summaryrefslogtreecommitdiff
path: root/src/lib/libc/stdlib/recallocarray.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2022-10-17Revise expire callback regress to use chains with expired certificates.jsing1-25/+66
Rather than using X509_STORE_CTX_set_time() (which is resulting all certificates in the chain being treated as expired), use chains that have an expired leaf or expired intermediate. This triggers a different code path, which is currently mishandled (and hence failing). Also ensure that the resulting error and error depth match what we expect them to be.
2022-10-17Ensure that verification results in the expected error and error depth.jsing1-16/+113
Improve verification regress and ensure that the legacy or modern verification completes with the expected error and error depth.
2022-10-17Avoid potential divide by zero in BIO_dump_indent_cb()jsing1-8/+7
Passing an indent value of 67 results in DUMP_WIDTH_LESS_IDENT returning a value of zero, which is promptly used for division. Likewise, passing a value larger than 67 results in a negative value being returned. Prevent this by limiting indent to 64 (which matches OpenSSL's current behaviour), as well as ensuring that dump_width is > 0. Should fix oss-fuzz #52464 and #52467. ok miod@ tb@
2022-10-17Unbreak ASN.1 indefinite length encoding.jsing1-4/+4
In r1.25 of tasn_enc.c a check was added to ensure that asn1_ex_i2c() returned the same value on both calls, however in the ndef case the len variable gets changed between calls. Keep a copy of the original value to test against. Issue reported by niklas, who encountered a test failure in rust-openssl. ok miod@ tb@
2022-10-14Error out if the out secret wasn't properly initializedtb1-2/+6
Calling HKDF_expand() with a length of 0 happens to succeed due to a quirk in the API inherited from BoringSSL. This hides caller-side errors during development. Error out to catch such mistakes early on. ok jsing
2022-10-14put the malloc_readonly struct into the "openbsd.mutable" section, soderaadt1-2/+3
that the kernel and ld.so will know not to mark it immutable. malloc handles the read/write transitions by itself.
2022-10-11Fix path of mentioned regress testtb1-2/+2
2022-10-11Handle corner case in which the test case can actually be a squaretb1-4/+3
2022-10-05unwrap two lines for readabilitytb1-5/+3
2022-10-04fix an obvious thinko without serious consequences in the display of eespie1-2/+2
for rsa and friends. okay tb@
2022-10-02Dynamically link libssl for QUIC regress.jsing1-2/+2
Now that the QUIC API is public, we can stop linking this statically.
2022-10-02Remove unused headers.jsing1-5/+1
2022-10-02Revise for SSL_CTX_INTERNAL and SSL_INTERNAL removal.jsing5-68/+66
2022-10-02Get rid of SSL_CTX_INTERNAL and SSL_INTERNAL.jsing26-1237/+1220
These are no longer necessary due to SSL_CTX and SSL now being fully opaque. Merge SSL_CTX_INTERNAL back into SSL_CTX and SSL_INTERNAL back into SSL. Prompted by tb@
2022-10-01Move handshake message handling functions from ssl_both.c to client/server.jsing4-225/+342
Currently, ssl_both.c contains several functions that are used by both the legacy client and legacy server. This interwines the client and server, making it harder to make progressive changes. While it does deduplicate some code, it also ends up with code that is conditioned on s->server and forces the caller to pass in SSL3_ST_* values. Move these functions from ssl_both.c into ssl_clnt.c and ssl_srvr.c, renaming as appropriate and removing the s->server conditionals. Also move the client and server function prototypes from ssl_locl.h into the .c files, making them static in the process. ok tb@
2022-09-28use Fn rather than Nm for swab(); from josiah frentsosjmc1-6/+6
2022-09-21Tweak symbols test in such a way that it would have caught the recenttb2-3/+9
Symbols.list mistake: undefine aliases (except _cfb block ciphers which are aliases for historical reasons). Use -Wl,--no-allow-shlib-undefined.
