summaryrefslogtreecommitdiffstats
path: root/crypto/des/asm/d-win32.uu (unfollow)
Commit message (Collapse)AuthorFilesLines
3 daysUpgrade action/{upload,download}-artifact to v4Richard Levitte4-22/+22
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/25920)
5 daysfips-jitter: set provider into error state upon CRNG permanent failuresDimitri John Ledkov1-2/+6
With fips-jitter build time option, jitter can be inside FIPS boundary. Calls to jent_read_entropy() can return permanent failures for Repetitive Count Test (RTC), Adaptive Proportion Test (APT), LAG prediction test. Ensure the module enters error state upon permanent jitter failures. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25957)
5 daysFix potential memory leak on failure of ecx_gen_init()Niels Dossche1-1/+1
When ecx_gen_set_params() returns 0, it could have duplicated the memory for the parameter OSSL_KDF_PARAM_PROPERTIES already in gctx->propq, leading to a memory leak. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26015)
5 daysFix potential memory leak on failure of dsa_gen_init()Niels Dossche1-1/+1
When dsa_gen_set_params() returns 0, it could have duplicated the memory for the parameter OSSL_PKEY_PARAM_FFC_DIGEST already in gctx->mdname, leading to a memory leak. Allocated here: https://github.com/openssl/openssl/blob/47a80fd2034cd4314d3b4958539dcd3106087109/providers/implementations/keymgmt/dsa_kmgmt.c#L524 Can return 0 here: https://github.com/openssl/openssl/blob/47a80fd2034cd4314d3b4958539dcd3106087109/providers/implementations/keymgmt/dsa_kmgmt.c#L529-L536 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26016)
8 daysEnable AES and SHA3 optimisations on Apple Silicon M4-based macOS systemsTom Cosgrove1-1/+2
AES gets a performance enhancement of 7-33%. Tested on an M4 Pro, but the CPU cores are the same on M4 and M4 Max. Change-Id: I634c03f1d2b50fa5f8ca97dd65975e49d970c72b Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/25940)
8 daysfips: remove redundant RSA encrypt/decrypt KATDimitri John Ledkov3-153/+1
FIPS 140-2 IG D.9 has become FIPS 140-3 D.G (see "Mapping FIPS 140-2 IGs to FIPS 140-3" in the FIPS 140-3 IG). The requirements w.r.t. RSA KATs have now been relaxed, meaning that existing full-message RSA signature verification (which is performed separately) is sufficient to meet KAT requirements for all RSA usecases (KEM/Encrypt/Decrypt/Sign/Verify). Dropping this KAT is very useful, because it is large/expensive on module startup, but also because it enables in the future to block RSA Encrypt/Decrypt operations with paddings other than OAEP, which are legacy or deprecated by either current or draft algorithm transition SP. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25988)
8 daysfips: zeroize temporary self-check out MD variableDimitri John Ledkov1-0/+1
At least this is done on module startup only. To satisfy ISO/IEC 19790:2012/Cor.1:2015(E) Section 7.5 [05.10] requirement. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25945)
8 days.gitignore: Ignoring demo executablesDmitry Belyavskiy1-0/+43
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26009)
8 daysRemove the negative return values of EVP_KDF_* functions in documentsPeiwei Hu1-3/+1
None of the EVP_KDF_* functions will ever return a negative value. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25811)
8 daysFix wrong return value checks for some functionsPeiwei Hu5-5/+5
- in particular in use of X509_LOOKUP_load_file, EVP_PKEY_print_params, EVP_PKEY_keygen, X509_CRL_add1_ext_i2d, EVP_PKEY_keygen_init Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25811)
8 daysFix multiple wrong use of BN_check_primePeiwei Hu2-3/+7
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25811)
8 daysFix multiple wrong checks of EVP_PKEY_set1_encoded_public_keyPeiwei Hu3-3/+3
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25811)
8 daysapps/lib/apps.c: fix the wrong check in check_cert_attributesPeiwei Hu1-3/+3
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25811)
8 daysMark OPENSSL_armcap_P .hidden in arm asmKai Pastor8-0/+8
Fixes #25601 Fixes #22414 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22181)
9 daysFix SSL_write_[ex|ex2] on blocking quic streamsNeil Horman1-2/+13
When writing to a blocking quic stream, we sometimes get duplicate transmitted data. This occurs when a call to quic_write_blocking has to wait for space to become available in the ring buffer. When we do a wait, the call sets *written to the value returned in args.total_written as filled out by the calls to block_until_pred->quic_write_again. However, the value there is based on the amount we requested, which is only the remaining data that we didn't append in xso_sstream_write. So if we call quic_write_blocking with a buffer of length X, and initially append Y bytes, and write the remainig X-Y bytes via a block_until_pred call, then *written will return with the value X-Y, even though we wrote the full X bytes to the ring buffer. Fix it by recording the initial amount appended into *written, and then add the args.total_written value if we have to wait on more space Fixes openssl/project#924 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26023)
