summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove STABLE_FLAGS_MALLOCtb2025-12-312-5/+5
| | | | | | | | | | Formerly used by ASN1_STRING_TABLE_{add,cleanup}() which were removed two years ago. Annotate why STABLE_NO_MASK stays: as usual, security/xca ends up being the sole consumer of some nonsense. Apparently it needs its own reimplementation of ASN1_STRING_set_by_NID(), another removable public API that should never have been exposed. ok kenjiro
* Require SSE in order to use gcm_{gmult,ghash}_4bit_mmx().jsing2025-12-311-2/+2
| | | | | | | | Contrary to naming, the '"June" MMX version' of gcm_ghash_4bit_mmx() uses SSE, while the 'pure-MMX "May" version' does not. This detail got missed when I was untangling OPENSSL_IA32_SSE2. Found the hard way by Tate Baldwin and Dennis Camera.
* Provide CRYPTO_CPU_CAPS_I386_SSEjsing2025-12-312-3/+6
|
* Use group method on point_{set_to,is_at}_infinity()tb2025-12-261-3/+3
| | | | All other public APIs call group->meth->... not point->meth->...
* Add compatibility check to EC_POINT_mul()tb2025-12-261-1/+7
| | | | | | | This is the only public API that doesn't check for compatibility between group and point. Add the missing check. ok jsing kenjiro
* Replace group->meth != point->meth checkstb2025-12-263-17/+21
| | | | | | | | | The method will currently always be identical since all groups use the EC_GFp_mont_method(). Use the ec_group_and_point_compatible() check to ensure this and if both group and point have a nid set, check that they are identical. ok jsing kenjiro
* Add ec_group_and_point_compatible() helpertb2025-12-262-2/+13
| | | | | | | Check that a given group and point are reasonably compatible. First see if they use the same method. Compare nids if both have nid != NID_undef. ok jsing kenjiro
* Add nid to EC_POINT for compat checkingtb2025-12-262-2/+6
| | | | | | | | It is annoying that an EC_POINT does not really know on what EC_GROUP it lives. Adding a refcount to EC_GROUP is slightly tricky, so instead use a nid which we will know unless the group was constructed by hand. ok jsing kenjiro
* X509_NAME_ENTRY_set_data: remove redundant parenthesestb2025-12-211-6/+6
|
* X509_NAME_ENTRY_set_data(): garbage collect unnecessary itb2025-12-211-5/+2
|
* Garbage collect V_ASN1_APP_CHOOSEtb2025-12-211-2/+1
| | | | ok kenjiro
* Stop documenting V_ASN1_APP_CHOOSE quirktb2025-12-212-22/+4
| | | | ok kenjiro
* X509_NAME_ENTRY_set_data: remove V_ASN1_APP_CHOOSE quirktb2025-12-211-7/+4
| | | | | | | This is the last remaining actual use of ASN1_PRINTABLE_type(), which will go away in the next major bump. ok kenjiro
* stack: switch data from char ** to void **tb2025-12-212-15/+15
| | | | ok jsing kenjiro
* conf_api: remove CONF_DEBUG and disabling of assert()tb2025-12-211-6/+1
| | | | | | | The only thing CONF_DEBUG has done in ages is defining NDEBUG in a file that does not contain a single assert. Kill it. ok jsing kenjiro
* conf_api: add empty line between !openssl and openssl includestb2025-12-201-1/+2
|
* conf_api: remove a few rather useless history tidbitstb2025-12-201-5/+1
|
* This function have -> This function hastb2025-12-201-2/+2
|
* These function -> These functionstb2025-12-201-3/+3
|
* This functions -> This functiontb2025-12-203-9/+9
|
* pkcs7: add PKCS7_NO_DUAL_CONTENT flag/behaviortb2025-12-203-12/+27
| | | | | | | | | | | | | What Netscape fucked up just had to be embraced by secure boot and other nonsense. First OpenSSL wanted to be strict (which we inherited) then Rich Salz Postel-ized this and made OpenSSL bypass this check by default and added a flag to be strict 10 years ago. Now sthen found that PHP 8.5 uses/exposes this flag. Follows OpenSSL 6b2ebe43 (2016) ok kenjiro
* BN_get_word(): return (BN_ULONG)-1 on error rather than BN_MASK2tb2025-12-153-7/+7
| | | | | | | | While the latter is more general in that it also works on 1-complement achitectures, we don't care about that. Adjust documentation and the only error check for it in libcrypto. ok deraadt
* x509.h: add missing spaces after ,tb2025-12-111-63/+63
|
* Remove last internal use of ASN1_STRING_data()tb2025-12-071-13/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | PKCS5_pbe_set0_algor() is no longer public, but its parameters are provided directly via public API, namely the wonderful PKCS8_encrypt() and PKCS12_pack_p7encdata(). Muppetry abounds. To wit: If saltlen < 0, the call to ASN1_STRING_set(pbe->salt, NULL, saltlen) would error. Let's do that up front in a more obvious way. We don't care about side-effects to pbe->salt since we free it on error anyway. If saltlen == 0, we default it to PKCS5_PBE1_SALT_LEN. This is particularly funky in case the caller passed in salt != NULL, in which case we can only hope and pray this buffer is long enough. If the caller passed a salt, copy it to pbe->salt via ASN1_STRING_set(). If there's no salt, allocate a buffer of the appropriate length, fill it with random and transfer ownership to pbe->salt via ASN1_STRING_set0(). There's a change of behavior in that this will not be NUL-terminated (why should it be?). If we wanted to preserve behavior, we'd just use calloc(1, saltlen + 1) instead of the malloc(). The exit path is quite special, too, but I didn't want to change this right now. tweaks/ok kenjiro
* libcrypto: remove BN_{DEC,HEX}_FMT1tb2025-12-051-5/+1
| | | | It appears that these were only ever used in bn_test.c...
