summaryrefslogtreecommitdiffstats
path: root/crypto/conf
AgeCommit message (Collapse)Author
2024-07-16Fix line continuation check in config parsererbsland-dev
Fixes #8038: Previously, line continuation logic did not account for the 'again' flag, which could cause incorrect removal of a backslash character in the middle of a line. This fix ensures that line continuation is correctly handled only when 'again' is false, thus improving the reliability of the configuration parser. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24890) (cherry picked from commit f54e4bc51b78c10dc99a61c087861ee2c11d7a41)
2024-06-27Free appname if it was set after initializing crypto.sgzmd
Fixes #24729 CLA: trivial Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24730) (cherry picked from commit fbd6609bb21b125c9454d07c484d166a33b4815b)
2024-06-24Allow calling OPENSSL_INIT_free() with NULL argumentTomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24681) (cherry picked from commit d38f62ea118170fc40e10f6f95b180cccbaa7581)
2024-06-20Make rcu_thread_key context-awareNeil Horman
Currently, rcu has a global bit of data, the CRYPTO_THREAD_LOCAL object to store per thread data. This works in some cases, but fails in FIPS, becuase it contains its own copy of the global key. So 1) Make the rcu_thr_key a per-context variable, and force ossl_rcu_lock_new to be context aware 2) Store a pointer to the context in the lock object 3) Use the context to get the global thread key on read/write lock 4) Use ossl_thread_start_init to properly register a cleanup on thread exit 5) Fix up missed calls to OSSL_thread_stop() in our tests (cherry picked from commit 24d16d3a1915a06a2130385a87de9a37fc09c4b9) Fixes #24581 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24630)
2024-06-05Fix memory leak on error in crypto/conf/conf_mod.cshridhar kalavagunta
Fixes #24111 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24119) (cherry picked from commit 5bbdbce856c7ca132e039a24a315618484874c81)
2024-05-06Coverity found the following issues:Neil Horman
1591471 1591474 1591476 which pertain to memory leaks in the conf_mod code If an error is encountered after the module STACK_OF is duplicated or created in the new_modules variable, we need to remember to free it in the error path Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24337)
2024-04-11VMS: Move defining _XOPEN_SOURCE and _XOPEN_SOURCE_EXTENDED to config targetRichard Levitte
For all other platforms that need these macros defined, that's how it's done, so we have VMS follow suit. That avoids a crash between in source definitions and command line definitions on some other platforms. Fixes #24075 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24083)
2024-04-09Copyright year updatesTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2024-04-04Diverse small VMS build fixupsRichard Levitte
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24008)
2024-03-20Copyright year updatesRichard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-15plug potential memory leak in error code pathAlexandr Nedvedicky
Function `module_add()` may leak stack of modules when it fails to initialize newly added module. Fixes #23835 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23836)
2024-02-01Add exemplar use case for rcu locksNeil Horman
To demonstrate the use of RCU locks, convert CONF_MOD api to using rcu rather than RW locks Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22729)
2023-12-21Detect and prevent recursive config parsingNeil Horman
If a malformed config file is provided such as the following: openssl_conf = openssl_init [openssl_init] providers = provider_sect [provider_sect] = provider_sect The config parsing library will crash overflowing the stack, as it recursively parses the same provider_sect ad nauseum. Prevent this by maintaing a list of visited nodes as we recurse through referenced sections, and erroring out in the event we visit any given section node more than once. Note, adding the test for this revealed that our diagnostic code inadvertently pops recorded errors off the error stack because provider_conf_load returns success even in the event that a configuration parse failed. The call path to provider_conf_load has been updated in this commit to address that shortcoming, allowing recorded errors to be visibile to calling applications. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22898)
2023-10-24Add notes on use of strdupNate Karstens
Added notes to OPENSSL_INIT_set_config_filename and OPENSSL_INIT_set_config_appname explaining why strdup is used instead of OPENSSL_strdup. CLA: trivial Co-authored-by: Jean Apolo <jean.apolo@garmin.com> Signed-off-by: Jean Apolo <jean.apolo@garmin.com> Signed-off-by: Nate Karstens <nate.karstens@garmin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21742)
2023-09-11"foo * bar" should be "foo *bar"Dimitri Papadopoulos
Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21468)
2023-09-07Copyright year updatesMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2023-08-31OPENSSL_init_crypto load config into initial global default library contextIngo Franzki
