summaryrefslogtreecommitdiff
path: root/src/lib/libc/stdlib/recallocarray.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2019-04-01Add a mutex to guard reference counting for tls_config.jsing3-4/+16
This makes libtls more friendly for multithreaded use - otherwise we can end up with incorrect refcounts and end up freeing when we should not be (or not freeing when we should be). ok beck@
2019-04-01Implement a print function for BIGNUM_it.jsing1-2/+18
ok beck@, tb@
2019-04-01Correct the return values from long_print.jsing1-2/+5
BIO_print() returns -1 on failure, whereas the ASN print functions need to return 0. ok beck@, tb@
2019-04-01Require all ASN1_PRIMITIVE_FUNCS functions to be provided.jsing5-26/+42
If an ASN.1 item provides its own ASN1_PRIMITIVE_FUNCS functions, require all functions to be provided (currently excluding prim_clear). This avoids situations such as having a custom allocator that returns a specific struct but then is then printed using the default primative print functions, which interpret the memory as a different struct. Found by oss-fuzz, fixes issue #13799. ok beck@, tb@
2019-04-01mark ERR_R_INTERNAL_ERROR instead of assert or _exit, sighderaadt1-3/+3
2019-04-01Correct subtle bug in sigalgs, only care about curve_nid if we arebeck1-4/+4
checking the curve. ok jsing@ tb@
2019-03-31Clean up and simplify the client verify code:jsing1-50/+49
- Be consistent with _len naming. - Use size_t where possible/appropriate. - Group the CBB code. - Use EVP_MAX_MD_SIZE consistently, instead of "magic" values. - Switch GOST to EVP_DigestSign*, making it similar to sigalgs. ok tb@ a while back.
2019-03-31Wrap long lines and apply some style(9).jsing1-7/+10
2019-03-31Use named field initialisers.jsing2-16/+18
2019-03-29Use correct capitalization of EC_GROUP_get_curve_GF{2m,p}(3).tb1-4/+4
2019-03-28Enable GOST cipher selection test after libssl has been fixed.bluhm1-6/+1
2019-03-27Cast nonce bytes to avoid undefined behaviour when left shifting.jsing1-3/+3
Reported by oss-fuzz, really fixes issue #13805. ok beck@ tb@
2019-03-27remove duplicate set key file call. from alf.tedu1-3/+1
ok jsing
2019-03-27bump to 2.9.1bcook1-3/+3
2019-03-26Use limits.h instead of sys/limits.h for portability.jsing1-3/+2
From phrocker via github.
2019-03-25Update regress following sigalgs changes.jsing1-17/+1
2019-03-25Strip out all of the pkey to sigalg and sigalg to pkey linkages.jsing5-59/+8
These are no longer used now that we defer signature algorithm selection. ok beck@
2019-03-25tls1_process_sigalgs() is no longer needed.jsing2-57/+2
ok beck@
2019-03-25Defer sigalgs selection until the certificate is known.jsing9-48/+124
Previously the signature algorithm was selected when the TLS extension was parsed (or the client received a certificate request), however the actual certificate to be used is not known at this stage. This leads to various problems, including the selection of a signature algorithm that cannot be used with the certificate key size (as found by jeremy@ via ruby regress). Instead, store the signature algorithms list and only select a signature algorithm when we're ready to do signature generation. Joint work with beck@.
2019-03-25Rework ssl_ctx_use_certificate_chain_bio() to use the CERT_PKEY chain.jsing1-46/+26
This means that any additional CA certificates end up on the per certificate chain, rather than the single/shared extra_certs. Also simplify this code and in particular, avoid setting the return value to indicate success until we've actually succeeded. ok beck@ tb@
2019-03-25Remove ssl_get_server_send_cert() which is now unused.jsing2-14/+2
ok beck@ tb@
2019-03-25Rework ssl3_output_cert_chain() to take a CERT_PKEY and consider chains.jsing4-40/+36
We will now include the certificates in the chain in the certificate list, or use the existing extra_certs if present. Failing that we fall back to the automatic chain building if not disabled. This also simplifies the code significantly. ok beck@ tb@
2019-03-25Add a chain member to CERT_PKEY and provide functions for manipulating it.jsing2-3/+74
Note that this is not the full chain, as the leaf certificate currently remains in the x509 member of CERT_PKEY. Unfortunately we've got to contend with the fact that some OpenSSL *_chain_* APIs exclude the leaf certificate while others include it... ok beck@ tb@
2019-03-24In the incredibly unbelievable circumstance where _rs_init() fails toderaadt1-2/+2
allocate pages, don't call abort() because of corefile data leakage concerns, but simply _exit(). The reasoning is _rs_init() will only fail if someone finds a way to apply specific pressure against this failure point, for the purpose of leaking information into a core which they can read. We don't need a corefile in this instance to debug that. So take this "lever" away from whoever in the future wants to do that.
