summaryrefslogtreecommitdiff
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Convert D_, R_ macro indices to enums in speed.ckenjiro11 days1-49/+59
| | | | | | | | | Replaced many `#define` based index constants with enums by adding ALGOR_NUM, DSA_NUM, RSA_NUM, and EC_NUM to the enum definitions. This makes it easier to add or remove new entries. ok tb@
* speed: remove unused counters and dead parameterskenjiro11 days1-92/+77
| | | | | | | | | | | | | | In the speed implementation, a number of unused variables and parameters (save_count, c[][], rsa_c, dsa_c, ecdsa_c, ecdh_c, and the num argument of print_message()/pkey_print_message()) were still left behind. These values are no longer referenced and cannot affect the time-based benchmark logic, so remove them. Functional behaviour of speed remains unchanged. ok tb@
* Do not crash when calling freeaddrinfo(NULL)jca2025-12-082-5/+13
| | | | | | | | | | | | Supported by Linux since at least 1997, and FreeBSD since 2017. While not defined, there's no real good reason to crash when we could just cope. Indeed, software out there relies on the Linux behavior. Point out in the manpage that the behavior of getaddrinfo(NULL) isn't defined and thus isn't portable. Edge case spotted recently by kn@ in OpenVPN. ok millert@ djm@ deraadt@ kn@
* ec_asn1_test: change a comma to a full stoptb2025-12-071-2/+2
|
* asn1complex: use ASN1_STRING_get0_data() instead of ASN1_STRING_data()tb2025-12-071-4/+4
|
* Remove last internal use of ASN1_STRING_data()tb2025-12-071-13/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | PKCS5_pbe_set0_algor() is no longer public, but its parameters are provided directly via public API, namely the wonderful PKCS8_encrypt() and PKCS12_pack_p7encdata(). Muppetry abounds. To wit: If saltlen < 0, the call to ASN1_STRING_set(pbe->salt, NULL, saltlen) would error. Let's do that up front in a more obvious way. We don't care about side-effects to pbe->salt since we free it on error anyway. If saltlen == 0, we default it to PKCS5_PBE1_SALT_LEN. This is particularly funky in case the caller passed in salt != NULL, in which case we can only hope and pray this buffer is long enough. If the caller passed a salt, copy it to pbe->salt via ASN1_STRING_set(). If there's no salt, allocate a buffer of the appropriate length, fill it with random and transfer ownership to pbe->salt via ASN1_STRING_set0(). There's a change of behavior in that this will not be NUL-terminated (why should it be?). If we wanted to preserve behavior, we'd just use calloc(1, saltlen + 1) instead of the malloc(). The exit path is quite special, too, but I didn't want to change this right now. tweaks/ok kenjiro
* sort the "va" keyword to be in alpha order, some programs use bsearchphessler2025-12-061-2/+2
| | | | noticed by deraadt@
* allow network programs select DSCP_VA for network ToSphessler2025-12-051-1/+2
| | | | OK stsp@
* check_complete: remove the BN_*FMT1 macros as welltb2025-12-051-4/+1
|
* libcrypto: remove BN_{DEC,HEX}_FMT1tb2025-12-051-5/+1
| | | | It appears that these were only ever used in bn_test.c...
