Matt Caswell [Thu, 23 Jun 2022 12:38:32 +0000 (13:38 +0100)]
Add additional messages to the DTLS dropped records test
Ensure we are testing a handshake that includes a HelloVerifyRequest and
what happens if we drop it.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18654)
Matt Caswell [Thu, 23 Jun 2022 10:39:38 +0000 (11:39 +0100)]
Correctly handle a retransmitted ClientHello
If we receive a ClientHello and send back a HelloVerifyRequest, we need
to be able to handle the scenario where the HelloVerifyRequest gets lost
and we receive another ClientHello with the message sequence number set to
0.
Fixes #18635
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18654)
Hugo Landau [Tue, 20 Sep 2022 19:40:36 +0000 (20:40 +0100)]
Add deferred datagram limit to QUIC Record Layer RX
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19251)
Pauli [Sun, 18 Sep 2022 23:57:38 +0000 (09:57 +1000)]
Coverity
1515415: NULL dereference
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19236)
Pauli [Mon, 19 Sep 2022 00:48:07 +0000 (10:48 +1000)]
Remove unnecessary define
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19237)
Pauli [Mon, 19 Sep 2022 00:47:06 +0000 (10:47 +1000)]
Runtime detect FIPS RNG usage in test
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19237)
Pauli [Mon, 19 Sep 2022 00:31:12 +0000 (10:31 +1000)]
Remove FIPS condition on IV gen test.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19237)
Pauli [Mon, 19 Sep 2022 00:28:25 +0000 (10:28 +1000)]
Remove FIPS condition on SM2 test.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19237)
Dr. David von Oheimb [Tue, 6 Jul 2021 10:28:22 +0000 (12:28 +0200)]
APPS: Move load_csr_autofmt() from apps/cmp.c to apps.c and use it also for apps, too
Also add related references to FR #15725.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18900)
Dr. David von Oheimb [Wed, 7 Jul 2021 12:14:01 +0000 (14:14 +0200)]
apps/x509.c: Remove legacy call to OBJ_create()
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18900)
Daniel Fiala [Sun, 18 Sep 2022 05:36:36 +0000 (07:36 +0200)]
Check that sk_SSL_CIPHER_value returns non-NULL value.
Fixes openssl#19162.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19233)
Patrik Sevallius [Sun, 18 Sep 2022 10:26:02 +0000 (12:26 +0200)]
Always use FORMAT_BINARY for infile
CLA: trivial
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19234)
Patrik Sevallius [Sun, 18 Sep 2022 10:24:56 +0000 (12:24 +0200)]
Update documentation, standard input is expected to be in binary format too
CLA: trivial
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19234)
Matt Caswell [Fri, 12 Aug 2022 12:27:21 +0000 (13:27 +0100)]
Use an enum for the return value from a construction function
Construction return values are no longer boolean but can return 3 different
values, so we use an enum to represent them.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18990)
Matt Caswell [Fri, 12 Aug 2022 12:24:19 +0000 (13:24 +0100)]
If a ticket key callback returns 0 in TLSv1.3 don't send a ticket
If we can't construct the ticket don't send one. This requires a change
to the TLS state machine to be able to a handle a construction function
deciding not to send a message after all.
Fixes #18977
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18990)
Matt Caswell [Fri, 12 Aug 2022 11:14:18 +0000 (12:14 +0100)]
Test a 0 return from the ticket key callback
A 0 return from a ticket key callback should indicate that crypto parameters
are not currently available and that the handshake should continue without
generating/using the ticket.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18990)
Tomas Mraz [Wed, 14 Sep 2022 08:41:04 +0000 (10:41 +0200)]
Fix detection of ktls support in cross-compile environment on Linux
Fixes #19212
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19213)
Daniel Fiala [Tue, 6 Sep 2022 05:51:59 +0000 (07:51 +0200)]
Add an EVP demo for AES key wrap
Fixes openssl#14119
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19141)
David von Oheimb [Thu, 11 Aug 2022 15:46:11 +0000 (17:46 +0200)]
80-test_ssl_new.t: make dependencies on CTLOG_FILE and TEST_CERTS_DIR explicit
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/18918)
Dr. David von Oheimb [Sun, 7 Aug 2022 05:08:28 +0000 (07:08 +0200)]
stack.c: add missing direct error reporting and improve coding style
Doing so, had to fix sloppiness in using the stack API in crypto/conf/conf_def.c,
ssl/ssl_ciph.c, ssl/statem/statem_srvr.c, and mostly in test/helpers/ssltestlib.c.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18918)
Dr. David von Oheimb [Sun, 7 Aug 2022 04:17:15 +0000 (06:17 +0200)]
x509_vpm.c: add missing direct error reporting and improve coding style
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18918)
David von Oheimb [Sun, 31 Jul 2022 05:15:40 +0000 (07:15 +0200)]
X509_STORE_CTX_set_default(): improve error handling, also in its use
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/18918)
Daniel Fiala [Fri, 5 Aug 2022 02:44:51 +0000 (04:44 +0200)]
Add tests for trace_api.