OPENSSL_init_crypto() with OPENSSL_INIT_LOAD_CONFIG must load the configuration into the initial global default library context, not the currently set default library context. OPENSSL_init_crypto() with OPENSSL_INIT_LOAD_CONFIG may be called within other OpenSSL API functions, e.g. from within EVP_PKEY_CTX_new_xxx() when initializing a pkey context, to perform implicit initialization, if it has not been initialized yet. This implicit initialization may happen at a time when an application has already create its own library context and made it the default library context. So loading the config into the current default library context would load it into the applications library context. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21897)
2023-06-30conf/conf_sap.c: correct return of ossl_config_int() in UEFI systemYi Li
FIX: https://github.com/openssl/openssl/issues/21299 ret in ossl_config_int() only used to check return value of CONF_modules_load_file(), should set it to 1 if in UEFI system. Signed-off-by: Yi Li <yi1.li@intel.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21300)
2023-06-27CONF_modules_load_file_ex(): Do not try to load an empty file nameTomas Mraz
Fixes #21258 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/21282)
2023-05-08Prevent a fuzzing timeout in the conf fuzzerMatt Caswell
The fuzzer was creating a config file with large numbers of includes which are expensive to process. However this should not cause a security issue, and should never happen in normal operation so we can ignore it. Fixes ossfuzz issue 57718. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20839)
2022-10-21stack: Do not add error if pop/shift/value accesses outside of the stackTomas Mraz
This partially reverts commit 30eba7f35983a917f1007bce45040c0af3442e42. This is legitimate use of the stack functions and no error should be reported apart from the NULL return value. Fixes #19389 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19400)
2022-10-05Stop raising ERR_R_MALLOC_FAILURE in most placesRichard Levitte
Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
2022-09-16stack.c: add missing direct error reporting and improve coding styleDr. David von Oheimb
Doing so, had to fix sloppiness in using the stack API in crypto/conf/conf_def.c, ssl/ssl_ciph.c, ssl/statem/statem_srvr.c, and mostly in test/helpers/ssltestlib.c. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/18918)
2022-09-09crypto/conf: gcc build warning fixGang Chen
Fix the gcc build warning from conf_sap.c: variable flags set but not used [-Wunused-but-set-variable] variable appname set but not used [-Wunused-but-set-variable] variable filename set but not used [-Wunused-but-set-variable] CLA: trivial Signed-off-by: Gang Chen <gang.c.chen@intel.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19153)
2022-07-01Avoid crashing if CONF_modules_unload() is called after OPENSSL_cleanup()Tomas Mraz
Although this is basically an incorrect API call it was not crashing before and it might happen inadvertently if CONF_modules_unload() is called from a destructor for example. Fixes #18669 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18673)
2022-06-06CONF_modules_unload should fail if CONF_modules_finish failsMatt Caswell
The module_list_lock is used by CONF_modules_unload(). That function relies on the RUN_ONCE in CONF_modules_finish() to initialise that lock. However if the RUN_ONCE fails that failure is not propagated to CONF_modules_unload() and so it erroneously tries to use the lock anyway. Found due to: https://github.com/openssl/openssl/pull/18355#issuecomment-1144734604 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18460)
2022-06-01Make OSSL_LIB_CTX_load_config thread safeHugo Landau
Fixes #18226. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18331)
2022-05-03Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-04-22str[n]casecmp => OPENSSL_strncasecmpDmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18069)
2022-02-05Move e_os.h to include/internalRichard Levitte
Including e_os.h with a path from a header file doesn't work well on certain exotic platform. It simply fails to build. Since we don't seem to be able to stop ourselves, the better move is to move e_os.h to an include directory that's part of the inclusion path given to the compiler. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17641)
2022-01-06Fix copyright year issuesBernd Edlinger
Fixes: #13765 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17427)
2022-01-03Update troublesome copyright years of auto-generated files to 2022Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17398)
2021-11-17Add and use HAS_PREFIX() and CHECK_AND_SKIP_PREFIX() for checking if string ↵Dr. David von Oheimb
has literal prefix Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15847)
2021-10-14Fix another memory leak reported in CIFuzzBernd Edlinger
