summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Fix a few more leaks in *_print() functions.tobhe2022-11-102-14/+28
| | | | ok jsing@
* Move bn_prime.h to the public domain.tb2022-11-101-57/+4
| | | | | | It's entirely trivial. ok beck
* Start migrating to one source file per line.joshua2022-11-091-18/+83
| | | | ok jsing@ tb@
* Sync CBS_strdup() documentation update from libcrypto.jsing2022-11-091-6/+4
|
* Move table in bn_primes.h to a .c file and get rid of prime_ttb2022-11-095-335/+292
| | | | | | | This way we deduplicate two inclusions of the same big table and eliminate lots of stupid casts. input and ok many
* Fix up indentation for EVP_PKEY_* defines.jsing2022-11-091-19/+19
|
* Revise CBS_strdup() documentation.jsing2022-11-091-6/+4
| | | | | | | CBS_strdup() now internally checks if the data contains NUL, failing if it does. Prompted by beck@
* Clean up EVP_PKEY_METHOD related tables and code.jsing2022-11-091-56/+41
| | | | | | | This is effectively the same as done for EVP_PKEY_ASN1_METHOD, although this table only has nine entries. ok tb@
* Clean up EVP_PKEY_ASN1_METHOD related tables and code.jsing2022-11-091-87/+52
| | | | | | | | | | | Rather than messing around with an OBJ_bsearch() for a table that contains 16 entries (and a stack find for any application added methods), simply do a reverse linear scan. This maintains the application method first behaviour, while removing a chunk of code. While here rename some variables and do some style clean up. ok tb@
* Make X25519_public_from_private() internally reachable.jsing2022-11-092-5/+8
|
* Rename public_value to public_key for consistency.jsing2022-11-091-9/+9
| | | | ok tb@
* Rework ED25519 API.jsing2022-11-093-45/+40
| | | | | | | | | | | BoringSSL implemented a compound private key, which includes a copy of the public key as a performance optimisation for signing. However, this does not readily match with how EVP works, makes the ED25519 API inconsistent with the X25519 API, diverges from th RFC and does not align with the OpenSSL API. Instead, the caller can readily compute the public key and pass this in to the signing process. ok tb@
* Sort EVP_PKEY_METHOD externs.jsing2022-11-091-5/+10
|
* Sort EVP_PKEY_ASN1_METHOD externs.jsing2022-11-091-6/+6
|
* Inline use of bn_is_prime_bpsw()tb2022-11-091-24/+20
| | | | | | | | | Instead of using the BN_is_prime_fasttime_ex() API, use a direct call to bn_is_prime_bpsw(). This increases readability and simplifies error handling. Also put a division by two to the natural place now that we no longer need to do Miller-Rabin rounds. ok beck jsing
* Next pass of bn_prime.c cleanuptb2022-11-091-39/+29
| | | | | | | Garbage collect a few pointless variables and remove a loop that wasn't really a loop. Simplify BN_CTX handling and drop some stupid comments. ok jsing miod
* Drop some dead codetb2022-11-091-136/+1
| | | | ok jsing
* Fix possible memory leak in BN_mpi2bn() if BN_bin2bn() fails.tobhe2022-11-091-3/+7
| | | | | | found with CodeChecker feedback from millert@ ok tb@
* In case lh_OBJ_NAME_insert returns NULL due to a failed malloc, onpmbuhl2022-11-081-1/+2
| | | | | | is leaked in OBJ_NAME_add. ok tb Found by CodeChecker.
* Rename out to err to conform with standard naming scheme.tobhe2022-11-081-4/+4
|
* Fix leak of pk if EVP_PKEY_set1_DSA() fails.tobhe2022-11-081-5/+9
| | | | | Found with CodeChecker ok jsing@
* Refactor/split ED25519_keypair.jsing2022-11-082-16/+24
| | | | | | This brings in ED25519_keypair_from_seed() from BoringSSL commit c034e2d3ce16, which ED25519_keypair then wraps. This reduces differences between us and BoringSSL.
* Change function argument to reduce differences with BoringSSL.jsing2022-11-081-2/+2
|
* Remove pointless loops.jsing2022-11-081-13/+1
| | | | From BoringSSL 997c706d43504.