Fixes openssl#17422
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19096)
Daniel Fiala [Mon, 22 Aug 2022 06:41:36 +0000 (08:41 +0200)]
Add documentation and test for EVP_PBE_alg_add
Fixes openssl#18687
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19157)
Pauli [Tue, 13 Sep 2022 22:39:29 +0000 (08:39 +1000)]
Add CI to test old FIPS provider versions
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/19201)
Tomas Mraz [Tue, 13 Sep 2022 20:38:30 +0000 (22:38 +0200)]
With fips provider 3.0.0 skip tests related to explicit curves handling
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19201)
Tomáš Mráz [Tue, 13 Sep 2022 04:37:05 +0000 (14:37 +1000)]
EVP_PKEY_eq: regain compatibility with the 3.0.0 FIPS provider
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19201)
Pauli [Tue, 13 Sep 2022 01:23:03 +0000 (11:23 +1000)]
Fix default padding regression against 3.0.0 FIPS provider
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/19201)
Pauli [Tue, 13 Sep 2022 00:52:25 +0000 (10:52 +1000)]
TDES: fix test with old FIPS provider
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/19201)
Pauli [Mon, 12 Sep 2022 22:49:05 +0000 (08:49 +1000)]
evp_test: allow FIPS provider version based escapes in evp_test
Also fix a number of regressions when run against the 3.0.0 FIPS provider
that result from bug fixes.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/19201)
Pauli [Mon, 12 Sep 2022 22:46:34 +0000 (08:46 +1000)]
test: make unit tests FIPS provider version aware
Fixes #19171
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/19201)
Akshat Maheshwari [Tue, 13 Sep 2022 07:03:21 +0000 (12:33 +0530)]
Fix a typo in the function name
X509_STORE_load_locations_ex() calls X509_STORE_load_file_ex() and X509_STORE_load_path(), there's no such function name as X509_STORE_load_dir().
CLA: trivial
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19202)
K1 [Tue, 13 Sep 2022 12:16:43 +0000 (20:16 +0800)]
Add support for PBE using hmacWithSM3
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19204)
Richard Levitte [Wed, 14 Sep 2022 05:07:41 +0000 (07:07 +0200)]
util/wrap.pl.in: Use parentheses so `kill` gets all its arguments
In perl, this may be ambiguous:
fn (expr1), expr2
Is the comma (which may be `=>` just as well in this case) a separator
between arguments to `fn`, or is it the comma operator, separating the
expressions `fn(expr1)` and `expr2`? It appears that in this particular
case, perl takes the existing parentheses to mean the latter. When the
former was intended, extra parentheses are required.
Fixes #19209
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19211)
Hugo Landau [Fri, 8 Apr 2022 12:20:44 +0000 (13:20 +0100)]
Add support for loading root CAs from Windows crypto API
Fixes #18020.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18070)
Hugo Landau [Fri, 8 Apr 2022 12:10:52 +0000 (13:10 +0100)]
Fix URI handling in SSL_CERT_DIR/introduce SSL_CERT_URI env
Fixes #18068.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18070)
Richard Levitte [Wed, 14 Sep 2022 10:32:26 +0000 (12:32 +0200)]
Fix the OSSL_TIME fallback in include/internal/e_os.h
There's a fallback `ossl_sleep()` that uses `OSSL_TIME`. However,
nothing was done to ensure that `OSSL_TIME` is defined.
