public/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

merge into: public:openssl-3.3
Branches Tags
public:master
public:openssl-3.5
public:openssl-3.0
public:openssl-3.2
public:openssl-3.3
public:openssl-3.4
public:feature/dtls-1.3
public:openssl-3.1
public:feature/evp_skey
public:feature/hss
public:feature/ech
public:feature/acert-cli
public:OpenSSL_1_1_1-stable
public:OpenSSL_1_0_2-stable
public:OpenSSL_1_1_0-stable
public:OpenSSL-fips-2_0-stable
public:OpenSSL-fips-2_0-dev
public:tls1.3-draft-18
public:tls1.3-draft-19
public:OpenSSL_1_0_1-stable
public:OpenSSL_1_0_0-stable
public:OpenSSL_0_9_8-stable
public:OpenSSL-fips-1_2-stable
public:OpenSSL-fips-0_9_8-stable
public:OpenSSL_0_9_7-stable
public:OpenSSL_0_9_8fg-stable
public:OpenSSL-fips2-0_9_7-stable
public:OpenSSL_0_9_6-stable
public:OpenSSL-engine-0_9_6-stable
public:OpenSSL-fips-0_9_7-stable
public:SSLeay
public:openssl-3.5.0-alpha1
public:openssl-3.0.16
public:openssl-3.1.8
public:openssl-3.2.4
public:openssl-3.3.3
public:openssl-3.4.1
public:openssl-3.4.0
public:openssl-3.4.0-beta1
public:openssl-3.4.0-alpha1
public:openssl-3.0.15
public:openssl-3.1.7
public:openssl-3.2.3
public:openssl-3.3.2
public:openssl-3.0.14
public:openssl-3.1.6
public:openssl-3.2.2
public:openssl-3.3.1
public:openssl-3.3.0
public:openssl-3.3.0-beta1
public:openssl-3.3.0-alpha1
public:openssl-3.0.13
public:openssl-3.1.5
public:openssl-3.2.1
public:openssl-3.2.0
public:openssl-3.2.0-beta1
public:openssl-3.0.12
public:openssl-3.1.4
public:openssl-3.2.0-alpha2
public:openssl-3.0.11
public:openssl-3.1.3
public:OpenSSL_1_1_1w
public:openssl-3.2.0-alpha1
public:OpenSSL_1_1_1v
public:openssl-3.0.10
public:openssl-3.1.2
public:OpenSSL_1_1_1u
public:openssl-3.0.9
public:openssl-3.1.1
public:openssl-3.1.0
public:openssl-3.0.8
public:OpenSSL_1_1_1t
public:openssl-3.1.0-beta1
public:openssl-3.1.0-alpha1
public:openssl-3.0.7
public:OpenSSL_1_1_1s
public:OpenSSL_1_1_1r
public:openssl-3.0.6
public:OpenSSL_1_1_1q
public:openssl-3.0.5
public:OpenSSL_1_1_1p
public:openssl-3.0.4
public:OpenSSL_1_1_1o
public:openssl-3.0.3
public:OpenSSL_1_1_1n
public:openssl-3.0.2
public:openssl-3.0.1
public:OpenSSL_1_1_1m
public:openssl-3.0.0
public:OpenSSL_1_1_1l
public:openssl-3.0.0-beta2
public:openssl-3.0.0-beta1
public:openssl-3.0.0-alpha17
public:openssl-3.0.0-alpha16
public:openssl-3.0.0-alpha15
public:openssl-3.0.0-alpha14
public:OpenSSL_1_1_1k
public:openssl-3.0.0-alpha13
public:openssl-3.0.0-alpha12
public:OpenSSL_1_1_1j
public:openssl-3.0.0-alpha11
public:openssl-3.0.0-alpha10
public:OpenSSL_1_1_1i
public:openssl-3.0.0-alpha9
public:openssl-3.0.0-alpha8
public:openssl-3.0.0-alpha7
public:OpenSSL_1_1_1h
public:openssl-3.0.0-alpha6
public:openssl-3.0.0-alpha5
public:openssl-3.0.0-alpha4
public:openssl-3.0.0-alpha3
public:openssl-3.0.0-alpha2
public:openssl-3.0.0-alpha1
public:OpenSSL_1_1_1g
public:OpenSSL_1_1_1f
public:OpenSSL_1_1_1e
public:OpenSSL_1_0_2u
public:OpenSSL_1_0_2t
public:OpenSSL_1_1_0l
public:OpenSSL_1_1_1d
public:OpenSSL_1_1_1c
public:OpenSSL_1_1_0k
public:OpenSSL_1_0_2s
public:OpenSSL_1_0_2r
public:OpenSSL_1_1_1b
public:OpenSSL_1_0_2q
public:OpenSSL_1_1_0j
public:OpenSSL_1_1_1a
public:OpenSSL_1_1_1
public:OpenSSL_1_1_1-pre9
public:OpenSSL_1_0_2p
public:OpenSSL_1_1_0i
public:OpenSSL_1_1_1-pre8
public:OpenSSL_1_1_1-pre7
public:OpenSSL_1_1_1-pre6
public:OpenSSL_1_1_1-pre5
public:OpenSSL_1_1_1-pre4
public:OpenSSL_1_0_2o
public:OpenSSL_1_1_0h
public:OpenSSL_1_1_1-pre3
public:OpenSSL_1_1_1-pre2
public:OpenSSL_1_1_1-pre1
public:OpenSSL_1_0_2n
public:OpenSSL_1_0_2m
public:OpenSSL_1_1_0g
public:OpenSSL-fips-2_0_16
public:OpenSSL-fips-2_0_15
public:OpenSSL_1_0_2l
public:OpenSSL_1_1_0f
public:OpenSSL-fips-2_0_14
public:OpenSSL_1_1_0e
public:OpenSSL_1_0_2k
public:OpenSSL_1_1_0d
public:OpenSSL-fips-2_0_13
public:OpenSSL_1_1_0c
public:OpenSSL_1_0_2j
public:OpenSSL_1_1_0b
public:OpenSSL_1_0_1u
public:OpenSSL_1_0_2i
public:OpenSSL_1_1_0a
public:OpenSSL_1_1_0
public:OpenSSL_1_1_0-pre6
public:OpenSSL_1_0_1t
public:OpenSSL_1_0_2h
public:OpenSSL_1_1_0-pre5
public:OpenSSL_1_1_0-pre4
public:OpenSSL_1_0_1s
public:OpenSSL_1_0_2g
public:OpenSSL_1_1_0-pre3
public:OpenSSL-fips-2_0_12
public:OpenSSL-fips-2_0_11
public:OpenSSL-fips-2_0_10
public:OpenSSL_1_0_1r
public:OpenSSL_1_0_2f
public:OpenSSL_1_1_0-pre2
public:OpenSSL_1_1_0-pre1
public:OpenSSL_0_9_8zh
public:OpenSSL_1_0_0t
public:OpenSSL_1_0_1q
public:OpenSSL_1_0_2e
public:OpenSSL_1_0_1p
public:OpenSSL_1_0_2d
public:OpenSSL_1_0_1o
public:OpenSSL_1_0_2c
public:OpenSSL_0_9_8zg
public:OpenSSL_1_0_0s
public:OpenSSL_1_0_1n
public:OpenSSL_1_0_2b
public:OpenSSL-fips-2_0_9
public:OpenSSL_0_9_8zf
public:OpenSSL_1_0_0r
public:OpenSSL_1_0_1m
public:OpenSSL_1_0_2a
public:OpenSSL_0_9_8-pre-reformat
public:OpenSSL_0_9_8-pre-auto-reformat
public:OpenSSL_0_9_8-post-auto-reformat
public:OpenSSL_0_9_8-post-reformat
public:OpenSSL_1_0_0-pre-reformat
public:OpenSSL_1_0_0-pre-auto-reformat
public:OpenSSL_1_0_0-post-auto-reformat
public:OpenSSL_1_0_0-post-reformat
public:OpenSSL_1_0_1-pre-reformat
public:OpenSSL_1_0_1-pre-auto-reformat
public:OpenSSL_1_0_1-post-auto-reformat
public:OpenSSL_1_0_1-post-reformat
public:OpenSSL_1_0_2-pre-reformat
public:OpenSSL_1_0_2-pre-auto-reformat
public:OpenSSL_1_0_2-post-auto-reformat
public:OpenSSL_1_0_2-post-reformat
public:master-pre-reformat
public:master-pre-auto-reformat
public:master-post-auto-reformat
public:master-post-reformat
public:OpenSSL_1_0_2
public:OpenSSL_0_9_8ze
public:OpenSSL_1_0_0q
public:OpenSSL_1_0_1l
public:OpenSSL_0_9_8zd
public:OpenSSL_1_0_0p
public:OpenSSL_1_0_1k
public:OpenSSL-fips-2_0_8
public:OpenSSL_1_0_1j
public:OpenSSL_1_0_0o
public:OpenSSL_0_9_8zc
public:OpenSSL_1_0_2-beta3
public:OpenSSL_0_9_8zb
public:OpenSSL_1_0_0n
public:OpenSSL_1_0_1i
public:OpenSSL_1_0_2-beta2
public:OpenSSL-fips-2_0_7
public:OpenSSL_1_0_1h
public:OpenSSL_1_0_0m
public:OpenSSL_0_9_8za
public:OpenSSL-fips-2_0_6
public:OpenSSL_1_0_1g
public:OpenSSL_1_0_2-beta1
public:OpenSSL_1_0_0l
public:OpenSSL_1_0_1f
public:OpenSSL-fips-2_0_4
public:OpenSSL-fips-2_0_5
public:OpenSSL-fips-2_0_3
public:OpenSSL-fips-2_0_2
public:OpenSSL_1_0_1e
public:OpenSSL_1_0_0k
public:OpenSSL_1_0_1d
public:OpenSSL_0_9_8y
public:OpenSSL-fips-2_0-pl1
public:OpenSSL-fips-2_0_1
public:OpenSSL_1_0_1c
public:OpenSSL_1_0_0j
public:OpenSSL_0_9_8x
public:OpenSSL_1_0_1b
public:OpenSSL_0_9_8w
public:OpenSSL_1_0_1a
public:OpenSSL_0_9_8v
public:OpenSSL_1_0_0i
public:OpenSSL_1_0_1
public:OpenSSL_1_0_0h
public:OpenSSL_0_9_8u
public:OpenSSL_1_0_1-beta3
public:OpenSSL_1_0_1-beta2
public:OpenSSL-fips-2_0-rc9
public:OpenSSL-fips-2_0
public:OpenSSL_1_0_0g
public:OpenSSL_0_9_8t
public:OpenSSL_0_9_8s
public:OpenSSL_1_0_0f
public:OpenSSL-fips-2_0-rc8
public:OpenSSL_1_0_1-beta1
public:OpenSSL-fips-2_0-rc7
public:OpenSSL-fips-2_0-rc6
public:OpenSSL-fips-2_0-rc5
public:OpenSSL-fips-2_0-rc4
public:OpenSSL-fips-2_0-rc3
public:OpenSSL-fips-2_0-rc2
public:OpenSSL-fips-2_0-rc1
public:OpenSSL-fips-1_2_3
public:OpenSSL-fips-1_2_2
public:OpenSSL-fips-1_2_1
public:OpenSSL_1_0_0e
public:OpenSSL_1_0_0d
public:OpenSSL_0_9_8r
public:OpenSSL_0_9_8q
public:OpenSSL_1_0_0c
public:OpenSSL_0_9_8p
public:OpenSSL_1_0_0b
public:OpenSSL_0_9_8o
public:OpenSSL_1_0_0a
public:OpenSSL_1_0_0
public:OpenSSL_0_9_8n
public:OpenSSL_0_9_8m
public:OpenSSL_0_9_8m-beta1
public:OpenSSL_1_0_0-beta5
public:OpenSSL_1_0_0-beta4
public:OpenSSL_0_9_8l
public:OpenSSL_1_0_0-beta3
public:OpenSSL_1_0_0-beta2
public:OpenSSL_1_0_0-beta1
public:OpenSSL_0_9_8k
public:OpenSSL_0_9_8j
public:OpenSSL_0_9_8i
public:OpenSSL_0_9_8h
public:OpenSSL_0_9_8g
public:OpenSSL_0_9_8f
public:OpenSSL-fips-1_2_0
public:FIPS_098_TEST_8
public:FIPS_098_TEST_7
public:FIPS_098_TEST_6
public:FIPS_098_TEST_5
public:FIPS_098_TEST_4
public:FIPS_098_TEST_3
public:FIPS_098_TEST_2
public:FIPS_098_TEST_1
public:OpenSSL_0_9_7m
public:OpenSSL_0_9_8e
public:OpenSSL_0_9_7l
public:OpenSSL_0_9_8d
public:OpenSSL_0_9_8c
public:OpenSSL_0_9_7k
public:OpenSSL_0_9_7j
public:OpenSSL_0_9_8b
public:OpenSSL_FIPS_1_0
public:OpenSSL_0_9_7i
public:OpenSSL_0_9_8a
public:OpenSSL_0_9_7h
public:OpenSSL_0_9_8
public:FIPS_TEST_10
public:OpenSSL_0_9_8-beta6
public:OpenSSL_0_9_8-beta5
public:FIPS_TEST_9
public:OpenSSL_0_9_8-beta4
public:OpenSSL_0_9_8-beta3
public:BEN_FIPS_TEST_8
public:OpenSSL_0_9_8-beta2
public:OpenSSL_0_9_8-beta1
public:OpenSSL_0_9_7g
public:OpenSSL_0_9_7f
public:BEN_FIPS_TEST_7
public:BEN_FIPS_TEST_6
public:OpenSSL_0_9_7e
public:OpenSSL_0_9_7d
public:OpenSSL-engine-0_9_6m
public:OpenSSL_0_9_6m
public:LEVITTE_after_const
public:LEVITTE_before_const
public:BEN_FIPS_TEST_5
public:BEN_FIPS_TEST_4
public:OpenSSL-engine-0_9_6l
public:OpenSSL_0_9_6l
public:BEN_FIPS_TEST_3
public:BEN_FIPS_TEST_2
public:BEN_FIPS_TEST_1
public:OpenSSL-engine-0_9_6k
public:OpenSSL_0_9_6k
public:OpenSSL_0_9_7c
public:OpenSSL-engine-0_9_6j
public:OpenSSL_0_9_7b
public:OpenSSL_0_9_6j
public:OpenSSL-engine-0_9_6i
public:OpenSSL_0_9_6i
public:OpenSSL_0_9_7a
public:OpenSSL_0_9_7
public:OpenSSL_0_9_7-beta6
public:STATE_after_zlib
public:STATE_before_zlib
public:OpenSSL_0_9_7-beta5
public:OpenSSL-engine-0_9_6h
public:OpenSSL_0_9_6h
public:OpenSSL_0_9_7-beta4
public:OpenSSL-engine-0_9_6g
public:OpenSSL_0_9_6g
public:OpenSSL-engine-0_9_6f
public:OpenSSL_0_9_6f
public:OpenSSL_0_9_7-beta3
public:OpenSSL-engine-0_9_6e
public:OpenSSL_0_9_6e
public:OpenSSL_0_9_7-beta2
public:OpenSSL_0_9_7-beta1
public:AFTER_COMPAQ_PATCH
public:BEFORE_COMPAQ_PATCH
public:OpenSSL-engine-0_9_6d
public:OpenSSL_0_9_6d
public:OpenSSL-engine-0_9_6d-beta1
public:OpenSSL_0_9_6d-beta1
public:OpenSSL-engine-0_9_6c
public:OpenSSL_0_9_6c
public:OpenSSL-engine-0_9_6b
public:OpenSSL_0_9_6b
public:OpenSSL_0_9_6a
public:OpenSSL-engine-0_9_6a
public:OpenSSL-engine-0_9_6a-beta3
public:OpenSSL_0_9_6a-beta3
public:OpenSSL-engine-0_9_6a-beta2
public:OpenSSL_0_9_6a-beta2
public:OpenSSL-engine-0_9_6a-beta1
public:OpenSSL_0_9_6a-beta1
public:rsaref
public:BEFORE_engine
public:OpenSSL_0_9_6-beta2
public:OpenSSL_0_9_6-beta1
public:OpenSSL_0_9_6
public:OpenSSL-engine-0_9_6
public:OpenSSL-engine-0_9_6-beta3
public:OpenSSL_0_9_6-beta3
public:OpenSSL-engine-0_9_6-beta2
public:OpenSSL-engine-0_9_6-beta1
public:OpenSSL_0_9_5
public:OpenSSL_0_9_5a
public:OpenSSL_0_9_5a-beta2
public:OpenSSL_0_9_5a-beta1
public:OpenSSL_0_9_5beta2
public:OpenSSL_0_9_5beta1
public:OpenSSL_0_9_4
public:OpenSSL_0_9_3a
public:OpenSSL_0_9_3
public:OpenSSL_0_9_3beta2
public:OpenSSL_0_9_3beta1
public:OpenSSL_0_9_2b
public:OpenSSL_0_9_1c
public:SSLeay_0_9_1b
public:SSLeay_0_9_0b
public:SSLeay_0_8_1b
...
pull from: public:master
Branches Tags
public:openssl-3.5
public:master
public:openssl-3.0
public:openssl-3.2
public:openssl-3.3
public:openssl-3.4
public:feature/dtls-1.3
public:openssl-3.1
public:feature/evp_skey
public:feature/hss
public:feature/ech
public:feature/acert-cli
public:OpenSSL_1_1_1-stable
public:OpenSSL_1_0_2-stable
public:OpenSSL_1_1_0-stable
public:OpenSSL-fips-2_0-stable
public:OpenSSL-fips-2_0-dev
public:tls1.3-draft-18
public:tls1.3-draft-19
public:OpenSSL_1_0_1-stable
public:OpenSSL_1_0_0-stable
public:OpenSSL_0_9_8-stable
public:OpenSSL-fips-1_2-stable
public:OpenSSL-fips-0_9_8-stable
public:OpenSSL_0_9_7-stable
public:OpenSSL_0_9_8fg-stable
public:OpenSSL-fips2-0_9_7-stable
public:OpenSSL_0_9_6-stable
public:OpenSSL-engine-0_9_6-stable
public:OpenSSL-fips-0_9_7-stable
public:SSLeay
public:openssl-3.5.0-alpha1
public:openssl-3.0.16
public:openssl-3.1.8
public:openssl-3.2.4
public:openssl-3.3.3
public:openssl-3.4.1
public:openssl-3.4.0
public:openssl-3.4.0-beta1
public:openssl-3.4.0-alpha1
public:openssl-3.0.15
public:openssl-3.1.7
public:openssl-3.2.3
public:openssl-3.3.2
public:openssl-3.0.14
public:openssl-3.1.6
public:openssl-3.2.2
public:openssl-3.3.1
public:openssl-3.3.0
public:openssl-3.3.0-beta1
public:openssl-3.3.0-alpha1
public:openssl-3.0.13
public:openssl-3.1.5
public:openssl-3.2.1
public:openssl-3.2.0
public:openssl-3.2.0-beta1
public:openssl-3.0.12
public:openssl-3.1.4
public:openssl-3.2.0-alpha2
public:openssl-3.0.11
public:openssl-3.1.3
public:OpenSSL_1_1_1w
public:openssl-3.2.0-alpha1
public:OpenSSL_1_1_1v
public:openssl-3.0.10
public:openssl-3.1.2
public:OpenSSL_1_1_1u
public:openssl-3.0.9
public:openssl-3.1.1
public:openssl-3.1.0
public:openssl-3.0.8
public:OpenSSL_1_1_1t
public:openssl-3.1.0-beta1
public:openssl-3.1.0-alpha1
public:openssl-3.0.7
public:OpenSSL_1_1_1s
public:OpenSSL_1_1_1r
public:openssl-3.0.6
public:OpenSSL_1_1_1q
public:openssl-3.0.5
public:OpenSSL_1_1_1p
public:openssl-3.0.4
public:OpenSSL_1_1_1o
public:openssl-3.0.3
public:OpenSSL_1_1_1n
public:openssl-3.0.2
public:openssl-3.0.1
public:OpenSSL_1_1_1m
public:openssl-3.0.0
public:OpenSSL_1_1_1l
public:openssl-3.0.0-beta2
public:openssl-3.0.0-beta1
public:openssl-3.0.0-alpha17
public:openssl-3.0.0-alpha16
public:openssl-3.0.0-alpha15
public:openssl-3.0.0-alpha14
public:OpenSSL_1_1_1k
public:openssl-3.0.0-alpha13
public:openssl-3.0.0-alpha12
public:OpenSSL_1_1_1j
public:openssl-3.0.0-alpha11
public:openssl-3.0.0-alpha10
public:OpenSSL_1_1_1i
public:openssl-3.0.0-alpha9
public:openssl-3.0.0-alpha8
public:openssl-3.0.0-alpha7
public:OpenSSL_1_1_1h
public:openssl-3.0.0-alpha6
public:openssl-3.0.0-alpha5
public:openssl-3.0.0-alpha4
public:openssl-3.0.0-alpha3
public:openssl-3.0.0-alpha2
public:openssl-3.0.0-alpha1
public:OpenSSL_1_1_1g
public:OpenSSL_1_1_1f
public:OpenSSL_1_1_1e
public:OpenSSL_1_0_2u
public:OpenSSL_1_0_2t
public:OpenSSL_1_1_0l
public:OpenSSL_1_1_1d
public:OpenSSL_1_1_1c
public:OpenSSL_1_1_0k
public:OpenSSL_1_0_2s
public:OpenSSL_1_0_2r
public:OpenSSL_1_1_1b
public:OpenSSL_1_0_2q
public:OpenSSL_1_1_0j
public:OpenSSL_1_1_1a
public:OpenSSL_1_1_1
public:OpenSSL_1_1_1-pre9
public:OpenSSL_1_0_2p
public:OpenSSL_1_1_0i
public:OpenSSL_1_1_1-pre8
public:OpenSSL_1_1_1-pre7
public:OpenSSL_1_1_1-pre6
public:OpenSSL_1_1_1-pre5
public:OpenSSL_1_1_1-pre4
public:OpenSSL_1_0_2o
public:OpenSSL_1_1_0h
public:OpenSSL_1_1_1-pre3
public:OpenSSL_1_1_1-pre2
public:OpenSSL_1_1_1-pre1
public:OpenSSL_1_0_2n
public:OpenSSL_1_0_2m
public:OpenSSL_1_1_0g
public:OpenSSL-fips-2_0_16
public:OpenSSL-fips-2_0_15
public:OpenSSL_1_0_2l
public:OpenSSL_1_1_0f
public:OpenSSL-fips-2_0_14
public:OpenSSL_1_1_0e
public:OpenSSL_1_0_2k
public:OpenSSL_1_1_0d
public:OpenSSL-fips-2_0_13
public:OpenSSL_1_1_0c
public:OpenSSL_1_0_2j
public:OpenSSL_1_1_0b
public:OpenSSL_1_0_1u
public:OpenSSL_1_0_2i
public:OpenSSL_1_1_0a
public:OpenSSL_1_1_0
public:OpenSSL_1_1_0-pre6
public:OpenSSL_1_0_1t
public:OpenSSL_1_0_2h
public:OpenSSL_1_1_0-pre5
public:OpenSSL_1_1_0-pre4
public:OpenSSL_1_0_1s
public:OpenSSL_1_0_2g
public:OpenSSL_1_1_0-pre3
public:OpenSSL-fips-2_0_12
public:OpenSSL-fips-2_0_11
public:OpenSSL-fips-2_0_10
public:OpenSSL_1_0_1r
public:OpenSSL_1_0_2f
public:OpenSSL_1_1_0-pre2
public:OpenSSL_1_1_0-pre1
public:OpenSSL_0_9_8zh
public:OpenSSL_1_0_0t
public:OpenSSL_1_0_1q
public:OpenSSL_1_0_2e
public:OpenSSL_1_0_1p
public:OpenSSL_1_0_2d
public:OpenSSL_1_0_1o
public:OpenSSL_1_0_2c
public:OpenSSL_0_9_8zg
public:OpenSSL_1_0_0s
public:OpenSSL_1_0_1n
public:OpenSSL_1_0_2b
public:OpenSSL-fips-2_0_9
public:OpenSSL_0_9_8zf
public:OpenSSL_1_0_0r
public:OpenSSL_1_0_1m
public:OpenSSL_1_0_2a
public:OpenSSL_0_9_8-pre-reformat
public:OpenSSL_0_9_8-pre-auto-reformat
public:OpenSSL_0_9_8-post-auto-reformat
public:OpenSSL_0_9_8-post-reformat
public:OpenSSL_1_0_0-pre-reformat
public:OpenSSL_1_0_0-pre-auto-reformat
public:OpenSSL_1_0_0-post-auto-reformat
public:OpenSSL_1_0_0-post-reformat
public:OpenSSL_1_0_1-pre-reformat
public:OpenSSL_1_0_1-pre-auto-reformat
public:OpenSSL_1_0_1-post-auto-reformat
public:OpenSSL_1_0_1-post-reformat
public:OpenSSL_1_0_2-pre-reformat
public:OpenSSL_1_0_2-pre-auto-reformat
public:OpenSSL_1_0_2-post-auto-reformat
public:OpenSSL_1_0_2-post-reformat
public:master-pre-reformat
public:master-pre-auto-reformat
public:master-post-auto-reformat
public:master-post-reformat
public:OpenSSL_1_0_2
public:OpenSSL_0_9_8ze
public:OpenSSL_1_0_0q
public:OpenSSL_1_0_1l
public:OpenSSL_0_9_8zd
public:OpenSSL_1_0_0p
public:OpenSSL_1_0_1k
public:OpenSSL-fips-2_0_8
public:OpenSSL_1_0_1j
public:OpenSSL_1_0_0o
public:OpenSSL_0_9_8zc
public:OpenSSL_1_0_2-beta3
public:OpenSSL_0_9_8zb
public:OpenSSL_1_0_0n
public:OpenSSL_1_0_1i
public:OpenSSL_1_0_2-beta2
public:OpenSSL-fips-2_0_7
public:OpenSSL_1_0_1h
public:OpenSSL_1_0_0m
public:OpenSSL_0_9_8za
public:OpenSSL-fips-2_0_6
public:OpenSSL_1_0_1g
public:OpenSSL_1_0_2-beta1
public:OpenSSL_1_0_0l
public:OpenSSL_1_0_1f
public:OpenSSL-fips-2_0_4
public:OpenSSL-fips-2_0_5
public:OpenSSL-fips-2_0_3
public:OpenSSL-fips-2_0_2
public:OpenSSL_1_0_1e
public:OpenSSL_1_0_0k
public:OpenSSL_1_0_1d
public:OpenSSL_0_9_8y
public:OpenSSL-fips-2_0-pl1
public:OpenSSL-fips-2_0_1
public:OpenSSL_1_0_1c
public:OpenSSL_1_0_0j
public:OpenSSL_0_9_8x
public:OpenSSL_1_0_1b
public:OpenSSL_0_9_8w
public:OpenSSL_1_0_1a
public:OpenSSL_0_9_8v
public:OpenSSL_1_0_0i
public:OpenSSL_1_0_1
public:OpenSSL_1_0_0h
public:OpenSSL_0_9_8u
public:OpenSSL_1_0_1-beta3
public:OpenSSL_1_0_1-beta2
public:OpenSSL-fips-2_0-rc9
public:OpenSSL-fips-2_0
public:OpenSSL_1_0_0g
public:OpenSSL_0_9_8t
public:OpenSSL_0_9_8s
public:OpenSSL_1_0_0f
public:OpenSSL-fips-2_0-rc8
public:OpenSSL_1_0_1-beta1
public:OpenSSL-fips-2_0-rc7
public:OpenSSL-fips-2_0-rc6
public:OpenSSL-fips-2_0-rc5
public:OpenSSL-fips-2_0-rc4
public:OpenSSL-fips-2_0-rc3
public:OpenSSL-fips-2_0-rc2
public:OpenSSL-fips-2_0-rc1
public:OpenSSL-fips-1_2_3
public:OpenSSL-fips-1_2_2
public:OpenSSL-fips-1_2_1
public:OpenSSL_1_0_0e
public:OpenSSL_1_0_0d
public:OpenSSL_0_9_8r
public:OpenSSL_0_9_8q
public:OpenSSL_1_0_0c
public:OpenSSL_0_9_8p
public:OpenSSL_1_0_0b
public:OpenSSL_0_9_8o
public:OpenSSL_1_0_0a
public:OpenSSL_1_0_0
public:OpenSSL_0_9_8n
public:OpenSSL_0_9_8m
public:OpenSSL_0_9_8m-beta1
public:OpenSSL_1_0_0-beta5
public:OpenSSL_1_0_0-beta4
public:OpenSSL_0_9_8l
public:OpenSSL_1_0_0-beta3
public:OpenSSL_1_0_0-beta2
public:OpenSSL_1_0_0-beta1
public:OpenSSL_0_9_8k
public:OpenSSL_0_9_8j
public:OpenSSL_0_9_8i
public:OpenSSL_0_9_8h
public:OpenSSL_0_9_8g
public:OpenSSL_0_9_8f
public:OpenSSL-fips-1_2_0
public:FIPS_098_TEST_8
public:FIPS_098_TEST_7
public:FIPS_098_TEST_6
public:FIPS_098_TEST_5
public:FIPS_098_TEST_4
public:FIPS_098_TEST_3
public:FIPS_098_TEST_2
public:FIPS_098_TEST_1
public:OpenSSL_0_9_7m
public:OpenSSL_0_9_8e
public:OpenSSL_0_9_7l
public:OpenSSL_0_9_8d
public:OpenSSL_0_9_8c
public:OpenSSL_0_9_7k
public:OpenSSL_0_9_7j
public:OpenSSL_0_9_8b
public:OpenSSL_FIPS_1_0
public:OpenSSL_0_9_7i
public:OpenSSL_0_9_8a
public:OpenSSL_0_9_7h
public:OpenSSL_0_9_8
public:FIPS_TEST_10
public:OpenSSL_0_9_8-beta6
public:OpenSSL_0_9_8-beta5
public:FIPS_TEST_9
public:OpenSSL_0_9_8-beta4
public:OpenSSL_0_9_8-beta3
public:BEN_FIPS_TEST_8
public:OpenSSL_0_9_8-beta2
public:OpenSSL_0_9_8-beta1
public:OpenSSL_0_9_7g
public:OpenSSL_0_9_7f
public:BEN_FIPS_TEST_7
public:BEN_FIPS_TEST_6
public:OpenSSL_0_9_7e
public:OpenSSL_0_9_7d
public:OpenSSL-engine-0_9_6m
public:OpenSSL_0_9_6m
public:LEVITTE_after_const
public:LEVITTE_before_const
public:BEN_FIPS_TEST_5
public:BEN_FIPS_TEST_4
public:OpenSSL-engine-0_9_6l
public:OpenSSL_0_9_6l
public:BEN_FIPS_TEST_3
public:BEN_FIPS_TEST_2
public:BEN_FIPS_TEST_1
public:OpenSSL-engine-0_9_6k
public:OpenSSL_0_9_6k
public:OpenSSL_0_9_7c
public:OpenSSL-engine-0_9_6j
public:OpenSSL_0_9_7b
public:OpenSSL_0_9_6j
public:OpenSSL-engine-0_9_6i
public:OpenSSL_0_9_6i
public:OpenSSL_0_9_7a
public:OpenSSL_0_9_7
public:OpenSSL_0_9_7-beta6
public:STATE_after_zlib
public:STATE_before_zlib
public:OpenSSL_0_9_7-beta5
public:OpenSSL-engine-0_9_6h
public:OpenSSL_0_9_6h
public:OpenSSL_0_9_7-beta4
public:OpenSSL-engine-0_9_6g
public:OpenSSL_0_9_6g
public:OpenSSL-engine-0_9_6f
public:OpenSSL_0_9_6f
public:OpenSSL_0_9_7-beta3
public:OpenSSL-engine-0_9_6e
public:OpenSSL_0_9_6e
public:OpenSSL_0_9_7-beta2
public:OpenSSL_0_9_7-beta1
public:AFTER_COMPAQ_PATCH
public:BEFORE_COMPAQ_PATCH
public:OpenSSL-engine-0_9_6d
public:OpenSSL_0_9_6d
public:OpenSSL-engine-0_9_6d-beta1
public:OpenSSL_0_9_6d-beta1
public:OpenSSL-engine-0_9_6c
public:OpenSSL_0_9_6c
public:OpenSSL-engine-0_9_6b
public:OpenSSL_0_9_6b
public:OpenSSL_0_9_6a
public:OpenSSL-engine-0_9_6a
public:OpenSSL-engine-0_9_6a-beta3
public:OpenSSL_0_9_6a-beta3
public:OpenSSL-engine-0_9_6a-beta2
public:OpenSSL_0_9_6a-beta2
public:OpenSSL-engine-0_9_6a-beta1
public:OpenSSL_0_9_6a-beta1
public:rsaref
public:BEFORE_engine
public:OpenSSL_0_9_6-beta2
public:OpenSSL_0_9_6-beta1
public:OpenSSL_0_9_6
public:OpenSSL-engine-0_9_6
public:OpenSSL-engine-0_9_6-beta3
public:OpenSSL_0_9_6-beta3
public:OpenSSL-engine-0_9_6-beta2
public:OpenSSL-engine-0_9_6-beta1
public:OpenSSL_0_9_5
public:OpenSSL_0_9_5a
public:OpenSSL_0_9_5a-beta2
public:OpenSSL_0_9_5a-beta1
public:OpenSSL_0_9_5beta2
public:OpenSSL_0_9_5beta1
public:OpenSSL_0_9_4
public:OpenSSL_0_9_3a
public:OpenSSL_0_9_3
public:OpenSSL_0_9_3beta2
public:OpenSSL_0_9_3beta1
public:OpenSSL_0_9_2b
public:OpenSSL_0_9_1c
public:SSLeay_0_9_1b
public:SSLeay_0_9_0b
public:SSLeay_0_8_1b
Sign in to create a new pull request.

