Skip to main content
swh:1:snp:dc2a5002442a00b1c0eda7c65d04ea7455e166cd
sort by:
RevisionAuthorDateMessageCommit Date
26ecab1 Matt Caswell26 October 2023, 13:22:51 UTCPrepare for release of 3.2 beta 1 Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes26 October 2023, 13:22:51 UTC
0f8c670 Matt Caswell26 October 2023, 13:22:51 UTCmake update Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes26 October 2023, 13:22:51 UTC
2699ffe Matt Caswell26 October 2023, 13:21:19 UTCCopyright year updates Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes26 October 2023, 13:21:19 UTC
6a0ae39 Tomas Mraz24 October 2023, 11:44:26 UTCBlake2b: Use OSSL_DIGEST_PARAM_SIZE as settable instead of XOFLEN BLAKE2 is not really an extensible output function unlike SHAKE as the digest size must be set during the context initialization. Thus it makes no sense to use OSSL_DIGEST_PARAM_XOFLEN. We also need to adjust EVP_DigestFinal_ex() to query the OSSL_DIGEST_PARAM_SIZE as gettable ctx param for the size. Fixes #22488 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22491)25 October 2023, 19:13:39 UTC
c7ed5e4 Hugo Landau24 October 2023, 06:59:36 UTCQUIC CHANNEL: Handle ping deadlines differently Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22476)25 October 2023, 10:14:24 UTC
29f6338 Hugo Landau23 October 2023, 14:44:26 UTCQUIC CHANNEL: Tweak crypto buffer sizes Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22476)25 October 2023, 10:14:24 UTC
4d100bb Hugo Landau23 October 2023, 14:38:16 UTCQUIC CHANNEL: Correct timeout calculation for ACKs ACKs are not restricted by CC so do not consider CC when determining when we will emit an ACK. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22476)25 October 2023, 10:14:24 UTC
82b7a0e Hugo Landau20 October 2023, 15:52:40 UTCQUIC TLS: Ensure QUIC_TLS is ticked between each processed RX packet Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22476)25 October 2023, 10:14:23 UTC
3860ef2 Tomas Mraz05 October 2023, 17:48:15 UTCQUIC: Test connection with large client and server cert chains Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22476)25 October 2023, 10:14:23 UTC
dc1cc3e Tomas Mraz25 October 2023, 09:01:58 UTCfuzz-checker.yml: Revert inadvertent change from fac61ea Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22501)25 October 2023, 09:05:27 UTC
2e471a7 Tomas Mraz09 October 2023, 08:32:44 UTCAvoid using gets as an argument name in a prototype This otherwise breaks compilation of applications using ssl.h on MingW. Fixes #22296 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22316)25 October 2023, 08:53:46 UTC
59d8a33 James Muir24 October 2023, 01:00:41 UTCquic: documentation and demo nits The code for the quic demos (from the openssl guide) is presented as modifications of tls-client-block.c. Make it so that the quic code better matches the tls code (drop unneeded assignments to "ret", use the same comment on SSL_connect(), add the same printf() statement). Also fix some minor typos. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22483)25 October 2023, 08:44:32 UTC
687326c Hugo Landau24 October 2023, 07:23:39 UTCQUIC MULTISTREAM TEST: Output connection closure reason info on failure Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22485)25 October 2023, 08:42:03 UTC
55abe74 Hugo Landau24 October 2023, 07:15:18 UTCQUIC APL: Add support for querying frame type causing closure Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22485)25 October 2023, 08:42:03 UTC
95420a2 Matt Caswell23 October 2023, 17:11:06 UTCDon't wait in select if we have data to write In s_client, when using quic, if we have data from the user to write then we shouldn't hang in "select" waiting for something to happen. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22480)25 October 2023, 08:40:48 UTC
1a91fda Matt Caswell13 October 2023, 11:19:40 UTCMake s_client -quic -debug work The callback that makes -debug print the data sent/received needed extending for the new QUIC callback codes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22480)25 October 2023, 08:40:48 UTC
