summaryrefslogtreecommitdiff
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Add a regression test to verify that we call the callback in the samebeck2021-09-013-4/+551
| | | | | | | | | order on success for both the legacy and the new verifier, This avoids problems as seen in perl's regression tests for some of the crazy things net:ssleay does. This is currently marked as expected to fail, it will be expected to succeed after a forthcoming commit from me.
* Remove some dead code that was missed in an earlier cleanup andtb2021-08-311-4/+3
| | | | | | | | fix a stale comment. Found by mortimer with clang 13's -Wunused-but-set-variable. ok beck
* Defragment DTLS.jsing2021-08-312-123/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In normal TLS, it is possible for record fragments to be sent that contain one byte of alert or handshake message payload. In this case we have to read and collate multiple message fragments before we can decide what to do with the record. However, in the case of DTLS, one record is effectively one packet and while it is possible to send handshake messages across multiple records/packets, the minimum payload is the DTLS handshake message header (plus one byte of data if the handshake message has a payload) - without this, there is insufficient information available to be able to reassemble the handshake message. Likewise, splitting an alert across multiple DTLS records simply does not work, as we have no way of knowing if we're collating the same alert or two different alerts that we lost half of each from (unfortunately, these details are not really specified in the DTLS RFC). This means that for DTLS we can expect to receive a full alert message (a whole two bytes) or a handshake record with at least the handshake message header (12 bytes). If we receive messages with less than these lengths we discard them and carry on (which is what the DTLS code already does). Remove all of the pointless fragment handling code from DTLS, while also fixing an issue where one case used rr->data instead of the handshake fragment. ok inoguchi@ tb@
* Remove a nonsensical s->version == TLS1_VERSION from DTLS code.jsing2021-08-311-6/+1
| | | | ok inoguchi@ tb@ (as part of a larger diff)
* whitespacetb2021-08-312-7/+7
|
* enter uuid/jasper2021-08-311-1/+2
|
* add initial tests for uuid_from_string, uuid_to_string, uuid_create_niljasper2021-08-312-0/+134
| | | | prompted by the bug krw@ fixed yesterday in uuid_from_string()
* Clean up and simplify info and msg callbacks.jsing2021-08-308-127/+88
| | | | | | | | | The info and msg callbacks result in duplication - both for code that refers to the function pointers and for the call sites. Avoid this by providing typedefs for the function pointers and pulling the calling sequences into their own functions. ok inoguchi@ tb@
* Replace DTLS r_epoch with the read epoch from the TLSv1.2 record layer.jsing2021-08-305-27/+26
| | | | ok inoguchi@ tb@
* Move to an AEAD nonce allocated in the TLSv1.2 record layer.jsing2021-08-301-45/+36
| | | | | | | | There is little to gain by mallocing and freeing the AEAD nonce for each record - move to an AEAD nonce allocated for the record layer, which matches what we do for TLSv1.3. ok inoguchi@ tb@
* sync with OpenSSL 1.1.1, which is still under a free license;schwarze2021-08-301-15/+107
| | | | | | | in particular, this includes new text by Matt Caswell from OpenSSL commit 721eb8f6 Nov 28 12:03:00 2019 +0000 and corrects a wrong argument type that i introduced into the SYNOPSIS; requested by tb@
* Remove tests that are now covered by regress/lib/libssl/verifytb2021-08-301-65/+2
|
* hook verify regress test to buildtb2021-08-301-1/+2
|
* Revert accidental committb2021-08-307-35/+18
|
* link verify regress tests to buildtb2021-08-307-18/+35
|
* Reimplement part of the openssl/x509 regress tests in Ctb2021-08-303-0/+521
| | | | | | | | Instead of using s_client and s_server and complicated shell scripts, we can reuse the framework from the ssl_get_shared_cipher() regress test and inspect the verify return value directly. Discussed with beck jan jsing
* Ignore warning alert returns from servername callback in TLSv1.3tb2021-08-301-3/+7
| | | | | | | | | | | | | | | | If a servername callback returns SSL_TLSEXT_ERR_ALERT_WARNING, this results in a fatal error in TLSv1.3 since alert levels are implicit in the alert type and neither close_notify nor user_canceled make sense in this context. OpenSSL chose to ignore this, so we need to follow suit. Found via a broken servername callback in p5-IO-Socket-SSL which returns a Boolean instead of SSL_TLSEXT_ERR_*. This happened to have worked before TLSv1.3 since warning alerts are often ignored. This "fixes" sni.t and sni-verify.t in p5-IO-Socket-SSL. ok beck jsing
* Clean up end of do_body in openssl(1) cainoguchi2021-08-301-6/+8
| | | | suggested from tb@
* Remove NULL check before free in openssl(1) cainoguchi2021-08-301-41/+25
| | | | ok tb@
* Admit that we return error 20 in the failure case here. Changingbeck2021-08-301-5/+5
| | | | | our verifier to return 21 results in other regress failures in ruby and perl.
