| Commit message (Collapse) | Author | Files | Lines |
|---|
|
OK tb@
|
|
jsing@ worries that cycle prevention might increase risk because
software that is not checking return values (and indeed, not checking
is likely common in practice) might silently behave incorrectly
with cycle prevention whereas without, it will likely either crash
right away through infinite recursion or at least hang in an infinite
loop when trying to use the cyclic chain, in both cases making it
likely that the bug will be found and fixed.
Besides, tb@ points out that BIO_set_next(3) ought to behave as
similarly as possible to BIO_push(3), but adding cycle prevention
to BIO_set_next(3) would be even less convincing because that
function does not provide a return value, encouraging users to
expect that it will always succeed. While a safe idiom for checking
the success of BIO_set_next(3) could easily be designed, let's be
realistic: application software would be highly unlikely to pick up
such an idiom.
|
|
ED25519_keypair(3), ED25519_sign(3), and ED25519_verify(3).
Document them.
|
|
unsigned char.
Casting to int is particularly useless because that's what the
compiler already does. We need to prevent sign extension, not write
down that we want sign extension.
OK deraadt, kn, miod, op
|
|
EVP_PKEY_new_raw_private_key(3), EVP_PKEY_new_raw_public_key(3),
EVP_PKEY_get_raw_private_key(3), and EVP_PKEY_get_raw_public_key(3).
Merge the documentation from the OpenSSL 1.1.1 branch, which is
still under a free license. I tweaked the text somewhat for
conciseness, and argument names for uniformity.
|
|
Document it.
|
|
|
|
|
|
|
|
|
|
Rework the loops walking the chains to be correct for empty chains as well.
This simplifies the checking at the cost of slightly more initialization
and will allow further refactoring in a subsequent check.
|
|
|
|
|
|
|
|
|
|
Align initialization in walk_backward() with walk_forward(), fix grammar
in a comment and move initialization of oldhead_len in a place consistent
with the other length initializations in that function
|
|
|
|
|
|
|
|
Add helpers to create and destroy a linear chain of BIOs. Provide two
defines for the two lengths of the test chains and make them distinct
to rule out coincidences. As a bonus, the code becomes simpler.
|
|
Add helper that validate the chains. This deduplicates a lot of code and
makes the heart of the test much easier to read.
|
|
|
|
Some parts of this test rely on unportable behavior, so cannot run in
portable. This way we can run more tests for portable which is helpful
for analysis tools, better coverage, etc.
|
|
|
|
|
|
This tests for the behavior changes in bio_lib.c r1.40 and r1.41 and
makes sure that BIO_push() and BIO_set_next() act on two chains in the
expected and now documented way.
|
|
|
|
and reports failure if a call would result in a cycle.
The algorithm used was originally suggested by jsing@.
Feedback and OK tb@.
|
|
The reader may not know what digest BIOs, Base64 BIOs and file BIOs are
and the relevant function names are non-obvious, hence it's not entirely
trivial to find the manuals where they are explained. With these references
a reader should be able to turn the example into actual code.
ok schwarze
|
|
If you want to Base64-encode "Hello World\n" using a BIO, you had better
pass "Hello World\n" into it, not something slightly different... While
we're touching this, we might as well write it the way K&R did...
|
|
|
|
Feedback and OK tb@.
|
|
In bn_test.c include bn_local.h instead of using copy-pasted prototypes.
|
|
and next_bio fields of all BIO objects in all affected chains, no
matter what the arguments are.
In particular, if the second argument (the one to be appended) is
not at the beginning of its chain, properly detach the beginning
of its chain before appending.
We have weak indications that this bug might affect real-world code.
For example, in FreeRDP, file libfreerdp/crypto/tls.c, function
bio_rdp_tls_ctrl(), case BIO_C_SET_SSL, BIO_push(3) is definitely
called with a second argument that is *not* at the beginning of its
chain. Admittedly, that code is hard to fathom, but it does appear
to result in a bogus prev_bio pointer without this patch.
The practical impact of this bug in this and other software remains
unknown; the consequences might possibly escalate up to use-after-free
issues if BIO_pop(3) is afterwards called on corrupted BIO objects.
OK tb@
|
|
invariants of the prev_bio and next_bio fields of all BIO objects
in all involved chains, no matter which arguments this function is
called with.
Both real-world uses of this function (in libssl and freerdp) have
been audited to make sure this makes nothing worse. We believe libssl
behaves correctly before and after the patch (mostly because the second
argument is NULL there), and we believe the code in freerdp behaves
incorrectly before and after the patch, leaving a prev_bio pointer in
place that is becoming bogus, only in a different object before and
after the patch. But after the patch, that bogus pointer is due to a
separate bug in BIO_push(3), which we are planning to fix afterwards.
Joint work with and OK tb@.
|
|
|
|
For the test compilation using the CC crate, base clang is good enough,
so we don't need to pull in another heavy dependency just for this test.
|
|
|
|
getopt(3) returns '?' when it encounters a flag not present in the in
the optstring or if a flag is missing its option argument. We can
handle this case with the "default" failure case with no loss of
legibility. Hence, remove all the redundant "case '?':" lines.
Prompted by dlg@. With help from dlg@ and millert@.
Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2
ok naddy@ millert@ dlg@
|
|
|
|
The issue is likely that the build is trying to compile some generated
C code with the prehistoric gcc from base, so add a tentative workaround
for that. Since I don't currently have access to a sparc64 box where I
could validate this easily and check if the workaround is enough, let's
not waste lots of cycles on this.
|
|
|
|
Should have been part of the previous commit
|
|
|
|
Drop unnecessary loading of error strings, fix error path and consistently
print to stdout.
|
|
The amount of copy-paste in this test led to a few bugs and it was hard to
spot them since things were done in random order. Use a different approach:
compute the result of a^b (mod m) according to BN_mod_exp_simple(), then
compare the results of all the other *_mod_exp* functions to that.
Reuse the test structure from bn_mod_exp_zero.c to loop over the list of
functions. This way we test more functions and don't forget to check some
crucial bits.
|
|
Someone added a few more functions to test, but forgot to check their
results, so if they would not do the expected thing that would only be
noticed if one of the already tested functions would break.
|
|
For nearly 25 years this test has attempted to generate random numbers of
bit length between 192 and 319 bits. Unfortunately, it used an unsigned
char so instead of generating numbers in the interval [-64..63] and add
them to 256, it used numbers in the intervals [0..63] and [192..255]...
|
|
BIO_push() and BIO_pop() are misnamed. No need to gently and politely
suggest that their 'names [...] are perhaps a little misleading'.
|
|
As schwarze points out, you can pop any BIO in a chain, not just the first
one (bonus points for a great name for this API).
The internal doubly linked was used to fix up the BIO chain bio was part
of when you BIO_pop() a bio that wasn't in the first position, which is
explicitly allowed in our documentation and implied by OpenSSL's.
|