* check_complete: adjust for BN_ macro removaltb2025-12-051-5/+2
| | | | pointed out by kenjiro
* Replace trivial uses of ASN1_STRING_data()tb2025-12-055-13/+13
| | | | | | | | | Almost entirely mechanical diff that ensures that for read-only accesses we use the const correct ASN1_STRING_get0_data(). Arguably, in most places the better fix would be to reach into ASN1_STRING but then we have to think and bikeshed... ok beck kenjiro
* libcrypto: make most of the BN_* macro pollution internaltb2025-12-055-31/+29
| | | | | | | | | This is a first sweep of reducing the number of terribly named macros in bn.h More can go away. Those we need internally go to bn_local.h. Annoyingly bn_internal.h uses some of them, so it includes bn_local.h now. This can be cleaned up later. ok jsing kenjiro
* bn_word.c: include bn_local.h in preparation for an upcoming changetb2025-12-051-1/+3
|
* Make the openssh test pass after adding mlkem.beck2025-12-041-8/+9
| | | | | | | | | | This has a magic value looking for what happens when we HRR, more or less assuming it might never change. it now has. Commenting it out get us by it, unsure if we should change this or get rid of it. ok tb@
* Hook up X25519MKLEM768 to the TLS 1.3 handshakebeck2025-12-046-66/+433
| | | | | | | | | | | | | | | | | | | | | | | | This does the following: 1) Adds a second key share prediction to the TLS 1.3 handshake. We only add one as we are unlikely to want to send more than one PQ one, and one classical one and are unlikely to waste bytes on a second PQ algorithm (anything that wants something else that we support can HRR to get it) 2) Adds X25519MLKEM768 (4588) to our list of supported groups. We add this to our preferred client and server key shares for TLS 1.3 and we now have a separate list for TLS 1.2 which does not do this, cleaning up the old "full list" from the comments. 3) Updates the golden magic numbers in the regression tests to allow for the above two things changing the handshake, so the regress tests pass. With this you can successfully hybrid PQ with servers and clients that support it. ok tb@ kenjiro@
* Add a MLKEM768_X25519 hybrid key share.beck2025-12-048-31/+353
| | | | | | | | | | | | This implements the currently in use MLKEM768_X25519 hybrid key share as outlined in https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/ This commit does not yet wire this up to anything, that is done in follow on changes. ok tb@ jsing@ kenjiro@
* Clean up confusing logic in CMS_EncryptedData_encrypt()tb2025-11-281-15/+20
| | | | | | | | This makes it easier to read and more in line with other code in libcrypto. Also add a missing error check for the CMS_set_detached() call. ok jsing kenjiro
* Fix double free in certificate policies configurationtb2025-11-281-12/+7
| | | | | | | | In nref_nos(), nnums must not be freed on error because in the caller it is not->noticeref->noticenos and hangs off the POLICYQUALINFO qual which is freed as part of POLICYQUALINFO_free() in the error path. ok jsing kenjiro
* openssl cms: switch to ASN1_STRING_get0_data()tb2025-11-271-3/+3
| | | | | | | The deprecated ASN1_STRING_data() will be removed in a future release. This is one small step towards that. ok kenjiro
* openssl pkcs12: stop reaching into ASN1_STRINGtb2025-11-271-18/+17
| | | | | | | Buy a t: rename hex_prin() to hex_print() and accept an ASN1_STRING so that we only need to use accessors once. Also avoid a printf %s NULL. ok kenjiro
* openssl ca: mechanical change to stop reaching into ASN1_STRINGtb2025-11-271-21/+26
| | | | ok kenjiro
* openssl asn1pars: don't reach into ASN1_STRINGtb2025-11-271-4/+4
| | | | ok kenjiro
* libcrypto: add header guards to *_local.htb2025-11-269-9/+54
| | | | | | | | | An upcoming change requires the inclusion of asn1_local.h in x509_local.h which doesn't work due to missing header guards. Add guards to all local headers that don't have them, although reacharounds and multiple inclusions are unlikely to occur for most of those. ok jsing
* openssl ts: simplify create_nonce()tb2025-11-211-17/+7
| | | | | | | | Just your average dumb TS code. Instead of handrolling a random ASN.1 integer generator, we can use BN_rand() and convert the resulting bn to an ASN1_INTEGER. All this then also works without reaching into ASN1_STRING. ok kenjiro
* Correct the MLKEM hybrid objects values.beck2025-11-192-8/+5
| | | | | | | | | | | | | The ietf has had a bunch of back and forth over what will happen here. in the end the previously mentioned draft will not include the TLS hybrids, so we change this to use reference the correct draft for TLS, and use the same name everyone else is using, without an OID. While we will probably end up needing the *other* hybrids for things like CMS, we will bring them in when we need them and have official OID values from IANA. ok tb@
* sync cert.pem with updated Mozilla list; ok tb@sthen2025-11-171-1/+237
| | | | | | | | | | | | | | | | | | changes are: +OISTE Foundation + /C=CH/O=OISTE Foundation/CN=OISTE Server Root ECC G1 + /C=CH/O=OISTE Foundation/CN=OISTE Server Root RSA G1 SwissSign AG /C=CH/O=SwissSign AG/CN=SwissSign Gold CA - G2 + /C=CH/O=SwissSign AG/CN=SwissSign RSA TLS Root CA 2022 - 1 TrustAsia Technologies, Inc. /C=CN/O=TrustAsia Technologies, Inc./CN=TrustAsia Global Root CA G3 /C=CN/O=TrustAsia Technologies, Inc./CN=TrustAsia Global Root CA G4 + /C=CN/O=TrustAsia Technologies, Inc./CN=TrustAsia TLS ECC Root CA + /C=CN/O=TrustAsia Technologies, Inc./CN=TrustAsia TLS RSA Root CA
* bn_test: avoid last use of BN_HEX_FMT1 in libressltb2025-11-151-2/+4
|
* bn_test: remove dead codetb2025-11-151-12/+1
| | | | | | We haven't defined SIXTY_FOUR_BITS in a long time, if ever. The last #undef SIXTY_FOUR_BITS were removed when we cleaned up opensslconf.h. Code behind #ifdef SIXTY_FOUR_BITS is therefore dead.
