summaryrefslogtreecommitdiff
path: root/Cryptlib
AgeCommit message (Collapse)Author
2018-10-09Include FIPS objects in OpenSSL's makefile.Peter Jones
2018-10-09CrtLibSupport.h: declare secure_getenv()Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-10-09Make the FIPS module actually build.Peter Jones
- Remove the vestigial FIPS stuff from upstream - Make the fips module honor all the stuff we turn off. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-10-09Make update.sh use git amPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-08-01Undo part of our old openssl version rollback.Peter Jones
When OpenSSL 1.1.0e didn't work so well, we added a macro for abort() to passify the build. Now that we've got 1.1.0e in again, that macro messes up building SysCall/CrtWrapper.c. This patch gets rid of the macro. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-08-01Cryptlib: Amend update.sh for the CA check workaroundGary Lin
Also add the workaround patch so we won't lose it for the future update. Signed-off-by: Gary Lin <glin@suse.com>
2018-08-01Cryptlib: Apply the less strict CA checkGary Lin
Since openssl < 1.1.0 didn't check the x509 v3 extension strictly, a CA certificate without the CA flag in the basic constraints or KeyCertSign in the key usage was still loaded to verify EFI images. We relax the check for now. In the future, the workaround should be removed. Signed-off-by: Gary Lin <glin@suse.com>
2018-08-01Cryptlib: replace CryptPem with the Null versionGary Lin
CryptPem only provides one function: RsaGetPrivateKeyFromPem(). Since we don't need to retrieve any private key, it's safe to disable the function. Signed-off-by: Gary Lin <glin@suse.com>
2018-08-01Cryptlib/OpenSSL: update to openssl 1.1.0eGary Lin
- Delete the old openssl files and use the script to copy the new files - Add "-DNO_SYSLOG" to CFLAGS and add crypto/include to the include path Signed-off-by: Gary Lin <glin@suse.com>
2018-08-01Cryptlib/OpenSSL: Update the script to copy the new openssl filesGary Lin
- Update update.sh to copy the openssl 1.1.0 source files - Refresh the supplemental patch to reflect the change - Add a patch for pk7_smime.c (*) * aaf8049c3995dd2c0c42087a601c262545f36b9c Fix a missing OpenSSL error message point Signed-off-by: Gary Lin <glin@suse.com>
2018-08-01Cryptlib: Update to the latest edk2 commitGary Lin
- Update to edk2 commit 7c410b3d4180087020c7734bf67cdc4ad9fdb136 CryptoPkg/BaseCryptLib: Adding NULL checking in time() wrapper. - Update headers in Cryptlib/Include/openssl/ to 1.1.0e + Also copy the openssl internal headers Signed-off-by: Gary Lin <glin@suse.com>
2018-08-01Cryptlib: Amend update.sh and refresh Cryptlib.diffGary Lin
- Remove the openssl version from update.sh since edk2 doesn't use the version number in the directory name anymore. - Refresh Cryptlib.diff to reflect the change Signed-off-by: Gary Lin <glin@suse.com>
2018-08-01Cryptlib: Rename OpenSslSupport.h as CrtLibSupport.hGary Lin
Edk2 renamed OpenSslSupport.h, so we have to follow the change. Also merge some changes from edk2 CrtLibSupport.h Signed-off-by: Gary Lin <glin@suse.com>
2018-03-15Work around clang bugs for scan-build.Peter Jones
I don't think the x86 binaries clang builds will actually work unless they just infer -maccumulate-outgoing-args from __attribute__((__ms_abi__), but it's nice to have the analyzer working. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12CryptLib: Add the AsciiStrCpy() decl.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Move includes around to clean the source tree up a bit.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-06Add -m64 compiler flag to allow cross-compiling to 64-bit version on 32-bit ↵Tamas K Lengyel
system Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-02-28Cryptlib: replace CryptPem with CryptPemNullGary Lin
We don't need the functions in CryptPem.c. Signed-off-by: Gary Lin <glin@suse.com>
2017-12-19Don't let openssl() try to call an external abort()Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Work around some annoying compiler grievancesPeter Jones
I'm still having some trouble with the offsetof() definition, so just nerf it to what stddef.h would say anyway. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Some things went weird with the openssl revert...Peter Jones
I think this works around most of them. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Cryptlib: remove DESGary Lin
Disable DES completely since it's already old and insecure. This makes MokManager not support the DES based password hash but probably no one is using it. Signed-off-by: Gary Lin <glin@suse.com>
