summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* More KNF.jsing2014-06-2116-122/+112
|
* KNFmiod2014-06-216-248/+274
|
* KNFmiod2014-06-216-356/+372
|
* Fix memory leak in error path.logan2014-06-212-4/+4
| | | | OK from miod@
* Protect explicit_bzero() from link-time optimizationmatthew2014-06-211-7/+10
| | | | | | | | | | | | | | | | | | | | Modern compiler toolchains are capable of optimizing even across translation unit boundaries, so simply moving the memory clearing into a separate function is not guaranteed to clear memory. To avoid this, we take advantage of ELF weak symbol semantics, and insert a call to an empty, weakly named function. The semantics of calling this function aren't determinable until load time, so the compiler and linker need to keep the memset() call. There are still ways a toolchain might defeat this trick (e.g., optimistically expecting the weak symbol to not be overloaded, and only calling memset() if it is; promoting weak symbols to strong symbols at link-time when emitting a static binary because they won't be interposed; implementing load-time optimizations). But at least for the foreseeable future, these seem unlikely. ok deraadt
* hash in correct pointerderaadt2014-06-212-4/+4
|
* Remove the OPENSSL_*cap getenv's. A program should not be able toderaadt2014-06-206-50/+10
| | | | | change the behaviour of the library in such a complicated fashion. ok miod
* wrap getenv OPENSSL_ALLOW_PROXY_CERTS in an issetugid check, to protectderaadt2014-06-202-4/+4
| | | | | setuid applications from being fooled. ok miod
* KNFbeck2014-06-202-96/+112
|
* indentderaadt2014-06-202-4/+4
|
* rearrange so that the main function with the important comments is at the topotto2014-06-202-156/+160
| | | | ok deraadt@ beck@
* Work in progress on how to deal with the inherit unreliability ofbeck2014-06-202-0/+878
| | | | | | /dev/urandom. Does well in the fallback case. Get it in tree so it can be worked on. ok otto@ deraadt@
* Remove OPENSSL_instrument_halt and OPENSSL_far_spin, which both mightmiod2014-06-202-140/+0
| | | | have been used under DJGPP in the previous century (if at all).
* Fix incorrect bounds check in amd64 assembly version of bn_mul_mont();miod2014-06-204-8/+8
| | | | | noticed and fix by Fedor Indutny of Joyent ( https://github.com/joyent/node/issues/7704 )
* Simple regress test for the amd64 bn_mul_mont bug found by Joyentmiod2014-06-203-2/+86
| | | | | ( https://github.com/joyent/node/issues/7704 ), about to be fixed in libcrypto.
* Move the crypto/bn regression test one directory deeper in preparation formiod2014-06-203-7/+15
| | | | it getting siblings.
* arc4random: hard fail with raise(SIGKILL) if getentropy() returns -1matthew2014-06-201-3/+4
| | | | | | | Allow other non-zero return values in case we change our mind to return an ssize_t byte count instead of simple success/fail. ok deraadt, djm
* convert CRYPTO_memcmp to timingsafe_memcmp based on current policy favoringtedu2014-06-1918-44/+44
| | | | | | libc interfaces over libcrypto interfaces. for now we also prefer timingsafe_memcmp over timingsafe_bcmp, even when the latter is acceptable. ok beck deraadt matthew miod
* check stack push return and make some effort to clean up. ok beck miodtedu2014-06-192-4/+12
|
* improve error checking. set error code on error, and check malloc return.tedu2014-06-192-4/+26
| | | | add missing unlock in one case. ok lteo miod
* Move rs_chacha and rs_buf into the same memory page and don't mark itmatthew2014-06-191-22/+31
| | | | | | | | | MAP_INHERIT_ZERO anymore. This restores arc4random's previous behavior where fork children would mix in some randomness from the parent process. New behavior noticed by deraadt ok deraadt, tedu
* Always call atexit handlers as if they were registered with __cxa_atexit.kettenis2014-06-183-19/+13
| | | | | | | | | | | The extra argument doesn't hurt genuine atexit handlers and this fixes a bug where we didn't provide the argument (effectively passing garbage) for functions registered with __cxa_atexit in the main executable. Pointed out by Dmitriy Ivanov <dimitry@google.com> and Elliott Hughes <enh@google.com>. ok matthew@
* Add regress tests to make sure arc4random(3) is reinitializedmatthew2014-06-183-2/+181
| | | | correctly in fork children.
