summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2023-10-04Remove duplicates of EVP_aes_xxx_wrap() from EVP_aes_128_gcm.podFrederik Wedel-Heinen
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22236) (cherry picked from commit 5c20c202699ba9c08183c5227df0ad4352e0974b)
2023-10-04doc/man3: fix misnamed function nameMatthias St. Pierre
Rename `DSA_generate_prime[_ex]` to `DSA_generate_parameters[_ex]`, fixing a copy&paste error from the `BN_generate_prime[_ex]` paragraph in commit b3696a55a5ed. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22242) (cherry picked from commit 515856f5ceb1ef0065466ac85164766623457000)
2023-10-04Add openssl/pem.h inclusion for d2i_PKCS8PrivateKeySumitra Sharma
Include the necessary header file openssl/pem.h in the documentation to ensure that all functions related to d2i_PKCS8PrivateKey are correctly defined. Closes openssl#22188 Signed-off-by: Sumitra Sharma <sumitraartsy@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22253) (cherry picked from commit cda2e7c914bffc904e3ee79f360953fd370e19e9)
2023-10-04All lh_stats functions were deprecated not just someTomas Mraz
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22248)
2023-10-03Coverity 1545175: use after freePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22211) (cherry picked from commit 6bd07949e54f9958eb8a0f9a597ceb3910753ab0)
2023-10-03Coverity 1545174: calling risky functionPauli
Remove the call to rand() and replace with an xor-shift RNG. There are no security implications to worry about here. This RNG is used during testing only. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22211) (cherry picked from commit eaf08794398ac3caaadffcfd670854bf51f610fa)
2023-10-03Coverity 1545176: dereference before NULL checkPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22211) (cherry picked from commit 15410839c668f97b5c03ee1a1bc1a2bf4315715f)
2023-10-03rand: add extra error codePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22210)
2023-10-03Fix a mem leak when the FIPS provider is used in a different threadMatt Caswell
We were neglecting to register the main thread to receive thread stop notifications. This is important if the thread that starts the FIPS provider is not the same one that is used when OPENSSL_cleanup() is called. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22210)
2023-10-03fips: use seed source requestedPauli
Fixes #21909 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22210)
2023-10-03fips selftest: avoid relying on a real RNG for self testsPauli
Rather than instantiate the private and primary DRBGs during the selftest, instead use a test RNG. This leaves the DRBG setup pristine and permits later replacement of the seed source despite the very early running power up self tests. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22210)
2023-10-03remove redundant free of NULLPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22210)
2023-10-03Bump actions/setup-python from 4.7.0 to 4.7.1dependabot[bot]
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4.7.0 to 4.7.1. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v4.7.0...v4.7.1) --- updated-dependencies: - dependency-name: actions/setup-python dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22254) (cherry picked from commit f7e7bbcd7850b96d02dd0f4dd49b3365b320776c)
2023-10-02doc: correct the SSL_CTX_set_info_callback(3) manual pageMatthias St. Pierre
The info callback is not prototyped correctly, and the code example fails to compile because of const-incorrectness. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22224) (cherry picked from commit 92986c0be56bc8bf9c414dab59d4f1e128f1e843)
2023-09-22no-engine: fix signing with legacy app method based keysMatthias St. Pierre
Signing with an app method based key (i.e. an `EVP_PKEY` which wraps an `RSA` key with an application defined `RSA_METHOD`) used to work in 1.1.1. That feature was broken in commit 60488d2434, but later on fixed by @t8m in commit b247113c05 (see #14859). This commit corrects a minor flaw of the fix, which affects only `no-engine` builds: the special treatment for foreign keys is guarded by an `OPENSSL_NO_ENGINE` check. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22163) (cherry picked from commit 1acc3e8cc3c69187b55cc557c1bc03278ab38063)
2023-09-22Do not include sparse_array.o in libsslHuiyue Xu
sparse_array.o is not needed in libssl at 3.0.x version. Signed-off-by: Huiyue Xu <xuhuiyue@huawei.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22111) (cherry picked from commit a31cd07af1ca34cdbbd2b077a933208d447ed0b2)