* Revert previous change that changed our default return for unable tobeck2021-08-301-11/+5
| | | | | | | | find leaf cert issuers. This breaks perl and ruby regress, as noticed by tb that "we tried this before". Jan's regress that cares about 21 vs 20 needs to change ok tb@
* Fix Jan's regress in openssl/x509 to do what it says it does,beck2021-08-302-13/+15
| | | | | | | | then fix the only thing it still has complaints about which is that we don't return the leaf version of the error code when we can't verify the leaf (as opposed to the rest of the chain) ok jan@ tb@
* Do not call X509_alias_get0(3) with NULL as the second argument.schwarze2021-08-291-5/+7
| | | | | | | | | | | | | | | | | | | Even if the buffer is guaranteed to be NUL-terminated in a particular case, it is still setting a bad example. Besides, it is unclear to me whether there is any such guarantee in the case at hand. Checking that would require auditing all of d2i_X509_bio(3), ASN1_item_d2i_bio(&NETSCAPE_X509_it, ...), PEM_read_bio_X509_AUX(3), and PKCS12_parse(3), since no such guarantee is documented for any of these functions, and even then it would remain fragile with respect to later changes of implementation details. In the worst case, this could potentially result in a read buffer overrun. OK tb@ on an earlier version of this patch. While we are here, deraadt@ requested to not use the word "string" in the name of a variable that is not a string in the sense of the C language.
* Don't call the verify callback twice on success.beck2021-08-291-2/+1
| | | | | | | This fixes a problem in the perl regress where it notices the callback is called twice and complains. ok tb@ bluhm@
* Pass the -quiet option to openssl s_server to make it ignore EOF.tb2021-08-291-6/+6
| | | | This makes some tests run from the Makefile behave as they should.
