summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
8 daysAdd docs noting requirements for SM2 signingopenssl-3.0Neil Horman
Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24078) (cherry picked from commit 54673b93594a71c9f8052a1df1a7c6bf07c49f4d)
8 daysAdd check for public key presence on sm2 signingNeil Horman
SM2 requires that the public EC_POINT be present in a key when signing. If its not there we crash on a NULL pointer. Add a check to ensure that its present, and raise an error if its not Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24078) (cherry picked from commit 1316aa05aae57cf47d8c8bfca38aaa042db1518f)
11 daysess_lib.c: Changed ERR_LIB_CMS to ERR_LIB_ESSleerubin13
This fixes an incorrect error message. Fixes #24224 CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24290) (cherry picked from commit 2d29a8a7e8ef42050d2b08ca8cec9e4d9f0a0bb7)
11 daysdoc: clarify SSL_CIPHER_description allocationDaniel McCarney
Previously the documentation for `SSL_CIPHER_description` said: > If buf is provided, it must be at least 128 bytes, otherwise a buffer > will be allocated using OPENSSL_malloc(). In reality, `OPENSSL_malloc` is only invoked if the provided `buf` argument is `NULL`. If the `buf` arg is not `NULL`, but smaller than 128 bytes, the function returns `NULL` without attempting to allocate a new buffer for the description. This commit adjusts the documentation to better describe the implemented behaviour. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23921) (cherry picked from commit 6a4a714045415be6720f4165c4d70a0ff229a26a)
2024-04-26Fix missing NULL check in prov_config_testNeil Horman
coverity-1596500 caught a missing null check. We should never hit it as the test harness always sets the environment variable, but lets add the check for safety Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24198) (cherry picked from commit a380ec952f138f644d227637eeba90fd1e17f72f)
2024-04-26Fix up path generation to use OPENSSL_MODULESNeil Horman
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (cherry picked from commit 4e3c1e6206251c59855362d6d2edab4621c31dec) (Merged from https://github.com/openssl/openssl/pull/24198) (cherry picked from commit 163202f0b95cfc7e666e45cafc55a505f51f6153)
2024-04-26Update modulepath test for provider config to skip if not presentNeil Horman
If the p_test.so library isn't present, don't run the test Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (cherry picked from commit b80fed3f27ebe156b17246f7c12c5178cbe6834e) (Merged from https://github.com/openssl/openssl/pull/24198) (cherry picked from commit 83c649996c18e5185f9439172d5908ad7fef9146)
2024-04-26Add test for OSSL_PROVIDER_load with module path setNeil Horman
Ensure that, with the modulepath setting set in a config field, that we are able to load a provider from the path relative to OPENSSL_MODULES Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (cherry picked from commit 91a77cbf66c575345cf1eab31717e8edafcd1633) (Merged from https://github.com/openssl/openssl/pull/24198) (cherry picked from commit db163245097bc813235403c234795721d4e5c4eb)
2024-04-26set module path from templateNeil Horman
Modules that aren't activated at conf load time don't seem to set the module path from the template leading to load failures. Make sure to set that Fixes #24020 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (cherry picked from commit bc9595963a45e28e6a8b2de45a6719c252bd3a3d) (Merged from https://github.com/openssl/openssl/pull/24198) (cherry picked from commit 71e5bb982f9c9563567ea8ae9f6e29492e9146ca)
2024-04-26Add an Apple privacy info file for OpenSSLTakehiko Yokota
Added PrivacyInfo.xcprivacy to os-dep/Apple/ dir. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24260) (cherry picked from commit bde66e828dd2869d02225e4aab01d0983f242ae3)
2024-04-24Update perl-actions/install-with-cpanm version in CITomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/23613) (cherry picked from commit 599bc929baa3c5496342641e028e4c482aed7449)
2024-04-23Invoke tear_down when exiting test_encode_tls_sct() prematurelyshridhar kalavagunta
Fixes #24121 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24222) (cherry picked from commit 264ff64b9443e60c7c93af0ced2b22fdf622d179)
2024-04-19Fix migration guide mappings for i2o/o2i_ECPublicKeyslontis
Fixes #23854 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24041) (cherry picked from commit 6594baf6457c64f6fce3ec60cb2617f75d98d159)
2024-04-17Handle empty param in EVP_PKEY_CTX_add1_hkdf_infotrinity-1686a
Fixes #24130 The regression was introduced in PR #23456. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24141) (cherry picked from commit 299996fb1fcd76eeadfd547958de2a1b822f37f5)
2024-04-16doc/fingerprints.txt: Add the future OpenSSL release keyRichard Levitte
