesn't work well on certain exotic platform. It simply fails to build. Since we don't seem to be able to stop ourselves, the better move is to move e_os.h to an include directory that's part of the inclusion path given to the compiler. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17641)
* Fix Decoder, Encoder and Store loader fetchingMatt Caswell2022-01-121-2/+3
| | | | | | | | | | | | | Attempting to fetch one of the above and providing a query string was failing with an internal assertion error. We must ensure that we give the provider when calling ossl_method_store_cache_set() Fixes #17456 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17459)
* OSSL_STORE_open_ex(): Prevent spurious error: unregistered scheme=fileDr. David von Oheimb2022-01-071-0/+4
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16452)
* try_pkcs12(): cleanse passphrase so it is not left on the stackTomas Mraz2022-01-031-2/+3
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/17320)
* try_pkcs12(): Correct handling of NUL termination of passphrasesTomas Mraz2022-01-031-4/+10
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/17320)
* add OSSL_STACK_OF_X509_free() for commonly used patternDr. David von Oheimb2021-12-211-1/+1
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17307)
* Add and use HAS_PREFIX() and CHECK_AND_SKIP_PREFIX() for checking if string ↵Dr. David von Oheimb2021-11-171-1/+1
| | | | | | | has literal prefix Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15847)
* fix some code with obvious wrong coding stylex20182021-10-281-2/+2
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16918)
* CORE: Encure that cached fetches can be done per providerRichard Levitte2021-10-271-4/+5
| | | | | | | | | | | | | | | | | | | This mostly entails passing around a provider pointer, and handling queries that includes a pointer to a provider, where NULL means "any". This also means that there's a need to pass the provider pointer, not just down to the cache functions, but also be able to get it from ossl_method_store_fetch(). To this end, that function's OSSL_PROVIDER pointer argument is modified to be a pointer reference, so the function can answer back what provider the method comes from. Test added. Fixes #16614 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725)
* CORE: add a provider argument to ossl_method_construct()Richard Levitte2021-10-271-1/+1
| | | | | | | | | | This makes it possible to limit the search of methods to that particular provider. This uses already available possibilities in ossl_algorithm_do_all(). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725)
* PROV & STORE: Make the 'file:' store loader understand more binary formatsRichard Levitte2021-07-031-1/+1
| | | | | | | | | | | | | | | | | | | | | The 'file:' store loader only understood DER natively. With all the whatever to key decoders gone, direct support for other binary file formats are gone, and we need to recreate them for this store loader. With these changes, it now also understands MSBLOB and PVK files. As a consequence, any store loader that handles some form of open file data (such as a PEM object) can now simply pass that data back via OSSL_FUNC_store_load()'s object callback. As long as libcrypto has access to a decoder that can understand the data, the appropriate OpenSSL object will be generated for it, even if the store loader sits in a different provider than any decoder or keymgmt. For example, an LDAP store loader, which typically finds diverse PEM formatted blobs in the database, can simply pass those back via the object callback, and let libcrypto do the rest of the work. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15981)
* Defined out MUTEX attributes not available on NonStop SPT Threads.Randall S. Becker2021-07-023-6/+6
| | | | | | | | | | | | | | | | | Standard Posix Threads (SPT) Threads are an older separate branch of pthreads that do not support some of the capabilities in the current Posix User Threads (PUT). The change also includes a rename of the close field of OSSL_STORE_LOADER which was causing preprocessor conflicts. Fixes #15885 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15886)
* OSSL_STORE: Fix crash when tracing STORERichard Levitte2021-06-291-5/+6
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15931)
* STORE: Fix OSSL_STORE_open_ex() error reportingRichard Levitte2021-06-202-9/+24