* Add back the echo Q thing.tb2021-08-291-5/+5
|
* Start naccept .desc with a capitaltb2021-08-291-2/+2
| | | | noted by inoguchi
* Use s_server -naccept 1 and remove echo "Q" | openssl s_client hack.tb2021-08-291-12/+11
|
* Implement -naccept in the s_server.tb2021-08-294-11/+29
| | | | | doc fixes/ok jmc ok beck
* Get rid of historical code to extract the roots in the legacy case.beck2021-08-283-78/+33
| | | | | | | | Due to the need to support by_dir, we use the get_issuer stuff when running in x509_vfy compatibility mode amyway - so just use it any time we are doing that. Removes a bunch of yukky stuff and a "Don't Look Ethel" ok tb@ jsing@
* Clean up and simplify ssl3_dispatch_alert() and ssl3_send_alert().jsing2021-08-281-30/+32
| | | | ok inoguchi@ tb@
* Only remove the directories if there's an obj/ or obj@tb2021-08-281-2/+4
|
* Add a pass using the modern vfy with by_dir roots, code by me, script tobeck2021-08-283-15/+106
| | | | | | generate certdirs by jsing, and make chicken sacrifies by tb. ok tb@ jsing@
* Zap blanks before tabs.tb2021-08-281-4/+4
|
* Add RCS markertb2021-08-281-0/+1
|
* Add case 2c to the go side. Don't tell jsing I touched go.beck2021-08-281-0/+1
|
* Remove the "dump_chain" flag and code. This was a workaround for a problem wherebeck2021-08-282-16/+4
| | | | | | | roots were not checked correctly before intermediates that has since been fixed and is no longer necessary. It is regress checked by case 2c in regress/lib/libcrypto/x509/verify.c ok jsing@ tb@
* Check X509_get_notAfter return value in openssl(1) ca.cinoguchi2021-08-281-3/+5
|
* Use strndup instead of malloc, memcpy and NULL termination in openssl(1) ca.cinoguchi2021-08-281-11/+4
| | | | | suggested from tb@ for do_updatedb(), and applied the same for do_body() and do_revoke().
* Remove ASN1_TIME_new and use NULL for X509_gmtime_adj, free tmptm in err pathinoguchi2021-08-281-15/+7
| | | | comments from tb@
* Unwrap lines in openssl(1) ca.cinoguchi2021-08-281-5/+3
| | | | suggested from tb@
* Avoid leak with X509_REVOKED variable in openssl(1) ca.cinoguchi2021-08-281-1/+3
| | | | pointed out by tb@
* Checking the return value in openssl(1) ca.cinoguchi2021-08-281-41/+127
| | | | | | | | | Some functions are used without verifying the return value in openssl(1) ca. This diff adds checking for the function return value. With this diff, I changed return value of the write_new_certificate from void to int to return the condition to the caller. ok and comments from tb@
* Add regress test testing having the root cert in the intermediate bundlebeck2021-08-275-1/+96
|
* Remove unused #include <assert.h>.tb2021-08-271-2/+1
| | | | | | | This is from upstream where there is an assert() that EVP_MD_size(digest) matches the length returned by HMAC(). We avoid asserts in our libraries. From Martin Vahlensieck
* Fix various read buffer overflow when printing ASN.1 strings (which aretb2021-08-244-14/+20
| | | | | | | | not necessarily NUL terminated). Same as schwarze's fix in t_x509a.c r1.9. From David Benjamin and Matt Caswell (part of the fixes in OpenSSL 1.1.1l) ok inoguchi
* Pull roots out of the trust store in the legacy xsc when building chainsbeck2021-08-193-8/+26
| | | | | | | to handly by_dir and fun things correctly. - fixes dlg@'s case and by_dir regress in openssl-ruby ok jsing@
* Import regress tests for SM2. Not yet linked to the build.tb2021-08-184-0/+640
| | | | Part of Github PR #105
* Import initial code for the SM2 ciphertb2021-08-187-0/+1870
| | | | | | | | | | | | | | | | | This adds the SM2 algorithm defined in the Chinese standards GB/T 32918.1-2016, GB/T 32918.2-2016, GB/T 32918.3-2016, GB/T 32918.4-2016 and GB/T 32918.5-2017. This is an ISC licensed implementation contributed by Ribose.inc, based on the same code that was contributed to OpenSSL by Jack Lloyd. The port to LibreSSL was done by Ronald Tse and Nickolay Olshevsky. Github PR #105 I made quite a few cleanup passes on this, but more is needed, some of which will happen in-tree before this is linked to the build. ok deraadt inoguchi (a long time ago), jsing
* Add a check_trust call to the legacy chain validation on chain add, rememberingbeck2021-08-181-2/+10
| | | | | | | | | the result in order to return the same errors as OpenSSL users expect to override the generic "Untrusted cert" error. This fixes the openssl-ruby timestamp test. ok tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-28 02:38:08 +0000