2023-09-21Fix test_cms if DSA is not supportedSteffen Klee
CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22150) (cherry picked from commit dee2129802d9694d72e8745aec2d8bd4577ee4ee)
2023-09-21Fix error handling in lhash contractBernd Edlinger
When the realloc fails in contract, this not a fatal error, since the memory is only shrinked. It is also no option to exit the function at this point, since that would leave the hash table in an inconsistent state. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22154) (cherry picked from commit 5fbfd641aeebdf4b29a0749e13a79a1e59502878)
2023-09-21Fix error handling in CRYPTO_get_ex_new_indexBernd Edlinger
If an out of memory error happens when the index zero is reserved in a newly created ip->meth stack object, that reservation is not done in a second attempt, which makes various X_set_ex_data overwrite the value of X_set_app_data. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22149) (cherry picked from commit d4f22a915ac50570015a23ad794032c4fb9496cb)
2023-09-21Fix some memory leaks in the openssl appBernd Edlinger
In some error cases the normal cleanup did not happen, but instead an exit(1) which caused some memory leaks, as reported in #22049. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/22055) (cherry picked from commit 8c040c086ca11a519975c58961a5dc933aa6524a)
2023-09-20coverity: NULL dereferencePauli
Fixes coverity 1544699. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/22138) (cherry picked from commit be01f609f98a8930f2c91b813715e515a88f4d54)
2023-09-20Add documentation for the function SSL_CONF_CTX_finish.Sumitra Sharma
Add documentation for the function SSL_CONF_CTX_finish() in man3. Fixes #22084 Signed-off-by: Sumitra Sharma <sumitraartsy@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22128) (cherry picked from commit 955c133ccccd2b6e3f5a1b1342045111fe8b3e86)
2023-09-20enc: "bad decrypt" only in decryptionMathieu Tortuyaux
CLA: trivial Signed-off-by: Mathieu Tortuyaux <mathieu.tortuyaux@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22134) (cherry picked from commit 0e138b7b591f160a50aff22f662254d1b39c9cac)
2023-09-19Prepare for 3.1.4Richard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-09-19Prepare for release of 3.1.3openssl-3.1.3Richard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-09-19make updateRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-09-19Copyright year updatesRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-09-18CMP app and API doc: add note on critical server auth on receiving trust ↵Dr. David von Oheimb
anchor certs Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21138) (cherry picked from commit 5e721ecee5a8c9c27e392fb3770d221709bde1a7)
2023-09-18CMP doc: various small corrections, mostly on PBM vs. MAC-based protectionDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21138) (cherry picked from commit 4a1073981fcff530d3f810b536514eb45d5d0bae)
2023-09-18Enhance code safety and readability in SSL_get_shared_ciphers()Sumitra Sharma
This commit introduces two key improvements: 1. Improve code safety by replacing the conditional statement with `if (n >= size)` and using OPENSSL_strnlen() instead of strlen(). This change ensures proper buffer size handling and adheres to secure coding practices. 2. Enhance code readability by substituting `strcpy(p, c->name)` with `memcpy(p, c->name, n)`. This adjustment prioritizes code clarity and maintenance, even while mitigating a minimal buffer overflow risk. These enhancements bolster the code's robustness and comprehensibility, aligning with secure coding principles and best practices. Fixes #19837 Signed-off-by: Sumitra Sharma <sumitraartsy@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21934) (cherry picked from commit 2743594d73e65c38375c619e89ec62579e2c24a9)
2023-09-15Fix PKCS#12 creation error when certificate contains auxiliary dataOlga Batyshkina
Prefer friendly name passed by the caller and calculated local key id to ones found in certificate auxiliary data when creating PKCS#12. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21675) (cherry picked from commit 388a8e731445d190a46ec27b2ff5b4bf334d526b)
2023-09-15Fix a merge mistake in engne_list_addBernd Edlinger
master version increments the struct_ref early and needs to decrement the struct_ref on error, while 3.1 and 3.0 increment the struct_ref later. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22115)
2023-09-15Fix engine cleanup error handlingBernd Edlinger
