summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* Use X509_ALGOR_get0() in ecdh_cms_set_shared_info()tb2024-04-181-6/+14
| | | | | | | | This makes things slightly less gross since it involves less reaching into nested ASN.1 structures. But don't get the idea that this means the code is now clean. ok jsing
* Test and assign in ecdh_cms_set_shared_info()tb2024-04-181-9/+7
| | | | ok jsing
* Turn ecdh_cms_set_shared_info() into single exittb2024-04-181-7/+9
| | | | ok jsing
* Remove comments from captain obvious and drop useless prototypestb2024-04-171-43/+1
|
* SSL_version_str is no moretb2024-04-171-5/+1
|
* tidy includestb2024-04-171-3/+2
|
* bn_convert: zap extra blank linetb2024-04-171-2/+1
|
* Rewrite BN_mpi2bn() using CBS and bn_bin2bn_cbs().jsing2024-04-171-32/+29
| | | | ok tb@
* Rewrite BN_lebin2bn() using CBS.jsing2024-04-171-48/+16
| | | | | | | We get an implementation of this for free by having bn_bin2bn_cbs() use CBS_get_u8() instead of CBS_get_last_u8(). ok tb@
* Provide constant time operations for uint8_t.jsing2024-04-171-1/+68
| | | | | | These will be used in upcoming changes. ok tb@
* Shuffle EVP_PKEY_CTX setting togethertb2024-04-171-5/+3
| | | | | | | Another stroke of the already very dirty brush eliminates more traces of ADHD and/or crack. ok jsing
* ecdh_cms_encrypt(): tweak wrap_algor constructiontb2024-04-171-15/+23
| | | | | | | | | | | | | | | | This manually constructs an X509_ALGOR because the (now internal) legacy interface EVP_CIPHER_param_to_asn1() (which is an unwelcome complication thanks to RC2) is entirely incompatible with X509_ALGOR_set0() since the ASN1_TYPE can't be pulled apart nicely (because the ASN1_TYPE API is incomplete as well). Once we got this far, we get to DER-encode the inner AlgorithmIdentifier and set that blob as the parameters of another one. The same variables are reused of course and needless to say an unchecked X509_ALGOR_set0() would leak this blob on failure. So fix this by switching to the usual error checked X509_ALGOR_set0_by_nid(). ok jsing
* ecdh_cms_encrypt: tweak handling of ecdh_nidtb2024-04-171-4/+3
| | | | ok jsing
* ecdh_cms_encrypt: handle kdf_md in one gotb2024-04-171-3/+3
| | | | | | | Again the getting and the setting were interrupted by ten lines of completely unrelated code. ok jsing
* ecdh_cms_encrypt: simplify setting the KDF typetb2024-04-171-13/+6
| | | | | | | | | It is much simpler to avoid the key_type variable altogether and inline its use. Also it makes no sense to have 15 unrelated lines between the getting of the kdf type, checking its content, and then actually setting it to EVP_PKEY_ECDH_KDF_X9_63. ok jsing
* Use error checked X509_ALGOR_set0_by_nidtb2024-04-171-5/+5
| | | | | | | | While setting the parameters to type V_ASN1_UNDEF can't actually fail, it is cleaner to just do the check. Using the by_nid() variant also removes the need for an unchecked nested OBJ_nid2obj() call. ok jsing
* ecdh_cms_encrypt: simplify handling of pkeytb2024-04-171-15/+6
| | | | | | | The pkey is only used in one scope. i2o allocates if passed a pointer to NULL, so use that to drop two unnecessary local variables. ok jsing
* Transfer ownership before setting unused bitstb2024-04-171-2/+4
| | | | | | | This looks like a use after free, but setting the unused bits to 0 can't actually fail. ok jsing
* Turn ecdh_cms_encrypt() into single exittb2024-04-171-7/+7
| | | | | | Also use ret instead of rv. ok jsing
* Fix error check in ecdh_cms_encrypt()tb2024-04-171-2/+2
| | | | | | | | ASN1_TYPE_get() returns V_ASN1_* constants. Checking the return for NID_undef instead means that we actually check for V_ASN1_EOC, which makes absolutely no sense here. Clearly V_ASN1_UNDEF was intended. ok jsing
* Add regress coverage for BN_lebin2bn().jsing2024-04-171-3/+17
|
* Avoid NULL dereference in EVP_PKEY_paramgen()tb2024-04-171-6/+8
| | | | | | | | If EVP_PKEY_new() returns NULL, it would be passed to the paramgen() pmeth which would typically dereference it. This is identical to a recent change in keygen(). ok jsing
* openssl req: plug obvious leaktb2024-04-171-1/+2
| | | | CID 492603
* Fix key share negotiation in HRR casetb2024-04-161-1/+40
| | | | | | | | | | | | | | | | | | | | | | | | In the ClientHello retrying the handshake after a HelloRetryRequest, the client must send a single key share matching the group selected by the server in the HRR. This is not necessarily the mutually preferred group. Incorrect logic added in ssl_tlsect.c r1.134 would potentially reject such a key share because of that. Instead, add logic to ensure on the server side that there is a single share matching the group we selected in the HRR. Fixes a regress test in p5-IO-Socket-SSL where server is configured with P-521:P-384 and the client with P-256:P-384:P-521. Since the client sends an initial P-256 key share, a HRR is triggered which the faulty logic rejected because it was not the mutually preferred P-384 but rather matching the server-selected P-521. This will need some deduplication in subsequent commits. We may also want to consider honoring the mutual preference and request a key accordingly in the HRR. reported by bluhm, fix suggested by jsing ok beck jsing
* Invert BN_BITS2 handling in bn_bin2bn_cbs() and bn_hex2bn_cbs().jsing2024-04-161-11/+11
| | | | | | This results in simpler code. Suggested by tb@ during review.
