summaryrefslogtreecommitdiff
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* libssl: ensure server selected ALPN was advertisedtb8 days1-6/+20
| | | | | | | | | | | | | | | Per RFC 7301, section 3.2, "In the event that the server supports no protocols that the client advertises, then the server SHALL respond with a fatal "no_application_protocol" alert. If a server does not do that and chooses a protocol that we have not advertised, we should abort the handshake. The RFC does not specify an alert for this case. BoringSSL chose illegal_parameter and OpenSSL decode_error. I slightly prefer illegal_parameter, so went with that. Reported by Acts1631 with a similar diff. ok jsing kenjiro
* tlsext: check we reject unadvertised selected protocoltb8 days1-1/+24
| | | | This test currently fails and will be fixed in ssl_tlsect.c r1.168
* tlsext_alpn_client_process(): rename list and prototb8 days1-8/+8
| | | | | | | Use server_list and selected instead of list and proto to reduce noise in the next commit. ok jsing kenjiro
* rsa_eay: Replace handrolled BN_bn2binpad with the real thingtb10 days1-19/+7
| | | | | | | | | | | | | Just a tiny little bit of lipstick on this entelodont. This is simpler and does not change behavior as BN_bn2binpad() returns -1 on failure and num on success. jsing points out that BN_bn2binpad() is constant time. ok jsing kenjiro PS: henning, you owe me a significant amount of quality beverages for making me look at this particular tire fire (and corresponding XS files).
* libcrypto: harden cms_kek_cipher() a bittb10 days1-3/+8
| | | | | | | | | | | | | | | | When AES key unwrap with padding is in use, the EVP interface breaks its contract and writes more than the outlen it initially reports to the output buffer. This is an old, sneaky trap that the muppet set eons ago and many victims walked right into it, including the muppet himself. If inlen is larger than outlen, allocate inlen bytes to unwrap with padding to avoid a buffer overwrite. This is a variant of OpenSSL's fix. Since we do not support AES keywrap with padding no actual bufer overwrite occurs here at the moment, but if we ever chose to do so (unlikely) this trap would be avoided. There's plenty more traps that the next round of scas will surely find in this absolute trashfire of CMS support code. ok kenjiro
* Don't drop X509_V_ERR_HOSTNAME_MISMATCH when verify callback returns 1beck10 days1-2/+5
| | | | | | | | | | | | | While not the advised way of using the verify callback (either by OpenSSL or by us) in production, sometimes folks like to return 1 from everything in the callback and then check the error return and make decicions about things. This fix ensures that such callbacks will see the hostname mismatch and be able to act upon them. Reported by Alexander Aleksandrovic Klimov ok tb@
* fix a double word; ok tb@jsg11 days1-3/+3
|
* ICBB -> ICDBjsg12 days1-3/+3
|
* grammar; a -> anjsg12 days8-24/+24
| | | | ok schwarze@ sthen@ krw@
* Make deprecation of ASN1_STRING_data(3) more prominenttb14 days1-19/+22
| | | | | | | | | | | | | | | | | | | | The function has been deprecated for a long time: OpenSSL did so when adding ASN1_STRING_get0_data in 1.1.0. beck removed it from OpenSSL 4. The reason is that it returns a modifiable "string" and you should not be modifying an ASN1_STRING this way. You should be using one of the clumsy, inconvenient accessors. schwarze merged the deprecation when adding documentation for ASN1_STRING_get0_data() in 2018. Make this a bit more obvious: move function to the end of the documented functions in this page, and mark it deprecated in the SYNOPSIS, too. I'm aware that deprecation does not work. I was hopeful to be able to remove the function in the last cycle, but that did not happen and it might not happen in this cycle either. It will happen at some point, though. Prompted by a question by brad
* grammar; an program -> a programjsg14 days1-3/+3
|
* document MALLOC_OPTIONS=D output; OK otto@schwarze2026-08-221-2/+72
|
* RFC 8446 -> 9846tb2026-08-211-2/+2