Adding an inclusion of "internal/time.h" should be enough.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/19214)
Hugo Landau [Thu, 8 Sep 2022 13:10:38 +0000 (14:10 +0100)]
QUIC QRL: Fix bug in Handshake packet processing
We automatically dropped Initial keys when receiving a Handshake packet,
but did this regardless of whether the packet was successfully decrypted
and authenticated. Per the RFC, we should only drop Initial keys when
successfully processing a Handshake packet.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19176)
Tomas Mraz [Fri, 9 Sep 2022 12:46:24 +0000 (14:46 +0200)]
Fix AES-GCM on Power 8 CPUs
Properly fallback to the default implementation on CPUs
missing necessary instructions.
Fixes #19163
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19182)
Pauli [Tue, 14 Jun 2022 01:28:58 +0000 (11:28 +1000)]
design: TX Packetiser
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18570)
Pauli [Wed, 31 Aug 2022 06:15:44 +0000 (16:15 +1000)]
Fix white space
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19082)
Pauli [Mon, 29 Aug 2022 04:53:45 +0000 (14:53 +1000)]
libcrypto: remove reliance on struct timeval
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19082)
Pauli [Mon, 29 Aug 2022 04:52:44 +0000 (14:52 +1000)]
time: move OSSL_TIME to libcrypto
Keep building it for libssl without exposing any symbols.
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19082)
Pauli [Wed, 31 Aug 2022 03:11:15 +0000 (13:11 +1000)]
Avoid struct timeval in QUIC code
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19082)
Pauli [Mon, 29 Aug 2022 04:17:25 +0000 (14:17 +1000)]
ssl: modify libssl so that it uses OSSL_TIME
This is instead of time_t and struct timeval. Some public APIs mandate a
presence of these two types, but they are converted to OSSL_TIME internally.
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19082)
Pauli [Mon, 29 Aug 2022 03:41:26 +0000 (13:41 +1000)]
time: add some additional utilities and document everything
Some of the recently added functions were not documents. This has been addressed.
Also added utility functions for conversions between time_t, seconds and struct timeval
to/from OSSL_TIME.
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19082)
Dr. David von Oheimb [Tue, 13 Sep 2022 07:32:25 +0000 (09:32 +0200)]
apps/openssl-vms.cnf: reflect latest changes by 'make update'
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19179)
Dr. David von Oheimb [Thu, 8 Sep 2022 15:17:06 +0000 (17:17 +0200)]
Revert (most of) "Makefile: Generate crypto objects only as far as needed"
This reverts all adaptations by commit
89c39bd8f6528ad268c1c0d0c9e196ba4396941b
on Configurations/unix-Makefile.tmpl except for additions to .PHONY
Fixes #19087
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19179)
Richard Levitte [Mon, 12 Sep 2022 15:29:53 +0000 (17:29 +0200)]
Checking __STDC_VERSION__ rather than __STRICT_ANSI__
`__STRICT_ANSI__` is a gnuish flag macro that indicates if `-ansi`
was given on the command line. To check the C version, it's better
to check the macro `__STDC_VERSION__`.
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/19197)
David Carlier [Thu, 8 Sep 2022 21:16:31 +0000 (22:16 +0100)]
OSSL_CRYPTO_ALLOC attribute introduction proposal.
Giving hint to the compiler the returned pointer is not aliased
(so realloc-like api is de facto excluded).
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19180)
Michael Baentsch [Fri, 9 Sep 2022 13:43:15 +0000 (15:43 +0200)]
update oqsprovider/liboqs to v0.7.2
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19184)
Paul Yang [Fri, 9 Sep 2022 07:48:24 +0000 (15:48 +0800)]
Fix PROV_RC5_CTX's original structure name
It looks like a typo when copy & pasting the structure from blowfish.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19186)
Tom Cosgrove [Fri, 9 Sep 2022 06:24:48 +0000 (07:24 +0100)]
Fix tests when configured with -DOPENSSL_USE_IPV6=0
In include/internal/sockets.h it says that you can disable IPv6, and only
defines OPENSSL_USE_IPV6 (to 0 or 1) if it's not already defined.
The codebase generally then checks `#if OPENSSL_USE_IPV6`.
However, test_bio_dgram uses `#if defined(OPENSSL_USE_IPV6)` which means it tries
to test IPv6 even if it's explicitly configured out with -DOPENSSL_USE_IPV6=0
(`#if defined(OPENSSL_USE_IPV6)` is always true).
This fixes that.