9 dayssm2_sig_verify(): Do not call BN_CTX_end() without BN_CTX_start()Tomas Mraz1-4/+8
In case of memory allocation failure this could happen. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25994)
9 daysadd new keytype test for EVP_PKEY_Q_keygenMichael Baentsch2-1/+54
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25972)
10 dayspkeyutl.c: Avoid freeing pkey at multiple placesTomas Mraz1-13/+4
Also fixes a leak of pkey in error case for -verifyrecover. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25987)
10 daysREADME.md: Fix typo. Change 'the are' to 'there are'spectre1-1/+1
This pull request fixes a typo in the documentation. The phrase "the are" has been corrected to "there are". CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25977)
10 dayss_cb.c: Move the negotiated group outputMichael Baentsch1-6/+7
It needs to be always displayed not just with -brief. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25959)
10 daysAdd CTX copy function for EVP_MD to optimize the performance of ↵wangcheng8-15/+116
EVP_MD_CTX_copy_ex. 1. Add OSSL_FUNC_digest_copyctx_fn function for EVP_MD, which is used to copy algctx from the old EVP_MD_CTX to the new one. 2. Add implementation of OSSL_FUNC_digest_copyctx_fn function for default providers. 3. Modify EVP_MD_CTX_copy_ex: When the fetched digest is the same in in and out contexts, use the copy function to copy the members in EVP_MD_CTX if the OSSL_FUNC_digest_copyctx_fn function exists. Otherwise, use the previous method to copy. 4. Add documentation for OSSL_FUNC_digest_copyctx function in doc/man7/provider-digest.pod. 5. Add testcase. Fixes #25703 Signed-off-by: wangcheng <bangwangnj@163.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25726)
10 daysx509_vfy.c and x509_lu.c: refactor find_issuer(), ↵Dr. David von Oheimb2-137/+74
X509_STORE_CTX_get1_issuer(), etc. Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18762)
10 daysos-zoo CI: Replace macos-12 run with macos-15Tomas Mraz1-1/+1
macos-12 runners will be removed in December. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Hugo Landau <hlandau@devever.net> (Merged from https://github.com/openssl/openssl/pull/25715)
11 daysMake ossl_trace_param_values an official api functionNeil Horman7-104/+222
lots of people may want to print params to a buffer. Make it part of our api Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25630)
11 daysAdd QUERY trace pointsNeil Horman4-40/+211
Adds trace messages for method store add/remove and fetch operations Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25630)
11 daysAdd a QUERY trace categoryNeil Horman2-1/+3
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25630)
11 daysAdd tracing messages to the provider apiNeil Horman2-9/+260
Adds tracing messages to the init/teardown/gettable_params/get_params/query/unquery operations for a provider Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25630)
11 daysAdding a trace category for PROVIDER callsNeil Horman2-1/+4
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25630)
2024-11-15remove ternary from runs-on, security repo is hosted on github.comDmitry Misharov3-28/+26
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25939)
2024-11-13man ECDSA_sign(3): fix wrong variable namesAlicja Kario1-2/+2
the parameters in the function definitions use `siglen` not `sig_len`, this fixes the doc text. Signed-off-by: Alicja Kario <hkario@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25927)
2024-11-13Change "a SSL" to "an SSL"Andrew Dinh30-40/+40
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/25868)
2024-11-13test_hashtable_multithread(): Stress it moreTomas Mraz1-7/+8
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Hugo Landau <hlandau@devever.net> (Merged from https://github.com/openssl/openssl/pull/25669)
2024-11-13Use test_random() in hashtable mt test for reproducibilityTomas Mraz1-18/+18
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Hugo Landau <hlandau@devever.net> (Merged from https://github.com/openssl/openssl/pull/25669)
2024-11-13Fix doc and use of_X509v3_add_extensions() in case ↵Dr. David von Oheimb4-9/+10
sk_X509_EXTENSION_num(exts) <= 0 Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25631)
2024-11-13Add test for SSL_stream_resetNeil Horman1-4/+33
Add a test to the quic_multistream test suite to reset a stream after all data has been received by a given stream, ensuring that we don't crash in the reset operation Fixes #25410 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25910)
2024-11-13Fix SSL_stream_reset for stream objects which have FIN bit setNeil Horman1-2/+4
