summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* double word fix; from martin vahlensieckjmc2021-01-052-6/+6
|
* whitespacetb2021-01-043-10/+10
|
* Keep the various free calls of tls13_record_layer_free() in thetb2021-01-041-4/+4
| | | | | | order of the struct members for reviewability. ok jsing
* Tweak previous:schwarze2021-01-021-19/+34
| | | | | | | * Do not abuse .Bl -tag for lists without bodies, use .Bl -item instead. * In tagged lists, put bodies into bodies, not into heads. * Add a few missing macros. * Drop some useless quoting.
* Make list of DHE parameters more prominentkn2021-01-021-6/+19
| | | | | | | Follow the previous commit and complete the manual page for consistency; better readable and tags for free. OK tb
* Free {alert,phh}_data in tls13_record_layer_free()tb2021-01-021-1/+4
| | | | | | | | | | | | | | httpd(8)'s incorrect tls_close() after closing the underlying socket led to a leak: tls_close()'s attempt to send out the close_notify won't work very well over a closed pipe. This resulted in alert_data still hanging off the TLSv1.3 context's record layer struct. The tls_free() call should have cleaned this up but failed to do so. The record layer's phh_data potentially has the same issue, so free it as well. This diff makes -current httpd(8) run in constant memory over hundreds of thousands TLS connections with a static site. ok inoguchi jsing
* Remove unused categories in re_guts; they are written to but never read.millert2020-12-311-39/+2
| | | | From miod@, OK tb@
* Make the list of supported protocols more prominentkn2020-12-301-5/+15
| | | | | | | | | | Manuals like httpd.conf(5) refer to this for valid protocol strings, but elements inlined into sentences are hard find to spot. Use a list as already done elsewhere in this manual. OK jmc on earlier version Feeback OK tb
* Document meaning of '*' in genrsa outputtb2020-12-301-3/+6
| | | | ok inoguchi jmc kn
* Fix an off-by-one error in the marking of the O_CH operator followingmillert2020-12-281-1/+4
| | | | | an OOR2 operator. Also includes a regress test for the issue. From FreeBSD via miod@
* Start each regress run from scratch with new keys and CA database.bluhm2020-12-261-12/+17
|
* Convert CA regress implementation from shell script to make file.bluhm2020-12-265-141/+100
| | | | Ensure that it works with obj directory and link regress to build.
* Add to *FLAGS and *ADD rather than overwriting themtb2020-12-251-6/+6
| | | | | This makes CFLAGS pick up -O2, which shaves a few seconds runtime off these very slow tests.
* Destroy the mutex in tls_config objects when tls_config_free is called.bcook2020-12-221-1/+3
| | | | | | Add a stub for pthread_mutex_destroy() for installers. ok tb@
* Revert call to pthread_mutex_destroy until installers have a stub.bcook2020-12-221-3/+1
| | | | noted by deraadt@
* Destroy the mutex in a tls_config object when tls_config_free is called.bcook2020-12-211-1/+3
| | | | ok inoguchi@
* Remove echo headlines.bluhm2020-12-1715-46/+15
|
* Remove a redundant memset call.tb2020-12-161-2/+2
|
* Remove two reduntat memset calls.tb2020-12-162-5/+2
| | | | pointed out by jsing
* Avoid potential use of uninitialized in ASN1_time_parsetb2020-12-161-4/+3
| | | | | | | | | | | When parsing an UTCTime into a struct tm that wasn't cleared by the caller, the years would be added to the already present value, which could give an incorrect result. This is an issue in ASN1_UTCTIME_cmp_time_t(), which is practically unused. Fix this by always zeroing the passed struct tm. Issue reported by Olivier Taïbi, thanks! ok jsing
* Fix some KNF issuestb2020-12-161-7/+8
|
* Use natural sizes for S3I(s)->tmp's *_md arraystb2020-12-151-6/+4
