summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/objects (unfollow)
Commit message (Collapse)AuthorFilesLines
2026-08-07Restore the OCSP no-check extension methodkenjiro2-2/+5
The conversion of X509V3_EXT_get_nid() from a table to a switch omitted the OCSP no-check extension method. Add the missing accessor declaration and switch case. ok tb@
2026-08-07revert switch to elf_aux_info(); it breaks the install medianaddy1-19/+63
2026-08-05OBJ_create: OBJ_add_objects -> OBJ_create_objectstb1-2/+2
2026-08-05Remove documentation of OBJ_add_object(3)tb1-39/+14
This API was removed a long time ago but I forgot to update the manpage (probably because doing so is slightly non-trivial). There's still a lot of API here that should be removed. OBJ_add_objects() seems now unused while OBJ_new_nid() is used by the one consumer that is single-handedly responsible for at least two dozen APIs that could otherwise be removed from libcrypto with significant simplifications: security/xca. It would appear the author is on a quest to figure out how to make use of whatever undocumented garbage they can find in the openssl headers. That's of course a hobby project you can pursue for decades.
2026-08-05Add missing Dv macro for NI_NUMERICSERV and NI_DGRAMclaudio1-4/+4
OK tb@
2026-08-04switch aarch64 CPU feature detection to elf_aux_info()naddy1-63/+19
ok kettenis@ tb@
2026-07-31callbackfailures: allow specifying the root certificate filekenjiro1-10/+11
Accept an optional roots file argument while retaining /etc/ssl/cert.pem as the default. This allows portable regress users to provide a CA bundle when the default path is unavailable. ok tb
2026-07-31Make file-local functions statickenjiro9-27/+27
These functions are only used within their implementation files and do not need external linkage. Mark them static. ok tb
2026-07-31Remove unused BUF_reverse()kenjiro1-22/+1
BUF_reverse() has no callers and is not part of the public API. Remove the unused function, which also eliminates its -Wmissing-prototypes warning. ok tb beck
2026-07-31Add missing internal header includeskenjiro25-25/+60
Include the relevant internal headers in implementation files that define internal functions. Also make asn1_local.h and pkcs12_local.h self-contained by including their corresponding public headers. ok tb beck
2026-07-29ocspcheck: make validate_response() static, it's only used in this filetb1-3/+2
2026-07-29timingsafe test: make check() statictb1-2/+2
2026-07-29verify test: print size_t with %zutb1-2/+2
2026-07-28tlsfuzzer: use an f-string instead of explicit format specifierstb1-4/+2
2026-07-28tlsfuzzer: avoid mutable default argumentstb1-6/+18
2026-07-28tlsfuzzer: simplify check for directorytb1-2/+2
2026-07-26tlsfuzzer: use sys.exit() instead of naked exit()tb1-8/+8
2026-07-26tlsfuzzer: whitespace tweakstb1-4/+5
2026-07-26tlsfuzzer: remove unnecessary semicolontb1-2/+2
2026-07-25Unlock CRYPTO_LOCK_UI on ui_open_session() failuretb1-3/+5
Both ui_open_session() implementations, open_console() in ui_openssl.c in base, and the one in ui_openssl_win.c in portable, grab the lock of type CRYPTO_LOCK_UI before doing anything else. The only internal (and, as far as I can tell, the only existing) caller, UI_process(), returns immediately on failure. The calling thread thus keeps holding the lock and the next call to UI_process() will block indefinitely. Fix this by using the common exit path, which calls ui_close_session() aka close_console(), both implementations of which release the lock. Thanks to Kartik (@sage-mode-hunter) who proposed an alternative fix for ui_openssl_win.c, which we would have to apply to ui_openssl.c as well. Matches OpenSSL behavior since PR #2037 Closes https://github.com/libressl/portable/pull/1334 ok kenjiro
2026-07-22Improve SHA-3 performance.jsing1-37/+281
Replace the tiny-sha3 keccakf implementation with an unrolled and interleaved algorithm, that is hidden away in an obsolete reference implementation. This gets us 3.3x speed up on arm64 (Apple M2), a 1.3x speed up on amd64 (Intel i7-1165G7) and 6x speed up on sparc64 (M3000). ok tb@
2026-07-21bn_mul_div: use (unsigned long long) instead of (uint64_t) to print with %llutb1-2/+2
2026-07-17Alberta moved to permanent -06 on 2026-06-18, update test datamillert1-17/+17
2026-07-17Remove redundant BIO_write() length assertions in b64_write()kenjiro1-3/+1
b64_write() asserted that BIO_write() does not return more bytes than requested in two places. Other BIO_write() call sites do not make this check, and there is no special handling here that depends on asserting this condition. ok tb@ beck@ joshua@
2026-07-17Remove stale SECURE RENEGOTIATION referencekenjiro1-5/+3
SSL_CTX_set_options(3) no longer has a SECURE RENEGOTIATION section, but SSL_OP_LEGACY_SERVER_CONNECT still referenced it. Replace the dangling cross reference with a note that the option is no longer set by default. ok tb@ beck@