2019-03-24If ssl_cipher_apply_rule() is given a specific cipher suite, match on it.jsing1-3/+4
Otherwise matching a specific cipher is performed by matching against its characteristics, which can result in multiple rather than a single match. Found by bluhm@'s regress tests. ok bluhm@ tb@
2019-03-24Don't allow asn1_parse2 to recurse arbitrarily deep. Constrain to a maxbeck1-1/+5
depth of 128 - For oss-fuzz issue 13802 ok jsing@
2019-03-24Cast nonce bytes to avoid undefined behaviour when left shifting.jsing1-3/+3
Reported by oss-fuzz, fixes issue #13805. ok beck@ tb@
2019-03-24do not call assert(), which has a tendency to leave traces of stuff inderaadt1-2/+3
corefiles. Instead call OPENSSL_assert(), which has recently been trained to do this in a safer (if more awkward to debug) way. discussed with jsing and beck a while back
2019-03-23Add range checks to varios ASN1_INTEGER functions to ensure thebeck3-6/+62
sizes used remain a positive integer. Should address issue 13799 from oss-fuzz ok tb@ jsing@
2019-03-21Fix typo in usage and comment.bluhm3-6/+6
2019-03-21import EVP_camellia_128_cbc(3) from OpenSSL 1.1.1,schwarze4-3/+156
still under a free license, tweaked by me
2019-03-21space before punct;jmc1-3/+3
2019-03-21Split EVP_rc4(3) out of EVP_EncryptInit(3) to reduce clutter.schwarze4-21/+116
The algorithm is insecure and yet its description would spread over three paragraphs in the cipher list, including remarkable advice like using a 40 bit key length.
2019-03-21Split EVP_des_cbc(3) out of EVP_EncryptInit(3) to reduce clutter:schwarze4-55/+230
this moves a large number of functions out of the way that are no longer the latest and greatest. Also mention a few that were missing.
2019-03-21add a handful of missing functionsschwarze1-5/+38
that are also documented in OpenSSL 1.1.1 (still under a free license)
2019-03-21Bring back EVP_chacha20 list item that was accidentally removedtb1-2/+3
in r1.28 when the AES ciphers were split into their own manual.
2019-03-20fix examples (libtls uses its own error reporting mechanism)espie1-4/+4
okay tb@
2019-03-20escape backslashes;schwarze2-11/+11
patch from Peter Piwowarski <peterjpiwowarski at gmail dot com>
2019-03-19Document the flag EVP_CIPHER_CTX_FLAG_WRAP_ALLOW needed for the EVPschwarze2-4/+71
AES wrap modes, the function EVP_CIPHER_CTX_set_flags(3) needed to set it, and the companion functions EVP_CIPHER_CTX_clear_flags(3) and EVP_CIPHER_CTX_test_flags(3). With help and an OK from tb@.
2019-03-19Avoid an internal 2 byte overread in ssl_sigalgs().jsing1-7/+2
Found by oss-fuzz, fixes issue #13797. ok beck@ tb@
2019-03-19Revert TLS1_get{,_client}_version simplification because DTLS.jsing4-14/+15
2019-03-18* note that the handshake must be completed firstschwarze1-4/+15
* correct the description of "unknown" (the previous are both from OpenSSL 1.1.1, still under a free license) * add a comment saying that TLS1_get_version() and TLS1_get_client_version() are intentionally undocumented (reasons provided by jsing@)
2019-03-18Insert a missing input line break after a .Vt macro;schwarze1-4/+5
from Jan Stary <hans at stare dot cz>. Where here, correct one .Vt NULL -> .Dv NULL.
2019-03-18Split EVP_aes_128_cbc(3) out of EVP_EncryptInit(3):schwarze4-74/+322
both resulting pages are still long. Mention a number of missing functions. Add some text from the OpenSSL 1.1.1 EVP_aes.pod manual page, which is still under a free license. Add missing HISTORY information. Triggered by tb@ providing EVP_aes_{128,192,256}_wrap(3) in evp.h rev. 1.74.
2019-03-18In ssl.h rev. 1.165, tb@ provided version agnostic DTLS methods.schwarze1-3/+26
Document them.
2019-03-18Document SM4; related to evp.h rev. 1.73.schwarze4-6/+93
2019-03-18Expand the ERR_PACK() macro to ERR_REASON() for consistency.tb1-2/+2
No binary change.
2019-03-18In evp.h rev. 1.75, tb@ provided EVP_PKEY_get0_hmac(3).schwarze1-3/+29
Document it. Even though OpenSSL muddles the waters by lumping the description together with the other EVP_PKEY_get0_*() functions, describe it separately because a char * has no reference count and because the function fills in an additional length parameter.
2019-03-17Add regress tests for the EVP_aes_*_wrap() API. Based on the tests intb2-4/+19
OpenSSL 1.0.2r which is still freely licenced with a tweak by jsing.
2019-03-17bump minors after symbol additiontb3-3/+3
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-01 09:02:02 +0000