Dr. David von Oheimb [Wed, 15 Feb 2023 14:38:35 +0000 (15:38 +0100)]
crypto/cmp: fix CertReqId to use in p10cr transactions acc. to RFC 4210
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/20298)
Alois Klink [Sun, 16 Apr 2023 18:19:04 +0000 (19:19 +0100)]
bn_local: remove unused `PTR_SIZE_INT` definition
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20748)
Alois Klink [Sun, 16 Apr 2023 16:03:23 +0000 (17:03 +0100)]
bn_nist: remove unused type-punning union `u`
We no longer need to cast function pointers to PTR_SIZE_INT.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20748)
Alois Klink [Sun, 16 Apr 2023 14:40:01 +0000 (15:40 +0100)]
bn_nist: replace pointer bit-fiddling with ternary
Bit-fiddling pointers is technically implementation defined behavior
in the C specification so the following code is not supported in all
platforms:
PTR_SIZE_INT mask;
void * a, b, c;
int boolean_flag;
mask = 0 - boolean_flag;
/* Not guaranteed to be a valid ptr to a or b on all platforms */
a = (void *)
((((PTR_SIZE_INT) b & ~mask) | (((PTR_SIZE_INT)) c & mask)));
Using a ternary conditional operator is supported on all platforms
(i.e. `a = boolean_flag ? b : c;`).
On most modern compilers/CPUs, this will be faster, since it will
get converted to a CMOV instruction.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20748)
Danny Carpenter [Thu, 13 Apr 2023 19:16:44 +0000 (19:16 +0000)]
adding provider_unload functions for cmp_ tests
CLA: trivial
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20731)
GauriSpears [Thu, 30 Mar 2023 11:30:59 +0000 (16:30 +0500)]
List also non-fetchable hashes in openssl dgst -list
CLA: trivial
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20651)
slontis [Thu, 23 Mar 2023 01:07:03 +0000 (11:07 +1000)]
Fix a HPKE API to put libctx, propq as last (optional parameters).
This keeps the interface consistent with other HPKE API's.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20583)
Tomas Mraz [Tue, 11 Apr 2023 14:24:44 +0000 (16:24 +0200)]
Fix the LCM computation in the RSA multiprime key check
Fixes #20693
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/20708)
Ladislav Marko [Tue, 11 Apr 2023 13:44:03 +0000 (15:44 +0200)]
Fix typo in ssl_ciph.c
CLA: trivial
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/20703)
Aidan Khoury [Tue, 11 Apr 2023 15:31:57 +0000 (12:31 -0300)]
Fix UEFI support on win32
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20714)
Ladislav Marko [Tue, 11 Apr 2023 13:51:06 +0000 (15:51 +0200)]
doc: Fix incorrect pairing of functions
CLA: trivial
The functions that should be implemented together are `OSSL_FUNC_signature_verify_recover_init` and `OSSL_FUNC_signature_verify_recover` and not `OSSL_FUNC_signature_verify_recover_init` with ` OSSL_FUNC_signature_verify_init`
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20704)
Ladislav Marko [Tue, 11 Apr 2023 13:56:11 +0000 (15:56 +0200)]
doc: Fix misleading stucture info
CLA: trivial
The thing created by `OSSL_FUNC_signature_newctx()` and `OSSL_FUNC_signature_dupctx()` is a signature context, not a signature. It's in the name of the function and surrounding documentation.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20705)
Yuan, Shuai [Tue, 4 Apr 2023 05:42:38 +0000 (01:42 -0400)]
Fixes #19580 ECX keygen
Signed-off-by: Yuan, Shuai <shuai.yuan@intel.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/20680)
Matt Caswell [Mon, 27 Feb 2023 09:19:16 +0000 (09:19 +0000)]
Allow partially releasing a record for TLS
This enables the cleansing of plaintext to occur in the record layer and
avoids the need to cast away const above the record layer.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20404)
Matt Caswell [Thu, 23 Feb 2023 17:02:54 +0000 (17:02 +0000)]
Make the data field for get_record() const
Improves consistency with the QUIC rstream implementation - and improves
the abstraction between the TLS implementation and the abstract record
layer. We should not expect that the TLS implementation should be able to
change the underlying buffer. Future record layers may not expect that.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20404)
Matt Caswell [Thu, 23 Feb 2023 16:31:49 +0000 (16:31 +0000)]
Add support for rstream get/release record in the QUIC TLS layer
The QUIC TLS layer was taking an internal copy of rstream data while
reading. The QUIC rstream code has recently been extended to enable a
get/release model which avoids the need for this internal copy, so we use
that instead.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20404)
Jeeban Sethi [Mon, 3 Apr 2023 08:46:24 +0000 (14:16 +0530)]
Updated return value of PEM_write_TYPE() and PEM_write_bio_TYPE() in man-pages.