8c11031 Tomas Mraz23 October 2023, 14:05:27 UTCquic_multistream_test: Output info about connection close reason In case the connection close error code is unexpected print out the reason to help with diagnostics. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22474)25 October 2023, 08:39:41 UTC
74efc54 Pauli25 October 2023, 07:30:39 UTCsslapitest: add cast to avoid compiler error Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22500)25 October 2023, 08:36:36 UTC
d732991 Tomas Mraz23 October 2023, 14:16:50 UTCquic_tserver_test: Raise the initial timeout limit There were intermitten failures on the test occasionally and 1s initial limit might be too short. Fixes #22424 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22475)25 October 2023, 08:35:31 UTC
8b26854 Clemens Lang16 October 2023, 13:30:26 UTCrsa: Add SP800-56Br2 6.4.1.2.1 (3.c) check The code did not yet check that the length of the RSA key is positive and even. Signed-off-by: Clemens Lang <cllang@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22403)25 October 2023, 08:26:51 UTC
df5f419 Ingo Franzki16 October 2023, 12:07:05 UTCspeed: Correct handling of async_jobs for KEM and signature algos Setup the loopargs array for all jobs, not only for the very first one. It may fail with "Could not allocate 0 bytes for sig sign loop" and/or will cause the loop functions to fail silently, because they operate on a NULL PKEY context when "-async_jobs <n>" is specified. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22399)25 October 2023, 08:24:29 UTC
4e09305 Ingo Franzki16 October 2023, 12:06:04 UTCspeed: Fix memory leaks Free the PKEYs created for KEM and signature algorithms. Free the encrypt/decrypt PKEY contexts for RSA. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22399)25 October 2023, 08:24:29 UTC
66f4782 slontis20 March 2023, 05:08:38 UTCCreate hierarchical demo Makefile. Adds a Makefile with all, clean, and test targets. This has only been added for demos that already contain Makefiles. For problematic tests that require inputs, the test target does nothing. (Note: Demos should be self contained and not require unknown external inputs. This PR does not attempt to fix this.) Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20546)25 October 2023, 08:21:07 UTC
dbbdb94 Matt Caswell23 October 2023, 11:16:44 UTCAdd a test for retries when sending app data Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22473)24 October 2023, 16:37:19 UTC
b9b9f48 Matt Caswell23 October 2023, 08:54:16 UTCMake sure we remember how much data we sent in the event of a retry If a retry occurs we need to reset s->rlayer.wnum so that next time around we remember how much data we already sent. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22473)24 October 2023, 16:37:19 UTC
86e11b1 Matt Caswell20 October 2023, 11:33:25 UTCWhen requeueing deferred URXEs retain the order If a URXE cannot be processed yet then we add it to the urx_deferred list. Later, when they can be processed, we requeue them in the urx_pending list. We must not reverse the order when doing so. We want to process the URXEs in the order that they were received. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22452)24 October 2023, 16:35:54 UTC
acf9512 Hugo Landau16 October 2023, 14:50:30 UTCAdjust mdl configuration Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22405)24 October 2023, 16:34:07 UTC
514430c Hugo Landau16 October 2023, 14:50:25 UTCAdd QUIC README file24 October 2023, 16:34:07 UTC
26f75c2 Nate Karstens20 October 2023, 16:24:33 UTCAdd notes on use of strdup Added notes to OPENSSL_INIT_set_config_filename and OPENSSL_INIT_set_config_appname explaining why strdup is used instead of OPENSSL_strdup. CLA: trivial Co-authored-by: Jean Apolo <jean.apolo@garmin.com> Signed-off-by: Jean Apolo <jean.apolo@garmin.com> Signed-off-by: Nate Karstens <nate.karstens@garmin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21742)24 October 2023, 16:30:58 UTC
a2fe10c Pauli05 October 2023, 23:32:20 UTCtest: add unit test for CVE-2023-5363 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>24 October 2023, 13:32:24 UTC
1e6e682 Pauli05 October 2023, 23:43:46 UTCchanges and news entries for CVE-2023-5363 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>24 October 2023, 13:32:24 UTC
