summaryrefslogtreecommitdiffstats
path: root/ssl (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Update copyright yearMatt Caswell2021-04-082-2/+2
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14801)
* Corrected missing definitions from NonStop SPT build.Randall S. Becker2021-04-013-0/+14
| | | | | | | | | | | | | | | | | This change includes swapping the PUT and SPT configuration, includes of sys/stat.h and sys/types.h in the correct scope to be picked up by SPT definitions. Fixes: #14698 Fixes: #14734 CLA: The author has the permission to grant the OpenSSL Team the right to use this change. Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14736)
* Fix typos in ssl_lib.cNan Xiao2021-04-011-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14751)
* OBJ_nid2sn(NID_sha256) is completely equivalent to OSSL_DIGEST_NAME_SHA2_256Tomas Mraz2021-04-011-5/+1
| | | | | | | | The comment is bogus as that call for NID_sha256 does not do anything else than looking up the string in an internal table. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14703)
* ssl: fix problem where MAC IDs were globally cached.Pauli2021-03-302-10/+15
| | | | | | | | | | | | | Instead, they should be cached per SSL_CTX. This also addresses a threading issue where multiple attempts to write the same location occur. The last one winning. Under 1.1.1, this wasn't an issue but under 3.0 with library contexts, the results can and will be different. Fixes #13456 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14715)
* Fix BIO_new_ssl_connect() to not leak memoryNan Xiao2021-03-301-0/+1
| | | | | | | | CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14719)
* ssl/ssl_ciph.c: update format string, againAlexander Traud2021-03-261-1/+1
| | | | | | | | Commit 2664810 changed everything except the encoding. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14673)
* Ensure buffer/length pairs are always in syncMatt Caswell2021-03-256-10/+45
| | | | | | | | | Following on from CVE-2021-3449 which was caused by a non-zero length associated with a NULL buffer, other buffer/length pairs are updated to ensure that they too are always in sync. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
* ssl sigalg extension: fix NULL pointer dereferencePeter Kaestle2021-03-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | As the variable peer_sigalgslen is not cleared on ssl rehandshake, it's possible to crash an openssl tls secured server remotely by sending a manipulated hello message in a rehandshake. On such a manipulated rehandshake, tls1_set_shared_sigalgs() calls tls12_shared_sigalgs() with the peer_sigalgslen of the previous handshake, while the peer_sigalgs has been freed. As a result tls12_shared_sigalgs() walks over the available peer_sigalgs and tries to access data of a NULL pointer. This issue was introduced by c589c34e61 (Add support for the TLS 1.3 signature_algorithms_cert extension, 2018-01-11). Signed-off-by: Peter Kästle <peter.kaestle@nokia.com> Signed-off-by: Samuel Sapalski <samuel.sapalski@nokia.com> CVE-2021-3449 CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* ssl: coverity 1465527 - dereference after null checkPauli2021-03-201-0/+3
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14589)
* ssl: fix coverity 1451495: resource leakPauli2021-03-201-1/+3
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14596)
* ssl: fix coverity 1451515: out of bounds memory accessPauli2021-03-181-0/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14585)
* Add ossl_gost symbolsShane Lontis2021-03-183-8/+8
| | | | | | | Partial fix for #12964 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14473)
* Always check CRYPTO_LOCK_{read,write}_lockRich Salz2021-03-142-13/+29
| | | | | | | | | | | | | | Some functions that lock things are void, so we just return early. Also make ossl_namemap_empty return 0 on error. Updated the docs, and added some code to ossl_namemap_stored() to handle the failure, and updated the tests to allow for failure. Fixes: #14230 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14238)
* ssl: fix format specifier for size_t argument to BIO_printfPauli2021-03-131-1/+1
| | | | | | | | Fixes #14519 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14521)
* ssl: support params arguments to init functionsPauli2021-03-117-10/+15
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14383)
* Increase the upper limit on group name lengthAnthony Hu2021-03-111-2/+2
| | | | | | | | | | | | | | While all the standardized groups would fit within the old limit, with the addition of providers, some might want to experiment with new and unstandardized groups. As such, their names might not fit within the old limit. Define it as GROUP_NAME_BUFFER_LENGTH with value 64. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14502)
