summaryrefslogtreecommitdiff
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Randomise the rekey interval a little. Previously, the chacha20djm2022-07-311-2/+8
| | | | | | | instance would be rekeyed every 1.6MB. This makes it happen at a random point somewhere in the 1-2MB range. Feedback deraadt@ visa@, ok tb@ visa@
* Use named initialisers for BIGNUMs.jsing2022-07-301-61/+65
| | | | | | | Also move the _bignum_nist_p_.*_sqr static BIGNUMs out of individual functions. ok tb@
* Untangle two logic chains in x509_asid.c into something more readable.tb2022-07-301-9/+22
| | | | ok jsing
* update copyright yearstb2022-07-301-2/+2
|
* Reorder functions and remove unnecessary function prototypes.jsing2022-07-301-29/+24
|
* Update copyright for additional/new code.jsing2022-07-301-1/+2
|
* Provide additional AEAD test cases.jsing2022-07-306-1/+1991
| | | | | | | | | Bring in additional AEAD test cases from BoringSSL. This provides additional coverage for AES-{128,192,256}-GCM, as well as Chacha20-Poly1305 and XChaCha20-Poly1305. Discussed with tb@
* Add EVP_aes_192_gcm() as a known AEAD.jsing2022-07-301-1/+3
|
* Allow the AEAD to be specified for a test file.jsing2022-07-302-8/+12
| | | | | Currently, this must be specified per test - allow it to be given as a command line argument that applies to the entire test file.
* Run AEAD tests against EVP_CIPHER implementations.jsing2022-07-301-15/+220
| | | | | | | | In addition to running AEAD tests against the EVP_AEAD implementation, also run them against the EVP_CIPHER implementation where applicable. This is a perfect example of why EVP_AEAD exists and why EVP_CIPHER is completely unsuited for use with AEADs...
* Allow quoted ASCII strings as input for AEAD regress.jsing2022-07-301-21/+42
| | | | | | Currently, each line in the text file is expected to be string of hexadecimal digits. In addition to this, allow a line to be given as an quoted ASCII string.
* Sort includes.jsing2022-07-301-4/+4
|
* Less #ifndef OPENSSL_NO_*jsing2022-07-301-17/+1
| | | | | We're not going to be compiling without AES or CHACHA/POLY1305 anytime soon.
* Fix comment formatting.jsing2022-07-301-4/+7
|
* Switch to ISC license.jsing2022-07-301-46/+13
| | | | | | | Use Google's ISC license for this code - this was originally being upstreamed to OpenSSL by Adam Langley, however it was never actually accepted and eventually ended up in BoringSSL (via commit dfe3053086). The same change was made a long time ago for evp/evp_aead.c and others.
* Add stack frames to AES-NI x86_64 assembly.jsing2022-07-301-39/+58
| | | | | | | | | | | | | | | | | | | | | The current AES-NI x86_64 assembly does some strange, although valid things, such as making internal function calls without creating stack frames. In this case, the return address lands in the red zone (which it allows for when making use of the stack) and everything works as expected. However, this trips a false positive in valgrind, which seems to think that any data saved on the stack prior to the internal function call is now "undefined" once the function returns. Avoid this by actually using stack frames - this brings in most of 6a40ebe86b4 from OpenSSL, omitting the unnecessary explicit stack alignment (which was apparently added so this code could be used in the Linux kernel with an incorrectly aligned stack). Valgrind issue reported by Steffen Jaeckel (@sjaeckel), found via libstrophe unit tests. ok tb@
* Use ASN1_INTEGER to encode/decode BIGNUM_it.jsing2022-07-301-34/+48
| | | | | | | | | | The current code simply shoves the unvalidated ASN.1 bytes into a BIGNUM on the hope that other things will detect issues (such as negative values being flipped to positive). Instead of doing this, decode and validate the ASN.1 data using ASN1_INTEGER, then convert it to a BIGNUM. Similarly, for encoding convert from BIGNUM to ASN1_INTEGER and use ASN1_INTEGER encoding. ok tb@
* Provide and use a primitive clear function for BIGNUM_it.jsing2022-07-301-8/+15
| | | | | | Also tidy up bn_new() while here. ok tb@
* Eliminate the somewhat pointless Ij variabletb2022-07-301-5/+4
| | | | Requested by & ok jsing
* Transform two || chains into individually checked functionstb2022-07-301-8/+13
| | | | Requested by and ok jsing
* Having a perfect square at this point is not an error. Rather it istb2022-07-291-2/+2
| | | | | a shortcut bypassing expensive computation, so change goto err to goto done. Bug introduced in last refactoring before commit.
