summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2023-10-04Restore the meaning of EVP_PKEY_print_private()Richard Levitte
With pre-3.0 OpenSSL, EVP_PKEY_print_private() calls the EVP_PKEY_ASN1_METHOD function "priv_print", effectively asking the backend to print whatever it regards as private key components. In all backends that were built into libcrypto, this function printed what was included in the private key structure, which usually includes the public key components as well. With OpenSSL 3.0, some of the corresponding key2text encoders got a slightly different behavior, where the presence of the selector OSSL_KEYMGMT_SELECT_PRIVATE_KEY without the presence of the selector OSSL_KEYMGMT_SELECT_PUBLIC_KEY would only get what would intuitively be regarded as private key components printed. This isn't entirely consistent, though, as the RSA key2text encoder will still print the public key components regardless. To compensate for the changed backend behavior, EVP_PKEY_print_private() was made to ask the encoder to print the keypair rather than just the private key, thereby moving the backend semantics to the application API. Unfortunately, this causes confusion for providers where the key2text encoder really should print the private key only. This change restores the built-in 1.1.1 backend behavior in the encoders that OpenSSL provides, and renders EVP_PKEY_print_private() more true to its documented behavior, leaving it to the backend to decide what it regards as "private key components". Fixes #22233 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22237) (cherry picked from commit 1296c2ec7866a4f2f4d210432c771142e8de33a0)
2023-10-04Improved detection of engine-provided private "classic" keysDmitry Belyavskiy
Resolves #17092 (?) Resolves #17286 (?) Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19965) (cherry picked from commit 2b74e75331a27fc89cad9c8ea6a26c70019300b5)
2023-09-22no-engine: fix signing with legacy app method based keysMatthias St. Pierre
Signing with an app method based key (i.e. an `EVP_PKEY` which wraps an `RSA` key with an application defined `RSA_METHOD`) used to work in 1.1.1. That feature was broken in commit 60488d2434, but later on fixed by @t8m in commit b247113c05 (see #14859). This commit corrects a minor flaw of the fix, which affects only `no-engine` builds: the special treatment for foreign keys is guarded by an `OPENSSL_NO_ENGINE` check. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22163) (cherry picked from commit 1acc3e8cc3c69187b55cc557c1bc03278ab38063) (cherry picked from commit c67a1988fcf8fe34b1d31e29849f2528d553dd66)
2023-09-22Do not include sparse_array.o in libsslHuiyue Xu
sparse_array.o is not needed in libssl at 3.0.x version. Signed-off-by: Huiyue Xu <xuhuiyue@huawei.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22111)
2023-09-21Fix error handling in lhash contractBernd Edlinger
When the realloc fails in contract, this not a fatal error, since the memory is only shrinked. It is also no option to exit the function at this point, since that would leave the hash table in an inconsistent state. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22154) (cherry picked from commit 5fbfd641aeebdf4b29a0749e13a79a1e59502878)
2023-09-21Fix error handling in CRYPTO_get_ex_new_indexBernd Edlinger
If an out of memory error happens when the index zero is reserved in a newly created ip->meth stack object, that reservation is not done in a second attempt, which makes various X_set_ex_data overwrite the value of X_set_app_data. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22149) (cherry picked from commit d4f22a915ac50570015a23ad794032c4fb9496cb)
2023-09-20coverity: NULL dereferencePauli
Fixes coverity 1544699. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/22138) (cherry picked from commit be01f609f98a8930f2c91b813715e515a88f4d54)
2023-09-19Copyright year updatesRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-09-15Fix PKCS#12 creation error when certificate contains auxiliary dataOlga Batyshkina
Prefer friendly name passed by the caller and calculated local key id to ones found in certificate auxiliary data when creating PKCS#12. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21675) (cherry picked from commit 388a8e731445d190a46ec27b2ff5b4bf334d526b)
2023-09-15Fix a merge mistake in engne_list_addBernd Edlinger