This will be used for future releases Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24063) (cherry picked from commit 4ffef97d3755a0425d5d72680daebfa07383b05c)
2024-04-15list_provider_info(): Fix leak on errorTomas Mraz
Fixes #24110 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24117) (cherry picked from commit 993c2407d04956ffdf9b32cf0a7e4938ace816dc)
2024-04-12make_addressPrefix(): Fix a memory leak in error caseTomas Mraz
Fixes #24098 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24102) (cherry picked from commit 682ed1b86ebe97036ab37897d528343d0e4def69)
2024-04-10Document that private and pairwise checks are not bounded by key sizeTomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/24049) (cherry picked from commit 27005cecc75ec7a22a673d57fc35a11dea30ac0a)
2024-04-10Fix socket descriptor checks on Windowsolszomal
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24035) (cherry picked from commit c89baf871030c811ba316ccbdcea26c294f605ae)
2024-04-10man EVP_PKEY_CTX_set_params: document params is a listHubert Kario
Signed-off-by: Hubert Kario <hkario@redhat.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23986) (cherry picked from commit 9b87c5a3ffa1ca233be96dd0bce812c04bad53fe)
2024-04-09APPS: Add missing OPENSSL_free() and combine the error handlerJiasheng Jiang
Add the OPENSSL_free() in the error handler to release the "*md_value" allocated by app_malloc(). To make the code clear and avoid possible future errors, combine the error handler in the "err" tag. Then, we only need to use "goto err" instead of releasing the memory separately. Since the EVP_MD_get_size() may return negative numbers when an error occurs, create_query() may fail to catch the error since it only considers 0 as an error code. Therefore, unifying the error codes of create_digest() from non-positive numbers to 0 is better, which also benefits future programming. Fixes: c7235be ("RFC 3161 compliant time stamp request creation, response generation and response verification.") Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/23873) (cherry picked from commit beb82177ddcd4b536544ceec92bb53f4d85d8e91)
2024-04-09Fix "Error finalizing cipher loop" when running openssl speed -evp -decryptTom Cosgrove
When using CCM, openssl speed uses the loop function EVP_Update_loop_ccm() which sets a (fake) tag when decrypting. When using -aead (which benchmarks a different sequence than normal, to be comparable to TLS operation), the loop function EVP_Update_loop_aead() is used, which also sets a tag when decrypting. However, when using defaults, the loop function EVP_Update_loop() is used, which does not set a tag on decryption, leading to "Error finalizing cipher loop". To fix this, set a fake tag value if we're doing decryption on an AEAD cipher in EVP_Update_loop(). We don't check the return value: this shouldn't really be able to fail, and if it does, the following EVP_DecryptUpdate() is almost certain to fail, so that can catch it. The decryption is certain to fail (well, almost certain, but with a very low probability of success), but this is no worse than at present. This minimal change means that future benchmarking data should be comparable to previous benchmarking data. (This is benchmarking code: don't write real apps like this!) Fixes #23657 Change-Id: Id581cf30503c1eb766464e315b1f33914040dcf7 Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23757) (cherry picked from commit b3be6cc89e4dcfafe8f8be97e9519c26af2d19f5)
2024-04-09Fix EVP_PKEY_CTX_add1_hkdf_info() behaviorTodd Short
Fix #23448 `EVP_PKEY_CTX_add1_hkdf_info()` behaves like a `set1` function. Fix the setting of the parameter in the params code. Update the TLS_PRF code to also use the params code. Add tests. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23456) (cherry picked from commit 6b566687b58fde08b28e3331377f050768fad89b)
2024-04-08Add a test for session cache overflowMatt Caswell
Test sessions behave as we expect even in the case that an overflow occurs when adding a new session into the session cache. Related to CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24044) (cherry picked from commit ddead0935d77ba9b771d632ace61b145d7153f18)
2024-04-08Hardening around not_resumable sessionsMatt Caswell
Make sure we can't inadvertently use a not_resumable session Related to CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24044) (cherry picked from commit c342f4b8bd2d0b375b0e22337057c2eab47d9b96)
2024-04-08Add a CHANGES.md/NEWS.md entry for the unbounded memory growth bugMatt Caswell
Related to CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24044) (cherry picked from commit e32ad41b48c28d82339de064b05d5e269e5aed97)
2024-04-08Fix unconstrained session cache growth in TLSv1.3Matt Caswell
