summaryrefslogtreecommitdiffstats
path: root/ssl/ssl_local.h (unfollow)
Commit message (Collapse)AuthorFilesLines
2023-06-16fips: use tsan counter instead of tsan_add to incrementPauli1-1/+1
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/21199)
2023-06-16QUIC: Allow application to trigger TXKUHugo Landau6-7/+120
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC: Minor fixupsHugo Landau2-3/+12
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC CHANNEL: Inform the ACKM when the handshake is confirmedHugo Landau1-0/+1
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC: Test key update works correctlyHugo Landau2-2/+184
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC CHANNEL: Optimise key update using ACKsHugo Landau3-0/+30
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC: Add internal APIs for white-box testing of key updateHugo Landau7-2/+75
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC CHANNEL: Enforce the RX packet forgery limitHugo Landau1-0/+34
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC RXDP: Strictly enforce ACK PNs with regard to TX key epochsHugo Landau3-7/+48
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC CHANNEL: Ensure new packets aren't enforced with old keysHugo Landau1-0/+17
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC CHANNEL: Handle key updates correctlyHugo Landau2-0/+300
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC TXP: Make TXP use time callback correctlyHugo Landau1-1/+1
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC APL: Correct implementation of time callback overrideHugo Landau3-12/+34
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC RX: Support reporting the key epoch a packet was received withHugo Landau3-8/+106
This is needed to support key update validation on the receive side. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC TXP: Allow callbacks on ACK transmissionHugo Landau2-0/+29
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC TXP: Allow next PN to be used to be queriedHugo Landau2-0/+14
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC RX: Refactor key update callback to provide PNHugo Landau2-5/+8
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC TXP: Remove TX key update handling from TXPHugo Landau2-13/+6
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC TXP: Refactor status output to use an extensible structureHugo Landau4-18/+25
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC ACKM: Allow largest acked PN to be queriedHugo Landau2-0/+8
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC WIRE: Utility function to determine if PN is in an ACK frameHugo Landau2-0/+15
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-16QUIC Glossary: TXKU, RXKU, KUHugo Landau1-0/+11
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21029)
2023-06-15apps/ca.c: Handle EVP_PKEY_get_default_digest_name() returning 1 with "UNDEF"Richard Levitte2-5/+10
EVP_PKEY_get_default_digest_name() may return 1 with the returned digest name "UNDEF". This case hasn't been documented, and the meaning has been left undefined, until now. Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20460)
2023-06-15Partially revert #18070 (Add support for Windows CA certificate store)Hugo Landau8-120/+39
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21190)
2023-06-15OpenSSL::paramnames: Use less magic perlRichard Levitte1-3/+3
Constructions like $$cursor{whatever} and %$cursor{whatever} were ambiguous in some perl versions, and it's still better to use the arrow syntax for the way we use them, i.e. they can both be replaced with $cursor->{whatever}. Fixes #21152 Fixes #21172 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21178)
2023-06-15Fix typos found by codespellDimitri Papadopoulos60-139/+139
Typos in doc/man* will be fixed in a different commit. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20910)
2023-06-15fips: update DSA security check to fix legacy verify strengthsPauli3-63/+106
Refer SP 800-131Ar2 table 2: https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final Fixes #21185 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21186)
2023-06-15updated (lib+)oqsprovider to latest releasesMichael Baentsch3-17/+16
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21194)
2023-06-14Only take note of the ack deadline if we can actually issue an ackMatt Caswell1-4/+14
When determining the next tick deadline we cannot actually issue an ack if the CC will not let us, or the enc_level is not yet provisioned. This avoids a bug where we can end up in a busy loop because the next event deadline is reported as "now" because we want to send an ack, but we can't actually send anything yet. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21181)
2023-06-14cmactest.c: Fix no-des and no-sm4 build failuresTomas Mraz1-5/+7
Also use OSSL_NELEM instead of hardcoding array size. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21183)
2023-06-14fips: use memory ordering rather than locksPauli1-36/+14
The FIPS provider accesses it's current state under lock. This is overkill, little or no synchronisation is actually required in practice (because it's essentially a read only setting). Switch to using TSAN operations in preference. Fixes #21179 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21187)
2023-06-14Fix minor issues in the demo/man pages for TLS client/blockingMatt Caswell2-8/+10
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21133)
2023-06-14Split the blocking TLS client guide page into twoMatt Caswell3-282/+340
We split the page into two: one covering basic TLS introductory material that applies to both clients and servers, and one with the specific material on writing a blocking TLS client. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21133)