master version increments the struct_ref early and needs to decrement the struct_ref on error, while 3.1 and 3.0 increment the struct_ref later. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22115) (cherry picked from commit bb67dff95aeb21047b95f92c5119cb63e75cfd2f)
2023-09-15Fix engine cleanup error handlingBernd Edlinger
Error handling in engine_cleanup_add_first/last was broken and caused memory leaks. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21971) (cherry picked from commit 00f2efccf5b9671a7af2b12571068258e9c255a5)
2023-09-11Fix a possible memleak in rsa_pub_encodeBernd Edlinger
That seems to be only an issue for RSA-PSS with parameters. Spotted by code review, so it looks like there is no test coverage for this. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22032) (cherry picked from commit 285eb1688f05ad477fefc681bf05d0afedc46d40)
2023-09-08Fix a possible memleak in SRP_VBASE_newBernd Edlinger
In the error handling case the memory in vb->users_pwd was accidentally not released. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21981) (cherry picked from commit 68e95f7840d0d8ac4e5e03381cf9d305578dd1c7)
2023-09-08OSSL_STORE: Fix error flag clearing and setting (provider path only)Richard Levitte
When the provider's load function returned with an error, the libcrypto error flag was only set if EOF hadn't been reached. This is troublesome, as an error can very well occur during the last load before EOF is reached! Also, the error flag was never reset, even though documentation specifies that it should indicate an error in the last load (i.e. not the one before that). Fixes #21968 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21976) (cherry picked from commit 17dd9a2c6262c00800301fddd9441a9c590a630e)
2023-09-08Check error return from cms_sd_asn1_ctrl() correctly.Pauli
Fixes #21986 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/21988) (cherry picked from commit 00a413e2483257a17239cef5dde52df14926284c)
2023-09-05Fix internal memory leaks from OPENSSL_MALLOC_FAILURESBernd Edlinger
There is a rarely used feature that can be enabled with `./config enable-crypto-mdebug` when additionally the environment variable OPENSSL_MALLOC_FAILURES is used. It turns out to be possible that CRYPTO_zalloc may create a leak when the memory is allocated and then the shouldfail happens, then the memory is lost. Likewise when OPENSSL_realloc is used with size=0, then the memory is to be free'd but here the shouldfail check is too early, and the failure may prevent the memory to be freed thus creating a bogus memory leak. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21944) (cherry picked from commit e2cf38d5751d6b48c8625b622c3765d0a39958d7)
2023-09-02Avoid clobbering non-volatile XMM registersBernd Edlinger
This affects some Poly1305 assembler functions which are only used for certain CPU types. Remove those functions for Windows targets, as a simple interim solution. Fixes #21522 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21808) (cherry picked from commit 7b8e27bc2e02238986d89ef0ece067ec1b48e165)
2023-08-31OPENSSL_init_crypto load config into initial global default library contextIngo Franzki
OPENSSL_init_crypto() with OPENSSL_INIT_LOAD_CONFIG must load the configuration into the initial global default library context, not the currently set default library context. OPENSSL_init_crypto() with OPENSSL_INIT_LOAD_CONFIG may be called within other OpenSSL API functions, e.g. from within EVP_PKEY_CTX_new_xxx() when initializing a pkey context, to perform implicit initialization, if it has not been initialized yet. This implicit initialization may happen at a time when an application has already create its own library context and made it the default library context. So loading the config into the current default library context would load it into the applications library context. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21897) (cherry picked from commit ecb6cdf02a302af18fe4bc20097a9ea3177f897c)
2023-08-24Allow RSA-PSS also in EVP_PKEY_assign() and EVP_PKEY_can_sign()Ingo Franzki
Treat keys with EVP_PKEY_RSA_PSS the same as EVP_PKEY_RSA in EVP_PKEY_can_sign() and detect_foreign_key() which is called by EVP_PKEY_assign(). Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21819) (cherry picked from commit e2972982c64f3f1ac10b3ebe1086d99ec67631bd)
2023-08-24ctrl_params_translate: Allow get_rsa_payload_x() also for RSA-PSSIngo Franzki