In TLSv1.3 we create a new session object for each ticket that we send. We do this by duplicating the original session. If SSL_OP_NO_TICKET is in use then the new session will be added to the session cache. However, if early data is not in use (and therefore anti-replay protection is being used), then multiple threads could be resuming from the same session simultaneously. If this happens and a problem occurs on one of the threads, then the original session object could be marked as not_resumable. When we duplicate the session object this not_resumable status gets copied into the new session object. The new session object is then added to the session cache even though it is not_resumable. Subsequently, another bug means that the session_id_length is set to 0 for sessions that are marked as not_resumable - even though that session is still in the cache. Once this happens the session can never be removed from the cache. When that object gets to be the session cache tail object the cache never shrinks again and grows indefinitely. CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24044) (cherry picked from commit 7e4d731b1c07201ad9374c1cd9ac5263bdf35bce)
2024-04-08Extend the multi_resume test for simultaneous resumptionsMatt Caswell
Test what happens if the same session gets resumed multiple times at the same time - and one of them gets marked as not_resumable. Related to CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24044) (cherry picked from commit 031b11a4054c972a5e2f07dfa81ce1842453253e)
2024-04-08Add a test for session cache handlingMatt Caswell
Repeatedly create sessions to be added to the cache and ensure we never exceed the expected size. Related to CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24044) (cherry picked from commit 5f5b9e1ca1fad0215f623b8bd4955a2e8101f306)
2024-04-04downgrade upload-artifact action to v3Dmitry Misharov
GitHub Enterpise Server is not compatible with upload-artifact@v4+. https://github.com/actions/upload-artifact/tree/v4 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24029) (cherry picked from commit 089271601a1d085f33ef7b7d8c3b6879045be370)
2024-04-04openssl-crl(1): The -verify option is implied by -CA* optionsTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/24024) (cherry picked from commit a16f2e7651b22ee992bb0c279e25164b519c1e80)
2024-04-04DEFINE_STACK_OF.pod: Fix prototypes of sk_TYPE_free/zero()Tomas Mraz
They take non-const STACK_OF(TYPE)* argument. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24023) (cherry picked from commit e898c367312c3ab6eb5eaac9b4be768f0d2e4b0e)
2024-04-04Backported .gitignore changes from masterdgbkn
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23847)
2024-04-04Add 'documentation policy' link to CONTRIBUTING guide.slontis
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23875) (cherry picked from commit e817766c0f46f371fabe344fba60d13afcfc3da9)
2024-04-04Align 'openssl req' string_mask docs to how the software really worksJob Snijders
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23699) (cherry picked from commit 2410cb42e62c3be69dcf1aad1bdf1eb0233b670f)
2024-04-02Fix handling of NULL sig parameter in ECDSA_sign and similarBernd Edlinger
The problem is, that it almost works to pass sig=NULL to the ECDSA_sign, ECDSA_sign_ex and DSA_sign, to compute the necessary space for the resulting signature. But since the ECDSA signature is non-deterministic (except when ECDSA_sign_setup/ECDSA_sign_ex are used) the resulting length may be different when the API is called again. This can easily cause random memory corruption. Several internal APIs had the same issue, but since they are never called with sig=NULL, it is better to make them return an error in that case, instead of making the code more complex. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23529) (cherry picked from commit 1fa2bf9b1885d2e87524421fea5041d40149cffa)
2024-04-02Fix openssl req with -addext subjectAltName=dirNameBernd Edlinger
The syntax check of the -addext fails because the X509V3_CTX is used to lookup the referenced section, but the wrong configuration file is used, where only a default section with all passed in -addext lines is available. Thus it was not possible to use the subjectAltName=dirName:section as an -addext parameter. Probably other extensions as well. This change affects only the syntax check, the real extension was already created with correct parameters. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23669) (cherry picked from commit 387418893e45e588d1cbd4222549b5113437c9ab)
2024-04-02Bump actions/setup-python from 5.0.0 to 5.1.0dependabot[bot]
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.0.0 to 5.1.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v5.0.0...v5.1.0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23977) (cherry picked from commit de85587911dcd41dc3546b348acf9c9f15dd7c3d)
