summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Rename SSL3_BUFFER to TLS_BUFFERMatt Caswell2022-11-147-87/+87
| | | | | | | | The SSL3 prefix no longer seems appropriate. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
* Move declarations out of record.h and record_local.hMatt Caswell2022-11-149-207/+166
| | | | | | | | | | We move many of the declarations in record.h and record_local.h into locations inside ssl/record/methods instead. Also many declarations were no longer required and could be removed completely. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
* Move tls_pad.c into ssl/record/methodsMatt Caswell2022-11-143-6/+7
| | | | | | | | | This file is used by libssl record layer methods and therefore should now be in the methods subdir Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
* Remove references to read_mac_secret and write_mac_secretMatt Caswell2022-11-142-6/+0
| | | | | | | | They are no longer used and can be removed. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
* Remove the read_iv/write_iv fields from SSL_CONNECTIONMatt Caswell2022-11-142-15/+3
| | | | | | | | | These fields are instead held in the new record layer code and are therefore no longer needed. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
* Remove compress/expand fields from SSL_CONNECTIONMatt Caswell2022-11-142-39/+27
| | | | | | | | They are no longer needed. The new record layer handles this. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
* Remove remaining refs to enc_(write|read)_ctx/(read|write)_hashMatt Caswell2022-11-145-49/+19
| | | | | | | | | Those fields are no longer used. Their previous function is now in the new record layer. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
* use OSSL_PARAM_construct_uint32 for max_early_dataJ.W. Jagersma2022-11-141-2/+2
| | | | | | | | | Otherwise, this causes a warning on platforms where 'uint32_t' is defined as 'unsigned long int' instead of 'unsigned int'. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19322)
* djgpp: Fix unused-but-set-variable warningJ.W. Jagersma2022-11-141-6/+10
| | | | | | | | | | I chose to just hide this behind '#ifndef __DJGPP__', instead of listing all the macro combinations where it *is* used. That would make quite a mess. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19322)
* djgpp: Skip check for negative timevalJ.W. Jagersma2022-11-141-0/+2
| | | | | | | | This causes a warning since tv_sec is unsigned. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19322)
* Define threads_lib.c functions only for OPENSSL_SYS_UNIXJ.W. Jagersma2022-11-141-1/+3
| | | | | | | | This matches the declaration in <openssl/crypto.h>. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19322)
* Cast socklen_t to size_t in assert comparisonJ.W. Jagersma2022-11-141-2/+2
| | | | | | | | This causes a warning otherwise when socklen_t is signed (Watt32). Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19322)
* Cast values to match printf format strings.J.W. Jagersma2022-11-146-12/+20
| | | | | | | | | | | | | | | For some reason djgpp uses '(unsigned) long int' for (u)int32_t. This causes errors with -Werror=format, even though these types are in practice identical. Obvious solution: cast to the types indicated by the format string. For asn1_time_test.c I changed the format string to %lli since time_t may be 'long long' some platforms. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19322)
* Resign test/certs/rootCA.pem to expire in 100 yearsBernd Edlinger2022-11-121-18/+76
| | | | | | Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19654)
* Update the validity period of ed25519 cerificatesBernd Edlinger2022-11-122-14/+74
| | | | | | | | Note: The private key is test/certs/root-ed25519.privkey.pem Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19654)
* test_CMAC_keygen(): Avoid using ECB cipher with CMACTomas Mraz2022-11-111-2/+2
| | | | | | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19401)
* cmac_set_ctx_params(): Fail if cipher mode is not CBCTomas Mraz2022-11-113-3/+27
| | | | | | | | | Also add negative test cases for CMAC and GMAC using a cipher with wrong mode. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19401)
* demos/mac/cmac-aes256: Clarify the cipher algorithm usedTomas Mraz2022-11-111-1/+1
| | | | | | | | | | | The currently used cipher is aes256 which is an alias to AES-256-CBC, so the demo is correct. However it might be misleading so make it clear the CBC mode cipher is used. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19401)
* Add test for generating safeprime DH parametersTomas Mraz2022-11-111-0/+25
| | | | | | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19635)
* Use libctx when generating DH parametersTomas Mraz2022-11-111-2/+2
| | | | | | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19635)
* fuzz: add punycode decoder fuzz testPauli2022-11-116-0/+57
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/19591)
* punycode: update to use WPACKET instead of using custom range checkingPauli2022-11-115-62/+96
| | | | | | | | | | | | | | Add test for `.' overflows, remove the output size argument from ossl_a2ulabel() since it was never used and greatly complicated the code. Convert ossl_a2ulabel() to use WPACKET for building the output string. Update the documentation to match the new definition of ossl_a2ulabel(). x509: let punycode handle the '\0' string termination. Saves a memset(3) and some size fiddling. Also update to deal with the modified parameters. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/19591)
* pem: avoid segfault if PKEY is NULL in PEM_write_bio_PrivateKeyMilan Broz2022-11-102-2/+10
| | | | | | | | | | | Make the code more robust and correctly handle EVP_PKEY set to NULL instead of dereferencing null pointer. Signed-off-by: Milan Broz <gmazyland@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19536)
* pem: fix a memory leak in PEM_write_bio_PrivateKey_traditionalMilan Broz2022-11-101-0/+1
| | | | | | | | | | | The copy of PKEY should be released on the error path. Easily reproduced with "ED448" context. Signed-off-by: Milan Broz <gmazyland@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19536)
* Limit size of modulus for BN_mod_exp_mont_consttime()Tomas Mraz2022-11-102-0/+29
