summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Clean up alignment handling for SHA-512.jsing2023-05-172-81/+95
| | | | | | | | | | | | | | | | | | All assembly implementations are required to perform their own alignment handling. In the case of the C implementation, on strict alignment platforms, unaligned data will be copied into an aligned buffer. However, most platforms then perform byte-by-byte reads (via the PULL64 macros). Instead, remove SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA and alignment handling to sha512_block_data_order() - if the data is aligned then simply perform 64 bit loads and then do endian conversion via be64toh(). If the data is unaligned then use memcpy() and be64toh() (in the form of crypto_load_be64toh()). Overall this reduces complexity and can improve performance (on aarch64 we get a ~10% performance gain with aligned input and about ~1-2% gain on armv7), while the same movq/bswapq is generated for amd64 and movl/bswapl for i386. ok tb@
* ecdhtest: check malloc() return valuestb2023-05-161-4/+7
| | | | From Ilya Chipitsine
* add missing pointer invalidationjcs2023-05-161-1/+2
| | | | ok tb
* Clean up SHA-512 input handling and round macros.jsing2023-05-161-47/+49
| | | | | | | | | | | Avoid reach around and initialisation outside of the macro, cleaning up the call sites to remove the initialisation. Use a T2 variable to more closely follow the documented algorithm and remove the gorgeous compound statement X = Y += A + B + C. There is no change to the clang generated assembly on aarch64. ok tb@
* Rename arguments of X509_STORE_CTX_init()tb2023-05-141-5/+5
| | | | | | | | | | It is higly confusing to call the list of untrusted certs chain, when you're later going to call X509_STORE_CTX_get0_chain() to get a completely unrelated chain by the verifier. Other X509_STORE_CTX APIs call this list of certs 'untrusted', so go with that. At the same time, rename the x509 into leaf, which is more explicit. suggested by/ok jsing
* Fix X509error() and X509V3error()tb2023-05-141-6/+11
| | | | | | | | | | | | | | | When v3err.c was merged into x509_err.c nearly three years ago, it was overlooked that the code needed two distinct pairs of ERR_FUNC/ERR_REASON, one for ERR_LIB_X509 and one for ERR_LIB_X509V3. The result is that the reason strings for the X509_R_* codes would be overwritten by the ones for X509V3_R_* with the same value while the reason strings for all X509V3_R_* would be left undefined. Fix this by an #undef/#define dance for ERR_LIB_X509V3 once we no longer the ERR_FUNC/ERR_REASON pair for ERR_LIB_X509. reported by job ok jsing
* Send the linebuffer BIO to the attictb2023-05-141-377/+0
| | | | | | | | | | | | | | | | | | | | | *) On VMS, stdout may very well lead to a file that is written to in a record-oriented fashion. That means that every write() will write a separate record, which will be read separately by the programs trying to read from it. This can be very confusing. The solution is to put a BIO filter in the way that will buffer text until a linefeed is reached, and then write everything a line at a time, so every record written will be an actual line, not chunks of lines and not (usually doesn't happen, but I've seen it once) several lines in one record. BIO_f_linebuffer() is the answer. Currently, it's a VMS-only method, because that's where it has been tested well enough. [Richard Levitte] Yeah, no, we don't care about any of this and haven't compiled this file since forever. Looks like tedu's chainsaw got blunt at some point...
* Fix another mandoc -Tlint warningtb2023-05-141-3/+5
| | | | | With this the only -Tlint warnings are about Xr to undocumented functions: EVP_CIPHER_CTX_copy, EVP_CIPHER_CTX_get_cipher_data, X509V3_EXT_get_nid.