2017-09-08Cryptlib: Remove MD4Gary Lin
MD4 is known to be insecure and shim never uses it. Signed-off-by: Gary Lin <glin@suse.com>
2017-09-08Cryptlib: amend the headers and fix signnessGary Lin
- Declare some functions in the proper headers + We missed them for a long time... - Cast offsetof to UINTN + The original casting triggers the gcc warning since int can not present the offset for the 64bit machines. - Cast the "char" array to "CHAR8 *" to avoid the gcc warnings - Implement atoi correctly Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Cryptlib: implement strcmp() and strcasecmp()Gary Lin
strcmp() and strcasecmp() are widely used in openssl. Implement those two functions to eliminate the gcc warnings and the potential crash. Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Cryptlib: Include stddef.h in CrtLibSupport.hGary Lin
The changes in the openssl headers cause the inclusion of CrtLibSupport.h eariler than the inclusion of stddef.h, so "offsetof" was defined twice and this caused the followling build error: In file included from Cryptlib/Include/openssl/buffer.h:23:0, from Cryptlib/Include/openssl/x509.h:22, from shim.c:56: /usr/lib64/gcc/x86_64-suse-linux/6/include/stddef.h:417:0: error: "offsetof" redefined [-Werror] #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) In file included from Cryptlib/Include/limits.h:15:0, from Cryptlib/Include/openssl/ossl_typ.h:13, from Cryptlib/Include/openssl/x509.h:20, from shim.c:56: Cryptlib/Include/CrtLibSupport.h:192:0: note: this is the location of the previous definition #define offsetof(type, member) ( (int) & ((type*)0) -> member ) We can lower the priority of the gcc include path or just remove the path, but this might cause problem since the path was introduced on purpose(*). Instead, including stddef.h first is more feasible. (*) https://github.com/rhinstaller/shim/commit/d51739a416400ad348d8a1c7e3886abce11fff1b Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Revert lots of Cryptlib updates.Peter Jones
OpenSSL changes quite a bit of the key validation, and most of the keys I can find in the wild aren't marked as trusted by the new checker. Intel noticed this too: https://github.com/vathpela/edk2/commit/f536d7c3ed but instead of fixing the compatibility error, they switched their test data to match the bug. So that's pretty broken. For now, I'm reverting OpenSSL 1.1.0e, because we need those certs in the wild to work. This reverts commit 513cbe2aea689bf968f171f894f3d4cdb43524d5. This reverts commit e9cc33d6f2b7f35c6f5e349fd83fb9ae0bc66226. This reverts commit 80d49f758ead0180bfe6161931838e0578248303. This reverts commit 9bc647e2b23bcfd69a0077c0717fbc454c919a57. This reverts commit ae75df6232ad30f3e8736e9449692d58a7439260. This reverts commit e883479f35644d17db7efed710657c8543cfcb68. This reverts commit 97469449fda5ba933a64280917e776487301a127. This reverts commit e39692647f78e13d757ddbfdd36f440d5f526050. This reverts commit 0f3dfc01e2d5e7df882c963dd8dc4a0dfbfc96ad. This reverts commit 4da6ac819510c7cc4ba21d7a735d69b45daa5873. This reverts commit d064bd7eef201f26cb926450a76260b5187ac689. This reverts commit 9bc86cfd6f9387f0da9d5c0102b6aa5627e91c91. This reverts commit ab9a05a10f16b33f7ee1e9da360c7801eebdb9d2. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Fix a missing OpenSSL error message pointPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Fix openssl compile flags for x86_64Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-07-24Make it possible to build in a subdirectory.Peter Jones
This lets you do: mkdir build-x64 build-ia32 cd build-x64 make TOPDIR=.. -f ../Makefile cd ../build-ia32 setarch i686 -B make ARCH=ia32 TOPDIR=.. -f ../Makefile And not worry about generated sources and headers mixing and matching. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-04-11Cryptlib: replace CryptPem with the Null versionGary Lin
CryptPem only provides one function: RsaGetPrivateKeyFromPem(). Since we don't need to retrieve any private key, it's safe to disable the function. Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: remove DESGary Lin
Disable DES completely since it's already old and insecure. This makes MokManager not support the DES based password hash but probably no one is using it. Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: Remove MD4Gary Lin
MD4 is known to be insecure and shim never uses it. Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: implement strcmp() and strcasecmp()Gary Lin
strcmp() and strcasecmp() are widely used in openssl. Implement those two functions to eliminate the gcc warnings and the potential crash. Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: amend the headers and fix signnessGary Lin