When calling SSL_stream_reset on a QUIC stream object that has received all data that is expected to be sent (i.e. when the sender has sent a STREAM frame with the FIN bit set), we encounter the following segfault: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7f0bd28 in ossl_quic_sstream_get_final_size (qss=0x0, final_size=0x0) at ssl/quic/quic_sstream.c:273 273 if (!qss->have_final_size) (gdb) bt 0) 0x00007ffff7f0bd28 in ossl_quic_sstream_get_final_size (qss=0x0, final_size=0x0) at ssl/quic/quic_sstream.c:273 1) 0x00007ffff7ef65bf in quic_validate_for_write (xso=0x5555555efcb0, err=0x7fffffffd5e0) at ssl/quic/quic_impl.c:2513 2) 0x00007ffff7ef8ae3 in ossl_quic_stream_reset (ssl=0x5555555efcb0, args=0x0, args_len=0) at ssl/quic/quic_impl.c:3657 3) 0x00007ffff7ebdaa6 in SSL_stream_reset (s=0x5555555efcb0, args=0x0, args_len=0) at ssl/ssl_lib.c:7635 4) 0x0000555555557527 in build_request_set ( req_list=0x55555555ebd0 "neil1.txt neil2.txt neil3.txt neil4.txt neil5.txt neil6.txt neil7.txt neil8.txt neil9.txt neil10.txt neil11.txt neil12.txt neil13.txt neil14.txt neil15.txt neil16.txt neil17.txt neil18.txt neil19.txt "..., ssl=0x5555555b6f80) at demos/guide/quic-hq-interop.c:545 5) 0x00005555555587b2 in main (argc=4, argv=0x7fffffffe568) at demos/guide/quic-hq-interop.c:941 This occurs because: 1) When the stream FIN bit is set, the quic stack frees the underlying stream structures immediately within the QUIC stack and 2) when SSL_stream_reset is called, the call stack indicates we call quic_validate_for_write, which attempts to access the xso->stream->sstream QUIC_SSTREAM object, which was already freed in (1) The fix I think is pretty straightforward. On receipt of a STREAM frame with a FIN bit set, the QUIC stack sets the QUIC_STREAM object state to QUIC_SSTREAM_STATE_DATA_RECVD, which means we can use that state to simply assert that the stream is valid for write, which allows it to be reset properly. Fixes #25410 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25910)
2024-11-13Adjustments for the on schedule workflowsTomas Mraz8-24/+25
Run them all after 02:00 UTC. Add possibility to run them on workflow_dispatch. Add branch 3.4 to the coveralls.yml. Remove the branches from os-zoo.yml as it is possible to run on them manually from workflow_dispatch. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/25765)
2024-11-13Fix memleaks in cmd_RecordPadding()Holger Dengler1-8/+7
Free the internal copy of parameter `value` on each early exit. Fixes #25906 Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25926)
2024-11-13feat: define and use ossl_bio_print_hexJonathan M. Wilbur5-43/+58
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25429)
2024-11-13test: the attributeDescriptor X.509v3 extensionJonathan M. Wilbur2-1/+36
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25429)
2024-11-13doc: the attributeDescriptor X.509v3 extensionJonathan M. Wilbur3-0/+50
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25429)
2024-11-13feat: support the attributeDescriptor X.509v3 extensionJonathan M. Wilbur5-1/+233
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25429)
2024-11-12txp_generate_stream_frames(): Set stream id in header early enoughTomas Mraz1-1/+1
Otherwise we will calculate an incorrect header size for higher stream ids and won't fit the frame into the packet. Fixes #25417 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25928)
2024-11-12APPS/load_key_certs_crls(): refactor to clean up the code a little and add ↵Dr. David von Oheimb1-8/+38
clarifying comments Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@devever.net> (Merged from https://github.com/openssl/openssl/pull/22528)
2024-11-09openssl-pkeyutl.pod.in: improve description of -rawin and -digest optionsDr. David von Oheimb2-24/+49
Fixes #25827 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25831)
2024-11-09openssl-pkeyutl.pod.in: add that -sign is default op, update claim on hash ↵Dr. David von Oheimb1-7/+13
needed for -sign/-verify, etc. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25831)
2024-11-09APPS/pkeyutl: add missing high-level check for -verifyrecover being usable ↵Dr. David von Oheimb2-5/+18
only with RSA Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25903)
2024-11-09APPS/pkeyutl: remove wrong check for -verifyrecover regarding too long ↵Dr. David von Oheimb2-6/+11
sign/verify input Fixed #25898 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25903)
2024-11-08Add a test for setting TLSv1.2 ciphersuites on a QUIC objectMatt Caswell1-1/+11
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25886)
2024-11-08Don't complain with "no cipher match" for QUIC objectsMatt Caswell1-3/+5
Calling the functions SSL_CTX_set_cipher_list() or SSL_set_cipher_list() will return the error "no cipher match" if no TLSv1.2 (or below) ciphers are enabled after calling them. However this is normal behaviour for QUIC objects which do not support TLSv1.2 ciphers. Therefore we should suppress that error in this case. Fixes #25878 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25886)
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-30 08:48:19 +0100