summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-11-15Reset the rwstate before calling ASYNC_start_job()Matt Caswell
If an async job pauses while processing a TLS connection then the rwstate gets set to SSL_ASYNC_PAUSED. When resuming the job we should reset the rwstate back to SSL_NOTHING. In fact we can do this unconditionally since if we're about to call ASYNC_start_job() then either we are about to start the async job for the first time (in which case the rwstate should already by SSL_NOTHING), or we are restarting it after a pause (in which case reseting it to SSL_NOTHING is the correct action). Fixes #16809 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17013) (cherry picked from commit 07f620e3acf0dd76a3a03ada9911c544aa483aa7)
2021-11-09Fix: invoking x509_name_cannon improperlyPW Hu
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16974) (cherry picked from commit 09235289c377ff998964bb6b074bb2a3ad768fd2)
2021-11-04Fix a memory leak in ssl_create_cipher_listBernd Edlinger
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16955)
2021-11-04Fix a memory leak in tls_parse_stoc_key_shareBernd Edlinger
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16957)
2021-11-03check the return value of BN_new() and BN_dup()x2018
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16948) (cherry picked from commit d99004fe5de934120765d342586f08d22131b8ed)
2021-10-28speed: range check the argument given to -multi for 1.1.1Pauli
Fixes #16899 for 1.1.1 branch. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16922)
2021-10-27Fix a gcc 11.2.0 warningMatt Caswell
gcc 11.2.0 is the default on Ubuntu 21.10. It emits a (spurious) warning when compiling test/packettest.c, which causes --strict-warnings builds to fail. A simple fix avoids the warning. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16887) (cherry picked from commit 37467b2752f75ce80437120f704452982b7c1998)
2021-10-25Fix no-cmacMatt Caswell
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16894) (cherry picked from commit ef2fb64f9dfde1965cb0b8a5f8765c4f467c1604)
2021-10-22Fix the s_server psk_server_cb for use in DTLSMatt Caswell
Commit 0007ff257c added a protocol version check to psk_server_cb but failed to take account of DTLS causing DTLS based psk connections to fail. Fixes #16707 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/16838) (cherry picked from commit 8b09a9c76d873f62c2507fa9628a9c96c1d66d5c)
2021-10-22Fix BIO_get_md_ctx return value checkPeiwei Hu
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16792)
2021-10-22Fix some documentation errors related to return valuesPW Hu
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16794) (cherry picked from commit f1d077f1108b1bc2334350a4d53a46e29e082910)
2021-10-21Add tests for ENGINE problemsMatt Caswell
Add some tests which would have caught the issues fixed in the previous commit related to engine handling. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16860)
2021-10-21Ensure pkey_set_type handles ENGINE references correctlyMatt Caswell
pkey_set_type should not consume the ENGINE references that may be passed to it. Fixes #16757 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16860)
2021-10-15test/ssl_old_test.c: Fix potential leakPeiwei Hu
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16806) (cherry picked from commit 34563be5368fb8e6ade7d06d8376522ba83cd6ac)
2021-10-14Fix test/recipes/01-test_symbol_presence.t to disregard version infoRichard Levitte
The output of 'nm -DPg' contains version info attached to the symbols, which makes the test fail. Simply dropping the version info makes the test work again. Fixes #16810 (followup) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16840) (cherry picked from commit 73970cb91fdf8e7b4b434d479b875a47a0aa0dbc)
2021-10-14Fix test/recipes/01-test_symbol_presence.t to allow for stripped librariesRichard Levitte
It's a small change to the 'nm' call, to have it look at dynamic symbols rather than the normal ones. Fixes #16810 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16822) (cherry picked from commit a85b4de6a6cbe03c46219d4b1c3b2828ca3fd51c)
2021-10-11Extend custom extension testingMatt Caswell
Test the scenario where we add a custom extension to a cetificate request and expect a response in the client's certificate message. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16634) (cherry picked from commit 0db3a9904fa00569905be130854a31dab7b8f49d)
2021-10-11New extensions can be sent in a certificate requestMatt Caswell
Normally we expect a client to send new extensions in the ClientHello, which may be echoed back by the server in subsequent messages. However the server can also send a new extension in the certificate request message to be echoed back in a certificate message Fixes #16632 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16634) (cherry picked from commit cbb862fbaaa1ec5a3e33836bc92a6dbea97ceba0)
2021-10-09Bindhost/bindport should be freedDmitry Belyavskiy
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16775) (cherry picked from commit 0ce0c455862ed29bd7f2acdbddbe8d0b1783c1c9)