The get_rsa_payload_x() functions should also allow to get the payload for RSA-PSS keys. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21818) (cherry picked from commit cf712830b7b5a20a768a1fc5f78dc48841b7617f)
2023-08-24ctrl_params_translate: Allow RSA controls also for RSA-PSSIngo Franzki
Controls 'rsa_keygen_pubexp' and 'rsa_keygen_primes' should also be allowed for RSA-PSS keys. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21818) (cherry picked from commit e2c2cca4b2fd1ad946d93507e9ca4f9ea910a114)
2023-08-17issue-21718: remove setting of PTHREAD_MUTEX_NORMALNeil Horman
issue: https://github.com/openssl/openssl/issues/21718 build break reported: crypto/threads_pthread.c:76:5: warning: implicit declaration of function 'pthread_mutexattr_settype'; did you mean 'pthread_mutexattr_destroy'? [-Wimplicit-function-declaration] 76 | pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_NORMAL); | ^~~~~~~~~~~~~~~~~~~~~~~~~ | pthread_mutexattr_destroy crypto/threads_pthread.c:76:38: error: 'PTHREAD_MUTEX_NORMAL' undeclared (first use in this function); did you mean 'PTHREAD_MUTEX_TIMED_NP'? 76 | pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_NORMAL); | ^~~~~~~~~~~~~~~~~~~~ | PTHREAD_MUTEX_TIMED_NP This occurs because PTHREAD_MUTEX_NORMAL is only defined in glibc if __USE_UNIX98 or __USE_XOPEN2K8 is defined, which is derived from setting __USE_POSIX_C_SOURCE or __XOPEN_SOURCE is selected in the glibc feature set for a build. Since openssl selects no specific feature set from glibc, the build break occurs We could select a feature set of course, but that seems like a significant discussion to have prior to doing so. Instead, the simpler solution is to just not set the mutex type at all, given that pthread_mutexattr_init sets the default mutex type, which should be akin to normal anyway (i.e. no mutex error checking or allowed-recursive behavior) Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21726) (cherry picked from commit e4d808652b0a1a19cfe615a6659e65ead0245108)
2023-08-16Check i2d_X509_NAME return in X509_NAME_hash_ex/old3lswear
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21697) (cherry picked from commit 945fde53a3db5011940a059fd1407b81197c9e14)
2023-08-10OSSL_HTTP_{REQ_CTX_set_request_line(),_set1_request()}: backward compat ↵Dr. David von Oheimb
w.r.t. path parameter Fixes #17923 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21690) (cherry picked from commit 45c02183c65f0e1abf59909c2900764606334664)
2023-08-10For ASN1_STRING_set() check result and set correct error codeatishkov
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21658)
2023-08-10Do not raise CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA error in CMS_ContentInfo_freeOlga Batyshkina
This happens if this function is called for signed content. Added ossl_cms_env_enc_content_free() for cleaning enveloped content. Fixed indentation in ossl_cms_env_enc_content_free Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21676) (cherry picked from commit 13342efbb9e16ec8f97b1ac5ab4aa2b3b3490596)
2023-08-09Fix ChaCha assembly code on 32-bit HPUX itanium systemsBernd Edlinger
This fixes the reported crashes 32-bit HPUX systems due to raw out and inp pointer values, and adds one nop instruction on 64-bit systems, like it is done in other assembly modules for those systems. The fix was tested by @johnkohl-hcl see: https://github.com/openssl/openssl/issues/17067#issuecomment-1668468033 Fixes #17067 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21681) (cherry picked from commit 6d38ccedb25f31dfab232e2669415fd4db18b20e)
2023-08-08Fix handling of the "0:" label in arm-xlate.plTom Cosgrove
When $label == "0", $label is not truthy, so `if ($label)` thinks there isn't a label. Correct this by looking at the result of the s/// command. Verified that there are no changes in the .S files created during a normal build, and that the "0:" labels appear in the translation given in the error report (and they are the only difference in the before and after output). Fixes #21647 Change-Id: I5f2440100c62360bf4bdb7c7ece8dddd32553c79 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21653) (cherry picked from commit 9607f5ccf285ac9988a86f95c5ad9f92b556a843)
2023-08-04When exporting/importing decoded keys do not use 0 as selectionTomas Mraz
When decoding 0 as the selection means to decode anything you get. However when exporting and then importing the key data 0 as selection is not meaningful. So we set it to OSSL_KEYMGMT_SELECT_ALL to make the export/import function export/import everything that we have decoded. Fixes #21493 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21519) (cherry picked from commit 2acb0d363c0032b5b97c4f6596609f40bd7d842f) (cherry picked from commit 137ba0567417441cd8b3d43cf23e27d73f7a7684)