- Declare some functions in the proper headers + We missed them for a long time... - Cast offsetof to UINTN + The original casting triggers the gcc warning since int can not present the offset for the 64bit machines. - Cast the "char" array to "CHAR8 *" to avoid the gcc warnings - Implement atoi correctly Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: Include stddef.h in CrtLibSupport.hGary Lin
The changes in the openssl headers cause the inclusion of CrtLibSupport.h eariler than the inclusion of stddef.h, so "offsetof" was defined twice and this caused the followling build error: In file included from Cryptlib/Include/openssl/buffer.h:23:0, from Cryptlib/Include/openssl/x509.h:22, from shim.c:56: /usr/lib64/gcc/x86_64-suse-linux/6/include/stddef.h:417:0: error: "offsetof" redefined [-Werror] #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) In file included from Cryptlib/Include/limits.h:15:0, from Cryptlib/Include/openssl/ossl_typ.h:13, from Cryptlib/Include/openssl/x509.h:20, from shim.c:56: Cryptlib/Include/CrtLibSupport.h:192:0: note: this is the location of the previous definition #define offsetof(type, member) ( (int) & ((type*)0) -> member ) We can lower the priority of the gcc include path or just remove the path, but this might cause problem since the path was introduced on purpose(*). Instead, including stddef.h first is more feasible. (*) https://github.com/rhinstaller/shim/commit/d51739a416400ad348d8a1c7e3886abce11fff1b Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib/OpenSSL: update to openssl 1.1.0eGary Lin
- Delete the old openssl files and use the script to copy the new files - Add "-DNO_SYSLOG" to CFLAGS and add crypto/include to the include path Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib/OpenSSL: Update the script to copy the new openssl filesGary Lin
- Update update.sh to copy the openssl 1.1.0 source files - Refresh the supplemental patch to reflect the change Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: Update to the latest edk2 commitGary Lin
- Update to edk2 commit 7c410b3d4180087020c7734bf67cdc4ad9fdb136 CryptoPkg/BaseCryptLib: Adding NULL checking in time() wrapper. - Update headers in Cryptlib/Include/openssl/ to 1.1.0e + Also copy the openssl internal headers Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: Amend update.sh and refresh Cryptlib.diffGary Lin
- Remove the openssl version from update.sh since edk2 doesn't use the version number in the directory name anymore. - Refresh Cryptlib.diff to reflect the change Signed-off-by: Gary Lin <glin@suse.com>
2017-04-11Cryptlib: Rename OpenSslSupport.h as CrtLibSupport.hGary Lin
Edk2 renamed OpenSslSupport.h, so we have to follow the change. Also merge some changes from edk2 CrtLibSupport.h Signed-off-by: Gary Lin <glin@suse.com>
2017-03-24Update to openssl 1.0.2kGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2017-03-24Update CryptlibGary Lin
Update to edk2 commit 6e4489d8129d233ef0fe85eeb6eebfecafe9ea6e (CryptoPkg: Refine type cast for pointer subtraction) Also replaced CryptAes.c, CryptArc4.c, CryptTdes.c, CryptMd4.c, CryptHmacMd5.c, and CryptHmacSha1.c with the Null version since we don't really need those functions. Signed-off-by: Gary Lin <glin@suse.com>
2016-11-30Update the CryptLibGary Lin
Update to the edk2 commit dab62c5ec8a88def3ee99c04d644720cb201de08 Signed-off-by: Gary Lin <glin@suse.com>
2016-11-30Update to openssl 1.0.2jGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2016-11-30Update the openssl update script to 1.0.2jGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2016-11-30Cryptlib: Implement memset() to avoid the potential crashGary Lin
Although the prototype of memset() is already defined in OpenSslSupport.h, the function was never implemented. It was fine since a macro was designed to replace all memset() with SetMem() after including OpenSslSupport.h. However, since openssl 1.0.2j, a new function pointer in crypto/mem_clr.c requires the "real" memset() or the program would crash due to the NULL function pointer access. This commit implements memset() (just a wrapper of SetMem()) to avoid the potential crash. Signed-off-by: Gary Lin <glin@suse.com>
2016-09-06Update the CryptLibGary Lin
Update to the edk2 commit 8ff7187cfd998d2b6db43075a4a7908281b6da00 Signed-off-by: Gary Lin <glin@suse.com>
2016-09-06Update to openssl 1.0.2hGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2016-09-06Update the openssl update script to 1.0.2hGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-20 09:04:22 +0000