summaryrefslogtreecommitdiff
path: root/src/usr.sbin (unfollow)
Commit message (Collapse)AuthorFilesLines
2023-02-07Fix arbitrary memory read in GENERAL_NAME_cmp()libressl-v3.5.4bluhm1-2/+3
The ASN.1 template for GENERAL_NAME and its corresponding C structure disagree on the type of the x400Address member. This results in an ASN.1 string to be considered as an ASN.1 type, which allows an attacker to read (essentially) arbitrary memory. Fix this by forcing comparison as strings. While the underlying type confusion has been present since time immemorial, this particular bug came with the EdiPartyName fix (6.8/008_asn1.patch.sig). Reported by David Benjamin, fix suggested by jsing. Release date for this was set to be January 31. Unilaterally pushed back to February 7 by OpenSSL by way of announcement of many completely unrelated embargoed issues, some of which they had been sitting on since July 2020. from tb@; OK beck@ jsing@ this is errata/7.1/022_x509.patch.sig
2022-05-14Fix d2i_ASN1_OBJECT()libressl-v3.5.3tb1-2/+2
Due to a confusion of two CBS, the API would incorrectly advance the *der_in pointer, resulting in a DER parse failure. Issue reported by Aram Sargsyan ok jsing This is patches/7.1/004_asn1.patch.sig
2022-04-10Set ASN1_OBJECT_FLAG_DYNAMIC_DATA flag with t2i_ASN1_OBJECT_internalinoguchi1-1/+2
'flags' should have ASN1_OBJECT_FLAG_DYNAMIC_DATA bit to free 'data' by ASN1_OBJECT_free as c2i_ASN1_OBJECT_cbs does. ok jsing@ tb@
2022-04-07Avoid infinite loop on parsing DSA private keystb1-3/+24
DSA private keys with ill-chosen g could cause an infinite loop on deserializing. Add a few sanity checks that ensure that g is according to the FIPS 186-4: check 1 < g < p and g^q == 1 (mod p). This is enough to ascertain that g is a generator of a multiplicative group of order q once we know that q is prime (which is checked a bit later). Issue reported with reproducers by Hanno Boeck. Additional variants and analysis by David Benjamin. ok beck jsing
2022-04-07Avoid infinite loop for custom curves of order 1tb2-4/+9
If a private key encoded with EC parameters happens to have order 1 and is used for ECDSA signatures, this causes an infinite loop since a random integer x in the interval [0,1) will be 0, so do ... while (x == 0); will loop indefinitely. Found and reported with a reproducer by Hanno Boeck. Helpful comments and analysis from David Benjamin. ok beck jsing
2022-04-03Initialize the mutex before making us of it from many threads. Preventsanton1-28/+23
a race in which one thread is currently initializing the mutex which is not an atomic operation whereas another thread tries to use it too early. With and ok schwarze@
2022-03-31man pages: fix some typos found while looking for other issuesnaddy1-2/+2
2022-03-31man pages: add missing commas between subordinate and main clausesnaddy41-167/+167
jmc@ dislikes a comma before "then" in a conditional, so leave those untouched. ok jmc@
2022-03-31Fix leak in ASN1_TIME_adj_internal()tb1-3/+5
p is allocated by asprintf() in one of the *_from_tm() functions, so it needs to be freed as in the other error path below. CID 346194 ok jsing
2022-03-31Simplify priv_key handling in d2i_ECPrivateKey()tb1-8/+3
d2i_EC_PRIVATEKEY() can handle the allocation of priv_key internally, no need to do this up front and reach it through the dangerous reuse mechanism. There's also no point in freeing a variable we know to be NULL. ok jsing
2022-03-31Check EVPDigest* return values.tb1-4/+7
CID 351293
2022-03-30Add a simple test to ensure that pmeth->cleanup() can cope with NULLtb2-2/+93
pkey_ctx->data.