2030 commits
openssl-3. ... master

Author SHA1 Message Date
Matt Caswell
95051052b3 Move the Handshake read secret change earlier in the process for QUIC 0-RTT 
On the server side we were changing the handshake rx secret a little late.
This meant the application was forced to call SSL_do_handshake() again
even if there was nothing to read in order to get the secret. We move it
a little earlier int the process to avoid this.

Fixes the issue described in:
https://github.com/ngtcp2/ngtcp2/pull/1582#issuecomment-2735950083

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27101)
 2025-03-20 20:22:39 +01:00
Daniel Van Geest
c1d27789e9 Fix use of SHAKE as a digest in CMS 
draft-ietf-lamps-cms-sphincs-plus-19 specifies SHAKE as
the message digest algorithm for SLH-DSA-SHAKE-* in CMS.
SHAKE doesn't have a default digest length, so this adds
a SHAKE-specific kludge in CMS.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27087)
 2025-03-20 12:20:37 +01:00
Viktor Dukhovni
27b88364e4 Avoid erroneous legacy code path when provided 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27075)
 2025-03-20 11:33:23 +01:00
Ankit Kekre
952d9b83b2 apps/cms.c, apps/ocsp.c: Added NULL pointer checks 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27059)
 2025-03-20 11:30:57 +01:00
Matt Caswell
207cd5bb97 Fix the use of CCM ciphersuites with QUIC TLS API 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
366b2643cb Add a test for using CCM ciphersuites with QUIC TLS API 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
228a26fde4 Always use NULL BIOs when using the QUIC TLS API 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
445c0942cd Test that using the QUIC TLS API does not require BIOs to be set 
When using the QUIC TLS API it does not make sense to require BIOs to be
set.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
2100cf2ee0 Ensure SSL_get_app_data() continues to work even in SSL_free() 
During SSL_free() we may get a QUIC TLS callback being called to clean up
any remaining record data. We should ensure that SSL_get_app_data()
continues to work, even in this scenario.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
4ad45969b0 Don't decrement the unreleased counter if we failed to release a record 
In a failure situation we may incorrectly decrement the amount of data
released. Only decrement the counter if we successfully released.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
f2488a567b Check SSL_get_app_data() from QUIC cb in a failure situation 
Ensure SSL_get_app_data() works even in a failure situation from SSL_free()

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Matt Caswell
2ebae654d5 Add a test for calling SSL_get_app_data() from QUIC TLS callbacks 
Check that we get the expected app data when using the QUIC TLS callbacks.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27091)
 2025-03-20 11:24:26 +01:00
Bernd Edlinger
c658a60aae Remove workaround for an old ppc64le compiler bug 
Lowering the optimization level is no longer needed,
since the old compiler bug from ubuntu-20.04 has been
fixed meanwhile.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27033)
 2025-03-20 11:17:29 +01:00
Dmitry Misharov
1bf328edf9 correctly mark the release as prerelease 
release must be marked as prerelease if "alpha" or "beta" is in tag name

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27092)
 2025-03-20 11:15:16 +01:00
Viktor Dukhovni
064bb16454 Tolerate PKCS#8 V2 with optional public keys 
- Presently any included public key is unused.
- We don't check that v1 PKCS#8 structures omit the public key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27076)
 2025-03-19 12:02:31 +01:00
Jon Spillett
58d548d84e Use text compare for PEM and text files 
- Fix ml_dsa_codecs test
- Fix ml_kem_codecs test
- Fix pkey test
- Fix dsaparam test
- Fix dhparam test
- Fix pkcs8 test

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27082)
 2025-03-19 11:48:49 +01:00
Ingo Franzki
05c05d43bf Doc fix in EVP_PKEY-ML-DSA/KEM.pod files 
Fix the references to OSSL_PROVIDER_add_conf_parameter in the 'SEE ALSO'
section.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27077)
 2025-03-19 11:47:07 +01:00
Martin Oliveira
482d3f9338 Fix gettable_params() for ECX 
The OSSL_PKEY_PARAM_MANDATORY_DIGEST parameter is only handled by the
ed25519_get_params() and ed448_get_params(). The x25519 and x448
versions of get_params() always ignore that parameter, so it should not
be in the list of gettable params.

Fixes: 1a7328c882 ("PROV: Ensure that ED25519 & ED448 keys have a mandatory digest")

cla: trivial

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27043)
 2025-03-19 10:43:26 +01:00
ak4153
978e23a472 Fix missing OSSL_FUNC_DIGEST_GET_PARAMS in provider-digest.pod 
Fixes #26626
CLA: trivial

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27009)
 2025-03-19 10:41:34 +01:00
sashan
108079fcbb require GNU assembler 2.30 or higher to build aesni-xtx-avx512.pl 
The peralsm in aesni-xts-avx512 currently checks for GNU assembler 2.26
or higher. According to reporters it looks like we need 2.30.

This PR just attempts fix version check so people with older
tool chains can  build OpenSSL.

Fixes #27049

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27078)
 2025-03-19 08:03:50 +11:00
Nicola Tuveri
2d50cb660c docs(provider-base): Add HISTORY note for OSSL_CAPABILITY_TLS_SIGALG_MIN_DTLS (and MAX) 
This commit adds a small note about
definitions for
`OSSL_CAPABILITY_TLS_SIGALG_MIN_DTLS` and
`OSSL_CAPABILITY_TLS_SIGALG_MAX_DTLS`
being first added in OpenSSL 3.5.

PR #26975 added these definitions for OpenSSL 3.5, but the documentation
update omitted a history note for the addition.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27063)
 2025-03-18 18:58:55 +01:00
Bernd Edlinger
a532f2302d Do some more cleanup in the RCU code 
Only a minimum of 2 qp's are necessary: one for the readers,
and at least one that writers can wait on for retirement.
There is no need for one additional qp that is always unused.
Also only one ACQUIRE barrier is necessary in get_hold_current_qp,
so the ATOMIC_LOAD of the reader_idx can be changed to RELAXED.
And finally clarify some comments.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27012)
 2025-03-18 18:52:29 +01:00
Bernd Edlinger
4a1a7fe5ce Fix a memory order issue with weakly ordered systems 
this adds a dummy atomic release operation to update_qp, which
should make sure that the new value of reader_idx is visible in
get_hold_current_qp, directly after incrementing the users count.

Fixes: #26875

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26964)
 2025-03-17 08:01:26 -04:00
Neil Horman
5db7b99914 Fix interop ci yaml 
Somehow I mistakenly listed clients in the exlude list, when it should
have been servers, resulting in an invalid yml file

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/27066)
 2025-03-14 16:08:04 -04:00
Danny Tsen
85cabd9495 Fix Minerva timing side-channel signal for P-384 curve on PPC 
1. bn_ppc.c: Used bn_mul_mont_int() instead of bn_mul_mont_300_fixed_n6()
   for Montgomery multiplication.
2. ecp_nistp384-ppc64.pl:
   - Re-wrote p384_felem_mul and p384_felem_square for easier maintenance with
     minumum perl wrapper.
   - Implemented p384_felem_reduce, p384_felem_mul_reduce and p384_felem_square_reduce.
   - Implemented p384_felem_diff64, felem_diff_128_64 and felem_diff128 in assembly.
3. ecp_nistp384.c:
   - Added wrapper function for p384_felem_mul_reduce and p384_felem_square_reduce.

Signed-off-by: Danny Tsen <dtsen@us.ibm.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26709)
 2025-03-14 17:20:52 +01:00
Randall S. Becker
ff030ad5bd Wrap use of poll.h to prevent including on NonStop. 
Fixes: #26724

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26726)
 2025-03-14 07:40:40 -04:00
Tomas Mraz
c8654f79f4 Keep the provided peer EVP_PKEY in the EVP_PKEY_CTX too 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26976)
 2025-03-14 09:44:52 +01:00
Andrew Dinh
7097d2e00e Fix RCU TODOs 
- Update allocate_new_qp_group to take unsigned int
- Move id_ctr in rcu_lock_st for better stack alignment

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26972)
 2025-03-12 12:07:44 -04:00
Neil Horman
2fb4cfe143 Exclude retry test with msquic server from interop 
With the addition of larger ml-kem keys in our tls handshake, we've
uncovered a interop failure, as described here:
https://github.com/microsoft/msquic/issues/4905

In short, when we send a client hello that spans multiple datagrams, the
servers sends an ACK frame in a datagram prior to sending its server
hello.  msquic however, recomputes a new SCID always when sending its
sserver hello, which is fine nominally, but because in this test the
server sends a retry frame to update the SCID, followed by an ACK using
that SCID (which is an initial packet), msquic violates the RFC in
section 7.2 which states:

Once a client has received a valid Initial packet from the server, it MUST
discard any subsequent packet it receives on that connection with a
different Source Connection ID

Because msquic sent an initial packet with that ACK frame, we are
required to discard subsequent frames on the connection containing a
different SCID.

Until msquic fixes that in their implementation we are going to fail the
retry interop test, so for now, lets exclude the test.

Also, while we're at it, re-add chrome into the client list for our
server tests, as that seems to have been lost during the merge.

Fixes openssl/project#1132

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27014)
 2025-03-12 10:28:04 -04:00
openssl-machine
b2762763e9 Prepare for 3.6 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
 2025-03-12 13:37:30 +00:00
openssl-machine
2a3fce2274 make update 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
 2025-03-12 13:37:18 +00:00
openssl-machine
0c679f5566 Copyright year updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
 2025-03-12 13:35:59 +00:00
Neil Horman
2df40ea6ff Adding missed items to NEWS.md prior to release 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27026)
 2025-03-11 09:21:45 -04:00
Michael Schroeder
cad3520bf7 Add support for md-less signature schemes in CMS 
Signature schemes like Ed25519 or ML-DSA use "pure" signing,
i.e. they directly sign the tbs data instead of signing a digest.

This is already supported in the X509 code, but not in CMS.
This commit adds support for such schemes to CMS.

This is a minimalistic set of changes, based in the work done
by David von Oheimb.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26867)
 2025-03-10 14:36:15 +01:00
Viktor Dukhovni
91c6e157c6 Make group names case-insensitive 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26991)
 2025-03-09 23:31:25 +01:00
Viktor Dukhovni
bcff020c36 Refactor sigalg handling 
- The default sigalg list now puts ML-DSA-65 first, then ML-DSA-87
  and then ML-DSA-44.  (87 vs. 44 Subject to bikeshedding).

- The mintls and maxtls versions are now taken into account for
  both built-in and provided algorithms.

- Some algorithms have a separate TLSv1.2-specific name for future
  reporting via openssl-list(1).

- ML-DSA aside, any new provided algorithms go at the end of the
  default list (backwards-compatible inclusion).

- The built-in algorithms now also have min/max DTLS versions.
  Though the provider TLS-SIGALG capability was extended to also report
  the DTLS version range, the minimum supported DTLS is 1.3, which we
  don't yet have, so it is not yet possible to add DTLS sigalgs via a
  provider

- The TLS 1.3 brainpool sigalgs got their correct IANA names, with
  the legacy names as purported TLS 1.2 alternatives, but since
  these are for TLS 1.3 and up those names are for matching only,
  the reported value will still be the 1.3 name.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26975)
 2025-03-09 23:19:37 +01:00
Neil Horman
9a308a89a4 Orphan packets from qrx 
It may occur that the qrx we allocate in port_default_packet handler to
do AEAD validation isn't the one the channel ultimately uses (like if we
turn off address validation).  In that event, we need to ensure that
anything we have on that qrx isn't returned to its free list to avoid
early freeing when we free the qrx at the end of
port_default_packet_handler, while those frames are still pending on the
channel qrx

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27004)
 2025-03-09 18:44:53 +01:00
Neil Horman
0cfbeba8ed Fix a few erroneous double frees in quic-hq-interop 
Uncovered during testing for openssl/project#1130

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27004)
 2025-03-09 18:44:53 +01:00
Neil Horman
8f74d8cee3 If our server channel creates its own qrx, set its initial secret 
With the addition of larger client hellos, stemming from the use of
larger PQC key shares, it may happen that we get a client hello accross
multiple datagrams. Normally this is not a problem as
port_default_packet_handler allocates a qrx and initializes its initial
secret immediately.  But if server address validation is disabled, then
the channel creates the qrx in port_bind_channel itself, without initial
secrets.  As a result, we validate the first datagram in
port_default_packet_handler, but the subsequent datagrams containing the
remaining client hello fragments fail decode.

Fix it by ensuring that we add the initial secret in port_bind_channel
if we don't give it a preconfigured qrx

Fixes openssl/project#1131

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27006)
 2025-03-07 21:56:34 -05:00
RSA-1977
8d6fd6142b Updated SSL_SESSION_get0_hostname() documentation to be consistent with the function 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26559)
 2025-03-05 19:12:45 +01:00
Neil Horman
c0251d7b0f Fix build on windows xp 
Windows XP doesn't support setting socket handles to be non-inheritable,
but the rio_notifier attempts to do so. WSASocketA will there return
an error when the NO_INHERIT flag is set. In that case, just retry the
call without the flag.

Fixes #26943

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26970)
 2025-03-05 17:36:20 +01:00
Bernd Edlinger
6e7be995fd RCU: Ensure that qp's are actually retired in order 
The current retirement code for rcu qp's has a race condition,
which can cause use-after-free errors, but only if more than
3 QPs are allocated, which is not the default configuration.

This fixes an oversight in commit 5949918f9a ("Rework and
simplify RCU code")

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26952)
 2025-03-05 16:04:16 +01:00
Bernd Edlinger
bcb8eae1af Fix support for windows atomics 
Make CRYPTO_atomic_add consistent with
CRYPTO_atomic_load_int and set the
reader_idx under write_lock since there
is no CRYPTO_atomic_store_int.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26963)
 2025-03-05 16:02:47 +01:00
Andrew Dinh
b48145cd18 QUIC server post-rebase nits 
- Apply doc nits suggested by Viktor from https://github.com/openssl/openssl/pull/26762
- Update CHANGES.md & NEWS.md saying there is now support for QUIC server
- Added copyright header in: test/radix/quic_ops.c

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26944)
 2025-03-05 15:02:17 +01:00
daum3ns
30fbc68dd4 tls_validate_record_header(): Check for all HTTP methods 
The change checks for all HTTP methods in ssl_record, not only GET, POST,
PUT and HEAD. (additionally PATCH, DELETE, OPTIONS and TRACE)

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26968)
 2025-03-05 14:58:29 +01:00
Ivan Stanković
e599893a9f x509: allow SAN URIs to contain userinfo 
The way we're currently handling SAN URIs does not allow for userinfo,
meaning the name constraint check on such URIs will fail. Fix this by
skipping over the userinfo component:

      authority   = [ userinfo "@" ] host [ ":" port ]

(per RFC 3986).

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25861)
 2025-03-04 17:30:34 +01:00
Tomas Mraz
4e9b542868 compiler-zoo.yml: Switch to ubuntu-22.04 where possible 
And drop the rest.

The ubuntu-20.04 CI runners are discontinued.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26971)
 2025-03-04 16:33:15 +01:00
Matt Caswell
5eb55ad8a7 Fix a compilation failure in AIX 
AIX (at least for 7.1)  defines some macros for "events" and "revents" which
interferes with our own use of these names.

Fixes #24236

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26933)
 2025-03-04 09:02:15 -05:00
Tomas Mraz
ac80e1e15d doc: Fix type of OSSL_KEM_PARAM_IKME for ML-KEM 
Fixes #26945

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26954)
 2025-03-04 14:06:32 +01:00
Dr. David von Oheimb
1d3da367ab minor doc fixes for CMP and HTTP 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26924)
 2025-03-04 13:58:37 +01:00
Pauli
c1cd6d89a3 run ECX KEM evp_test tests 
The FIPS providers that support ECX (3.0.x & maybe 3.1.x) do not support ECX
KEM so there is little point to testing these algorithms under FIPS.  Consequently,
they are being tested only with the default provider.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:44 +11:00
Pauli
9adf53889b ecx kem: add evp_test data for ECX KEM testing 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:44 +11:00
Pauli
b2f415e0a4 evp_test: fully test RSA 
The evppkey_rsa.txt data were only tested against the default provider.
Change this so that they are tested against the FIPS provider too.
Also add the RSA KEM tests.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:44 +11:00
Pauli
a7c550ff76 rsa kem: add evp_test data 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:44 +11:00
Pauli
8e874d09d8 evp_test: fix untested errant code paths 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:44 +11:00
Pauli
e0b779098d test: condition SHA1/MD5 tests on default provider in evp_test data file 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:37 +11:00
Pauli
982a9676cf test: remove RSA KEM tests from evp_test data file 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26946)
 2025-03-04 18:53:37 +11:00
Bartel Artem
d3b6b81eab X509v3_addr_canonize(): Check whether addr == NULL 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26583)
 2025-03-03 09:43:22 +01:00
14MM4CH1N3
da44eb2901 Update doc README URLs 
This updates the openssl documentation link to the one currently in use,
and removes the standards.txt section as that URL leads to the normal
documentation page and there is no "standards" page in the openssl
documentation site.

