summaryrefslogtreecommitdiff
path: root/src/lib/libc (unfollow)
Commit message (Collapse)AuthorFilesLines
2023-03-07Consolidate clear code for EC_GFp_mont_method.jsing1-23/+18
Use a fang dangled thing (known as a function) to avoid duplicating the same code in five places. ok tb@
2023-03-06Clean up ndef_{prefix,suffix}_free()tb1-8/+13
These functions are rather similar, so there's no need for the code to be wildly different. Add a missing NULL check to ndef_prefix_free() since that will be needed in a subsequent commit. ok jsing
2023-03-06Rename struct ${app}_config to plain cfgtb44-3260/+3260
All the structs are static and we need to reach into them many times. Having a shorter name is more concise and results in less visual clutter. It also avoids many overlong lines and we will be able to get rid of some unfortunate line wrapping down the road. Discussed with jsing
2023-03-06Document ECDSA_SIG_get0_{r,s}()tb1-2/+35
2023-03-06Document DH_get0_* for individual DH members.tb1-3/+78
2023-03-06Document DSA_get0_* for individual DSA memberstb1-3/+77
2023-03-06Document RSA_get0_* for individual RSA members.tb1-3/+106
Loosely based on OpenSSL commit 6692ff77. Prodded by job
2023-03-06Rework asn1_item_flags_i2d()tb1-19/+20
Flip the logic of NULL checks on out and *out to unindent, use calloc() instead of malloc() and check on assign. Also drop the newly added len2 again, it isn't needed. ok jsing
2023-03-06Fix some return checks in ecdh_cms_encrypt()tb1-3/+3
i2d functions return <= 0 on error, so check for that instead of == 0. The issue with CMS_SharedInfo_encode() was found by Niels Dossche. OpenSSL review overlooked that they had turned penclen into a size_t. In principle the issue with i2d_X509_ALGOR() is purely cosmetic. Why do a strange check when there is an idiomatic check? Then again this is CMS... ok jsing
2023-03-06Fix incorrect RSA_public_decrypt() return checktb1-4/+8
RSA_public_decrypt() returns <= 0 on error. Assigning to a size_t and checking for == 0 is not the right thing to do here. Neither is blindly turning the check into <= 0... Found by Niels Dossche ok jsing
2023-03-06ASN.1 enc: check ASN1_item_ex_i2d() consistencytb1-3/+8
The i2d API design is: call a function first with a pointer to NULL, get the length, allocate a buffer, call the function passing the buffer in. Both calls should be checked since ther are still internal allocations. At the heart of ASN.1 encoding, this idiom is used and the second call is assumed to succeed after the length was determined. This is far from guaranteed. Check that the second call returns the same length and error otherwise. ok jsing
2023-03-05Remove #ifndef OPENSSL_EC_NISTP_64_GCC_128.jsing1-5/+1
This was presumably intended to be OPENSSL_NO_EC_NISTP_64_GCC_128, however generic code has ended up inside the ifdef (and none of the NISTP code or prototypes now remain).
2023-03-05Remove ec_GFp_nistp.* prototypes.jsing1-40/+1
This code has been deleted, however the prototypes managed to hang around.
2023-03-05Remove duplicate function prototypes.jsing1-8/+1
2023-03-05openssl: make all config structs statictb11-22/+22
These are per-app, so per-file. Most of them already are static, adjust the rest of them.