* the structure produced has alignment, which contained uninitialized data.deraadt2025-11-131-30/+57
| | | | | | | | | This is obviously fixed by using calloc(), but it was also observed that the precalculated storage requirement was higher than what is actually filled. So all the math has been rewritten to be byte accurate. Temporarily, a syslog_r check is added to report if we ever get count inconsistancy again so that can be fixed quickly. ok claudio
* bn_prime.c: fix includestb2025-11-081-3/+4
|
* move the sentence about X509_VERIFY_PARAM_get_hostflags(3)schwarze2025-11-071-6/+7
| | | | | | to the right section and mention the value returned if X509_VERIFY_PARAM_set_hostflags(3) was never called; OK tb@ kenjiro@
* Use 64 bit BN_ULONG on 64 bit Windows platforms.jsing2025-11-071-2/+2
| | | | | | | | 64 bit Windows is a special LLP snowflake and it is currently incorrectly using 32 bit BN_ULONG, since _LP64 is not defined. Enable 64 bit BN_ULONG if _LP64 or _WIN64 is defined. ok tb@
* tweak previous: "functions returns" -> "functions return"schwarze2025-11-061-4/+4
| | | | and add a missing Oxford comma
* Let this compile on m88k.miod2025-11-061-1/+3
|
* Use BN_ULONG in probable_prime_dh()tb2025-11-061-2/+2
| | | | | | | | | This was the last user of BN_LONG in code. It had no reason to do so. BN_mod_word() returns a BN_ULONG and since the largest prime in the small primes table primes[] is well below 20000, the only return value that could cause 'mod' to be negative was the error sentinel (BN_ULONG)-1. ok jsing kenjiro
* Use more specific types for BN.jsing2025-11-051-27/+29
| | | | | | | | | | | Be specific about width and use uint64_t/uint32_t, rather than using unsigned int/long/long long, based on platform. Additionally use UINT64_C() and UINT32_C() for constants, along with PRI*64/PRI*32 for formatting. This makes the platform responsible for providing the correct types/defines - all we then need to do is determine is if BN should use a 32 bit or 64 bit configuration. With input from and ok tb@
* Avoid the use of _LP64 in libcrypto regress.jsing2025-11-051-2/+2
| | | | | | | What the tests actually care about is the size of a BN_ULONG, hence condition on BN_BYTES instead. Discussed with tb@
* In nref_nos() don't leak the ASN1_INTEGER if the push failstb2025-11-031-2/+4
| | | | | | | (A much bigger problem here is a double free for which I will send out a diff shortly) From Niels Dossche
* x509_cpols: pass correct free function to sk_ASN1_INTEGER_free()tb2025-11-031-2/+2
| | | | from Niels Dossche
* x509_cpols: indent labels to make diffs more readabletb2025-11-031-8/+8
|
* Plug memeory leak in CMS_EncryptedData_encrypt()tb2025-11-031-2/+4
| | | | | | If CMS_EncryptedData_set1_key() fails, cms is leaked. From Niels Dossche
* ec_curve: Remove outdated creditstb2025-11-021-4/+1
|
* Needs <sys/param.h> for hppa.miod2025-10-311-3/+3
|
* des_key: add missing hyphen in semi-weak keystb2025-10-271-2/+2
| | | | From Thorsten Blum
* This test takes *days* to complete on older platforms, reduce the loop countmiod2025-10-261-2/+8
| | | | for them.
* Simplify tls13_server_hello_build()tb2025-10-251-5/+5
| | | | | | | | There's no need to pass in the hrr parameter as it is redundant with the tls13.hrr flag. This avoids boolean blindness in the caller and removes a leftover from before we had tls13.hrr. ok jsing kenjiro
* Add missing Nm line for SSL_SESSION_duptb2025-10-241-2/+3
|
* Add some regress coverage for SSL_SESSION_dup()tb2025-10-241-2/+22
| | | | ok kenjiro
* The ssl_verify_param.c test can now link dynamically against libcryptotb2025-10-241-3/+1
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-12-22 21:42:20 +0000