| | | | | | | | | | | | | | | | | | OSSL_STORE_open_ex() could result in reports like this: 80722AA3927F0000:error:80000002:system library:file_open_ex:No such file or directory:engines/e_loader_attic.c:1016:calling stat(file:test/blahdibleh.der) 80722AA3927F0000:error:41800069:lib(131)::path must be absolute:engines/e_loader_attic.c:1010:test/blahdibleh.der 80722AA3927F0000:error:1600007B:STORE routines:OSSL_STORE_open_ex:no loaders found:crypto/store/store_lib.c:148:No store loaders were found. For standard store loaders you need at least one of the default or base providers available. Did you forget to load them? The last one turns out to be a bit too generically reported. It should only be reported when no loader were loaded at all, not when loader_ctx happens to be NULL (which may happen for other reasons). We also move the helpful message to the OSSL_STORE_LOADER fetcher. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15820)
* CORE: Do a bit of cleanup of core fetchingRichard Levitte2021-06-161-12/+10
| | | | | | | | | | | | | Some data, like the library context, were passed both through higher level callback structures and through arguments to those same higher level callbacks. This is a bit unnecessary, so we rearrange the callback arguments to simply pass that callback structure and rely on the higher level fetching functionality to pick out what data they need from that structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15750)
* Clean up the encoder/decoder/loader stores before providersMatt Caswell2021-06-161-1/+2
| | | | | | | | | | | | | We already had the evp method store being cleaned up before the provider store was. This prevents issues where the method clean up functions cause providers to clean up, which then needs access to the provider store. We extend the same thinking to the encoder/decoder/loader stores. Fixes #15727 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15741)
* Refactor OSSL_STORE_LOADER_do_all_provided() to behave like ↵Richard Levitte2021-06-151-32/+24
| | | | | | | | | | | | | | | | | | OSSL_STORE_LOADER_fetch() This is refactored to use inner_loader_fetch() without any given name, which is just there to ensure all decoder implementations are made into methods, and then use ossl_method_store_do_all() to list them all. This also adds the internal ossl_store_loader_do_all_prefetched(), which can be used if pre-fetching needs to be done separately from listing all the decoder implementations, or if listing may happen multiple times. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15604)
* CORE: Move away the allocation of the temporary no_cache method storeRichard Levitte2021-06-151-23/+40
| | | | | | | | | | | | | | | | | The responsibility for managing the temporary store for methods from algorithm implementations flaged "no_store" is moved up to the diverse method fetching functions. This allows them to allocate it "just in time", or in other words not at all if there is not such algorithm implementation. This makes this temporary store more flexible if it's needed outside of the core fetching functionality, and slightly faster when this temporary store isn't necessary at all. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15737)
* STORE: Make OSSL_STORE_LOADER_fetch() consistent with all other fetch functionsRichard Levitte2021-06-112-5/+5
| | | | | | | | | | The argument order was different on this one. Fixes #15688 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15689)
* store: include internal headerPauli2021-06-021-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15564)
* libcrypto: make XXX_get_number() internalPauli2021-06-021-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15564)
* store: remove TODOsPauli2021-06-022-3/+1
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15539)
* Rename all getters to use get/get0 in nameTomas Mraz2021-06-013-12/+13
| | | | | | | | | | | | | | For functions that exist in 1.1.1 provide a simple aliases via #define. Fixes #15236 Functions with OSSL_DECODER_, OSSL_ENCODER_, OSSL_STORE_LOADER_, EVP_KEYEXCH_, EVP_KEM_, EVP_ASYM_CIPHER_, EVP_SIGNATURE_, EVP_KEYMGMT_, EVP_RAND_, EVP_MAC_, EVP_KDF_, EVP_PKEY_, EVP_MD_, and EVP_CIPHER_ prefixes are renamed. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15405)
* Fix cert creation in the storeMatt Caswell2021-05-311-16/+15
| | | | | | | | | When we create a cert in the store, make sure we do so with the libctx and propq associated. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15523)
* err: rename err_load_xxx_strings_int functionsPauli2021-05-261-1/+1
| | | | | | | | The new names are ossl_err_load_xxx_strings. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15446)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-18 02:52:39 +0000