summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
8 daysCorrect top for EC/DSA nonces if BN_DEBUG is onopenssl-3.3Tomas Mraz
Otherwise following operations would bail out in bn_check_top(). Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265) (cherry picked from commit a380ae85be287045b1eaa64d23942101a426c080)
8 daysAdjust FIPS EC/DSA self test data for different nonce generationTomas Mraz
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265) (cherry picked from commit 8a1f65468064e39f65ef4918c62db73a9eef80e4)
8 daysRename BN_generate_dsa_nonce() to ossl_bn_gen_dsa_nonce_fixed_top()Tomas Mraz
And create a new BN_generate_dsa_nonce() that corrects the BIGNUM top. We do this to avoid leaking fixed top numbers via the public API. Also add a slight optimization in ossl_bn_gen_dsa_nonce_fixed_top() and make it LE/BE agnostic. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265) (cherry picked from commit 9c85f6cd2d6debe5ef6ef475ff4bf17e0985f7a2)
8 daysAdd ossl_bn_priv_rand_range_fixed_top() and use it for EC/DSATomas Mraz
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265) (cherry picked from commit 13b3ca5c998e6db4f7251a56c43541cb1a422bd0)
8 daysMake ossl_gen_deterministic_nonce_rfc6979() constant timeTomas Mraz
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265) (cherry picked from commit 2d285fa873028f6cff9484a0cdf690fe05d7fb16)
8 daysMake BN_generate_dsa_nonce() constant time and non-biasedTomas Mraz
Co-authored-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265) (cherry picked from commit d7d1bdcb6aa3d5000bf7f5ebc5518be5c91fd5a5)
9 daysFixed typos in EVP_PKEY_decrypt.pod and RSA_public_encrypt.podsapph2c
CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24304) (cherry picked from commit f4601b6de709a89120c86ad825b70f65b332deed)
9 daysFix intermittent sslapitest early data related failuresMatt Caswell
Early data is time sensitive. We have an approx 8 second allowance between writing the early data and reading it. If we exceed that time tests will fail. This can sometimes (rarely) occur in normal CI operation. We can try and detect this and just ignore the result of such test failures if the test has taken too long. We assume anything over 7 seconds is too long. This is a partial fix for #22605 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23966) (cherry picked from commit 1848c561ec39a9ea91ff1bf740a554be274f98b0)
9 daysUse OSSL_TIME instead of using arithmetic directly on time_tMatt Caswell
We have functions for adding/subtracting time. We should use them. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23966) (cherry picked from commit afb6ce0d0f5b8e88f8b4f420aba0a8e59f58934f)
10 daysFix race for X509 store found by thread sanitizerRobert Schulze
The following issue was found in automatic tests with thread sanitizer builds in ClickHouse (which uses OpenSSL 3.2.1) [0]. The first stack [1] does proper locking (function 'x509_store_add', x509_lu.c) but in the second stack [2], function 'get_cert_by_subject_ex' (by_dir.b) forgets to lock when calling 'sk_X509_OBJECT_is_sorted'. [0] https://github.com/ClickHouse/ClickHouse/issues/63049 [1] WARNING: ThreadSanitizer: data race (pid=1870) Write of size 4 at 0x7b08003d6810 by thread T552 (mutexes: write M0, write M1, write M2, write M3): #0 OPENSSL_sk_insert build_docker/./contrib/openssl/crypto/stack/stack.c:280:16 (clickhouse+0x203ad7e4) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #1 OPENSSL_sk_push build_docker/./contrib/openssl/crypto/stack/stack.c:401:12 (clickhouse+0x203ad7e4) #2 x509_store_add build_docker/./contrib/openssl/crypto/x509/x509_lu.c:419:17 (clickhouse+0x203d4a52) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #3 X509_STORE_add_cert build_docker/./contrib/openssl/crypto/x509/x509_lu.c:432:10 (clickhouse+0x203d48a2) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #4 X509_load_cert_file_ex build_docker/./contrib/openssl/crypto/x509/by_file.c:127:18 (clickhouse+0x203b74e6) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #5 get_cert_by_subject_ex build_docker/./contrib/openssl/crypto/x509/by_dir.c:333:22 (clickhouse+0x203b684c) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #6 X509_LOOKUP_by_subject_ex