summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Minor refactoring of the Argon2 derive functionTomas Mraz2023-04-211-48/+30
| | | | | | | | | Cache the fetched MAC and MD implementation until propq changes. No need to keep the output stored in the context. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20534)
* Bump coverallsapp/github-action from 2.1.0 to 2.1.2dependabot[bot]2023-04-211-1/+1
| | | | | | | | | | | | | | | | | | | | | Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 2.1.0 to 2.1.2. - [Release notes](https://github.com/coverallsapp/github-action/releases) - [Commits](https://github.com/coverallsapp/github-action/compare/v2.1.0...v2.1.2) --- updated-dependencies: - dependency-name: coverallsapp/github-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20773)
* aesv8-armx.pl: Avoid buffer overrread in AES-XTS decryptionTomas Mraz2023-04-203-1/+16
| | | | | | | | | | | | Original author: Nevine Ebeid (Amazon) Fixes: CVE-2023-1255 The buffer overread happens on decrypts of 4 mod 5 sizes. Unless the memory just after the buffer is unmapped this is harmless. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/20759)
* test: test -pedantic option in fipsinstallPauli2023-04-201-1/+26
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20752)
* doc: document the -pedantic option to fipsinstall.Pauli2023-04-201-0/+9
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20752)
* fipsinstall: add -pedantic optionPauli2023-04-201-39/+64
| | | | | | | | | | This adds a -pedantic option to fipsinstall that adjusts the various settings to ensure strict FIPS compliance rather than backwards compatibility. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20752)
* Adding Control Flow guard to Windows Buildsgakamath2023-04-191-3/+3
| | | | | | | | | | Control flow guard is a code security implementation: https://learn.microsoft.com/en-us/windows/win32/secbp/control-flow-guard We identified it with BlackDuck security scan utility CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20739)
* Configurations/descrip.mms.tmpl: Fix a few typosRichard Levitte2023-04-181-7/+3
| | | | | | | | | These typos caused failed propagation of the 'cflags' attribute from Configurations/10-main.conf. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20737)
* Fix broken links in crypto manpageLadislav Marko2023-04-181-2/+2
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20741)
* fix test failure on Kunpeng-920zhangzhilei2023-04-181-1/+1
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20751)
* crmf_lib.c: clean up coments on OSSL_CRMF_CERTTEMPLATE*()Dr. David von Oheimb2023-04-181-6/+2
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20736)
* OSSL_CRMF_CERTTEMPLATE_get0_publicKey(): fix return type and docDr. David von Oheimb2023-04-183-3/+5
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20736)
* crypto/cmp: fix CertReqId to use in p10cr transactions acc. to RFC 4210Dr. David von Oheimb2023-04-188-44/+61
| | | | | | | Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20298)
* bn_local: remove unused `PTR_SIZE_INT` definitionAlois Klink2023-04-161-18/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748)
* bn_nist: remove unused type-punning union `u`Alois Klink2023-04-161-21/+12
| | | | | | | | We no longer need to cast function pointers to PTR_SIZE_INT. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748)
* bn_nist: replace pointer bit-fiddling with ternaryAlois Klink2023-04-161-45/+19
| | | | | | | | | | | | | | | | | | | | | | | | | Bit-fiddling pointers is technically implementation defined behavior in the C specification so the following code is not supported in all platforms: PTR_SIZE_INT mask; void * a, b, c; int boolean_flag; mask = 0 - boolean_flag; /* Not guaranteed to be a valid ptr to a or b on all platforms */ a = (void *) ((((PTR_SIZE_INT) b & ~mask) | (((PTR_SIZE_INT)) c & mask))); Using a ternary conditional operator is supported on all platforms (i.e. `a = boolean_flag ? b : c;`). On most modern compilers/CPUs, this will be faster, since it will get converted to a CMOV instruction. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748)
* adding provider_unload functions for cmp_ testsDanny Carpenter2023-04-164-0/+8
| | | | | | | | CLA: trivial Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20731)
* List also non-fetchable hashes in openssl dgst -listGauriSpears2023-04-141-2/+5
| | | | | | | | CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20651)
* Fix a HPKE API to put libctx, propq as last (optional parameters).slontis2023-04-144-36/+44
| | | | | | | | | This keeps the interface consistent with other HPKE API's. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20583)
* Fix the LCM computation in the RSA multiprime key checkTomas Mraz2023-04-133-7/+69
| | | | | | | | Fixes #20693 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/20708)
* Fix typo in ssl_ciph.cLadislav Marko2023-04-131-1/+1
| | | | | | | | | CLA: trivial Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/20703)
* Fix UEFI support on win32Aidan Khoury2023-04-133-4/+4
| | | | | | Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20714)
