summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
* libssl: ensure server selected ALPN was advertisedtb8 days1-6/+20
| | | | | | | | | | | | | | | Per RFC 7301, section 3.2, "In the event that the server supports no protocols that the client advertises, then the server SHALL respond with a fatal "no_application_protocol" alert. If a server does not do that and chooses a protocol that we have not advertised, we should abort the handshake. The RFC does not specify an alert for this case. BoringSSL chose illegal_parameter and OpenSSL decode_error. I slightly prefer illegal_parameter, so went with that. Reported by Acts1631 with a similar diff. ok jsing kenjiro
* tlsext_alpn_client_process(): rename list and prototb8 days1-8/+8
| | | | | | | Use server_list and selected instead of list and proto to reduce noise in the next commit. ok jsing kenjiro
* rsa_eay: Replace handrolled BN_bn2binpad with the real thingtb10 days1-19/+7
| | | | | | | | | | | | | Just a tiny little bit of lipstick on this entelodont. This is simpler and does not change behavior as BN_bn2binpad() returns -1 on failure and num on success. jsing points out that BN_bn2binpad() is constant time. ok jsing kenjiro PS: henning, you owe me a significant amount of quality beverages for making me look at this particular tire fire (and corresponding XS files).
* libcrypto: harden cms_kek_cipher() a bittb10 days1-3/+8
| | | | | | | | | | | | | | | | When AES key unwrap with padding is in use, the EVP interface breaks its contract and writes more than the outlen it initially reports to the output buffer. This is an old, sneaky trap that the muppet set eons ago and many victims walked right into it, including the muppet himself. If inlen is larger than outlen, allocate inlen bytes to unwrap with padding to avoid a buffer overwrite. This is a variant of OpenSSL's fix. Since we do not support AES keywrap with padding no actual bufer overwrite occurs here at the moment, but if we ever chose to do so (unlikely) this trap would be avoided. There's plenty more traps that the next round of scas will surely find in this absolute trashfire of CMS support code. ok kenjiro
* Don't drop X509_V_ERR_HOSTNAME_MISMATCH when verify callback returns 1beck10 days1-2/+5
| | | | | | | | | | | | | While not the advised way of using the verify callback (either by OpenSSL or by us) in production, sometimes folks like to return 1 from everything in the callback and then check the error return and make decicions about things. This fix ensures that such callbacks will see the hostname mismatch and be able to act upon them. Reported by Alexander Aleksandrovic Klimov ok tb@
* fix a double word; ok tb@jsg11 days1-3/+3
|
* ICBB -> ICDBjsg12 days1-3/+3
|
* grammar; a -> anjsg12 days7-21/+21
| | | | ok schwarze@ sthen@ krw@
* Make deprecation of ASN1_STRING_data(3) more prominenttb14 days1-19/+22
| | | | | | | | | | | | | | | | | | | | The function has been deprecated for a long time: OpenSSL did so when adding ASN1_STRING_get0_data in 1.1.0. beck removed it from OpenSSL 4. The reason is that it returns a modifiable "string" and you should not be modifying an ASN1_STRING this way. You should be using one of the clumsy, inconvenient accessors. schwarze merged the deprecation when adding documentation for ASN1_STRING_get0_data() in 2018. Make this a bit more obvious: move function to the end of the documented functions in this page, and mark it deprecated in the SYNOPSIS, too. I'm aware that deprecation does not work. I was hopeful to be able to remove the function in the last cycle, but that did not happen and it might not happen in this cycle either. It will happen at some point, though. Prompted by a question by brad
* grammar; an program -> a programjsg14 days1-3/+3
|
* document MALLOC_OPTIONS=D output; OK otto@schwarze2026-08-221-2/+72
|
* Change RFC references from 8446 to 9846 and adjust section numberstb2026-08-2119-99/+97
| | | | with/ok kenjiro
* SSL_get_finished: remove comment about TLSv1.0 and TLSv1.1tb2026-08-211-4/+2
| | | | ok kenjiro
* Simplify handling of remaining record content on switch to legacy stack.jsing2026-08-211-35/+13
| | | | | | | | Now that the legacy stack uses struct tls_content, store any remaining record content directly, rather than fudging up a record that the legacy stack will process on the next read. ok kenjiro@ tb@
* Allocate TLS 1.3 receive buffers lazilykenjiro2026-08-211-14/+7
| | | | | | | | | | | | The receive buffer is not used for records created for sending. Avoid allocating a maximum-sized buffer in tls13_record_new() and instead allocate a header-sized buffer when tls13_record_recv() is first called. The buffer will grow as needed once the record length is known. This avoids an unnecessary allocation for outgoing records and reduces the initial allocation size for incoming records. ok tb jsing
* update cert.pem based on newer mozilla ca root store, ok tb@sthen2026-08-201-198/+192
