openssl/crypto/err
Richard Levitte acb90ba8ff EVP: Downgrade keys rather than upgrade
Upgrading EVP_PKEYs from containing legacy keys to containing provider
side keys proved to be risky, with a number of unpleasant corner
cases, and with functions like EVP_PKEY_get0_DSA() failing
unexpectedly.

We therefore change course, and instead of upgrading legacy internal
keys to provider side internal keys, we downgrade provider side
internal keys to legacy ones.  To be able to do this, we add
|import_from| and make it a callback function designed for
evp_keymgmt_export().

This means that evp_pkey_upgrade_to_provider() is replaced with
evp_pkey_downgrade().

EVP_PKEY_copy_parameters() is the most deeply affected function of
this change.

Fixes #11366

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11375)
2020-03-25 17:01:10 +01:00
..
build.info ERR: Add new building blocks for reporting errors 2019-07-31 06:42:45 +02:00
err_all.c Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.c 2020-02-10 16:49:37 +01:00
err_blocks.c Reorganize local header files 2019-09-28 20:26:35 +02:00
err_local.h Reorganize local header files 2019-09-28 20:26:35 +02:00
err_prn.c fix two mistakes w.r.t. ERR_LIB_* parameters in ERR_add_error_txt() 2020-03-10 16:09:44 +01:00
err.c Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.c 2020-02-10 16:49:37 +01:00
openssl.ec Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.c 2020-02-10 16:49:37 +01:00
openssl.txt EVP: Downgrade keys rather than upgrade 2020-03-25 17:01:10 +01:00
README

Adding new libraries
--------------------

When adding a new sub-library to OpenSSL, assign it a library number
ERR_LIB_XXX, define a macro XXXerr() (both in err.h), add its
name to ERR_str_libraries[] (in crypto/err/err.c), and add
ERR_load_XXX_strings() to the ERR_load_crypto_strings() function
(in crypto/err/err_all.c). Finally, add an entry:

    L      XXX     xxx.h   xxx_err.c

to crypto/err/openssl.ec, and add xxx_err.c to the Makefile.
Running make errors will then generate a file xxx_err.c, and
add all error codes used in the library to xxx.h.

Additionally the library include file must have a certain form.
Typically it will initially look like this:

    #ifndef HEADER_XXX_H
    #define HEADER_XXX_H

    #ifdef __cplusplus
    extern "C" {
    #endif

    /* Include files */

    #include <openssl/bio.h>
    #include <openssl/x509.h>

    /* Macros, structures and function prototypes */


    /* BEGIN ERROR CODES */

The BEGIN ERROR CODES sequence is used by the error code
generation script as the point to place new error codes, any text
after this point will be overwritten when make errors is run.
The closing #endif etc will be automatically added by the script.

The generated C error code file xxx_err.c will load the header
files stdio.h, openssl/err.h and openssl/xxx.h so the
header file must load any additional header files containing any
definitions it uses.