| | | | | | | | | | Otherwise the powerbufLen can overflow. Issue reported by Jiayi Lin. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/19632)
* Revert "Skip DES based tests in FIPS mode"Pauli2022-11-101-10/+7
| | | | | | | | This reverts commit 5db2b4a292b4576185287a9e01e4ba4098b4aa66. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19631)
* Revert "Remove conditional FIPS dependence for 3DES"Pauli2022-11-101-7/+1
| | | | | | | | This reverts commit 464c1011b02936850fc779739013dba52650840a. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19631)
* Revert "Move DES based test cases out of FIPS territory"Pauli2022-11-101-2/+2
| | | | | | | | This reverts commit c511953a0828e126b80a9ea8cee12d001d685ba8. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19631)
* Put 3DES back into the FIPS provider as a non-approved algorithmPauli2022-11-101-1/+9
| | | | | | | | | This reverts commit fc0bb3411bd0c6ca264f610303933d0bf4f4682c and changes how 3DES is advertised. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19631)
* pkcs7: Remove unused includesCameron Cawley2022-11-101-5/+0
| | | | | | | | | CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19608)
* fips-label.yml: Fix the script after actions/github-script upgradeTomas Mraz2022-11-091-5/+5
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19636)
* CI: Add Alpine (musl)Sam James2022-11-091-0/+37
| | | | | | | | | | | | | | | | | | I'm not intending to add every single possible combination of distros to compiler-zoo, but I think this one is worthwhile. musl tends to be Different Enough (TM) to allow problems to be found, in particular (but not limited to) its malloc implementation ("mallocng"). It's also quite a common environment, especially in containers, so I think it's worth testing on. Signed-off-by: Sam James <sam@gentoo.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19577)
* Fix CertificateCompressionAlgorithm to be read as 2-octet-wideAlexander Sosedkin2022-11-081-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19600)
* Fix PACKET_equal test with BUF_LEN+1 on -Wstringop-overreadReinhard Urban2022-11-071-3/+3
| | | | | | | | | | | Either suppress the error, or better make smbuf longer. Detected with -Werror. CLA: trivial Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19528)
* QUIC CFQ FixesHugo Landau2022-11-075-25/+30
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19206)
* QUIC FIFDHugo Landau2022-11-0713-105/+815
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19206)
* QUIC TXPIMHugo Landau2022-11-076-2/+418
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19206)
* QUIC CFQHugo Landau2022-11-076-1/+681
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19206)
* QUIC Frame-in-Flight Manager DesignHugo Landau2022-11-074-0/+504
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19206)
* Use the same encryption growth macro consistentlyMatt Caswell2022-11-071-11/+10
| | | | | | | | | | | | | | | | We had two different macros for calculating the potential growth due to encryption. The macro we use for allocating the underlying buffer should be the same one that we use for reserving bytes for encryption growth. Also if we are adding the MAC independently of the cipher algorithm then the encryption growth will not include that MAC so we should remove it from the amount of bytes that we reserve for that growth. Otherwise we might exceed our buffer size and the WPACKET_reserve operation will fail. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19622)
* Test that signatures using hash name commands work properlyTomas Mraz2022-11-072-1/+53
| | | | | | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/19606)
* apps/dgst.c: Set digestname from argv[0] if it is a builtin hash nameTomas Mraz2022-11-071-0/+2
| | | | | | | | Fixes #19589 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/19606)
* Assert that we do not exceed the DTLS MTUMatt Caswell2022-11-071-0/+11
| | | | | | Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19516)
* Fix dtls_get_max_record_overhead()Matt Caswell2022-11-075-24/+43
| | | | | | | | | | We fix dtls_get_max_record_overhead() to give a better value for the max record overhead. We can't realistically handle the compression case so we just ignore that. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19516)
* Fix the ceiling on how much encryption growth we can haveMatt Caswell2022-11-071-8/+12
| | | | | | | | | | Stitched ciphersuites can grow by more during encryption than the code allowed for. We fix the calculation and add an assert to check we go it right. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19516)
* Add zlib oneshot compressionTodd Short2022-11-077-7/+96
| | | | | | | | Fixes #19520 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19603)
* Check for private key existence before calling eddsa sign functionsWangchong Zhou2022-11-042-1/+83
| | | | | | | | Fixes #19524 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19525)
* crypto/sha/asm/sha512-ia64.pl: When checking assembler file names, ignore caseRichard Levitte2022-11-041-2/+2
| | | | | | | | | | The use case is that uppercase .ASM extension may be used on some platforms, and we were only testing for the lowercase extension. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/19604)
* Configurations/*.tmpl: overhaul assembler make rules.Richard Levitte2022-11-044-34/+15
| | | | | | | | | | | | | | | | | | | NOTE: Not Configurations/unix-Makefile.tmpl, as that was done 4 years ago, in commit a23f03166e0ec49ac09b3671e7ab4ba4fa57d42a. So far assembly modules were intended to be built as .pl->.S->.{asmext} followed by .{asmext}->.o. This posed a problem in build_all_generated rule if it was executed on another computer, and also turned out to be buggy, as .S was also translated to .{asmext} on Windows and VMS. Both issues are fixed by changing the rule sequence to .pl->.S and then .S->.s->.o, with the added benefit that the Windows and VMS build file templates are more in sync with unix-Makefile.tmpl and slightly simpler. Fixes #19594 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19598)
* Update GitHub actions as suggested by dependabotTomas Mraz2022-11-0318-55/+55
| | | | | | Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19581)
View Lorry Controller Status