2024-04-02Explicitly state what -keys doesSimo Sorce
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23919) (cherry picked from commit 693c479a2ca671e0dfca8d1ad14e789169b982ff)
2024-03-25Add NULL check before accessing PKCS7 encrypted algorithmViliam Lejčík
Printing content of an invalid test certificate causes application crash, because of NULL dereference: user@user:~/openssl$ openssl pkcs12 -in test/recipes/80-test_pkcs12_data/bad2.p12 -passin pass: -info MAC: sha256, Iteration 2048 MAC length: 32, salt length: 8 PKCS7 Encrypted data: Segmentation fault (core dumped) Added test cases for pkcs12 bad certificates Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23632) (cherry picked from commit a4cbffcd8998180b98bb9f7ce6065ed37d079d8b)
2024-03-25Replace unsigned with intJiasheng Jiang
Replace the type of "digest_length" with int to avoid implicit conversion when it is assigned by EVP_MD_get_size(). Otherwise, it may pass the following check and cause the integer overflow error when EVP_MD_get_size() returns negative numbers. Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23922) (cherry picked from commit f13ddaab69def0b453b75a8f2deb80e1f1634f42)
2024-03-22Fixed a typo and grammar in openssl-ts.podolszomal
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23913) (cherry picked from commit f1c14f1853d2df94e339208eed1df823c2238389)
2024-03-22Add M1 macOS runner to some workflowsDmitry Misharov
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23724) (cherry picked from commit ada9d8c785cce8e75a88675622dd5ec79e9aa6d7)
2024-03-22Update FIPS hmac key documentationMatt Hauck
The documentation is slightly incorrect about the FIPS hmac key. CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23846) (cherry picked from commit 53ef123f48d402aff7c27f8ec15191cb1cde4105)
2024-03-15Fix unbounded memory growth when using no-cached-fetchMatt Caswell
When OpenSSL has been compiled with no-cached-fetch we do not cache algorithms fetched from a provider. When we export an EVP_PKEY to a provider we cache the details of that export in the operation cache for that EVP_PKEY. Amoung the details we cache is the EVP_KEYMGMT that we used for the export. When we come to reuse the key in the same provider that we have previously exported the key to, we check the operation cache for the cached key data. However because the EVP_KEYMGMT instance was not cached then instance will be different every time and we were not recognising that we had already exported the key to the provider. This causes us to re-export the key to the same provider everytime the key is used. Since this consumes memory we end up with unbounded memory growth. The fix is to be more intelligent about recognising that we have already exported key data to a given provider even if the EVP_KEYMGMT instance is different. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23841) (cherry picked from commit dc9bc6c8e1bd329ead703417a2235ab3e97557ec)
2024-03-15SSL_add_dir_cert_subjects_to_stack(): Documented return valuesShakti Shah
In the man page for SSL_add_dir_cert_subjects_to_stack(), the functions returning int have undocumented return values. Fixes #23171 Signed-off-by: Shakti Shah <shaktishah33@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23433) (cherry picked from commit 9f3a7ca2cfff948b21f8fdbe92069b3eea1c01fa)
2024-03-15Fix ASLR to be smaller during asan/tsan/ubsan runsNeil Horman
Recently asan/tsan/ubsan runs have been failing randomly. It appears that a recent runner update may have led to the Address Space Layout Randomization setting in the linux kernel of ubuntu-latest runner getting set to too high a value (it defaults to 30). Such a setting leads to the possibility that a given application will have memory mapped to an address space that the sanitizer code typically uses to do its job. Lowering this value allows a/t/ubsan to work consistently again Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23842) (cherry picked from commit 37cd49f57f9ce4128381ca122b0ac8ca21395265)
2024-03-14Fix dasync_rsa_decrypt to call EVP_PKEY_meth_get_decryptVladimirs Ambrosovs
Signed-off-by: Vladimirs Ambrosovs <rodriguez.twister@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23825) (cherry picked from commit c91f0ca95881d03a54aedee197bbf5ffffc02935)
2024-03-12Doc: fix style谭九鼎
CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23805) (cherry picked from commit 52a75f4088f2b2c59721152d9ec6ecf4d17c7e43)
2024-03-11FAQ.md should be removedAlexandr Nedvedicky
the page the link refers to does not exist. Anyone objects to delete file? Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23719) (cherry picked from commit 854539889d31ed2ea63280256fd7aab66e828ae5)
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-10 20:48:34 +0000