summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* bn_test: keep the error stack cleantb2023-04-071-1/+13
| | | | | | Make message() print and clear the error stack. This way we can know what test errored. To make this work also clear the error stack after a handful of xfail tests.
* bn_test: use bn_copy() instead of BN_free/BN_duptb2023-04-071-3/+2
| | | | This is not only simpler but also required by an upcoming change.
* bn_test: a few early return would leak. goto err insteadtb2023-04-071-5/+5
|
* bn_test: rand_neg() is not only one of the most stupidly named functionstb2023-04-071-2/+2
| | | | in the entire code base it also has a few parentheses too many
* bn_test: handle rc consistentlytb2023-04-071-111/+134
| | | | | | | Various test functions had bugs due to the fact that the return code would be set to 1 at the top so that each error would have to set rc = 0. This is silly. Fail closed instead by setting rc = 0 at the top and only flipping to 1 before the err label
* bn_test: inline the only use of lst[]tb2023-04-071-14/+12
| | | | | | lst[] can be converted from a bit string to a hex string. Use BN_hex2bn() isntead of BN_bin2bn(). Handle this inside test_lshift() rather than doing artistic ownership dances.
* Improve some test failure reportingtb2023-04-071-5/+12
|
* Ignore ten getter and setter control macros related to proxy BIOs.schwarze2023-04-071-0/+6
| | | | | | | Those are not useful because such a BIO type neither exists in LibreSSL nor in OpenSSL 1.1.1. Not adding the deprecation notice to some manual page because there is no manual page that is even vaguely related.
* Two minor tweaks that are useful for processing bio.h, among other headers:schwarze2023-04-071-1/+2
| | | | | * ignore lines defining "__bounded__()" * ignore whitespace between "#" and "include"
* Mark BIO_CB_return(), BIO_cb_pre(), and BIO_cb_post() as intentionallyschwarze2023-04-071-2/+7
| | | | | undocumented because they are unused according to codesearch.debian.net and would cause nothing but obfuscation if they were used.
* Document the effects that BIO_set_info_callback(3), BIO_callback_ctrl(3),schwarze2023-04-061-3/+54
| | | | BIO_get_info_callback(3), and BIO_info_cb(3) have on connect BIOs.
* Properly document BIO_set_info_callback(3) and BIO_get_info_callback(3)schwarze2023-04-061-8/+96
| | | | | | | | which where mentioned below SYNOPSIS and HISTORY but not described. Also document the command constant BIO_CTRL_SET_CALLBACK and the deprecated function type name bio_info_cb(3). Mention that callbacks installed using BIO_set_callback_ex(3) and BIO_set_callback(3) can tamper with *all* the return values.
* Use RCS tag instead of an incorrect path.tb2023-04-061-1/+1
|
* Move a comment to the proper placetb2023-04-061-6/+5
|
* wycheproof: fix copy-paste error in previoustb2023-04-061-2/+2
|
* wycheproof: use EVP_MD instead of importing "hash"tb2023-04-061-70/+52
|
* Check and assign on one linetb2023-04-061-3/+2
|
* Zap extra empty linetb2023-04-061-2/+1
|
* Add a few missing bracestb2023-04-051-4/+7
| | | | ok jsing
* Set up the RSA's _method_mod_n before the initial blindingtb2023-04-051-11/+13
| | | | | | | | | | | | | | | | As observed by Bernd Edlinger, the main part of the RSA timing leak that was recently made public is that the initial blinding isn't done with Montgomery exponentiation but rather with plain exponentiation. Pull up the initialization of the cached Montgomery context to ensure we use Montgomery exponentiation. Do this for private_{de,en}crypt(). Interestingly, the latter was fixed in OpenSSL a while ago by Andy Polyakov as part of the "smooth CRT-RSA" addition. If this code was anything but completely insane this would never have been an issue in the first place. But it's libcrypto... ok jsing
* Sprinkle a few BTI instructions into the arm64 assembly files and passkettenis2023-04-052-1/+8
| | | | | | -mmark-bti-property to indicate those now have BTI support. ok jsing@, deraadt@
* bn_mod_sqrt: Improve a handful of comments and a printftb2023-04-051-5/+9
|
* Improve regress coverage for BN_mod_sqrt()tb2023-04-051-3/+2783
| | | | | This now covers all the main branches of both the old and new BN_mod_sqrt() implementation except for negative p.
* Simplify mod_sqrt_test() a bittb2023-04-051-35/+16
|
* bn_mod_sqrt test: Use a #define rather than hard coded 100tb2023-04-051-3/+5
|
* Add coverage for the truly non-deterministic path of Tonelli-Shankstb2023-04-051-4/+1625
| | | | | Regress coverage of all of BN_mod_sqrt() is still lacking after this. This will improve in forthcoming commits.
* Introduce variation in location of junked bytes; ok tb@otto2023-04-051-3/+8
|
* A refactoring back in 2016 in which magic numbers where extracted intoanton2023-04-041-0/+1
| | | | | | | named constants accidentally dropped an instruction causing detection of eXtended operations (XOP) on AMD hardware to break. ok miod@ tb@
* In preparation for better documenting BIO info callbacks, improve theschwarze2023-04-041-9/+115
| | | | | | | | | description of BIO_ctrl(3) and its three siblings. Given the vast range of effects these functions can have, the text is unavoidably still vague, but at least some information can be provided. While here, fix one wrong parameter type and three inconsistent parameter names in the SYNOPSIS.
