summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Provide SSL_SESSION_dup()tb7 days4-3/+13
| | | | | | | As reported by ajacoutot and sthen, an update to net/neon is blocked on that missing symbol. ok kenjiro
* Document X509_VERIFY_PARAM_set_hostflags(3)tb7 days1-2/+15
| | | | ok kenjiro
* Expose X509_VERIFY_PARAM_get_hostflags()tb7 days4-4/+7
| | | | | | | | | | | | | | This is needed by Python 3.14, extending the urllib3 nonsense further. This is a trivial getter and it is exercised by the libssl unit test I added for urllib3 (which can now use dynamic linking for libcrypto). Fixes https://github.com/libressl/portable/issues/1202 Thanks to @orbea for the report. ok kenjiro PS: X509_VERIFY_PARAM_get_flags() and X509_VERIFY_PARAM_get_peername() aren't const correct. Fixing this will require some doing...
* Implement ffsl() and ffsll() using the compiler builtin __builtin_ctzlclaudio7 days4-11/+66
| | | | | | now that all archs use at least gcc4. ffsl() and ffsll() are now part of POSIX. OK deraadt@, input from miod@ and jsg@
* libssl: const correct the ssl_session_dup() helpertb7 days2-5/+5
| | | | | | | | | This allows a const correct SSL_SESSION_dup() implementation at the cost of casting away const due to the const incorrect CRYPTO_dup_ex_data()... (I should look into fixing that, but things like rust-openssl make that hard at this point in the release cycle.) ok kenjiro (as part of a larger diff)
* Prepare for gcc 3 leaving the building, COMPILER_VERSION can no longer getmiod8 days1-4/+4
| | | | set to "gcc3".
* Revert r1.286 now that all supported platforms have __builtin_clz.miod8 days1-20/+1
|
* Ensure that we specify the correct group when creating a HelloRetryRequest.jsing2025-10-162-9/+4
| | | | | | | | | | | | | | | | | When processing the client supported groups and key shares extensions, the group selection is currently based on client preference. However, when building a HRR the preferred group is identified by calling tls1_get_supported_group(). If SSL_OP_CIPHER_SERVER_PREFERENCE is enabled, group selection will be based on server instead of client preference. This in turn can result in the server sending a HRR for a group that the client has already provided a key share for, violating the RFC. Avoid this issue by storing the client preferred group when processing the key share extension, then using this group when creating the HRR. Thanks to dzwdz for identifying and reporting the issue. ok beck@ tb@
* const correct X509_VERIFY_PARAM_get_hostflags()tb2025-10-101-2/+2
| | | | | | | This is currently an internal helper only used by a regress test. We'll have to expose in the public API for Python 3.14: https://github.com/libressl/portable/issues/1202
* Remove unused sequence member from x509_revoked_sttb2025-10-102-11/+2
| | | | | | | | | | | | | | | | | To allow binary search for looking up if a cert was revoked in a CRL, the list of revoked serial numbers is sorted in crl_lookup(). On the other hand, to be able to output the DER that was actually signed by the issuer, the original order needs to be remembered. Before the encoding was cached, there was a mechanism that would restore the original order on serialization using the .sequence member. This was done without a lock and was thus racy (hilarity would ensue if one thread performed a CRL lookup while another thread serialized the same CRL). When the racy mechanism was removed in 2004, the only reader of .sequence, X509_REVOKED_seq_cmp(), was also removed, and this piece of dead code was left behind. Garbage collect it. ok kenjiro
* cms: fix incorrect length check in kek_unwrap_key()tb2025-09-301-2/+2
| | | | | | | | | | An incorrect length check can result in a 4-byte overwrite and an 8-byte overread. From Stanislav Fort and Viktor Dukhovni via OpenSSL. CVE-2025-9230. ok jsing
* cms_RecipientInfo_pwri_crypt: fix incorrect return checktb2025-09-301-3/+3
| | | | ok jsing
* cms_RecipientInfo_pwri_crypt: plug leak of kekalgtb2025-09-301-3/+3
| | | | ok jsing
* libcrypto: rsa gen: min. distance between p and qjan2025-09-291-3/+19
| | | | | | | | | | | | | | | | | This is required in NIST Special Publication 800-56B Revision 2 "Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography": 6 RSA Key Pairs 6.2 Criteria for RSA Key Pairs for Key Establishment 6.2.1 Definition of a Key Pair 3. The prime factors p and q shall be generated using one of the methods specified in Appendix B.3 of FIPS 186 such that: c. |p – q| > 2nBits/2−100 ok djm@, tb@
* Bump libressl version to 4.2.0tb2025-09-281-3/+3
| | | | | The version check will break the rust-openssl regress unless you have rust-openssl-tests-20250927p0.