| | | | pointed out by kenjiro
* Change RFC references from 8446 to 9846 and adjust section numberstb2026-08-2119-99/+97
| | | | with/ok kenjiro
* SSL_get_finished: remove comment about TLSv1.0 and TLSv1.1tb2026-08-211-4/+2
| | | | ok kenjiro
* Simplify handling of remaining record content on switch to legacy stack.jsing2026-08-211-35/+13
| | | | | | | | Now that the legacy stack uses struct tls_content, store any remaining record content directly, rather than fudging up a record that the legacy stack will process on the next read. ok kenjiro@ tb@
* Allocate TLS 1.3 receive buffers lazilykenjiro2026-08-211-14/+7
| | | | | | | | | | | | The receive buffer is not used for records created for sending. Avoid allocating a maximum-sized buffer in tls13_record_new() and instead allocate a header-sized buffer when tls13_record_recv() is first called. The buffer will grow as needed once the record length is known. This avoids an unnecessary allocation for outgoing records and reduces the initial allocation size for incoming records. ok tb jsing
* update cert.pem based on newer mozilla ca root store, ok tb@sthen2026-08-201-198/+192
|
* s2i_ASN1_INTEGER.3: mark up second use of usr_data for consistencytb2026-08-181-3/+5
|
* libssl: use correct alert for key_share without supported_groupstb2026-08-181-2/+2
| | | | | | | | | | | | | | | | Processing the key_share extension requires a supported_groups extension. RFC 9846, section 9.2 explicitly mandates a missing_extension alert in this situation, so use that instead of illegal_parameter. We do have code in tls13_client_hello_required_extensions() implementing the requirements on extensions of the relevant paragraph of that section with the corrrect alerts. The error in the extension processing happens before hitting these checks in this particular case. Reported by Tom Gouville of the tlspuffin team as part of https://github.com/libressl/portable/issues/1279 ok jsing kenjiro
* SSL_CTX_new(): fix spelling of NULLtb2026-08-141-3/+3
|
* wycheproof: recognize Cobblestone-{128,256}tb2026-08-111-1/+3
|
* hdestroy(3): stop freeing key valuesdaniel2026-08-102-46/+3
| | | | | | | | | | | | | | POSIX leaves ownership of ENTRY.key with the caller. Our current behaviour came from NetBSD when this code was imported in 2004. NetBSD and FreeBSD both stopped freeing key values in July 2014. NetBSD in commit fe0a1a6 and FreeBSD in commit e19f362. Remove the call to free(3) to align ourselves with NetBSD, FreeBSD and POSIX. Also adjust rsync for the change in semantics. Flagged by Sortix os-test. ok millert@, deraadt@
* Check HMAC() return value to avoid a later use of uninitialized datakenjiro2026-08-101-3/+7
| | | | | | CID 25423 ok tb@
* switch aarch64 CPU feature detection to elf_aux_info()naddy2026-08-081-63/+19
| | | | | | | ok kettenis@ tb@ Restore commit; install media build error is not reproducible (deraadt@) or was operator error (naddy@)
* Restore the OCSP no-check extension methodkenjiro2026-08-072-2/+5
| | | | | | | | | The conversion of X509V3_EXT_get_nid() from a table to a switch omitted the OCSP no-check extension method. Add the missing accessor declaration and switch case. ok tb@
* revert switch to elf_aux_info(); it breaks the install medianaddy2026-08-071-19/+63
|
* OBJ_create: OBJ_add_objects -> OBJ_create_objectstb2026-08-051-2/+2
|
* Remove documentation of OBJ_add_object(3)tb2026-08-051-39/+14
| | | | | | | | | | | | | This API was removed a long time ago but I forgot to update the manpage (probably because doing so is slightly non-trivial). There's still a lot of API here that should be removed. OBJ_add_objects() seems now unused while OBJ_new_nid() is used by the one consumer that is single-handedly responsible for at least two dozen APIs that could otherwise be removed from libcrypto with significant simplifications: security/xca. It would appear the author is on a quest to figure out how to make use of whatever undocumented garbage they can find in the openssl headers. That's of course a hobby project you can pursue for decades.