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26759)
 2025-03-03 09:40:30 +01:00
Andrew Dinh
2240da83f9 SSL_CTX_set1_curves.pod: Move examples to own section 
Also specify whether server or client preference

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26897)
 2025-03-03 09:37:59 +01:00
Andrew Dinh
493e067f90 doc: Add some clarifications for SSL_CTX_set1_curves() 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26897)
 2025-03-03 09:37:44 +01:00
Ondrej Moris
a06d14e8ec Update pkcs11-provider submodule (898b107) 
Signed-off-by: Ondrej Moris <omoris@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26899)
 2025-03-03 09:35:16 +01:00
Dmitry Misharov
808a086171 Fix hashsum files in release assets 
We use the coreutils format since 3.4.0.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26907)
 2025-03-03 09:33:26 +01:00
Jakub Zelenka
5045712d3d Fix libctx passing for CMS PWRI use 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26937)
 2025-03-03 09:26:44 +01:00
Jean-Frederic Clere
7e431da4d8 http_test.c: Replace snprintf by BIO_snprintf 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26925)
 2025-03-03 09:18:13 +01:00
Tomas Mraz
2411f9b662 apps: Escape control characters in DNs by default 
When displaying distinguished names the control characters
are escaped by default.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26932)
 2025-03-03 09:08:34 +01:00
Tomas Mraz
624a00ef41 Sync CHANGES.md with 3.4 branch and fix formatting 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26932)
 2025-03-03 09:08:31 +01:00
Neil Horman
4f2f5179a1 Remove empty buffer check in script_84 of quic_multistream_test 
The quic_multistream_test occasionally fails script_84, specifically
failing on:

OP_CHECK2(check_write_buf_stat, 0, 0)

which fails due to the send stream buffer not reading zero after data is
sent on the stream

However, the send stream is culled of pending data, not after the stream
is sent, but rather only after the peer sends an ack confirming that the
data has been received.  There is no guarantee that ACK will be sent
immediately, so occasionally timing discrepancies result in the test not
getting that ack by the time we check the send stream buffer.

We couldmodify the script to wait longer, or repeatedly tick the quic
stack to wait for that ack to be collected, but since its perfectly
valid for that data to live in the ring buffer for a period, and that
any true erroneous keeping of that data beyond its ack point would
manifest as any number of other duplicate transmissions, it seems more
sane to just remove the check.

Fixes openssl/project#1117

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26939)
 2025-03-02 17:39:38 -05:00
Matt Caswell
aaad33c5ac Move ssl_err.c into libcrypto 
We move ssl_err.c out of libssl and into libcrypto. This file is entirely
self contained and is used to load error strings into the libcrypto error
tables. By moving this file into libcrypto, libssl can be unloaded safely
without having dangling references to this error information.

Fixes #26672

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26931)
 2025-03-01 14:46:03 -05:00
Viktor Dukhovni
31b5f3f382 Further decoder tuning possibly better perf 
- The decoder should consider fewer options based on
  more precise tracking of the desired input type
  (DER, PVK, MSBLOB), algorithm (RSA, EC, ...),
  input structure (SPKI, P8, ...).

How much this affects actual use-cases is harder to estimate, we'll just
have to run before/after perf tests.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26927)
 2025-03-02 02:04:09 +11:00
Geert Hendrickx
89dbc6a62c Fix no-tls-deprecated-ec documentation to match the actual option. 
CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26934)
 2025-03-02 01:55:14 +11:00
Ian Spence
d4430ef9fc Delete include/openssl/asn1_mac.h 
See https://github.com/openssl/openssl/discussions/26886

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26900)
 2025-03-01 09:27:54 -05:00
Hugo Beauzée-Luyssen
c2ab75e30a doc: fix OSSL_WINCTX spelling windows notes 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26567)
 2025-02-28 15:21:12 +01:00
Valerii Krygin
f86acc9434 EVP_DecodeUpdate() should not produce padding zeros to the decoded output (Fixes #26677) 
EVP_DecodeUpdate() should not produce zeros for input padding `=` signs to avoid writing to non-allocated memory regions.

To achieve this:
- Add `eof` parameter to `evp_decodeblock_int` function in `openssl/crypto/evp`. The parameter should either contain the number of the input padding characters to ignore or `-1` if the function has to count them.
- Use precalculated `eof` in `EVP_DecodeUpdate` to fix its behaviour.
- Use `eof = -1` in `EVP_DecodeFinal` to count it in `evp_decodeblock_int`.
- Do not ignore padding in `EVP_DecodeBlock` (`eof = 0`) because it should write padding zeros according to the documentation.
- Add the HISTORY section to EVP_EncodeInit documentation to describe the fix.

Other changes:
- Update AUTHORS.md
- Update the copyright date in the documentation.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26678)
 2025-02-27 17:38:57 +00:00
Viktor Dukhovni
6ef393b89b Check full ML-KEM encoded key 
When both seed and key are provided compare the full ML-KEM private key
with the seed keygen output, not just the public key.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26905)
 2025-02-27 11:06:29 -05:00
Dr. David von Oheimb
253a380bdb doc/, CHANGES, NEWS: add missing entries and fix existing ones when which CMP feature was added 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26908)
 2025-02-27 16:58:47 +01:00
Andrew Dinh
ecc174065a Update slh_dsa_test.c 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26916)
 2025-02-27 10:23:38 -05:00
Andrew Dinh
237b761ab4 Update slh_dsa_test.c 
Fix https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1642943

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26916)
 2025-02-27 10:23:38 -05:00
Andrew Dinh
442f1958e8 QUIC NULL checks 
- Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643029
- Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643030
- Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643141

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26916)
 2025-02-27 10:23:38 -05:00
Dan Pittman
9688973596 Add a note about avx-512 support for XTS to CHANGES.md 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26410)
 2025-02-27 08:31:16 -05:00
dan pittman
ddc8529e87 fix windows calling convention in aesni-xts-avx512 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26410)
 2025-02-27 08:31:16 -05:00
Dan Pittman
b4116b9372 add an AVX-512-optimized ASM XTS implementation for x86_64 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26410)
 2025-02-27 08:31:16 -05:00
slontis
c2f4d7aae1 Encoder : Fix floating pointer when OSSL_ENCODER_to_data() is called 
twice.

Fixes #26862

This only happens when using the FIPS provider, since it needs to export
the key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26891)
 2025-02-27 12:04:14 +11:00
Andrew Dinh
054f6c0fc1 Optimize ossl_namemap_name2num_n to avoid strndup 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26870)
 2025-02-26 13:32:59 -05:00
Viktor Dukhovni
18f2091ad1 Older FIPS providers require a kemop 
Don't expect success with dated FIPS modules.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26904)
 2025-02-26 15:52:53 +01:00
Viktor Dukhovni
44a64029c3 Use better data type info in decoders 
The decoders in some cases failed to capture or propagate
information about what is being decoded, causing more work
happen to try unrelated decoders as a fallback.

We now try harder to keep track of the expected object (private key or
public key, if known), and the algorithm determined from the OID of a
PKCS8 object or SPKI.  This leads in many cases to fewer decoder
invocations.  With so many more algorithms now, trying every decoder
is increasingly best avoided.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26892)
 2025-02-26 15:13:57 +01:00
SaEvangelista
f11c10d83e Allow 0 length plaintext and aad for aes-siv 
Test vectors taken from wycheproof:

https://github.com/C2SP/wycheproof/blob/master/testvectors/aes_siv_cmac_test.json

Fixes #26580

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26658)
 2025-02-26 12:21:08 +01:00
slontis
20599e480f ML-DSA Add Wycheproof test vectors. 
Added a python script to convert the json files into evp_test data.
Added a EVP_TEST_METHOD "KeyFromData" that can test failures when
loading raw keys. (The existing "PrivateKeyRaw" and "PublicKeyRaw"
were not fit for this purpose).

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26885)
 2025-02-26 12:14:58 +01:00
Viktor Dukhovni
fed9be39ff Make RFC8422 deprecated TLS EC curves disablable 
Also move the deprecated curves to the end of the list, and order the
soon most preferred groups first.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26873)
 2025-02-26 12:14:02 +01:00
slontis
69d15b28af FIPS POST: Change PBKDF2 CAST to use less iterations. 
Fixes #26876

The issue here is that the pbkdf2 'lower_bounds_checks' currently errors by default
in FIPS mode if iterations < 1000.
i.e. the "pkcs5" flag = 0 triggers an error..
Turning the flag on means the FIPS indicator is triggered (which is probably correct behaviour)
Not sure testing the fips state here is a good idea (i.e. taking a TSAN hit).

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26887)
 2025-02-26 12:13:03 +01:00
Neil Horman
c0eb5c57f7 fix slh-dsa incorrect prediction of result code 
The slh_dsa fuzzer predicts failure in EVP_message_sign_init in the
event we pass a context_string param of more than 255 bytes.  That makes
for an accurate prediction, but only if we actually create  the param.

augment the setting of exepct_rc_init to be determined not only by our
allocation of a > 255 byte message, but also on selector bit 1, which
determines if we create the parameter at all.

Fixes https://oss-fuzz.com/testcase-detail/4807793999937536

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26884)
 2025-02-25 16:04:02 -05:00
Neil Horman
83dbfde6aa Add record overflow test to tlsfuzzer external tests 
Add this to our regression test suite for tlsfuzzer, since it recently
caught an error

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26781)
 2025-02-25 15:31:58 -05:00
Neil Horman
2ce46ad8ce Change cipher suite alert for 0 length cipher_suites 
From RFC 8446:

Note: TLS defines two generic alerts (see Section 6) to use upon
   failure to parse a message.  Peers which receive a message which
   cannot be parsed according to the syntax (e.g., have a length
   extending beyond the message boundary or contain an out-of-range
   length) MUST terminate the connection with a "decode_error" alert.
   Peers which receive a message which is syntactically correct but
   semantically invalid (e.g., a DHE share of p - 1, or an invalid enum)
   MUST terminate the connection with an "illegal_parameter" alert.

A zero length cipher suite list I think is considered out of range, and
so we should return "decode_error" rather than "illegal_parameter"

Fixes #25309

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26781)
 2025-02-25 15:31:45 -05:00
Dimitri John Ledkov
a7c0fa601e Add ifndef to seed-src_jitter too 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25930)
 2025-02-25 14:45:57 -05:00
Dimitri John Ledkov
aa5f1b4cf5 fips-jitter: Force use jitter entropy in the FIPS 3.0.9 provider callback 
FIPS 3.0.9 provider does not honor runtime seed configuration, thus if
one desires to use JITTER entropy source with FIPS 3.0.9 provider
something like this needs to be applied to the core (libcrypto) build.

Not sure if this is at all suitable for upstream.

With fips-jitter (3.5+) config, also ensure that core<->provider
callback for entropy uses jitter entropy source, rather than os seed
(getrandom syscall).

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25930)
 2025-02-25 14:45:57 -05:00
Alexandr Nedvedicky
395a83a617 Fix read out of buffer bounds when dealing with BIO_ADDR 
This issue was discoevered while I was testing SSL_new_from_listener()
using a newly created unit test. It has turned out the QUIC stack
at few places contain pattern as follows:
	foo(QUIC_WHATEVER *q, BIO_ADDR *a)
	{
	   q->a = *a;
	}

The problem is that derefencning a that way is risky. If the address `a`
comes from BIO_lookup_ex() it may actually be shorter than sizeof(BIO_ADDR).
Using BIO_ADDR_copy() is the right thing to do here.

Fixes #26241

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26252)
 2025-02-25 15:55:46 +01:00
Niels Dossche
ececabd9ad Fix potential memory leak in policy_section() 
If sk_POLICYQUALINFO_push() fails, qual is not freed.
Fix it by adding POLICYQUALINFO_free() to the error path.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26499)
 2025-02-25 15:52:13 +01:00
Tomas Mraz
be5965acad add_uris_recursive(): Avoid OSSL_STORE_INFO leak on error 
Fixes #26480

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26511)
 2025-02-25 15:50:45 +01:00
Niels Dossche
56160f173d Fix potential leak in error path in cert_response() 
get1_cert_status() returns an object that must be freed,
but the error path does not do that.
Fix it by adding a call to X509_free() in the error path.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26513)
 2025-02-25 15:48:50 +01:00
Andrew Dinh
b4fab70bfb EVP_PKEY_derive_set_peer_ex(): Don't free peer on error 
In EVP_PKEY_derive_set_peer_ex, don't free peer
on error. Revert to existing functionality.

Bug was introduced with
https://github.com/openssl/openssl/pull/26294

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26823)
 2025-02-25 15:47:08 +01:00
Tomas Mraz
87b5aa737d Rename fnv1a_hash() to ossl_fnv1a_hash() 
It is no longer static.

Also add it to libssl only with quic enabled.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26882)
 2025-02-25 15:45:42 +01:00
Niels Dossche
8cdba24cee Fix potential memory leaks in error paths in ossl_rsa_multiprime_derive() 
There are several cases where new BIGNUM instances are created, not
using the context, but not freed when an error occurs.
Fix this by adding the necessary calls to BN_free().

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26515)
 2025-02-25 15:36:43 +01:00
Tomas Mraz
7e80b16776 Add CHANGES.md entry for changed default TLS group list 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
4c69caef48 tls1_set_groups_list(): Update raised errors 
Do not raise ERR_LIB_CONF codes from libssl.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
0b40fac3fb tls_construct_ctos_key_share(): Fix handling of HRR without key share request 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Neil Horman
192f096afd Convert test_bio_ssl to use fake time 
The test_bio_ssl test in quicapitest is failing on windows.  Something
about the timing there is causing wide variance in how long it takes to
establish a handshake (between 130-6500 iterations).

Convert it to use fake time to make it run consistently.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
bcc364896e 28-seclevel.cnf.in: Enable some groups required for high SECLEVELs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
5a9966dd3a 70-test_tls13cookie.t: Change the order of the test cases 
As the COOKIE_ONLY cannot run on no-ecx build.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
sashan
f9aaeacbf9 Tserver must keep fake time ticking to complete a handshake 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
a3143c2400 No valid groups is not an error 
Of course TLS-1.3 won't be usable with such configuration.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:24 +01:00
Tomas Mraz
a89c99e04b Have the same default groups list for QUIC and TLS 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:23 +01:00
Tomas Mraz
b665a13ac0 compare_with_file(): ? at EOL matches any number of characters 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:23 +01:00
Sasha Nedvedicky
3947982e3a Fix quic multistream test 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:23 +01:00
Viktor Dukhovni
63a70d63e2 Add hybrid ML-KEM based groups to default TLS groups 
- send two key shares by default
- trim down the list of default groups

The default TLS group list setting is now:
?*X25519MLKEM768 / ?*X25519:?secp256r1 / ?X448:?secp384r1:?secp521r1 / ?ffdhe2048:?ffdhe3072

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26801)
 2025-02-25 15:34:23 +01:00
Alexandr Nedvedicky
96075a6a40 Fix AEAD validation of initial packets in port 
The interoperability tests disable client ip address
validation done by RETRY packet. All tests done in CI
take code path which sends a retry packet.

The first initial packet sent by client uses a different
initial encryption level keys to protect packet integrity.
The keys are derived from DCID chosen by client.

When server accepts connection on behalf of initial packet,
the 'DCID' gets changed which means the initial level encryption keys
are changing too. So when server skips sending a retry packet,
it must forget the qrx which was used to validate initial
packet sent by client.

Forgetting qrx is not straightforward, we must salvage the
unencrypted packets left there after they were validated.
Those unencrypted packets must be injected to newly created channel.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26808)
 2025-02-25 12:05:10 +01:00
Alexandr Nedvedicky
c14ae04613 Perform initial AEAD validation before creating a channel 
We let port to create qrx object and use it for
packet validation. If packet validates, we then
create channel and pass pre-created qrx to channel's
constructor.

Co-authored-by: Andrew Dinh <andrewd@openssl.org>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26808)
 2025-02-25 12:04:09 +01:00
daichengrong
7fb4a323f1 riscv: add dl_hwcap for capability detection 
Availability of ZVK* should be determined with dl_hwcap and hwcap.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26811)
 2025-02-25 12:01:59 +01:00
Burkov Egor
6d42072e0b fix: add OOM handler for x509 fuzz test 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26830)
 2025-02-25 11:58:48 +01:00
Viktor Dukhovni
ddd7ecb04b Make the KEM operating mode optional 
There is only one operating mode supported for each of RSA, EC and ECX.
We should not require an explicit setting for the obvious default.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26872)
 2025-02-25 10:58:23 +01:00
Pauli
53c54b13ac doc: document that the FIPS provider doesn't support deterministic ECDSA sigs 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26880)
 2025-02-25 10:41:40 +01:00
Bernd Edlinger
a6f512a1e6 Revert wrong macos RCU fix 
This reverts #23974 which seems to be no longer needed now,
due to other fixes nearby.  Most likely the change did just
slightly decrease the performance of the reader threads, and
did therefore create the wrong impression that it fixed the issue.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26881)
 2025-02-25 10:38:26 +01:00
Andrew Dinh
cec0659fa4 Coverity fixes 
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643042
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643047
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643089
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643091
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643095

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26845)
 2025-02-25 08:55:26 +01:00
Viktor Dukhovni
64a27c24d8 More seed and private key checks for ML-DSA 
- Check seed/key consistency when generating from a seed and the private
  key is also given.
- Improve error reporting when the private key does not match an
  explicit public key.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26865)
 2025-02-25 12:49:49 +11:00
Neil Horman
1eb5ffcdc8 Fix ci break on building quic with no-siphash 
SHARED_SOURCE doesn't pull in siphash if its disabled in the
configuration leading to undefined symbols, which we need for quic.

If siphash is disabled in the build, then pull it in via a SOURCE
addition, otherwise pull it in via SHARED_SOURCE

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26874)
 2025-02-23 17:16:03 -05:00
Neil Horman
ba90c49125 separate intval into separate variable in OSSL_PARAMS 
construction of int params holds a pointer to an int rather than an int
value, so we need to use separate variables when constructing separate
int params.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26851)
 2025-02-22 14:29:56 -05:00
Neil Horman
3be71de4d9 Fix slh-dsa fuzzer on invalid param inputs 
oss-fuzz issue:
https://issues.oss-fuzz.com/issues/397734693

Fails because the fuzzer occasionaly provides inputs which drives the
fuzzer to create an octet-string for the context_string param which
violates the 255 byte constraint documented on that parameter.

Fix it by detecting that condition, expecting failure in the call to
EVP_sign_message_init, and bailing out when it occurs.

Fixes openssl/project#1109

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26851)
 2025-02-22 14:29:56 -05:00
Neil Horman
17d2fd0752 Use siphash to implement lcidm hash function 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)
 2025-02-22 13:23:16 -05:00
Neil Horman
7dd821bab5 Add siphash to shared source for quic 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)
 2025-02-22 13:23:16 -05:00
Neil Horman
6a9a9480a7 Update LCIDM lookups to include hash keys 
In preparation for using siphash in our hash function

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)
 2025-02-22 13:23:16 -05:00
Neil Horman
3e3942b42f Add random hash key value to lcidm struct 
This is in preparation for using siphash to compute lcidm hash table
values

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26849)
 2025-02-22 13:23:16 -05:00
Bernd Edlinger
4d16d2f40a Re-enable RCU torture test on MACOSX 
This test was disabled due to "Stochastic failures in
the RCU test on MACOSX" by #23967, which sounds like an
issue that is probably fixed now.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26834)
 2025-02-22 17:43:15 +01:00
slontis
6e770d38c7 SLH-DSA - restrict keygen seed length to exact value of 3*n 
It was allowing the seed to be larger, and then just ignoring the
trailing bytes.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26858)
 2025-02-22 22:46:44 +11:00
slontis
5b52a6395c SLH-DSA fixup tests to adjust the private key getter returning the 
public component

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26839)
 2025-02-22 21:25:03 +11:00
slontis
fa8d70bf75 SLH-DSA Update private key getter to also return public components. 
The private key is defined in FIPS 205 as containing the public key,
so we return this also. This also matches what happens in fromdata.

Updated Documentation for SLH_DSA.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26839)
 2025-02-22 21:25:03 +11:00
Pauli
0bdd10e407 doc: fixup FIPS self test names 
Missing names and categories in the documentation

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Pauli
5fd4ad73f0 fipsinstall: update tests to use corrent key gen test name 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Pauli
92a54f4d59 fips: update FIPS self test defines 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Pauli
b330d590b4 fips: refactor to unify the ST_KAT_PARAM -> OSSL_PARAM code 
This code was duplicated multiple times throughout the self tests.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Pauli
17b73561d5 fips: refactor ML-KEM tests so that key generation is separate 
Encapsulation and decapsulation remain as their own CAST.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Pauli
a5cc141bbc fips: add key generation name for ML-KEM CASTs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26859)
 2025-02-22 17:31:43 +11:00
Bernd Edlinger
51597e2ee6 Use linux-arm64 or the public ubuntu-24.04-arm runner image 
dependent on whether this runs on the openssl/openssl repository
or a clone.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26855)
 2025-02-21 15:36:25 -05:00
Andrew Dinh
704c3d3cd2 Various NULL checks 
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643035
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643039
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643041
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643044
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643045
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643046

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26840)
 2025-02-21 15:07:27 -05:00
Dmitry Belyavskiy
17bbc16383 EVP_SKEY_get_raw_key => EVP_SKEY_get0_raw_key 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26832)
 2025-02-21 17:58:41 +01:00
Michael Baentsch
c535b28baf Update oqsprovider git submodule and start testing with it again 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26848)
 2025-02-21 17:17:54 +01:00
Clemens Lang
c338c89d16 Provide aliases to ML-DSA without dashes 
oqsprovider did not use dashes in the algorithm names for ML-DSA. Make
the transition smoother by also accepting the names without dashes as
aliases.

See also #26326 for the same thing for ML-KEM.

Signed-off-by: Clemens Lang <cllang@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26853)
 2025-02-21 17:04:41 +01:00
Bernd Edlinger
3240427a85 Make CRYPTO_atomic_load/store use the same preprocessor guards 
as the other CRYPTO_atomic_X functions.
All CRYPTO_atomic functions should use the same logic here,
just in case...

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)
 2025-02-21 14:01:51 +01:00
Bernd Edlinger
eacf14594d Cleanup atomic fallbacks in threads_pthread.c 
the unused atomic stub functions make clang issue
unused function warnings -Wunused-function

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)
 2025-02-21 14:01:51 +01:00
Bernd Edlinger
00a173af77 Enhance thread sanitizer CI tests 
Related to issue #26798

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26815)
 2025-02-21 14:01:51 +01:00
Tomas Mraz
347de0ab1f cross-compiles.yml: Disable FIPS for cross compiles 
When running tests things are too slow due to SLH-DSA POST.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)
 2025-02-21 12:03:34 +01:00
Tomas Mraz
03e9718a50 run-checker-daily.yml: Add memory sanitizer run with SLH-DSA enabled 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)
 2025-02-21 12:03:34 +01:00
Tomas Mraz
5ae74ab47c make-test: No verbose tar output 
This just clutters the logs otherwise.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)
 2025-02-21 12:03:34 +01:00
Tomas Mraz
612e3e8340 run-checker-daily.yml: Adjust the list of jobs 
Some of the disablables are already disabled by default.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)
 2025-02-21 12:03:34 +01:00
Tomas Mraz
2ecc87fc94 Disable SLH-DSA in memory sanitizer 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26820)
 2025-02-21 12:03:34 +01:00
Cheng Zhang
db2c54cc92 Added new API to enable 0-RTT for 3rd party QUIC stacks. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26842)
 2025-02-21 12:01:30 +01:00
Andrew Dinh
8d69f4005b Use OPENSSL_strdup instead of strdup 
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643038

Also NULL check for the allocation.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26843)
 2025-02-21 11:21:48 +01:00
Pauli
26fc6da358 fips: change SLH-DSA key generation to use a fast algorithm flavour 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26837)
 2025-02-21 12:22:56 +11:00
Pauli
ca26db30a0 slh-dsa: avoid pairwise test when doing key generation CAST 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)
 2025-02-21 11:40:19 +11:00
Pauli
5811c0e8cf ml-kem: avoid pairwise test when doing key generation CAST 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)
 2025-02-21 11:40:19 +11:00
Pauli
50f995ff8c ml-dsa: avoid pairwise test when doing key generation CAST 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)
 2025-02-21 11:40:19 +11:00
Pauli
e36d00e53b fips: add function to detect if the self tests are running 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26838)
 2025-02-21 11:40:19 +11:00
slontis
92159b48e9 SLH-DSA coverity fixes. 
Fixes 1643092 and 1643093

Neither of these are major issues, but fixed anyway..

i.e. 1<<hm is bounded by the parameter set so this is not an issue
Not checking an error from WPACKET_memcpy() would also not cause an
issue.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26835)
 2025-02-21 09:12:02 +11:00
Tomas Mraz
560e586371 Refactor EVP_SKEY initialization 
Enforce that skeymgmt cannot ever be NULL in EVP_SKEY.

Also add missing allocation checks.

