Fix underlying pkey of RSA-PSS

There are currently very few differences between the rsa_asn1_meth for
plain RSA and the rsa_pss_asn1_meth for RSA-PSS apart from the obviously
necessary differnces fo

Fix underlying pkey of RSA-PSS

There are currently very few differences between the rsa_asn1_meth for
plain RSA and the rsa_pss_asn1_meth for RSA-PSS apart from the obviously
necessary differnces for base_method, pkey_id, pem_str and info (and the
fact that RSA has support for legacy private key encoding). This had the
lucky side effect that it didn't really matter which ameth one ended up
using after OBJ_find_sigid_algs().

With the upcoming support for X509_get_signature_infO() for RSA-PSS, this
needs to change as for RSA-PSS we need to decode the PSS parameters for
extracting the "security level", whereas for RSA we can just use the hash
length. Thus, for RSA-PSS switch pkey_id from the incorrect rsaEncryption
to rassaPss.

ok jsing

PS: OBJ_find_sigid_algs() manual is no longer entirely correct, but this
has been the case since we added Ed25519 support to obj_xref.

show more ...

Teach OBJ_find_sigid_{,by_}algs(3) about ECDSA with SHA-3

This allows signing and verifying ASN.1 "items" using the ECDSA with SHA-3
signature algorithms. With this diff, ECDSA certificates and CMS

Teach OBJ_find_sigid_{,by_}algs(3) about ECDSA with SHA-3

This allows signing and verifying ASN.1 "items" using the ECDSA with SHA-3
signature algorithms. With this diff, ECDSA certificates and CMS products
using ECDSA with SHA-3 can be generated using the openssl command line tool.

ok jsing

show more ...

Remove OBJ_add_sigid() and OBJ_sigid_free()

Another bit of unused extensibility that was responsible for a lot
of complexity until recently. This removes the remaining stubs from
the public API.

ok

Remove OBJ_add_sigid() and OBJ_sigid_free()

Another bit of unused extensibility that was responsible for a lot
of complexity until recently. This removes the remaining stubs from
the public API.

ok jsing

show more ...

Align argument names of OBJ_add_sigid() with the other functions.

Rewrite obj_xref.c

Instead of having two unreadable tables placed in a header generated by a
janky perl script from an ugly text file, use a single table inlined in
the C file. This table is used to

Rewrite obj_xref.c

Instead of having two unreadable tables placed in a header generated by a
janky perl script from an ugly text file, use a single table inlined in
the C file. This table is used to translate between signature algorithm
OIDs and pairs of OIDs of a message digest and a cipher. The table has
fewer than fifty entries and isn't used in a hot path. Using binary search
is overkill. Just do two linear searches, one for each translation. None
of the original code remains apart from the API.

ok jsing

show more ...

Neuter OBJ_add_sigid() and OBJ_sigid_free()

These functions will be removed in the upcoming bump. Nothing uses them,
so it won't hurt if they become noops. This allows us to garbage collect
the sig_

Neuter OBJ_add_sigid() and OBJ_sigid_free()

These functions will be removed in the upcoming bump. Nothing uses them,
so it won't hurt if they become noops. This allows us to garbage collect
the sig_app and sigx_app stacks and make a first step towards simplifying
the OBJ_bsearch_() dances. Also sprinkle some const correctness... because
we can.

intermediate step towards a diff that is ok jsing

show more ...

Hide symbols in objects

ok tb@

Expand DECLARE_OBJ_BSEARCH_CMP_FN and IMPLEMENT_OBJ_BSEARCH_CMP_FN macros.

No change to generated assembly excluding line numbers.

tags as requested by miod and tedu

Remove various test stubs. The good ones have been moved by jsing
and others to the regress framework. These remaining ones just
muddle us up when re-reading code repeatedly.
ok jsing

ok, next pass after review: when possible, put the reallocarray arguments
in the "size_t nmemb, size_t size"

convert 53 malloc(a*b) to reallocarray(NULL, a, b). that is 53
potential integer overflows easily changed into an allocation return
of NULL, with errno nicely set if need be. checks for an allocati

convert 53 malloc(a*b) to reallocarray(NULL, a, b). that is 53
potential integer overflows easily changed into an allocation return
of NULL, with errno nicely set if need be. checks for an allocations
returning NULL are commonplace, or if the object is dereferenced
(quite normal) will result in a nice fault which can be detected &
repaired properly.
ok tedu

show more ...

KNF.

Change library to use intrinsic memory allocation functions instead of
OPENSSL_foo wrappers. This changes:
OPENSSL_malloc->malloc
OPENSSL_free->free
OPENSSL_relloc->realloc
OPENSSL_freeFunc->free

import OpenSSL-1.0.1c

import OpenSSL-1.0.0a