build_docker/./contrib/openssl/crypto/x509/x509_lu.c:105:16 (clickhouse+0x203d46ec) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #7 ossl_x509_store_ctx_get_by_subject build_docker/./contrib/openssl/crypto/x509/x509_lu.c:360:17 (clickhouse+0x203d46ec) #8 X509_STORE_CTX_get1_issuer build_docker/./contrib/openssl/crypto/x509/x509_lu.c:782:10 (clickhouse+0x203d56cb) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #9 get1_trusted_issuer build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:3194:10 (clickhouse+0x203db4a9) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #10 build_chain build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:3324:40 (clickhouse+0x203db4a9) #11 verify_chain build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:240:15 (clickhouse+0x203dbe27) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #12 x509_verify_x509 build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:358 (clickhouse+0x203d7fd8) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #13 X509_verify_cert build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:293:56 (clickhouse+0x203d8215) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #14 ssl_verify_internal build_docker/./contrib/openssl/ssl/ssl_cert.c:496:13 (clickhouse+0x2019a2a4) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #15 ssl_verify_cert_chain build_docker/./contrib/openssl/ssl/ssl_cert.c:543:12 (clickhouse+0x2019a402) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #16 tls_post_process_server_certificate build_docker/./contrib/openssl/ssl/statem/statem_clnt.c:2072:9 (clickhouse+0x20227658) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #17 ossl_statem_client_post_process_message build_docker/./contrib/openssl/ssl/statem/statem_clnt.c:1159:16 (clickhouse+0x202272ee) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #18 read_state_machine build_docker/./contrib/openssl/ssl/statem/statem.c:712:35 (clickhouse+0x2021e96d) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #19 state_machine build_docker/./contrib/openssl/ssl/statem/statem.c:478:21 (clickhouse+0x2021e96d) #20 ossl_statem_connect build_docker/./contrib/openssl/ssl/statem/statem.c:297:12 (clickhouse+0x2021ddce) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #21 SSL_do_handshake build_docker/./contrib/openssl/ssl/ssl_lib.c:4746:19 (clickhouse+0x201a5781) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #22 SSL_connect build_docker/./contrib/openssl/ssl/ssl_lib.c:2208:12 (clickhouse+0x201a5893) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #23 Poco::Net::SecureSocketImpl::connectSSL(bool) build_docker/./base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp:206:11 (clickhouse+0x1d179567) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) [2] Previous read of size 4 at 0x7b08003d6810 by thread T553 (mutexes: write M4, write M5, write M6): #0 OPENSSL_sk_is_sorted build_docker/./contrib/openssl/crypto/stack/stack.c:490:33 (clickhouse+0x203adcff) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #1 get_cert_by_subject_ex build_docker/./contrib/openssl/crypto/x509/by_dir.c:423:10 (clickhouse+0x203b6d8f) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #2 X509_LOOKUP_by_subject_ex build_docker/./contrib/openssl/crypto/x509/x509_lu.c:105:16 (clickhouse+0x203d46ec) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #3 ossl_x509_store_ctx_get_by_subject build_docker/./contrib/openssl/crypto/x509/x509_lu.c:360:17 (clickhouse+0x203d46ec) #4 X509_STORE_CTX_get1_issuer build_docker/./contrib/openssl/crypto/x509/x509_lu.c:782:10 (clickhouse+0x203d56cb) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #5 get1_trusted_issuer build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:3194:10 (clickhouse+0x203db4a9) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #6 build_chain build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:3324:40 (clickhouse+0x203db4a9) #7 verify_chain build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:240:15 (clickhouse+0x203dbe27) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #8 x509_verify_x509 build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:358 (clickhouse+0x203d7fd8) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #9 