summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
* rsa_eay: Replace handrolled BN_bn2binpad with the real thingtb12 days1-19/+7
| | | | | | | | | | | | | Just a tiny little bit of lipstick on this entelodont. This is simpler and does not change behavior as BN_bn2binpad() returns -1 on failure and num on success. jsing points out that BN_bn2binpad() is constant time. ok jsing kenjiro PS: henning, you owe me a significant amount of quality beverages for making me look at this particular tire fire (and corresponding XS files).
* libcrypto: harden cms_kek_cipher() a bittb12 days1-3/+8
| | | | | | | | | | | | | | | | When AES key unwrap with padding is in use, the EVP interface breaks its contract and writes more than the outlen it initially reports to the output buffer. This is an old, sneaky trap that the muppet set eons ago and many victims walked right into it, including the muppet himself. If inlen is larger than outlen, allocate inlen bytes to unwrap with padding to avoid a buffer overwrite. This is a variant of OpenSSL's fix. Since we do not support AES keywrap with padding no actual bufer overwrite occurs here at the moment, but if we ever chose to do so (unlikely) this trap would be avoided. There's plenty more traps that the next round of scas will surely find in this absolute trashfire of CMS support code. ok kenjiro
* Don't drop X509_V_ERR_HOSTNAME_MISMATCH when verify callback returns 1beck13 days1-2/+5
| | | | | | | | | | | | | While not the advised way of using the verify callback (either by OpenSSL or by us) in production, sometimes folks like to return 1 from everything in the callback and then check the error return and make decicions about things. This fix ensures that such callbacks will see the hostname mismatch and be able to act upon them. Reported by Alexander Aleksandrovic Klimov ok tb@
* fix a double word; ok tb@jsg13 days1-3/+3
|
* grammar; a -> anjsg2026-08-252-6/+6
| | | | ok schwarze@ sthen@ krw@
* Make deprecation of ASN1_STRING_data(3) more prominenttb2026-08-231-19/+22
| | | | | | | | | | | | | | | | | | | | The function has been deprecated for a long time: OpenSSL did so when adding ASN1_STRING_get0_data in 1.1.0. beck removed it from OpenSSL 4. The reason is that it returns a modifiable "string" and you should not be modifying an ASN1_STRING this way. You should be using one of the clumsy, inconvenient accessors. schwarze merged the deprecation when adding documentation for ASN1_STRING_get0_data() in 2018. Make this a bit more obvious: move function to the end of the documented functions in this page, and mark it deprecated in the SYNOPSIS, too. I'm aware that deprecation does not work. I was hopeful to be able to remove the function in the last cycle, but that did not happen and it might not happen in this cycle either. It will happen at some point, though. Prompted by a question by brad
* grammar; an program -> a programjsg2026-08-231-3/+3
|
* Change RFC references from 8446 to 9846 and adjust section numberstb2026-08-211-2/+2
| | | | with/ok kenjiro
* update cert.pem based on newer mozilla ca root store, ok tb@sthen2026-08-201-198/+192
|
* s2i_ASN1_INTEGER.3: mark up second use of usr_data for consistencytb2026-08-181-3/+5
|
* switch aarch64 CPU feature detection to elf_aux_info()naddy2026-08-081-63/+19
| | | | | | | ok kettenis@ tb@ Restore commit; install media build error is not reproducible (deraadt@) or was operator error (naddy@)
* Restore the OCSP no-check extension methodkenjiro2026-08-072-2/+5
| | | | | | | | | The conversion of X509V3_EXT_get_nid() from a table to a switch omitted the OCSP no-check extension method. Add the missing accessor declaration and switch case. ok tb@
* revert switch to elf_aux_info(); it breaks the install medianaddy2026-08-071-19/+63
|
* OBJ_create: OBJ_add_objects -> OBJ_create_objectstb2026-08-051-2/+2
|
* Remove documentation of OBJ_add_object(3)tb2026-08-051-39/+14
| | | | | | | | | | | | | This API was removed a long time ago but I forgot to update the manpage (probably because doing so is slightly non-trivial). There's still a lot of API here that should be removed. OBJ_add_objects() seems now unused while OBJ_new_nid() is used by the one consumer that is single-handedly responsible for at least two dozen APIs that could otherwise be removed from libcrypto with significant simplifications: security/xca. It would appear the author is on a quest to figure out how to make use of whatever undocumented garbage they can find in the openssl headers. That's of course a hobby project you can pursue for decades.