|
* s2i_ASN1_INTEGER.3: mark up second use of usr_data for consistencytb2026-08-181-3/+5
|
* libssl: use correct alert for key_share without supported_groupstb2026-08-181-2/+2
| | | | | | | | | | | | | | | | Processing the key_share extension requires a supported_groups extension. RFC 9846, section 9.2 explicitly mandates a missing_extension alert in this situation, so use that instead of illegal_parameter. We do have code in tls13_client_hello_required_extensions() implementing the requirements on extensions of the relevant paragraph of that section with the corrrect alerts. The error in the extension processing happens before hitting these checks in this particular case. Reported by Tom Gouville of the tlspuffin team as part of https://github.com/libressl/portable/issues/1279 ok jsing kenjiro
* SSL_CTX_new(): fix spelling of NULLtb2026-08-141-3/+3
|
* hdestroy(3): stop freeing key valuesdaniel2026-08-102-46/+3
| | | | | | | | | | | | | | POSIX leaves ownership of ENTRY.key with the caller. Our current behaviour came from NetBSD when this code was imported in 2004. NetBSD and FreeBSD both stopped freeing key values in July 2014. NetBSD in commit fe0a1a6 and FreeBSD in commit e19f362. Remove the call to free(3) to align ourselves with NetBSD, FreeBSD and POSIX. Also adjust rsync for the change in semantics. Flagged by Sortix os-test. ok millert@, deraadt@
* switch aarch64 CPU feature detection to elf_aux_info()naddy2026-08-081-63/+19
| | | | | | | ok kettenis@ tb@ Restore commit; install media build error is not reproducible (deraadt@) or was operator error (naddy@)
* Restore the OCSP no-check extension methodkenjiro2026-08-072-2/+5
| | | | | | | | | The conversion of X509V3_EXT_get_nid() from a table to a switch omitted the OCSP no-check extension method. Add the missing accessor declaration and switch case. ok tb@
* revert switch to elf_aux_info(); it breaks the install medianaddy2026-08-071-19/+63
|
* OBJ_create: OBJ_add_objects -> OBJ_create_objectstb2026-08-051-2/+2
|
* Remove documentation of OBJ_add_object(3)tb2026-08-051-39/+14
| | | | | | | | | | | | | This API was removed a long time ago but I forgot to update the manpage (probably because doing so is slightly non-trivial). There's still a lot of API here that should be removed. OBJ_add_objects() seems now unused while OBJ_new_nid() is used by the one consumer that is single-handedly responsible for at least two dozen APIs that could otherwise be removed from libcrypto with significant simplifications: security/xca. It would appear the author is on a quest to figure out how to make use of whatever undocumented garbage they can find in the openssl headers. That's of course a hobby project you can pursue for decades.
* Add missing Dv macro for NI_NUMERICSERV and NI_DGRAMclaudio2026-08-051-4/+4
| | | | OK tb@
* switch aarch64 CPU feature detection to elf_aux_info()naddy2026-08-041-63/+19
| | | | ok kettenis@ tb@
* Make file-local functions statickenjiro2026-07-319-27/+27
| | | | | | | These functions are only used within their implementation files and do not need external linkage. Mark them static. ok tb
* Remove unused BUF_reverse()kenjiro2026-07-311-22/+1
| | | | | | | BUF_reverse() has no callers and is not part of the public API. Remove the unused function, which also eliminates its -Wmissing-prototypes warning. ok tb beck
* Add missing internal header includeskenjiro2026-07-3125-25/+60
| | | | | | | | | Include the relevant internal headers in implementation files that define internal functions. Also make asn1_local.h and pkcs12_local.h self-contained by including their corresponding public headers. ok tb beck
* Unlock CRYPTO_LOCK_UI on ui_open_session() failuretb2026-07-251-3/+5
| | | | | | | | | | | | | | | | | | | | | Both ui_open_session() implementations, open_console() in ui_openssl.c in base, and the one in ui_openssl_win.c in portable, grab the lock of type CRYPTO_LOCK_UI before doing anything else. The only internal (and, as far as I can tell, the only existing) caller, UI_process(), returns immediately on failure. The calling thread thus keeps holding the lock and the next call to UI_process() will block indefinitely. Fix this by using the common exit path, which calls ui_close_session() aka close_console(), both implementations of which release the lock. Thanks to Kartik (@sage-mode-hunter) who proposed an alternative fix for ui_openssl_win.c, which we would have to apply to ui_openssl.c as well. Matches OpenSSL behavior since PR #2037 Closes https://github.com/libressl/portable/pull/1334 ok kenjiro
* Improve SHA-3 performance.jsing2026-07-221-37/+281
| | | | | | | | | | | Replace the tiny-sha3 keccakf implementation with an unrolled and interleaved algorithm, that is hidden away in an obsolete reference implementation. This gets us 3.3x speed up on arm64 (Apple M2), a 1.3x speed up on amd64 (Intel i7-1165G7) and 6x speed up on sparc64 (M3000). ok tb@