2023-08-04no_autoload: make the no-autoload-config option work again.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/21621) (cherry picked from commit cb8e64131e7ce230a9268bdd7cc4664868ff0dc9)
2023-08-03crypto/cmp: fix clash of OSSL_CMP_CERTREQID_NONE with error result of ↵Dr. David von Oheimb
ossl_cmp_asn1_get_int() Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21579) (cherry picked from commit 2c8d9f19e351a84d4329fbe2f68a4a8a49cad3ef)
2023-08-01The PEM_read_bio_Parameters() function should not ask for a passwordMatt Caswell
The PEM_read_bio_Parameters[_ex] function does not have the capability of specifying a password callback. We should not use the fallback password callback in this case because it will attempt to send a prompt for the password which might not be the correct thing to do. We should just not use a password in that case. Fixes #21588 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21603) (cherry picked from commit 0d0791eedff7f0747503d816184810aa093f523e)
2023-08-01Always add a suitable error if we fail to decodeMatt Caswell
We're always supposed to add the fallback "unsupported" error if we don't have anything better. However in some cases this wasn't happening because we were incorrectly setting "flag_construct_called" - even though the construct function had failed. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21603) (cherry picked from commit 564e5b754a4680dfad38585dd73bcf025567b448)
2023-08-01Copyright year updatesMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-07-31Fix a regression in X509_VERIFY_PARAM_add0_policy()Matt Caswell
Also fixes a similar regression in X509_VERIFY_PARAM_add0_table(). Commit 38ebfc3 introduced a regression in 3.0.6 that changed the return value of the two functions above from 1 on success to the number of entries in the stack. If there are more than one entry then this is a change in behaviour which should not have been introduced into a stable release. This reverts the behaviour back to what it was prior to the change. The code is slightly different to the original code in that we also handle a possible -1 return value from the stack push function. This should never happen in reality because we never pass a NULL stack as a parameter - but for the sake of robustness we handle it anyway. Note that the changed behaviour exists in all versions of 3.1 (it never had the original version). But 3.1 should be fully backwards compatible with 3.0 so we should change it there too. Fixes #21570 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/21576) (cherry picked from commit e3d897d3fa3b48bb835fab0665a435469beea7ae)
2023-07-27DH_check(): Do not try checking q properties if it is obviously invalidTomas Mraz
If |q| >= |p| then the q value is obviously wrong as q is supposed to be a prime divisor of p-1. We check if p is overly large so this added test implies that q is not large either when performing subsequent tests using that q value. Otherwise if it is too large these additional checks of the q value such as the primality test can then trigger DoS by doing overly long computations. Fixes CVE-2023-3817 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21550) (cherry picked from commit 1c16253f3c3a8d1e25918c3f404aae6a5b0893de) (cherry picked from commit 6a1eb62c29db6cb5eec707f9338aee00f44e26f5)
2023-07-26Make DH_check set some error bits in recently added errorBernd Edlinger
The pre-existing error cases where DH_check returned zero are not related to the dh params in any way, but are only triggered by out-of-memory errors, therefore having *ret set to zero feels right, but since the new error case is triggered by too large p values that is something different. On the other hand some callers of this function might not be prepared to handle the return value correctly but only rely on *ret. Therefore we set some error bits in *ret as additional safety measure. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21524) (cherry picked from commit 81d10e61a4b7d5394d08a718bf7d6bae20e818fc)
2023-07-25get_cert_by_subject_ex(): Check result of X509_STORE_lock()atishkov
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21515) (cherry picked from commit bc5d9cc8711e86d5c25b81c58dfae531536e61fc)