* Revert NULL,0 -> OPENSSL_FILE,OPENSSL_LINE from r1.78tb2025-09-281-9/+9
| | | | | | | | | | | This wasn't part of the initial proposal and causes issues in curl downstream. We could pile more hacks on top of this, but at some point this is getting too silly. Relatedly, most of the FOOerr() could be removed, although PEMerr(), RSAerr() and SSLerr() are used by some downstreams and probably not worth patching out. Discussed with @vszakats in https://github.com/libressl/portable/issues/1154
* mlkem_generate_key_external_entropy: normalize sizeof() usetb2025-09-161-2/+2
|
* Simplify MLKEM_{private,public}_key_new()tb2025-09-161-19/+7
| | | | | | | This removes two unnecessary variables in each of these functions, normalizes the sizeof() use and undoes unnecessary line wraps. ok deraadt djm kenjiro
* aes: move explicit_bzero() after NULL checktb2025-09-151-5/+7
| | | | | | CID 621601 621602 ok djm jsg jsing miod
* MLKEM_private_key_new: add missing space before =tb2025-09-151-2/+2
|
* mlkem_public_to_private: fix overread/information leaktb2025-09-141-3/+3
| | | | | | | | | | | | After the guts of MLKEM_public_key were changed from a union to a struct, the aligner grew the struct, leaking as many bytes of private key data as the struct grew (on normal platforms that would be 2). Ideally this would all be a bit more robust. CID 621603 621604 ok jsing kenjiro
* Call aes_set_encrypt_key_generic() from aes_set_decrypt_key_generic().jsing2025-09-081-2/+2
| | | | | With the renaming, aes_set_decrypt_key_generic() should now call aes_set_encrypt_key_generic() directly.
* Allow generic AES implementation to be used as a fallback.jsing2025-09-083-19/+65
| | | | | | | | | Rename the C based AES implementation to *_generic() and provide *_internal() wrappers for these. This allows for architectures to provide accelerated versions without having to also provide a fallback implementation. ok tb@
* Zero the round keys on AES_set_{en,de}crypt_key() function entry.jsing2025-09-081-1/+5
| | | | | | | This avoids leaving previous round keys around on failure, or leaving parts of previous round keys behind if reused with a smaller key size. ok tb@
* Validate AES_set_{encrypt,decrypt}_key() inputs at API boundary.jsing2025-09-082-18/+28
| | | | | | | | | | | Every aes_set_{encrypt,decrypt}_key_internal() implementation is currently required to check the inputs and return appropriate error codes. Pull the input validation up to the API boundary, setting key->rounds at the same time. Additionally, call aes_set_encrypt_key_internal() directly from aes_set_decrypt_key_internal(), rather than going back through the public API. ok tb@
* Remove BN_DIV2W.jsing2025-09-073-28/+4
| | | | | | | The BN_DIV2W define provides a code path for double word division via the C compiler, which is only enabled on hppa. Simplify the code and mop this up. ok tb@
* Re-enable bn_sqr_words() assembly.jsing2025-09-073-8/+8
| | | | This is now only on amd64.
* Rename old assembly bn_sqr_words() to bn_sqr_word_wise().jsing2025-09-076-30/+27
| | | | | | | bn_sqr_words() does not actually compute the square of the words, it only computes the square of each individual word - rename it to reflect reality. Discussed with tb@
* Deduplicate the mlkem 768 and mlkem 1024 code.beck2025-09-056-1788/+527
| | | | | | | | | | | This moves everything not public to mlkem_internal.c removing the old files and doing some further cleanup on the way. With this landed mlkem is out of my stack and can be changed without breaking my subsequent changes ok tb@
* Disable assembly bn_sqr_words() again for now.jsing2025-09-023-8/+8
| | | | | | | | The old assembly bn_sqr_words() does not actually square words in the bignum sense. These will have to be renamed (once I come up with a name for whatever it actually does) before we can roll forward again. Found the hard way by Janne Johansson.