Fixes multiple issues found by Coverity.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26795)
 2025-02-20 20:35:59 +01:00
Shakti Shah
c9e56da777 Make org.openssl.winstore: work in openssl-ts 
Fixes #26739

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26833)
 2025-02-20 20:24:45 +01:00
Andrew Dinh
6b662bf0d6 Set op_num to 0 
Here, op_num is just used for logging purposes (number of completed operations), so start it at 0

Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643034

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26829)
 2025-02-20 13:10:12 -05:00
Dmitry Belyavskiy
c152a94395 Fix coverity finding 
Coverity ID: 1643094

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26831)
 2025-02-20 16:28:22 +01:00
Andrew Dinh
a1c6e2d1b5 ssl_lib.c: Check for NULL from SSL_CONNECTION_FROM_SSL() 
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643027
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643028

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26824)
 2025-02-20 15:30:25 +01:00
otherddn1978
e1a501a433 EC_get_buildin_curves does not return an error, this check is unnecessary. 
Found by Linux Verification Center (linuxtesting.org) with SVACE.

unused code has been removed

delete whitespace

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26719)
 2025-02-20 15:15:46 +01:00
Andrew Dinh
3820f2da7c NULL checks for QUIC code 
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643033
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643032
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643031
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643030
Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643029

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26825)
 2025-02-20 08:13:02 -05:00
Tomas Mraz
20ca6d4743 CI: ssl-trace is enabled by default 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26810)
 2025-02-20 10:48:54 +01:00
Tomas Mraz
9d8b18c74e test/quicapitest.c: Fix build with no-ssl-trace 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26810)
 2025-02-20 10:48:54 +01:00
Burkov Egor
c5eb70de75 fix: add check for NULL zalloc in tls-provider.c (reverse if statement) 
CLA: trivial

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26814)
 2025-02-20 09:40:33 +01:00
Viktor Dukhovni
cab4e7cbd1 Configurable import-time PCT for ML-KEM 
And related cleanup.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26789)
 2025-02-20 18:21:40 +11:00
Pauli
f31b98fefe slh-dsa: use fast flavours for FIPS Power Up Self Test 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26821)
 2025-02-20 12:44:34 +11:00
Pauli
0da8140214 testutil: remove unused buffer from stanza structure 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
11f4eaf197 slh-dsa: update changes authorship 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
2440305e8f slh-dsa: add key generation tests 
These are reasonably fast so are not flagged as extended tests.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
8c2cc4eea9 slhdsa: add Python script to convert NIST ACVP data to evp_test format 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
73e01df48d slh-dsa: change the seed parameter name from entropy to seed 
This brings it inline with the same parameter for ML-KEM and ML-DSA.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
ac77e0697a evp_test: include signature generation and verification tests for SLH-DSA 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
9531a1de0f slh-dsa: add signature generation tests 
This marks the first use of the extended test feature in evp_test.
The reason behind this is the amount of time the full SLH-DSA tests consume.
The non-extended tests chosen so that they exercise all of the algorithms
at least once and all the varying combinations of features for the fast
algorithms.

On my build machine the full test suite takes: 290 seconds.
With the reduction to a dozen tests it takes: 10.5 seconds.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:40 +11:00
Pauli
8029960bbc slh-dsa: add signature verification failure tests 
These are fast and don't require reduction in number.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:39 +11:00
Pauli
f0417c6ebc evp_test: add a Verify-Message-Public test type 
This is like Verify-Message but accepts a public key instead of a private one.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:39 +11:00
Pauli
4439b8d3cc testutil: increase the line length for reading stanzas 
PQC algorithms and SLH-DSA in particular have very long lines of data.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:39 +11:00
Pauli
de194a6074 coverage: enable extended EVP tests 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:39 +11:00
Pauli
740e43f074 evp_test: add concept of extended tests to evp_test 
These tests are not run by default, instead they run when the EVP_TEST_EXTENDED environment variable
has an integer value other than zero.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26750)
 2025-02-20 11:17:39 +11:00
Viktor Dukhovni
a4465bf694 More consistent ML-KEM key checks 
- Cross-check seed `z` value on import as well as load.
- In import/load When re-generating from a seed, check hash of any
  explicit private key when both provided.
- Avoid leak of expanded key encoding when load fails.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26812)
 2025-02-20 09:59:22 +11:00
Viktor Dukhovni
ff20db213d Typo fix 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26813)
 2025-02-20 09:50:53 +11:00
Neil Horman
c55114f680 Merge quic client and quic server interop CI 
Now that quic server is merged, we can merge the CI jobs that test the
client and server interop tests

Fixes openssl/project#1105

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26804)
 2025-02-19 15:57:25 -05:00
Cheng Zhang
966c9d3e98 Add the SSL_NO_EOED macro test 
test_no_end_of_early_data

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26552)
 2025-02-19 17:27:42 +01:00
Cheng Zhang
1b3f27f920 Add the SSL_NO_EOED internal macro 
The TLS EndOfEarlyData message is not applicable in some scenarios (e.g., QUIC).
This adds a macro to handle this message.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26552)
 2025-02-19 17:27:04 +01:00
Viktor Dukhovni
76e3fdd0f6 ssl3_ctrl(): Fix condition in SSL_CTRL_GET_PEER_SIGNATURE_NAME 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26819)
 2025-02-19 17:23:04 +01:00
Neil Horman
84694d2baa Relax checking of supported-groups/keyshare ordering 
quic interop testing showed that interop with the mvfst client was
failing, due to detecting mis ordering of supported groups and keyshare
extensions

This is strictly a mvfst problem to fix, but RFC 8446 indicates that we
MAY check the ordering but don't strictly have to.

We've opened an issue with the client to fix this, but in the interests
of client compatibility relax the ordering check so that, instead of
issuing a fatal alert, we just log a trace message indicating the
discrepancy

Fixes openssl/project#1106

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26818)
 2025-02-19 17:08:53 +01:00
Neil Horman
20a2f3beba Fix memory leak in ecdsa_keygen_knownanswer_test 
We allocate an EC_POINT with EC_POINT_new here, but in failing a
subsequent check, we don't free it, correct that.

Fixes #26779

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26799)
 2025-02-19 09:30:25 -05:00
slontis
5a1819a150 ML-KEM Add ACVP tests using latest values from 
https://github.com/usnistgov/ACVP-Server/blob/master/gen-val/json-files/
Which are parsed using mlkem_parse.py

The existing BoringSSL related .txt files have been left in place.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26791)
 2025-02-19 11:50:56 +01:00
slontis
1f5ac721e3 ML-KEM: Modify existing ML-KEM keygen tests to not use custom data. 
There are general input and output controls that are used instead.
Also fix a memory leak in keygen.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26791)
 2025-02-19 11:50:56 +01:00
Pauli
94491369f2 ssl_test: correctly handle ML-DSA being disabled 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26806)
 2025-02-19 13:38:41 +11:00
Pauli
4ad13c48d7 mldsa: add run-checker workflow for no-ml-dsa option 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26806)
 2025-02-19 13:38:41 +11:00
Pauli
3230c0526d ml-kem: add ML-KEM to bulk disable cascade 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26807)
 2025-02-19 13:37:19 +11:00
Pauli
0a297bd23d ml-dsa: test ML-DSA under FIPS 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26805)
 2025-02-19 13:35:45 +11:00
Dmitry Belyavskiy
83ced5e6b1 Fix coverity issues 
Fixes coverity issues 1642964, 1642965, 1642966, 1642968, 1642969

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26793)
 2025-02-18 18:12:10 +01:00
Neil Horman
1636ae1a90 Free hashtable prior to freeing atomic worker_lock 
lhash_test uses a hashtable that may not be empty at the end of the test

Given that the free function frees the elements in the list and uses the
atomic worker_lock to do so, we need to free the hash table prior to
freeing the working lock to avoid the use of unallocated memory.

Fixes #26798

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26800)
 2025-02-18 16:40:24 +01:00
Frederik Wedel-Heinen
00fbc96988 Adds missing checks of return from XXX_up_ref(). 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26294)
 2025-02-18 16:32:59 +01:00
Tomas Mraz
e9aac2c2f3 Do not call BIO_printf() from FIPS_MODULE 
Fixes #26743

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26744)
 2025-02-18 16:31:45 +01:00
Dr. David von Oheimb
5cba362909 OSSL_CMP_MSG_http_perform(): support using BIO from OSSL_CMP_CTX_set_transfer_cb_arg() 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26628)
 2025-02-18 12:19:26 +01:00
Neil Horman
75bc132dec Initial slh-dsa fuzzer 
Current preforms the following operations

1) Generates arbitrary key pairs
2) Generates key pairs with parameters (both correct and incorrect)
   based on fuzzer input buffer
3) Exports and re-imports keys, confirming validity
4) Preforms Sign and Verify operations with optional parameters based on
   fuzzer input buffer

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26708)
 2025-02-18 10:24:02 +01:00
slontis
0e43652489 SLH-DSA: Add EVP_PKEY_CTX_dup() support. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26701)
 2025-02-18 10:17:29 +01:00
slontis
3fcefd51a1 SLH_DSA: Make apps.c do_X509_REQ_verify() call work correctly. 
- Added sigid_algs for SLH_DSA such that OBJ_find_sigid_algs() works.
- OBJ_sn2nid() was also being called, so the SN form of SLH_DSA
  algorithms needed to be added to the provider dispatch tables.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26625)
 2025-02-18 10:17:29 +01:00
slontis
7389cca079 SLH_DSA: Add support for generating X509 certs via the openssl 
command line app.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26625)
 2025-02-18 10:17:29 +01:00
slontis
67d52a555e SLH-DSA cleanups 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
0f0a836abd SLH-DSA More fixups 
Also added slh_dsa_key_dup()

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
8f86a75fcf SLH-DSA: Remove legacy ASN1 method tables for SLH-DSA. Update to use 
custom encoders for SLH_DSA decode_der2key.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
79e7c83711 SLH-DSA cleanups 
Addressed some review comments.
- Ref counting has been removed from SLH_DSA_KEY (EVP_PKEY is responsible
for the keys ref counting).
- Moved constants and prefetched objects into SLH_DSA_KEY.
- The SLH_DSA_HASH_CTX is still required since there are multiple
  contexts that need to propagate to a lot of functions, but it no
  longer contains the constants. Note that it also holds a pointer to
  the SLH_DSA_KEY.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
eba0e11c39 Add SLH_DSA key validation. 
The pairwise test requires that the computed PK_ROOT key matches the
keys PK_ROOT value. The public and private key tests just require the
key elements to exist.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
b8b67b1907 Add SLH-DSA FIPS self tests 
This requires a keygen test, as well as Sign/Verify tests for at least 1
sha2 algorithm and 1 shake related algorithm.

A pairwise consistency test has also been added to the key generation.

Note that self test datat for the signature is currently stored as a
sha256 digest in order to reduce the memory footprint.
(Since the signature size for sha2/shake using 128s = ~8K, and for 128f = ~17K)

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
a25bcde26a Add SLH-DSA encoder/decoder support. 
This required adding additional EVP_PKEY_ASN1_METHOD methods.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
db5846a7e0 Address style check nits for SLH-DSA 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
148f4d23e1 Update SLH-DSA code to use PACKET and WPACKET. 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
ed77201a26 Update SLH-DSAto use EVP_PKEY_sign_message_init() instead of using the 
prehashed variant.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:29 +01:00
slontis
acdd2c8bff Add SLH-DSA design document 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:17:26 +01:00
slontis
6de411963f Add SLH-DSA documentation 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:16:04 +01:00
slontis
5c2b404241 SLH-DSA clean ups 
- Make slh_dsa_sign() return the siglen when sig is NULL.
- Remove the ability in fromdata to generate the public key root
  given the private key and public key seed. This was messy and can
  be done by key generation instead.
- Add common EVP_PKEY gettablesto SLH_DSA keys
  (OSSL_PKEY_PARAM_BITS, OSSL_PKEY_PARAM_SECURITY_BITS, and
   OSSL_PKEY_PARAM_MAX_SIZE).
- Update tests based on the above changes.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
ce3acbd07e Zeorize some secret values in SLH_DSA 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
30a55b0cf1 Added return code checks to SLH_DSA Hash functions and propogated the 
values thru the calling functions.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
5901ca87ba Add SLH_DSA to the FIPS provider. 
The keygen tests required "entropy" to be added via an additional
parameter for ACVP testing. This is required because TEST_RAND cant be
used to pass entropy to the FIPS provider, due to it not knowing the
lib ctx of the FIPS provider.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
e8457ce077 Add support for all 12 SLH-DSA parameter sets. 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
e240d39c6c Add SLH-DSA signing. 
Also updated function comments.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
8f53b9b59d Add SLH-DSA key generation 
Also made fromdata able to generate the public root key if the private
key seed + prf as well as the public key seed are passed to from data.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
2f9e152d86 Add SLH_DSA signature verification. 
This uses a SLH_DSA_CTX that is passed to most functions.
It contains information related to a parameter set (such as constants,
hash functions, prefetched EVP_MD/EVP_MAC objects, as well as ADDRESS
functions). This context is seperated from the SLH_DSA_KEY since
multiple signature operations could be performed using the same keys.
This only implements functions required for SLH-DSA-SHA2-128s

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
34f4cacc8f Add base code to load a SLH_DSA public key. 
This loads a SLH_DSA public key from data.
A simple SLH_DSA keymanager imports this key.

Initially this only has a parameter set for
SLH-DSA-SHA2-128s

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
slontis
16395ee9cc Add SLH_DSA configuration option 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25882)
 2025-02-18 10:13:53 +01:00
Viktor Dukhovni
d5a4665a21 Case-insensitive sigalgs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26767)
 2025-02-18 14:24:57 +11:00
Pauli
2b7679b16d fips: omit PCT on key import 
Our lab thinks the IG 10.3.A additional comment 1 is a mistake and that
a PCT on import is not required.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26785)
 2025-02-18 10:11:42 +11:00
Neil Horman
a903be9cae Fixup error ennumeration 
The merge gives us a conflict on SSL_R_MISSING_QUIC_TLS_FUNCTIONS
which conflicted with SSL_R_LISTENER_USE_ONLY.  Move the former to
ordinal 423

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26762)
 2025-02-17 11:27:34 -05:00
Neil Horman
b684545e73 Fix ssltrace test 
It seems something changed during the merge leading to a slightly longer
frame

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26762)
 2025-02-17 11:27:34 -05:00
Neil Horman
8b0fbe224a Add ssl_unwrap.h to quic_tls_api.c 
Needed after the macro re-arranging performed on the quic-server branch

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26762)
 2025-02-17 11:27:34 -05:00
Neil Horman
b360611ad6 Readd the inclusion of quic_record_util.h to quic_tls.c 
Some refactoring on master removed the inclusion of quic_local.h from
ssl_local.h, which quic_tls.c needed on the server branch to pull in the
QRL_SUITE_AES128GCM and simmilar definitions.  Fix it by specifcially
adding quic_record_util.h into quic_tls.c, as we only need a few defines
from that header.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26762)
 2025-02-17 11:27:34 -05:00
Neil Horman
473e6bcb2c Fixup conflict between 3rd party quic-tls api and quic-server 
Build.info changes between quic-server and master occured here, resolve
them.  Can't do it as a fixup as the conficting changes have already
been merged to master

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26762)
 2025-02-17 11:27:34 -05:00
Alexandr Nedvedicky
9eee58cce4 Backout validation of initial packet done by port_default_packet_handler() 
QUIC interoperability tests discovered bugs in my earlier commit #59e7c2313b.
This change reverts everything out.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26748)
 2025-02-17 11:27:34 -05:00
Alexandr Nedvedicky
c82c1dbbbb Perform initial AEAD validation before creating a channel 
We let port to create qrx object and use it for
packet validation. If packet validates, we then
create channel and pass pre-created qrx to channel's
constructor.

Co-authored-by: Andrew Dinh <andrewd@openssl.org>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26610)
 2025-02-17 11:27:34 -05:00
Andrew Dinh
029d85869f Add quic-server fuzz test. Also update fuzz corpora submodule. 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26514)
 2025-02-17 11:27:34 -05:00
Neil Horman
5177484f19 Fix ossl_quic_trace to fetch connection short conn id len 
ossl_quic_trace currently fails to get the connection id when parsing a
short header.  now that we have an api to get the known length, go ahead
and use that to parse the header properly

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26592)
 2025-02-17 11:27:34 -05:00
Neil Horman
164d3a6b59 Use the recorded short conn id len in pktsplitbio 
Do the same thing in our pktsplit bio

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26592)
 2025-02-17 11:27:34 -05:00
Neil Horman
a55b689499 Use reported short conn id len in qtestlib 
Use the new short conn id internal api to record and use the connections
short conn id len when decoding packets in qtestlib

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26592)
 2025-02-17 11:27:34 -05:00
Neil Horman
5b808e1d80 Add api to fetch short conn id len from a given channel/tserver 
Need an api to fetch the configured conn id len for short headers, add
that in here

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26592)
 2025-02-17 11:27:34 -05:00
Neil Horman
7d5426c703 Move handling of connection close frames to QUIC FUTURE 
There is a corner case in handling connection close frames for which RFC
guidance is unclear.  Given that, move addressing it to QUIC FUTURE

Fixes openssl/project#1075

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26593)
 2025-02-17 11:27:34 -05:00
Neil Horman
3f06ebcfe3 Eliminate SSL_LISTENER_FLAG_NO_ACCEPT flag in QUIC 
We've not implemented it yet, and don't need it for MVP, so move the
TODO's to QUIC FUTURE and remove the docs for it.

Fixes openssl/project#1074

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26593)
 2025-02-17 11:27:34 -05:00
Neil Horman
a6f3110318 Move EAGAIN handling of QUIC retry/verneg frames to QUIC FUTURE 
Fixes openssl/project#1072
Fixes openssl/project#1073

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26593)
 2025-02-17 11:27:34 -05:00
Neil Horman
a08e9aec1d Move implementation of RETIRE CONN ID frames to QUIC FUTURE 
Fixes openssl/project#1071

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26593)
 2025-02-17 11:27:34 -05:00
Neil Horman
05ea15261c Move quictestlib TODO to QUIC FUTURE 
Improving handling of packets in tserver doesn't currently make sense,
as we're planning on eliminating it soon.  Move this TODO to QUIC FUTURE

Fixes openssl/project#1070

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26593)
 2025-02-17 11:27:34 -05:00
Neil Horman
c536754fd0 move token store definition to quic_predef.h 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:34 -05:00
Neil Horman
35fb39da76 de-duplicate fnv1a_hash 
I cloned a copy of fnv1a_hash from hashtable.c.  Deduplicate that so we
have common source code.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:34 -05:00
Neil Horman
9d6e5a69db Remove NEW_TOKEN public api 
@sashan and I were discussing the usefulness of the public facing api
for NEW_TOKEN support, and he has concerns over its usefulness and our
being stuck with it if we need to make changes later.  Given that it is
a convience api for using multiple CTX-es to share a cache, its fine if
we remove it for now, as that seems like a less common use case.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
73b49e65fc init token to ease cleanup 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
e732f4456a Remove SSL_TOKEN_STORE_HANDLE type 
Replace it with SSL_TOKEN_STORE and make the structure opaque in the
public api

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
f0e516522c Modify ossl_quic_get_peer_token to return QUIC_TOKEN 
we use this struct internally to track computed tokens, we may as well
use it when fetching those tokens, as it allows the removeal of the QTOK
type

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
e521131c60 Rename token_store functions to make them consistent 
we use get0 to get a token store, but set to set it.  Since the latter
takes a refcount, change that to set1.  Also rename the interal quic
functions to match.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
e8148315ca Review fixups 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
4f11f520d7 Fix a memory leak on free 
Forgot to free the CRYPTO_REF when freeing a token

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
642fde8616 Reduce our NEW_TOKEN send rate. 
Currently, we send a NEW_TOKEN frame on every new validated connection,
but thats not necessecary.  Since NEW_TOKEN tokens have a lifetime of 1
hour currently, we really only need to send a NEW_TOKEN if:
1) We validated a RETRY token
or
2) We validated a NEW_TOKEN for which the lifetime is nearing its limit

So lets do that.  When we validate a token, only generate a NEW_TOKEN if
the current token is a RETRY token, or if its a NEW_TOKEN, and there is
less than 10% of the tokens lifetime remaining.

This lets clients use NEW_TOKENS repeatedly (as per the RFC), and saves
us some network bandwith.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
c266322bd1 Don't reserve an unused cid for NEW_TOKENS 
Just realized that NEW_TOKEN tokens don't need a reserved rscid.

Because a client might use a received NEW_TOKEN for multiple subsequent
connections, we allocate a cid when we validate the token on new
connection establishment (in fact we just use the one that the client
sends).  As such the allocated rscid never gets used, and just sits
there until it ages out.

Instead, fill the rscid with random data to mutate subsequently
generated NEW_TOKENS's, since it won't ever be part of the validation
process anyway.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
fce82b6ccc Reference count QUIC_TOKENS 
closer reading of RFC 9000 indicates that a NEW_TOKEN token can be
(re)used repeatedly.

so instead of creating a use once and discard pattern in the token api.
Let the tokens stick around until they are replaced with a new token
from the server.  To do this, we need to ref count the tokens so that we
don't accidentally free them while a given client is waiting to send an
initial frame making use of them.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
725074f4e7 Centralize freeing of tokens 
This will make it easier to refcount them in a moment

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
647fdf65c9 Schedule new token frame after handshake complete 
We don't want to schedule the NEW_TOKEN frame until such time as the
handshake is complete, otherwise we risk giving a token to validate a
future connection to a peer we haven't decided to trust yet

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
ebc52f1f02 Add test to confirm new token functionality 
Basically just create two clients and two servers, ensuring that both
clients use the same ctx (to share the token cache).

Connect the first client and server so that the cache gets populated
with a new token, tracing the ssl connection

Connect the second client and server, again tracing the connection with
the same bio

Then sift through the trace, looking for the new token frame in the
first connection, matching it with the token used in the second
connection.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
29e861a5a6 Add lookup for initial token assignment on channel start 
Start assiging initial tokens, and validating them on receipt

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
a2fe6435ca Enhance get_peer_token to not require memcpy 
Instead of copying the token thats store, return a pointer to it
along with a pointer to the token struct to free should we need to

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
38cb9ca1ad Add allocation of token cache on server contexts when needed 
the SSL_new_from_listener api creates a client SSL from a server
SSL_CTX context.  Normally server contexts need no token cache, but once
we start using it as a client, that changes.  Allocate one here when
needed

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
0f71ebec26 Augment client side recieve code to store NEW_TOKENS 
Start storing new tokens in our new cache

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
9a055c8917 extend internal api to allow for add/lookup token ops 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
3649a47f82 Add docs for token store manipulation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
b1828dc23a Add public api to create token cache for QUIC NEW_TOKENS 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Neil Horman
e73f330e99 Add new token generation transmission 
When we bind a channel, create a NEW_TOKEN token to be sent on the next
available datagram, once the channel is validated

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
f13ef23371 Clean up a few further TODO(QUIC SERVER) 
These are either already implemented or not relevant for
the QUIC server MVP.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26544)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
1ed2ef07b3 Add build.info for QUIC server demo 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26544)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
1f23dbb62d We are not handling AEAD at port level for now 
-> TODO(QUIC FUTURE)

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26544)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
54dcb3740b ossl_quic_tserver_shutdown(): Remove TODO(QUIC SERVER) 
tserver code is not related to QUIC SERVER

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26544)
 2025-02-17 11:27:33 -05:00
Neil Horman
c90cd1cfb5 update Dockerfile to pull hq-interop code from new location 
Change the dockerfile to use enable-hqinterop and copy binaries from
their new location

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26546)
 2025-02-17 11:27:33 -05:00
Neil Horman
8875da1b23 Add hq-interop configure option 
Allow the building of the hq-interop client and server when we are
building our interop container

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26546)
 2025-02-17 11:27:33 -05:00
Neil Horman
ec6200bf0f Move hq-interop code to test/quic-openssl-docker 
Its the only place we use this code, so put the code in that directory

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26546)
 2025-02-17 11:27:33 -05:00
Neil Horman
10cd798688 Disable server address validation for resumption test 
The quic-interop runner expects a handshake message and certificate
exchange in the first 3 frames in this test.  The addition of server
address validation retry frames causes the test to fail.  Strictly
speaking this is a shortcoming of the test, but disabling address
validation allows the test to pass, and we have the mechanism, so
disable the feature.

Fixes openssl/project#1061

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26545)
 2025-02-17 11:27:33 -05:00
Neil Horman
b33851eb72 Update doc/man3/SSL_new_stream.pod 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26527)
 2025-02-17 11:27:33 -05:00
Neil Horman
17dc32c51b quic-hq-interop: Allow for retries if we've reached our max stream limit 
Several servers defer the sending of max stream frames.  For instance
quic-go uses a go-routine to do the sending after sufficient existing
streams have finished, while mvfst seems to wait for all outstanding
streams to be closed before issuing a new batch.  This result in the
client, if all streams are in use, getting a transient NULL return from
SSL_new_stream().  Check for the stream limit being reached and allow a
number of retries before giving up to give the server a chance to issue
us more streams.  Also dead-reckon the batch count of streams we use in
parallel to be 1/4 of our total number of available streams (generally
hard coded to 100 for most servers) to avoid using all our streams at
once.  It would be really nice to have an api to expose our negotiated
transport parameters so that the application can know what this limit
is, but until then we have to just guess.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26527)
 2025-02-17 11:27:33 -05:00
Neil Horman
5569e170ee Fix up some nits 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
c85c572206 remove check of pending in ossl_quic_free 
Not strictly needed

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
943b137c2c Remove vestigual accepted flag 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
f60a96a2b4 Fix more typos 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
3e124f4bdd Fix some typos 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
9c189782c9 update docs with reference to SSL_set_ex_data 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
56b6ab094e Attempt to use NULL listeners to avoid use after free 
As per @sashan suggestion, try pre-creating user ssls with a NULL
listener

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
ddfd561f3c Update man page to note limitations of callbacks for QUIC 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
6f38c59850 Fix memory leak in pre-allocated listeners 
We have a chicken and egg problem.

Normally when we create a connection object in quic, we associate it
with a listener, and up the ref on the parent listener, which is fine.