| | | | | | | | | | | | | | | | | | | | It is a historical artifact that cert_verify_md[], finish_md[] and peer_finish_md[] are twice as large as they need to be. This is confusing, especially for finish_md[] and peer_finish_md[] which are copied to to previous_client_finished[] and previous_server_finished[] which are only half as large. It is easy to check that they will never get more than EVP_MAX_MD_SIZE data written to them. In 1998, EVP_MAX_MD_SIZE was 20 bytes long (for SHA-1). This got bumped to 16+20 for the SSLv3-specific md5+sha1. Apparently under the impression that EVP_MAX_MD_SIZE was still 20 bytes, someone else doubled finish_md[]'s size to EVP_MAX_MD_SIZE*2 and added /* actually only needs to be 16+20 */. A bit later finish_md[] was split up, and still a bit later the comment was amended for TLSv1. Shortly thereafter SHA-512 required a bump of EVP_MAX_MD_SIZE to 64 by a third person and we have been carrying 192 bytes of untouched memory in each of our SSLs ever since. ok inoguchi jsing (jsing had the same diff)
* Fix return value variable type in tls_keypair_load_certinoguchi2020-12-151-2/+2
| | | | | | | ERR_peek_error() returns unsigned long. Reported by github issue by @rozhuk-im. ok bcook@ jsing@
* Fix SSL_get{,_peer}_finished() with TLSv1.3tb2020-12-142-2/+28
| | | | | | | | | | As reported by Steffen Ullrich and bluhm, the Finished tests in p5-Net-SSLeay's t/local/43_misc_functions.t broke with with TLSv1.3. The reason for this is that we don't copy the MDs over to the SSL, so the API functions can't retrieve them. This commit fixes this part of the test (one unrelated test still fails). ok inoguchi jsing
* Switch finish{,_peer}_md_len from int to size_ttb2020-12-141-3/+3
| | | | | | | This is the natural type for these and it simplifies an upcoming commit. The few consumers have been carefully checked to be fine with this. ok inoguchi jsing
* LibreSSL 3.3.1libressl-v3.3.1bcook2020-12-081-3/+3
|
* Fix a NULL dereference in GENERAL_NAME_cmp()tb2020-12-086-11/+94
| | | | | | | | | | | | Comparing two GENERAL_NAME structures containing an EDIPARTYNAME can lead to a crash. This enables a denial of service attack for an attacker who can control both sides of the comparison. Issue reported to OpenSSL on Nov 9 by David Benjamin. OpenSSL shared the information with us on Dec 1st. Fix from Matt Caswell (OpenSSL) with a few small tweaks. ok jsing
* Enable t_mmap-1 test. It is skipped on NetBSD, but works for us.bluhm2020-12-062-3/+10
|
* Mark bitmask_{start,end}_values[] and g_probable_mtu[] const.tb2020-12-051-4/+4
| | | | ok jsing kn
* Mark nid_list[] const. This moves 116 bytes to .rodata.tb2020-12-051-2/+2
| | | | ok jsing kn
* Move point-on-curve check to set_affine_coordinatestb2020-12-044-18/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bad API design makes it possible to set an EC_KEY public key to a point not on the curve. As a consequence, it was possible to have bogus ECDSA signatures validated. In practice, all software uses either EC_POINT_oct2point*() to unmarshal public keys or issues a call to EC_KEY_check_key() after setting it. This way, a point on curve check is performed and the problem is mitigated. In OpenSSL commit 1e2012b7ff4a5f12273446b281775faa5c8a1858, Emilia Kasper moved the point-on-curve check from EC_POINT_oct2point to EC_POINT_set_affine_coordinates_*, which results in more checking. In addition to this commit, we also check in the currently unused codepath of a user set callback for setting compressed coordinates, just in case this will be used at some point in the future. The documentation of EC_KEY_check_key() is very vague on what it checks and when checks are needed. It could certainly be improved a lot. It's also strange that EC_KEY_set_key() performs no checks, while EC_KEY_set_public_key_affine_coordinates() implicitly calls EC_KEY_check_key(). It's a mess. Issue found and reported by Guido Vranken who also tested an earlier version of this fix. ok jsing
* grammar fixes from Varik "The Genuine Article!!!" Valefor;jmc2020-12-033-9/+9
|
* Extend the methods test to cover dtls methods as welltb2020-12-011-1/+57
|
* Enable ssl_methods unit test.tb2020-12-011-1/+2
|
* Add an ssl_methods() unit test that currently only covers thetb2020-12-011-0/+192
| | | | | behavior of SSL_is_server(). This would have caught the regression introduced in the method unification.