2023-03-05openssl/cms: zap some trailing whitespacetb1-3/+3
2023-03-04openssl enc doesn't really support AEAD ciphers and XTS modetb1-2/+30
Do not display such ciphers in the usage display and error out if they are given. As pointed out by Pauli Dale, the current situation is confusing. Fixes GH issues #786 and #819 ok jsing
2023-03-04Simplify the consistency checks in old_dsa_priv_decode()tb1-24/+13
We have long had expensive checks for DSA domain parameters in old_dsa_priv_decode(). These were implemented in a more complicated way than necesary. ok beck jsing
2023-03-04Enforce a lower bound of of EC group order so 80 bits for ECDSAtb1-2/+7
This makes sure that the elliptic curve is not completely stupid. This is conservative enough: the smallest named groups that we support have an order of 112 bits. ok beck jsing
2023-03-04Cap the number of iterations in ECDSA signingtb1-1/+15
ECDSA is essentially the same thing as DSA, except that it is slightly less stupid. Signing specifies an infinite loop, which is only possible with arbitrary ECDSA domain parameters. Fortunately, most use of ECDSA in the wild is based on well-known groups, so it is known a priori that the loop is not infinite. Still, infinite loops are bad. A retry is unlikely, 32 retries have a probability of ~2^-8000. So it's pretty safe to error out. ok beck jsing
2023-03-04Cap the number of iterations in DSA signingtb1-1/+16
The DSA standard specifies an infinite loop: if either r or s is zero in the signature calculation, a new random number k shall be generated and the whole thing is to be redone. The rationale is that, as the standard puts it, "[i]t is extremely unlikely that r = 0 or s = 0 if signatures are generated properly." The problem is... There is no cheap way to know that the DSA domain parameters we are handed are actually DSA domain parameters, so even if all our calculations are carefully done to do all the checks needed, we cannot know if we generate the signatures properly. For this we would need to do two primality checks as well as various congruences and divisibility properties. Doing this easily leads to DoS, so nobody does it. Unfortunately, it is relatively easy to generate parameters that pass all sorts of sanity checks and will always compute s = 0 since g is nilpotent. Thus, as unlikely as it is, if we are in the mathematical model, in practice it is very possible to ensure that s = 0. Read David Benjamin's glorious commit message for more information https://boringssl-review.googlesource.com/c/boringssl/+/57228 Thanks to Guido Vranken for reporting this issue, also thanks to Hanno Boeck who apparently found and reported similar problems earlier. ok beck jsing
2023-03-04Small readability tweak in old_dsa_priv_decode()tb1-3/+3
Explicitly check against NULL and turn early return into goto err. ok beck jsing
2023-03-04Call dsa_check_keys() before signing or verifyingtb1-23/+9
We already had some checks on both sides, but they were less precise and differed between the functions. The code here is messy enough, so any simplification is helpful... ok beck jsing
2023-03-04Add dsa_check_key() calls on DSA decodingtb1-18/+17
When decoding a public or a private key, use dsa_check_key() to ensure consistency of the DSA parameters. We do not always have sufficient information to do that, so this is not always possible. This adds new checks and replaces incomplete existing ones. On decoding the private key we will now only calculate the corresponding public key, if the sizes are sensible. This avoids potentially expensive operations. ok beck jsing
2023-03-04Provide dsa_check_key()tb2-2/+77
This is a cheap check that ensures basid parameter consistency per FIPS 186-4: 1 < g < q, that q has the allowed bit sizes 160, 224, 256 and that p is neither too small nor too large. Unfortunately, enforcing the three allowed sizes for p is not possible since the default dsa key generation has not respected this limitation. Instead of checking that p and q are prime, we only check that they are odd. Check that public and private keys, if set, are in the proper range. In particular, disallow zero values. Various versions of these checks have been added to the dsa code over time. This consolidates and extends them and in a subsequent commit wewill replace the incomplete checks. BoringSSL has a similar function of the same name, thanks to David Benjamin for pointing it out. ok beck jsing
2023-03-04Provide DSA_R_INVALID_PARAMETERS error codetb2-2/+4
This has been missing for a while already and will be used in a few upcoming commits. ok beck jsing
2023-03-04Mop up ECP_NISTZ256_ASM and OPENSSL_NO_EC_NISTP_64_GCC_128 leftovers.jsing2-22/+3
This is `unifdef -m -DOPENSSL_NO_EC_NISTP_64_GCC_128 -UECP_NISTZ256_ASM` and some manual tidy up.
