openssl

History

Matt Caswell fc52ae8c4b Don't copy parameters on setting a key in libssl Whenever we set a private key in libssl, we first found the certificate that matched the key algorithm. Then we copied the key parameters from the private key into the public key for the certficate before finally checking that the private key matched the public key in the certificate. This makes no sense! Part of checking the private key is to make sure that the parameters match. It seems that this code has been present since SSLeay. Perhaps at some point it made sense to do this - but it doesn't any more. We remove that piece of code altogether. The previous code also had the undocumented side effect of removing the certificate if the key didn't match. This makes sense if you've just overwritten the parameters in the certificate with bad values - but doesn't seem to otherwise. I've also removed that error logic. Due to issue #13893, the public key associated with the certificate is always a legacy key. EVP_PKEY_copy_parameters will downgrade the "from" key to legacy if the target is legacy, so this means that in libssl all private keys were always downgraded to legacy when they are first set in the SSL/SSL_CTX. Removing the EVP_PKEY_copy_parameters code has the added benefit of removing that downgrade. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13899)		2 years ago
..
record	Ensure DTLS free functions can handle NULL	2 years ago
statem	Update SERVER_HELLO_MAX_LENGTH	2 years ago
bio_ssl.c	Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call	2 years ago
build.info	Modify the ERR init functions to use the internal ERR string loaders	2 years ago
d1_lib.c	Ensure DTLS free functions can handle NULL	2 years ago
d1_msg.c	Update copyright year	2 years ago
d1_srtp.c	Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call	2 years ago
ktls.c	ktls: Initial support for ChaCha20-Poly1305	2 years ago
methods.c	Update some inclusions of <openssl/macros.h>	3 years ago
pqueue.c	Update copyright year	2 years ago
s3_cbc.c	TLS fixes for CBC mode and no-deprecated	3 years ago
s3_enc.c	Clean away extraneous library specific FETCH_FAILED reason codes	2 years ago
s3_lib.c	Adding TLS group name retrieval	2 years ago
s3_msg.c	Update copyright year	2 years ago
ssl_asn1.c	Update copyright year	2 years ago
ssl_cert.c	Add X509_NAME_hash_ex() to be able to check if it failed due to unsupported SHA1	2 years ago
ssl_cert_table.h	Following the license change, modify the boilerplates in ssl/	4 years ago
ssl_ciph.c	Remove extra space.	2 years ago
ssl_conf.c	Implement a replacement for SSL_set_tmp_dh()	2 years ago
ssl_err.c	Clean away extraneous library specific FETCH_FAILED reason codes	2 years ago
ssl_err_legacy.c	Modify the ERR init functions to use the internal ERR string loaders	2 years ago
ssl_init.c	Modify the ERR init functions to use the internal ERR string loaders	2 years ago
ssl_lib.c	replace 'unsigned const char' with 'const unsigned char'	2 years ago
ssl_local.h	Adding TLS group name retrieval	2 years ago
ssl_mcnf.c	SSL: refactor all SSLfatal() calls	2 years ago
ssl_rsa.c	Don't copy parameters on setting a key in libssl	2 years ago
ssl_rsa_legacy.c	Deprecate RSA harder	2 years ago
ssl_sess.c	SSL: refactor all SSLfatal() calls	2 years ago
ssl_stat.c	Reorganize local header files	4 years ago
ssl_txt.c	Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call	2 years ago
ssl_utst.c	Reorganize local header files	4 years ago
sslerr.h	Update copyright year	2 years ago
t1_enc.c	Clean away extraneous library specific FETCH_FAILED reason codes	2 years ago
t1_lib.c	Adding TLS group name retrieval	2 years ago
t1_trce.c	t1_trce: Fix remaining places where the 24 bit shift overflow happens	3 years ago
tls13_enc.c	Clean away extraneous library specific FETCH_FAILED reason codes	2 years ago
tls_depr.c	Implement a replacement for SSL_set_tmp_dh()	2 years ago
tls_srp.c	SSL: refactor all SSLfatal() calls	2 years ago