* Rephrase a sentence slightly to apease mandoc -Tlinttb2023-05-141-3/+5
|
* Fix Xr as BN_is_prime(3) is in the attictb2023-05-141-3/+3
|
* Zap trailing commatb2023-05-141-2/+2
|
* X509_policy_tree_level_count(3) is gonetb2023-05-141-3/+2
|
* add missing #include <string.h>; ok tb@op2023-05-148-8/+18
|
* Assert that test->want != NULL at this pointtb2023-05-131-1/+3
| | | | Should make coverity happier
* Bob points out that one error should be an X509V3error()tb2023-05-121-2/+2
|
* x509_utl.c: fix some style nits.tb2023-05-121-4/+3
|
* Rewrite string_to_hex() and hex_to_string() using CBB/CBStb2023-05-121-70/+124
| | | | | | | | | | | These helpers used to contain messy pointer bashing some with weird logic for NUL termination. This can be written more safely and cleanly using CBB/CBS, so do that. The result is nearly but not entirely identical to code used elsewhere due to some strange semantics. Apart from errors pushed on the stack due to out-of-memory conditions, care was taken to preserve error codes. ok jsing
* asn1oct: add a couple more teststb2023-05-121-1/+10
|
* Reduce the number of SHA-512 C implementations from three to one.jsing2023-05-121-134/+1
| | | | | | | | | | | | | | | | | We currently have three C implementations for SHA-512 - a version that is optimised for CPUs with minimal registers (specifically i386), a regular implementation and a semi-unrolled implementation. Testing on a ~15 year old i386 CPU, the fastest version is actually the semi-unrolled version (not to mention that we still currently have an i586 assembly implementation that is used on i386 instead...). More decent architectures do not seem to care between the regular and semi-unrolled version, presumably since they are effectively doing the same thing in hardware during execution. Remove all except the semi-unrolled version. ok tb@
* asn1oct: minor tweak in error messagetb2023-05-121-3/+3
|
* Add regress coverage for {s2i,i2s}_ASN1_OCTET_STRINGtb2023-05-122-1/+271
|
* primility -> primalityjsg2023-05-121-3/+3
| | | | ok tb@
* Be a bit more precise on how s2i_ASN1_OCTET_STRING handles colonstb2023-05-121-5/+6
|
* tls_verify.c: give up on variable alignment in this filetb2023-05-111-6/+6
| | | | | | The previous commit resulted in misalignment, which impacts my OCD worse than no alignment at all. Alignment wasn't consistently done in this file anyway. op tells me it won't affect current efforts in reducing the diff.
* Document recent changes in primality testingtb2023-05-111-8/+23
| | | | With input from beck and jsing
* Use is_pseudoprime instead of is_prime in bn_bpsw.ctb2023-05-101-30/+33
| | | | | | | This is more accurate and improves readability a bit. Apart from a comment tweak this is sed + knfmt (which resulted in four wrapped lines). Discussed with beck and jsing
* switch two ASN1_STRING_data() to ASN1_STRING_get0_data()op2023-05-101-5/+5
| | | | | | | | | and while here mark as const data. This diff is actually from gilles@, in OpenSMTPD-portable bundled libtls. ok tb@, jsing@
* Add Miller-Rabin test for random bases to BPSWtb2023-05-103-33/+130
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The behavior of the BPSW primality test for numbers > 2^64 is not very well understood. While there is no known composite that passes the test, there are heuristics that indicate that there are likely infinitely many. Therefore it seems appropriate to harden the test. Having a settable number of MR rounds before doing a version of BPSW is also the approach taken by Go's primality check in math/big. This adds a new implementation of the old MR test that runs before running the strong Lucas test. I like to imagine that it's slightly cleaner code. We're effectively at about twice the cost of what we had a year ago. In addition, it adds some non-determinism in case there actually are false positives for the BPSW test. The implementation is straightforward. It could easily be tweaked to use the additional gcds in the "enhanced" MR test of FIPS 186-5, but as long as we are only going to throw away the additional info, that's not worth much. This is a first step towards incorporating some of the considerations in "A performant misuse-resistant API for Primality Testing" by Massimo and Paterson. Further work will happen in tree. In particular, there are plans to crank the number of Miller-Rabin tests considerably so as to have a guaranteed baseline. The manual will be updated shortly. positive feedback beck ok jsing
* As mmap(2) is no longer a LOCK syscall, do away with the extraotto2023-05-101-23/+1
| | | | | unlock-lock dance it serves no real purpose any more. Confirmed by a small performance increase in tests. ok @tb
* Make malloc tests that set flags more robust against the user alsootto2023-05-092-15/+19
| | | | having flags set.