* doc: Fix incorrect pairing of functionsLadislav Marko2023-04-131-1/+1
| | | | | | | | | | CLA: trivial The functions that should be implemented together are `OSSL_FUNC_signature_verify_recover_init` and `OSSL_FUNC_signature_verify_recover` and not `OSSL_FUNC_signature_verify_recover_init` with ` OSSL_FUNC_signature_verify_init` Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20704)
* doc: Fix misleading stucture infoLadislav Marko2023-04-131-1/+1
| | | | | | | | | | CLA: trivial The thing created by `OSSL_FUNC_signature_newctx()` and `OSSL_FUNC_signature_dupctx()` is a signature context, not a signature. It's in the name of the function and surrounding documentation. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20705)
* Fixes #19580 ECX keygenYuan, Shuai2023-04-121-1/+1
| | | | | | | | Signed-off-by: Yuan, Shuai <shuai.yuan@intel.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/20680)
* Allow partially releasing a record for TLSMatt Caswell2023-04-127-62/+114
| | | | | | | | | This enables the cleansing of plaintext to occur in the record layer and avoids the need to cast away const above the record layer. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20404)
* Make the data field for get_record() constMatt Caswell2023-04-1210-23/+28
| | | | | | | | | | | Improves consistency with the QUIC rstream implementation - and improves the abstraction between the TLS implementation and the abstract record layer. We should not expect that the TLS implementation should be able to change the underlying buffer. Future record layers may not expect that. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20404)
* Add support for rstream get/release record in the QUIC TLS layerMatt Caswell2023-04-123-27/+52
| | | | | | | | | | | The QUIC TLS layer was taking an internal copy of rstream data while reading. The QUIC rstream code has recently been extended to enable a get/release model which avoids the need for this internal copy, so we use that instead. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20404)
* Updated return value of PEM_write_TYPE() and PEM_write_bio_TYPE() in man-pages.Jeeban Sethi2023-04-111-2/+1
| | | | | | | | | | Fixes #20218 CLA: trivial Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20673)
* CI: Checkout submodules to make the regression fuzz tests runTomas Mraz2023-04-1110-0/+70
| | | | | | | | Otherwise the fuzz/corpora won't be present. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20683)
* Add openssl/fuzz-corpora repository as submoduleTomas Mraz2023-04-112-0/+4
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20683)
* Remove fuzz corpora data from the repositoryTomas Mraz2023-04-1119718-20041/+0
| | | | | | | | To be replaced with a git submodule. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20683)
* Bump coverallsapp/github-action from 1.2.4 to 2.1.0dependabot[bot]2023-04-111-1/+1
| | | | | | | | | | | | | | | | | | | | | Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 1.2.4 to 2.1.0. - [Release notes](https://github.com/coverallsapp/github-action/releases) - [Commits](https://github.com/coverallsapp/github-action/compare/v1.2.4...v2.1.0) --- updated-dependencies: - dependency-name: coverallsapp/github-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20699)
* Remove FIPS cross version check of 3.0.0 provider against currentPauli2023-04-111-74/+0
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20552)
* Remove old FIPS provider cross version checkPauli2023-04-111-97/+0
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20552)
* Add action to cross validate FIPS providersPauli2023-04-111-0/+228
| | | | | | | | | Tests all released FIPS approved (or in progress) versions against all development branches and each other. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20552)
* Ignore SIGPIPE if client closes connection abruptlyVishwa Pravin2023-04-061-0/+6
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20678)
* Alternative fix for CVE-2022-4304Bernd Edlinger2023-04-046-69/+112
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is about a timing leak in the topmost limb of the internal result of RSA_private_decrypt, before the padding check. There are in fact at least three bugs together that caused the timing leak: First and probably most important is the fact that the blinding did not use the constant time code path at all when the RSA object was used for a private decrypt, due to the fact that the Montgomery context rsa->_method_mod_n was not set up early enough in rsa_ossl_private_decrypt, when BN_BLINDING_create_param needed it, and that was persisted as blinding->m_ctx, although the RSA object creates the Montgomery context just a bit later. Then the infamous bn_correct_top was used on the secret value right after the blinding was removed. And finally the function BN_bn2binpad did not use the constant-time code path since the BN_FLG_CONSTTIME was not set on the secret value. In order to address the first problem, this patch makes sure that the rsa->_method_mod_n is initialized right before the blinding context. And to fix the second problem, we add a new utility function bn_correct_top_consttime, a const-time variant of bn_correct_top. Together with the fact, that BN_bn2binpad is already constant time if the flag BN_FLG_CONSTTIME is set, this should eliminate the timing oracle completely. In addition the no-asm variant may also have branches that depend on secret values, because the last invocation of bn_sub_words in bn_from_montgomery_word had branches when the function is compiled by certain gcc compiler versions, due to the clumsy coding style. So additionally this patch stream-lined the no-asm C-code in order to avoid branches where possible and improve the resulting code quality. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20281)