2026-07-16Make dtls1_do_write_ccs() self contained.jsing1-4/+5
A ChangeCipherSpec message is always the same single byte. Make dtls1_do_write_ccs() know how to send this message, which avoids the use of buffers and needing to keep copies for retransmission. ok kenjiro@ tb@
2026-07-16Clean up sequence number and message header handling.jsing2-26/+13
dtls1_set_message_header() is only called in one place - inline the write handshake sequence number handling. Rename dtls1_set_message_header_int() to dtls1_set_message_header(). The dtls12_write_ccs() code does not use handshake sequence numbers (since they're not handshake messages) - stop pretending that it does. ok kenjiro@ tb@
2026-07-15Check that the server selected ciphersuite is valid for use with TLSv1.2.jsing1-1/+10
In the legacy stack, ensure that the server selected ciphersuite is valid for use with TLSv1.2 - this effectively means that it is not a TLSv1.3 ciphersuite. We currently fail the handshake, but at a later stage. Reported by Tom Gouville from the tlspuffin team. ok tb@
2026-07-15Remove check for use of TLSv1.2 ciphersuites with TLSv1.1 and earlier.jsing1-9/+1
We no longer negotiate any TLS version lower than TLSv1.2, so this is now redundant. ok tb@
2026-07-14Improve name constraints URI host regress.jsing1-12/+57
2026-07-14Fix X.509 constraints URI host parsing.jsing1-29/+72
An authority in a URI is only terminated by a slash, question mark or hash, however the current code also included colons. This allows a specically crafted userinfo to bypass name constraints host checks. Additionally, IPv6 literals may only be specified when enclosed with square brackets, which is not enforced. Rewrite parts of the host and IP parsing code to be more strict, fixing both of these issues in the process. Thanks to Jack Lloyd for reporting the userinfo bypass. ok tb@
2026-07-13correspondigly -> correspondinglytb1-1/+1
2026-07-09Recent msgrcv(2) changes made more tests pass.anton1-2/+1
2026-06-30LLVM now emits calls to strlen(3) and wcslen(3). Redirect those calls tokettenis3-5/+9
our hidden aliases to prevent unnecessary PLT entries (like we already do for memmove(3), memcpy(4) and memset(3)). ok deraadt@
2026-06-27Trivial check for freeaddrinfo(NULL)jca3-2/+29
2026-06-27Ansify usage()jca1-3/+2
While here drop pointless declaration for main()
2026-06-27K&R -> ANSIjca1-9/+3
2026-06-26With x509_vfy.c 1.153, the x509_crl regress passestb1-3/+1
2026-06-26x509_vfy: sync get_crl_sk() with BoringSSL and OpenSSLtb1-6/+18
Among CRLs with the same score prefer the one with the most recent lastUpdate (RFC 5280 thisUpdate). This pulls in OpenSSL commits 626aa248, e032117d, 8b7c51a0 from 2016, so before the license change. This uses the annoying ASN1_TIME_diff() API, but there is no better way, really. Every other ASN1_TIME API will be just as awkward. This fixes the currently failing x509_crl test cases. ok kenjiro
2026-06-26x509_crl regress: enable the failing test and mark as XFAILtb2-4/+4
2026-06-25Add OIDs for CCR, ErikIndex, ErikPartition, CommunityDefinitionjob2-0/+10
References: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-ccr https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-erik-protocol https://datatracker.ietf.org/doc/html/draft-ietf-grow-yang-bgp-communities OK tb@
2026-06-24Test runs out of file descriptors. Increase ulimit number to 256.bluhm1-1/+3
2026-06-23Fix misleading comment in strstr(3)tim1-2/+2
From upstream musl: https://git.musl-libc.org/cgit/musl/commit?id=c53e9b239418eb3e0e8be256abd0f6ad7608bbcf OK tb@
2026-06-23Avoid shift overflow in memmem(3) and strstr(3)tim2-10/+10
Fix from upstream musl: https://git.musl-libc.org/cgit/musl/commit?id=593caa456309714402ca4cb77c3770f4c24da9da OK tb@
2026-06-23With x_crl.c r1.52 the x509_crl regress passestb1-3/+1
2026-06-23crl_cb(): fix EXFLAG_CRITICAL mishandlingtb1-2/+2
The EXFLAG_CRITICAL should be set on encountering a critical CRL extension unsupported by the library. The current loop does the opposite: it stops looking as soon as it finds the first critical extension the library supports... ok kenjiro
2026-06-23libcrypto/x509 regress: x509_crl regress from Boring via OpenSSL #1775tb2-2/+368
Currently expected to fail due to mishandling of unknown critical extensions in x_crl.c, to be fixed shortly.
2026-06-22x509_vfy: make a NULL check explicittb1-2/+2
2026-06-22x509_vfy: remove unnecessary NULL checks before freetb1-7/+4
looks good to claudio
2026-06-22SSL_alert_desc_string: update manpage after change to return "!!" alwaystb1-39/+36
Also change some totally unreadable roff macros to slightly less unreadable mdoc markup.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-09-09 02:55:27 +0000