summaryrefslogtreecommitdiffstats
path: root/.github (unfollow)
Commit message (Collapse)AuthorFilesLines
46 hourstest: the timeSpecification X.509v3 extensionJonathan M. Wilbur3-1/+64
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25476)
46 hoursdoc: the timeSpecification X.509v3 extensionJonathan M. Wilbur3-0/+110
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25476)
46 hoursfeat: support the timeSpecification X.509v3 extensionJonathan M. Wilbur5-1/+787
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25476)
47 hoursdh_cms_set_peerkey(): Fix the incorrect conditionShakti Shah1-1/+1
Only absent parameters allowed in RFC 3370. Fixes #25824 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26058)
3 daysAdd function to mix in an additional input into a RAND_POOLTomas Mraz8-61/+96
It will be just xor-ed over the existing entropy in the pool. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26128)
3 daysFix potential use-after-free in REF_PRINT_COUNTNeil Horman22-37/+37
We use REF_PRINT_COUNT to dump out the value of various reference counters in our code However, we commonly use this macro after an increment or decrement. On increment its fine, but on decrement its not, because the macro dereferences the object holding the counter value, which may be freed by another thread, as we've given up our ref count to it prior to using the macro. The rule is that we can't reference memory for an object once we've released our reference, so lets fix this by altering REF_PRINT_COUNT to accept the value returned by CRYPTO_[UP|DOWN]_REF instead. The eliminates the need to dereference the memory the object points to an allows us to use the call after we release our reference count Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25664)
3 daysFix memory ordering guarantees and TSAN errorsTomas Mraz1-8/+20
If we had refcounted object allowing lockless writes the relaxed semantics on DOWN_REF would allow scheduling these writes after simultaneous release of the object by another thread. We do not have any such objects yet, but better to make the refcount correct just in case we will have them in future. TSAN doesn't properly understand this so we use even stronger acq_rel semantics if building with TSAN. Fixes #25660 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25664)
3 daysAdd test for releasing a shared EVP_PKEY across threadsTomas Mraz1-0/+40
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25664)
3 daysossl_cms_get1_crls_ex(): Avoid doublefree if CRL up ref failsTomas Mraz1-2/+4
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/26100) (cherry picked from commit ef0be53f90045d0a9f0d085a7a4289335f49ee41)
3 daysRevert the behavior change of CMS_get1_certs() and CMS_get1_crls()Tomas Mraz5-22/+65
Fixes #26079 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/26100) (cherry picked from commit afd36cbef8b3b7b00bd4bcdc33802d4cb39fdffa)
3 daysRemove references to git.openssl.org from README.mdTom Cosgrove1-19/+7
Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26122)
3 daysspeed.c: Changed the declaration of aead_ivlen to a #defineMohammed Alhabib1-6/+6
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26109)
7 daysExchange jitter and no-ct jobs between daily and on push CITomas Mraz2-27/+27
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26112)
7 daysjitter_generate(): Properly mix in the additional inputTomas Mraz1-8/+8
By adding the additional input directly to the pool we were using just the additional input. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26112)
7 daysA typo fix in a commentwillmafh1-1/+1
CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
7 daysAdd spaces to make macros more clearwillmafh1-13/+13
CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
7 daysCode & comments changes to make them in consistentwillmafh4-10/+17
CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
7 daysone more empty line for code style consistencywillmafh1-0/+1
CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
7 daysChange all one's complement to ones' complement for consistencywillmafh6-8/+8
CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
7 daysBN_secure_new function indentation correctionwillmafh1-7/+7
CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
7 daysDelete redundant parentheses for code consistencywillmafh1-1/+1
CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
7 daysDelete a redundant breakwillmafh1-1/+0
CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
10 daysRun interop tests on feature/quic-server branchNeil Horman2-0/+67
We currently run interop tests as a client only from the master branch. While we are developing quic-server it would be beneficial to also get interop test results from the quic-server branch run as both a client and a server, until such time as the feature branch is merged. Add building and running of a container in the test harness to our CI set Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26090)
10 daysAdd handling for additional input in jitter rngjsondevers1-0/+8
Fixes #25917 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25966)
10 daysfips: zeroization of ECX public keysJoachim Vandersmissen1-0/+3
Commit fa338aa7cd added zeroization of public security parameters as required by ISO 19790:2012/Cor.1:2015 7.9. However, that commit overlooked ECX keys, which are used for EdDSA and X25519/X448. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25807)
10 daysproviders: stop probing for getentropy(3) on recent FreeBSDKyle Evans1-23/+28
FreeBSD has supported both getrandom(2) and getentropy(3) since 12.0. The last version which did *not* have these went EoL in September 2021. Use getrandom(2) unconditionally and fallback to sysctl kern.arandom if we do happen to have a FreeBSD that old. This is generally a necessary step for FreeBSD's _FORTIFY_SOURCE implementation, which needs to do some symbol renaming tricks with the getentropy declaration that would otherwise add some platform-specific hacks here to accommodate. getentropy(3) uses getrandom(2) internally on FreeBSD, so we just cut out the middleman. While we're here, it doesn't seem to make sense to ever prefer the sysctl on FreeBSD or NetBSD. For both platforms, it's limited to 256 bytes in a single request while getrandom(2) will generally use the same backend but service the entire request in one shot, even for larger amounts of entropy, modulo the EINTR possibility that presents itself with larger requests. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24903)