2021-10-07Fix double-free in e_dasync.cBernd Edlinger
When the cipher is copied, the inner_cihper_data need to be copied as well, using the EVP_CTRL_COPY method. The EVP_CIPH_CUSTOM_COPY bit needs to be set as well. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16751)
2021-10-07Fix some possible memory leaks in EVP_CipherInit_exBernd Edlinger
An EVP_CONTEXT with zero cipher but non-zero engine, and/or cipher_data is possible if an error happens in EVP_CTRL_INIT or in EVP_CTRL_COPY, the error handling will just clear the cipher in that case. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16756)
2021-10-06Fix a memory leak in the afalg engineBernd Edlinger
Fixes: #16743 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16744) (cherry picked from commit 6f6a5e0c7c41b6b3639e51f435cd98bb3ae061bc)
2021-09-30Fix a NPD bug in engines/e_dasync.cBernd Edlinger
The dasync_aes_128_cbc_hmac_sha1 cipher depends on EVP_aes_128_cbc_hmac_sha1() returning a NON-NULL value. We should simply not advertise this cipher otherwise. Fixes: #7950 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16722)
2021-09-30doc/man3/SSL_set_fd.pod: add note about Windows compiler warningDr. Matthias St. Pierre
According to an old stackoverflow thread [1], citing an even older comment by Andy Polyakov (1875e6db29, Pull up Win64 support from 0.9.8., 2005-07-05), a cast of 'SOCKET' (UINT_PTR) to 'int' does not create a problem, because although the documentation [2] claims that the upper limit is INVALID_SOCKET-1 (2^64 - 2), in practice the socket() implementation on Windows returns an index into the kernel handle table, the size of which is limited to 2^24 [3]. Add this note to the manual page to avoid unnecessary roundtrips to StackOverflow. [1] https://stackoverflow.com/questions/1953639/is-it-safe-to-cast-socket-to-int-under-win64 [2] https://docs.microsoft.com/en-us/windows/win32/winsock/socket-data-type-2 [3] https://docs.microsoft.com/en-us/windows/win32/sysinfo/kernel-objects Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16699) (cherry picked from commit f8dd5869bca047a23599ac925aace70efcf487ad)
2021-09-28Add sm2 encryption test case from GM/T 0003.5-2012Mingjun.Yang
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16511) (cherry picked from commit 8ba65c35ea3af347c3b2adc8e665066b541a1c35)
2021-09-27ssl: Correct filename in READMETianjia Zhang
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16671)
2021-09-17Correct the documentation for SSL_set_num_tickets()Matt Caswell
The behaviour for what happens in a resumption connection was not quite described correctly. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16582) (cherry picked from commit 4603b782e6dbed493d2f38db111abc05df66fb99)
2021-09-17Clarify what SSL_get_session() does on the server side in TLSv1.3Matt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16582) (cherry picked from commit 9e51f877930dbd4216438a5da3c9612bf4d0a918)
2021-09-14MacOS prior to 10.12 does not support random API correctlyLenny Primak
Fixes #16517 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16587)
2021-09-13Fix nc_email to check ASN1 strings with NULL byte in the middleNikita Ivanov
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16524) (cherry picked from commit 485d0790ac1a29a0d4e7391d804810d485890376)
2021-09-09VMS: Fix misspelt typeRichard Levitte
'__int64', not 'int64_t' Ref: commit 2e5cdbc18a1a26bfc817070a52689886fa0669c2 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16557)
2021-09-08DOCS: Update the page for 'openssl passwd' to not duplicate some infoRichard Levitte
The options -1 and -apr1 were mentioned in DESCRIPTION, not mentioning any other options or even mentioning that there are more algorithms. The simple fix is to remove that sentence and let the OPTIONS section speak for itself. Fixes #16529 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16531) (cherry picked from commit 116799ff6a8fc803ec4685fc432c7329d0511e23)
2021-09-07VMS: Compensate for compiler type incompatibilityRichard Levitte
The compiler says that 'unsigned long long' isn't the same as 'unsigned __int64'. Sure, and considering that crypto/rand/rand_vms.c is specific VMS only code, it's easy to just change the type to the exact same as what's specified in the system headers. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15613)
2021-09-06test/ec_internal_test: link with libapps.a tooRichard Levitte
Whenever the source from $target{apps_init_src} is added to the source of a test program, it needs to be linked with libapps.a as well. Some init sources depend on that. Without this, builds break on VMS because of the unresolved symbol 'app_malloc'. On platforms that do not need anything from libapps.a, adding it is a no-op. This is for OpenSSL 1.1.1 only. OpenSSL 3.0 and beyond have a different solution. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16512)
2021-09-03Test for DANE cross cert fixViktor Dukhovni
Reviewed-by: Tomáš Mráz <tomas@openssl.org>
2021-09-03Prioritise DANE TLSA issuer certs over peer certsViktor Dukhovni
