summaryrefslogtreecommitdiff
path: root/src/lib/libc/stdlib/reallocarray.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-05-02Prevent future internal use of some #definestb1-1/+3
After jsing's recent commits, SSL3_CC_{READ,WRITE,CLIENT,SERVER} and the derived SSL3_CHANGE_CIPHER_{CLIENT,SERVER}_{READ,WRITE} are no longer used by LibreSSL and should never be used again. discussed with jsing
2021-05-02Clean up tls1_change_cipher_state().jsing5-42/+29
Replace flag gymnastics at call sites with separate read and write, functions which call the common code. Condition on s->server instead of using SSL_ST_ACCEPT, for consistency and more readable code. ok inoguchi@ tb@
2021-05-02In the TLSv1.2 server, set up the key block after sending the CCS.jsing1-7/+7
This avoids calling into the key block setup code multiple times and makes the server code consistent with the client. ok inoguchi@ tb@
2021-05-02Clean up dtls1_reset_seq_numbers().jsing5-26/+22
Rather than doing flag gymnastics, split dtls1_reset_seq_numbers() into separate read and write functions. Move the calls of these functions into tls1_change_cipher_state() so they directly follow the change of cipher state in the record layer, which avoids having to duplicate the calls in the client and server. ok inoguchi@ tb@
2021-05-02Ensure that handshake hash is non-NULL in tls1_transcript_hash_value().jsing1-1/+4
There are several paths where a subtle bug could result in tls1_transcript_hash_value() being called with a NULL handshake hash - add an explicit check for this case. As noted by tb@, due to the wonders of the libcrypto EVP APIs, combined with integer promotion, we already have a NULL check - this one is just more obvious. ok tb@
2021-05-02Harden tls12_finished_verify_data() by checking master key length.jsing1-1/+4
Require master key length to be greater than zero if we're asked to derive verify data for a finished or peer finished message. ok tb@
2021-05-02Stop deriving peer finished twice for TLSv1.2.jsing1-12/+1
We already derive the peer finished in ssl3_do_change_cipher_spec(), which DTLS relies on. In the case of TLS we've been doing it twice - once in ssl3_get_message() and once in ssl3_do_change_cipher_spec(). ok tb@
2021-05-02Make TS_compute_imprint a bit more robust.tb1-20/+28
Instead of using the output parameters directly, null them out at the beginning and work with local variables which are only assigned to the output parameters on success. This way we avoid leaking stale pointers back to the caller. requested/ok jsing
2021-05-01Retire OpenBSD/sgi.visa1-5/+1
OK deraadt@
2021-05-01bump to LibreSSL 3.4.0 in -currentbcook1-3/+3
2021-05-01Plug leak in c2i_ASN1_OBJECTtb1-3/+8
When using the object reuse facility of c2i_ASN1_OBJECT, the dynamically allocated strings a may contain are set to NULL, so we must free them beforehand. Also clear the flag, because that's what OpenSSL chose to do. From Richard Levitte OpenSSL 1.1.1 65b88a75921533ada8b465bc8d5c0817ad927947 ok inoguchi
2021-05-01Prevent double free in int_TS_RESP_verify_tokentb1-1/+2
If TS_compute_imprint fails after md_alg was allocated, there will be a double free in its caller. Obvious fix is to null out the output parameter md_alg just like it's already done for imprint and imprint_len. From Pauli Dale, OpenSSL 1.1.1, a3dea76f742896b7d75a0c0529c0af1e628bd853 ok inoguchi jsing
2021-04-30Clean up and harden TLSv1.2 master key derivation.jsing5-54/+51
The master key and its length are only stored in one location, so it makes no sense to handle these outside of the derivation function (the current 'out' argument is unused). This simplifies the various call sites. If derivation fails for some reason, fail hard rather than continuing on and hoping that something deals with this correctly later. ok inoguchi@ tb@
2021-04-28Revert "Handle X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE in newtb1-4/+1
verifier." (r1.27). While this may have "fixed" one corner case, it broke expectations of Perl Net::SSLeay and Ruby OpenSSL regression tests. ok bcook
2021-04-27Add DTLS test in appstest.shinoguchi1-1/+70
2021-04-27test-verify-unusual-wildcard-cert is no longer expected to fail withtb1-2/+1
lib/libcrypto/x509/x509_constraints.c r1.16
2021-04-27Relax SAN DNSname validation and constraints to permit non leading *beck2-27/+25
wildcards. While we may choose not to support them the standards appear to permit them optionally so we can't declare a certificate containing them invalid. Noticed by jeremy@, and Steffan Ulrich and others. Modify the regression tests to test these cases and not check the SAN DNSnames as "hostnames" anymore (which don't support wildcards). ok jsing@, tb@
2021-04-25Clean up derivation of finished/peer finished.jsing8-116/+147
Make this process more readable by having specific client/server functions, calling the correct one based on s->server. This allows to remove various SSL_ST_ACCEPT/SSL_ST_CONNECT checks, along with duplicate code. ok inoguchi@ tb@
2021-04-24Do not leave errors on the error stack on PKCS12_parse() success.tb1-1/+3
Fix is the same as OpenSSL commit ffbf304d4832bd51bb0618f8ca5b7c26647ee664 Found by Alex Gaynor with a new pyca cryptography regress test. ok inoguchi
2021-04-24Enable the new verifier again so hopefully the remaining kinks get ironedtb1-2/+2
out in this release cycles. discussed with deraadt and jsing
2021-04-24Remove "-4" option treatment and use it always on s_server test in appstest.shinoguchi1-9/+2
2021-04-23Enable test-renegotiation-changed-clienthello.py but skiptb1-1/+7
"drop extended_master_secret in renegotiation" since we don't support this extension.