* switch aarch64 CPU feature detection to elf_aux_info()naddy2026-08-041-63/+19
| | | | ok kettenis@ tb@
* Make file-local functions statickenjiro2026-07-315-16/+16
| | | | | | | These functions are only used within their implementation files and do not need external linkage. Mark them static. ok tb
* Remove unused BUF_reverse()kenjiro2026-07-311-22/+1
| | | | | | | BUF_reverse() has no callers and is not part of the public API. Remove the unused function, which also eliminates its -Wmissing-prototypes warning. ok tb beck
* Add missing internal header includeskenjiro2026-07-3125-25/+60
| | | | | | | | | Include the relevant internal headers in implementation files that define internal functions. Also make asn1_local.h and pkcs12_local.h self-contained by including their corresponding public headers. ok tb beck
* Unlock CRYPTO_LOCK_UI on ui_open_session() failuretb2026-07-251-3/+5
| | | | | | | | | | | | | | | | | | | | | Both ui_open_session() implementations, open_console() in ui_openssl.c in base, and the one in ui_openssl_win.c in portable, grab the lock of type CRYPTO_LOCK_UI before doing anything else. The only internal (and, as far as I can tell, the only existing) caller, UI_process(), returns immediately on failure. The calling thread thus keeps holding the lock and the next call to UI_process() will block indefinitely. Fix this by using the common exit path, which calls ui_close_session() aka close_console(), both implementations of which release the lock. Thanks to Kartik (@sage-mode-hunter) who proposed an alternative fix for ui_openssl_win.c, which we would have to apply to ui_openssl.c as well. Matches OpenSSL behavior since PR #2037 Closes https://github.com/libressl/portable/pull/1334 ok kenjiro
* Improve SHA-3 performance.jsing2026-07-221-37/+281
| | | | | | | | | | | Replace the tiny-sha3 keccakf implementation with an unrolled and interleaved algorithm, that is hidden away in an obsolete reference implementation. This gets us 3.3x speed up on arm64 (Apple M2), a 1.3x speed up on amd64 (Intel i7-1165G7) and 6x speed up on sparc64 (M3000). ok tb@
* Remove redundant BIO_write() length assertions in b64_write()kenjiro2026-07-171-3/+1
| | | | | | | | | b64_write() asserted that BIO_write() does not return more bytes than requested in two places. Other BIO_write() call sites do not make this check, and there is no special handling here that depends on asserting this condition. ok tb@ beck@ joshua@
* Fix X.509 constraints URI host parsing.jsing2026-07-141-29/+72
| | | | | | | | | | | | | | | An authority in a URI is only terminated by a slash, question mark or hash, however the current code also included colons. This allows a specically crafted userinfo to bypass name constraints host checks. Additionally, IPv6 literals may only be specified when enclosed with square brackets, which is not enforced. Rewrite parts of the host and IP parsing code to be more strict, fixing both of these issues in the process. Thanks to Jack Lloyd for reporting the userinfo bypass. ok tb@
* correspondigly -> correspondinglytb2026-07-131-1/+1
|
* x509_vfy: sync get_crl_sk() with BoringSSL and OpenSSLtb2026-06-261-6/+18
| | | | | | | | | | | | Among CRLs with the same score prefer the one with the most recent lastUpdate (RFC 5280 thisUpdate). This pulls in OpenSSL commits 626aa248, e032117d, 8b7c51a0 from 2016, so before the license change. This uses the annoying ASN1_TIME_diff() API, but there is no better way, really. Every other ASN1_TIME API will be just as awkward. This fixes the currently failing x509_crl test cases. ok kenjiro