f3a7e6c Pauli05 October 2023, 23:26:23 UTCevp: process key length and iv length early if present evp_cipher_init_internal() takes a params array argument and this is processed late in the initialisation process for some ciphers (AEAD ones). This means that changing the IV length as a parameter will either truncate the IV (very bad if SP 800-38d section 8.2.1 is used) or grab extra uninitialised bytes. Truncation is very bad if SP 800-38d section 8.2.1 is being used to contruct a deterministic IV. This leads to an instant loss of confidentiality. Grabbing extra bytes isn't so serious, it will most likely result in a bad decryption. Problem reported by Tony Battersby of Cybernetics.com but earlier discovered and raised as issue #19822. Fixes CVE-2023-5363 Fixes #19822 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>24 October 2023, 13:32:24 UTC
0bf1814 Tomas Mraz19 October 2023, 06:37:47 UTCFix Coverity 1547856: memset() uses only the lowest byte of c Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22430)24 October 2023, 13:23:50 UTC
7998e7d Matthias St. Pierre15 October 2023, 23:35:48 UTCrand: fix seeding from a weak entropy source The 'rand_generate' method is not well suited for being used with weak entropy sources in the 'get_entropy' callback, because the caller needs to provide a preallocated buffer without knowing how much bytes are actually needed to collect the required entropy. Instead we use the 'rand_get_seed' and 'rand_clear_seed' methods which were exactly designed for this purpose: it's the callee who allocates and fills the buffer, and finally cleans it up again. The 'rand_get_seed' and 'rand_clear_seed' methods are currently optional for a provided random generator. We could fall back to using 'rand_generate' if those methods are not implemented. However, imo it would be better to simply make them an officially documented requirement for seed sources. Fixes #22332 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22394)24 October 2023, 10:14:11 UTC
0a8faac Richard Levitte11 October 2023, 01:19:23 UTCrand: improve error message for rand pool overflows Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22394)24 October 2023, 10:14:02 UTC
fac61ea Tomas Mraz23 October 2023, 12:26:32 UTCquic_record, quicapi, and quicfaults tests do not support fuzzing builds Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22472)23 October 2023, 12:45:09 UTC
bde5411 Tomas Mraz19 October 2023, 15:19:44 UTCrun-checker-daily.yml: If the openssl app is not built do not run it Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22443)23 October 2023, 09:44:14 UTC
f2c2857 Matt Caswell19 October 2023, 13:54:58 UTCDon't run the QUIC client fuzzer if QUIC is disabled Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:22 UTC
49f5d95 Matt Caswell19 October 2023, 09:07:53 UTCUpdate the corpora files to include the new quic-client subdir Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:22 UTC
27d8827 Matt Caswell16 October 2023, 16:24:56 UTCFurther tweaks to the CI runs for fuzzing Have a new job just to run the fuzz tests with fuzzing build mode enabled. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:22 UTC
9252efd Matt Caswell16 October 2023, 12:10:33 UTCTeach the quic-client fuzzer about time We allow the fuzzer to influence the time between different packets using the fake time capability. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:22 UTC
d8a4451 Matt Caswell13 October 2023, 15:33:31 UTCIf an error occurs constructing the quic record layer, free it properly We need to call quic_free() to free the record layer to ensure than any BIO that was already set is also freed. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:22 UTC
d8bf5ea Matt Caswell13 October 2023, 13:23:40 UTCDrop FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION for some builds Some builds that weren't doing fuzzing were defining this which makes no sense and is not appropriate for non-fuzzing builds. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:22 UTC
f762055 Matt Caswell12 October 2023, 15:56:00 UTCSome cleanups in the quic-client fuzzer Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:22 UTC