11 daysfips-label.yml: Fix ABI change label removalTomas Mraz1-1/+1
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26080)
11 daysAvoid NULL dereference with PKCS7_OP_SET_DETACHED_SIGNATURETomas Mraz1-0/+5
We would dereference p7->d.sign pointer which can be NULL. Reported by Han Zheng. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26078)
14 daysDocument version-specific utility of EVP_PKEY_Q_keygenMichael Baentsch1-3/+4
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26040)
14 daysMinor nit fix to EVP_CipherFinal_ex() return code documentation.Frederik Wedel-Heinen1-5/+8
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25849)
14 daysFix memleak in dsa_gen()Holger Dengler1-1/+1
Free the stack return value `dsa` on each early exit. Fixes #25905 Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25948)
14 daysFix EVP_PKEY_print_private() so that it works with non default providers.slontis2-3/+32
At some point in time it was decided that the EC keymanagers ec_export() function would only allow the selection to be both the public + private parts. If just the private element is selected it returns an error. Many openssl commandline apps use EVP_PKEY_print_private() which passes EVP_PKEY_PRIVATE_KEY to the encoder. This selection propagates to encoder_construct_pkey(). For external providers (such as the fips provider this will call the keymanagers export() with the selection set to just the private part. So we either need to 1) change the selection in EVP_PKEY_print_private() or 2) modify the selection used in the export used in encoder_construct_pkey 3) Change the ec_export to allow this. I have chosen 2) but I am not sure if this is the correct thing to do or whether it should conditionally do this when the output_type == 'text'. Issue was reported by Ilia Okomin (Oracle). Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26004)
14 daysdie() in .tmpl file should not be silently ignored.Alexandr Nedvedicky2-2/+11
call to die() in perl templates is currently ignored. any error printed by die() commad appears in template output. In order to make sure die() terminates processing we must ensure we emite `undef` value. This is ensured by adding a `BROKEN` callback to `fill_in()` Template method. The callback must return undef to stop processing. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26064)
2024-11-29apps/passwd.c: Convert a redundant check to assertBartel Artem1-2/+1
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26053)
2024-11-29Fix solaris build in CRYPTO_atomic_store apiNeil Horman1-1/+1
Misnamed variable, just correct it to dst Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26075)
2024-11-28Use static array (length 256) for copy of OPENSSL_MALLOC_FAILURESsftcd3-5/+18
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26039)
2024-11-28Deprecate all BIO_meth_get_*() functionsTomas Mraz6-53/+118
Their use by applications is inherently unsafe. Fixes #26047 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/26056)
2024-11-28Use sk_X509_ATTRIBUTE_deep_copy() to copy attribute stacks in pk7_doit.cNiels Dossche1-20/+2
Clean up the code by using the dedicated stack copy function. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25713)
2024-11-28ci: add daily runcheckers to exercise the -DOPENSSL_PEDANTIC_ZEROIZATION optionPauli1-0/+2
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
2024-11-28fips: change integrity check zeroization to use the ↵Pauli1-0/+2
OPENSSL_PEDANTIC_ZEROIZATION define Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
2024-11-28pbkdf2: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION definePauli1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
2024-11-28hkdf: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION definePauli1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
2024-11-28rsa: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION definePauli1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
2024-11-28ffc: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION definePauli1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
2024-11-28ec: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION definePauli1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
2024-11-28A typo fix in a commentwillmafh1-1/+1
CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26069)
2024-11-27Document expected BIO operations for libsslDavid Benjamin1-0/+9
If your custom BIO does not implement BIO_CTRL_FLUSH, it won't work, but this is not document anywhere. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26060)
2024-11-27Upgrade action/{upload,download}-artifact to v4Richard Levitte4-22/+22
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/25920)
2024-11-25fips-jitter: set provider into error state upon CRNG permanent failuresDimitri John Ledkov1-2/+6
With fips-jitter build time option, jitter can be inside FIPS boundary. Calls to jent_read_entropy() can return permanent failures for Repetitive Count Test (RTC), Adaptive Proportion Test (APT), LAG prediction test. Ensure the module enters error state upon permanent jitter failures. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25957)
2024-11-25Fix potential memory leak on failure of ecx_gen_init()Niels Dossche1-1/+1
When ecx_gen_set_params() returns 0, it could have duplicated the memory for the parameter OSSL_KDF_PARAM_PROPERTIES already in gctx->propq, leading to a memory leak. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26015)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-13 16:37:15 +0100