* Reword repeated words.Shane Lontis2021-03-091-1/+1
| | | | | | | | | | A trivial PR to remove some commonly repeated words. It looks like this is not the first PR to do this. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14420)
* Fix the check for suitable groups and TLSv1.3Matt Caswell2021-03-081-1/+7
| | | | | | | | If we have TLSv1.3 enabled then we must have at least one TLSv1.3 capable group available. This check was not always working Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/14430)
* Fix NULL access in ssl_build_cert_chain() when ctx is NULL.Shane Lontis2021-03-031-1/+1
| | | | | | | | Fixes #14294 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14295)
* statem_lib.c: Remove TODOs that are unnecessaryTomas Mraz2021-03-031-8/+0
| | | | | | | | | If the EVP_MD_CTX_ctrl is deprecated the code will generate deprecation warnings. So there is no point in marking all EVP_MD_CTX_ctrl() calls with TODOs. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14367)
* tls: adjust for extra argument to KDF derive callPauli2021-02-282-6/+3
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14310)
* tls: updates for the new additional MAC_init argumentsPauli2021-02-282-16/+9
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14310)
* Remove disabled TLS 1.3 ciphers from the SSL(_CTX)Benjamin Kaduk2021-02-241-1/+4
| | | | | | | | | | | | | | | | In ssl_create_cipher_list() we make a pass through the ciphers to remove those which are disabled in the current libctx. We are careful to not include such disabled TLS 1.3 ciphers in the final consolidated cipher list that we produce, but the disabled ciphers are still kept in the separate stack of TLS 1.3 ciphers associated with the SSL or SSL_CTX in question. This leads to confusing results where a cipher is present in the tls13_cipherlist but absent from the actual cipher list in use. Keep the books in order and remove the disabled ciphers from the 1.3 cipherlist at the same time we skip adding them to the active cipher list. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12037)
* Update copyright yearMatt Caswell2021-02-188-8/+8
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14235)
* Rename OSSL_ENCODER_CTX_new_by_EVP_PKEY and OSSL_DECODER_CTX_new_by_EVP_PKEYTomas Mraz2021-02-171-3/+3
| | | | | | | | | | Additional renames done in encoder and decoder implementation to follow the style. Fixes #13622 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14155)
* Implement EVP_PKEY_param_check_quick() and use it in libsslMatt Caswell2021-02-151-1/+7
| | | | | | | | | | | | | | | | The low level DH API has two functions for checking parameters: DH_check_ex() and DH_check_params_ex(). The former does a "full" check, while the latter does a "quick" check. Most importantly it skips the check for a safe prime. We're ok without using safe primes here because we're doing ephemeral DH. Now that libssl is fully using the EVP API, we need a way to specify that we want a quick check instead of a full check. Therefore we introduce EVP_PKEY_param_check_quick() and use it. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14146)
* tls_valid_group: Add missing dereference of okfortls13Tomas Mraz2021-02-121-1/+1
| | | | | | | Fixes #14153 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14154)
* Use ERR_R_*_LIB instead of ERR_LIB_* as reason code for sub-librariesRichard Levitte2021-02-121-2/+2
| | | | | | | | | Using ERR_LIB_* causes the error output to say 'reason(n)' instead of the name of the sub-library in question. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14152)
* Deprecate the libssl level SRP APIsMatt Caswell2021-02-126-13/+78
| | | | | | | | The low level SRP implementation has been deprecated with no replacement. Therefore the libssl level APIs need to be similarly deprecated. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14132)
* Deprecate the low level SRP APIsMatt Caswell2021-02-121-0/+3
| | | | | | | | | The OTC decided that all low level APIs should be deprecated. This extends to SRP, even though at the current time there is no "EVP" interface to it. This could be added in a future release. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14132)
* Remove unused 'peer_type' from SSL_SESSIONBenjamin Kaduk2021-02-102-2/+0
| | | | | | | | | This field has not been used since #3858 was merged in 2017 when we moved to a table-based lookup for certificate type properties instead of an index-based one. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/13991)
* Simplify the EVP_PKEY_XXX_fromdata_XX methods.Shane Lontis2021-02-082-4/+5