2022-03-30Avoid segfaults in EVP_PKEY_CTX_free()tb2-4/+10
It is possible to call pmeth->cleanup() with an EVP_PKEY_CTX whose data is NULL. If pmeth->init() in int_ctx_new() fails, EVP_PKEY_CTX_free() is called with such a context. This in turn calls pmeth->cleanup(), and thus these cleanup functions must be careful not to use NULL data. Most of them are, but one of GOST's functions and HMAC's aren't. Reported for HMAC by Masaru Masada https://github.com/libressl-portable/openbsd/issues/129 ok bcook jsing
2022-03-30pkey_hmac_init(): use calloc()tb1-7/+3
Instead of using malloc() and setting most struct members to 0, simply use calloc(). ok bcook jsing
2022-03-30Remove double slash in path to test program.anton1-9/+9
2022-03-29man pages: add missing word, The foo() ... -> The foo() function ...naddy5-17/+18
ok jmc@ schwarze@
2022-03-29Given asn1/a_object.c rev. 1.45 by jsing@, stop talking about BUGSschwarze1-22/+21
we no longer have, focus on what our implementation now does, but keep short warnings in how far other implementations might be more fragile. Some improvements to wordings and clarity while here. OK tb@
2022-03-29man pages: add missing commas in enumerationsnaddy3-9/+9
2022-03-29Bound cofactor in EC_GROUP_set_generator()tb1-1/+7
Instead of bounding only bounding the group order, also bound the cofactor using Hasse's theorem. This could probably be made a lot tighter since all curves of cryptographic interest have small cofactors, but for now this is good enough. A timeout found by oss-fuzz creates a "group" with insane parameters over a 40-bit field: the order is 14464, and the cofactor has 4196223 bits (which is obviously impossible by Hasse's theorem). These led to running an expensive loop in ec_GFp_simple_mul_ct() millions of times. Fixes oss-fuzz #46056 Diagnosed and fix joint with jsing ok inoguchi jsing (previous version)
2022-03-29Do not zero cofactor on ec_guess_cofactor() successtb1-2/+6
The cofactor we tried to calculate should only be zeroed if we failed to compute it. ok inoguchi jsing
2022-03-29Zap trailing whitespacetb1-46/+46
2022-03-28Change internal functions to static in openssl(1) pkcs12inoguchi1-24/+30
ok tb@
2022-03-28Remove unused function cert_load in openssl(1) pkcs12inoguchi1-19/+1
ok tb@
2022-03-28Remove extra 'or'claudio1-3/+2
OK tb@
2022-03-27Check EVP_Digest* functions return value in openssl(1) tsinoguchi1-5/+16
Move up md_ctx and add EVP_MD_CTX_free under the 'err:' label. CID 149810 comment and ok jsing@
2022-03-26name constraints: be more careful with NULstb2-12/+25
An IA5STRING is a Pascal string that can have embedded NULs and is not NUL terminated (except that for legacy reasons it happens to be). Instead of taking the strlen(), use the already known ASN.1 length and use strndup() instead of strdup() to generate NUL terminated strings after some existing code has checked that there are no embedded NULs. In v2i_GENERAL_NAME_ex() use %.*s to print the bytes. This is not optimal and might be switched to using strvis() later. ok beck inoguchi jsing
2022-03-26Clean up {dtls1,ssl3}_read_bytes()jsing2-200/+166
Now that {dtls1,ssl3}_read_bytes() have been refactored, do a clean up pass - this cleans up various parts of the code and reduces differences between these two functions. ok = 1; *(&(ok)) tb@ ok inoguchi@
2022-03-26Remove the minimum record length checks from dtls1_read_bytes()jsing1-32/+1
The code that handles each record type already has appropriate length checks. Furthermore, the handling of application data here is likely incorrect and bypasses the normal state checks at the end of this function. ok inoguchi@ tb@
2022-03-26Convert c2i_ASN1_OBJECT() and d2i_ASN1_OBJECT to CBS.jsing1-81/+92
Along the way, rather than having yet another piece of code that parses OID arcs, reuse oid_parse_arc(). Always allocate a new ASN1_OBJECT rather than doing a crazy dance with ASN1_OBJECT_FLAG_DYNAMIC and trying to free parts of an ASN1_OBJECT if one is passed in. ok inoguchi@ tb@
2022-03-26Provide asn1_get_primitive()jsing2-2/+35
This takes a CBS, gets the ASN.1 identifier and length, ensures the resulting identifier is a valid primitive, then returns the tag number and the content as a CBS. ok inoguchi@ tb@
2022-03-25use the new CPU_ID_AA64ISAR0 sysctl to determine CPU features on arm64robert1-5/+55
ok tb@, deraadt@, kettenis@
2022-03-24Adjust the signer test to link statically and work with hidden tls_signertb2-3/+7
API.