* Add OIDs for CCR, ErikIndex, ErikPartition, CommunityDefinitionjob2026-06-252-0/+10
| | | | | | | | | References: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-ccr https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-erik-protocol https://datatracker.ietf.org/doc/html/draft-ietf-grow-yang-bgp-communities OK tb@
* crl_cb(): fix EXFLAG_CRITICAL mishandlingtb2026-06-231-2/+2
| | | | | | | | | The EXFLAG_CRITICAL should be set on encountering a critical CRL extension unsupported by the library. The current loop does the opposite: it stops looking as soon as it finds the first critical extension the library supports... ok kenjiro
* x509_vfy: make a NULL check explicittb2026-06-221-2/+2
|
* x509_vfy: remove unnecessary NULL checks before freetb2026-06-221-7/+4
| | | | looks good to claudio
* x509_vfy: another function pointer argument causing shadowing issuestb2026-06-221-3/+3
|
* bio_meth: rename function pointer arguments to avoid stdio.h shadowingtb2026-06-221-9/+9
|
* conf_api: remove a bunch of redundant parenthesestb2026-06-221-13/+14
|
* x509_verify: fix incorrect purpose check in the non-legacy pathtb2026-06-101-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | If a purpose is configured on the verify context (which it currently never is), this check would only accept certificates for which the purpose check fails. Also, this code is not currently reachable from public API since x509_verify() is only ever called with a legacy xsc set on the verify ctx, so x509_verify_ccert_extensions() takes the path returning 1 earlier. X509_check_purpose() is one of these strange legacy APIs. It returns -1 on error, 0 if the cert fails the purpose check, 1 if it passes it and values between 2 and 5 indicate various legacy garbage meaning that the cert might possibly have been fit for this purpose until around a quarter century ago. While for CA certs the checks in "No we don't care about ..." exclude return values > 1, it is still possible for the S/MIME purpose to return 2 due to a workaround for some buggy NS certs, for example. In short: anything but 1 means unfit for the purpose or at best dubious, so reject such certs. Reported by Frank Denis ok kenjiro
* Avoid freeing a caller-owned buffer in PKCS7_verify()tb2026-06-091-7/+7
| | | | | | | | If a PKCS#7 S/MIME message comes with an empty set of digestAlgorithms in the SignedData, PKCS7_verify() would incorrectly free a caller-owned buffer. Fix the freeing logic to avoid this situation. From Igor Ustinov via OpenSSL
* Add some missing bounds checks to ASN1_mbstring_copy()tb2026-06-091-3/+20
| | | | | | | | | | | | | If the in string is unreasonably long, assigning strlen(in) to an int may overflow, so exclude this situation. Moreover, the code would unconditionally multiply nchar by 2 or 4, which could again overflow an int. Check for this situation and error out to avoid an out of bounds write. More may be needed in here, which will be revisited later. Based on a diff by Viktor Dukhovni via OpenSSL.
* Avoid out-of-bounds read in CMS password-based decryptiontb2026-06-091-1/+5
| | | | | | | | | | The RFC 3211 PWRI integrity check when unwrapping the password-derived key accesses seven bytes from a heap-allocated buffer. If an (invalid) block cipher with short blocks is in use 2 * blocksize may not be sufficient room for 7 bytes. In that silly case, the function performs an OOB read. Add length check to avoid this situation From Igor Ustinov via OpenSSL.