X509_verify_cert build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:293:56 (clickhouse+0x203d8215) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #10 ssl_verify_internal build_docker/./contrib/openssl/ssl/ssl_cert.c:496:13 (clickhouse+0x2019a2a4) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #11 ssl_verify_cert_chain build_docker/./contrib/openssl/ssl/ssl_cert.c:543:12 (clickhouse+0x2019a402) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #12 tls_post_process_server_certificate build_docker/./contrib/openssl/ssl/statem/statem_clnt.c:2072:9 (clickhouse+0x20227658) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #13 ossl_statem_client_post_process_message build_docker/./contrib/openssl/ssl/statem/statem_clnt.c:1159:16 (clickhouse+0x202272ee) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #14 read_state_machine build_docker/./contrib/openssl/ssl/statem/statem.c:712:35 (clickhouse+0x2021e96d) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #15 state_machine build_docker/./contrib/openssl/ssl/statem/statem.c:478:21 (clickhouse+0x2021e96d) #16 ossl_statem_connect build_docker/./contrib/openssl/ssl/statem/statem.c:297:12 (clickhouse+0x2021ddce) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #17 SSL_do_handshake build_docker/./contrib/openssl/ssl/ssl_lib.c:4746:19 (clickhouse+0x201a5781) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #18 SSL_connect build_docker/./contrib/openssl/ssl/ssl_lib.c:2208:12 (clickhouse+0x201a5893) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) #19 Poco::Net::SecureSocketImpl::connectSSL(bool) build_docker/./base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp:206:11 (clickhouse+0x1d179567) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b) CLA: trivial Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24295) (cherry picked from commit af75373eeab6040aba243dd7629fb6f8244f2f5d)
10 daysess_lib.c: Changed ERR_LIB_CMS to ERR_LIB_ESSleerubin13
This fixes an incorrect error message. Fixes #24224 CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24290) (cherry picked from commit 2d29a8a7e8ef42050d2b08ca8cec9e4d9f0a0bb7)
11 daysdoc: clarify SSL_CIPHER_description allocationDaniel McCarney
Previously the documentation for `SSL_CIPHER_description` said: > If buf is provided, it must be at least 128 bytes, otherwise a buffer > will be allocated using OPENSSL_malloc(). In reality, `OPENSSL_malloc` is only invoked if the provided `buf` argument is `NULL`. If the `buf` arg is not `NULL`, but smaller than 128 bytes, the function returns `NULL` without attempting to allocate a new buffer for the description. This commit adjusts the documentation to better describe the implemented behaviour. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23921) (cherry picked from commit 6a4a714045415be6720f4165c4d70a0ff229a26a)
11 daysarchive artifacts before uploadDmitry Misharov
Some CI jobs produce a significant amount artifacts and it takes a lot of time to upload them into GitHub artifacts storage. It will be much faster to upload only one archive with artifacts. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24264) (cherry picked from commit 58ffcbbdc3302a35cea317aeee6b76987907ee60)
11 daysupdated to oqs-provider 0.6.0Michael Baentsch
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24261) (cherry picked from commit 7b1829fa37922a37ef9259fc1bc4038829e4fd73)
11 days82-test_ocsp_cert_chain.t: kill -HUP the server after client quitsTomas Mraz
This ensures even if the connection for some reason fails, the server will terminate and the test won't get stuck. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23857) (cherry picked from commit f4fcc21fdccfde90bda6f8a94d7f4e07f947e38f)
11 days82-test_ocsp_cert_chain.t: Terminate the server after 1 connectionTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23857) (cherry picked from commit 7054412ea8bb49d9522c3dd99982e41bf08c3ef7)
2024-04-26Add an Apple privacy info file for OpenSSLTakehiko Yokota
Added PrivacyInfo.xcprivacy to os-dep/Apple/ dir. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24260) (cherry picked from commit bde66e828dd2869d02225e4aab01d0983f242ae3)