Change-Id: Ie1641c9dd654f27f3bdca186517df5599ad1059b
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19181)
Pauli [Thu, 8 Sep 2022 02:54:23 +0000 (12:54 +1000)]
list: add an option to list all available algorithms
Fixes #19145
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/19168)
Dr. David von Oheimb [Mon, 29 Aug 2022 11:59:02 +0000 (13:59 +0200)]
crypto/x509/{x509_req,x_all}.c: add some NULL parameter checks, improve coding style
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19090)
Gibeom Gwon [Sat, 27 Aug 2022 13:29:28 +0000 (22:29 +0900)]
X509 x_all.c: Set 'modified' flag when ASN1_item_sign{,_ctx} call was successful
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19090)
Gibeom Gwon [Sat, 27 Aug 2022 13:04:38 +0000 (22:04 +0900)]
X509 x509_req.c: Set 'modified' flag when X509_req_info_st member data updated
We need to reencode X509_req_info_st if member data updated.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19090)
a1346054 [Thu, 8 Sep 2022 08:11:53 +0000 (08:11 +0000)]
openssl.cnf: split option value and comment and remove leading space
CLA: trivial
Signed-off-by: a1346054 <36859588+a1346054@users.noreply.github.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19173)
Todd Short [Thu, 1 Sep 2022 19:31:21 +0000 (15:31 -0400)]
Cleanup EBCDIC string defintions
Use a single definiton for protocol string defintions.
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19122)
Matt Caswell [Wed, 31 Aug 2022 11:31:24 +0000 (12:31 +0100)]
Add some API tests for TLSv1.3 record padding
We have some ssl_test_new tests for record padding. But these only use
the block padding approach set via a config file on the SSL_CTX. We add
tests for all the various API calls.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19103)
Gang Chen [Wed, 7 Sep 2022 06:31:31 +0000 (14:31 +0800)]
crypto/conf: gcc build warning fix
Fix the gcc build warning from conf_sap.c:
variable flags set but not used [-Wunused-but-set-variable]
variable appname set but not used [-Wunused-but-set-variable]
variable filename set but not used [-Wunused-but-set-variable]
CLA: trivial
Signed-off-by: Gang Chen <gang.c.chen@intel.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19153)
Juergen Christ [Wed, 7 Sep 2022 13:01:17 +0000 (15:01 +0200)]
s390x: fix ecx derive
Derivation via ecx-methods did not properly set the length. Make the code
more similar to common code and set the length property.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19158)
Todd Short [Tue, 6 Sep 2022 15:18:54 +0000 (11:18 -0400)]
Remove perror() usage in library
The dgram code used perror extensively.
Keep the `perror()` in the allocation code; it's used for debugging only.
Keep the `perror()`s in the demos, tests and apps.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19148)
Tomas Mraz [Wed, 7 Sep 2022 06:41:05 +0000 (08:41 +0200)]
bio_dgram_test.c: Fix warning from older clang compilers
Older clang compilers warn about the initializer:
test/bio_dgram_test.c:107:29: error: suggest braces around initialization
of subobject [-Werror,-Wmissing-braces]
struct in6_addr ina6 = {0};
^
{}
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19152)
Daniel Fiala [Tue, 6 Sep 2022 04:27:46 +0000 (06:27 +0200)]
Add an EVP demo for key encoding using EC
Fixes openssl#14117
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19143)
Hugo Landau [Wed, 7 Sep 2022 16:59:04 +0000 (17:59 +0100)]
Fix BIO_sendmmsg/BIO_recvmmsg issues on FreeBSD
Fixes #19156.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19164)
Tristan Lelong [Mon, 5 Sep 2022 09:14:40 +0000 (11:14 +0200)]
Fix undefined ipi_spec_dst for cygwin build.
The 'struct in_pktinfo' doesn't have a 'ipi_spec_dst' field on windows
OS which break cygwin builds of OpenSSL.