Fixes #20218
CLA: trivial
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20673)
Tomas Mraz [Wed, 5 Apr 2023 11:39:23 +0000 (13:39 +0200)]
CI: Checkout submodules to make the regression fuzz tests run
Otherwise the fuzz/corpora won't be present.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20683)
Tomas Mraz [Wed, 5 Apr 2023 11:00:25 +0000 (13:00 +0200)]
Add openssl/fuzz-corpora repository as submodule
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20683)
Tomas Mraz [Tue, 4 Apr 2023 14:15:37 +0000 (16:15 +0200)]
Remove fuzz corpora data from the repository
To be replaced with a git submodule.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20683)
dependabot[bot] [Tue, 11 Apr 2023 02:31:02 +0000 (02:31 +0000)]
Bump coverallsapp/github-action from 1.2.4 to 2.1.0
Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 1.2.4 to 2.1.0.
- [Release notes](https://github.com/coverallsapp/github-action/releases)
- [Commits](https://github.com/coverallsapp/github-action/compare/v1.2.4...v2.1.0)
---
updated-dependencies:
- dependency-name: coverallsapp/github-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
CLA: trivial
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20699)
Pauli [Wed, 29 Mar 2023 23:34:13 +0000 (10:34 +1100)]
Remove FIPS cross version check of 3.0.0 provider against current
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20552)
Pauli [Thu, 23 Mar 2023 23:16:57 +0000 (10:16 +1100)]
Remove old FIPS provider cross version check
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20552)
Pauli [Tue, 21 Mar 2023 23:42:11 +0000 (10:42 +1100)]
Add action to cross validate FIPS providers
Tests all released FIPS approved (or in progress) versions against
all development branches and each other.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20552)
Vishwa Pravin [Mon, 3 Apr 2023 06:46:33 +0000 (12:16 +0530)]
Ignore SIGPIPE if client closes connection abruptly
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20678)
Bernd Edlinger [Mon, 13 Feb 2023 16:46:41 +0000 (17:46 +0100)]
Alternative fix for CVE-2022-4304
This is about a timing leak in the topmost limb
of the internal result of RSA_private_decrypt,
before the padding check.
There are in fact at least three bugs together that
caused the timing leak:
First and probably most important is the fact that
the blinding did not use the constant time code path
at all when the RSA object was used for a private
decrypt, due to the fact that the Montgomery context
rsa->_method_mod_n was not set up early enough in
rsa_ossl_private_decrypt, when BN_BLINDING_create_param
needed it, and that was persisted as blinding->m_ctx,
although the RSA object creates the Montgomery context
just a bit later.
Then the infamous bn_correct_top was used on the
secret value right after the blinding was removed.
And finally the function BN_bn2binpad did not use
the constant-time code path since the BN_FLG_CONSTTIME
was not set on the secret value.
In order to address the first problem, this patch
makes sure that the rsa->_method_mod_n is initialized
right before the blinding context.
And to fix the second problem, we add a new utility
function bn_correct_top_consttime, a const-time
variant of bn_correct_top.
Together with the fact, that BN_bn2binpad is already
constant time if the flag BN_FLG_CONSTTIME is set,
this should eliminate the timing oracle completely.
In addition the no-asm variant may also have
branches that depend on secret values, because the last
invocation of bn_sub_words in bn_from_montgomery_word
had branches when the function is compiled by certain
gcc compiler versions, due to the clumsy coding style.
So additionally this patch stream-lined the no-asm
C-code in order to avoid branches where possible and
improve the resulting code quality.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20281)
Bernd Edlinger [Mon, 13 Feb 2023 17:05:18 +0000 (18:05 +0100)]
Revert "Fix Timing Oracle in RSA decryption"
This reverts commit
b1892d21f8f0435deb0250f24a97915dc641c807.
