summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2024-06-04make updateTomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-06-04Copyright year updatesTomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-06-04Disable 70-test_quic_multistream.t when building with PUT threads.Randall S. Becker
The test recipe includes a TEST_skip when OpenSSL is built with _PUT_MODEL_ based on design assumptions for QUIC and incompatibility with PUT wrapper methods. Fixes: #24442 Fixes: #24431 Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24468) (cherry picked from commit 0e2567d7293d3204de66acca0ed55bda4f0c0768)
2024-06-03Update CHANGES.md and NEWS.md for the upcoming releaseTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/24550)
2024-05-30[Docs] SSL_*_use will increment reference counterRuslan Baratov
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24520) (cherry picked from commit 0c73d65eeae9086c37149f4a512946040c8c2af3)
2024-05-30cmp_hdr_test.c: Fix leaks in error casesshridhar kalavagunta
Fixes #24475 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24511) (cherry picked from commit 0986e128ff258d482cab712aa617a533db5588ea)
2024-05-30uefi: move variablesGerd Hoffmann
Fixes "unused variable" warnings with OPENSSL_SYS_UEFI. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24459) (cherry picked from commit 7bc10f6ce2f91714d39a0410bfc545d79913e343)
2024-05-30uefi: add typedef for uintptr_tGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24459) (cherry picked from commit 7b33501a74ec2db4e54ddcd751dd42ded32bfd5b)
2024-05-29Fix potential memory leak in test_bad_dtlsAmir Mohammadi
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24464) (cherry picked from commit abe05fda8bdbfb35de7420cab31d5e459fabc874)
2024-05-29Update configurable sigalgs documentation for providersMichael Baentsch
also adding to SignatureAlgorithms section Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/24499) (cherry picked from commit 90e7c12f1b238ed714786fafc26d05b59a63752b)
2024-05-29VMS: Redefine _XOPEN_SOURCE_EXTENDED with the value 1 in apps/ocsp.cRichard Levitte
Some versions if the VMS C system header files seem to require this. Fixes #24466 on release older than 3.3. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/24471)
2024-05-28ecstresstest.c: Fix memory leak on errorNek Saikou
Fixes #24476 CLA: trivial Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24488) (cherry picked from commit 434e7f7cb4259f8c8c1463fd38fe723b3efca887)
2024-05-28Further extend the SSL_free_buffers testingMatt Caswell
We extend the testing to test what happens when pipelining is in use. Follow on from CVE-2024-4741 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24395) (cherry picked from commit c1bd38a003fa19fd0d8ade85e1bbc20d8ae59dab)
2024-05-28Move the ability to load the dasync engine into ssltestlib.cMatt Caswell
The sslapitest has a helper function to load the dasync engine which is useful for testing pipelining. We would like to have the same facility from sslbuffertest, so we move the function to the common location ssltestlib.c Follow on from CVE-2024-4741 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24395) (cherry picked from commit 05752478df623a9ddf849f897b630c1e0728cb7c)
2024-05-28Extend the SSL_free_buffers testingMatt Caswell
Test that attempting to free the buffers at points where they should not be freed works as expected. Follow on from CVE-2024-4741 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24395) (cherry picked from commit 566f3069169b9fab4fbb23da98c3c91730dd5209)
2024-05-28Set rl->packet to NULL after we've finished using itMatt Caswell
In order to ensure we do not have a UAF we reset the rl->packet pointer to NULL after we free it. Follow on from CVE-2024-4741 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24395) (cherry picked from commit bfb8128190632092b3a66465838b87b469455cec)
2024-05-28Only free the read buffers if we're not using themMatt Caswell
If we're part way through processing a record, or the application has not released all the records then we should not free our buffer because they are still needed. CVE-2024-4741 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24395) (cherry picked from commit 38690cab18de88198f46478565fab423cf534efa)
2024-05-22Added an explicit yield (OP_SLEEP) to QUIC testing for cooperative threading.Randall S. Becker
Fixes: #24442 Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24443) (cherry picked from commit b9e084f139c53ce133e66aba2f523c680141c0e6)
2024-05-22[Docs] Default value for verification flags is 'SSL_VERIFY_NONE'Ruslan Baratov
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24435) (cherry picked from commit a73e07dbb7df4795c4ec537f19516b541fb8dd3c)
2024-05-20fips provider: explicitly setup cpuid when initializingHongren Zheng