* Tweak some comments and whitespace around commentstb2022-07-291-9/+32
|
* Add a second test to validate the tables in the library.tb2022-07-281-1/+42
|
* Adjust a comment to reflect reality, minor code tweaks.tb2022-07-271-7/+7
|
* Do not pass input length <= 0 to the cipher handlerstb2022-07-261-11/+17
| | | | | | | | | | Input length < 0 is an error and input length == 0 can result in strange effects in some ciphers, except in CCM mode, which is extra special. Based on OpenSSL 420cb707 by Matt Caswell and Richard Levitte found by & ok jsing
* minor tweaks: unwrap a line, tweak a comment and zap an empty linetb2022-07-261-5/+3
|
* Remove test of non-portable implementation details (whether wctype_tguenther2022-07-251-5/+1
| | | | | | | and wctrans_t values are locale-specific) so we can simplify our implementation in libc ok schwarze@
* Add a regression test for bn_isqrt.ctb2022-07-252-1/+302
| | | | | This validates the tables used in bn_is_perfect_square() and checks that for randomly generated numbers the isqrt() is what it is expected to be.
* Separate the macro for generating string test functionsschwarze2022-07-251-14/+22
| | | | | | | | | | for the macro generating test functions for other data types. This makes sense because both are sufficiently different. It also avoids a large number of false positive compiler warnings that guenther@ reported. OK guenther@
* fix indenttb2022-07-251-2/+2
|
* If a command or interface first appeared in PWB/UNIX, UNIX System III orjsg2022-07-252-6/+10
| | | | | | | | | | | | UNIX System V mention it. Only do so in manual pages with a pre-existing HISTORY section. Prompted by the comparison of System V and BSD commands and interfaces in Sun's "System V Enhancements Overview" document. checked against manuals on bitsavers, TUHS archive and CSRG archive CDs ok jmc@ schwarze@
* Plug leak in X509V3_add1_i2d()tb2022-07-241-2/+3
| | | | | | | | Do not leak the extension that was deleted from the stack. via OpenSSL c3efe5c9. ok jsing
* Prepare to resurrect TS_RESP_CTX_set_time_cb()tb2022-07-242-2/+14
| | | | | | | | | This was removed shortly after the fork since TS is not 2038-ready and since there were no consumers of this API. Now there are consumers and they add it themselves if it's missing from libcrypto. This will no longer be possible with opaque TS structs, so begrudgingly add it back. ok jsing kn
* Prepare to provide TS_VERIFY_CTX accessorstb2022-07-242-2/+79
| | | | | | | | | | | | | | | | | | | | | | | | The setters make no sense since they do not free the old members and return what was passed in instead of returning the old struct member so that the caller has a chance of freeing them. This has the side effect that calling a setter a second time will likely result in a leak. TS_VERIFY_CTX_set_imprint() was "fixed" upstream by adding a free() but the other three setters were missed since discussing the contributor's CLA was more important. Also missed was that adding frees will result in double frees: careful consumers like openssl/ruby have workarounds for the strange existing semantics. Add a compat #define for TS_VERIF_CTS_set_certs() that made it into the public API with a typo. A good illustration of the amount of thought and care that went into the OpenSSL 1.1 API by both the implementers and the reviewers. Amazing job overall. We will be stuck with this nonsense for a long time. ok jsing kn
* Prepare to provide various TS_STATUS_INFO accessorstb2022-07-242-2/+34