2023-07-25x509: add ASN1_STRING_set() check resultatishkov
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21497) (cherry picked from commit 46e95903762f0cc478d8a3c252390fa7312bba6e)
2023-07-24fix: reject adding a duplicity into STACK_OF(X509_ATTRIBUTE)Adam Šulc
Function `X509at_add1_attr()` (crypto/x509/x509_att.c) rejects to add a duplicity into `*x` but it searches in a wrong stack. Changed to search in `*x`. CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21505) (cherry picked from commit 7551264186f176ca5801aa84d60c7b91d8fba31f)
2023-07-19Fix DH_check() excessive time with over sized modulusMatt Caswell
The DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it is excessively large. There is already a maximum DH modulus size (10,000 bits) over which OpenSSL will not generate or derive keys. DH_check() will however still perform various tests for validity on such a large modulus. We introduce a new maximum (32,768) over which DH_check() will just fail. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). CVE-2023-3446 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21451) (cherry picked from commit 9e0094e2aa1b3428a12d5095132f133c078d3c3d)
2023-07-18Fix int_ctx_new() error when use 1.1.1n sm2 key and ec method enginelan1120
Signed-off-by: lan1120 <lanming@huawei.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21170) (cherry picked from commit 4c4fefa5c78a49b63113aec35a2bc8d6d9432436)
2023-07-17Fix RSA OAEP set/get label for legacy engineljuzwiuk
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21401) (cherry picked from commit 64b1d2fb06c9a5233dcabfe130036ff95c3fdaae)
2023-07-14Modified OSSL_parse_url to initialize pport_num to 0.Randall S. Becker
This change is intended to provide some safety for uninitialized stack failures that have appeared in 80-test_cmp_http on NonStop x86 when run in a complex CI/CD Jenkins environment. This change also adds init_pint() to handle the initialization of a pointer to int value. Fixes: #21083 Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21109) (cherry picked from commit 45cd2554efc82f8959b4e8ac53bc419b4d5e195a)
2023-07-14Move Keccak rhotates tables to rodataAmir Ayupov
rhotates tables are placed to .text section which confuses tools such as BOLT. Move them to rodata to unbreak and avoid polluting icache/iTLB with data. CLA: trivial Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21440) (cherry picked from commit 2fd82c228363cfd16c5047a348e7c853defa42eb)
2023-06-30conf/conf_sap.c: correct return of ossl_config_int() in UEFI systemYi Li
FIX: https://github.com/openssl/openssl/issues/21299 ret in ossl_config_int() only used to check return value of CONF_modules_load_file(), should set it to 1 if in UEFI system. Signed-off-by: Yi Li <yi1.li@intel.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21300) (cherry picked from commit 500e479db1beae5fa5691d40b866329d2fdc62e7)
2023-06-27CONF_modules_load_file_ex(): Do not try to load an empty file nameTomas Mraz
Fixes #21258 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/21282) (cherry picked from commit 8b7d5ea7dd602eb7c2c4bc5ad45489dc5fc711f6)
2023-06-26Check for 0 modulus in BN_RECP_CTX_set.fullwaywang
The function BN_RECP_CTX_set did not check whether arg d is zero, in which case an early failure should be returned to the invoker. This is a similar fix to the cognate defect of CVE-2015-1794. Fixes #21111 CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21255) (cherry picked from commit 43596b306b1fe06da3b1a99e07c0cf235898010d)
2023-06-26OSSL_STORE and PKCS#12: Check if there is a MAC to verify before promptingRichard Levitte
When a DER object with unknown contents comes all the way to ossl_store_handle_load_result(), and it attempts to decode them as different objects, the PKCS#12 decoding attempt would (almost) always prompt for a passphrase, even if there isn't a MAC to verify it against in the PKCS#12 object. This change checks if there is a MAC to verify against before attempting to prompt for a passphrase, leading to less surprising behavior. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21197) (cherry picked from commit 7a520619c997146639f42ce8595162ac34c2ad41)
2023-06-18return immediately if namemap is NULLVladimír Kotal
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21223) (cherry picked from commit 307cd045dccbd9ea589ff47682e39504d79644d4)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-12 21:20:13 +0000