Fixes: #23979 Previously fips module relied on OPENSSL_cpuid_setup being used as constructor by the linker to correctly setup the capability vector, either via .section .init (for x86_64) or via __attribute__((constructor)). This would make ld.so call OPENSSL_cpuid_setup before the init function for fips module. However, this early constructing behavior has several disadvantages: 1. Not all platform/toolchain supports such behavior 2. Initialisation sequence is not well defined, and some function might not be initialized when cpuid_setup is called 3. Implicit path is hard to maintain and debug Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24419) (cherry picked from commit a192b2439c0207ce1b04ba6137329b68f9e23680)
2024-05-20Fix mem leak in threadpool_test.cshridhar kalavagunta
Fixes #24104 Added a goto label for cleanup. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24412) (cherry picked from commit 4dbd4925dfc61d93df678df607504f62b0ac3dcc)
2024-05-17Fix typo in CONTRIBUTING.mdJames Muir
CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24413) (cherry picked from commit 45f5d51b72a262bf85c4461fbded91485ce6b9da)
2024-05-16Check DSA parameters for excessive sizes before validatingTomas Mraz
This avoids overly long computation of various validation checks. Fixes CVE-2024-4603 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/24346) (cherry picked from commit 85ccbab216da245cf9a6503dd327072f21950d9b)
2024-05-15Update openssl-smime.pod.inDominikN
Remove duplicate entries for -nocerts and -noattr CLA:trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24052) (cherry picked from commit 5a0c92cf093b4f0aa65f4fdbff88d7bdc83491f3)
2024-05-15[Docs] 'SSL_CTX_set_cert_store' ownership of 'store'Ruslan Baratov
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24375) (cherry picked from commit 987baef4fa54d268d7eaa93837a56398409698a1)
2024-05-15fix sm2 encryption implementation bug.Liu-Ermeng
According to the "GB/T 32918.4-2016" section 6.1 encryption, step A5: If result of the "KDF" is all zeros, we should go back to the begin(step A1). section 7.1 decryption, step B4: If result of the "KDF" is all zeros, we should raise error and exit. Signed-off-by: Liu-Ermeng <liuermeng2@huawei.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23210) (cherry picked from commit 170620675dfd74f34bdcf8aba71dffeb07f3d533)
2024-05-14sslapitest.c: With fips skip tests depending on X25519 and X448Tomas Mraz
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/24347) (cherry picked from commit f6e469808501f52c7e8f8679d6c3290cf1c258b3)
2024-05-1490-test_sslapi.t: Fix execution of sslapitest with fips providerTomas Mraz
Default configuration of the fips provider for tests is pedantic which means that sslapitest was not fully executed with fips provider. The ems check must be switched off for full execution. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/24347) (cherry picked from commit d2af5e4c946afb59d3512b440642f0da775d198f)
2024-05-14test/ssl-tests: Avoid depending on X25519 and X448 being fips approvedTomas Mraz
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/24348) (cherry picked from commit 32ca45d3f905d014c44e1570617d96a7372c324d)
2024-05-14quicapitest.c: Make test_ssl_trace to be insensitive to fips changesTomas Mraz
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/24348) (cherry picked from commit b727850545b74e4d1bd82519c202b3b4585443a2)
2024-05-14Release pkey_ctx on initialization failureirosay
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24366) (cherry picked from commit 3e9d933882407a0792dc3466ba9a0d53d40677a7)
2024-05-14apps/pkcs12: Not writing the private key file until the import password is ↵naaysayer
verified Fixes #904 CLA: trivial Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23729) (cherry picked from commit f5462572a1873482ce38646cbf00dfc483f02068)
2024-05-14Add reason codes with the correct offset for two alertsJacob Champion
Fixes #24300. The current values of SSL_R_NO_APPLICATION_PROTOCOL and SSL_R_PSK_IDENTITY_NOT_FOUND don't allow for a correct lookup of the corresponding reason strings. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24351) (cherry picked from commit a401aaf9ed6eb34842cdedfcc35448bdc4174df3)
2024-05-14doc: Fix description of EVP_CIPHER_CTX_dupDaiki Ueno
This fixes a couple of copy and paste error from EVP_MD_CTX_dup, where: EVP_CIPHER_CTX_dup is useful to avoid multiple EVP_CIPHER_fetch (instead of EVP_MD_fetch) and returns EVP_CIPHER_CTX (instead of EVP_MD_CTX). Signed-off-by: Daiki Ueno <dueno@redhat.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24376) (cherry picked from commit 7860bca22c404cfd763ae2648d708d5cc4df6c2f)
2024-05-14quic_multistream_test: fix undefined symbol snprintf with VS2010Georgi Valkov
As snprintf is not available everywhere, use BIO_snprintf instead. Fixes: IF EXIST test\quic_multistream_test.exe.manifest DEL /F /Q test\quic_multistream_test.exe.manifest "link" /nologo /debug setargv.obj /subsystem:console /opt:ref /nologo /debug @V:\_tmp\nm4.tmp quic_multistream_test-bin-quic_multistream_test.obj : error LNK2019: unresolved external symbol _snprintf referenced in function _helper_init test\quic_multistream_test.exe : fatal error LNK1120: 1 unresolved externals NMAKE : fatal error U1077: '"E:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\BIN\link.EXE"' : return code '0x460' Signed-off-by: Georgi Valkov <gvalkov@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24369) (cherry picked from commit c02f952b48927af9fc4e991d7ead89a4cd1636bc)