2024-04-24Update perl-actions/install-with-cpanm version in CITomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/23613) (cherry picked from commit 599bc929baa3c5496342641e028e4c482aed7449)
2024-04-24Remove all references to FLOSS for NonStop Builds.Randall S. Becker
FLOSS is no longer a dependency for NonStop as of the deprecation of the SPT thread model builds. Fixes: #24214 Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24217) (cherry picked from commit 0339382abad578ccb3989799ea2fb99dfb2d099b)
2024-04-23Invoke tear_down when exiting test_encode_tls_sct() prematurelyshridhar kalavagunta
Fixes #24121 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24222) (cherry picked from commit 264ff64b9443e60c7c93af0ced2b22fdf622d179)
2024-04-22Be more explicit about RSAES-PKCS#1v1.5 error handlingHubert Kario
And add a note how to perform side-channel free error stack handling. Signed-off-by: Hubert Kario <hkario@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24159) (cherry picked from commit 98161274636dca12e3bfafab7d2d2ac28f4d7c30)
2024-04-22Fix missing NULL check in prov_config_testNeil Horman
coverity-1596500 caught a missing null check. We should never hit it as the test harness always sets the environment variable, but lets add the check for safety Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24208) (cherry picked from commit 6ee369cd6ec751c03879da56178e75e2691e08cb)
2024-04-22fix sending error when no root CA cert update availableRajeev Ranjan
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24169) (cherry picked from commit fc9649f61a8ac5f980da6807214fcbbbae1c45aa)
2024-04-19Fix migration guide mappings for i2o/o2i_ECPublicKeyslontis
Fixes #23854 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24041) (cherry picked from commit 6594baf6457c64f6fce3ec60cb2617f75d98d159)
2024-04-19OSSL_STORE: Add reference docs for the built-in Windows store implementationRichard Levitte
Fixes openssl/project#422 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24170) (cherry picked from commit faa4a10ebe5095765262c0e3c711fca08026c3d4)
2024-04-18Fix up path generation to use OPENSSL_MODULESNeil Horman
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24025) (cherry picked from commit 4e3c1e6206251c59855362d6d2edab4621c31dec)
2024-04-18Update modulepath test for provider config to skip if not presentNeil Horman
If the p_test.so library isn't present, don't run the test Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24025) (cherry picked from commit b80fed3f27ebe156b17246f7c12c5178cbe6834e)
2024-04-18Add test for OSSL_PROVIDER_load with module path setNeil Horman
Ensure that, with the modulepath setting set in a config field, that we are able to load a provider from the path relative to OPENSSL_MODULES Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24025) (cherry picked from commit 91a77cbf66c575345cf1eab31717e8edafcd1633)
2024-04-18set module path from templateNeil Horman
Modules that aren't activated at conf load time don't seem to set the module path from the template leading to load failures. Make sure to set that Fixes #24020 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24025) (cherry picked from commit bc9595963a45e28e6a8b2de45a6719c252bd3a3d)
2024-04-18QUIC TXP: Fix reserve calculations for PING framesHugo Landau
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24122) (cherry picked from commit c3542b22fa3f14d7b6c970d4b2c38a737d6ed8a4)
2024-04-17.ctags.d is previous, include it in our tarballsRichard Levitte
This is a simple change of .gitattributes, so our tarballs continue to be a reproducible output of a util/mktar.sh (i.e. git archive with no other funny business). Fixes #24090 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24156) (cherry picked from commit e1fd043ad7fa865a8ef9160c892b49a098d23c71)
2024-04-17Use scalar ALU and vector ALU together for chacha20 stream cipherJerry Shih
Fixes #24070 Use scalar ALU for 1 chacha block with rvv ALU simultaneously. The tail elements(non-multiple of block length) will be handled by the scalar logic. Use rvv path if the input length > chacha_block_size. And we have about 1.2x improvement comparing with the original code. Reviewed-by: Hongren Zheng <i@zenithal.me> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24097) (cherry picked from commit da8b6308bd7ad5b7c779aa2d9123bf5faacaec7f)