* Make failure mode of EVP_AEAD_CTX_new() more explicittb2023-05-091-4/+9
| | | | Pointed out and ok by dlg
* Add regress coverage for -1 modulus as well.tb2023-05-091-25/+38
|
* bn_exp: also special case -1 modulustb2023-05-091-6/+6
| | | | | | | | | | Anything taken to the power of 0 is 1, and then reduced mod 1 or mod -1 it will be 0. If "anything" includes 0 or not is a matter of convention, but it should not depend on the sign of the modulus... Reported by Guido Vranken ok jsing (who had the same diff)
* Rewrite BN_bn2hex() using CBB/CBS.jsing2023-05-091-25/+35
| | | | ok tb@
* Rewrite BN_bn2dec() using CBB/CBS.jsing2023-05-091-63/+61
| | | | ok tb@
* Rename the other_ctx in X509_STORE_CTX into trustedtb2023-05-082-12/+12
| | | | | | | | | | | | | | | | The other_ctx is a strong contender for the worst name of a struct member in OpenSSL. It's a void * member whose only purpose ever was to be set to a STACK_OF(X509) * via X509_STORE_CTX_trusted_stack() (yes, this is obviously a setter, why do you ask?) and then to be used by the get_issuer() callback (which of course isn't there to find any old issuer, but only to look for issuers among the 'trusted' certs). Anyway, we may want to rename untrusted into intermediates and trusted into roots later on, but for now let's match the lovely public API. While there rename get_issuer_sk() into get_trusted_issuer() which is a more accurate and slightly less silly name. ok jsing
* Add RCS tagtb2023-05-081-0/+1
|
* Enable malloc_errs testotto2023-05-081-2/+2
|
* Add a regress test to test various malloc API and heap mismanagementotto2023-05-082-0/+291
| | | | | errors which should cause abort. A few are not enabled yet, they will be once the corresponding diffs in malloc are committed.
* X509_verify_cert(): Garbage collect the unused roots variabletb2023-05-081-4/+1
| | | | | | | | | roots was used to store the trusted stack or pull the roots out of the X509_STORE before beck unmooned Ethel in x509_vfy.c r1.88. Since then this variable is effectively unused. It seems the STACK_OF(3) madness is too complicated for -Wunused-but-set-variable to notice. ok miod
* Avoid trailing whitespace in extension printingtb2023-05-081-2/+2
| | | | | | | If an extension is non-critical, X509V3_extensions_print() would leave trailing whitespace. This can be trivially avoided. ok miod
* Recommit -Wshadow now that the warning on BIG_ENDIAN is fixedtb2023-05-071-2/+2
|
* xts128 mode: avoid two -Wshadow warnings in the BIG_ENDIAN code path.tb2023-05-071-5/+5
| | | | Found by, compile tested & ok bluhm.
* Backout -Wshadow, it breaks build on powerpc64.bluhm2023-05-071-2/+2
|
* Remove a misplaced empty linetb2023-05-071-2/+1
|
* Regen cert.pemtb2023-05-061-419/+402
| | | | | | | | | This drops a few certs per the CA's request and TrustCor because of drama. Certainly, a new CA, is added as well as new certs for DigiCert, SECOM and E-Tugra. Unizeto still haven't fixed one of their certs and we still don't want the alternative Firmaprofesional with sha1WithRSAEncryption. ok sthen
* Use -Wshadow with clangtb2023-05-053-6/+6
| | | | ok jsing (a very long time ago)
* Reinstate X9.31 padding mode support in rsautltb2023-05-052-7/+18
|
* Fix error handling in tls_check_common_name()tb2023-05-051-6/+10
| | | | | | | | A calloc failure should be a fatal error, so make it return -1. Also switch the default rv to -1 and distinguish error cases with acceptable situations with goto err/goto done. ok jsing
* Salt shares the blame of the continued existence of the X9.31 padding modetb2023-05-051-2/+2
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-01 11:49:08 +0000