2024-05-10tls_provider_init(): Rename prov_ctx to xor_prov_ctx to clarifyTomas Mraz
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24103) (cherry picked from commit 3de3d481b269e9831d0b9abd3598b262647ae050)
2024-05-10tls_provider_init(): Fix leaks in error casesTomas Mraz
Fixes #24101 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24103) (cherry picked from commit 2a5d733e64f009f758163da852f1e7fee6aea0a2)
2024-05-09Dependabot update: Bump coverallsapp/github-actiondependabot[bot]
CLA: trivial (deps): Bump coverallsapp/github-action Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 2.2.3 to 2.3.0. - [Release notes](https://github.com/coverallsapp/github-action/releases) - [Commits](https://github.com/coverallsapp/github-action/compare/v2.2.3...v2.3.0) --- updated-dependencies: - dependency-name: coverallsapp/github-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24350) (cherry picked from commit 13d37d8f7557ee7935032ea832eab3e3c5540158)
2024-05-08Avoid memory leak in x509_test error pathViktor Dukhovni
Fixes #23897 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23991) (cherry picked from commit 7cbca5a6d6e792c75c414e1f3fb22e2afae67988)
2024-05-07Fix intermittent sslapitest early data related failuresMatt Caswell
Early data is time sensitive. We have an approx 8 second allowance between writing the early data and reading it. If we exceed that time tests will fail. This can sometimes (rarely) occur in normal CI operation. We can try and detect this and just ignore the result of such test failures if the test has taken too long. We assume anything over 7 seconds is too long. This is a partial fix for #22605 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24319)
2024-05-07Use OSSL_TIME instead of using arithmetic directly on time_tMatt Caswell
We have functions for adding/subtracting time. We should use them. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24319)
2024-05-07Add linux-arm64ilp32-clang targetHuiyue Xu
While clang 15 config target by '--target', not cannot support '-mabi=ilp32', so add the linux-arm64ilp32-clang target. Signed-off-by: Huiyue Xu <xuhuiyue@huawei.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22666) (cherry picked from commit 69bd5e4fff8ac9bf4dc3ed6fd87b5a5858edbb01)
2024-05-06Fix undefined behaviour in the event of a zero length session idMatt Caswell
Don't attempt to memcpy a NULL pointer if the length is 0. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24309) (cherry picked from commit 97c6489b39c966c6e5169b9b92ec5fa9a35c7ba3)
2024-05-06Document the SSL_set_session_secret_cb() functionMatt Caswell
This function is only useful for EAP-FAST, but was previously undocumented. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24309) (cherry picked from commit aecaaccaf93c4b36dd830accf08f2175059c5782)
2024-05-06Set the server sig algs before calling the session_secret_cbMatt Caswell
Setting the server sig algs sets up the certificate "s3->tmp.valid_flags". These are needed when calling ssl3_choose_cipher() which can happen immediately after calling the session_secret_cb Fixes #24213 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24309) (cherry picked from commit 91c7ab27cebe4e6f6a6376e0a691736a2534fdd0)
2024-05-06Add a test for the session_secret_cbMatt Caswell
Ensure that if a session_secret_cb is being used that a connection can be successfully made Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24309) (cherry picked from commit c8dddc61d49f84d1667de97e9548f07ccc92dddf)
2024-05-06Fix error handling in CMS_EncryptedData_encryptBernd Edlinger
That caused several memory leaks in case of error. Also when the CMS object that is created by CMS_EncryptedData_encrypt is not used in the normal way, but instead just deleted by CMS_ContentInfo_free some memory was lost. Fixes #21985 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22031) (cherry picked from commit 6d2a01cdfb56fdb8ea5d5dd417724e6906c8b8e2)
2024-05-02Correct top for EC/DSA nonces if BN_DEBUG is onTomas Mraz
Otherwise following operations would bail out in bn_check_top(). Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265) (cherry picked from commit a380ae85be287045b1eaa64d23942101a426c080)
2024-05-02Adjust FIPS EC/DSA self test data for different nonce generationTomas Mraz
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265) (cherry picked from commit 8a1f65468064e39f65ef4918c62db73a9eef80e4)
2024-05-02Rename BN_generate_dsa_nonce() to ossl_bn_gen_dsa_nonce_fixed_top()Tomas Mraz
And create a new BN_generate_dsa_nonce() that corrects the BIGNUM top. We do this to avoid leaking fixed top numbers via the public API. Also add a slight optimization in ossl_bn_gen_dsa_nonce_fixed_top() and make it LE/BE agnostic. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265) (cherry picked from commit 9c85f6cd2d6debe5ef6ef475ff4bf17e0985f7a2)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-28 06:18:12 +0000