However, now that we are pre-allocating user_ssl objects for incomming
connections we have a situation in which:
1) The pre-alocated connection object holds a ref on the listener
2) The application has no awareness of the quic connection object (and
   so can't free it)
3) The freeing of the listener object never calls into the quic stack,
   because its reference count may hold references from connections that
   haven't been accepted yet

We could require that applications register a function for the
new_pending_conn callback, and track/free these pending connections, but
that seems like alot of extra unneeded work to place on the application

Instead:
a) add a quic_conn_st flag named accepted
b) When pre-allocating connections, clear the flag in (a) and _dont_
   hold a reference to the parent listener
c) in SSL_accept_connection, set the accepted flag and reference the
listener
d) in ossl_quic_free drop the listener reference only if the accepted
flag is set
c) expressly free all user_ssl objects in ossl_quic_port_drop_incoming

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
55f3968a49 Add changes.md entry noting the limitations of recursive SSL calls 
QUIC can't currently make recursive SSL calls, as it potentially results
in deadlock

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
7502df20bc rename new_pending_ssl to new_pending_conn 
Make it clear its only announcing connections, not streams

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
1abc48fae8 Run Make update 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
016ddac4da Add docs for new callback registration 
Add docs for SSL_CTX_set_new_pending_ssl_cb

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
a477b4ec16 Add a test to validate our new SSL_accept connection objects 
Quick test to validate that:

a) our new pending SSL accept callback works
and
b) That our callback passed SSL objects match those that are returned
by SSL_accept_connection

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
a607146904 Add a callback to announce newly created ssl waiting acceptance 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
57f5af6f4c Return channel tls from ossl_quic_accept_connection 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
f193e0e9fb use internal callback to generate user ssl 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Neil Horman
dc04a11cca Add callback to get user ssl on channel creation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26361)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
d79ef118db If server receives NEW_TOKEN frame, respond with PROTOCOL_VIOLATION 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26426)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
db1c857c07 Fix MARSHALLED_TOKEN_MAX_LEN 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26333)
 2025-02-17 11:27:33 -05:00
Hugo Landau
3686d215fe QUIC FUTURE: Add concurrency architecture design document 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26025)
 2025-02-17 11:27:33 -05:00
Neil Horman
15f859403e Fix sizing on variable in ossl-nghttp3-demo-server 
On working on a rebase for the quic-server branch, I noted that the
rebase was failing on the http3 server.  It occurs because the new CI
ubuntu container appears to have FORTIFY_SOURCE enabled and trips over
the call to read here.  Specifically the compiler notes that in passing
an int into the read syscall (which accepts a size_t as the 3rd
argument), may interpret a negative value as a very large unsigned value
that exeeds the size allowed by a read call.

Fix it by converting the size variable to a size_t to ensure that the
signing is correct

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26368)
 2025-02-17 11:27:33 -05:00
Alexandr Nedvedicky
0b15147a37 Implement SSL_new_from_listener() 
SSL_new_from_listner() creates QUIC connection object (QCSO)
from listener. Caller can use the object retuned from
SSL_new_from_listener() to connect to remote QUIC server.
The QCSO created here shares engine/port with listener.

the change is covered by `test_ssl_new_from_listener()` in
test/quicapitest.c

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26138)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
6bae611c99 Make quic interop tests pass with the demo server 
Included are also multiple style fixes.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26193)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
e9aa0b6c0e IPv6 support for quic interop 
Modify the QUIC HQ interop server/client to support both IPv4 and IPv6.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26194)
 2025-02-17 11:27:33 -05:00
Neil Horman
fcd8f8f7dd Disable address validation for throughput test 
The multiplexing test using quiche as a client seems to get confused
when server address validation is enabled.  specifically it writes the
wrong keys into its keylog file, causing the test to fail when tshark
can't decode the tls connection that is established.  Fix it by
disabling address validation for the multiplexing/transfer test

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26198)
 2025-02-17 11:27:33 -05:00
Neil Horman
a99c76d94c Do read retries in quic hq-interop server 
Normally the throughput test in the interop harness requests several
hundred very small files, resulting in lots of small stream packets from
the client, which are nominally read in a single read operation (as they
typically fit into a single stream frame), and the server was written to
expect that.  However, its still possible, if a stream frame is packed
to the end of a datagram, that only part of its content is carried,
finished in a subsequent stream packet, which leads to a short read.

Augment the server to properly handle SSL_read transient failures so
that such an occurance is handled properly.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26198)
 2025-02-17 11:27:33 -05:00
Neil Horman
eabdcadefa Fix SSL_read error handling in http3 demo server 
The SSL_read error handling misses the ZERO_RETURN clause which is
non-fatal, correct that.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26180)
 2025-02-17 11:27:33 -05:00
Neil Horman
861a322400 Correct copying of the url value 
When setting up the url value we copy data from memory regions that
overlap, it leads to bogus output, correct that.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26180)
 2025-02-17 11:27:33 -05:00
Neil Horman
66e1e60a61 Preserve fileprefix accross reuse in http3 demo server 
The fileprefix that we serve content from needs to be preserved accross
h3ssl reuse.  Make sure we restore it after zeroing the struct.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26180)
 2025-02-17 11:27:33 -05:00
Neil Horman
9570ecfc69 Add http3 test to the interop container 
Set fileprefix for interop container on http3 server test

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26180)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
f851d8dfcc Encrypt the address validation token 
Store an EVP_CIPHER_CTX context with an ephemeral key set in port
and use it to encrypt/decrypt the validation token.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26165)
 2025-02-17 11:27:33 -05:00
Neil Horman
f42036822e removing debug code from quic_impl 
I had experimented with starting the ssl handshake during accept, and
forgot to remove it

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
6d25809cd0 Fix typo 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
d11c5b78af augment CI to run ampilficationlimit tests 
NOTE: Do this for the server test as well after rebase when http3
commits get merged

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
86c3c16c3b modify docker endpoint to not do address validation on transfer test 
quic interop uses the transfer test as part of the amplificationlimit
test, and as such we can't do address validation with retry frames
there, as the test requires it

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
d1c3bb2f74 Add tracking of receive credit for unvalidated connections 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
eaa1a143ae Add unvalidated credit tracking to packetizer 
Add data to track how much unvalidated credit we are sending and
receiving until such time as we are validated.  Validated conditions
are:

1) A retry token is sent, received, and validated
2) a handshake is completed on the connection

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26178)
 2025-02-17 11:27:33 -05:00
Neil Horman
b441d20a2f Add a warning that disabling server validation is not recommended 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Neil Horman
f443b4048d Clarify that this validation only relates to retry packets 
Disabling server address validation here only relates to new connections
that arrive without a token.  Future connections using tokens provided
by the server via NEW_TOKEN frames will still be validated

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Neil Horman
78f7141c12 Disable server address validation on interop handshake test 
The handshake test in the interop suite requires that no server address
validation be preformed, so disable it for this test

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Neil Horman
60762be09b Add a public flag to disable address validation on listeners 
Now that we have the infrastructure to skip address validation, add a
public flag to SSL_new_listener and SSL_new_listener_from to allow the
skipping of address validation on selected quic listener SSL objects

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Neil Horman
0746d4628e Add quic port flag to turn off address validation 
Give us the infrastrucute to skip addr validation on the server

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Neil Horman
207892d022 Enhance port binding to allow connections without odcid 
If we opt not to do server address validation, we have no odcid
and therefore never reserved a local cid

We need to follow the initial code path to generate one

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26114)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
9fc0d25b09 SSL_free() does check for != NULL (thanks Sashan) 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
b8e462c8e3 Fixes according Sashan review. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
887f6c06a1 port the 2 improvement suggested by @nhorman to help to run the 
quic-interop-runner.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
53ceb451b6 Arrange the code following the reviews. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
43ccd96da6 Fix small things from the review. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
ecf6701907 Add <sys/socket.h> for OpenBSD. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
fe2a51bfda typo in comment. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
1b11d7cf67 Arrange the remove_id() logic to be able to remove multiple stream. 
create a new h3conn in read_from_ssl_ids() when we have a new
connection.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
7492a44391 Arrange macox errors. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
a50a6efd07 make check style happy. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
511c37b88c Arrange the logic: 
SSL_poll() without SSL_POLL_FLAG_NO_HANDLE_EVENT ticks for each stream
we have in SSL_poll() that prevents the server logic to get all events
Use SSL_poll() with SSL_POLL_FLAG_NO_HANDLE_EVENT and
SSL_handle_events() prevents the problem.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
6ba49e30d8 read_from_ssl_ids() before wait_for_activity if something was received 
before and the first time we are in the loop.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
fe3e4bbb4f Arrange poll logic and get it working with chrome. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
76d8bf6f58 Allow to send some files to test with browsers. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Jean-Frederic Clere
2d080ca544 Use something like wait_for_activity() from demos/quic-server-non-block.c 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25859)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
2b271d0f85 Augment RETRY validation token 
Adds fields to the QUIC RETRY packet validation token:
timestamp, remote_addr, odcid, & rscid.

Also adds functionality to validate the token once returned by the client.

Note that this does not encrypt the token yet.

Also check that the RSCID stored in the RETRY validation
token matches the DCID in the header.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26048)
 2025-02-17 11:27:33 -05:00
Neil Horman
4d2912749e Determine which packet to drop for retry 
When doing a retry after a version negotiation, we actually need to drop
packet 1 rather than 0 to get a retransmit of the initial packet

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26000)
 2025-02-17 11:27:33 -05:00
Neil Horman
2f01b09408 Fix length check for datagram size in quic 
RFC says we should only accept datagrams of at least 1200 bytes, so the
check should discard anything under that, not over that

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26000)
 2025-02-17 11:27:33 -05:00
Neil Horman
fd50924d01 Augment quic interop harness to support server side interop tests 
the quic-interop-runner that we use for interop testing currently only
supports openssl client testing, as we had previously not had a server
to test with.

This PR rectifies that by doing the following:
1) Adding a quic-hq-interop-server.c file in demos/guide
2) Augmenting our interop Dockerfile and entrypoint to support our
   interop containter running in a server role

With these changes we are able to do server side interop testing

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26000)
 2025-02-17 11:27:33 -05:00
Matt Caswell
6d1646c66e Add documentation for BIO_dgram_set0_local_addr() 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26066)
 2025-02-17 11:27:33 -05:00
Matt Caswell
16a19002d8 Add the ablity to set a local address for BIO_dgram_pair 
BIOs created from a BIO_dgram_pair don't normally have a local BIO_ADDR
associated with them. This allows us to set one.

Fixes openssl/project#933

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26066)
 2025-02-17 11:27:33 -05:00
Neil Horman
128619a43b Make version negotiation packets use network byte order 
@t8m pointed out that versino negotiation packets weren't guaranteeing
network byte ordering in the array of supported versions.

Convert the client to use network byte order on send and receipt.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
Neil Horman
c7b82a7250 Fixup tests to properly check version negotiation 
Currently the quic_multistream_test tests version negotiation..sort of.

It uses a packet injector to force the tserver to send a version
negotiation packet back to the client.  Thats no longer needed as the
server will respond to an invalid version properly.

So alter script_74 to, instead of using the injector, use a quic channel
mutator to invalidate the version provided in the initial packet.  Then
we attempt to connect.  If the server responds with a version
negotiation packet and the client restarts with the proper version, then
the test passes, as the connection is extablished.

Also, while we're in here, update the gen_version_neg function to
properly insert a 0 version into the packet header for script_75, as
version negotiation packets require that to be set, otherwise script_75
will fail now when the server notices this discrepancy.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
Neil Horman
78702fb7d6 Handle the receipt of version negotiation packets 
On the client side, when we get a version negotiation packet, we need to
interrogate the supported version list from the server, and either:
1) drop the connection if we don't see a version we can work with

2) select a supported version and try the negotiation again

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
Neil Horman
bc4c7cf554 Add port version negotiation response from server 
If the server receives an Initial packet with a version number we don't
support (currently a fixed check for QUIC_VERSION_1), instead of
dropping it, respond with a version negotiation packet to the peer

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
Neil Horman
5fdd623df3 Allow packetizer to accept an arg to set protocol version 
In preparation for doing version negotiation, expose the ability to have
the packetiser for QUIC set a configured protocol version.  We only set
it to QUIC_VERSION_1 for now, but it allows for us to set different
protocols in the future.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
Neil Horman
2784112e9a Augment ossl_quic_wire_decode_pkt_hdr 
In preparation for supporting the handling of version negotiation, we
need to be able to detect why the decoding of quic header failed.
Specifically, ossl_quic_wire_decode_pkt_hdr fails if the version
provided in the header isn't QUIC_VERSION_1.  We want to keep that, as
we don't support anything else, but the server code needs to
differentiate when we fail decode because of a version problem, vs some
other more fatal malforming issue.

So add a uint64_t *fail_cause pointer that gets filled out with a
failure cause.  We only use VERSION failures right now, but we can
expand this later if needed

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25968)
 2025-02-17 11:27:33 -05:00
sashan
41fe7a2b8e SSL_inject_net_dgram() should return result of ossl_quic_demux_inject() 
This got introduced by #595288251b (QUIC APL: Ensure APL
functions use correct prologue)

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25659)
 2025-02-17 11:27:33 -05:00
Neil Horman
35f1917f2d Include RETRY_CID transport parameter when handling retried connection 
After sending a retry frame from a server, the subsequent server hello
record must include the RETRY_SCID transport parameter, as per RFC 9000:
https://datatracker.ietf.org/doc/html/rfc9000#section-7.3

Implement the encoding of said retry_source_connection_id transport
param, and fix up tests to address the impact of that change.  Test
changes amount to:
1) quicapitest needs to have its tparam test augmented such that it
   doesn't inject the retry_scid on its own, as the quic stack does it
   for the test now
2) quicapitest needs to have the ssl_trace test adjusted so the expected
   record values are reflected.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25890)
 2025-02-17 11:27:33 -05:00
Neil Horman
1c6e1e1c9c Select proper ORIG_DCID when sending server hello over quic 
When establishing a connection over quic, if the channel is established
in response to a retry request from the server, the ORIG_DCID transport
parameter must reflect the original dcid sent from the client in the
first inital packet that the server sent the retry request in response
to.

As opposed to establishing a connection without the retry request, when
address validation isn't in use, where the ORIG_DCID parameter just
represents the the dcid that the client sent.

Augment the channel creation code to select the 'right' DCID when
encoding server side transport parameters

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25890)
 2025-02-17 11:27:33 -05:00
Neil Horman
6654f8bb42 Generate initial packet keys based on new dcid for addr validation 
When using retry packets in QUIC to implement address validation, the
2nd inital packet that arrives after the server sends the retry frame
will have its CRYPTO packet encrypted using keys derived from the new
dcid, rather than the dcid in the 1st initial packet.  Update the
channel creation code to update those keys on the server so that the
CRYPTO packet is decrypted successfully

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25890)
 2025-02-17 11:27:33 -05:00
Saša Nedvědický
6ba0457c92 Implement Server Address validation using retry packets 
RFC 9000 describes a method for preforming server address validation on
QUIC using retry packets.  Based on:
https://datatracker.ietf.org/doc/html/rfc9000#section-17.2.5.2

We do the following:
1) Client sends an Initial packet without a retry token
2) Server abandons the initial packet and responds with a retry frame
   which includes a retry token and integrity tag and new SCID
3) Client send the initial packet again, updating the encryption keys
   for the connection based on the SCID sent in (2), using it as the new
   DCID, including the retry token/tag provided in (2).
4) Server validates the token in (3) and creates a new connection using
   the updated DCID from the client to generate its encryption keys

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25890)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
c4cd137047 Update QUIC related man7 pages for the added server functionality 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25834)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
417a8e8812 Remove extra FD_SET 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25532)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
0237f21e03 Add a guide for demo QUIC non-blocking server 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25532)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
6cb1b4e89e SSL_poll(): Handle blocking with no poll items 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
b7e1d375f1 poll_builder.c: Minor fixes and optimizations 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
5031f1b196 Add quic_lock() calls for functions called from poll_translate_ssl_quic() 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
44aab1ff84 Ensure WSAStartup() before calling WSASocketA() 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
0e470373ad ossl_rio_notifier_init(): Add error messages 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
89134200b8 SSL_poll(): Report result_count for failed events 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Tomas Mraz
84dbca4df0 QUIC: Immediate-Mode Polling various fixups 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
b20f557021 QUIC: Update SSL_poll documentation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
0c7063bb6f QUIC: Glossary updates 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
567a9eed65 QUIC RADIX: Use enhanced blocking support when testing 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
7b2eb52473 QUIC RADIX: Test listener polling support 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
381a2b5789 QUIC RADIX: Test new SSL_poll functionality 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
0601469dd6 QUIC MULTISTREAM TEST: Remove test that blocking SSL_poll doesn't work 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
53225c9c3d RIO: Amend SSL_poll code to correctly register blocking operations for inter-thread notification 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
f2fff144d7 QUIC POLLING: Add support for polling listeners 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
67df6bd936 RIO: Amend SSL_poll to support blocking on QUIC objects 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
caa3446eef RIO: Add poll builder to support immediate-mode polling API 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
643d149696 QUIC APL: Add support for registering blocking operations to support polling code 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
7f2adb82b1 QUIC REACTOR: Add utility for tracking recursive blocking operations 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Hugo Landau
5d3720dcb6 QUIC REACTOR: Add support for external registration of blocking operations 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25416)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
d9d4d84ceb Add demo QUIC non-blocking server 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25431)
 2025-02-17 11:27:33 -05:00
Matt Caswell
76af88a621 Use the reactor from ctx.obj for net read/write desired implementations 
The ossl_quic_get_net_write_desired() and
ossl_quic_reactor_net_read_desired() implementations can be used by
listeners. But in that case there is no ctx.qc object present. Instead we
should use the reactor from ctx.obj which will work also for a listener.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25642)
 2025-02-17 11:27:33 -05:00
Matt Caswell
034fa85ced Add a test for early ticking 
Ensure that we don't inadvertently start the connection if we call
SSL_handle_events(), or SSL_get_event_timeout() early.

This adds a test for #25054, which was originally fixed by #25069 to
ensure we haven't broken anything by the changes in the previous commit.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25452)
 2025-02-17 11:27:33 -05:00
Matt Caswell
4af6bcd69c Always tick the QUIC_ENGINE regardless of the state of a connection 
Just because one connection has not started yet, it does not mean that
we should not tick the QUIC_ENGINE. There may be other connections that do
need ticking.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25452)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
9dfacaa82a Add a guide for demo QUIC blocking server 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25361)
 2025-02-17 11:27:33 -05:00
Andrew Dinh
dad45ea769 Adds a new demo blocking QUIC server for use with the existing demo QUIC clients 
Remove util/quicserver.c

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25465)
 2025-02-17 11:27:33 -05:00
Matt Caswell
3a75cf8d9c Remove an obsolete comment 
The comment is no longer accurance so it can be removed

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25457)
 2025-02-17 11:27:33 -05:00
Matt Caswell
ac69d0649a Simplify the QUIC time override handling 
Centralise the storage of the override in the QUIC_ENGINE rather than in
the QUIC_CONNECTION. We can now set the override on any type of QUIC SSL
object as needed.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25457)
 2025-02-17 11:27:32 -05:00
Viktor Dukhovni
f23da50318 Handle a couple of NULL QUIC ctx.qc values 
Now that we also QUIC server (listener) handles, we may have a NULL quic
connection (ctx.qc), and so need to either return early or handle the
NULL `qc` gracefully.

Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25432)
 2025-02-17 11:27:32 -05:00
Alexandr Nedvedicky
73d7de128b QUIC Concurrency API: Various minor fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
54fd5e113b Minor fix for Windows 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
ccbf3f6ecb QUIC RADIX: Test domain functions as well 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
62f91f2f25 QUIC: Add basic domain flags test 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
b93fb2d177 Assorted bugfixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
89fa427504 Doc fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
269409c75b Allow use of socketpair, WSASocketA 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2c9953bbd3 Minor fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
9c1bd44f1d RIO NOTIFIER: Fix symbol usage 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2c70693e92 QUIC OBJ: Require blocking support in the domain flags to use blocking mode 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
5eecb6b619 make update 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
c4d516db6a QUIC: Update listener documentation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
3896bff051 QUIC: Add documentation on concurrency model 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2dae861fe0 QUIC: Document SSL_new_domain, etc. 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
db590923c1 QUIC APL: Refine domain flag handling 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
960b8449cb QUIC CHANNEL: Notify other threads when needed 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
fa4a8e8871 QUIC REACTOR: Allow ticks to schedule notifications of other threads 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
5dade08ed1 QUIC ENGINE: Notify when ticking 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1c89357d75 QUIC REACTOR: Inter-thread notification 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
ae26f1eed6 QUIC APL: Default domain flags 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
6bc47aa65f QUIC REACTOR: Integrate RIO NOTIFIER 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
14516cd5a4 RIO: Add OS notifier 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
5a6898db3a QUIC APL: Use domain flag to determine thread assisted mode 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
50c7796267 QUIC APL: Add support for configuring domain flags 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
f75b3d1db6 QUIC APL: Add QUIC Domain SSL Object: Implementation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Hugo Landau
907759818e QUIC APL: Add QUIC Domain SSL Object: Basic Definitions 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24971)
 2025-02-17 11:27:32 -05:00
Jean-Frederic Clere
a31dfb0ee6 ossl-nghttp3-demo-server.c: Fix compatibility with various clients 
Fixes openssl/project#752

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24946)
 2025-02-17 11:27:32 -05:00
Jean-Frederic Clere
73977a0424 Add a demo HTTP3 server using the quic server support and nghttp3 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24749)
 2025-02-17 11:27:32 -05:00
Hugo Landau
362cc00d6a QUIC Polling Design: Fix nits 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23455)
 2025-02-17 11:27:32 -05:00
Hugo Landau
51771dad69 QUIC Polling Design Document: Rename OSSL_ -> SSL_ for consistency 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23455)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1be93781e8 QUIC Polling Design: Move around sections a bit 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23455)
 2025-02-17 11:27:32 -05:00
Hugo Landau
e0a66263c2 QUIC Polling Design: Add discussion/rethink of event types 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23455)
 2025-02-17 11:27:32 -05:00
Hugo Landau
0288567452 QUIC Polling Design: minor fixups 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23455)
 2025-02-17 11:27:32 -05:00
Hugo Landau
e6f062601b Minor updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
8b4b5048ee Minor fixes and hardening 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
20eb1b656b QUIC Server Demo: Use IPv4 only 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
6330a78638 Copyright header 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
e88f03f193 QUIC APL: Make QCTX comments clearer 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
b35712db6c Minor doc fix 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
0723a3ac0c Minor update 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
a55d8b8b71 QUIC APL: Connection acceptance is an I/O operation 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
87d474660c QUIC APL: Support SSL_inject_net_dgram for listeners 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
640a32afcf QUIC: Clarify SSL_new_listener API in docs 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2176e0467e QUIC APL: When creating a default XSO, no further streams can arrive after connection terminastion 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
8df5b725ef Fix markdown 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
05e0eae202 QUIC APL: Ensure incoming stream data can be drained after connection closure 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
368fc8d486 QUIC: Add demo for QUIC server usage 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
8a6bb6b639 QUIC APL: Revise SSL_pending and SSL_has_pending handling for s_client compat 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
f1ade90a66 QUIC PORT: Ensure reactor waits for listening port correctly 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
390403abf8 QUIC REACTOR: Ensure no assertion failure or deadlock if called when unable to wait 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
01b151fbca QUIC RADIX TEST: Ensure connection acceptance does not block 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1e73a3ca9f QUIC APL: Support blocking connection acceptance 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
60c9ce78f5 QUIC APL: Unify event handling mode into QUIC_OBJ 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
fdc13a9e4e QUIC APL: Unify blocking mode handling for all object types 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
38df4b1976 QUIC APL: Ensure APL functions use correct prologue 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
67d43a7af5 QUIC APL: Make prologue function names more descriptive 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
8110737e42 QUIC APL: Refactor API call prologue code 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24037)
 2025-02-17 11:27:32 -05:00
Hugo Landau
cbd10ff618 QUIC RADIX: Fix simple_conn test 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24064)
 2025-02-17 11:27:32 -05:00
Hugo Landau
458018f3e6 Minor fix 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23995)
 2025-02-17 11:27:32 -05:00
Hugo Landau
bf8ce68c33 QUIC APL: Fix default stream creation on server side 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23995)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2399678797 QUIC APL: Revise SSL_pending and SSL_has_pending handling for s_client compat 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23995)
 2025-02-17 11:27:32 -05:00
Hugo Landau
17727841d1 QUIC: Avoid ticking before a connection is established 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23995)
 2025-02-17 11:27:32 -05:00
Hugo Landau
a3b1982e8a Fix nit 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
eda445e13d Minor updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
03ca681728 Add README for QUIC demos directory 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
fe1029d16b Minor updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2b21d3ac18 Amend README 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
05f0960e1f QUIC RADIX: Add keylogging support 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
cbfc09d994 QUIC RADIX: Minor fixes 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
646c20d034 QUIC RADIX TEST: Quiet warnings about uninitialized variables 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
08c5d856b6 QUIC RADIX: Add test of multithreading functionality 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
dc2bff5e58 QUIC RADIX: Add README 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
4a2d5fe812 QUIC RADIX: Add RADIX test framework implementation 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
ea236623c8 testutil: Allow overriding output BIOs thread-locally 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
c12ae88e10 QUIC RADIX: Add recipe 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
eef93d24ee QUIC RADIX: Add build configuration 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
57496767a8 test/build.info: Ensure QUIC tests are properly disabled in no-quic builds 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23487)
 2025-02-17 11:27:32 -05:00
Hugo Landau
48db230a88 Minor fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
04cec3d65e Minor doc fix 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
68537fceae QUIC APL: Avoid having a mutex variable where not needed 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
63984f276c QUIC OBJ: Use QUIC_OBJ pointer for parent references 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
477ff82236 Post-rebase fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
c69ce7fcf1 QUIC APL: Fix bug around default XSO handling on server side 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
f4cfa1b9cc QUIC APL: Fix refcounting for listeners 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
99e4a1e3ce QUIC PORT: Allow QUIC_PORT to throw away incoming connections 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
88804f3181 QUIC APL: Fix server API bugs discovered during test 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
e3ba554d73 QUIC APL: Implement SSL_get0_listener 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
2e582648c5 QUIC APL: Free listeners correctly 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
882c77e93e QUIC APL: Fix QUIC_TLS free order 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
d2ee7ceff0 Minor fix to BIO refcount handling 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
d1e81ca94c Minor fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
7efebeb172 QUIC APL: Add TODOs for unfinished listener APIs 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
56b59e7837 QUIC: Add manpage for listener API 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
745a779fb2 make update 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1aea7a2429 QUIC APL: Refactor block_until_pred 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
15f9df40ff QUIC APL: Implement base listener API, move addressing mode handling into PORT 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
3a9cedc20f QUIC APL: Rework QCTX to support listener calls 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
a68287adeb QUIC APL: Add skeleton listener API methods 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
b67be72a5d QUIC APL: Add skeleton listener API 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
6d1d52cef5 QUIC APL: Make use of QUIC_OBJ infrastructure 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
bf55326752 libssl: Move SSL object unwrapping macros to separate header 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1137f3f9ae QUIC APL: Introduce the QUIC_OBJ base type and infrastructure 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
e0ffd21e22 QUIC APL: Introduce QUIC listener SSL object type (QLSO) 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)
 2025-02-17 11:27:32 -05:00
Hugo Landau
ce1315140b Fix nit 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
19c55d559f Fix nit 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
bf52454f2d Fix nit 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
1599defd74 Updates to polling design document 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
9b149bb201 QUIC Polling Design Document: Add TOC 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
332cc89bb8 QUIC: Update glossary 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
c996bdcd91 QUIC Polling Design Document 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:32 -05:00
Hugo Landau
4e63896f5a QUIC: Minor updates to server API design document 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:31 -05:00
Hugo Landau
f07ba7bccd QUIC: Server API Design Document 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21795)
 2025-02-17 11:27:31 -05:00
Dmitry Belyavskiy
340f50b01f Remove redundant define 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26755)
 2025-02-17 16:38:08 +01:00
Viktor Dukhovni
22ab2a72d4 Consolidate ML-KEM and ML-DSA codecs 
These previously duplicated some code and structures, now shared.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26764)
 2025-02-17 15:14:10 +11:00
Viktor Dukhovni
594cef49b4 Accessors for the IANA signature scheme name 
This is the official name of the signature algorithm(s) used by the peer
and/or local end of the connection, and should be available, e.g. for
logging.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26738)
 2025-02-17 15:08:25 +11:00
Viktor Dukhovni
3d57bbb8ca Add ML-KEM long names 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26763)
 2025-02-17 14:58:05 +11:00
Neil Horman
7d284560a0 Don't use __ATOMIC_ACQ_REL on older compilers 
Older compilers don't always support __ATOMIC_ACQ_REL, use a lock where
they don't

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/26747)
 2025-02-16 15:09:03 -05:00
Viktor Dukhovni
afc64c240f Address non-FP coverity nits 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26765)
 2025-02-16 14:48:01 -05:00
Simo Sorce
fc00d9b7b1 Add additional EVP_SKEY helpers 
EVP_SKEY_is_a() allows to check if a key is of a specific type.
EVP_SKEY_to_provider() provides an easy way to move a key to a
different provider.

Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:31 +01:00
Simo Sorce
71debb7b84 Allow import of unknown keys via generic type 
This allows to use SKEY even w/o a specific skey managment available,
however it bears the risk of allowing users to mispell the key type
and not see the error of their ways until they expect a specific
provider to pick this up and fail.

Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:31 +01:00
Dmitry Belyavskiy
df93d1327a skeyutl command line utility 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:31 +01:00
Dmitry Belyavskiy
00bdee8974 Opaque keys support for the openssl command line 
Support EVP_SKEY object for the `enc` command.
Support EVP_SKEYMGMT for the `list` command.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy
759570bfed Implement EVP_MAC_init_SKEY 
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Simo Sorce
787a083d42 Add skeymgmt helper to fetch from a provider 
This allows to fetch efficiently directly from the same provider that can
handle the EVP_SKEY at hand.

Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Simo Sorce
5c16da0c18 Add generic secret skeymgmt provider, skey abstraction and default skeymgmt 
This commits adds an actual skey wrapper structure and skeymgmt
implementation for the default provider

This allows to use fallbacks for any SKEY operation,
and to use it for keys that do not have a specific purpose and
cipher-suite associated to it.

Add a test with a key type that does not have skey support (DES),
to show that the fallback works.

Add raw skey test

Signed-off-by: Simo Sorce <simo@redhat.com>
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy
b9d919f697 EVP_SKEY documentation 
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy
9422ab6a7e EVP_SKEY tests 
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy
d46e010cd2 EVP_SKEY implementation for EVP_CIPHER 
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy
45f9d271cd Design document of using opaque object as symmetric key 
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26753)
 2025-02-15 18:51:30 +01:00
Andrew Dinh
c0cf783178 Add an initial ML-DSA fuzzer 
Add an initial version of an ML-DSA fuzzer.  Exercises various ML-DSA
appropriate APIs. Currently it is able to randomly:

1. Attempt to create raw public private keys of various valid and invalid sizes
2. Generate legitimate keys of various sizes using the keygen api
3. Perform sign/verify operations using real generated keys
4. Perform digest sign/verify operations using real generated keys
5. Do an export and import of a key using todata/fromdata
6. Do a comparison of two equal and unequal keys

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26685)
 2025-02-15 11:13:38 -05:00
Dmitry Belyavskiy
4ca80d3941 When we try to get a group, we need session to be valid 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26722)
 2025-02-14 18:24:19 +01:00
slontis
7cf5300e6b dgst commandline support for one shot signing algorithms 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26697)
 2025-02-14 18:22:01 +01:00
slontis
bd8954bfe5 ML-DSA: Change ossl_ml_dsa_key_public_from_private() to check that the 
decoded value of t0 matches the calculated value of t0.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26681)
 2025-02-14 18:02:28 +01:00
Pauli
51ca035abb doc: fix typo/paste error 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26650)
 2025-02-14 17:49:53 +01:00
Viktor Dukhovni
a39dc27c25 Log name of provided peer temp keys 
Log the peer's temp key name when it is from a provider.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26734)
 2025-02-14 17:14:53 +01:00
Pauli
21f92ecf7c rand: avoid property query manipulations 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
9fef9b194c sslapitest: include hybrid KEM tests with FIPS 
Co-Authored-By: Tomas Mraz <tomas@openssl.org>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
7c45e7a6c8 fips: include ML-KEM capabilities in FIPS provider 
Co-Authored-By: Tomas Mraz <tomas@openssl.org>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
2e898497a6 fips: add hybrid KEM algorithms to the FIPS provider 
Co-Authored-By: Tomas Mraz <tomas@openssl.org>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
b6c5342613 evp: add additional functions for FIPS internal use to support hybrids KEMs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
53e3a54b60 evp: include one shot keygen functions for internal FIPS use 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
27b597113f mlkem: include hybrid KEM algs in FIPS provider 
Co-Authored-By: Tomas Mraz <tomas@openssl.org>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
765b2b0857 mlkem: include hybrid KEYMGMT algs in FIPS provider 
Co-Authored-By: Tomas Mraz <tomas@openssl.org>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Pauli
236d5d8f72 fips: FIPS ignores property queries for internal algorithm fetches 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26714)
 2025-02-14 17:08:42 +01:00
Viktor Dukhovni
0554bddd4f Refactor squeezing out empty tuples 
This is more efficient if multiple empty tuples are present, and may
also help to avoid Coverify false positives.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26732)
 2025-02-15 02:08:49 +11:00
Sebastian Andrzej Siewior
c71c65b922 SPARC assembly: Don't file aes-cbc on T4 with small sizes. 
The "openssl speed -testmode -seconds 1 -bytes 1 aes-128-cbc" test
revealed that the assembly code is crashing if length is less than 16.
The code shifts the provided length by 4 and than subtracts one until
the length hits zero. If it was already zero then it underflows the
counter and continues until it segfaults on reading or writing.

Replace the check against 0 with less than 15.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25637)
 2025-02-14 11:42:35 +01:00
Xi Ruoyao
f48c14e94e LoongArch: Fix output file name detection for Perl scripts 
We were using the first (or second) argument containing a '.' as the
output name file, but it may be incorrect as -march=la64v1.0 may be in
the command line.  If the builder specifies -march=la64v1.0 in the
CFLAGS, the script will write to a file named "-march=la64v1.0" and
cause a build error with cryptic message:

    ld: crypto/pem/loader_attic-dso-pvkfmt.o: in function `i2b_PVK':
    .../openssl-3.4.1/crypto/pem/pvkfmt.c:1070:(.text+0x11a8): undefined reference to `OPENSSL_cleanse'

Adapt the approach of ARM and RISC-V (they have similar flags like
-march=v8.1-a or -misa-spec=2.2) to fix the issue.

Signed-off-by: Xi Ruoyao <xry111@xry111.site>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26717)
 2025-02-14 11:35:23 +01:00
Tomas Mraz
0575755eaf ssl_test.c: Allow using DHE with TLS-1.2 and older versions 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26715)
 2025-02-14 10:50:59 +01:00
Tomas Mraz
c59f5f1210 Make test_ssl_new execute tests with fips provider again 
This has regressed with
https://github.com/openssl/openssl/pull/24799

The test configs have to be generated differently based
on the fips provider version.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26715)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
6ab87724e6 Left over doc TODOs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26715)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
cedc5bcce2 Post-merge make update 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26715)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
b3dd681f07 Two more private key checks. 
- When a PKCS#8 has both seed and key cross check the implicit
  rejection value |z|

- When an import (EVP_PKEY_fromdata call) provides both a private
  and public key, fail if the redundant public key does not match
  the copy in the private key.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26656)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
2ea9903c16 Reject import of private keys that fail PCT 
- Also added a provider "validate" method that wraps the PCT test.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26656)
 2025-02-14 10:50:59 +01:00
Neil Horman
f0be0521d1 Update corpora to include ml-kem seed corpus 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26657)
 2025-02-14 10:50:59 +01:00
Neil Horman
f440e816d0 Add an inital ML-KEM fuzzer 
Add an inital version of an ML-KEM fuzzer.  Exercises various ML-KEM
appropriate apis, as a fuzzer does.  Currently it is able to randomly:

1) Attempt to create raw public private keys of various valid and
   invalid sizes
2) Generate legitimate keys of various sizes using the keygen api

3) Preform encap/decap operations using real generated keys

4) Do a shared secret derivation using 2 keys

5) Do an export and import of a key using todata/fromdata

6) Do a comparison of two equal and unequal keys

Its not much to start, but it should be fairly extensible

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26657)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
096fde92e7 ASN.1 format tagging seed, key now octet string 
- The main ASN.1 private key syntax is the one from Russ Housley's post
  on the LAMPS list, subsequently amended to tag the seed instead of the
  key (each of the three parameter sets will have a fixed size for the
  `expandedKey`):

    ML-DSA-PrivateKey ::= CHOICE {
      seed [0] IMPLICIT OCTET STRING SIZE (64),
      expandedKey OCTET STRING SIZE (1632 | 2400 | 3168)
      both SEQUENCE {
        seed OCTET STRING SIZE (64),
        expandedKey OCTET STRING SIZE (1632 | 2400 | 3168) } }

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26639)
 2025-02-14 10:50:59 +01:00
Viktor Dukhovni
0fb5a78acd More polish and renamed codec tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26569)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
5b2d996f91 Implement seed/key preference when decoding 
- Moved the codec code out of `ml_kem.c` into its own file in
  the provider tree.  Will be easier to share some code with
  ML-DSA, and possible to use PROV_CTX, to do config lookups
  directly in the functions doing the work.

- Update and fixes of the EVP_PKEY-ML-KEM(8) documentation, which
  had accumulated some stale/inaccurate material, and needed new
  text for the "prefer_seed" parameter.

- Test the "prefer_seed=no" behaviour.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26569)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
cc5403f33a Fix code comment typo 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26569)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
d70edce5bc Check ML-KEM text encoding 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26569)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
fc225d9fb7 Test ML-KEM in FIPS module only when ML-KEM is enabled 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26569)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
1811f990f9 ML-KEM encoder and decoder tests 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26512)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
318994a121 ASN.1 ML-KEM private key format 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26512)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
869903c07c Improved import and export 
- On import, if a seed is provided, the keys are regenerated.

- The seed is exported as a separate "seed" parameter, when available.
  The "ml-kem.retain_seed" parameter is also exported, when false.

- The seed is optionally dropped after key generation.
    * When the "ml-kem.retain_seed" keygen parameter is set to zero.
    * When the "ml-kem.retain_seed" keygen parameter is not set to 1,
      and the "ml-kem.retain_seed" provider config property is set
      explictly false.

- The exported private key parameter "priv" is always the FIPS 203 |dk|.

- Private key decoding from PKCS#8 produces a transient "seed-only" form
  of the key, in which "retain_seed" is set to false when the
  "ml-kem.retain_seed" provider config property is set explictly false.
  The full key is generated during "load" and the seed is retained
  or not as specified.

- Import honours the "ml-kem.retain_seed" parameter when specified, or
  otherwise honours the provider's "ml-kem.retain_seed" property.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26512)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
9a79d4088f Zeroise temporary secrets while doing ML-KEM 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26456)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
003309c376 ML-KEM implementation cleanup/speedup 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26341)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
b818a99839 Encoders and Decoders for ML-KEM 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26341)
 2025-02-14 10:50:58 +01:00
Tomas Mraz
4a377f04b2 Temporarily disable oqsprovider testing 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26328)
 2025-02-14 10:50:58 +01:00
Tomas Mraz
9fdb2a0c2d libssl: Accept any key management which implements the group 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26328)
 2025-02-14 10:50:58 +01:00
Tomas Mraz
8dbe1adbd1 Update oqs-provider to the latest commit 
The oqs-provider testing is fixed so it doesn't fetch OpenSSL
implementations during its testing inadvertently.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26328)
 2025-02-14 10:50:58 +01:00
Tomas Mraz
ba20b3adee Provide alias names for ML-KEM algorithms without dashes 
Fixes #26326

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26328)
 2025-02-14 10:50:58 +01:00
Pauli
16870d9a90 test: add fipsinstall corruption tests for KEMs 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
d4f0bd379f fips: add pairwise consistency test for ML-KEM key generation 
This is mandated by FIPS 140-3 IG 10.3.A resolution 14

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
073b9f2b1e self_test: add ML-KEM test description 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
96b89c6adb doc: update documentation now that ML-KEM is in the FIPS provider 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
302fdaaf35 doc: remove ML-KEM line because it doesn't have an indicator associated with it 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
b8835e874d test: run ML-KEM tests for both default and FIPS providers 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
3c9b0ca13c tests: run ML-KEM tests in FIPS builds too 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
ff40a08dee fips: add ML-KEM to the FIPS provider 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
7057138f0f fips: defined for ML-KEM CASTs 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
289c168996 update build infrastructure for ML-KEM in the FIPS provider 
Also avoid a file name conflict when adding ML-KEM to the FIPS provider.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26338)
 2025-02-14 10:50:58 +01:00
Pauli
5510d96f82 Clear param array to ensure it's initialised properly 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26339)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
4b1c73d2dd ML-KEM hybrids for TLS 
- When used as KEMs in TLS the ECDHE algorithms are NOT subjected to
  HPKE Extract/Expand key derivation.  Instead the TLS HKDF is used
  as usual.

- Consequently these KEMs are just the usual ECDHE key exchange
  operations, be it with the encap ECDH private key unavoidably
  ephemeral.

- A new "MLX" KEM provider is added that supports four hybrids of EC/ECX
  DH with ML-KEM:

    * ML-KEM-768 + X25519
    * ML-KEM-1024 + X448
    * P-256 + ML-KEM-768
    * P-384 + ML-KEM-1024

- Support listing of implemented TLS groups.

  The SSL_CTX_get0_implemented_groups() function and new
  `openssl list -tls-groups` and `openssl list -all-tls-groups`
  commands make it possible to determine which groups are
  implemented by the SSL library for a particular TLS version
  or range of versions matching an SSL_CTX.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26220)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
95d764a044 Prepare to detect side-channels in compiled ML-KEM code 
Loosely based on similar code in BoringSSL.

Added the valgrind macros necessary to mark secret inputs as uninitialised on
entry to the ML-KEM keygen, encap and decap functions.  The inputs and outputs
are then untagged before control returns to the caller, where, at least in the
case of tests and protocols that check whether the derived keys succeeded in
decoding a key-confirmation message, there will at some point be a branch based
on the *content* of the compute shared secret.

When a build is configured with `-DOPENSSL_CONSTANT_TIME_VALIDATION`, and
various tests that use ML-KEM are run under:

    $ valgrind --tool=memcheck --error-exitcode=1 --exit-on-first-error=yes cmd [args]

any internal secret-data-dependent branches added by a mis-optimising
compiler, or inadvertently introduced into the source code would cause
the tests to fail, exposing the side channel.

Since the side-channels are liable to depend on the compiler and
selected optimisation flags, tests would need to cover a few combinations.

    * clang vs. gcc
    * debug builds
    * default builds
    * -O2
    * -O3 -fno-vectorise (a problem with clang in "clangover")
    * -Os (was a problem with clang in "clangover")
    ...

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26270)
 2025-02-14 10:50:58 +01:00
Viktor Dukhovni
e04a604d0d Remaining batch of ML-KEM-related doc updates 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26217)
 2025-02-14 10:50:57 +01:00
Viktor Dukhovni
7772dbb17c Initial batch of ML-KEM doc updates. 
With the soon-to-be-merged ML-KEM #26172 as the merge base.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26217)
 2025-02-14 10:50:57 +01:00
Viktor Dukhovni
63e9a3b1f3 Fix code and docs of pkeyutl en/decapsulation 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26281)
 2025-02-14 10:50:57 +01:00
Viktor Dukhovni
653fc2189d ML-KEM libcrypto implementation polish 
* Core ML_KEM constants in new <openssl/ml_kem.h>

* Renamed variant ordinals to ML_KEM_<bits>_VARIANT, freeing
  up the unadorned ML_KEM_<bits> names.

* Fewer/cleaner macros in <crypto/ml_kem.h>

* Fewer/cleaner macros for setting up the ML_KEM_VINFO table.

* Made (d, z) be separate inputs to the now single key generation
  function.  Both or neither have to be NULL.  This supports potential
  future callers that store them in a different order, or in separate
  buffers.

    - Random values are chosen when both are NULL, we never return the
      generated seeds, rather we may, when/if (d, z) private key support
      is added, store these in the expanded key, and make them available
      for import/export.

* No need for a stand-by keygen encoded public key buffer when the
  caller does not provide one (will ask for it later if needed).
  New `hash_h_pubkey` function can compute the public hash from
  the expanded form in constant space (384 bytes for 12-bit encoded
  scalar).

* Simplified code in `scalar_mult`.

* New `scalar_mult_add` adds the product to an existing scalar.
  Used in new `matrix_mult_transpose_add` replacing `matrix_mult_transpose`.

* Unrolled loop in `encode_12`.

* Folded decompression and inverse NTT into vecode_decode, the three
  were always used together.

* Folded inverse NTT into former `matrix_mult` as `matrix_mult_intt`,
  always used together.

* New gencbd_vector_ntt combines CBD vector generation with inverse NTT
  in one pass.

* All this makes for more readable code in `decrypt_cpa` and especially
  `genkey()`, which no longer requires caller-allocated variant-specific
  temporary storage (just a single EVP_MD_CTX is still needed).

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26236)
 2025-02-14 10:50:57 +01:00
Viktor Dukhovni
b99e1a9736 Polish ML-KEM kem provider. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26236)
 2025-02-14 10:50:57 +01:00
Viktor Dukhovni
d2136d9e73 Multi-variant ML-KEM 
This introduces support for ML-KEM-512 and ML-KEM-1024 using the same
underlying implementation parameterised by a few macros for the
associated types and constants.

KAT tests are added for ML-KEM 512 and 1024, to complement the previous
tests for ML-KEM-768.

MLKEM{512,768,1024} TLS "group" codepoints are updated to match the
final IANA assigments and to make the additional KEMs known to the TLS
layer.

The pure-QC MLKEMs are not in the default list of supported groups, and
need to be explicitly enabled by the application.  Future work will
introduce support for hybrids, and for more fine-grained policy of
which keyshares a client should send by default, and when a server
should request (HRR) a new mutually-supported group that was not
sent.

Tests for ML-KEM key exchange added to sslapitest to make sure that our
TLS client MLKEM{512,768,1024} implementations interoperate with our TLS
server, and that MLKEM* are not negotiated in TLS 1.2.

Tests also added to excercise non-derandomised ML-KEM APIs, both
directly (bypassing the provider layer), and through the generic EVP KEM
API (exercising the provider).  These make sure that RNG input is used
correctly (KAT tests bypass the RNG by specifying seeds).

The API interface to the provider takes an "const ML_KEM_VINFO" pointer,
(obtained from ossl_ml_kem_get_vinfo()).  This checks input and output
buffer sizes before passing control to internal code that assumes
correctly sized (for each variant) buffers.

The original BoringSSL API was refactored to eliminate the opaque
public/private key structure wrappers, since these structures are an
internal detail between libcrypto and the provider, they are not part of
the public (EVP) API.

New "clangover" counter-measures added, refined with much appreciated
input from David Benjamin (Chromium).

The internal steps of "encrypt_cpa" were reordered to reduce the
working-set size of the algorithm, now needs space for just two
temporary "vectors" rather than three.  The "decap" function now process
the decrypted message in one call, rather than three separate calls to
scalar_decode_1, scalar_decompress and scalar_add.

Some loops were unrolled, improving performance of en/decapsulate
(pre-expanded vectors and matrix) by around 5%.

To handle, however unlikely, the SHA3 primitives not behaving like
"pure" functions and failing, the implementation of `decap` was modifed:

- To use the KDF to compute the Fujisaki-Okamoto (FO) failure secret
  first thing, and if that fails, bail out returning an error, a shared
  secret is still returned at random from the RNG, but it is OK for the
  caller to not use it.

- If any of the subsequently used hash primitives fail, use the computed
  FO failure secret (OK, despite no longer constant-time) and return
  success (otherwise the RNG would replace the result).

- We quite reasonably assume that chosen-ciphertext attacks (of the
  correct length) cannot cause hash functions to fail in a manner the
  depends on the private key content.

Support for ML-KEM-512 required adding a centered binomial distribution
helper function to deal with η_1 == 3 in just that variant.

Some additional comments were added to highlight how the code relates to
the ML-KEM specification in FIPS 203.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26172)
 2025-02-14 10:50:57 +01:00
Michael Baentsch
78df1c1f61 Initial ML-KEM documentation 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26037)
 2025-02-14 10:50:57 +01:00
Andrew Dinh
42436eb53e Add ML-KEM-768 KATs from BoringSSL 
Add KATs for ML-KEM-768 under CCLA from https://boringssl.googlesource.com/boringssl/

These KATs test key generation, encapsulation, and decapsulation for the
ML-KEM-768 algorithm.