When building the certificate chain, prioritise any Cert(0) Full(0) certificates from TLSA records over certificates received from the peer. This is important when the server sends a cross cert, but TLSA records include the underlying root CA cert. We want to construct a chain with the issuer from the TLSA record, which can then match the TLSA records (while the associated cross cert may not). Reviewed-by: Tomáš Mráz <tomas@openssl.org>
2021-09-02doc: document the rsa_oaep_md: pkeyoptPauli
This was missing but essential for using non-SHA1 digests with OAEP. Fixes #15998 Manual backport of #16410 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16488)
2021-09-02Openssl fails to compile on Debian with kfreebsd kernelsMattias Ellert
(kfreebsd-amd64, kfreebsd-i386). The error reported by the compiler is: ../crypto/uid.c: In function 'OPENSSL_issetugid': ../crypto/uid.c:50:22: error: 'AT_SECURE' undeclared (first use in this function) 50 | return getauxval(AT_SECURE) != 0; | ^~~~~~~~~ This commit changes the code to use the freebsd code in this case. This fixes the compilation. CLA: trivial Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16477) (cherry picked from commit 3a1fa0116a92235ba200228e4bb60d6a3a7f4113)
2021-09-01ci: Add -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to asan buildTomas Mraz
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16441)
2021-09-01Make the -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION pass testsTomas Mraz
Fixes #16428 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16441)
2021-08-30Use applink to fix windows testsBernd Edlinger
(cherry picked from commit <https://github.com/bernd-edlinger/openssl/commit/96a463cede0070aa5c86629d683a214657a9ba9e>) Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12457)
2021-08-30[ec] Do not default to OPENSSL_EC_NAMED_CURVE for curves without OIDNicola Tuveri
Some curves don't have an associated OID: for those we should not default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`. This is a follow-up to https://github.com/openssl/openssl/pull/12312 (cherry picked from commit 7aa3dfc42104588f65301d20324388ac2c9a6b11) Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12457)
2021-08-30Fix d2i_ECPKParameters_fp and i2d_ECPKParameters_fp macrosNicola Tuveri
These functions are part of the public API but we don't have tests covering their usage. They are actually implemented as macros and the absence of tests has caused them to fall out-of-sync with the latest changes to ASN1 related functions and cause compilation warnings. This commit fixes the public headers to reflect these changes. Fixes #12443 (cherry picked from commit cca8a4cedaafe63b0b5729b72133661ece24ff08) Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12457)
2021-08-30Add tests for i2d_TYPE_fp and d2i_TYPE_fpNicola Tuveri
These functions are part of the public API but we don't have tests covering their usage. They are actually implemented as macros and the absence of tests has caused them to fall out-of-sync with the latest changes to ASN1 related functions and cause compilation warnings. @@ Note: This commit limits to ECPKParameters as a type. (cherry picked from commit ea1128e94e36fa9fa25278dc6b3f5b42d8735782) Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12457)
2021-08-30Fix no-tls1_3 testsBernd Edlinger
This recently added test needs DH2048 to work without tls1_3. Fixes: #16335 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16453)
2021-08-29Ensure that _GNU_SOURCE is defined for bss_dgram.cDaniel Krügler
This fixes the following error with gcc10 under strict ANSI conditions: .../crypto/bio/bss_dgram.c:373:20: error: 'const struct in6_addr' has no member named 's6_addr32' CLA: trivial Fixes #16449 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16451) (cherry picked from commit e8e1f6d1a9e599d575431f559200018b8f822e0f)
2021-08-28Fix the "Out of memory" EVP KDF scrypt testBernd Edlinger
This test did not really execute, since usually the OPENSSL_malloc(0) will fail and prevent the execution of the KDF. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16446)
2021-08-28Fix enable-asan with C++ buildtestBernd Edlinger
the following config: ./config no-shared enable-asan enable-buildtest-c++ enable-external-tests fails to build with unresolved asan symbols when linking test/ossl_shim/ossl_shim Fixed by passing all sanitizer-flags to cxxflags. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16434)
2021-08-27Fix instances of pointer addition with the NULL pointerBernd Edlinger
ubsan found undefined pointer addtions in crypto/bio/bss_mem.c (mem_ctrl), crypto/pem/pem_lib.c (PEM_read_bio_ex), test/testutil/format_output.c (test_fail_string_common, test_fail_memory_common). Mostly a straight back-port-of: a07dc81 Additionally enable the ubsan run-checker, to prevent regressions. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16423)
2021-08-27cms: fix memleaks in cms_env.czhaozg
CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16403)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-16 14:35:11 +0000