summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2022-04-21str[n]casecmp => OPENSSL_strncasecmpDmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18103)
2022-04-21Minimal test checking we can get public key in Turkish localeDmitry Belyavskiy
(cherry picked from commit 6ae39acaf0c3578850be6699026a3a5c3f4bdfce) Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18103)
2022-04-21FIPS provider modificationsDmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18103)
2022-04-21Public API functions OPENSSL_str[n]casecmpDmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18103)
2022-04-21Clear incorrectly reported errors in cms_io.Daniel Fiala
Fixes openssl#17841. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18109) (cherry picked from commit 45a3c592b94b66cab72e5bffbaf9d810c3fb29c0)
2022-04-21Fix a possible NULL pointer dereference in create_cert_store()Zhou Qingyang
In create_cert_store(), X509_STORE_new() is called and there is a dereference of it in following function X509_STORE_add_lookup() without check, which could lead to NULL pointer dereference. Fix this by adding a NULL check of X509_STORE_new() Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18057) (cherry picked from commit 3f075967f664aac12951a1d7aa3124d9235cd299)
2022-04-21Fix wild pointer dereference in make_ocsp_response()Zhou Qingyang
The function OCSP_basic_add1_status() will return NULL on malloc failure. However the return value is not checked before being passed to OCSP_SINGLERESP_add1_ext_i2d(), and there is a wild field pointer, which could lead to wild pointer dereference. Fix this by adding return value check Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18081) (cherry picked from commit 4d50a5467b0a208c61d163239a3544bae06343ea)
2022-04-19Avoid undefined behavior of provided macs on EVP_MAC reinitializationTomas Mraz
When the context is reinitialized, i.e. the same key should be used we must properly reinitialize the underlying implementation. However in POLY1305 case it does not make sense as this special MAC should not reuse keys. We fail with this provided implementation when reinitialization happens. Fixes #17811 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18100) (cherry picked from commit c9ddc5af5199909d196ee80ccd7abcff2eb42a34)
2022-04-19evp_test: Try computing MACs twice with reinitialization of EVP_MAC_CTXTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18100) (cherry picked from commit e58ba181de6b0dfad0dc371f8d962c82138a906e)
2022-04-19doc: Clarify that calling SSL_set_session(ssl, NULL) is a correct use case.EasySec
Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18101) (cherry picked from commit e763b1861fb2a138371464b7d3996dbde85ff5e8)
2022-04-14Fix an assertion in the DTLS server codeBernd Edlinger
This fixes an internal error alert from the server and an unexpected connection failure in the release version, but a failed assertion and a server crash in the debug version. Reproduce this issue with a DTLS server/client like that: ./openssl s_server -dtls -mtu 1500 ./openssl s_client -dtls -maxfraglen 512 In the debug version a crash happens in the Server now: ./openssl s_server -dtls -mtu 1500 Using default temp DH parameters ACCEPT ssl/statem/statem_dtls.c:269: OpenSSL internal error: Assertion failed: len == written Aborted (core dumped) While in the release version the handshake exceeds the negotiated max fragment size, and fails because of this: $ ./openssl s_server -dtls -mtu 1500 Using default temp DH parameters ACCEPT ERROR 4057152ADA7F0000:error:0A0000C2:SSL routines:do_dtls1_write:exceeds max fragment size:ssl/record/rec_layer_d1.c:826: shutting down SSL CONNECTION CLOSED From the client's point of view the connection fails with an Internal Error Alert: $ ./openssl s_client -dtls -maxfraglen 512 Connecting to ::1 CONNECTED(00000003) 40B76343377F0000:error:0A000438:SSL routines:dtls1_read_bytes:tlsv1 alert internal error:ssl/record/rec_layer_d1.c:613:SSL alert number 80 and now the connection attempt fails unexpectedly. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18093) (cherry picked from commit e915c3f5381cd38ebdc1824c3ba9896ea7160103)
2022-04-14Add error code for unsupported explicit parametersTomas Mraz
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17998) (cherry picked from commit 53137462f42f8673fbd5b0831f8ea051ddea509f)
2022-04-14endecode_test: Handle expected failures for non-fips ec keysTomas Mraz
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17998) (cherry picked from commit e8a4145968eea576788761f39c5e4cb68b7c4a42)
2022-04-14Import only named params into FIPS moduleTomas Mraz