Relevant notes:
- Added functionality to the ML-KEM key management to export/import. These may not
  be fully implemented yet (see openssl/openssl#25885)
- Exposed some more low-level ML-KEM API's to the provider implementation to
  allow for deterministic encapsulation/key generation
- Actually run 'mlkem_internal_test' with `make test`

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25938)
 2025-02-14 10:50:57 +01:00
Michael Baentsch
96a079a03f Add ML-KEM-768 implementation 
Based on code from BoringSSL covered under Google CCLA
Original code at https://boringssl.googlesource.com/boringssl/+/HEAD/crypto/mlkem

- VSCode automatic formatting (andrewd@openssl.org)
- Just do some basic formatting to make diffs easier to read later: convert
  from 2 to 4 spaces, add newlines after function declarations, and move
  function open curly brace to new line (andrewd@openssl.org)
- Move variable init to beginning of each function (andrewd@openssl.org)
- Replace CBB API
- Fixing up constants and parameter lists
- Replace BORINGSSL_keccak calls with EVP calls
- Added library symbols and low-level test case
- Switch boringssl constant time routines for OpenSSL ones
- Data type assertion and negative test added
- Moved mlkem.h to include/crypto
- Changed function naming to be in line with ossl convention
- Remove Google license terms based on CCLA
- Add constant_time_lt_32
- Convert asserts to ossl_asserts where possible
- Add bssl keccak, pubK recreation, formatting
- Add provider interface to utilize mlkem768 code enabling TLS1.3 use
- Revert to OpenSSL DigestXOF
- Use EVP_MD_xof() to determine digest finalisation (pauli@openssl.org)
- Change APIs to return error codes; reference new IANA number; move static asserts
  to one place
- Remove boringssl keccak for good
- Fix coding style and return value checks
- ANSI C compatibility changes
- Remove static cache objects
- All internal retval functions used leading to some new retval functions

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25848)
 2025-02-14 10:47:46 +01:00
Viktor Dukhovni
605b82d7ee Post-merge make update 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26715)
 2025-02-14 10:46:04 +01:00
Viktor Dukhovni
9a6bbf6169 Ensure we accept the IANA name for sigalgs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
slontis
7d2d153f9d ML-DSA: Add TLS certificate test 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
slontis
dd1d010130 MLDSA: Fix no-ml-dsa configure option. 
Added to 'bulk' group and CI

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
Matt Caswell
cc699ace92 Drop the session and PSK test from the clienthellotest 
This test doesn't really give us much that the other tests don't already
achieve. Added to that the ClientHello is nearly too long for it to work
reliably. Small changes in the ClientHello length make this test break.
So this test is too brittle with little value - so we drop it.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
Matt Caswell
a0fc1ff348 Teach SSL_trace() about ML-DSA 
Ensure the ML-DSA based sigalgs are recognised by SSL_trace()
Also ensure the test_ssl_trace test passes correctly.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
slontis
36f10925ff ML-DSA: Add TLS-SIGALG capability to support ML-DSA signatures 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26654)
 2025-02-14 10:46:04 +01:00
Pauli
6797e02907 ml-dsa test: update ML-DSA key generation tests 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
fb15378fe7 ml-dsa test: update ML-DSA signature verification tests to cover μ inputs 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
4e94dc07a9 ml-dsa test: update ML-DSA signature generation tests to cover μ inputs 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
7b95d20d48 test: update the ACVP test data parser to include tests that use μ 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
55738c1520 ml-dsa: allow signature operations to be provided a μ value 
The μ value replaces the message and avoids some of the preliminary
processes.  This is part of FIPS 204.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
e2323b1a13 params: add OSSL_SIGNATURE_PARAM_MU to param names 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Pauli
e894887d6c doc: document OSSL_SIGNATURE_PARAM_MU for ML-DSA 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26637)
 2025-02-14 10:46:04 +01:00
Viktor Dukhovni
edb3824604 Fix docs/comments with ASN.1 private key syntax 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26674)
 2025-02-14 10:46:04 +01:00
Viktor Dukhovni
8cc7ebf6fe Reject private keys with an incorrect pk hash 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26674)
 2025-02-14 10:46:04 +01:00
Viktor Dukhovni
3138976041 Make the ML-DSA seed gettable as documented 
- Also fix the get_params keymgmt function to always return what's
  available.  Requested, but unavailable, parameters are simply left
  unmodified.  It is not an error to request more than is present.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26674)
 2025-02-14 10:46:04 +01:00
Viktor Dukhovni
5421423ef9 Flexible encoders for ML-DSA 
- Same UX as ML-KEM.  The main ASN.1 private key syntax is the one from
  Russ Housley's post on the LAMPS list, subsequently amended to tag the
  seed instead of the key (each of the three parameter sets will have a
  fixed size for the `expandedKey`):

    ML-DSA-PrivateKey ::= CHOICE {
      seed [0] IMPLICIT OCTET STRING SIZE (32),
      expandedKey OCTET STRING SIZE (2560 | 4032 | 4896)
      both SEQUENCE {
        seed OCTET STRING SIZE (32),
        expandedKey OCTET STRING SIZE (2560 | 4032 | 4896) } }

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26638)
 2025-02-14 10:46:04 +01:00
slontis
1036be4384 ML_DSA: Make apps.c do_X509_REQ_verify() call work correctly. 
- Added sigid_algs for ML_DSA such that OBJ_find_sigid_algs() works.
- OBJ_sn2nid() was also being called, so the SN form of ML_DSA
  algorithms needed to be added to the provider dispatch tables.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26636)
 2025-02-14 10:46:04 +01:00
Pauli
f207938711 endecoders: make ML-KEM endecoders have fips=yes property 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
036ac183ab doc: ML-DSA is in the FIPS provider too, so update docs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
f56dc1f968 test: update endecode test in light of ML-DSA being in the FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
756527b89c ml-dsa(fips): add ML-DSA key generation self test 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
cd430bf5da ml-dsa(fips): add power up signature self tests for ML-DSA-65 
This added self tests for ML-DSA.  IG 10.3.A.15 requires known answer
tests for both signing and verify.  This adds them.

The signature generation is constructed to encounter all three of the rejection
loop tests that are relevant for ML-DSA-65.  The message has been generated
so that:

    * it fails the z_max rejection test on iteration one
    * it fails the r0_max rejection test on iteration two
    * it fails the h_ones rejection test on iteration three
    * it successfully generates the signature on iteration four

It is thus an optimal self test in terms of iterations and coverage.

Key generation self tests will be dealt with separately.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
63282ea4ac ml-dsa: document self test names 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
2b6dd88645 ml-dsa: add FIPS self test macro 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
521f2c284f test: run ML-DSA tests on FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
519814602b ml-dsa: add PCT for FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
a8956e22d9 ml-dsa: add to FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
29d14eeb2e ml-dsa: add more to internal header 
The ossl_ml_dsa_key_get0_libctx() and the various size macros are better in the intneral header

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
3e914a8a7a fips: build ML-DSA for FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
f8dc008254 fips: build ML-DSA for FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
01222cfadf build: fix copy/paste mistake 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
Pauli
a437ba2c08 Add ML-DSA to the FIPS provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26548)
 2025-02-14 10:46:04 +01:00
slontis
1cacc56137 ML-DSA Add digestsign tests - The digest must be NULL 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26575)
 2025-02-14 10:46:04 +01:00
slontis
808fccb721 ML_DSA Add support for generation of X509 certificates using the openssl 
commandline.

In order to support this gettables are required in both the key and
signature.:

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26575)
 2025-02-14 10:46:04 +01:00
slontis
c83e6c0a2c ML-DSA Updates to encoders required because of changes on the master 
branch.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26575)
 2025-02-14 10:46:03 +01:00
slontis
d9ffc11939 Add ML_DSA encoders 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26575)
 2025-02-14 10:46:03 +01:00
Pauli
aebcb3658f ml-dsa: avoid param builder 
Using param builder consumes more resources and it is only beneficial
when dealing with bignums.  Directly using the param helpers is a better
alternative.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26529)
 2025-02-14 10:46:03 +01:00
slontis
30b6650e1d ML-DSA: coverage testing fixups 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26505)
 2025-02-14 10:46:03 +01:00
slontis
d711ea967d ML-DSA Add coverage tests 
Also remove some ACVP test data from ml_dsa.inc since this is now
also done using evp_test.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26505)
 2025-02-14 10:46:03 +01:00
slontis
2ca319684c Add ML-DSA design document. 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26400)
 2025-02-14 10:46:03 +01:00
slontis
6184259849 Add ML-DSA documentation 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26400)
 2025-02-14 10:46:03 +01:00
slontis
5a1caef900 ML-DSA encoder fixups 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26483)
 2025-02-14 10:46:03 +01:00
slontis
87728deddf ML-DSA: Add python utility used to parse ACVP test data. 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
aabb69b8ba ML-DSA: Fix endian issue in ossl_ml_dsa_poly_sample_in_ball(). 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
f92855441f ML-DSA: Add evp_test support for ML-DSA ACVP test vectors. 
The evp_test line buffer was increased to 32K to deal with the large
lines required for PQ messages and signatures.
The test data files were generated by parsing AVCP test files using
a python script.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
c848506cd4 ML-DSA: Add support for dup. 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
2cb4b0c781 ML_DSA: Fix partially uninitialised hint buffer. 
The encoded hint data consists of omega + k bytes.
The bytes at the end of omega section of the buffer may be 0,
so the buffer must be cleared initially.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
df231a88ab Add ML_DSA encoders 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26451)
 2025-02-14 10:46:03 +01:00
slontis
fcffbbe192 ML-DSA fixups 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26127)
 2025-02-14 10:46:03 +01:00
Viktor Dukhovni
a2391f3aa5 Add ML-DSA-44 and ML-DSA-87, fix endian issues & add fixups 
- Make data encoding work on big-endian systems.

- Fix some ML-DSA-44 specific bugs related to w1-vector bits
  per-coefficient, overall size and high-bits rounding.

- Use "do { ... } while (pointer < end)" style consistently.

- Drop redundant reference counting of provided keys.

- Add parameter blocks for ML-DSA-44 and ML-DSA-87 and turn on
  associated provider glue.  These now pass both keygen and
  siggen tests (to be added separately).

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26127)
 2025-02-14 10:46:03 +01:00
slontis
3ab7409f3d Add ML-DSA sign/verify 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26127)
 2025-02-14 10:46:03 +01:00
slontis
efd7c96856 ML_DSA: Use pointers instead of arrays for polynomials in Vectors and Matrix. 
A DSA_KEY when created will alloc enough space to hold its k & l
vectors and then just set the vectors to point to the allocated blob.

Local Vectors and Matricies can then be initialised in a similar way by
passing them an array of Polnomials that are on the local stack.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26127)
 2025-02-14 10:46:03 +01:00
slontis
d3a7ae64b3 Add ML-DSA Keygen support 
The key generation algorithm requires a significant portion of the many
algorithms present in FIPS 204.

This work is derived from the BoringSSL code located at
https://boringssl.googlesource.com/boringssl/+/refs/heads/master/crypto/mldsa/mldsa.cc

Instead of c++ templates it uses an ML_DSA_PARAMS object to store constants such as k & l.
To perform hash operations a temporary EVP_MD_CTX object is used, which is supplied with a
prefetched EVP_MD shake128 or shake256 object that reside in the ML_DSA_KEY object.

The ML_DSA_KEY object stores the encoded public and/or private key
whenever a key is loaded or generated. A public  key is always present
if the private key component exists.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26127)
 2025-02-14 10:46:03 +01:00
Bernd Edlinger
5949918f9a Rework and simplify RCU code 
Use __ATOMIC_RELAXED where possible.
Dont store additional values in the users field.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26690)
 2025-02-13 20:23:48 +01:00
Bernd Edlinger
65787e2dc2 Revert "rcu: Ensure that updates to the ID field of a qp don't lose refs" 
This reverts commit fbd34c03e3.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26690)
 2025-02-13 20:23:33 +01:00
Tomas Mraz
4b4333ffcc Test openssl ecparam -list_curves 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26525)
 2025-02-13 11:19:02 +01:00
Tomas Mraz
8f416ba9b0 ecparam: process -list_curves before reading input 
Fixes #26519

This is a regression from commit 1dbb67c4

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26525)
 2025-02-13 11:19:02 +01:00
Josh Soref
7a8fe56da8 Fix arithmetic in a comment 
CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26707)
 2025-02-13 10:42:39 +01:00
Alexey Moksyakov
e4b899f53c [vpsm4_ex][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
110f1afd12 [vpsm4][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
1e42e76dda [sm3][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
85a8e97a76 [poly1305][aarch64] Extend address range by adrp + add 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
45579e8e58 [bsaes][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
15b011e0be [chacha_sve][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Alexey Moksyakov
d5c208b610 [sm4][aarch64] Move constant to .rodata section 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26509)
 2025-02-13 09:51:37 +01:00
Viktor Dukhovni
6f3ada8a14 Address coverity reports 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26703)
 2025-02-12 12:14:04 -05:00
Tomas Mraz
dfd177b776 ossl_rand_ctx_new(): Use OPENSSL_strdup instead of strdup 
Fixes Coverity 1642620

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26641)
 2025-02-12 17:44:51 +01:00
Dr. David von Oheimb
b45e035bf7 X509_STORE_CTX_get1_issuer(): make happy path quicker again 
Fixes #26588

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26600)
 2025-02-12 08:07:57 -05:00
Dr. David von Oheimb
5ebd6d26a8 x509_vfy.c: refactor parameter of get0_best_issuer_sk() and adapt its use by build_chain() 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26600)
 2025-02-12 08:07:57 -05:00
Dr. David von Oheimb
c8932aa94f http_client.c: fix error and default case handling in OSSL_HTTP_REQ_CTX_nbio() state machine 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:11:03 +01:00
Dr. David von Oheimb
64b478419a http_client.c: fix OSSL_HTTP_REQ_CTX_nbio() to return content on non-fatal HTTP status code >=400 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:10:43 +01:00
Dr. David von Oheimb
6de09ebe13 http_client.c: fix redirection in OSSL_HTTP_REQ_CTX_nbio() when non-ASN.1 content is expected 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:10:43 +01:00
Dr. David von Oheimb
920dd8a72e http_test.c: small beautifications 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:10:43 +01:00
Dr. David von Oheimb
efb621941a http_client.c: distinguish better between request/response header and body, in particular when tracing 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:10:41 +01:00
Dr. David von Oheimb
91114d53b0 http_client.c,OSSL_HTTP_REQ_CTX.pod,http.h: fixups for PR #23781 on max_response_hdr_lines 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:09:40 +01:00
Dr. David von Oheimb
153adbc540 remove parts of OSSL_HTTP_transfer.pod that are better described in OSSL_HTTP_transfer.pod 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:09:40 +01:00
Simo Sorce
0ba139f4b9 Add documentation to explain DRBG changes 
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26542)
 2025-02-11 21:50:53 +01:00
Simo Sorce
d037551ee3 Change also other DRBG's algorithm fetching 
- DRBG_HASH
- DRBG_HMAC

Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26542)
 2025-02-11 21:48:15 +01:00
Dmitry Belyavskiy
29d02206f3 Filter provider should return proper provctx 
...instead of the default one
Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26542)
 2025-02-11 21:48:15 +01:00
Simo Sorce
c9a2ce6111 Prefer DRBG ciphers from the same provider 
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26542)
 2025-02-11 21:48:15 +01:00
Ingo Franzki
0e93f64723 test/quicapitest.c: Increase timeout of test_fin_only_blocking to 40ms 
Running this test on heavily loaded systems may cause the SSL_read_ex() to
take more than 20ms, due to concurrent workload.

Increase the timeout to 40ms to allow a little bit more time.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26693)
 2025-02-11 13:04:03 -05:00
Matt Caswell
e2bfb61f61 Add a test for configuring provider certs via config 
A bug existed where provider added cert algorithms caused a crash when
they were configured via a config file. We add a test for this scenario.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26663)
 2025-02-11 17:36:21 +00:00
Matt Caswell
9cbaa8763c Fix configuring provider certificate algs via config file 
A crash could occur when attempting to configure a certificate via a
config file, where the algorithm for the certificate key was added
dynamically via a provider.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26663)
 2025-02-11 17:36:21 +00:00
Matt Caswell
c21e213b97 Enable the quic-tls API to work, even in the case of no-quic 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26683)
 2025-02-11 17:17:10 +00:00
Matt Caswell
0c3e1f25b2 Add a test for the quic-tls API 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26683)
 2025-02-11 17:17:10 +00:00
Matt Caswell
198e5a847a Add a CHANGES.md entry 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26683)
 2025-02-11 17:17:10 +00:00
Matt Caswell
e6bb7eaee0 Add documentation for the new third party QUIC stack API 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26683)
 2025-02-11 17:17:10 +00:00
Matt Caswell
3cf15554f2 Add an API for other QUIC stacks to use our TLS implementation 
We provide some callbacks for third party QUIC stacks to use in order
to be able to reuse the OpenSSL TLS implementation in that stack. This is
essentially a thin wrapper around the same API that OpenSSL's own QUIC
stack uses in order to integrate TLS.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26683)
 2025-02-11 17:17:10 +00:00
Viktor Dukhovni
3252fe646b Avoid calling ssl_load_sigalgs in tls1_set_sigalgs_list 
- The signature algorithms are already loaded in SSL_CTX_new()

- Calling ssl_load_sigalgs() again is non-productive, and does
  not look thread safe.

- And of course avoiding the call is cheaper.

- Also fix broken loop test in ssl_cert_lookup_by_pkey()

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26671)
 2025-02-12 03:13:07 +11:00
Neil Horman
cf9d6685fd Update CHANGES and NEWS for security release 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
 2025-02-11 08:36:29 -05:00
Viktor Dukhovni
739c4b2e92 Use ERR marks also when verifying server X.509 certs 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
 2025-02-11 08:26:51 -05:00
Viktor Dukhovni
6ae8e947d8 With SSL_VERIFY_PEER client RPK should abort on X509 error 
While RPK performs X.509 checks correctly, at the SSL layer the
SSL_VERIFY_PEER flag was not honoured and connections were allowed to
complete even when the server was not verified.  The client can of
course determine this by calling SSL_get_verify_result(), but some
may not know to do this.

Added tests to make sure this does not regress.

Fixes CVE-2024-12797

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
 2025-02-11 08:26:44 -05:00
Dave Kelsey
d69c014608 Add support for multiple key shares 
This PR is the implementation of concluded discussion that occurred in a
draft PR #25605. This changes were mainly authored by @martinschmatz
with some contribution from myself.

It addresses issue #21633

This extends the group list definition to support a more complex
definition while still retaining backward compatibility with the simple
form of colon separated groups.

Details of the agreed format and expected behaviour can be found in
#25605 and in the documentation changes.

Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com>

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26445)
 2025-02-10 11:43:56 -05:00
Zhiguo Zhou
78991c9e37 Revise CHANGES.md 
The performance impact on Intel Sierra Forest is documented.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25751)
 2025-02-10 15:14:33 +08:00
Zhiguo Zhou
0f6a3b8ef6 Remove unnecessary flag clearance in crypto/x86_64cpuid.pl 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25751)
 2025-02-10 15:14:33 +08:00
Zhiguo Zhou
b41e0bf168 Fix the checks of factor_size/modulus_bitsize 
The factor_size/modulus_bitsize are required to be 1024/1536/2048.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25751)
 2025-02-10 15:14:33 +08:00
Zhiguo Zhou
c18b6f4c52 Dual 1024/1536/2048-bit exponentiation optimization for Intel Sierra Forest CPU 
It optimizes the RSA-2k/3k/4k via the AVXIFMA ISA on Sierra Forest.
The performance improvements of 1.8x-2.2x are observed in the speed
tests of sign and decryption operations on this CPU.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25751)
 2025-02-10 15:14:33 +08:00
Dmitry Misharov
78d252889b add workflow dispatch inputs into coveralls workflow 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26645)
 2025-02-06 14:12:38 -05:00
Auto Vincent
becc0078f8 Fix compile error when building VC-WIN64-CLANGASM-ARM target 
With MSVC v143, C++ Clang Compiler for Windows (18.1.8) there are
many errors similar to:

crypto\aes\libcrypto-lib-aesv8-armx.obj.asm:3795:7: error: unknown token in expression
        ld1     {v2.16b},[x0],#16

CLA: trivial

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26603)
 2025-02-06 17:29:39 +01:00
sashan
fd6f27bdd5 perlasm: Replace .previous with the actual previous section 
Older versions of darwin (10.8 and earlier) don't understand .previous.
this tweak emits the previous section directive which preceeds the
rodata (for example .text) instead of using .previous. We use the
same for mingw.

Fixes #26447

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26585)
 2025-02-06 17:25:15 +01:00
Pauli
d46667284d changes: add note about the new provider random hook 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
b6a6eb6807 libcrypto.num: add RAND_set1_random_provider function 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
5bda5de88b style: fix style problems 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
6b518fef38 Add test case for RAND_set1_random_provider() call 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
888073e2e8 document provider random bypass ability 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
815416ba8d document internal ossl_provider_random_bytes rand funtion 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
b1cca25999 Add support for random provider 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:22 +11:00
Pauli
5b5c24d99e Document random_provider option in random section 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:10 +11:00
Pauli
c6ec045137 Document RAND_set1_random_provider() API 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:10 +11:00
Pauli
4636a39503 Add RAND_set1_random_provider() API 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:10 +11:00
Pauli
37172e2ab8 Add a new provider API to generate random numbers. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:10 +11:00
Pauli
f096fe4b98 Resolve undefined behaviour in wpacket test 
There is no necessity for rand_data to be aligned so that it can be
directly dereferenced as a uint64_t.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24498)
 2025-02-05 07:20:10 +11:00
Dr. David von Oheimb
b1775ba4c9 80-test_cmp_http.t: on test failures also print failed client invocations 
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26589)
 2025-02-03 08:36:10 +01:00
Dr. David von Oheimb
e7c6c5e088 80-test_cmp_http.t: on test failures print Mock server STDERR output 
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26589)
 2025-02-03 08:34:46 +01:00
Dr. David von Oheimb
12baad7ed4 80-test_cmp_http_data/Mock/test.cnf: further relax total_timeout as workaround for heavily loaded test systems 
Fixes #26577

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26584)
 2025-01-31 11:56:31 +01:00
Kazuki Yamaguchi
aa52ec9b0a Use ASN1_INTEGER_get_int64() in ossl_serial_number_print() 
A -1 return from ASN1_INTEGER_get() indicates both success and error.
Our man page calls out this ambiguity. Use ASN1_INTEGER_get_int64()
instead, which has a better error reporting and also a platform
independent behavior with respect to sizeof(long).

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26557)
 2025-01-28 21:06:51 +01:00
Kazuki Yamaguchi
6f1dbaf7d2 Fix pretty-printing empty serial number in ossl_serial_number_print() 
Fix a crash when the ASN1_INTEGER has empty content. While it is
illegal, this is the initial state of the serialNumber field when an
X509 object is allocated by X509_new(). X509_print*() should be able to
process an incomplete X509 object too.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26557)
 2025-01-28 21:06:51 +01:00
Bartel Artem
93d366bea6 EVP_DigestSign(): Check pctx != NULL 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26551)
 2025-01-28 21:03:46 +01:00
Billy Brumley
f1a4f0368b [providers/implementations/ciphers] make aes-gcm-siv work with zero-length messages 
test cases lifted from RFC 8452

fixes #26431

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26535)
 2025-01-28 21:02:14 +01:00
Josh Cooper
4f20de0c8a Open pem files in binary mode 
In order to avoid an MSVCRT bug affecting ftell and text mode[1], open PEM files
in binary mode. The PEM parser already handles CRLF translation[2].

[1] 8300a8742b
[2] https://github.com/openssl/openssl/pull/24249#issuecomment-2192025429

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25716)
 2025-01-28 20:57:14 +01:00
Josh Cooper
ed3ce75457 Revert "Work around Windows ftell() bug as per Microsoft engineering's suggestion" 
This reverts commit 8300a8742b.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25716)
 2025-01-28 20:57:14 +01:00
Viktor Dukhovni
a69288d04a Clarify docs of EVP_CIPHER*_get_block_size 
Also, tolerate NULL input ctx, just like NULL cipher.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26561)
 2025-01-28 23:09:15 +11:00
Viktor Dukhovni
de578a8a6a ossl_provider_prov_ctx is redundant 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26564)
 2025-01-28 20:10:44 +11:00
Michael Baentsch
6ab286f9eb Add version field check to PKCS8 decoder 
Fixes #26459

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26464)
 2025-01-27 09:24:56 +01:00
Dmitry Belyavskiy
40c01d8ddc Expanding trace of providers algorithms fetching/caching/etc 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26543)
 2025-01-27 09:07:48 +01:00
Rajeev Ranjan
24b7c27250 Add function X509_VERIFY_PARAM_get_purpose() 
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25132)
 2025-01-27 08:57:30 +01:00
Rajeev Ranjan
0048817523 CMP: add support for central key generation 
- add testcase for central keygen
- add documentation

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25132)
 2025-01-27 08:56:46 +01:00
Frederik Wedel-Heinen
35b97122ea Fixes some memory leaks when errors occur in ossl_cmp_rp_new(). 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26235)
 2025-01-27 08:17:27 +01:00
Viktor Dukhovni
95a3662626 Also expose an accessor for a single string provider config property 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26550)
 2025-01-25 23:16:10 +11:00
Neil Horman
cfc62a3c46 Exclude amplificationlimit test with mvfst client 
The amplificationlimit interop test is failing currently with our
server.

However, based on the global nightly runs here:
3585161414

it appears to be failing in all test cases.

Some analysis indicates that the client appears to abort operations
early during frame loss in this test.