* Remove redundant BIO_write() length assertions in b64_write()kenjiro2026-07-171-3/+1
| | | | | | | | | b64_write() asserted that BIO_write() does not return more bytes than requested in two places. Other BIO_write() call sites do not make this check, and there is no special handling here that depends on asserting this condition. ok tb@ beck@ joshua@
* Remove stale SECURE RENEGOTIATION referencekenjiro2026-07-171-5/+3
| | | | | | | | | SSL_CTX_set_options(3) no longer has a SECURE RENEGOTIATION section, but SSL_OP_LEGACY_SERVER_CONNECT still referenced it. Replace the dangling cross reference with a note that the option is no longer set by default. ok tb@ beck@
* Make dtls1_do_write_ccs() self contained.jsing2026-07-161-4/+5
| | | | | | | | A ChangeCipherSpec message is always the same single byte. Make dtls1_do_write_ccs() know how to send this message, which avoids the use of buffers and needing to keep copies for retransmission. ok kenjiro@ tb@
* Clean up sequence number and message header handling.jsing2026-07-162-26/+13
| | | | | | | | | | | dtls1_set_message_header() is only called in one place - inline the write handshake sequence number handling. Rename dtls1_set_message_header_int() to dtls1_set_message_header(). The dtls12_write_ccs() code does not use handshake sequence numbers (since they're not handshake messages) - stop pretending that it does. ok kenjiro@ tb@
* Check that the server selected ciphersuite is valid for use with TLSv1.2.jsing2026-07-151-1/+10
| | | | | | | | | | In the legacy stack, ensure that the server selected ciphersuite is valid for use with TLSv1.2 - this effectively means that it is not a TLSv1.3 ciphersuite. We currently fail the handshake, but at a later stage. Reported by Tom Gouville from the tlspuffin team. ok tb@
* Remove check for use of TLSv1.2 ciphersuites with TLSv1.1 and earlier.jsing2026-07-151-9/+1
| | | | | | | We no longer negotiate any TLS version lower than TLSv1.2, so this is now redundant. ok tb@
* Fix X.509 constraints URI host parsing.jsing2026-07-141-29/+72
| | | | | | | | | | | | | | | An authority in a URI is only terminated by a slash, question mark or hash, however the current code also included colons. This allows a specically crafted userinfo to bypass name constraints host checks. Additionally, IPv6 literals may only be specified when enclosed with square brackets, which is not enforced. Rewrite parts of the host and IP parsing code to be more strict, fixing both of these issues in the process. Thanks to Jack Lloyd for reporting the userinfo bypass. ok tb@
* correspondigly -> correspondinglytb2026-07-131-1/+1
|
* LLVM now emits calls to strlen(3) and wcslen(3). Redirect those calls tokettenis2026-06-303-5/+9
| | | | | | | our hidden aliases to prevent unnecessary PLT entries (like we already do for memmove(3), memcpy(4) and memset(3)). ok deraadt@
* x509_vfy: sync get_crl_sk() with BoringSSL and OpenSSLtb2026-06-261-6/+18
| | | | | | | | | | | | Among CRLs with the same score prefer the one with the most recent lastUpdate (RFC 5280 thisUpdate). This pulls in OpenSSL commits 626aa248, e032117d, 8b7c51a0 from 2016, so before the license change. This uses the annoying ASN1_TIME_diff() API, but there is no better way, really. Every other ASN1_TIME API will be just as awkward. This fixes the currently failing x509_crl test cases. ok kenjiro
* Add OIDs for CCR, ErikIndex, ErikPartition, CommunityDefinitionjob2026-06-252-0/+10
| | | | | | | | | References: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-ccr https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-erik-protocol https://datatracker.ietf.org/doc/html/draft-ietf-grow-yang-bgp-communities OK tb@
* Fix misleading comment in strstr(3)tim2026-06-231-2/+2
| | | | | | | From upstream musl: https://git.musl-libc.org/cgit/musl/commit?id=c53e9b239418eb3e0e8be256abd0f6ad7608bbcf OK tb@
* Avoid shift overflow in memmem(3) and strstr(3)tim2026-06-232-10/+10
| | | | | | | Fix from upstream musl: https://git.musl-libc.org/cgit/musl/commit?id=593caa456309714402ca4cb77c3770f4c24da9da OK tb@
* crl_cb(): fix EXFLAG_CRITICAL mishandlingtb2026-06-231-2/+2
| | | | | | | | | The EXFLAG_CRITICAL should be set on encountering a critical CRL extension unsupported by the library. The current loop does the opposite: it stops looking as soon as it finds the first critical extension the library supports... ok kenjiro
* x509_vfy: make a NULL check explicittb2026-06-221-2/+2
|
* x509_vfy: remove unnecessary NULL checks before freetb2026-06-221-7/+4
| | | | looks good to claudio
* SSL_alert_desc_string: update manpage after change to return "!!" alwaystb2026-06-221-39/+36
| | | | | Also change some totally unreadable roff macros to slightly less unreadable mdoc markup.
* x509_vfy: another function pointer argument causing shadowing issuestb2026-06-221-3/+3
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-09-05 23:06:05 +0000