2023-03-04Rename field_data1 and field_data2.jsing2-48/+50
Rather than pretending that these "generic" variables are used for multiple things, rename them to reflect their actual usage and use appropriate types instead of void *. ok tb@
2023-03-04bio_chain test: fix error messagetb1-2/+2
2023-03-04Avoid infinite loop in bio_asn1 state machinetb1-2/+2
If the BIO_write() in the ASN1_STATE_DATA_COPY state fails, incorrect error handling will break out of the switch without changing the state, and the infinite for loop will immediately try the same write again, which is unlikely to succeed... Clearly this code intended to break out of the loop instead. Via OpenSSL 1.1 commit 723f616df81ea05f31407f7417f49eea89bb459a ok millert
2023-03-04openssl/req: garbage collect a pointless EVP_MD_CTX_init()tb1-2/+2
Before do_sign_init(), the ctx is always allocated by EVP_MD_CTX_new() aka calloc(). There is no point in doing EVP_MD_CTX_init(), aka bzero(). ok jsing
2023-03-02Simplify the ct Makefile slightlytb1-7/+3
2023-03-02Clean up the x509 regress make file a littletb1-27/+10
2023-03-02Remove a few more unnecessary line continuationstb1-4/+4
2023-03-02Nitpick error checks of BN_get_mem_data()tb1-15/+27
BN_get_mem_data() returns a non-positive long on error, so assigning it to a size_t and displaying that in error messages is incorrect.
2023-03-02Some more Makefile cosmeticstb1-10/+15
The verbose evp test actually depends on the evptest binary. Use consistent spacing and indentation.
2023-03-02The evp_ecx_test no longer needs static linkingtb1-3/+1
2023-03-02Hide the hexdumps behind a verbose flags. Should have been part oftb1-26/+45
the previous commit.
2023-03-02Simplify evp test Makefile.tb1-18/+5
Make evptest silent by default: these pages of hexdumps are useless noise. Add a verbose target for debugging.
2023-03-02evp_pkey_check: make this test silent on successtb1-18/+13
2023-03-02Remove a few unnecessary line continuationstb1-7/+7
2023-03-01Comment out glob for JSON webcrypto tests for nowtb1-2/+3
Allows test to pass with the old version of the wycheproof-testvectors package.
2023-03-01Link evp/cipher_method_lib.c to the buildtb1-1/+2
ok jsing
2023-03-01Convert EVP_CIPHER_meth_dup() to using calloc()tb1-3/+2
There is no reason for this to call EVP_CIPHER_meth_new(), as the flags will be copied a line later anyway. Simplify this. Requested by jsing
2023-03-01Make cipher_method_lib.c compile with LibreSSLtb1-15/+29
OPENSSL_zalloc() -> calloc(), OPENSSL_free() -> free() and a few assorted cosmetic tweaks to match our style better. ok jsing
2023-03-01Add EVP_CIPHER_meth_* prototypes to evp.htb1-1/+25
As usual, this will be guarded by LIBRESSL_INTERNAL || LIBRESSL_NEXT_API until the next bump. ok jsing
2023-03-01Make the cleanup() method return an int againtb4-7/+12
This partially reverts jsing's OpenBSD commit b8185953, but without adding back the error check that potentialy results in dumb leaks. No cleanup() method in the wild returns anything but 1. Since that's the signature in the EVP_CIPHER_meth_* API, we have no choice... ok jsing
2023-03-01Fix line wrapping of function pointer argumentstb1-15/+8
ok jsing
2023-03-01First KNF approximation as per knfmt(1)tb1-60/+72
ok jsing
2023-03-01Drop the EVP_CIPHER_METH_get_* functionstb1-42/+1
Nothing interesting uses them. There's a Debian SSH-1 module and corresponding ncrack bits. That's not reason enough to have this garbage. ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-25 11:10:30 +0000