* Add missing Dv macro for NI_NUMERICSERV and NI_DGRAMclaudio2026-08-051-4/+4
| | | | OK tb@
* switch aarch64 CPU feature detection to elf_aux_info()naddy2026-08-041-63/+19
| | | | ok kettenis@ tb@
* callbackfailures: allow specifying the root certificate filekenjiro2026-07-311-10/+11
| | | | | | | | Accept an optional roots file argument while retaining /etc/ssl/cert.pem as the default. This allows portable regress users to provide a CA bundle when the default path is unavailable. ok tb
* Make file-local functions statickenjiro2026-07-319-27/+27
| | | | | | | These functions are only used within their implementation files and do not need external linkage. Mark them static. ok tb
* Remove unused BUF_reverse()kenjiro2026-07-311-22/+1
| | | | | | | BUF_reverse() has no callers and is not part of the public API. Remove the unused function, which also eliminates its -Wmissing-prototypes warning. ok tb beck
* Add missing internal header includeskenjiro2026-07-3125-25/+60
| | | | | | | | | Include the relevant internal headers in implementation files that define internal functions. Also make asn1_local.h and pkcs12_local.h self-contained by including their corresponding public headers. ok tb beck
* ocspcheck: make validate_response() static, it's only used in this filetb2026-07-291-3/+2
|
* timingsafe test: make check() statictb2026-07-291-2/+2
|
* verify test: print size_t with %zutb2026-07-291-2/+2
|
* tlsfuzzer: use an f-string instead of explicit format specifierstb2026-07-281-4/+2
|
* tlsfuzzer: avoid mutable default argumentstb2026-07-281-6/+18
|
* tlsfuzzer: simplify check for directorytb2026-07-281-2/+2
|
* tlsfuzzer: use sys.exit() instead of naked exit()tb2026-07-261-8/+8
|
* tlsfuzzer: whitespace tweakstb2026-07-261-4/+5
|
* tlsfuzzer: remove unnecessary semicolontb2026-07-261-2/+2
|
* Unlock CRYPTO_LOCK_UI on ui_open_session() failuretb2026-07-251-3/+5
| | | | | | | | | | | | | | | | | | | | | Both ui_open_session() implementations, open_console() in ui_openssl.c in base, and the one in ui_openssl_win.c in portable, grab the lock of type CRYPTO_LOCK_UI before doing anything else. The only internal (and, as far as I can tell, the only existing) caller, UI_process(), returns immediately on failure. The calling thread thus keeps holding the lock and the next call to UI_process() will block indefinitely. Fix this by using the common exit path, which calls ui_close_session() aka close_console(), both implementations of which release the lock. Thanks to Kartik (@sage-mode-hunter) who proposed an alternative fix for ui_openssl_win.c, which we would have to apply to ui_openssl.c as well. Matches OpenSSL behavior since PR #2037 Closes https://github.com/libressl/portable/pull/1334 ok kenjiro
* Improve SHA-3 performance.jsing2026-07-221-37/+281
| | | | | | | | | | | Replace the tiny-sha3 keccakf implementation with an unrolled and interleaved algorithm, that is hidden away in an obsolete reference implementation. This gets us 3.3x speed up on arm64 (Apple M2), a 1.3x speed up on amd64 (Intel i7-1165G7) and 6x speed up on sparc64 (M3000). ok tb@
* bn_mul_div: use (unsigned long long) instead of (uint64_t) to print with %llutb2026-07-211-2/+2
|
* Alberta moved to permanent -06 on 2026-06-18, update test datamillert2026-07-171-17/+17
|
* Remove redundant BIO_write() length assertions in b64_write()kenjiro2026-07-171-3/+1
| | | | | | | | | b64_write() asserted that BIO_write() does not return more bytes than requested in two places. Other BIO_write() call sites do not make this check, and there is no special handling here that depends on asserting this condition. ok tb@ beck@ joshua@
* Remove stale SECURE RENEGOTIATION referencekenjiro2026-07-171-5/+3
| | | | | | | | | SSL_CTX_set_options(3) no longer has a SECURE RENEGOTIATION section, but SSL_OP_LEGACY_SERVER_CONNECT still referenced it. Replace the dangling cross reference with a note that the option is no longer set by default. ok tb@ beck@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-09-05 23:45:13 +0000