* Replace trivial uses of ASN1_STRING_data()tb2025-12-055-13/+13
| | | | | | | | | Almost entirely mechanical diff that ensures that for read-only accesses we use the const correct ASN1_STRING_get0_data(). Arguably, in most places the better fix would be to reach into ASN1_STRING but then we have to think and bikeshed... ok beck kenjiro
* libcrypto: make most of the BN_* macro pollution internaltb2025-12-055-31/+29
| | | | | | | | | This is a first sweep of reducing the number of terribly named macros in bn.h More can go away. Those we need internally go to bn_local.h. Annoyingly bn_internal.h uses some of them, so it includes bn_local.h now. This can be cleaned up later. ok jsing kenjiro
* Clean up confusing logic in CMS_EncryptedData_encrypt()tb2025-11-281-15/+20
| | | | | | | | This makes it easier to read and more in line with other code in libcrypto. Also add a missing error check for the CMS_set_detached() call. ok jsing kenjiro
* Fix double free in certificate policies configurationtb2025-11-281-12/+7
| | | | | | | | In nref_nos(), nnums must not be freed on error because in the caller it is not->noticeref->noticenos and hangs off the POLICYQUALINFO qual which is freed as part of POLICYQUALINFO_free() in the error path. ok jsing kenjiro
* libcrypto: add header guards to *_local.htb2025-11-269-9/+54
| | | | | | | | | An upcoming change requires the inclusion of asn1_local.h in x509_local.h which doesn't work due to missing header guards. Add guards to all local headers that don't have them, although reacharounds and multiple inclusions are unlikely to occur for most of those. ok jsing
* Correct the MLKEM hybrid objects values.beck2025-11-192-8/+5
| | | | | | | | | | | | | The ietf has had a bunch of back and forth over what will happen here. in the end the previously mentioned draft will not include the TLS hybrids, so we change this to use reference the correct draft for TLS, and use the same name everyone else is using, without an OID. While we will probably end up needing the *other* hybrids for things like CMS, we will bring them in when we need them and have official OID values from IANA. ok tb@
* sync cert.pem with updated Mozilla list; ok tb@sthen2025-11-171-1/+237
| | | | | | | | | | | | | | | | | | changes are: +OISTE Foundation + /C=CH/O=OISTE Foundation/CN=OISTE Server Root ECC G1 + /C=CH/O=OISTE Foundation/CN=OISTE Server Root RSA G1 SwissSign AG /C=CH/O=SwissSign AG/CN=SwissSign Gold CA - G2 + /C=CH/O=SwissSign AG/CN=SwissSign RSA TLS Root CA 2022 - 1 TrustAsia Technologies, Inc. /C=CN/O=TrustAsia Technologies, Inc./CN=TrustAsia Global Root CA G3 /C=CN/O=TrustAsia Technologies, Inc./CN=TrustAsia Global Root CA G4 + /C=CN/O=TrustAsia Technologies, Inc./CN=TrustAsia TLS ECC Root CA + /C=CN/O=TrustAsia Technologies, Inc./CN=TrustAsia TLS RSA Root CA
* bn_prime.c: fix includestb2025-11-081-3/+4
|
* move the sentence about X509_VERIFY_PARAM_get_hostflags(3)schwarze2025-11-071-6/+7
| | | | | | to the right section and mention the value returned if X509_VERIFY_PARAM_set_hostflags(3) was never called; OK tb@ kenjiro@
* Use 64 bit BN_ULONG on 64 bit Windows platforms.jsing2025-11-071-2/+2
| | | | | | | | 64 bit Windows is a special LLP snowflake and it is currently incorrectly using 32 bit BN_ULONG, since _LP64 is not defined. Enable 64 bit BN_ULONG if _LP64 or _WIN64 is defined. ok tb@
* Use BN_ULONG in probable_prime_dh()tb2025-11-061-2/+2
