summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Switch loop bounds from size_t to int in check_hosts()tb2022-08-311-2/+2
| | | | | | | | | sk_num() can return a negative value, in which case the upper bound is SIZE_MAX, which results in a very long for loop. CID 153997 ok jsing
* Check return values in ssl_print_tmp_key()tb2022-08-311-4/+9
| | | | | | | | | | Use EVP_PKEY_get0_EC_KEY() instead of the get1 version to avoid an EVP_PKEY_free(). Check return values: if either EVP_PKEY_get0_EC_KEY() or EC_KEY_get0_group() fail, a NULL dereference occurs. CID 43289 ok jsing
* Avoid potential NULL dereference in ssl_set_pkey()tb2022-08-311-5/+9
| | | | | | | | | | | Switch from X509_get_pubkey() to X509_get0_pubkey() to avoid an unnecessary EVP_PKEY_free(). Check the return values of X509_get0_pubkey() and EVP_PKEY_copy_parameters(). If the former returns NULL, the latter will dereference NULL. CID 25020 ok jsing
* Check HMAC() return value to avoid a later use of uninitializedtb2022-08-301-3/+7
| | | | CID 25421
* Remove a commented-out sk_push that has been hanging around for > 20 yearstb2022-08-301-4/+1
|
* chacha20_poly1305_cleanup() should return 1tb2022-08-301-2/+2
| | | | | | Otherwise EVP_CIPHER_CTX_cleanup() leaks, as spotted by the ASAN CI. ok jsing
* Plug leak of BIO in tls13_quic_init()tb2022-08-301-2/+1
| | | | | | | If rbio and wbio are the same, SSL_free() only frees one BIO, so the BIO_up_ref() before SSL_set_bio() leads to a leak. ok jsing
* Plug memory leak in X509_REQ_print_ex()tb2022-08-301-2/+4
| | | | | | CID 356353 ok jsing
* missing periodtb2022-08-291-2/+2
|
* Provide ERR_R_INIT_FAIL.jsing2022-08-292-3/+4
| | | | | | Needed for an upcoming change. ok tb@
* Provide ASN1_R_TYPE_NOT_PRIMITIVE.jsing2022-08-292-2/+4
| | | | | | Needed for an upcoming change. ok tb@
* static const, not const staticjsg2022-08-291-3/+3
| | | | | | | | | c99 6.11.5: "The placement of a storage-class specifier other than at the beginning of the declaration specifiers in a declaration is an obsolescent feature." ok miod@ tb@
* Plug memory leak in CMS_add_simple_smimecap() in the unlikely event thattb2022-08-281-3/+6
| | | | | | ASN1_INTEGER_set() fails. ok jsing
* Add regress test for the encoding of an ASN1_INTEGER with NULL data.jsing2022-08-281-1/+38
|
* Encode an ASN.1 INTEGER with NULL data to value of zero.jsing2022-08-281-2/+4
| | | | | | | | | | | When an ASN1_INTEGER is created it has NULL data until a value is set - previously, an ASN1_INTEGER in this state encoded to an ASN.1 INTEGER with a value of 0, rather than being treated as an error. While code should really set values, the historical behaviour has not required this. Found the hard way by sthen@ with acme-client. ok tb@
* remove unused blowfish inline definesjsg2022-08-281-8/+1
| | | | inline use was removed in 1998
* Wire up QUIC regress.jsing2022-08-271-1/+2
|
* Add regress for QUIC.jsing2022-08-272-0/+358
| | | | | This exercises the libssl QUIC implementation and completes a TLS handshake using the SSL_QUIC_METHOD interface.
* Handle SSL_do_handshake() being called before SSL_provide_quic_data().jsing2022-08-271-1/+4
| | | | | | | If SSL_do_handshake() is called before SSL_provide_quic_data() has been called, the QUIC read buffer will not have been initialised. In this case we want to return TLS13_IO_WANT_POLLIN so that the QUIC stack will provide handshake data.