Except for the moving derive_kdk to a separate function.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20281)
Anatolii Lishchynskyi [Wed, 29 Mar 2023 14:16:48 +0000 (17:16 +0300)]
Erase temporary buffer in EVP_PKEY_get_bn_param()
Function EVP_PKEY_get_bn_param() uses temporary buffer (on stack or
heap allocated) to store serialized bignum, but after deserializing it
into BIGNUM*, the buffer is not erased and may contain sensitive data.
This change makes sure the buffer is erased if it was successfully
filled before. Unfortunately, it does not distinguish between public and
private key components, and will always erase the buffer.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20639)
Matt Caswell [Fri, 31 Mar 2023 09:35:32 +0000 (10:35 +0100)]
Don't call OPENSSL_init_crypto from inside a RUN_ONCE
Calling OPENSSL_init_crypto from inside a RUN_ONCE seems like a bad idea.
This is especially bad if OPENSSL_init_crypto can recursively end up
attempting to call the RUN_ONCE that we're already inside.
The initialisation in OPENSSL_init_crypto is already "run once" protected.
There is no need to protect it "twice".
Fixes #20653
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20662)
(cherry picked from commit
a9745427cd5d44a76b31690b4a2c6bef2ee677c4)
Matt Caswell [Thu, 30 Mar 2023 07:52:51 +0000 (08:52 +0100)]
Update the documentation for SSL_version et al
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20650)
Matt Caswell [Wed, 29 Mar 2023 15:50:49 +0000 (16:50 +0100)]
Add a test for SSL_version(), SSL_get_version() etc
We also test SSL_is_dtls(), SSL_is_tls() and SSL_is_quic().
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20650)
Matt Caswell [Wed, 29 Mar 2023 15:25:00 +0000 (16:25 +0100)]
Make sure we can query the SSL object for version info when using QUIC
We have the existing functions SSL_version(), SSL_get_version() and
SSL_is_dtls(). We extend the first two to return something sensible when
using QUIC. We additionally provide the new functions SSL_is_tls() and
SSL_is_quic() to provide a mechanism to figure out what protocol we are
using.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20650)
slontis [Wed, 22 Feb 2023 04:16:05 +0000 (14:16 +1000)]
FFC cleanups
Discovered during coverage testing.
Remove unneccesary check when using ossl_dh_get0_params() and
ossl_dsa_get0_params(). These point to addresses and can not fail
for any existing calls.
Make dsa keygen tests only available in the FIPS module - as they are
not used in the default provider.
Change ossl_ffc_set_digest() to return void as it cannot fail.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20359)
Tomas Mraz [Fri, 31 Mar 2023 13:46:15 +0000 (15:46 +0200)]
Avoid calling into provider with the same iv_len or key_len
Fixes #20625
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20664)
Anthony Roberts [Thu, 30 Mar 2023 14:19:53 +0000 (15:19 +0100)]
Fix compilation error when using clang-cl 16 or higher
Fixes a "Incompatible function pointer types" error.
In prior versions, this was a warning, but is now an error.
CLA: trivial
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20654)
slontis [Tue, 21 Mar 2023 05:52:34 +0000 (15:52 +1000)]
Make DSA_sign() test for negative p,q,g values.
Related to #20268
DSA_sign() assumes that the signature passed in is related to DSA_size().
If q is negative then DSA_size() actually fails and returns 0.
A test that tries to allocate the signature buffer using DSA_size() and then
pass it to DSA_sign() will then either.
(1) Have a signature buffer of NULL. In this case it was leaking data
returned via i2d_DSA_SIG.
(2) Cause a seg fault because we created a buffer that was not large
enough to hold the signature. As it already checked zero we also now
check for negative values also.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/20553)
afshinpir [Wed, 29 Mar 2023 22:26:44 +0000 (11:26 +1300)]
Incorrect null pointer check
CLA: trivial
There is an incorrect null pointer check and this ccommit resolves it.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/20646)
slontis [Tue, 21 Mar 2023 06:06:06 +0000 (16:06 +1000)]
Fix mem leak in ECDSA_sign().
Similiar to the issue found in PR #20553 for DSA_sign().
ECDSA_sign() leaked memory if the signature was NULL
when i2d_ECDSA_SIG was called.