* Rewrite BN_bin2bn() using CBS.jsing2024-04-161-35/+58
| | | | ok tb@
* Provide bn_expand_bytes().jsing2024-04-162-2/+16
| | | | | | This will be used in an upcoming change. ok tb@
* Rename bn_expand() to bn_expand_bits().jsing2024-04-163-10/+7
| | | | | | | Also change the bits type from int to size_t, since that's what the callers are passing and we can avoid unnecessary input validation. ok tb@
* sorttb2024-04-161-1/+1
|
* Remove workarounds for unprototyped symbolstb2024-04-151-71/+1
|
* Include the correct headertb2024-04-151-2/+2
|
* crank libtls like libcrypto and libssltb2024-04-151-1/+1
|
* crank libssl major after libcrypto major and symbol removaltb2024-04-151-1/+1
|
* Unexport SSL_version_strtb2024-04-152-4/+1
| | | | ok jsing
* crank libcrypto major after symbol removaltb2024-04-151-1/+1
|
* Bye, bye, OPENSSL_str{,n}casecmp()tb2024-04-153-25/+1
| | | | ok jsing
* And a pile of TS ASN.1 stuff becomes internal-only, tootb2024-04-152-19/+10
| | | | ok jsing
* X509_NAME_ENTRIES_it and X509_NAME_INTERNAL_it go internaltb2024-04-152-5/+3
| | | | | | It's always good to see something called internal in the public API. ok jsing
* And here go {,EC}DSA_SIG_ittb2024-04-153-6/+4
| | | | ok jsing
* DHparam_it becomes static, tootb2024-04-152-3/+2
| | | | ok jsing
* More X9.62 stuff was never used outside of ec_asn1.ctb2024-04-152-43/+5
| | | | | | We only need the ASN.1 items. ok jsing
* EC_PRIVATEKEY becomes internal-only, tootb2024-04-152-15/+10
| | | | ok jsing
* Unexport the ECPKPARAMETERS APItb2024-04-153-19/+12
| | | | ok jsing
* Make ECPARAMETERS_{new,free,it} internal-onlytb2024-04-152-8/+5
| | | | ok jsing
* Move BIO_CONNECT_{new,free}() to internal-onlytb2024-04-152-7/+5
| | | | ok jsing
* Remove ASN1_time_clamp_not_after() from Symbols.listtb2024-04-151-1/+0
| | | | | | | This was only ever semi-public and libtls no longer uses it since it was switched to the BoringSSL POSIX time API. ok jsing
* Enable negative zero checks for BN_clear_bit() and BN_mask_bits().jsing2024-04-151-5/+1
|
* Prevent negative zero from being created via BN bit functions.jsing2024-04-151-1/+7
| | | | | | | | | | | | Both BN_clear_bit() and BN_mask_bits() can create zero values - in both cases ensure that the negative sign is correctly handled if the value becomes zero. Thanks to Guido Vranken for providing a reproducer. Fixes oss-fuzz #67901 ok tb@
* drop htonl(), htons(), ntohl(), ntohs() MD functions from libcnaddy2024-04-155-50/+21
| | | | | | | | | | | Userland code compiled in a normal fashion picks up the htonl(), htons(), ntohl(), ntohs() macros implemented by endian.h. The functions in libc are effectively unused. Keep the MI functions in case something looks for the symbols in libc or plays games with #undef, but change them to wrap the implementation from endian.h. tweaks suggested by claudio@, ok miod@
* t22 and t23 can fail if the first chunk ends up being allocated atotto2024-04-141-2/+12
| | | | | the very end of the page. Circumvent that. Reported by and fix ok anton@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-19 23:42:10 +0000