2024-04-17fuzz/decoder.c: Limit the EVP_PKEY_param_check on DHX keys as wellTomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24126) (cherry picked from commit 8d8a0144303374f69f73fc944dd55c68600d15e5)
2024-04-17Handle empty param in EVP_PKEY_CTX_add1_hkdf_infotrinity-1686a
Fixes #24130 The regression was introduced in PR #23456. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24141) (cherry picked from commit 299996fb1fcd76eeadfd547958de2a1b822f37f5)
2024-04-16OpenSSL 3.2.0, QUIC, macOS, error 56 on connected UDP socketAlexandr Nedvedicky
current `translate_msg()` function attempts to set `->msg_name` (and `->msg_namelen`) with `BIO`'s peer name (connection destination) regardless if underlying socket is connected or not. Such implementation uncovers differences in socket implementation between various OSes. As we have learned hard way `sendmsg()` and `sendmmsg()` on `OpenBSD` and (`MacOS` too) fail to send messages with `->msg_name` being set on connected socket. In such case the caller receives `EISCON` errro. I think `translate_msg()` caller should provide a hint to indicate whether we deal with connected (or un-connected) socket. For connected sockets the peer's name should not be set/filled by `translate_msg()`. On the other hand if socket is un-connected, then `translate_msg()` must populate `->msg_name` and `->msg_namelen` members. The caller can use `getpeername(2)` to see if socket is connected. If `getpeername()` succeeds then we must be dealing with connected socket and `translate_msg()` must not set `->msg_name` and `->msg_namelen` members. If `getpeername(2)` fails, then `translate_msg()` must provide peer's name (destination address) in `->msg_name` and set `->msg_namelen` accordingly. The propposed fix introduces `is_connected()` function, which applies `getpeername()` to socket bound to `BIO` instance. The `dgram_sendmmsg()` uses `is_connected()` as a hint for `translate_msg()` function, so msghdr gets initialized with respect to socket state. The change also modifies existing `test/quic_client_test.c` so it also covers the case of connected socket. To keep things simple we can introduce optional argument `connect_first` to `./quic_client_test` function. Without `connect_first` the test run as usual. With `connect_first` the test creates and connects socket first. Then it passes such socket to `BIO` sub-system to perform `QUIC` connect test as usual. Fixes #23251 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23396) (cherry picked from commit c062403abd71550057b3647b01cc8af4cc2fc18c)
2024-04-16doc/fingerprints.txt: Add the future OpenSSL release keyRichard Levitte
This will be used for future releases Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24063) (cherry picked from commit 4ffef97d3755a0425d5d72680daebfa07383b05c)
2024-04-16crypto/threads_pthread.c: refactor all atomics fallbacks for type safetyRichard Levitte
The atomics fallbacks were using 'void *' as a generic transport for all possible scalar and pointer types, with the hypothesis that a pointer is as large as the largest possible scalar type that we would use. Then enters the use of uint64_t, which is larger than a pointer on any 32-bit system (or any system that has 32-bit pointer configurations). We could of course choose a larger type as a generic transport. However, that only pushes the problem forward in time... and it's still a hack. It's therefore safer to reimplement the fallbacks per type that atomics are used for, and deal with missing per type fallbacks when the need arrises in the future. For test build purposes, the macro USE_ATOMIC_FALLBACKS is introduced. If OpenSSL is configured with '-DUSE_ATOMIC_FALLBACKS', the fallbacks will be used, unconditionally. Fixes #24096 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24123) (cherry picked from commit a02077d4d7aeb0c99cc88cdfc7c131e48f98c4de)
2024-04-16crypto/threads_pthread.c: Cleanup misaligned preprocessor directivesRichard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24123) (cherry picked from commit 81f393498b333534111e320a33e3b244db06bbe9)