Signed-off-by: Tristan Lelong <tlelong@google.com>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19134)
Dr. David von Oheimb [Sat, 28 May 2022 18:26:43 +0000 (20:26 +0200)]
apps/lib/http_server.{c,h}: clean up logging and move it to log.{c,h}
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18434)
Dr. David von Oheimb [Sat, 28 May 2022 16:50:18 +0000 (18:50 +0200)]
apps/ocsp.c etc.: rename 'multi' to 'n_responders' for clarity
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18434)
Dr. David von Oheimb [Sat, 28 May 2022 16:44:02 +0000 (18:44 +0200)]
APPS HTTP server: trace requests and responses when enabled
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18434)
Dr. David von Oheimb [Sat, 28 May 2022 16:27:44 +0000 (18:27 +0200)]
OSSL_trace_enabled.pod: add missing synopsis for OSSL_TRACE()
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18434)
Pauli [Tue, 6 Sep 2022 01:41:35 +0000 (11:41 +1000)]
Coverity: explicit null dereference
Coverity is being pretty silly here but adding the explicit pointer checks
will stop a crash if something goes badly awry.
Fixes Coverity
1513706 -
1513709
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19136)
Tomas Mraz [Fri, 1 Apr 2022 15:01:15 +0000 (17:01 +0200)]
Initial congestion control API design
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18018)
Tomas Mraz [Mon, 5 Sep 2022 08:17:58 +0000 (10:17 +0200)]
Fix build failure on freebsd due to missing data declaration
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19130)
Pauli [Sun, 4 Sep 2022 21:56:37 +0000 (07:56 +1000)]
Coverity
1513478: negative return
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19126)
xtkoba [Fri, 2 Sep 2022 07:44:17 +0000 (16:44 +0900)]
test/pkcs12_api_test.c: fix failure on MinGW
Use binary mode when opening a file.
Partially fixes #18017.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19117)
Pauli [Fri, 2 Sep 2022 04:44:02 +0000 (14:44 +1000)]
list: add a doubly linked list type.
These list can be embedded into structures and structures can be members of
multiple lists. Moreover, this is done without dynamic memory allocation.
That is, this is legal:
typedef struct item_st ITEM;
struct item_st {
...
OSSL_LIST_MEMBER(new_items, ITEM);
OSSL_LIST_MEMBER(failed_items, ITEM);
...
};
DEFINE_LIST_OF(new_items, TESTL);
DEFINE_LIST_OF(failed_items, TESTL);
struct {
...
OSSL_LIST(new_items) new;
OSSL_LIST(failed_items) failed;
...
} *st;
ITEM *p;
for (p = ossl_list_new_items_head(&st->new); p != NULL;
p = ossl_list_new_items_next(p))
/* do something */
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19115)
Hongren (Zenithal) Zheng [Fri, 13 May 2022 16:01:11 +0000 (00:01 +0800)]
provider: cipher: aes: add riscv32 zkn (zbkb) support
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18308)
Hongren (Zenithal) Zheng [Fri, 13 May 2022 15:44:31 +0000 (23:44 +0800)]
aes_platform: add riscv32 zkn asm support
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18308)
Hongren (Zenithal) Zheng [Fri, 13 May 2022 15:29:34 +0000 (23:29 +0800)]
add build support for riscv32 aes zkn
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18308)
Hongren (Zenithal) Zheng [Fri, 13 May 2022 16:02:44 +0000 (00:02 +0800)]
Add RISC-V 32 cpuid support
Mainly from #17640
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18308)
Hongren (Zenithal) Zheng [Fri, 13 May 2022 15:23:29 +0000 (23:23 +0800)]
Add linux32-riscv32/BSD-riscv32 target
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18308)
Hongren (Zenithal) Zheng [Fri, 13 May 2022 14:24:43 +0000 (22:24 +0800)]
Add AES implementation in riscv32 zkn asm
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18308)
Dr. David von Oheimb [Tue, 26 Jul 2022 06:37:41 +0000 (08:37 +0200)]
check-format.pl: improve whitespace reporting on <op>=
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18812)
Dr. David von Oheimb [Mon, 25 Jul 2022 16:14:33 +0000 (18:14 +0200)]
check-format.pl: further fixes for whitespace reporting within 'for (...)'