| | | | | | | | | This was the last user of BN_LONG in code. It had no reason to do so. BN_mod_word() returns a BN_ULONG and since the largest prime in the small primes table primes[] is well below 20000, the only return value that could cause 'mod' to be negative was the error sentinel (BN_ULONG)-1. ok jsing kenjiro
* Use more specific types for BN.jsing2025-11-051-27/+29
| | | | | | | | | | | Be specific about width and use uint64_t/uint32_t, rather than using unsigned int/long/long long, based on platform. Additionally use UINT64_C() and UINT32_C() for constants, along with PRI*64/PRI*32 for formatting. This makes the platform responsible for providing the correct types/defines - all we then need to do is determine is if BN should use a 32 bit or 64 bit configuration. With input from and ok tb@
* In nref_nos() don't leak the ASN1_INTEGER if the push failstb2025-11-031-2/+4
| | | | | | | (A much bigger problem here is a double free for which I will send out a diff shortly) From Niels Dossche
* x509_cpols: pass correct free function to sk_ASN1_INTEGER_free()tb2025-11-031-2/+2
| | | | from Niels Dossche
* x509_cpols: indent labels to make diffs more readabletb2025-11-031-8/+8
|
* Plug memeory leak in CMS_EncryptedData_encrypt()tb2025-11-031-2/+4
| | | | | | If CMS_EncryptedData_set1_key() fails, cms is leaked. From Niels Dossche
* ec_curve: Remove outdated creditstb2025-11-021-4/+1
|
* des_key: add missing hyphen in semi-weak keystb2025-10-271-2/+2
| | | | From Thorsten Blum
* bump lib{crypto,ssl,tls} minors after symbol additiontb2025-10-241-1/+1
|
* Document X509_VERIFY_PARAM_set_hostflags(3)tb2025-10-241-2/+15
| | | | ok kenjiro
* Expose X509_VERIFY_PARAM_get_hostflags()tb2025-10-244-4/+7
| | | | | | | | | | | | | | This is needed by Python 3.14, extending the urllib3 nonsense further. This is a trivial getter and it is exercised by the libssl unit test I added for urllib3 (which can now use dynamic linking for libcrypto). Fixes https://github.com/libressl/portable/issues/1202 Thanks to @orbea for the report. ok kenjiro PS: X509_VERIFY_PARAM_get_flags() and X509_VERIFY_PARAM_get_peername() aren't const correct. Fixing this will require some doing...
* const correct X509_VERIFY_PARAM_get_hostflags()tb2025-10-101-2/+2
| | | | | | | This is currently an internal helper only used by a regress test. We'll have to expose in the public API for Python 3.14: https://github.com/libressl/portable/issues/1202
* Remove unused sequence member from x509_revoked_sttb2025-10-102-11/+2
| | | | | | | | | | | | | | | | | To allow binary search for looking up if a cert was revoked in a CRL, the list of revoked serial numbers is sorted in crl_lookup(). On the other hand, to be able to output the DER that was actually signed by the issuer, the original order needs to be remembered. Before the encoding was cached, there was a mechanism that would restore the original order on serialization using the .sequence member. This was done without a lock and was thus racy (hilarity would ensue if one thread performed a CRL lookup while another thread serialized the same CRL). When the racy mechanism was removed in 2004, the only reader of .sequence, X509_REVOKED_seq_cmp(), was also removed, and this piece of dead code was left behind. Garbage collect it. ok kenjiro
* cms: fix incorrect length check in kek_unwrap_key()tb2025-09-301-2/+2
| | | | | | | | | | An incorrect length check can result in a 4-byte overwrite and an 8-byte overread. From Stanislav Fort and Viktor Dukhovni via OpenSSL. CVE-2025-9230. ok jsing
* cms_RecipientInfo_pwri_crypt: fix incorrect return checktb2025-09-301-3/+3
| | | | ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-02-16 03:16:28 +0000