Note that this does not affect the higher level EVP
functions as they correctly handle NULL.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/20554)
Samuel Lee (ENS/CRYPTO) [Wed, 29 Mar 2023 20:02:38 +0000 (13:02 -0700)]
doc: Fix typo in EVP_EncryptInit.pod
CLA: trivial
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/20645)
Michael Baentsch [Sat, 24 Dec 2022 08:20:44 +0000 (09:20 +0100)]
Provider-based KEM and SIG alg speed testing added
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/19968)
Taylor R Campbell [Wed, 29 Mar 2023 13:21:02 +0000 (13:21 +0000)]
/dev/crypto: Suppress warning when open /dev/crypto fails with ENXIO.
On NetBSD the device node is essentially always present, but these
days it's mostly not useful except for testing the kernel crypto
stack since the cost of CPU crypto has gone down much faster than the
cost of I/O to external crypto engines. So on most systems it is
disabled in a way that makes open fail with ENXIO. NetBSD has had
this warning for ENXIO patched away for years.
CLA: trivial
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20636)
Matt Caswell [Tue, 28 Mar 2023 15:25:22 +0000 (16:25 +0100)]
Add a test for an app data record appearing before epoch change in DTLS
We had a test for a handshake record appearing before epoch change, and
a test for an app data record appearing before Finished - but not one for
the app data record appearing before epoch change.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20628)
Matt Caswell [Mon, 27 Mar 2023 14:59:41 +0000 (15:59 +0100)]
Handle app data records from the next epoch
It is possible that DTLS records are received out of order such that
records from the next epoch arrive before we have finished processing the
current epoch. We are supposed to buffer such records but for some reason
we only did that for handshake and alert records. This is incorrect since
it is perfectly possible for app data records to arrive early too.
Fixes #20597
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20628)
Pauli [Tue, 28 Mar 2023 22:22:23 +0000 (09:22 +1100)]
Coverity
1524597: null pointer dereference
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20629)
Hugo Landau [Mon, 27 Mar 2023 15:03:32 +0000 (16:03 +0100)]
Use correct function to wait for condvar
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Fri, 24 Mar 2023 16:23:40 +0000 (16:23 +0000)]
Revise build.info
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Fri, 24 Mar 2023 12:03:32 +0000 (12:03 +0000)]
QUIC: Ensure locking when injecting datagrams
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Wed, 22 Mar 2023 18:46:55 +0000 (18:46 +0000)]
QUIC test fix
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Mar 2023 15:19:34 +0000 (15:19 +0000)]
QUIC Thread Assisted mode: miscellaneous fixes
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Mon, 13 Mar 2023 18:53:49 +0000 (18:53 +0000)]
Refactor build.info
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Thu, 23 Feb 2023 05:06:59 +0000 (05:06 +0000)]
QUIC Thread Assisted Mode: Refactor locking to be infallible
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Thu, 23 Feb 2023 05:02:29 +0000 (05:02 +0000)]
QUIC Thread Assisted Mode: Fix typos and use of CRYPTO_RWLOCK type
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Wed, 22 Feb 2023 19:15:16 +0000 (19:15 +0000)]
QUIC Thread Assisted Mode: Support Windows XP
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Wed, 22 Feb 2023 17:01:28 +0000 (17:01 +0000)]
Avoid races in tserver test code
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Wed, 22 Feb 2023 16:08:26 +0000 (16:08 +0000)]
Minor fixes to thread assisted mode
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Wed, 22 Feb 2023 05:55:23 +0000 (05:55 +0000)]
QUIC Thread Assisted Mode: Add design document
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:59 +0000 (10:18 +0000)]
Enhance quic_tserver test to fully test thread assisted mode
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:59 +0000 (10:18 +0000)]
QUIC CHANNEL: Fix idle timeout handling
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:59 +0000 (10:18 +0000)]
QUIC CHANNEL: Allow time source to be overridden
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:59 +0000 (10:18 +0000)]
QUIC TXP: Allow caller to determine if an ACK-eliciting packet was sent
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:59 +0000 (10:18 +0000)]
Add basic test for thread assisted mode
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:59 +0000 (10:18 +0000)]
Switch to using ossl_crypto_mutex from CRYPTO_RWLOCK
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:59 +0000 (10:18 +0000)]
Add channel-only tick mode and use it for thread assisted mode