* Add const here as well...jsing2025-09-011-2/+2
|
* Use bn_mul_words() from bn_mod_mul_words().jsing2025-09-011-5/+3
| | | | | | Use bn_mul_words() and bn_montgomery_reduce_words(), rather than using bn_montgomery_multiply_words(). This provides better performance on architectures that have assembly optimised bn_mul_words(), such as amd64.
* Constify bn_mul_words().jsing2025-09-013-6/+9
|
* Use bn_sqr_words() from bn_mod_sqr_words().jsing2025-09-011-5/+3
| | | | | | | | Use bn_sqr_words() and bn_montgomery_reduce_words(), rather than using bn_montgomery_multiply_words(). This provides better performance on architectures that have assembly optimised bn_sqr_words(), such as amd64. ok tb@
* Provide bn_mul_words() on amd64.jsing2025-09-012-2/+12
| | | | | This uses s2n-bignum's bignum_mul() and provides significant performance gains for a range of multiplication sizes.
* EC_GROUP_new_curve_GFp: add a sentence on what elliptic curves look liketb2025-08-311-2/+7
| | | | (for our purposes).
* Remove bn_dump.3tb2025-08-311-415/+0
| | | | | | Not installed for nearly a decade since it only "documents" internal functions and structs and the internal function doco gets more out of sync with reality with every (much needed) pass over bn/
* Reorder functions since they've been renamed.jsing2025-08-311-17/+17
|
* Rename prototype for bn_mul_normal().jsing2025-08-311-2/+2
| | | | This was missed in the previous commit.
* Rename bn_mul_words()/bn_mul_add_words().jsing2025-08-3014-111/+106
| | | | | | | | | | | | | | Most bn_.*_words() functions operate on two word arrays, however bn_mul_words() and bn_mul_add_words() operate on one word array and multiply by a single word. Rename these to bn_mulw_words() and bn_mulw_add_words() to reflect this, following naming scheme that we use for primitives. This frees up bn_mul_words() to actually be used for multiplying two word arrays. Rename bn_mul_normal() to bn_mul_words(), which will then become one of the possible assembly integration points. ok tb@
* Rework bn_sqr() to use bn_sqr_words().jsing2025-08-304-26/+27
| | | | | | | | | | | | Rework some of the squaring code so that it calls bn_sqr_words() and use this as the integration point for assembly. Convert bn_sqr_normal() to bn_sqr_words(), which is then used on architectures that do not provide their own version. This means that we resume using the assembly version of bn_sqr_words() on i386, mips64 and powerpc, which can provide considerable performance gains. ok tb@
* Remove OPENSSL_VAR_AS_FUNCTION #undeftb2025-08-291-3/+1
| | | | | | The code supporting this toggle has long been removed from all the forks. discussed with jsing
* ec_mult.c: place this code under my ISC licensetb2025-08-261-58/+13
| | | | | | | | I have effectively rewritten the entirety of this file end of 2024. This isn't code I'm particularly proud of, but it's much better than it was before (it's not as if that involved any sort of challenge...) requested by/ok jsing
* zap stray spacetb2025-08-251-2/+2
|
* Move opensslconf.h to a machine-independent placetb2025-08-2514-158/+7
| | | | | | | | | | | | After drilling through many layers of fossilized turds from a long-forgotten millenium, jsing and I finally found oil^Wa machine-independent version of opensslconf.h. Remove the no longer needed versions in arch/*/ and move one copy to the top level. Add an RCS tag and place the remaining garbage in the public domain. ok jsing
* Hide primitive BOOLEAN itemstb2025-08-222-2/+8
| | | | Rides the libcrypto bump from a couple days ago
* x_crl.c: wont -> won't + KNF for a commenttb2025-08-191-3/+4
|
* An executive decision has been taken to expose marshal private key as welltb2025-08-195-9/+13
| | | | rides the libcrypto bump
* same crank for libssl and libtls as for libcryptotb2025-08-192-2/+2
|
* bump libcrypto minor after symbol additiontb2025-08-191-1/+1
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-10-31 13:10:20 +0000