* Avoid signed integer overflow in i2c_ASN1_BIT_STRING()tb2022-11-081-5/+9
| | | | | | | | | If the length of the bitstring is INT_MAX, adding 1 to it is undefined behavior, so error out before doing so. Based on BoringSSL eeb3333f by davidben ok beck joshua
* Add missing $OpenBSD$beck2022-11-081-0/+1
|
* Fix leak of pk if EVP_PKEY_set1_RSA() fails.tobhe2022-11-081-5/+9
| | | | | Found with CodeChecker feedback and ok tb@
* Replace the old OpenSSL julian date stuff with BoringSSL'sbeck2022-11-087-326/+289
| | | | | | | | | | | | OpenSSL dealt with time conversion using a classical julian day scheme. BoringSSL got rid of it and uses only a julian style calculation for seconds since the POSIX time epoch. This changes libressl to use the seconds calculation exculusively instead of a mix of the julian day based conversions and the system time conversions to and from time_t to tm. ok tb@ jsing@
* White space KNF, no code change:schwarze2022-11-071-15/+12
| | | | | | | - line breaking and indentation in three struct declarations - removal of trailing whitespace Found while working on /usr/src/regress/lib/libcrypto/man/check_complete.pl . OK tb@
* Rewrite TLSv1.2 key exporter.jsing2022-11-075-96/+163
| | | | | | | Replace the grotty TLSv1.2 key exporter with a cleaner version that uses CBB and CBS. ok tb@
* Move tls13_exporter() code.jsing2022-11-072-72/+73
| | | | | | | It makes more sense to have tls13_exporter() in tls13_key_schedule.c, rather than tls13_lib.c ok tb@
* Document that OPENSSL_free() is required in some circumstancestb2022-11-061-2/+6
| | | | | | | | | | BoringSSL uses the common trick of storing malloc metadata in a prefix and then returning a pointer with an offset. Therefore callers must not call free() but OPENSSL_free(). Reported by dropk1ck via tobhe ok beck jsing
* Enable Ed25519 internal to libcrypto.jsing2022-11-062-15/+44
| | | | Based on a diff from tb@
* Remove useless ancient files.jsing2022-11-064-74/+0
| | | | ok beck@ tb@
* In __cxa_atexit(), there is no need to initialize local pointer beforederaadt2022-10-221-2/+2
| | | | | the lock, when it is correctly initialized after the lock ok otto millert
* Add extra NULL check after ssl3_setup_read_buffer()tb2022-10-211-2/+5
| | | | | | | | | | While ssl3_setup_read_buffer() success alone is enough to imply that the read bufer is non-NULL, several static analyzers fail to recognize that and throw fits about possible NULL accesses. CID 331010 Fix from and ok jsing
* Add EVP_chacha20_poly1305()tb2022-10-211-1/+4
| | | | | | Omission reported by jca. ok jca jsing
* Initial parsing of the NewSessionTicket messagetb2022-10-201-2/+103
| | | | | | | | | | | | | | | | | | | | TLSv1.3 introduces a New Session Ticket post-handshake handshake message that allows a unique association between a ticket value and a pre-shared key derived from the resumption master secret. Servers may send this message arbitrarily often at any time after receiving the client's Finished message. Implement tls13_new_session_ticket_recv() which parses the contents of the NewSessionTicket message into a fresh session derived from the current session so as to avoid modifying sessions that are already in the session cache. This uses tls13_new_session_ticket_recv() in tls13_phh_received_cb(). We currently rely on the general rate limiting of 100 PHH messages per connection and hour to avoid problems from connecting to a misbehaving or malicious server. ok jsing
* Provide TLS13_MAX_TICKET_LIFETIME #definetb2022-10-201-1/+8
| | | | | | | | TLSv1.3 servers must not indicate a lifetime longer than 7 days and clients must not cache sessions for longer than 7 days. Encode this in a macro internal to tls13_lib.c for now. ok jsing
* Provide ssl_session_dup()tb2022-10-202-2/+108
| | | | | | | | SSL_SESSION_dup() is a currently essentially unused public OpenSSL 1.1.1 API. Add a version that does not duplicate the secrets for internal use. If the public API should be needed, we can easily make it a wrapper. ok jsing
* Clean up resumption master secret in SSL_SESSION_free()tb2022-10-201-1/+3
| | | | ok jsing
* Extend SSL_SESSION struct for TLSv1.3 PSKtb2022-10-201-2/+4
| | | | | | | | Add members necessary to store the "ticket_age_add" value and the resumption master secret needed in the TLSv1.3 version of session resumption. ok jsing
* Annotate misuse of EVP_Digest()tb2022-10-201-1/+2
| | | | | | | | | | The session_id member of SSL_SESSION has 32 bytes for historical reasons. This precisely accommodates a SHA-256 and is currently computed using this hash. If the hash function is ever changed, this will likely overflow. This should be fixed in code. Leave it at an XXX comment for now. Pointed out by jsing
* Store errors that result from leaf certificate verification.jsing2022-10-171-8/+12
| | | | | | | | | | | | | | | In the case that a verification callback is installed that tells the verifier to continue when a certificate is invalid (e.g. expired), any error resulting from the leaf certificate verification is not stored and made available post verification, resulting in an incorrect error being returned. Also perform leaf certificate verification prior to adding the chain, which avoids a potential memory leak (as noted by tb@). Issue reported by Ilya Shipitsin, who encountered haproxy regress failures. ok tb@
* Avoid potential divide by zero in BIO_dump_indent_cb()jsing2022-10-171-8/+7
| | | | | | | | | | | | | Passing an indent value of 67 results in DUMP_WIDTH_LESS_IDENT returning a value of zero, which is promptly used for division. Likewise, passing a value larger than 67 results in a negative value being returned. Prevent this by limiting indent to 64 (which matches OpenSSL's current behaviour), as well as ensuring that dump_width is > 0. Should fix oss-fuzz #52464 and #52467. ok miod@ tb@
* Unbreak ASN.1 indefinite length encoding.jsing2022-10-171-4/+4
| | | | | | | | | | | In r1.25 of tasn_enc.c a check was added to ensure that asn1_ex_i2c() returned the same value on both calls, however in the ndef case the len variable gets changed between calls. Keep a copy of the original value to test against. Issue reported by niklas, who encountered a test failure in rust-openssl. ok miod@ tb@
* Error out if the out secret wasn't properly initializedtb2022-10-141-2/+6
| | | | | | | | Calling HKDF_expand() with a length of 0 happens to succeed due to a quirk in the API inherited from BoringSSL. This hides caller-side errors during development. Error out to catch such mistakes early on. ok jsing
* put the malloc_readonly struct into the "openbsd.mutable" section, soderaadt2022-10-141-2/+3
| | | | | that the kernel and ld.so will know not to mark it immutable. malloc handles the read/write transitions by itself.
* Fix path of mentioned regress testtb2022-10-111-2/+2
|
* unwrap two lines for readabilitytb2022-10-051-5/+3
|