* Bring back *_client_method() structstb2020-12-013-11/+200
| | | | | | | | | | | | | | | | | | | | | | | | | | The method unification broke an API promise of SSL_is_server(). According to the documentation, calling SSL_is_server() on SSL objects constructed from generic and server methods would result in 1 even before any call to SSL_set_accept_state(). This means the information needs to be available when SSL_new() is called, so must come from the method itself. Prior to the method unification, s->server would be set to 0 or 1 in SSL_new() depending on whether the accept method was undefined or not. Instead, introduce a flag to the internal structs to distinguish client methods from server and generic methods and copy that flag to s->server in SSL_new(). This problem was reported to otto due to breakage of DoH in net/dnsdist. The reason for this is that www/h2o relies on SSL_is_server() to decide whether to call SSL_accept() or SSL_connect(). Thus, the h2o server would end up responding to a ClientHello with another ClientHello, which results in a handshake failure. The bandaid applied to www/h2o can be removed once this fix has made it into snaps. No other breakage is known. This commit brings back only about half of the duplication removed in the method unification, so is preferable to a full revert. ok jsing
* Avoid undefined behavior due to memcpy(NULL, NULL, 0)tb2020-11-251-4/+6
| | | | | | | | | This happens if name->der_len == 0. Since we already have a length check, we can malloc and memcpy inside the conditional. This also makes the code easier to read. agreement from millert ok jsing
* mapalign() only handles allocations >= a page; problem found by and ok semarie@otto2020-11-231-1/+3
|
* fix another misleading line break and indentlibressl-v3.3.0tb2020-11-201-3/+4
|
* fix confusing line break and indenttb2020-11-201-3/+4
|
* $OpenBSD$tb2020-11-191-0/+1
|
* Plug leak in x509_verify_chain_dup()tb2020-11-181-2/+2
| | | | | | | | | | | | | | | x509_verify_chain_new() allocates a few members of a certificate chain: an empty stack of certificates, a list of errors encountered while validating the chain, and a list of name constraints. The function to copy a chain would allocate a new chain using x509_verify_chain_new() and then clobber its members by copies of the old chain. Fix this by replacing x509_verify_chain_new() with calloc(). Found by review while investigating the report by Hanno Zysik who found the same leak using valgrind. This is a cleaner version of my initial fix from jsing. ok jsing
* Plug a big memory leak in the new validatortb2020-11-181-1/+6
| | | | | | | | | | | | | | | | | | The legacy validator would only call x509_vfy_check_policy() once at the very end after cobbling together a chain. Therefore it didn't matter that X509_policy_check() always allocates a new tree on top of the one that might have been passed in. This is in stark contrast to other, similar APIs in this code base. The new validator calls this function several times over while building its chains. This adds up to a sizable leak in the new validator. Reported with a reproducer by Hanno Zysik on github, who also bisected this to the commit enabling the new validator. Narrowed down to x509_vfy_check_policy() by jsing. We simultaenously came up with a functionally identical fix. ok jsing
* zap ugly empty line before closing bracetb2020-11-181-2/+1
|
* Move freeing of the verify context to its natural place instead oftb2020-11-181-2/+2
| | | | | | a few lines after. stylistic nit from jsing
* KNF (whitespace)tb2020-11-184-13/+13
|
* bump to 3.3.0bcook2020-11-181-3/+3
|
* Don't leak verify and store contexts.tb2020-11-181-1/+3
|
* typo & punctuation in commenttb2020-11-171-3/+3
|
* Implement exporter for TLSv1.3.jsing2020-11-164-8/+121
| | | | | | | | | This implements the key material exporter for TLSv1.3, as defined in RFC8446 section 7.5. Issue reported by nmathewson on github. ok inoguchi@ tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-26 03:45:44 +0000