| | | | | | | | This adds TS_STATUS_get0_{failure_info,text,status}() as well as TS_STATUS_INFO_set_status(). These will be needed by Ruby and openssl(1) when we make the structs in ts.h opaque. ok kn jsing
* Align PKCS12_key_gen_uni() with OpenSSLtb2022-07-241-58/+50
| | | | | | | | This is Dr Stephen Henson's rewrite avoiding BIGNUM (OpenSSL 54c68d35). Additionally this pulls in a < vs <= fix by Pauli Dale (OpenSSL 9d868840). There is also some minor cleanup by myself. ok jsing
* Minor fixes in PKCS12_parse()tb2022-07-241-24/+23
| | | | | | | | Pull up clearing of output parameters before first return (OpenSSL 524fdd51 by Bernd Edlinger), explicit comparisons against NULL, '\0', etc. ok jsing
* Per RFC 7292, safeContentsBag is a SEQUENCE OF, not a SET OFtb2022-07-241-2/+2
| | | | | | OpenSSL b709babb by Richard Levitte ok jsing
* Clear key on exit in PKCS12_gen_mac()tb2022-07-241-25/+38
| | | | | | | | | Also switch to heap-allocated HMAC_CTX and clean a few things up stylistically. loosely based on OpenSSL f5cee414 by Shane Lontis ok jsing
* Plug a leak in PKCS12_setup_mac()tb2022-07-241-2/+3
| | | | | | based on OpenSSL 1b8f1937 by Dmitry Belyavskiy ok jsing
* Move cipher_id bsearch functions back to the bottom of the file.jsing2022-07-241-16/+16
|
* Set NULL BIOs for QUIC.jsing2022-07-241-1/+14
| | | | | | | | When used with QUIC, the SSL BIOs are effectively unused, however we still currently expect them to exist for status (such as SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE). Set up NULL BIOs if QUIC is in use. ok tb@
* Provide record layer callbacks for QUIC.jsing2022-07-247-16/+217
| | | | | | | | | | | | QUIC uses TLS to complete the handshake, however unlike normal TLS it does not use the TLS record layer, rather it provides its own transport. This means that we need to intercept all communication between the TLS handshake and the record layer. This allows TLS handshake message writes to be directed to QUIC, likewise for TLS handshake message reads. Alerts also need to be sent via QUIC, plus it needs to be provided with the traffic keys that are derived by TLS. ok tb@
* Move tls13_phh_done_cb() after tl13_phh_received_cb().jsing2022-07-241-12/+12
| | | | This is the order that they're called/run in.
* Provide QUIC encryption levels.jsing2022-07-246-20/+33
| | | | | | | | | | | | QUIC wants to know what "encryption level" handshake messages should be sent at. Provide an ssl_encryption_level_t enum (via BoringSSL) that defines these (of course quictls decided to make this an OSSL_ENCRYPTION_LEVEL typedef, so provide that as well). Wire these through to tls13_record_layer_set_{read,write}_traffic_key() so that they can be used in upcoming commits. ok tb@
* Rely on tlsext_parse() to set a decode_error alerttb2022-07-241-79/+47
| | | | | | | | Instead of setting the alert manually in various parse handlers, we can make use of the fact that tlsext_parse() sets the alert to decode_error by default. This simplifies the code quite a bit. ok jsing
* Start making ts opaquetb2022-07-2410-50/+134
| | | | | | | | | Move the not yet exposed EssCertIDv2 struct internals to ts_local.h and move the ASN.1 function prototypes that we don't want to expose with them. Include ts_local.h where necessary or where it will be needed soon. ok jsing
* Fix file names in comments.tb2022-07-231-7/+7
|
* Convert TLS transcript from BUF_MEM to tls_buffer.jsing2022-07-222-29/+16
| | | | ok beck@ tb@
* Extend TLS buffer regress to cover read/write usage.jsing2022-07-221-13/+219
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-17 09:12:31 +0000