d3bb8fe Matt Caswell12 October 2023, 15:10:12 UTCAdd a test for OSSL_ERR_STATE_save_to_mark() Add a test for the recently added function OSSL_ERR_STATE_save_to_mark(). We can just modify the existing test_save_restore() to add this in. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:22 UTC
b13f3f1 Matt Caswell12 October 2023, 14:55:48 UTCAdd a HISTORY section in the docs about the new ERR_STATE functions Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:12 UTC
1f8a8c1 Matt Caswell12 October 2023, 14:42:22 UTCFix a use-after-free in qrx_proces_pkt When calling qrx_relocate_buffer, both the rxe and the pointer to the token may be changing locations. We have to use a temporary copy of the token pointer to avoid referencing the old location of the rxe. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:12 UTC
94300d8 Matt Caswell12 October 2023, 11:38:22 UTCEnsure that the ERR_STATE is left in a consistent state We shouldn't ever have the case where the data flags indicate that err_data has been malloc'd, but the err_data field is NULL. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:12 UTC
c327ebb Matt Caswell11 October 2023, 16:35:33 UTCAdd fuzz test recipe for the quic client fuzzer Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:12 UTC
3714a73 Matt Caswell11 October 2023, 16:35:10 UTCUpdate the fuzz README to provide info about the stdc++ requirements Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:12 UTC
702bb16 Matt Caswell11 October 2023, 09:46:46 UTCIgnore a bad signature in a CertificateVerify message while fuzzing We ignore such a bad signature when fuzzing - it will never be correct. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:12 UTC
b62ac1a Matt Caswell11 October 2023, 09:45:14 UTCDon't fail on a bad dcid in the tranport params when fuzzing We accept a bad original destination connection id in the transport params while we are fuzzing since this may change every time. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:12 UTC
acee7d6 Matt Caswell11 October 2023, 09:43:58 UTCUpdates to the quic client fuzzer Handle retryable errors from SSL_read(). Also ensure the underlying BIO handles the destination address capability. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:12 UTC
5415383 Matt Caswell06 October 2023, 16:32:14 UTCDon't encrypt/decrypt packet data during fuzzing Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:12 UTC
ee7729e Kurt Roeckx23 November 2022, 13:24:13 UTCAdd quic client fuzzer. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22368)23 October 2023, 09:08:12 UTC
b6eb95f наб18 October 2023, 13:35:55 UTCReference the non-"legacy" provider names directly from EVP_md5(3) &c. Earlier today, it took me five manuals! to find what on earth the "Performance"/"EVP_MD_fetch(3)" crosslinks actually mean: EVP_sha1(3) crypto(7) EVP_MD_fetch(3) (but not there! don't read that!) OSSL_PROVIDER-default(7) EVP_MD-SHA1(7) If, instead, EVP_sha1(3) referenced EVP_MD-SHA1(7) at /all/, which it should do, since it's supposed to be what you're replacing it with, but it doesn't actually say that, maybe people would use it. I know I didn't because it's basically just deadass buried As found by git grep -l 'and should consider using' Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22420)20 October 2023, 15:46:57 UTC
039119a Matt Caswell19 October 2023, 10:37:28 UTCAdd a test for converting OSSL_TIME to struct timeval Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22440)20 October 2023, 15:33:40 UTC
c239bc9 Matt Caswell19 October 2023, 10:00:39 UTCRound up nano secs when converting OSSL_TIME to struct timeval struct timeval doesn't support nanosecs but OSSL_TIME does. We round up any nanosecs to ensure that a non-zero input always results in a non-zero output. This fixes a quic-client fuzzer hang. Fixes #22437 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22440)20 October 2023, 15:33:40 UTC
055f3dd Hugo Landau19 October 2023, 10:58:26 UTCQUIC: Test handling of post-connection session tickets Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22439)20 October 2023, 15:32:46 UTC
461d411 Hugo Landau19 October 2023, 08:27:11 UTCQUIC: Prevent incoming oversize tokens Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22436)20 October 2023, 15:31:40 UTC