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18812)
Dr. David von Oheimb [Fri, 15 Jul 2022 06:35:16 +0000 (08:35 +0200)]
check-format.pl: report #if and #elif with constant condition; improve checks on '/*'
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18812)
Dr. David von Oheimb [Wed, 13 Jul 2022 23:34:11 +0000 (01:34 +0200)]
check-format.pl: extend checking into macro bodies; small further improvements
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18812)
Dr. David von Oheimb [Wed, 13 Jul 2022 17:37:30 +0000 (19:37 +0200)]
check-format.pl: improve preprocessor directive handling; re-order state variables
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18812)
Dr. David von Oheimb [Wed, 31 Aug 2022 08:27:42 +0000 (10:27 +0200)]
PKCS7: add notes to pkcs7.h.in and minor code cleanup in crypto/{pkcs7,cms}/
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18915)
Dr. David von Oheimb [Fri, 29 Jul 2022 11:09:52 +0000 (13:09 +0200)]
Fix many inconsistencies in doc of CMS_verify() and PKC7_verify() etc.
Also change B< to I< in {CMS,PKCS7}_verify.pod, PKCS7_sign{,_add_signer}.pod
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18915)
Hugo Landau [Mon, 15 Aug 2022 15:13:28 +0000 (16:13 +0100)]
TX key update support, RX time and PN reporting, general refactoring
- Adds an RX time field to the OSSL_QRX_PKT structure.
- Adds a timekeeping argument to ossl_demux_new which is used to determine
packet reception time.
- Adds a decoded PN field to the OSSL_QRX_PKT structure.
This has to be decoded by the QRX anyway, and its omission was an oversight.
- Key update support for the TX side.
- Minor refactoring.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18949)
Hugo Landau [Thu, 11 Aug 2022 10:24:57 +0000 (11:24 +0100)]
QUIC Record Layer (Refactor and TX Side)
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18949)
Hugo Landau [Fri, 22 Jul 2022 12:08:38 +0000 (13:08 +0100)]
QUIC Demuxer and Record Layer (RX Side)
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18949)
Tomas Mraz [Wed, 31 Aug 2022 06:50:42 +0000 (08:50 +0200)]
Document the return value of OSSL_LIB_CTX_load_config()
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19101)
Tobias Brunner [Mon, 29 Aug 2022 08:05:56 +0000 (10:05 +0200)]
Fix documented max. length for info buffer in HKDF
This limit was increased with
20c2876f24d0 ("Increase
HKDF_MAXBUF from 1024 to 2048").
CLA: trivial
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19085)
Dr. David von Oheimb [Sat, 30 Jul 2022 18:53:44 +0000 (20:53 +0200)]
PKCS7_dataVerify(): fix missing use of CRLs in PKCS#7 message
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18913)
Tomas Mraz [Mon, 29 Aug 2022 10:27:27 +0000 (12:27 +0200)]
Remove unused dtls1_bitmap.c
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19088)
Hugo Landau [Mon, 9 May 2022 13:24:33 +0000 (14:24 +0100)]
BIO_dgram support for BIO_sendmmsg/BIO_recvmmsg
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18270)
Daniel Hu [Tue, 19 Jul 2022 17:43:28 +0000 (18:43 +0100)]
Improve chacha20 perfomance on aarch64 by interleaving scalar with SVE/SVE2
The patch will process one extra block by scalar in addition to
blocks by SVE/SVE2 in parallel. This is esp. helpful in the
scenario where we only have 128-bit vector length.
The actual uplift to performance is complicated, depending on the
vector length and input data size. SVE/SVE2 implementation don't
always perform better than Neon, but it should prevail in most
cases
On a CPU with 256-bit SVE/SVE2, interleaved processing can
handle 9 blocks in parallel (8 blocks by SVE and 1 by Scalar).
on 128-bit SVE/SVE2 it is 5 blocks. Input size that is a multiple
of 9/5 blocks on respective CPU can be typically handled at
maximum speed.
Here are test data for 256-bit and 128-bit SVE/SVE2 by running
"openssl speed -evp chacha20 -bytes 576" (and other size)
----------------------------------+---------------------------------
256-bit SVE | 128-bit SVE2
----------------------------------|---------------------------------
Input 576 bytes 512 bytes | 320 bytes 256 bytes
----------------------------------|---------------------------------
SVE
1716361.91k
1556699.18k |
1615789.06k
1302864.40k
----------------------------------|---------------------------------
Neon
1262643.44k
1509044.05k | 680075.67k
1060532.31k
----------------------------------+---------------------------------
If the input size gets very large, the advantage of SVE/SVE2 over
Neon will fade out.