2022-09-19Remove PKCS12_MAKE_{,SH}KEYBAG from Symbols.listtb1-2/+0
These functions were renamed in the last bump #define PKCS12_MAKE_KEYBAG PKCS12_SAFEBAG_create0_p8inf #define PKCS12_MAKE_SHKEYBAG PKCS12_SAFEBAG_create_pkcs8_encrypt They don't appear in the compiled library itself, so no further bump required. Fixes libressl-portable/portable#791 Found the hard way by vollkommenheit ok deraadt jsing
2022-09-17Allow TLSv1.3 clients to send CCS without middlebox compatibility mode.jsing1-4/+2
While RFC 8446 is clear about what legacy session identifiers can be sent by a TLSv1.3 client and how middlebox compatibility mode is requested, it is delightfully vague about the circumstances under which a client is permitted to send CCS messages. While it does not make sense for a client to send CCS messages when they are not requesting middlebox compatibility mode, it is not strictly forbidden by the RFC and at least one (unknown) TLSv1.3 stack has been observed to do this in the wild. Revert part of the previous change and allow clients to send CCS messages, even if they are not requesting middlebox compatibility mode. Found the hard way by florian@ ok tb@
2022-09-17Link to SSL_read_early_data(3)kn1-3/+3
OK tb
2022-09-15Add OID for RPKI signedTAL objectsjob2-0/+2
IANA made a permanent registration in the SMI Security for S/MIME CMS Content Type registry at https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#security-smime-1 for signed objects conforming to draft-ietf-sidrops-signed-tal. OK tb@
2022-09-15Use LONG_MAX as the limit for ciphers with long based APIs.jsing6-169/+120
These ciphers have long based APIs, while EVP has a size_t based API. The intent of these loops is to handle sizes that are bigger than LONG_MAX. Rather than using the rather crazy EVP_MAXCHUNK construct, use LONG_MAX rounded down to a large block size, ensuring that it is a block size multiple. Revert the recently added overflow checks now that this is handled more appropriately. ok tb@
2022-09-14remove an extraneous empty linetb1-2/+1
2022-09-13Stop pretending that EVP_CIPHER cleanup can fail.jsing4-14/+15
Now that EVP_CIPHER is opaque, stop pretending that EVP_CIPHER cleanup can fail. ok tb@
2022-09-12zap extra .Pptb1-2/+1
2022-09-12Stop documenting i2c_ASN1_INTEGER.tb2-48/+4
This is no longer public API. Also remove some comments about i2c and c2i functions being intentionally undocumented since they are no longer public.
2022-09-12Add CBC, CFB64 and OFB64 test coverage for RC2tb1-34/+463
From Joshua Sing
2022-09-12whitespace nitstb1-4/+5
2022-09-12Move division by two out of sizeof()tb1-3/+3
2022-09-12Error checks for EVP_*tb1-25/+36
CID 356777
2022-09-12Move division by two out of sizeof()tb1-3/+3
CID 356778
2022-09-11Add regression tests for the sendmmsg and recvmmsg system calls.mbuhl4-2/+410
2022-09-11Enforce the minimum TLS version requirement for QUIC.jsing1-1/+9
ok tb@
2022-09-11Adjust for opaque structs in ts.htb1-14/+24
ok jsing
2022-09-11Adjust for opaque structs in pkcs12.htb1-25/+38
ok jsing
2022-09-11bump major after libcrypto and libssl major bumptb1-2/+2
2022-09-11Crank major after symbol addition and libcrypto major bumptb1-2/+2
2022-09-11Update Symbols.listtb1-0/+11
ok jsing
2022-09-11Expose SSL_get_share_{group,curve}() and related #definestb1-7/+3
ok jsing
2022-09-11Expose some error codes needed for QUIC supporttb1-3/+1
ok jsing
2022-09-11Define LIBRESSL_HAS_QUICtb1-0/+1
ok jsing
2022-09-11Bump major after symbol addition and removal and struct visibility changestb1-2/+2
2022-09-11Update Symbols.listtb1-9/+31
ok jsing
2022-09-11Make structs in ts.h opaquetb2-215/+223
ok jsing
2022-09-11Make structs in pkcs12.h opaquetb4-162/+45
ok jsing
2022-09-11Expose EVP_chacha20_poly1305()tb1-3/+1
ok jsing
2022-09-11Expose various EVP AEAD constants for EVP ChaCha and QUICtb1-3/+1
ok jsing
2022-09-11Expose OPENSL_cleanup()tb1-3/+1
ok jsing
2022-09-11Make BIO_info_cb() identical to bio_info_cb()tb1-2/+3
Various projects use bio_info_cb and BIO_info_cb interchangeably, for example mupdf and freerdp. This is because this was changed in OpenSSL commit fce78bd4 (2017), triggered by new warnings in gcc 8. https://github.com/openssl/openssl/pull/4493 This results in some scary compiler warnings and useless patches in ports. Nobody seems to be using the old bio_info_cb() version. ok jsing
2022-09-11Remove c2i_* and i2c_* from public visibilitytb2-10/+11
This removes c2i_ASN1_OBJECT(), {c2i,i2c}_ASN1_BIT_STRING() and {c2i,i2c}_ASN1_INTEGER(). These are not part of the OpenSSL 1.1 API and should never have been exposed in the first place. ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-02 23:00:45 +0000