21f7a09 Neil Horman18 October 2023, 14:01:21 UTCConvert jdkTrustedKeyUsage to be a pkcs12 cmd line option Creating JDK compatible pkcs12 files requires a bit more than just adding the Trusted Key Usage OID to a certbag in the pkcs12 file. Additionally the JDK currently requires that pkcs12 files setting this oid _not_ contain any additional keys, and in response will produce unpredictable results. This could be solved by implying --nokeys when the pkcs12 utility is run and the config option is set, but thatcould confuse users who didn't specify nokeys on the command line. As such, remove the config file setting for this feature, and replace it with a -jdktrust command line option, that is documented to assert nokeys when a users specifies the new command line option. Fixes #22215 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22422)20 October 2023, 15:30:43 UTC
7757f5e Tomas Mraz17 October 2023, 08:00:58 UTCQUIC: Add handling of SSL_get_shutdown() Return SSL_SENT_SHUTDOWN and SSL_RECEIVED_SHUTDOWN with semantics similar to TLS connections. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22408)20 October 2023, 15:29:28 UTC
8e520d2 Tomas Mraz17 October 2023, 06:58:22 UTCPostpone two TODO(QUIC) items appropriately The one in ch_rx_handle_packet() is a tuning thing -> QUIC FUTURE The one in ossl_quic_tserver_shutdown() is a server thing -> QUIC SERVER Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22408)20 October 2023, 15:29:18 UTC
5516d20 Matthias St. Pierre16 October 2023, 21:48:03 UTCrand: add callbacks to cleanup the user entropy resp. nonce The `get_user_{entropy,nonce}` callbacks were add recently to the dispatch table in commit 4cde7585ce8e. Instead of adding corresponding `cleanup_user_{entropy,nonce}` callbacks, the `cleanup_{entropy,nonce}` callbacks were reused. This can cause a problem in the case where the seed source is replaced by a provider: the buffer gets allocated by the provider but cleared by the core. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22423)20 October 2023, 08:48:34 UTC
098f27f Matt Caswell17 October 2023, 13:55:48 UTCIgnore ping deadline when calculating tick deadline if we can't send If the CC TX allowance is zero then we cannot send a PING frame at the moment, so do not take into account the ping deadline when calculating the tick deadline in that case. This avoids the hang found by the fuzzer mentioned in https://github.com/openssl/openssl/pull/22368#issuecomment-1765131727 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22410)19 October 2023, 09:54:44 UTC
56e3032 Matt Caswell17 October 2023, 15:26:13 UTCIgnore retry packets that arrive too late RFC 9000 s 17.2.5.2 says > After the client has received and processed an Initial or Retry packet > from the server, it MUST discard any subsequent Retry packets that it > receives. We were checking for multiple Retry packets, but not if we had already processed an Initial packet. Fixes the assertion failure noted in https://github.com/openssl/openssl/pull/22368#issuecomment-1765618884 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22411)19 October 2023, 09:53:07 UTC
fa9e6ad Tomas Mraz19 October 2023, 07:23:43 UTCcms_enc.c: Include crypto/asn1.h for struct asn1_object_st Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22432)19 October 2023, 08:15:56 UTC
80f3296 Tomas Mraz19 October 2023, 07:18:37 UTCDo not include crypto/asn1.h from internal/cryptlib.h This is unnecessary and conceptualy wrong as headers from internal should not include headers from crypto Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22432)19 October 2023, 08:15:56 UTC
1d76885 Tomas Mraz09 October 2023, 09:39:12 UTCapps.c: Remove a redundant error print-out Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22318)19 October 2023, 08:10:00 UTC
edc2b6e Tomas Mraz09 October 2023, 09:36:50 UTCapps: Print out a proper message when a store cannot be opened Fixes #22306 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22318)19 October 2023, 08:10:00 UTC
9f54da4 Hugo Landau16 October 2023, 14:02:10 UTCFix markdown Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22369)19 October 2023, 07:28:59 UTC