Fixes #17978 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17998) (cherry picked from commit 638c3a28af45bd81a1c90b81efd8e10449eace1b)
2022-04-13Check the return of EVP_KDF_fetch()tangyiqun
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18096) (cherry picked from commit 02119faee397565525151eb2ce39c424d129d287)
2022-04-12Add return value check of X509V3_add_value() in X509V3_parse_list()Zhou Qingyang
X509V3_add_value() will return 0 on malloc failure, which could lead to err logic in X509V3_parse_list(). Fix this by adding return value check of X509V3_add_value(). Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18077) (cherry picked from commit bcd5645b34c319b8e4d72d6850ead80e85f18921)
2022-04-12SSL_conf_cmd: Allow DH Parameters at any position.Daniel Fiala
Fixes openssl#17326. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18041) (cherry picked from commit b2b8d1883a3b7e64006b0b4ada0cbcf3eb6dba1a)
2022-04-11Fix -no-tls1_2 in testsTodd Short
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/18019) (cherry picked from commit 40fb5a4ce3e90c9e8702aad0fcf43eb9f6edf419)
2022-04-11Add test for openssl ecparam with fips and base providersTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17981) (cherry picked from commit 269c349a7688daae48d95e582e62ff181888c854)
2022-04-11ec_export: Other parameters are exportable with domain parametersTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17981) (cherry picked from commit e20af37d063514c27567c64e975fa5b3208707a9)
2022-04-11Add test for resetting SM2 dist IDTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18052) (cherry picked from commit 707d4e06eba71fb8a8b2faa77a2072511189544d)
2022-04-11sm2: Allow setting 0 length SM2 dist ID paramTomas Mraz
Fixes #18022 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18052) (cherry picked from commit 2904d0a2ae0ec6ce23d5cec66ce8c7bdb005d4e5)
2022-04-11Crypto/evp: Fix null pointer dereferenceyuanjungong
Check the return value of EVP_KDF_fetch to avoid a potential null pointer dereference. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18062) (cherry picked from commit 5f1424c6bdca8ddb9d5d88a78a1d738be19c4ea8)
2022-04-11kdf: avoid NULL dereference on malloc failure in sshkdfPauli
Fixes #18009 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/18011) (cherry picked from commit 148176ca323e3dfce5d5cdb5578c113c8d2440bb)
2022-04-07Document {SSL|SSL_CTX}_set_{purpose|trust}()Hugo Landau
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18037) (cherry picked from commit eb27a90e41a62d3337c5e21e24ee72f1e49a445c)
2022-04-07Document SSL_CTX_get_ssl_methodHugo Landau
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18037) (cherry picked from commit e12bee78d4e64da2176dd9a7ec19ec680dd3bebf)
2022-04-07test_fipsinstall: Fallback to config(FIPSKEY) for the FIPSKEYTomas Mraz
Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18048) (cherry picked from commit ffc22e038e92d5dd956362fa48babd03cff202d1)
2022-04-07Fix failure to check result of bn_rshift_fixed_topHugo Landau
Fixes #18010. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18034) (cherry picked from commit bc6bac8561ead83d6135f376ffcbbb0b657e64fe)
2022-04-05Document the fact that setting a BIO create function means the BIO will no ↵Arran Cudbard-Bell
longer be marked as initialised Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/17983) (cherry picked from commit dedb1927751bc9a7ada08cfc4dcc481b8ce1ad81)
2022-04-05Fix AIX build when no-shared is passed to Configure.Todd C. Miller
AIX shared libs are also .a files so the AIX platform staticname() appends a '_a' to the name to avoid a collision. However, this must not be done when no-shared is passed to Configure or the binaries that link with -lcrypto and -lssl be unable to link as those libraries won't exist without the '_a' suffix. CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18006) (cherry picked from commit b83c0a900f9303e0c9fd084829b791386d7c57ce)
2022-04-05Redefine macro X509_http_nbio to avoid using ocsp.hDaniel Fiala
The functions used from ocsp.h are actually just aliases for functions from http.h. Use them directly to avoid including ocsp.h. Fixes openssl#17148 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17980) (cherry picked from commit f593f32eede30ead69e0a16e47a564a664171283)
2022-04-04Fix broken link to coding-style.htmlViktor Söderqvist
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18015) (cherry picked from commit 31ff3635371b51c8180838ec228c164aec3774b6)
2022-04-03Fix Coverity 1503096: out-of-bounds accessPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/17898) (cherry picked from commit d1592f21c0d4c2c94a8c6004cf7b5cad2dcb2637)