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:59 +0000 (10:18 +0000)]
Front End for QUIC Thread Assisted Mode
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:59 +0000 (10:18 +0000)]
QUIC Thread Assist Core
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:59 +0000 (10:18 +0000)]
Fix handshake locking
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:58 +0000 (10:18 +0000)]
Add mutex to tserver
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:58 +0000 (10:18 +0000)]
Add locking to QUIC front-end
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:58 +0000 (10:18 +0000)]
Move channel mutex out of QUIC_CHANNEL for init/teardown flexibility
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:58 +0000 (10:18 +0000)]
Annotate functions needing locking
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:58 +0000 (10:18 +0000)]
QUIC Channel: Add a mutex
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:58 +0000 (10:18 +0000)]
QUIC Reactor: Allow a mutex to be released during waits
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Hugo Landau [Tue, 21 Feb 2023 10:18:58 +0000 (10:18 +0000)]
threading: Add ossl_crypto_condvar_wait_timeout
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20348)
Matt Caswell [Tue, 21 Mar 2023 16:06:58 +0000 (16:06 +0000)]
Add some documentation for the new advanced s_client command mode
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20566)
Matt Caswell [Thu, 16 Mar 2023 15:08:04 +0000 (15:08 +0000)]
Add a new advanced command mode to s_client
The s_client command mode just looks at the first letter on a line
and if it is one that maps to a "command" then that command is executed
and everything else on the line is ignored.
This means it is impossible to send anything over s_client that starts with
one of the "magic" letters unless you switch off command processing
entirely.
With the forthcoming quic support that will be added to s_client we expect
a significant new number of commands being added (for example to send fin
on a stream, or to list or swap between different streams, etc). This will
use up more "letters" and reduces the usability of s_client.
This PR adds a new "advanced" command processing mode. Commands are enclosed
in braces {}, and can appear anywhere in the text typed into s_client. A
brace can be escaped by sending a double {{. This gives much more
flexibility without reducing the usability of s_client. Commands can also
have "arguments" which also extends the scope of what they can be used for.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20566)
Michael Baentsch [Sat, 25 Mar 2023 12:06:46 +0000 (13:06 +0100)]
remove DSA512 from speed testing
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20603)
Tom Cosgrove [Mon, 27 Mar 2023 14:42:20 +0000 (15:42 +0100)]
SM4 check should be for __aarch64__, not __ARM_MAX_ARCH__ >= 8
(And then __arm__ and __arm tests are redundant)
Fixes #20604
Change-Id: I4308e75b7fbf3be7b46490c3ea4125e2d91b00b8
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20620)
Tom Cosgrove [Mon, 27 Mar 2023 21:05:13 +0000 (22:05 +0100)]
Ensure there's only one copy of OPENSSL_armcap_P in libcrypto.a
Change-Id: Ia94e528a2d55934435de6a2949784c52eb38d82f
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20621)
Michael Richardson [Sat, 19 Mar 2022 13:11:06 +0000 (09:11 -0400)]
doc: add HOWTO document about Documenting public Functions and Macros
Co-authored-by: Matthias St. Pierre <matthias.st.pierre@ncp-e.com>
Co-authored-by: Tomáš Mráz <tm@t8m.info>
Co-authored-by: Lin2Jing4 <35728132+Lin2Jing4@users.noreply.github.com>
Co-authored-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17926)
Pauli [Thu, 23 Mar 2023 22:24:23 +0000 (09:24 +1100)]
Declare FIPS option functions in their own header
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/20521)
Pauli [Sun, 19 Mar 2023 23:49:40 +0000 (10:49 +1100)]
test: test -drbg_allow_truncated_digests option
Verify that the option produces the correct output in the FIPS configuration
file and that the default is as expected.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/20521)
Pauli [Sun, 19 Mar 2023 22:46:08 +0000 (09:46 +1100)]
Let fipsinstall know about DRBG digiest limiting
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/20521)
Pauli [Fri, 17 Mar 2023 00:23:49 +0000 (11:23 +1100)]
changes: note the banning of truncated hashes with DRBGs
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/20521)
Pauli [Thu, 16 Mar 2023 03:21:25 +0000 (14:21 +1100)]
doc: note the restriction on digests used by DRBGs in FIPS mode.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/20521)
Pauli [Thu, 16 Mar 2023 03:12:09 +0000 (14:12 +1100)]
DRBG: restrict the digests that can be used with HMAC and Hash DRBGs.