f92d4a0 Hugo Landau16 October 2023, 13:58:36 UTCAdd SNI Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22369)19 October 2023, 07:28:59 UTC
17b8f40 Hugo Landau16 October 2023, 12:33:11 UTCRename Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22369)19 October 2023, 07:28:59 UTC
10c0424 Hugo Landau16 October 2023, 12:33:11 UTCAdd link to nghttp3 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22369)19 October 2023, 07:28:59 UTC
444d18f Hugo Landau16 October 2023, 12:33:11 UTCAdd copyright headers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22369)19 October 2023, 07:28:59 UTC
47f8cfe Hugo Landau16 October 2023, 12:33:11 UTCQUIC: Add comments to HTTP/3 demo Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22369)19 October 2023, 07:28:59 UTC
e33af80 Hugo Landau16 October 2023, 12:33:11 UTCQUIC: Add HTTP/3 demo using nghttp3 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22369)19 October 2023, 07:28:59 UTC
e62097f Neil Horman11 October 2023, 16:45:44 UTCAdd a test to confirm that legacy rsa keys work Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22334)18 October 2023, 16:08:02 UTC
2647726 Neil Horman10 October 2023, 15:06:44 UTCDont require CRT params on ossl_rsa_set0_all_params Its not required that crt params be available in an RSA key, so don't perform an error check on them Fixes #29135 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22334)18 October 2023, 16:08:02 UTC
4ad3a44 Neil Horman05 September 2023, 16:08:19 UTCremove sanity check from ossl_rsa_todata Theres no reason we should gate ossl_rsa_todata on there being a minimum set of parameters. EVP_PKEY_todata makes no guarantees about the validity of a key, it only returns the parameters that are set in the requested key, whatever they may be. Remove the check. Fixes #21935 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22334)18 October 2023, 16:08:02 UTC
15a39e7 Tomas Mraz04 September 2023, 09:10:42 UTCossl_param_build_set_multi_key_bn(): Do not set NULL BIGNUMs This makes them zeroes otherwise where NULLs actually mean the values aren't present. Fixes #21935 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22334)18 October 2023, 16:07:13 UTC
cd920f8 Neil Horman11 October 2023, 13:34:02 UTCensure that ossl_obj_nid_lock is allocated before use external calls to OBJ_new_nid will fail on an attempt to lock the ossl_obj_nid_lock as it won't have been initalized yet. Bifurcate OBJ_new_nid into an external and internal variant, in which the former calls ossl_obj_write_lock (ensuring that the nid_lock is initalized), while OBJ_create (the sole internal caller) uses the latter to avoid having to drop and re-acquire the lock Fixes #22337 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22350)18 October 2023, 14:52:45 UTC
bd16091 James Muir14 October 2023, 23:36:57 UTCcms encrypt, better OBJ_nid2obj() return check Fixes #22225 In OBJ_nid2obj(), if the NID does not have an OID, then a pointer to the special "undefined" ASN1_OBJECT is returned. Check for the undefined-ASN1_OBJECT and return an error. Also, add a test for this in 80-test_cms.t. Testing: #!/bin/bash -x shopt -s expand_aliases alias openssl="LD_LIBRARY_PATH=~/git/openssl ~/git/openssl/apps/openssl" echo "This is a confidential message. It should be encrypted." > msg.txt ## this should fail b/c there is no OID for aes-256-ctr openssl cms -encrypt -in msg.txt -aes-256-ctr -out msg.txt.cms -recip demos/cms/signer.pem echo $? Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22392)18 October 2023, 14:49:11 UTC
a47fc4e Pavel Stetsuk14 September 2023, 20:05:49 UTCfix: LINEAR search doesn't work properly (if CHARSET_EBCDIC is defined) CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22108)18 October 2023, 14:39:34 UTC
21b98da Daiki Ueno16 October 2023, 05:42:12 UTCrsa: Accept NULL OAEP label for backward compatibility According to the manual page, EVP_PKEY_CTX_set0_rsa_oaep_label() should accept NULL as the label argument, though the function currently rejects it while setting the corresponding octet string parameter with OSSL_PARAM_construct_octet_string, which expects non-NULL input. This adds a workaround to the caller for backward compatibility. Signed-off-by: Daiki Ueno <dueno@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22397)18 October 2023, 14:25:25 UTC