* Provide additional defines for EVP AEAD.jsing2022-08-271-1/+18
| | | | | | | While these will not be used by LibreSSL, they are used by some QUIC implementations (such as ngtcp2). ok tb@
* Revise regress now that SSL_QUIC_METHOD exists.jsing2022-08-211-4/+6
|
* Provide the remaining QUIC API.jsing2022-08-212-2/+149
| | | | | | | While more work is still required, this is sufficient to get ngtcp2 to compile with QUIC and for curl to be able to make HTTP/3 requests. ok tb@
* Wire up SSL_QUIC_METHOD callbacks to the record layer callbacks for QUIC.jsing2022-08-213-19/+59
| | | | ok tb@
* Provide SSL_QUIC_METHOD.jsing2022-08-213-9/+172
| | | | | | | | | | | | | | | | | | | This provides SSL_QUIC_METHOD (aka ssl_quic_method_st), which allows for QUIC callback hooks to be passed to an SSL_CTX or SSL. This is largely ported/adapted from BoringSSL. It is worth noting that this struct is not opaque and the original interface exposed by BoringSSL differs to the one they now use. The original interface was copied by quictls and it appears that this API will not be updated to match BoringSSL. To make things even more challenging, at least one consumer does not use named initialisers, making code completely dependent on the order in which the function pointers are defined as struct members. In order to try to support both variants, the set_read_secret/set_write_secret functions are included, however they have to go at the end. ok tb@
* Provide and use QUIC specific error reasons.jsing2022-08-213-5/+9
| | | | ok tb@
* Ensure that SSL_{peek,read,write}() are not called if QUIC is in use.jsing2022-08-211-1/+16
| | | | ok tb@
* Prepare to provide SSL_ERROR_WANT_{ASYNC,ASYNC_JOB,CLIENT_HELLO_CB}jsing2022-08-211-10/+15
| | | | | | | LibreSSL will not return these values, however software is starting to check for these as return values from SSL_get_error(). ok tb@
* fix indent and zap trailing whitespacetb2022-08-211-3/+3
|
* zap a tabtb2022-08-201-2/+2
|
* Test EVP_chacha20_poly1305() (linking statically for now)jsing2022-08-202-3/+4
|
* Provide EVP_chacha20_poly1305()jsing2022-08-202-7/+260
| | | | | | | | | | | EVP_chacha20_poly1305() is an EVP_CIPHER implementation of the ChaCha20-Poly1305 AEAD. This is potentially used to provide encryption for the QUIC transport layer. Where possible, this should be avoided in favour of the significantly saner EVP_AEAD interface. ok tb@
* Remove bogus length checks from EVP_aead_chacha20_poly1305()jsing2022-08-201-27/+1
| | | | | | | | | The length checks for EVP_aead_chacha20_poly1305() seal/open were incorrect and are no longer necessary (not to mention that the comment failed to match the code). Remove these since the underlying ChaCha implementation will now handle the same sized inputs at these functions can. Issue flagged by and ok tb@
* Remove UINT32_MAX limitation on ChaCha() and CRYPTO_chacha_20().jsing2022-08-201-3/+23
| | | | | | | | We can avoid this unnecessary limitation by calling chacha_encrypt_bytes() multiple times internally. In the case of ChaCha(), the caller still needs to ensure that the same IV is not used for more than 2^70 bytes. ok tb@
* Rewrite i2c_ASN1_INTEGER() using CBB/CBS.jsing2022-08-201-97/+100
| | | | | | | | | | This gives us cleaner and safer code, although it is worth noting that we now generate the encoding even when called with NULL as the output pointer (and then discard it, returning just the length). Resolves oss-fuzz #49963. ok tb@
* Make it possible to signal an error from an i2c_* function.jsing2022-08-201-2/+7
| | | | | | | | | | | | | | | | In asn1_i2d_ex_primitive(), asn1_ex_i2c() returning -1 is used to indicate that the object is optional and should be skipped, while -2 is used to indicate that indefinite length encoding should be used. Any other negative value was treated as success, resulting in the out pointer being walked backwards. Avoid this by treating any negative value (aside from -1 and -2) as a failure, propagating it up the stack. Additionally, check the return value of the second asn1_ex_i2c() call to ensure that it matches the value returned by the first call. This makes sure that the length of the encoded object is correct, plus it detects the case where a failure occurs during the second call. Discussed with tb@ (who also flagged the negative value issue).