* In ssl3_send_newsession_ticket(), fix a memory leak in an error path.miod2014-06-182-4/+8
|
* Missinc calloc() return value check; ok deraadt@miod2014-06-181-1/+5
|
* Make sure to always invoke EVP_CIPHER_CTX_cleanup() before returning in themiod2014-06-182-8/+20
| | | | | | error paths from tls_decrypt_ticket(). ok tedu@
* Use asprintf() instead of a fixed 128-byte size in SSL_CIPHER_description()miod2014-06-182-22/+22
| | | | | | when no storage buffer is passed. ok deraadt@ tedu@
* In SSL_COMP_add_compression_method(), make sure error cases actually returnmiod2014-06-182-4/+4
| | | | | | `error' rather than `success'. ok deraadt@
* ssl_session_cmp is not a sort function, can use CRYPTO_memcmp here too.tedu2014-06-172-4/+8
|
* Use MAP_INHERIT_ZERO in arc4random(3)matthew2014-06-171-37/+44
| | | | | | | | Now instead of calling getpid() each time a user invokes arc4random(), we're able to rely on the kernel zero'ing out the RNG state if the process forks. ok deraadt, djm
* free iv, then cleanse. from Cyril Jouvetedu2014-06-152-4/+4
|
* Simplify EVP_MD_CTX_create() by just using calloc(). Also, use 0 ratherjsing2014-06-152-18/+8
| | | | | | than '\0' for several memset(). ok beck@ miod@
* Simplify EVP_CIPHER_CTX_new() - stop pretending that EVP_CIPHER_CTX_init()jsing2014-06-152-12/+4
| | | | | | does something special... just use calloc() instead. ok beck@ miod@
* Add missing OPENSSL_cleanse() in aead_aes_gcm_cleanup().jsing2014-06-152-2/+4
| | | | ok beck@ miod@
* The OPENSSL_cleanse() in aes_gcm_cleanup() only cleans the gcm field of thejsing2014-06-152-4/+4
| | | | | | | EVP_AES_GCM_CTX, leaving the AES key untouched - clean the entire context, rather than just part of it. ok beck@ miod@
* Rename ssl3_record_sequence_update() to ssl3_record_sequence_increment(),jsing2014-06-157-55/+28
| | | | | | | so that it reflects what it is actually doing. Use this function in a number of places that still have the hand rolled version. ok beck@ miod@
* oops, typo. James Hartley is fast at trying -currentderaadt2014-06-151-2/+2
|
* In srandomdev(), use arc4random_buf() instead of from the kernel.deraadt2014-06-151-4/+3
| | | | discussion with matthew
* Add more bounded attributes to the buffer and md5/sha headers in libsslavsm2014-06-146-38/+70
| | | | ok miod@
* typomiod2014-06-132-4/+4
|
* For now... assume success of getentropy() just like we assumed successderaadt2014-06-131-3/+3
| | | | of sysctl(). Mark it with XXX while we consider.
* Correctly calculate the key block length when using export ciphers.jsing2014-06-132-2/+10
|
* Overhaul the keyblock handling in ssl3_change_cipher_state(). Usejsing2014-06-131-32/+45
| | | | | meaningful variable names with use with pointer arithmitic rather than complex array indexing.
* Correctly calculate the key block length when used with export ciphers.jsing2014-06-131-17/+24
| | | | While here, use meaningful variable names and simplify the calculation.
* Remove deprecated RFC2292 ancillary data convenience functions.chrisz2014-06-132-488/+2
| | | | | | They are obsoleted by the RFC3542 api. ok mpi@
* use getgentropy() call. If it fails, things are pretty bad --deraadt2014-06-131-8/+3
| | | | | call abort(). this direction discussed at length with miod beck tedu matthew etc
* use getentropy; from matthewderaadt2014-06-131-5/+2
|
* Use meaningful variable names, rather than i, j, k and cl.jsing2014-06-131-23/+27
|
* Do not bother trying to work out of we can reuse a cipher context - justjsing2014-06-131-22/+12
| | | | | throw it away and create a new one. This simplifies the code and also allows ASR to do its thing.
* Separate the comression handling from the cipher/message digest handling injsing2014-06-131-43/+47
| | | | ssl3_change_cipher_state().
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-22 08:21:48 +0000