Direct leak of 2 byte(s) in 1 object(s) allocated from: #0 0x4a067d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 #1 0x57acd9 in CRYPTO_malloc /src/openssl/crypto/mem.c:184:12 #2 0x57e106 in CRYPTO_strdup /src/openssl/crypto/o_str.c:24:11 #3 0x5c139f in def_load_bio /src/openssl/crypto/conf/conf_def.c:427:45 #4 0x56adf5 in NCONF_load_bio /src/openssl/crypto/conf/conf_lib.c:282:12 #5 0x4d96cf in FuzzerTestOneInput /src/openssl/fuzz/conf.c:38:5 #6 0x4d9830 in LLVMFuzzerTestOneInput /src/openssl/fuzz/driver.c:28:12 #7 0x510c23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) cxa_noexception.cpp #8 0x4fc4d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 #9 0x501f85 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) cxa_noexception.cpp #10 0x52ac82 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 #11 0x7f15336bf0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16813)
2021-10-14Fix a memory leak reported in CIFuzzBernd Edlinger
Direct leak of 4 byte(s) in 1 object(s) allocated from: #0 0x4a067d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 #1 0x57af0d in CRYPTO_malloc /src/openssl/crypto/mem.c:184:12 #2 0x57af0d in CRYPTO_realloc /src/openssl/crypto/mem.c:207:16 #3 0x569d17 in BUF_MEM_grow /src/openssl/crypto/buffer/buffer.c:97:15 #4 0x5c3629 in str_copy /src/openssl/crypto/conf/conf_def.c:642:10 #5 0x5c1cc1 in def_load_bio /src/openssl/crypto/conf/conf_def.c:452:22 #6 0x56adf5 in NCONF_load_bio /src/openssl/crypto/conf/conf_lib.c:282:12 #7 0x4d96cf in FuzzerTestOneInput /src/openssl/fuzz/conf.c:38:5 #8 0x4d9830 in LLVMFuzzerTestOneInput /src/openssl/fuzz/driver.c:28:12 #9 0x510c23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) cxa_noexception.cpp #10 0x4fc4d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 #11 0x501f85 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) cxa_noexception.cpp #12 0x52ac82 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16813)
2021-06-17Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15801)
2021-06-02Add NCONF_get_section_names()Tomas Mraz
And a few additional fixups to make the no-deprecated configuration to build. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15466)
2021-06-02Add NCONF_get0_libctx()Rich Salz
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15466)
2021-06-02Make conf_method_st and conf_st deprecatedRich Salz
So they can be made opaque in a future release. Fixes #15101 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15466)
2021-05-27Use <> for #include openssl/xxxRich Salz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15468)
2021-05-26err: rename err_load_xxx_strings_int functionsPauli
The new names are ossl_err_load_xxx_strings. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15446)
2021-05-11Add convenience functions and macros for asymmetric key generationDr. David von Oheimb
Add EVP_PKEY_gen(), EVP_PKEY_Q_gen(), EVP_RSA_gen(), and EVP_EC_gen(). Also export auxiliary function OSSL_EC_curve_nid2name() and improve deprecation info on RSA and EC key generation/management functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14695)
2021-05-05Add .includedir pragmaRich Salz
Also add a negative test, and fix typo's. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15090)
2021-05-05Allow absolute paths to be setRich Salz
It was a mistake to allow relative paths for include files (just like root shouldn't have "." in its PATH), but we probably can't change it now. Add a new pragma "abspath" that someone can put in the system-wide config file to require absolute paths. Also update the config documentation to better explain how file inclusion works. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15090)
2021-04-19Resurrect and modernize C++Builder configTanzinul Islam
Similar configuration to what was deleted in 8e56a422, updated for the unified build scheme. Use the [Clang-based `bcc32c.exe`][1] to avoid a [bug][2] with the old one, and increase the `tlib.exe` page size to 256. Also avoid MSVC-specific C runtime library functions. [1]: http://docwiki.embarcadero.com/RADStudio/Sydney/en/Win32_Clang-enhanced_Compilers [2]: https://quality.embarcadero.com/browse/RSP-31630 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13540)
2021-04-08Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14801)
2021-04-01Corrected missing definitions from NonStop SPT build.Randall S. Becker
This change includes swapping the PUT and SPT configuration, includes of sys/stat.h and sys/types.h in the correct scope to be picked up by SPT definitions. Fixes: #14698 Fixes: #14734 CLA: The author has the permission to grant the OpenSSL Team the right to use this change. Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14736)
2021-03-31Add a local perl module to get year last changedRich Salz
This is used for generating a more-correct copyright statement for the "build_generated" targets. Fixes: #13765 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13791)
2021-03-18Add ossl_ conf symbolsShane Lontis
Partial fix for #12964 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14473)
2021-01-28Update copyright yearRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13999)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-01 05:01:48 +0000