410c80d Dr. David von Oheimb13 October 2023, 20:27:31 UTCEVP shake_ctrl(): add missing NULL evp_ctx check Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22390)17 October 2023, 20:02:29 UTC
72a99ef Dr. David von Oheimb13 October 2023, 20:12:22 UTCCMS_add1_signer(): add missing ERR_raise() calls Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22390)17 October 2023, 20:02:29 UTC
2c581eb Dr. David von Oheimb13 October 2023, 20:39:25 UTCCMS_add1_signer.pod: add missing info on CMS_SignerInfo_sign() return values Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22390)17 October 2023, 20:02:29 UTC
e15891b Dr. David von Oheimb13 October 2023, 20:30:31 UTCPKCS7_SIGNER_INFO: point out confusing names of digest_enc_alg and enc_digest fields Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22390)17 October 2023, 20:02:16 UTC
143ca66 Tomas Mraz13 October 2023, 14:22:59 UTCAvoid another copy of key schedule pointer in PROV_GCM_CTX This copy would need an update on dupctx but rather than doing it just remove the copy. This fixes failures of evp_test on Windows with new CPUs. Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22384)16 October 2023, 10:12:36 UTC
cd138c3 Hugo Landau10 October 2023, 11:19:29 UTCQUIC APL: Fix incoming default stream popping Fixes #22106 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22333)13 October 2023, 17:26:22 UTC
91a5c0e Pauli11 October 2023, 21:46:19 UTCcmp: add null pointer check in tear_down test function problem reported by: 2ourc3 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22355)13 October 2023, 15:35:05 UTC
008ca01 James Muir11 October 2023, 22:11:42 UTCFix parenthesis, use a colon Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22356)13 October 2023, 15:23:50 UTC
4991841 James Muir10 October 2023, 16:41:59 UTCUpdate unix Makefile template to handle paths with spaces Fixes #4668 (on unix-like platforms) Testing: rm -rf "$HOME/tmp/beforespace afterspace" ./Configure -Werror --strict-warnings --prefix="$HOME/tmp/beforespace afterspace" make -j6 update make -j6 make install make test Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21821)13 October 2023, 14:36:28 UTC
0496d2d Tomas Mraz11 October 2023, 10:55:41 UTCtrace_api_test.c: Separate tracing statements Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22347)13 October 2023, 13:04:42 UTC
3b107b8 Tomas Mraz11 October 2023, 09:20:02 UTCWindows: use srand() instead of srandom() This is used for memory allocation failure debugging only Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22347)13 October 2023, 13:04:42 UTC
10767fd Tomas Mraz11 October 2023, 09:05:37 UTCWindows CI: Add some non-default options to check they are working Some of the non-default options that enable more code to be built need to be enabled in one of the Windows builds to avoid regressions. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22347)13 October 2023, 13:04:42 UTC
eaee176 Tomas Mraz05 October 2023, 09:11:16 UTCDH_check_pub_key() should not fail when setting result code The semantics of ossl_ffc_validate_public_key() and ossl_ffc_validate_public_key_partial() needs to be changed to not return error on non-fatal problems. Fixes #22287 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22291)11 October 2023, 14:22:27 UTC
715242b Richard Levitte10 October 2023, 10:32:40 UTCtest/recipes/05-test_rand.t: replace 'and' with '&&' The lower priority 'and' seems to have some "interesting" interactions with function argument parsing in some perl versions (presumably because 'and' is lower priority than the comma). For the lines that are changed here, perl v5.20.1 says this: Useless use of string eq in void context at [.test.recipes]05-test_rand.t line 33. Useless use of numeric eq (==) in void context at [.test.recipes]05-test_rand.t line 39. Replacing 'and' with '&&' in these two cases fixes the problem. Replacing Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22331)11 October 2023, 12:16:43 UTC
6cf23ce Hugo Landau09 October 2023, 18:11:39 UTCEnsure struct timeval is defined when including ssl.h Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22323)11 October 2023, 09:10:05 UTC
back to top