* Revert "Fix Timing Oracle in RSA decryption"Bernd Edlinger2023-04-046-670/+22
| | | | | | | | | | This reverts commit b1892d21f8f0435deb0250f24a97915dc641c807. Except for the moving derive_kdk to a separate function. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20281)
* Erase temporary buffer in EVP_PKEY_get_bn_param()Anatolii Lishchynskyi2023-04-041-1/+8
| | | | | | | | | | | | | | Function EVP_PKEY_get_bn_param() uses temporary buffer (on stack or heap allocated) to store serialized bignum, but after deserializing it into BIGNUM*, the buffer is not erased and may contain sensitive data. This change makes sure the buffer is erased if it was successfully filled before. Unfortunately, it does not distinguish between public and private key components, and will always erase the buffer. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20639)
* Don't call OPENSSL_init_crypto from inside a RUN_ONCEMatt Caswell2023-04-041-3/+2
| | | | | | | | | | | | | | | | | | Calling OPENSSL_init_crypto from inside a RUN_ONCE seems like a bad idea. This is especially bad if OPENSSL_init_crypto can recursively end up attempting to call the RUN_ONCE that we're already inside. The initialisation in OPENSSL_init_crypto is already "run once" protected. There is no need to protect it "twice". Fixes #20653 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20662) (cherry picked from commit a9745427cd5d44a76b31690b4a2c6bef2ee677c4)
* Update the documentation for SSL_version et alMatt Caswell2023-04-041-4/+44
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20650)
* Add a test for SSL_version(), SSL_get_version() etcMatt Caswell2023-04-042-0/+190
| | | | | | | | We also test SSL_is_dtls(), SSL_is_tls() and SSL_is_quic(). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20650)
* Make sure we can query the SSL object for version info when using QUICMatt Caswell2023-04-044-0/+48
| | | | | | | | | | | | We have the existing functions SSL_version(), SSL_get_version() and SSL_is_dtls(). We extend the first two to return something sensible when using QUIC. We additionally provide the new functions SSL_is_tls() and SSL_is_quic() to provide a mechanism to figure out what protocol we are using. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20650)
* FFC cleanupsslontis2023-04-039-85/+112
| | | | | | | | | | | | | | | | | Discovered during coverage testing. Remove unneccesary check when using ossl_dh_get0_params() and ossl_dsa_get0_params(). These point to addresses and can not fail for any existing calls. Make dsa keygen tests only available in the FIPS module - as they are not used in the default provider. Change ossl_ffc_set_digest() to return void as it cannot fail. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20359)
* Avoid calling into provider with the same iv_len or key_lenTomas Mraz2023-04-031-0/+8
| | | | | | | | | Fixes #20625 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20664)
* Fix compilation error when using clang-cl 16 or higherAnthony Roberts2023-04-031-1/+1
| | | | | | | | | | | | Fixes a "Incompatible function pointer types" error. In prior versions, this was a warning, but is now an error. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20654)
* Make DSA_sign() test for negative p,q,g values.slontis2023-03-313-2/+84
| | | | | | | | | | | | | | | | | | | | | | Related to #20268 DSA_sign() assumes that the signature passed in is related to DSA_size(). If q is negative then DSA_size() actually fails and returns 0. A test that tries to allocate the signature buffer using DSA_size() and then pass it to DSA_sign() will then either. (1) Have a signature buffer of NULL. In this case it was leaking data returned via i2d_DSA_SIG. (2) Cause a seg fault because we created a buffer that was not large enough to hold the signature. As it already checked zero we also now check for negative values also. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20553)
* Incorrect null pointer checkafshinpir2023-03-311-1/+1
| | | | | | | | | | CLA: trivial There is an incorrect null pointer check and this ccommit resolves it. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20646)
* Fix mem leak in ECDSA_sign().slontis2023-03-313-3/+20
| | | | | | | | | | | | | | Similiar to the issue found in PR #20553 for DSA_sign(). ECDSA_sign() leaked memory if the signature was NULL when i2d_ECDSA_SIG was called. Note that this does not affect the higher level EVP functions as they correctly handle NULL. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20554)
View Lorry Controller Status