Error handling in engine_cleanup_add_first/last was broken and caused memory leaks. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21971) (cherry picked from commit 00f2efccf5b9671a7af2b12571068258e9c255a5)
2023-09-13Fix memory leaks in ssl_old_test.cBernd Edlinger
This fixes a few memory leaks reported in #22049. If SSL_CTX_set0_tmp_dh_pkey rejects the temp dh key due to security restrictions (even when @SECLEVEL=0 is used!) then the caller has to delete the PKEY object. That is different to how the deprecated SSL_CTX_set_tmp_dh_pkey was designed to work. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22060) (cherry picked from commit 21f0b80cd4b32ba80843b812b01a6056daf14093)
2023-09-13Revert "make inability to dup/clone ciphers an error"Tomas Mraz
This reverts commit d739b3e05e749d4310b7310c007a4f3b8d5f8556. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22081)
2023-09-13Revert "Add dupctx support to aead ciphers"Tomas Mraz
This reverts commit a982016c56f8c631e0906b0a33f4feaf3d20a2ff. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22081)
2023-09-13Revert "implement dupctx for aes_WRAP methods"Tomas Mraz
This reverts commit 819ae76bb76540a4321e548851e23099ddf71e8e. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22081)
2023-09-13Revert "implement dupctx for chacha20_poly1305"Tomas Mraz
This reverts commit 603b4c332f817cfc14a0d8b30d1e5a198f575644. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22081)
2023-09-13Revert "Add dupctx support to rc4_hmac_md5 algo"Tomas Mraz
This reverts commit d9f84aef6033804e4c7ebf28ee88fcd2c63161d6. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22081)
2023-09-13d2i_ECPKParameters and i2d_ECPKParameters are not deprecatedTomas Mraz
So do not document them as such. Fixes #22068 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22069) (cherry picked from commit 2508629765403375b3075300a0951705ec26fe27)
2023-09-13Fix typos found by codespell in openssl-3.1Dimitri Papadopoulos
Only modify doc/man* in the openssl-3.1 branch. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22065)
2023-09-13Fix a memleak in prepare_rsa_paramsBernd Edlinger
This affects only RSA-PSS keys with params using negative salt legth, or in case of out of memory. This fixes a memory leak reported in #22049. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22061) (cherry picked from commit 46def829afa4d8bed8f53d484bdf842d65f0e176)
2023-09-12Add dupctx support to rc4_hmac_md5 algoNeil Horman
Pretty straightforward, just clone the requested context, no pointers to fixup Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21933) (cherry picked from commit 123c85864fa7fe97d8ae3a09989d410501d957a5)
2023-09-12implement dupctx for chacha20_poly1305Neil Horman
Same as chacha20 in the last commit, just clone the ctx and its underlying tlsmac array if its allocated Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21933) (cherry picked from commit df93b3c9e72571876bd01e5a50a5ba8368c6c77f)
2023-09-12implement dupctx for aes_WRAP methodsNeil Horman
create a dupctx method for aes_WRAP implementations of all sizes Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21933) (cherry picked from commit 2c021e7d11f03ede2330398c4fd8e8c7bd8768ee)
2023-09-12Add dupctx support to aead ciphersNeil Horman
Add dupctx method support to to ciphers implemented with IMPLEMENT_aead_cipher This includes: aes-<kbits>-gcm aria-<kbits>-ccm aria-<kbits>-gcm sm4-<kibs>-gcm Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21933) (cherry picked from commit 0239fb3db77e9de2031c5054854cba8e417c1b72)
2023-09-12make inability to dup/clone ciphers an errorNeil Horman
There should be no reason that a cipher can't be duplicated Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21933) (cherry picked from commit 39d857bb610d25b3de4e414264246ec41753c446)
2023-09-11augment man pages with information about PKCS12KDF in FIPS modeVladimir Kotal
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21965) (cherry picked from commit 4ee8c1fb51687ea811fc2abf87e173c70d018bc2)
2023-09-11Add CVE-2023-4807 fix to CHANGES.md and NEWS.mdTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22033) (cherry picked from commit 0be7510f49e498532708fd03628fc3fc62ee7875)
2023-09-11Fix a possible memleak in rsa_pub_encodeBernd Edlinger
That seems to be only an issue for RSA-PSS with parameters. Spotted by code review, so it looks like there is no test coverage for this. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22032) (cherry picked from commit 285eb1688f05ad477fefc681bf05d0afedc46d40)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-27 13:27:09 +0000