2024-04-15Adding missing NULL pointer checkafshinpir
CLA: trivial In the provider store API, it is not necessary to provide both open and attach method at the same time and providing at least one of them is enough. Adding some null pointer checks to prevent exceptions in case of not providing both methods at the same time. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23703) (cherry picked from commit bd73e1e62c4103e0faffb79cb3d34a2a92a95439)
2024-04-15list_provider_info(): Fix leak on errorTomas Mraz
Fixes #24110 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24117) (cherry picked from commit 993c2407d04956ffdf9b32cf0a7e4938ace816dc)
2024-04-12ossl_provider_new(): Fix memory leak on errorTomas Mraz
Fixes #24095 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24100) (cherry picked from commit 875db35ac63beb0e5a3d520743fa55ad2e5ccd1d)
2024-04-12make_addressPrefix(): Fix a memory leak in error caseTomas Mraz
Fixes #24098 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24102) (cherry picked from commit 682ed1b86ebe97036ab37897d528343d0e4def69)
2024-04-11Fix duplicate mutex allocation in threads_win.cNeil Horman
Creating an rcu lock does a double allocation of the underlying mutex. Not sure how asan didn't catch this, but we clearly have a duplicate line here Fixes #24085 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24086) (cherry picked from commit 8e5918fb8eb90289a0c89f6a4c6d623ecf49cf43)
2024-04-11VMS: Move defining _XOPEN_SOURCE and _XOPEN_SOURCE_EXTENDED to config targetRichard Levitte
For all other platforms that need these macros defined, that's how it's done, so we have VMS follow suit. That avoids a crash between in source definitions and command line definitions on some other platforms. Fixes #24075 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24083)
2024-04-11Add locking to atomic operations in rw/rcu testsNeil Horman
I neglected to add locks to the calls to CRYPTO_atomic_add in these test, which on newer compilers is fine, as atomic operations are defined. However on older compilers the __ATOMIC_ACQ_REL definition is missing causing these function to be implemented using an rwlock, which when NULL causes the locks to fail. Fix this my creating the lock and using them appropriately Fixes #24000 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24001) (cherry picked from commit 5f8b812931e5da24df08913c05ff8e4f4494f014)
2024-04-11crypto/provider_core.c: Allocate activatecnt_lockOleg Bulatov
CRYPTO_atomic_add has a lock as a parameter, which is often ignored, but in some cases (for example, when BROKEN_CLANG_ATOMICS is defined) it is required. There is no easy way to determine if the lock is needed or not. The current logic looks like this: if defined(OPENSSL_THREADS) && !defined(CRYPTO_TDEBUG) && !defined(OPENSSL_SYS_WINDOWS) if defined(__GNUC__) && defined(__ATOMIC_ACQ_REL) && !defined(BROKEN_CLANG_ATOMICS) - It works without the lock, but in general the need for the lock depends on __atomic_is_lock_free results elif defined(__sun) && (defined(__SunOS_5_10) || defined(__SunOS_5_11)) - The lock is not needed (unless ret is NULL, which should never happen?) else - The lock is required endif else - The lock is not needed endif Adding such conditions outside of crypto.h is error-prone, so it is better to always allocate the lock, otherwise CRYPTO_atomic_add may silently fail. Fixes #23376. CLA: trivial Fixes: fc570b2605 ("Avoid taking a write lock in ossl_provider_doall_activated()") Signed-off-by: Oleg Bulatov <oleg@bulatov.me> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24081) (cherry picked from commit 2fd6c12e85ec7558cbdee08033f822c42ee0f5d4)
2024-04-10Change approach to SSL_pending APIHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24040)
2024-04-10QUIC APL: Fix default stream creation on server sideHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24040)
2024-04-10QUIC APL: Revise SSL_pending and SSL_has_pending handling for s_client compatHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24040)
2024-04-10QUIC QSM: Add function to determine if data is waitingHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24040)
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-10 15:03:31 +0000