2022-04-01req, x509: Allow printing modulus of RSA-PSS keysTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17990) (cherry picked from commit e4cdcb8bc44250aa4e0893dc4a7d64668f0fb949)
2022-03-31doc: fix example in ssh KDF man page.Pauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17972) (cherry picked from commit 67f48eb9be375f47bafc5be2df2d04a95e6d0ff1)
2022-03-30Test processing of a duplicated HRRTomas Mraz
Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17936) (cherry picked from commit db44b55aaa42141921217183667800425227b658)
2022-03-30tls_process_server_hello: Disallow repeated HRRTomas Mraz
Repeated HRR must be rejected. Fixes #17934 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17936) (cherry picked from commit d204a50b898435fbf937316d5693008cebf62eef)
2022-03-30sparse array: reduces the block sizePauli
This becomes a performance improvement in the ossl_sa_doall_arg function which has started appearing on profile output. The other ossl_sa_ functions don't contribute significantly to profile output. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17973) (cherry picked from commit 514bd51a8cb901a7351ecdc45a680d6aba720b5a)
2022-03-29Fix typo in manpage SSL_CONF_cmd(3)Hugo Landau
Fixes #17976. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17977) (cherry picked from commit 5d3746910438fd052b44010d92ac70fea606fa9d)
2022-03-28Remove statistics tracking from LHASHHugo Landau
Fixes #17928. Supercedes #17931. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17935) (cherry picked from commit 77d7b6eebb411fdb2c3d1390ac779300757aa9dc)
2022-03-25ticket_lifetime_hint may exceed 1 week in TLSv1.3Todd Short
For TLSv1.3, limit ticket lifetime hint to 1 week per RFC8446 Fixes #17948 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17952) (cherry picked from commit 0089cc7f9d42f6e39872161199fb8b6a99da2492)
2022-03-25s390x: Hide internal cpuid symbol and functionJuergen Christ
The symbol OPENSSL_s390xcap_P and the OPENSSL_cpuid_setup function are not exported by the version script of OpenSSL. However, if someone uses the static library without the version script, these symbols all of a sudden become global symbols and their usage in assembler code does not correctly reflect that for PIC. Since these symbols should never be used outside of OpenSSL, hide them inside the binary. Signed-off-by: Juergen Christ <jchrist@linux.ibm.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17946) (cherry picked from commit 37816ef5757e458be9648481e56bf698ee3bfbb1)
2022-03-25Fix formatting of NOTES-WINDOWS.md and doc-nits failureTomas Mraz
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/17960) (cherry picked from commit bd28a23eb120b4fdfd45d18a1f05cd7366ed8058)
2022-03-25Fix Coverity 1498612: integer overflowPauli
The assert added cannot ever fail because (current & 0xFFFF) != 0 from the while loop and the trailing zero bit count therefore cannot be as large as 32. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/17892) (cherry picked from commit 81487b65b9eb8148471e729b8c1959521d62c69e)
2022-03-24Add build note for win-arm64Gabor Kertesz
Windows on Arm is not officially supported by release, but with x86 emulated Perl it can be built locally. This method is added to Windows notes. Locally all tests are passed on win-arm64. CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17940) (cherry picked from commit 288e9680399d3a755861d309058dda2fb48af8bf)
2022-03-23util/markdownlint.rb: Allow fenced code blocksRichard Levitte
We use both indented and fenced styles in diverse markdown files. We try to do this consistently in each file, though. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17933) (cherry picked from commit fb2cd91f27d0cc0bbf1883dd188788016165a458)
2022-03-23Fix Coverity 1201763 uninitialised pointer readPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17890) (cherry picked from commit a0238b7ed87998c48b1c92bad7fa82dcbba507f9)
2022-03-23Fix Coverity 1498613: resource leakPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17891) (cherry picked from commit 6889ebff01fa8cd7e5905f3f242edfed55fca443)
2022-03-23Fix Coverity 1498611 & 1498608: uninitialised readPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17893) (cherry picked from commit 09134f183f76539aa1294adfef10fcc694e90267)
2022-03-22Make `openssl check -rsa ...` to work for both RSA and RSA-PSS.Daniel Fiala
Fixes openssl#17167 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17920)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-19 06:23:43 +0000