* Avoid NULL dereference in password-based CMS decryptiontb2026-06-091-1/+5
| | | | | | | | The keyDerivationAlgorithm field is OPTIONAL in the ASN.1 but required for password-based CMS. Check that the field is present before using it to avoid a crash. From Igor Ustinov via OpenSSL
* ecdh: add error codes for point at infinity/not on curvetb2026-06-091-3/+7
| | | | | | | | The point at infinity would previously raise EC_R_POINT_AT_INFINITY via EC_POINT_get_affine_coordinates(). For consistency, also raise an error for off-curve points. pointed out by/ok kenjiro
* Fix strange error check in EC_POINT_get_affine_coordinatestb2026-06-091-2/+2
| | | | | | EC_POINT_is_at_infinity() has a Boolean return nowadays, so drop > 0. ok jsing kenjiro
* Add a point at infinity check to ecdh_compute_key()tb2026-06-081-1/+4
| | | | | | | | | | | | | | While we already check that the peer's public point is on the curve and will reject the point at infinity when getting the affine coordinates, doing this earlier avoids doing work with the private key in a clearly invalid case. Suggested by Lucca Hirschi et al. [An EC_KEY_check_key() call was also suggested but this is a bit expensive and punishes callers that do that or equivalent already (e.g. ssh)] ok jsing kenjiro
* ec_convert: point_conversion_t -> point_conversion_form_t in a commenttb2026-06-071-3/+3
|
* remove '#undef _' added for Windows CEjsg2026-05-191-5/+1
| | | | ok jsing@ tb@
* libcrypto/ui: mechanically rename the union _ into utb2026-05-191-29/+29
| | | | | | | | | | | | While mainstream OS use compilers that understand anonymous unions, which would be cleaner here, some special snowflakes rely on LibreSSL in their stacks and they sometimes use very old and special compilers. There is no need to impose a burden on them. There is far more impactful and important cleanup that could be done in the ui pit. This obviates jsg's upcoming removal of a windows-ce workaround. discussed with jsing
* libcrypto/ui: move ui_string_st to ui_lib.c. It's only used there.tb2026-05-192-35/+35
|
* x509_addr: do not call memcmp() on NULLtb2026-05-181-5/+5
| | | | | | | | | | | | | | | | If the minimum length is 0, either a->data or b->data could be NULL, so do not call memcmp() and let the length comparison decide. Doing it this way preserves the RFC 3779, section 2.2.3.3 semantics and avoids the UB. A valid IPAddressFamily has an addressFamily element of 2 or 3 octets: 2 octets for the AFI and 1 octet for the optional SAFI. The check as it is written compares the AFIs and, if they're equal, lets absent SAFI be smaller than any other SAFI. So IPv4 (0x0001) sorts before IPv4 unicast (0x000101) and that in turn sorts before IPv6 (0x0002). Found by beck while breaking OpenSSL ok kenjiro
* x509_prn: zap more than useless commentstb2026-05-161-8/+1
|
* x509_prn: hoist unknown_ext_print() above its only caller; drop prototypetb2026-05-161-29/+25
|
* asn1_print_obstring_ctx: cast to const char * rather than char *tb2026-05-161-2/+2
| | | | Another call to BIO_dump_indent() that cast away const for no good reason.
* unknown_ext_print: avoid casting away consttb2026-05-161-2/+2
| | | | | | | | | The BIO_dump_indent() API masterpiece expects a const char pointer as input. Don't cast away const when suppressing pointer sign warnings. Prompted by a report by N. Dossche ok kenjiro
* Ensure X509V3_EXT_print() only returns 0 and 1tb2026-05-161-3/+3
| | | | | | | | | | | | | | | | | | | In a rare mistake by schwarze, X509V3_EXT_print() is documented to return 0 and 1. This is also what most internal callers expect. However, if either X509V3_EXT_DUMP_UNKNOWN or X509V3_EXT_PARSE_UNKNOWN is set, the extension has an unknown NID or on failure to deserialize the extension value, the return values of BIO_dump_indent() (which is number of bytes written or -1 on error) and ASN1_parse_dump() (which is 0, 1, or 2 on EOC) are propagated. Follow what OpenSSL did and translate to Boolean returns. Error indicators are rather useless here since most errors are ignored anyway. Most callers do if (!X509V3_EXT_print(...)) but they also pass a zero flag. Reported by N. Dossche ok kenjiro
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-09-08 06:04:17 +0000