Signed-off-by: Daniel Hu <Daniel.Hu@arm.com>
Change-Id: Ieedfcb767b9c08280d7c8c9a8648919c69728fab
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18901)
Juergen Christ [Fri, 19 Aug 2022 15:10:29 +0000 (17:10 +0200)]
Fix memory leak with TLS1.2 compression
Leak sanitizer reports following leak for ssl-test-new subtest
4-tlsv1_2-both-compress:
==335733==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 17728 byte(s) in 1 object(s) allocated from:
#0 0x3ff9fbba251 in malloc (/usr/lib64/libasan.so.8+0xba251)
#1 0x3ff9f71744f in tls_do_uncompress ssl/record/methods/tls_common.c:868
#2 0x3ff9f7175bd in tls_default_post_process_record ssl/record/methods/tls_common.c:896
#3 0x3ff9f715ee7 in tls_get_more_records ssl/record/methods/tls_common.c:773
#4 0x3ff9f712209 in tls_read_record ssl/record/methods/tls_common.c:958
#5 0x3ff9f6ef73f in ssl3_read_bytes ssl/record/rec_layer_s3.c:1235
#6 0x3ff9f776165 in tls_get_message_header ssl/statem/statem_lib.c:1198
#7 0x3ff9f74709b in read_state_machine ssl/statem/statem.c:624
#8 0x3ff9f74709b in state_machine ssl/statem/statem.c:478
#9 0x3ff9f662e61 in SSL_do_handshake ssl/ssl_lib.c:4430
#10 0x100c55d in do_handshake_step test/helpers/handshake.c:775
#11 0x100c55d in do_connect_step test/helpers/handshake.c:1134
#12 0x100e85b in do_handshake_internal test/helpers/handshake.c:1544
#13 0x1011715 in do_handshake test/helpers/handshake.c:1738
#14 0x101d1a7 in test_handshake test/ssl_test.c:543
#15 0x1027875 in run_tests test/testutil/driver.c:370
#16 0x1008393 in main test/testutil/main.c:30
#17 0x3ff9cc2b871 in __libc_start_call_main (/usr/lib64/libc.so.6+0x2b871)
#18 0x3ff9cc2b94f in __libc_start_main_alias_2 (/usr/lib64/libc.so.6+0x2b94f)
#19 0x100864f (/code/openssl/test/ssl_test+0x100864f)
Direct leak of 17728 byte(s) in 1 object(s) allocated from:
#0 0x3ff9fbba251 in malloc (/usr/lib64/libasan.so.8+0xba251)
#1 0x3ff9f71744f in tls_do_uncompress ssl/record/methods/tls_common.c:868
#2 0x3ff9f7175bd in tls_default_post_process_record ssl/record/methods/tls_common.c:896
#3 0x3ff9f715ee7 in tls_get_more_records ssl/record/methods/tls_common.c:773
#4 0x3ff9f712209 in tls_read_record ssl/record/methods/tls_common.c:958
#5 0x3ff9f6ef73f in ssl3_read_bytes ssl/record/rec_layer_s3.c:1235
#6 0x3ff9f776165 in tls_get_message_header ssl/statem/statem_lib.c:1198
#7 0x3ff9f74709b in read_state_machine ssl/statem/statem.c:624
#8 0x3ff9f74709b in state_machine ssl/statem/statem.c:478
#9 0x3ff9f662e61 in SSL_do_handshake ssl/ssl_lib.c:4430
#10 0x100c55d in do_handshake_step test/helpers/handshake.c:775
#11 0x100c55d in do_connect_step test/helpers/handshake.c:1134
#12 0x1010b09 in do_handshake_internal test/helpers/handshake.c:1550
#13 0x1011715 in do_handshake test/helpers/handshake.c:1738
#14 0x101d1a7 in test_handshake test/ssl_test.c:543
#15 0x1027875 in run_tests test/testutil/driver.c:370
#16 0x1008393 in main test/testutil/main.c:30
#17 0x3ff9cc2b871 in __libc_start_call_main (/usr/lib64/libc.so.6+0x2b871)
#18 0x3ff9cc2b94f in __libc_start_main_alias_2 (/usr/lib64/libc.so.6+0x2b94f)
#19 0x100864f (/code/openssl/test/ssl_test+0x100864f)
SUMMARY: AddressSanitizer: 35456 byte(s) leaked in 2 allocation(s).
Fix this by freeing the SSL3_RECORD structure inside the OSSL_RECORD_LAYER.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19030)