| | | | | | | | | | | | | | | | | | The existing names such as EVP_PKEY_param_fromdata_settable were a bit confusing since the 'param' referred to key params not OSSL_PARAM. To simplify the interface a 'selection' parameter will be passed instead. The changes are: (1) EVP_PKEY_fromdata_init() replaces both EVP_PKEY_key_fromdata_init() and EVP_PKEY_param_fromdata_init(). (2) EVP_PKEY_fromdata() has an additional selection parameter. (3) EVP_PKEY_fromdata_settable() replaces EVP_PKEY_key_fromdata_settable() and EVP_PKEY_param_fromdata_settable(). EVP_PKEY_fromdata_settable() also uses a selection parameter. Fixes #12989 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14076)
* Remove all OPENSSL_NO_XXX from libssl where XXX is a crypto algMatt Caswell2021-02-055-29/+5
| | | | | | | | | | | | We should no longer be relying on compile time checks in libssl for the availability of crypto algorithms. The availability of crypto algorithms should be determined at runtime based on what providers have been loaded. Fixes #13616 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
* Remove OPENSSL_NO_EC guards from libsslMatt Caswell2021-02-0517-167/+20
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
* Make sure we don't use sigalgs that are not availableMatt Caswell2021-02-051-3/+10
| | | | | | | | We may have compiled in sigalg values that we can't support at runtime. Make sure we only use sigalgs that are actually enabled. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
* Add the nist group names as aliases for the normal TLS group namesMatt Caswell2021-02-052-5/+1
| | | | | | | | By recognising the nist group names directly we can avoid having to call EC_curve_nist2nid in libssl, which is not available in a no-ec build. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
* Remove compile time guard checking from ssl3_get_req_cert_typeMatt Caswell2021-02-051-9/+4
| | | | | | | | | With 3.0 we need to know whether algs are available at run time not at compile time. Actually the code as written is sufficient to do this, so we can simply remove the guards. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
* Check for availability of ciphersuites at run timeMatt Caswell2021-02-051-10/+29
| | | | | | | | | | | | | | In 1.1.1 and below we would check for the availability of certain algorithms based on compile time guards. However with 3.0 this is no longer sufficient. Some algorithms that are unavailable at compile time may become available later if 3rd party providers are loaded. Similarly, algorithms that exist in our built-in providers at compile time may not be available at run time if those providers are not loaded. Fixes #13184 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
* Make supported_groups code independent of EC and DHMatt Caswell2021-02-056-20/+44
| | | | | | | | | | The supported groups code was checking the OPENSSL_NO_EC and OPENSSL_NO_DH guards in order to work, and the list of default groups was based on those guards. However we now need it to work even in a no-ec and no-dh build, because new groups might be added from providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
* Ensure default supported groups works even with no-ec and no-dhMatt Caswell2021-02-056-26/+33
| | | | | | | | | | The default supported groups code was disabled in the event of a build with no-ec and no-dh. However now that providers can add there own groups (which might not fit into either of these categories), this is no longer appropriate. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
* Remove OPENSSL_NO_DH guards from libsslMatt Caswell2021-02-058-67/+40
| | | | | | | | | | | This removes man unnecessary OPENSSL_NO_DH guards from libssl. Now that libssl is entirely using the EVP APIs and implementations can be plugged in via providers it is no longer needed to disable DH at compile time in libssl. Instead it should detect at runtime whether DH is available from the loaded providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
* Remove some TODO(OpenSSL1.2) referencesMatt Caswell2021-02-042-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | We had a couple of stray references to OpenSSL1.2 in libssl. We just reword the comments to remove those references without changing any behaviour. The first one in t1_lib.c is a technical non-compliance in the TLSv1.3 spec where, under some circumstances, we offer DSA sigalgs even in a ClientHello that eventually negotiates TLSv1.3. We explicitly chose to accept this behaviour in 1.1.1 and we're not planning to change it for 3.0. The second one in s3_lib.c is regarnding the behaviour of SSL_set_tlsext_host_name(). Technically you shouldn't be able to call this from a server - but we allow it and just ignore it rather than raising an error. The TODO suggest we consider raising an error instead. However, with 3.0 we are trying to minimise breaking changes so I suggest not making this change now. Fixes #13161 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/14037)