2022-03-24Crank major after symbol removal.tb1-2/+2
2022-03-24Hide the tls_signer from public visibility. It's not ready yet andtb3-29/+24
should not be used. It will be revisited after release. ok beck inoguchi jsing
2022-03-24Check function return valueinoguchi1-2/+3
2022-03-24Compare pointer value with NULLinoguchi1-63/+63
2022-03-24Wrap long linesinoguchi1-39/+44
2022-03-24Remove space between asterisk and variable nameinoguchi1-22/+22
2022-03-24Convert openssl(1) ts option handlinginoguchi1-153/+285
Apply new option handling to openssl(1) ts, and there is no functional changes here. usage strings are comes from manual page. comments and ok jsing@
2022-03-23openssl cms: avoid NULL derefs on option parsingtb1-1/+3
Two missing initializations in the new option handling cause a segfault when -nodetach or -noindef is passed to openssl cms. ok inoguchi jsing miod
2022-03-23Start disentangling armv7 and aarch64 codetb8-6/+154
arm_arch.h and armcap.c are shared between armv7 and aarch64 which results in an inscrutable #ifdef maze. Move copies of these files into arch/{arm,aarch64}/ with appropriate names and some trivial minor adjustments. ok deraadt inoguchi kettenis
2022-03-20Move/group i2d_ASN1_OBJECT() and d2i_ASN1_OBJECT().jsing1-53/+53
2022-03-19Remove three useless tests filestb3-185/+0
The asn1test depends on asn1_mac.h which had a date with the bitbucket a few years back (and the test "isn't meant to run particularly, it's just to test type checking"). methtest.c tests an API that was never present in OpenSSL's git history. r160test.c is nothing but a licence. "nuke away" jsing
2022-03-19Provide t2i_ASN1_OBJECT_internal() and use it for OBJ_txt2obj()jsing3-32/+43
The current OBJ_txt2obj() implementation converts the text to ASN.1 object content octets, builds a full DER encoding from it, then feeds the entire thing back through the DER to ASN.1 object conversion. Rather than doing this crazy dance, provide an t2i_ASN1_OBJECT_internal() function that converts the text to ASN.1 object content octets, then creates a new ASN1_OBJECT and attaches the content octets to it. ok inoguchi@ tb@
2022-03-19Revise regress for ascii/text to ASN.1 object conversion rewrite.jsing1-58/+10
2022-03-19Rewrite ascii/text to ASN.1 object conversion.jsing1-121/+167
Rewrite the ascii/text to ASN.1 object conversion code using CBB/CBS, while also addressing some of the bizarre behaviour (such as allowing mixed separators and treating '..' as a zero value). ok inoguchi@ tb@
2022-03-19Add another invalid separator test case.jsing1-1/+5
2022-03-18Simplify SSL_do_handshake().jsing1-7/+5
ok inoguchi@ tb@
2022-03-18Rewrite legacy DTLS unexpected handshake message handling.jsing1-83/+139
Rewrite the code that handles unexpected handshake messages in the legacy DTLS stack. Parse the DTLS message header up front, then process it based on the message type. Overall the code should be more strict and we should reject various invalid messages that would have previously been accepted. ok inoguchi@ tb@
2022-03-17Rewrite legacy TLS unexpected handshake message handling.jsing1-78/+114
Rewrite the code that handles unexpected handshake messages in the legacy TLS stack. Parse the TLS message header up front, then process it based on the message type. Overall the code should be more strict and we should reject various invalid messages that would have previously been accepted. I also reviewed steve's experimental code and fixed the bug that it contained. ok inoguchi@ tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 05:09:03 +0000