2021-04-23whitespacetb1-3/+3
2021-04-22Only hash known CH extensionstb1-5/+5
RFC 4.1.2 specifies the ways in which the extensions in the first and the second ClientHello may differ. It basically says that extensions not known to a server must not change. This in turn makes it impossible to introduce new extensions that do change. It makes little sense to enforce that extensions we don't know and care about aren't modified, so make the hashing more lenient and restrict it to the extensions we do care about. Arguably, enforcing no change in an unknown extension is incompatible with the requirement that it be ignored. ok bcook jsing
2021-04-21Add a test that roundtrips a bunch of points on all builtin curvestb2-6/+268
via point2oct and oct2point and that checks the corner case in hybrid encoding that was fixed in ec2_oct.c r1.13.
2021-04-21Clean up TLSv1.2 certificate request handshake data.jsing5-43/+27
Currently cert_req is used by clients and cert_request is used by servers. Replace this by a single cert_request used by either client or server. Remove the certificate types as they are currently unused. This also fixes a bug whereby if the number of certificate types exceeds SSL3_CT_NUMBER the number of bytes read in is insufficient, which will break decoding. ok inoguchi@ tb@
2021-04-21Fix const in previous. Pointed out by asoutb1-5/+5
2021-04-20Fix indent of EC_METHODs as requested by jsing.tb6-192/+192
While there zap trailing whitespace from a KNF approximation gone wrong.
2021-04-20Adjust ectest.c for set_compressed_coordinatestb1-9/+9
2021-04-20Compare pointer against NULL and fix a KNF issue.tb1-3/+3
ok jsing
2021-04-20Prepare to provide EC_POINT_set_compressed_coordinatestb5-57/+41
ok jsing
2021-04-20Adjust ectest.c for get_Jprojective coordinate changetb1-2/+2
2021-04-20Compare function pointers against NULL, not 0.tb1-3/+3
ok jsing
2021-04-20Provide EC_POINT_{g,s}et_Jprojective_coordinates for internal usetb10-77/+97
ok jsing
2021-04-20Simplify code after adding EC_POINT_{s,g}et_affine_coordinates()tb3-73/+18
ok jsing
2021-04-20Adjust ecdhtest.c for affine_coordinates changetb2-7/+7
2021-04-20Adjust ectest.c for affine_coordinates changetb1-17/+17
2021-04-20Compare function pointers against NULL, not 0.tb1-3/+3
ok jsing
2021-04-20Prepare to provide EC_POINT_{g,s}et_affine_coordinatestb18-92/+90
Similar to part of OpenSSL commit 8e3cced75fb5fee5da59ebef9605d403a999391b ok jsing
2021-04-20Simplify after EC_POINT_get_curve() additiontb2-30/+8
ok jsing
2021-04-20Adjust ectest.c for EC_GROUP_{g,s}et_curve changetb2-15/+15
2021-04-20Add prototypes for EC_GROUP_get_curve_{GF2m,GFp}().tb1-1/+6
These will be removed once EC_GROUP_get_curve() is public.
2021-04-20Compare function pointers against NULL, not 0.tb1-3/+3
ok jsing
2021-04-20Prepare to provide EC_GROUP_{get,set}_curve(3)tb6-41/+51
There are numerous functions in ec/ that exist with _GF2m and _GFp variants for no good reason. The code of both variants is the same. The EC_METHODs contain a pointer to the appropriate version. This commit hides the _GF2m and _GFp variants from internal use and provides versions that work for both curve types. These will be made public in an upcoming library bump. Similar to part of OpenSSL commit 8e3cced75fb5fee5da59ebef9605d403a999391b ok jsing
2021-04-19Remove new_sym_enc and new_aead.jsing3-10/+19
These can be replaced with accessors that allow this information to be retrieved from the new record layer. ok inoguchi@ tb@
2021-04-19Avoid division by zero in hybrid point encodingtb1-17/+49
In hybrid and compressed point encodings, the form octet contains a bit of information allowing to calculate y from x. For a point on a binary curve, this bit is zero if x is zero, otherwise it must match the rightmost bit of of the field element y / x. The existing code only considers the second possibility. It could thus fail with a division by zero error as found by Guido Vranken's cryptofuzz. This commit adds a few explanatory comments to oct2point and fixes some KNF issues. The only actual code change is in the last hunk which adds a BN_is_zero(x) check to avoid the division by zero. ok jsing
2021-04-19Move new_mac_secret_size into the TLSv1.2 handshake struct.jsing2-5/+7
Drop the 'new_' prefix in the process. ok inoguchi@ tb@
2021-04-19Move reuse_message, message_type, message_size and cert_verify into thejsing6-59/+62
TLSv1.2 handshake struct. ok inoguchi@ tb@
2021-04-19Set alpn_selected_len to zero when freeing alpn_selected.jsing1-1/+2
This is not strictly necessary since we proceed to zero the entire struct, however it keeps the code consistent and easily auditable. ok tb@
2021-04-19The powerpc64 ELFv2 ABI explicitly states that exception enable bitskettenis1-1/+9
and rounding control bits are not restored by longjmp(3). So expect the some failures on that platform. ok bluhm@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-19 08:09:00 +0000