* Update copyright yearRichard Levitte2021-01-2821-21/+21
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13999)
* TLS client: allow cert verify callback return -1 for SSL_ERROR_WANT_RETRY_VERIFYDr. David von Oheimb2021-01-263-30/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The client-side cert verification callback function may not only return as usual for success or 0 for failure, but also -1, typically on failure verifying the server certificate. This makes the handshake suspend and return control to the calling application with SSL_ERROR_WANT_RETRY_VERIFY. The app can for instance fetch further certificates or cert status information needed for the verification. Calling SSL_connect() again resumes the connection attempt by retrying the server certificate verification step. This process may even be repeated if need be. The core implementation of the feature is in ssl/statem/statem_clnt.c, splitting tls_process_server_certificate() into a preparation step that just copies the certificates received from the server to s->session->peer_chain (rather than having them in a local variable at first) and returns to the state machine, and a post-processing step in tls_post_process_server_certificate() that can be repeated: Try verifying the current contents of s->session->peer_chain basically as before, but give the verification callback function the chance to pause connecting and make the TLS state machine later call tls_post_process_server_certificate() again. Otherwise processing continues as usual. The documentation of the new feature is added to SSL_CTX_set_cert_verify_callback.pod and SSL_want.pod. This adds two tests: * A generic test in test/helpers/handshake.c on the usability of the new server cert verification retry feature. It is triggered via test/ssl-tests/03-custom_verify.cnf.in (while the bulky auto- generated changes to test/ssl-tests/03-custom_verify.cnf can be basically ignored). * A test in test/sslapitest.c that demonstrates the effectiveness of the approach for augmenting the cert chain provided by the server in between SSL_connect() calls. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13906)
* Avoid using OSSL_PKEY_PARAM_GROUP_NAME when the key might be legacyTomas Mraz2021-01-263-53/+17
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* Add EVP_PKEY functions to get EC conv form and field typeMatt Caswell2021-01-261-15/+9
| | | | | | | | | libssl at the moment downgrades an EVP_PKEY to an EC_KEY object in order to get the conv form and field type. Instead we provide EVP_PKEY level functions to do this. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* Deprecate EC_KEY + Update ec apps to use EVP_PKEYShane Lontis2021-01-264-41/+82
| | | | | | | | | Co-author: Richard Levitte <levitte@openssl.org> Co-author: Tomas Mraz <tmraz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* Don't copy parameters on setting a key in libsslMatt Caswell2021-01-221-20/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | Whenever we set a private key in libssl, we first found the certificate that matched the key algorithm. Then we copied the key parameters from the private key into the public key for the certficate before finally checking that the private key matched the public key in the certificate. This makes no sense! Part of checking the private key is to make sure that the parameters match. It seems that this code has been present since SSLeay. Perhaps at some point it made sense to do this - but it doesn't any more. We remove that piece of code altogether. The previous code also had the undocumented side effect of removing the certificate if the key didn't match. This makes sense if you've just overwritten the parameters in the certificate with bad values - but doesn't seem to otherwise. I've also removed that error logic. Due to issue #13893, the public key associated with the certificate is always a legacy key. EVP_PKEY_copy_parameters will downgrade the "from" key to legacy if the target is legacy, so this means that in libssl all private keys were always downgraded to legacy when they are first set in the SSL/SSL_CTX. Removing the EVP_PKEY_copy_parameters code has the added benefit of removing that downgrade. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13899)
* ktls: Initial support for ChaCha20-Poly1305Vadim Fedorenko2021-01-201-1/+20
| | | | | | | | | Linux kernel is going to support ChaCha20-Poly1305 in TLS offload. Add support for this cipher. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13475)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 07:52:08 +0100