According to FIP 140-3 IG D.R: https://csrc.nist.gov/CSRC/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf
Outside of FIPS, there remains no restriction other than not allowing
XOF digests.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/20521)
Pauli [Fri, 17 Mar 2023 01:42:21 +0000 (12:42 +1100)]
fips: rework the option handling code
Add option for restricting digests available to DRBGs.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/20521)
Todd Short [Wed, 27 Jan 2021 19:23:33 +0000 (14:23 -0500)]
RFC7250 (RPK) support
Add support for the RFC7250 certificate-type extensions.
Alows the use of only private keys for connection (i.e. certs not needed).
Add APIs
Add unit tests
Add documentation
Add s_client/s_server support
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18185)
Tomas Mraz [Tue, 21 Mar 2023 15:15:47 +0000 (16:15 +0100)]
Fix documentation of X509_VERIFY_PARAM_add0_policy()
The function was incorrectly documented as enabling policy checking.
Fixes: CVE-2023-0466
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20561)
Matt Caswell [Thu, 23 Mar 2023 15:31:25 +0000 (15:31 +0000)]
Updated CHANGES.md and NEWS.md for CVE-2023-0465
Also updated the entries for CVE-2023-0464
Related-to: CVE-2023-0465
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20585)
Matt Caswell [Tue, 7 Mar 2023 17:07:57 +0000 (17:07 +0000)]
Add a Certificate Policies Test
Test that a valid certificate policy is accepted and that an invalid
certificate policy is rejected. Specifically we are checking that a
leaf certificate with an invalid policy is detected.
Related-to: CVE-2023-0465
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20585)
Matt Caswell [Tue, 7 Mar 2023 16:52:55 +0000 (16:52 +0000)]
Ensure that EXFLAG_INVALID_POLICY is checked even in leaf certs
Even though we check the leaf cert to confirm it is valid, we
later ignored the invalid flag and did not notice that the leaf
cert was bad.
Fixes: CVE-2023-0465
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20585)
Matt Caswell [Tue, 7 Mar 2023 15:22:40 +0000 (15:22 +0000)]
Generate some certificates with the certificatePolicies extension
Related-to: CVE-2023-0465
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20585)
afshinpir [Wed, 22 Mar 2023 23:25:45 +0000 (12:25 +1300)]
`EVP_PKEY_CTX_dup` segmentation fault fix
CLA: trivial
The the provider, context duplication method for signature, key
exchange, asymmetric cipher, and key encapsulation is optional. But if
they are missing, we will get a segmentation fault in `EVP_PKEY_CTX_dup`
because they are called without null pointer checking.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20581)
Jorge Ramirez-Ortiz [Mon, 20 Mar 2023 11:51:55 +0000 (12:51 +0100)]
test: evp_extra: EC, read affine coordinates
Add a test to read the EC X,Y coordinates.
Support legacy keys.
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20535)
Jorge Ramirez-Ortiz [Wed, 8 Mar 2023 11:50:25 +0000 (12:50 +0100)]
translation: EC legacy keys, handle OSSL_PKEY_PARAM_EC_PUB_X,Y requests
Required by tpm2-tss to load legacy EC keys using the OpenSSL engine.
Fixes: https://github.com/tpm2-software/tpm2-tss/issues/2581
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20535)
Tomas Mraz [Tue, 21 Mar 2023 14:31:15 +0000 (15:31 +0100)]
Avoid duplication of OPENSSL_armcap_P on 32bit ARM
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20558)
Tomas Mraz [Tue, 21 Mar 2023 14:05:47 +0000 (15:05 +0100)]
Print the duplicate symbols found in test
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20558)
Dr. David von Oheimb [Fri, 16 Dec 2022 14:53:32 +0000 (15:53 +0100)]
apps/lib/http_server.c: improve diagnostics, e.g., on port number already in use
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19947)
Dr. David von Oheimb [Tue, 13 Dec 2022 16:44:27 +0000 (17:44 +0100)]
80-test_cmp_http.t: fix server port and confusion client vs. server config
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19947)
Dr. David von Oheimb [Fri, 3 Feb 2023 09:31:19 +0000 (10:31 +0100)]
CMP add: fix -reqin option, which requires adding OSSL_CMP_MSG_update_recipNonce()
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/20204)