2023-06-14Allow man7 pages to not have a DESCRIPTION sectionMatt Caswell1-4/+4
For tutorial type pages it doesn't make any sense to have a DESCRIPTION section. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21133)
2023-06-14Add a tutorial on writing a simple blocking TLS clientMatt Caswell2-0/+823
Provide guidance on the steps needed to write a very simple blocking TLS client. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21133)
2023-06-14Add a very simple blocking TLS client demoMatt Caswell2-0/+289
This blocking client is intended to be used to explain how to implement a simple client in the documentation. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21133)
2023-06-14configure: introduce no-ecx to remove ECX related featureYi Li55-200/+511
This can effectively reduce the binary size for platforms that don't need ECX feature(~100KB). Signed-off-by: Yi Li <yi1.li@intel.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20781)
2023-06-14rand_lib: RAND_poll: Reseed in non-"no-deprecated" builds.Mike Kasick1-4/+4
In a non-"no-deprecated" libcrypto build with a default configuration, RAND_get_rand_method() == RAND_OpenSSL() and so needs to fall through to the RAND_seed call (used in "no-deprecated" builds) to perform a reseed. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21167)
2023-06-13crypto/sm2/sm2_sign.c: Add BN_CTX_endJiasheng Jiang1-0/+1
To match the BN_CTX_start, it should be better to add BN_CTX_end in the end of the function. Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19266)
2023-06-12X509_NAME_cmp fix for empty nameWim Decroix1-4/+4
CLA: trivial Fixes #21156 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21155)
2023-06-12Update CMAC test cases.fisher.yu2-216/+29
1. Update cmac test cases, fullfilling test data by short string instead of using long string directly. 2. Modify the wording of comments in cmac.c Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21177)
2023-06-12INSTALL: document shared library pinning for static buildsMatthias St. Pierre1-5/+13
The libcrypto library uses shared library pinning to prevent its cleanup handlers from crashing at program termination because of a premature unloading of the shared library. However, shared library pinning is enabled also for static builds, which may lead to surpising behaviour if libcrypto is linked statically to a shared third-party library, because in this case the third-party library gets pinned. This surprising behaviour is caused by the fact that the `no-shared` configure option does not imply `no-pinshared`. Since this quirk can't be changed without potentially breaking existing code, we just document it here and provide a workaround. Fixes #20977 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20985)
2023-06-12Fix incorrect ERR_raise() callsTheo Buehler1-3/+3
A few ERR_raise() calls in v3_purp.c use the wrong library. For example, in OpenSSL 3.1.1 we get 00000000:error:0580009E:x509 certificate routines:ossl_x509v3_cache_extensions:reason(158):crypto/x509/v3_purp.c:635: instead of 00000000:error:1100009E:X509 V3 routines:ossl_x509v3_cache_extensions:invalid certificate:crypto/x509/v3_purp.c:635: Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21168)
2023-06-12add cygwin CIMichael Baentsch2-1/+39
Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21006)
2023-06-12Fix build on cygwinMichael Baentsch2-1/+4
Fixes #19531 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21006)
2023-06-12Introduce [HAVE_/NO_]MADVISE definesJames Knight1-1/+13
Toolchains that target a non-MMU architecture may not have the `madvise` function available, even if the `sys/mman.h` header provides a define for `MADV_DONTDUMP` (e.g. when targeting ARMv7-M with uClibc). The following tweaks the implementation to use `HAVE_MADVISE`/`NO_MADVISE` defines to help indicate when to attempt to use `madvise`. This change operates in the same manner as the original implementation (i.e. relies on `MADV_DONTDUMP` to indicate if `madvise` can be used); however, this change now allows a builder to override the internal detection by explicitly providing the `HAVE_MADVISE` define at compile time. This should give flexibility for environments which do not have `madvise` when there is no easy logic to set `NO_MADVISE`. Signed-off-by: James Knight <james.d.knight@live.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20851)
2023-06-11riscv: aes: dual-license under Apache + 2-clause BSDHeiko Stuebner2-0/+54
To allow re-use of the already reviewed openSSL crypto code for RISC-V in other projects - like the Linux kernel, add a second license (2-clause BSD) to the 32+64bit aes implementations using the Zkn extension. Signed-off-by: Heiko Stuebner <heiko.stuebner@vrull.eu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21018)
2023-06-11riscv: GCM: dual-license under Apache + 2-clause BSDHeiko Stuebner2-0/+54
To allow re-use of the already reviewed openSSL crypto code for RISC-V in other projects - like the Linux kernel, add a second license (2-clause BSD) to the recently added GCM ghash functions. Signed-off-by: Heiko Stuebner <heiko.stuebner@vrull.eu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20649)
2023-06-11Coverity 1528485: Remove unused assignment of wvalueTomas Mraz1-3/+3
wvalue is always initialized at the beginning of each cycle and used only within the cycle Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21145)
2023-06-11Coverity 1528486: Avoid assignment of unused value of bagsTomas Mraz1-3/+3
It is used only within the loop and always initialized
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 13:37:14 +0100