* Add an empty pkcs12_local.h and include it where it will soon be needed.tb2022-08-2012-11/+94
|
* Adjust signatures of BIO_ctrl functionstb2022-08-181-13/+10
| | | | | | | | | | | | | | | In bio.h r1.54, the signature of BIO_callback_ctrl() was changed from bio_info_cb to BIO_info_cb. Adjust manual to reflect this change. At the moment, bio_info_cb and BIO_info_cb are still distinct types with our BIO_info_cb matching OpenSSL's definition. Historically, bio_info_cb had a different type, but that leads to issues with casting function pointers. The ecosystem has moved on to embrace the new type and several ports confuse the two types because OpenSSL decided to "solve" the issues with "typedef BIO_info_cb bio_info_cb; /* backward compatibilty */". We will align with this in the next bump. ok jsing
* Allow empty attribute sets in CSRstb2022-08-181-2/+4
| | | | | | | | | | | While each attribute must contain at least one extension, it is not required that a CSR have attributes at all. Instead of signalling an error by returning NULL if no extensions are found, return an empty stack of extensions. Via OpenSSL 1f02ca2d ok jsing
* Tweak prototype to match function definition (n -> index)tb2022-08-181-2/+2
|
* Implement the SSL_CTRL_GET_SHARED_GROUP controltb2022-08-171-1/+37
| | | | | | | | | | | | | | | | | | | | | | | This implements SSL_get_shared_{curve,group}() in a bug-compatible fashion with OpenSSL. This is your average OpenSSL-style overloaded parameter API where n >= 0 means "return the n-th shared group's NID" (as if anyone possibly ever cared about the case n > 0) and n == -1 means "return the number of shared groups". There is also an undocumented case n == -2 for Suite B profile support which falls back to n == 0 in case Suite B profile support is disabled, so n == -2 is the same as n == 0 in LibreSSL. The API also returns 0 for error, which is indistinguishable from a count of 0 shared groups but coincides with NID_undef. Contrary to claims in the documentation, the API doesn't actually return -1 for clients, rather it returns 0. Obviously this entire exercise is pretty useless, but since somebody exposed it because they could and someone else used it because they could we need to provide it. ok jsing
* Refactor tls1_get_supported_group()tb2022-08-172-30/+99
| | | | | | | | | | | | | This splits tls1_get_supported_group() into a few helper functions to be able to count shared groups and to return the n-th shared group since someone thought it is a great idea to expose that in a single API and some others thought it is useful to add this info to log noise. This is all made a bit more complicated thanks to the security level having its tentacles everywhere and because a user-provided security callback can influence the list of groups shared by the peers. ok jsing
* Add SSL_get_shared_{curve,group}()tb2022-08-171-2/+10
| | | | | | | | These are wrappers of SSL_ctrl() using the SSL_CTRL_GET_SHARED_GROUP control. Do not provide SSL_CTRL_GET_SHARED_CURVE since that is only mentioned in Net::SSLeay docs according to codesearch.debian.net. ok jsing
* Make tls1_get_{format,group_}list() take a const SSLtb2022-08-172-8/+8
| | | | ok jsing
* Provide ssl_security_shared_group()tb2022-08-172-5/+18
| | | | | | | | | Refactor ssl_security_supported_group() into a wrapper of a new internal ssl_security_group() which takes a secop as an argument. This allows adding ssl_security_shared_group() which will be needed in upcoming commits. ok jsing
* Deduplicate peer certificate chain processing code.jsing2022-08-1710-109/+121
| | | | | | | | | | | | | | Rather than reimplement this in each TLS client and server, deduplicate it into a single function. Furthermore, rather than dealing with the API hazard that is SSL_get_peer_cert_chain() in this code, simply produce two chains - one that has the leaf and one that does not. SSL_get_peer_cert_chain() can then return the appropriate one. This also moves the peer cert chain from the SSL_SESSION to the SSL_HANDSHAKE, which makes more sense since it is not available on resumption. ok tb@
* Add missing RCS tag and zap a trailing spacetb2022-08-151-2/+2
|
* Initialize readbytes in BIO_gets()tb2022-08-151-2/+2
| | | | | | | | If the bgets() callback returns <= 0, we currently rely on the user provided callback to set readbytes, which isn't ideal. This also matches what's done in BIO_read() and BIO_write(). ok jsing
* Avoid shadowing the cbs function parameter in tlsext_alpn_server_parse()tb2022-08-151-6/+4
| | | | ok jsing
* Remove redeclaration of rettb2022-08-151-2/+1
| | | | | | | When ret was introduced in an outer scope in r1.113, this declaration wasn't garbage collected. ok jsing
* Fix upper bound in a for loop (no functional change).tb2022-08-121-2/+2
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-29 08:11:10 +0000