* Clean bn_mod_sqrt up a littletb2023-04-041-28/+53
| | | | | This makes it look a bit more like other tests and also prepares the addition of further test cases and different tests.
* Compress euclid() a littletb2023-04-031-49/+28
| | | | | | | | | | This function is spread out over way too many lines and has too much repetition. Once this is made a little more compact, it becomes clearer that this is a somewhat obfuscated version of binary gcd (it is not constant time therefore cryptographically unsound. It is not used internally). This will likely go away later. ok jsing
* Link bn_gcd test to regresstb2023-04-031-1/+3
|
* Add regress coverage for BN_gcd() and BN_gcd_ct()tb2023-04-031-0/+3664
|
* Fix table by using strings of proper lengths instead of bogustb2023-04-021-3/+3
| | | | | | scaling widths. ok schwarze
* Revert r1.9 and reinstate r1.6tb2023-04-021-2/+2
| | | | | | The argument change to x5519_ge_scalarmult_base() was made to match the prototype in the header. More recent compilers warn about such ptr vs array mismatches.
* Check all chunks in the delayed free list for write-after-free.otto2023-04-012-8/+25
| | | | Should catch more of them and closer (in time) to the WAF. ok tb@
* Pull static const data out of BN_value_one()tb2023-04-011-7/+11
| | | | | | Also use C99 initializers for readability. discussed with jsing
* Indent labelstb2023-04-011-6/+6
|
* Group the non-constant time gcd functions togethertb2023-04-011-45/+45
| | | | | | | | The only consumer of euclid() is BN_gcd(), which, in turn is only used by BN_gcd_nonct(). Group them together rather than having parts of the constant time implementation separate them. This moves two functions to a different place in the file.
* Add regress coverage for the new behavior of BN_copy() with respect totb2023-03-311-1/+161
| | | | flags.
* Copy BN_FLG flags in BN_copy()tb2023-03-311-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BN_copy() forgot to copy the flags from the source to the target. Fix this by copying the flags. In fact, only copy BN_FLG_CONSTTIME since propagating BN_FLG_MALLOCED and BN_FLG_STATIC_DATA is wrong. Ignore the BN_FLG_FREE flag "used for debugging" which of course means "unused" like a lot of other debug code that somehow ended up in public headers. Also: make BN_FLG_CONSTTIME sticky on the target, i.e., don't clear the flag when copying from a non-constant time BIGNUM to a constant time one for the following reason: if a is constant time, BN_sqr(a, a, ctx) would use a BIGNUM without the flag internally, then copy the result to a in which process a would lose its constant time flag. Fixing this would be a lot of pointless work since someone had the good sense of not relying on a fragile flag for something this important. Rather, libcrypto always uses the constant time paths instead of the faster, cryptographically inadequate paths. Before this was changed, this was a pretty bad bug. The RSA code uses the horrible BN_with_flags() function to create local versions of the private moduli and set BN_FLG_CONSTTIME on them. If the RSA_FLAG_CACHE_PRIVATE for caching moduli is set on the RSA, which it is by default, it attempts to set these constant time versions on the RSA's internal Montgomery contexts. Since it is called BN_MONT_CTX_set(), the setter doesn't set a BIGNUM on the BN_MONT_CTX, rather it copies it over, losing the BN_FLG_CONSTTIME flag in the process and make all the horrible leaky RSA code leak some more. Good job. This is all harmless and is mostly a cosmetic fix. BN_FLG_CONSTTIME should be removed internally. It will be kept since various language bindings of course picked it up and expose it. ok beck jsing
* Inline only use of TS_VERIFY_CTX_init()tb2023-03-311-2/+2
| | | | | | | | Since TS_VERIFY_CTX is now opaque, the only thing TS_VERIFY_CTX_init() is good for outside the library is memory leaks. Inside the library it's also useless, since as a much more familiar name is memset(). It will soon be able to join all the other nonsense that should never have leaked out of this library.
* Add a regress for the recent BIO_new_NDEF() write after freetb2023-03-311-2/+59
| | | | | | This is a simple reproducer for a write after free that avoids all the mess with CMS, PKCS7 and SMIME. This now mostly allows ASAN to check that the memory handling in this marvellous function is correct.
* i2d_ECDSA_SIG() may return a negative value in case of error. Handlebluhm2023-03-301-5/+14
| | | | | this in ossl_ecdsa_sign() and propagate the return code. OK jsing@ tb@
* Call bn_copy() unconditionally in BN_mul() and BN_sqr()tb2023-03-302-11/+6
| | | | | | | bn_copy() does the right thing if source and target are the same, so there is no need for an additional check. Requested by jsing
* bio_ndef: add an empty line before returntb2023-03-301-1/+2
|
* Rework BN_exp() a bittb2023-03-301-27/+28
| | | | | | | | | This mostly only cleans up the mess that it was - which doesn't stand out because of the horror that lurks in the rest of this file. It avoids copying the partial calculation out on error and does away with some other weirdness. with/ok jsing
* Rework test failure printingtb2023-03-291-25/+33
| | | | | Make sure it's always printed to stderr. Use a wrapper for printing a BIGNUM rather than repeating the same ugly pattern over and over again.
* Dedup print functions on test failuretb2023-03-291-29/+14
|
* Fix printfs that escaped defensive greppingtb2023-03-291-5/+5
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-31 23:58:18 +0000