As such just exclude the combination of this test and client.  Re-add it
later if it ever becomes functional

Fixes openssl/project#1062

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26538)
 2025-01-24 12:01:43 -05:00
Sean Kannanaikal
a59efbfc7e Fix magic + 20 in PEM_ASN1_write_bio 
Fixes #26476

In the file crypto/pem/pem_lib.c the function had a +20 to account for
padding in the data size, however this was recognized to not be up to
standard quality. Instead it has now been updated to use the static
maximum block size and uses that for the calculation as opposed to a +20.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26526)
 2025-01-24 17:14:39 +01:00
Mae
b6f2ff9363 Fix passing struct by value rather than by reference to syscall 
Fixes #26521

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26523)
 2025-01-24 14:26:16 +01:00
Tomas Mraz
0bdb4a67bd template_kem.c: Use proper printf format for size_t 
Fixes Coverity 1633351, 1633352, 1633354, 1633355

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26522)
 2025-01-24 14:16:44 +01:00
Tomas Mraz
2581ff619b template_kem.c: Check outlen before dereferencing it 
Fixes Coverity 1633353, 1633356, 1633357

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26522)
 2025-01-24 14:16:44 +01:00
Frederik Wedel-Heinen
bd0a2e0c1e Check returns of sk_X509_CRL_push and handle appropriately. 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26234)
 2025-01-24 13:37:38 +01:00
Viktor Dukhovni
1397dc59c6 Expose the provider c_get_params function via PROV_CTX. 
This applies to the base, default and FIPS providers, could be added in
principle also to the legacy provider, but there's no compelling reason
to do that at the moment.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26530)
 2025-01-24 22:51:35 +11:00
Viktor Dukhovni
3a9e3b1fb0 Don't lose config infopairs of built-in providers 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26520)
 2025-01-24 22:49:08 +11:00
Dmitry Misharov
8900cdf230 os-zoo.yml: Add linux-s390x runner 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26489)
 2025-01-23 12:17:53 +01:00
Stas Cymbalov
7262c0bcc4 Fix data race in asn1_str2tag() on tntmp which was accidentally made static 
Variables tntmp and tnst are declared in the same declaration and thus
share storage class specifiers (static). This is unfortunate as tntmp is
used during iteration through tnst array and shouldn't be static.
In particular this leads to two problems that may arise when multiple
threads are executing asn1_str2tag() concurrently:
1. asn1_str2tag() might return value that doesn't correspond to tagstr
   parameter. This can happen if other thread modifies tntmp to point to
   a different tnst element right after a successful name check in the
   if statement.
2. asn1_str2tag() might perform an out-of-bounds read of tnst array.
   This can happen when multiple threads all first execute tntmp = tnst;
   line and then start executing the loop. If that case those threads
   can end up incrementing tntmp past the end of tnst array.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26504)
 2025-01-23 12:13:42 +01:00
Tomas Mraz
abbc407314 eddsa_signverify_init(): Avoid memory leak on error 
Add missing WPACKET_cleanup() call.
Fixes Coverity 1638693

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26500)
 2025-01-23 12:09:13 +01:00
Tomas Mraz
2455ef2112 mac_legacy_kmgmt.c: Avoid possible memory leak on error 
Use mac_gen_cleanup() instead of just freeing the gctx.
Fixes Coverity 1638702

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26500)
 2025-01-23 12:09:13 +01:00
Tomas Mraz
4f7d2b4809 test_kdf_scrypt(): Test resetting the KDF context 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26488)
 2025-01-23 12:07:33 +01:00
Tomas Mraz
901b108154 kdf_scrypt_reset(): NULLify freed pointers 
Otherwise doublefree happens with further usage.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26488)
 2025-01-23 12:07:33 +01:00
Tomas Mraz
2dded72022 scrypt: Do not free the context itself when fetch fails 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26488)
 2025-01-23 12:07:33 +01:00
Alexander Heinlein
b07a273f59 config.pod: Fix typo 
CLA: trivial

Signed-off-by: Alexander Heinlein <alexander.heinlein@web.de>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26497)
 2025-01-23 12:05:57 +01:00
Richard Levitte
0cacf9be97 Refactor MAKE_ENCODER in providers/implementations/encode_decode/encode_key2any.c 
It took a parameter 'evp_type', which isn't used.  The comment describing
it mentions a future refactoring, but it appears that this has already
happened.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26360)
 2025-01-23 12:03:48 +01:00
Bernd Edlinger
b999ea6bc4 Give DTLS tests more time to complete 
Increase the timeout for DTLS tests to 10 seconds.
But do that only for DTLS as this would waste time
for other tests, most of the TLS tests do not need
this at all.

Fixes #26491

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26502)
 2025-01-23 12:01:38 +01:00
Alex Prabhat Bara
c5e17e8cb7 apps/cms.c: Cleanup for dead assignment to argc 
CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26273)
 2025-01-23 11:21:12 +01:00
Neil Horman
fbd34c03e3 rcu: Ensure that updates to the ID field of a qp don't lose refs 
ppc64le occasionally still fails the threadstest on __rcu_torture

From several days of debugging, I think I've landed on the problem.

Occasionally, under high load I observe the following pattern

CPU0                                     CPU1
update_qp                                get_hold_current_qp
  atomic_and_fetch(qp->users, ID_MASK, RELEASE)
                                         atomic_add_fetch(qp->users, 1, RELEASE
  atomic_or_fetch(qp->users, ID_VAL++, RELEASE)

When this pattern occurs, the atomic or operation fails to see the published
value of CPU1 and when the or-ed value is written back to ram, the incremented
value in get_hold_current_qp is overwritten, meaning the hold that the reader
placed on the rcu lock is lost, allowing the writer to complete early, freeing
memory before a reader is done reading any held memory.

Why this is only observed on ppc64le I'm not sure, but it seems like a pretty
clear problem.

fix it by implementing ATOMIC_COMPARE_EXCHANGE_N, so that, on the write side in
update_qp, we can ensure that updates are only done if the read side hasn't
changed anything.  If it has, retry the operation.

With this fix, I'm able to run the threads test overnight (4000 iterations and
counting) without failure.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26478)
 2025-01-22 20:16:11 +01:00
Kelvin Lee
5b589fcdab byteorder.h: Fix MSVC compiler error C2371 
Compiling byteorder_test.c with VS2022 produces the following warnings
and errors:

E:\build\kiyolee\openssl\include\openssl\byteorder.h(24,21): warning
C4164: '_byteswap_ushort': intrinsic function not declared
(compiling source file '../../../test/byteorder_test.c')
E:\build\kiyolee\openssl\include\openssl\byteorder.h(25,21): warning
C4164: '_byteswap_ulong': intrinsic function not declared
(compiling source file '../../../test/byteorder_test.c')
E:\build\kiyolee\openssl\include\openssl\byteorder.h(26,21): warning
C4164: '_byteswap_uint64': intrinsic function not declared
(compiling source file '../../../test/byteorder_test.c')
E:\build\kiyolee\openssl\include\openssl\byteorder.h(112,18): warning
C4013: '_byteswap_ushort' undefined; assuming extern returning int
(compiling source file '../../../test/byteorder_test.c')
E:\build\kiyolee\openssl\include\openssl\byteorder.h(144,18): warning
C4013: '_byteswap_ulong' undefined; assuming extern returning int
(compiling source file '../../../test/byteorder_test.c')
E:\build\kiyolee\openssl\include\openssl\byteorder.h(182,18): warning
C4013: '_byteswap_uint64' undefined; assuming extern returning int
(compiling source file '../../../test/byteorder_test.c')
C:\Program Files (x86)\Windows
Kits\10\Include\10.0.22621.0\ucrt\stdlib.h(298,41): error C2371:
'_byteswap_ushort': redefinition; different basic types
(compiling source file '../../../test/byteorder_test.c')
C:\Program Files (x86)\Windows
Kits\10\Include\10.0.22621.0\ucrt\stdlib.h(299,41): warning C4142:
'_byteswap_ulong': benign redefinition of type
(compiling source file '../../../test/byteorder_test.c')
C:\Program Files (x86)\Windows
Kits\10\Include\10.0.22621.0\ucrt\stdlib.h(300,41): error C2371:
'_byteswap_uint64': redefinition; different basic types
(compiling source file '../../../test/byteorder_test.c')

CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26448)
 2025-01-22 11:40:11 +01:00
Jiasheng Jiang
27b324f90a providers/implementations/keymgmt/ec_kmgmt.c: Remove unused variable 
Remove unused variable "group".

CLA: trivial

Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26293)
 2025-01-22 11:34:50 +01:00
Michael Baentsch
c81ff97866 Improve ASN1_TIME_print documentation and output 
This adds missing GMT indication when printing the local time as
it is converted to the UTC timezone before printing.

Also fixing the fractional seconds printing on EBCDIC platforms.

Fixes #26313

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26344)
 2025-01-22 11:28:31 +01:00
Dimitri John Ledkov
7ffb65666f keymgmt: refactor fips indicator check 
Currently direct call to ossl_ec_check_security_strength is used,
instead of ossl_fips_ind_ec_key_check() like in all other places.

Make keymgmt do the same check as ecdh_exch and ecdsa_sig do.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25748)
 2025-01-22 09:29:32 +01:00
Nadav Tasher
113c12ee8c s_socket: naccept: close listening socket after accepting clients 
When `-naccept` is passed (i.e with `s_server`), the listening socket remains open while handling
client, even after `naccept` is supposed to reach `0`.

This is caused to to the decrementation of `naccept` and closing of the socket
happening a little too late in the `do_server` function.

Signed-off-by: Nadav Tasher <tashernadav@gmail.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26228)
 2025-01-22 09:20:14 +01:00
Viktor Dukhovni
e6855e1d79 Support boolean queries against provider config 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26455)
 2025-01-22 14:52:26 +11:00
Alexey Moksyakov
908bc0994d Revert "Move rodata to .rodata section for armv8" 
This reverts commit 5b36728d97.

Issue #26458

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26498)
 2025-01-21 18:21:19 +01:00
Julian Andres Klode
5261f3ca41 Restore correct registers in aarch64 AES-CTR code 
Commit 1d1ca79fe3 introduced
save and restore for the registers, saving them as

	stp		d8,d9,[sp, #16]
	stp		d10,d11,[sp, #32]
	stp		d12,d13,[sp, #48]
	stp		d14,d15,[sp, #64]

But the restore code was inadvertently typoed:

	ldp		d8,d9,[sp, #16]
	ldp		d10,d11,[sp, #32]
	ldp		d12,d13,[sp, #48]
	ldp		d15,d16,[sp, #64]

Restoring [sp, #64] into d15,d16 instead of d14,d15.

Fixes: #26466

CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26469)
 2025-01-21 10:55:56 +01:00
Viktor Dukhovni
c374f79549 Move some encode helpers to crypt/encode_decode/ 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26487)
 2025-01-21 20:09:57 +11:00
Viktor Dukhovni
5b94140b52 Check return of OSSL_PROVIDER_do_all to avoid coverity noise 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26462)
 2025-01-21 17:25:22 +11:00
Viktor Dukhovni
1dafff06ca Don't promise a non-zero return size in error cases. 
When a requested parameter has a non-NULL result pointer,
and the error isn't simply that the result buffer is too
small, don't return a non-zero result size.

Returning a non-zero result size that isn't larger than the
user's provided space is an indication that a result of
that size was actually written, inviting trouble if the
error indication was inadvertenly lost.

Also, in such cases (wrong type, data can't be converted to the
requested type when otherwise supported, ...) there is nothing useful to
be done with the return size value, it can't help to address the
problem.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26436)
 2025-01-21 17:21:52 +11:00
Viktor Dukhovni
35f6e7ea02 Make the provider context available to encoders 
At the moment the provider context is only available to
encoders that encrypt, but it is useful more generally.

A similar change has already been merged to "master" on the
decoder side, this is the mirror change for encoders.  The
only significant difference is that PEM_ASN1_write_bio needed
to be "extended" (cloned) to allow it to pass the provider context
down to the `k2d` function it uses to encode the data.

I had to "hold my nose" and live with the random "20" added to the data
size in order to accomodate encryption with padding, which may produce
one more cipher block than the input length.  This really should ask
the EVP layer about the block length of the cipher, and allocate the
right amount.  This should be a separate fix for both the old
PEM_ASN1_write_bio() and the new PEM_ASN1_write_bio_ctx().

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26475)
 2025-01-21 17:19:07 +11:00
Tomas Mraz
c3144e1025 Add CHANGES.md and NEWS.md updates for CVE-2024-13176 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26429)
 2025-01-20 09:30:48 +01:00
Tomas Mraz
63c40a66c5 Fix timing side-channel in ECDSA signature computation 
There is a timing signal of around 300 nanoseconds when the top word of
the inverted ECDSA nonce value is zero. This can happen with significant
probability only for some of the supported elliptic curves. In particular
the NIST P-521 curve is affected. To be able to measure this leak, the
attacker process must either be located in the same physical computer or
must have a very fast network connection with low latency.

Attacks on ECDSA nonce are also known as Minerva attack.

Fixes CVE-2024-13176

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26429)
 2025-01-20 09:30:48 +01:00
Dr. David von Oheimb
3294dcdbc2 fix X509_PURPOSE_add() to take |sname| as primary key and handle |id| in a backwd compat way for new purpose 
Fixes #25873

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26221)
 2025-01-20 08:41:19 +01:00
Dr. David von Oheimb
b48ed24737 fix X509_PURPOSE_set() to support clearing the purpose requirement as needed for X509_VERIFY_PARAM_set_purpose() 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26221)
 2025-01-20 08:41:02 +01:00
otherddn1978
3c7db9e0fd If you call X509_add_cert with cert == NULL and the X509_ADD_FLAG_UP_REF 
flag, it will сrash to X509_up_ref.  Passing NULL here is not valid,
return 0 if cert == NULL.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26267)
 2025-01-20 18:22:48 +11:00
Richard Levitte
1df07c761b Fix documentation of OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION 
This drops OSSL_PKEY_PARAM_IMPLICIT_REJECTION - which is a meaningless
name - everywhere apart from still existing (for API stability, in
case someone uses that macro).

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26421)
 2025-01-17 18:54:51 +01:00
Jonathan M. Wilbur
635ad41cd9 test: aAissuingDistributionPoint X.509v3 extension 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26174)
 2025-01-17 18:39:24 +01:00
Jonathan M. Wilbur
7346348779 doc: aAissuingDistributionPoint X.509v3 extension 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26174)
 2025-01-17 18:39:24 +01:00
Jonathan M. Wilbur
0d8cc7c699 feat: support the aAissuingDistributionPoint X.509v3 extension 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26174)
 2025-01-17 18:39:24 +01:00
Viktor Dukhovni
38a0926528 Support CLI and API setting of provider configuration parameters 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26427)
 2025-01-18 03:46:37 +11:00
Alexandr Nedvedicky
42aced5c9f Work around to get llvm-mingw working on aarch64 
It looks like llvm-mingw tool chain does not understand `.previous` asm
directive (see https://sourceware.org/binutils/docs/as/Previous.html).
As a workaround for win64 flavor (llvm-mingw toolchain) we let xlate
to emit .text instead of emitting .previous.

We also need to revisit usage of win64 flavor here in aarch64. We should
perhaps introduce a mingw flavour on aarch64 as well. win assembly
flavour should be used for microsoft assembler.

Fixes #26415

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26428)
 2025-01-17 17:43:39 +01:00
Alexey Moksyakov
5b36728d97 Move rodata to .rodata section for armv8 
Adds missing files where asm code is generated by
perl scripts and read only constant is used

PR #24137

closes #23312

Signed-off-by: Alexey Moksyakov <yavtuk@yandex.ru>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26440)
 2025-01-17 17:33:41 +01:00
Dmitry Belyavskiy
e8387ed61c Missing .gitignore entries 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26418)
 2025-01-17 15:06:32 +01:00
Dmitry Belyavskiy
116c0ad952 atoi should be allowed 
When we compile with -O0 for Linux, the command
`./util/checkplatformsyms.pl ./util/platform_symbols/unix-symbols.txt ./libcrypto.so ./libssl.so`
complains to the lack of `atoi`

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26417)
 2025-01-17 15:04:35 +01:00
onexyoung
8fb6c8154b provider_deactivate(): Check return value of CRYPTO_atomic_add() 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26249)
 2025-01-17 11:36:26 +01:00
Nikolay Nikolaev
b26894ec69 Workaround for RSA on AArch64 Big Endian 
1064616012 introduced and optimized RSA NEON implementation
for AArch64 architecture, namely Cortex-A72 and Neoverse N1.
This implementation is broken in Big Endian mode, which is not
widely used, therefore not properly verified.
Here we disable this optimized implementation when Big Endian
platform is used.

Fixes: #22687

CLA: trivial

Signed-off-by: Nikolay Nikolaev <nicknickolaev@gmail.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26257)
 2025-01-15 17:52:29 +01:00
Peter Bierma
0b1d3ebb70 Remove non-existing error code. 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26389)
 2025-01-15 16:22:39 +01:00
Peter Bierma
5b81f942d5 Synchronize openssl.txt with comperr.h 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26389)
 2025-01-15 16:22:39 +01:00
Bernd Edlinger
52bcf4f88b Fix dtls tests 
The dtls server process exits too early when the input
has an EOF condition.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26374)
 2025-01-15 16:05:53 +01:00
Bernd Edlinger
bf2e6e849d Revert "Use open2 instead of open for s_server instance" 
This reverts commit 4439ed16c5.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26374)
 2025-01-15 16:05:53 +01:00
Bernd Edlinger
716a64fcc4 Revert "chomp does not work on windows." 
This reverts commit 3e94e2b11d.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26374)
 2025-01-15 16:05:44 +01:00
Bernd Edlinger
824d23772b Revert "Do not confuse TAP::Parser by mixing up stderr with stdout." 
This reverts commit 3d3bb26a13.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26374)
 2025-01-15 16:05:44 +01:00
Tom Fay
62f9fd832a Correct documented KEM ids for OSSL_HPKE_str2suite 
CLA: trivial

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26159)
 2025-01-15 16:03:51 +01:00
Dmitry Misharov
d8af77e736 Add a GitHub workflow to make a release 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25662)
 2025-01-15 16:00:58 +01:00
shridhar kalavagunta
21f72fa4c8 genpkey: Avoid leaving empty file if encryption passphrase does not match 
Fixes #25440

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26081)
 2025-01-15 13:26:41 +01:00
Bernd Edlinger
c37f564bb8 Fix test failure in 30-test_evp_pkey_provided.t 
In this test there is a random test output corruption.
`make test TESTS=test_evp_pkey_provided V=1` has some random output,
that can with a certain probability start a line with "ok" or so:

    # Setting up a OSSL_ENCODER context with passphrase
    # Testing with no encryption
jLixONcRPi/m64CGie4KKKDuGeTjtYwfima3BNYCGlgbLGeK3yYxBfZb9JjviOJ4
    # nHaNsRsONTAKyg==

This happens because large random data is output to bio_out
but some data remains buffered, and then test_note() is used to print
some comments on the bio_err file.  This causes output corruption that
confuses the TAP parser.
Fix that by flushing any pending output with test_flush_stdout() first.

Fixes #23992

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26383)
 2025-01-15 09:16:04 +01:00
Viktor Dukhovni
92c242e8ac Big and little-endian load and store support 
These are needed in ML-KEM and ML-DSA, and are likely generally useful,
so public.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26385)
 2025-01-14 12:14:54 +00:00
sashan
8e69c18828 Finishing touch to perlasm update to make it work on OpenBSD 
This changeset brings a finishing touch to stuff we got from botovoq@
Changes to `crypto/perlasm/arm-xlate.pl` deal with verious assembler
flavours to keep various assembler compilers happy.

We also need to keep original code for 32-bit flavour in
`crypto/aes/asm/aesv8-armx.pl`.

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24137)
 2025-01-14 12:15:13 +01:00
Theo Buehler
c6e65c1f8e Make it able to run asm code on OpenBSD (arm64) 
In order to get asm code running on OpenBSD we must place
all constants into .rodata sections.

The change to crypto/perlasm/arm-xlate.pl adjusts changes
from Theo for additional assembler variants/flavours we
use for building OpenSSL.

Fixes #23312

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24137)
 2025-01-14 12:14:27 +01:00
Dimitri John Ledkov
3b7bd871c1 drbg: provide requested amount of entropy, rather than self-strength 
Parent DRBG can be seed source (os or jitter) and thus able to provide
unlimited entropy.

get_entropy is documented to provide at least the request amount of
entropy. If requested amount of entropy is same as, or less than
drbg->strength, everything is compliant. However, if requested entropy
is more than drbg->strength (unlikely, but possible), the returned
amount of entropy will be insufficient and additional repeated calls
to get_entropy will be required.

Reading history of refactors, it seems to me that this function call
previouslly had assumptions and usecases that couldn't ever request or
require more than strength amount of entropy.

If entropy is set, request that amount, otherwise request
drbg->strength amount.

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25850)
 2025-01-14 12:12:02 +01:00
Tom Cosgrove
4188ab2b19 Fix obvious misspelling of ASN1_VALUE 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26118)
 2025-01-14 12:05:18 +01:00
Tom Cosgrove
690bb5192c Fix double 'the's 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26118)
 2025-01-14 12:05:07 +01:00
Wang Xin
dd7a79fc6f LoongArch: we should access global symbol by la.global instead of 
la.pcrel

openssl will not be built successfully with binutils-2.43.50.20241230
which checks if global symbols are accessed by PC-relative in shared
library.

CLA: trivial

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26336)
 2025-01-14 12:02:45 +01:00
Neil Horman
25f8e2c15b Fix premature reuse of qp's in rcu locks 
An intermittent failure was noted on our new ppc64le CI runner, in which
what appeared to be a corrupted or invalid value getting returned from a
shared pointer under rcu protection

Investigation showed that the problem was with our small number of qp's
in a lock, and slightly incorrect accounting of the number of qp's
available we were prematurely recycling qp's, which led in turn to
premature completion of synchronization states, resulting in readers
reading memory that may have already been freed.

Fix it by:
a) Ensuring that we account for the fact that the first qp in an rcu
lock is allocated at the time the lock is created

and

b) Ensuring that we have a minimum number of 3 qp's:
1 that is free for write side allocation
1 that is in use by the write side currently
1 "next" qp that the read side can update while the prior qp is being
retired

With this change, the rcu threadstest runs indefinately in my testing

Fixes #26356

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26384)
 2025-01-13 17:13:48 -05:00
Bernd Edlinger
37a954e5c3 Fix intermittent test failure in 80-test_cmp_http.t 
output to stderr is unbuffered bypassing the normal output, which does
not happen at line boundaries and is therefore confusing the TAP parser.
This is known to cause random test failures like this one:

80-test_cmp_http.t                    (Wstat: 0 Tests: 5 Failed: 0)
  Parse errors: Tests out of sequence.  Found (6) but expected (5)
                Bad plan.  You planned 6 tests but ran 5.

Fixes #23992

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26363)
 2025-01-13 20:19:10 +01:00
Tomas Mraz
74cbe9d1a4 coveralls.yml: Avoid excluding subdirectories of already excluded dirs 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26405)
 2025-01-13 14:24:22 +01:00
Ingo Franzki
b8028d4890 speed: Pass IV to EVP_CipherInit_ex for -evp runs with non-AEAD ciphers 
Some (non-AEAD) ciphers require an IV to be used. Always pass a (dummy) IV
when setting the key. It is ignored by ciphers that do not use an IV.

Commit 607a46d003 corrected the use of AEAD
ciphers, but removed the IV from being passed to EVP_CipherInit_ex() for
non-AEAD ciphers.

Fixes: 607a46d003

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26346)
 2025-01-13 11:47:29 +01:00
Viktor Dukhovni
b049ce0e35 Tweak case of [fs] variant letter in SLH-DSA algorithms 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26359)
 2025-01-11 14:39:03 +11:00
Tomas Mraz
75416c098e coveralls.yml: Add --ignore-errors mismatch 
Once lcov is updated to 2.2 version or later, it could be dropped.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26381)
 2025-01-10 16:10:46 +01:00
Viktor Dukhovni
0f28638603 Pre-ML-KEM/DSA decoder/encoder refactor 
Simplify some decoder/encoder internals to facilitate upcoming support
for ML-KEM and ML-DSA.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26355)
 2025-01-10 22:23:58 +11:00
Kai Pastor
e87a3473fd Fix buildinf.h generation for space and backslash 
Builds may be configured with CC or CFLAGS containing space and
double quotes. In particular on Windows, this may lead to passing
more than two arguments into mkbuildinf.pl.
In addition, backslashes must be escaped for constructing the C string.

Fixes #26253.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26315)
 2025-01-10 11:56:38 +01:00
Michael Baentsch
3cfcf820bd Update error codes in "crypto/err/openssl.txt" 
Fixes #26316

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26330)
 2025-01-09 15:44:18 +01:00
Dmitry Misharov
ea71f8cd40 Replace self-hosted runners with GitHub hosted 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26304)
 2025-01-09 15:32:20 +01:00
Frederik Wedel-Heinen
d48874ab47 Fix memory leaks from missing checks of return value from sk_OPENSSL_STRING_push() 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26238)
 2025-01-09 15:23:39 +01:00
Richard Levitte
6a2472fb3e Fix the use of OPENSSL_HTTP_PROXY / OPENSSL_HTTPS_PROXY 
Fixes #26337

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26340)
 2025-01-09 12:03:52 +01:00
Neil Horman
89e2c6f61e Fix encryption level ordering 
It was noticed recently that the enum for QUIC encryption levels doesn't
match the ordering that is outlined in the RFC.  RFC 9000 s. 12.2 and
RFC 9002 s 14.4.1 indicate that encryption level ordering is
INITIAL/0RTT/HANDSHAKE/1RTT, but our enum is in the order
INITAL/HANDSHAKE/0RTT/1RTT.

Our enum isn't a direct wire translation, so as long as the wire->enum
mapping done in ossl_quic_pkt_type_to_enc_level is done consistently it
ideally wouldn't matter, but because we do coalescing in
ossl_quic_tx_packetiser_generate by iterating through all the values in
the enum, its possible we may coalesce in the wrong order when we do
start implementing 0RTT support.

Fix it by adjusting the enum properly to match the RFC order.  This also
necessitates and adjustment to the archetypes array, which is a two
dimensional array indexed by encryption level and frame archetype
(PROBE/NORMAL/ACK ONLY).  Moving the 0RTT enc level to index 1 requires
moving the (formerly) index 2 0RTT array row to be at index 1.

Fixes #26324

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26334)
 2025-01-08 11:17:01 -05:00
Frederik Wedel-Heinen
2457fc4816 Free data if sk_OPENSSL_STRING_push fails. 
Fixes #26203

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26227)
 2025-01-08 11:25:30 +01:00
Frederik Wedel-Heinen
dfce0d7418 Return NULL from ossl_lib_ctx_get_concrete() when it is uninitialized 
When default_context_inited is set to false we return NULL instead of
the global default context.

Fixes #25442

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26319)
 2025-01-08 11:18:13 +01:00
Семенов Герман
bbd1811663 Added configuration for Embarcadero-Borland Clang Compiler 64 (BCC64) 
Signed-off-by: Герман Семенов <GermanAizek@yandex.ru>
Signed-off-by: Herman Semenov <GermanAizek@yandex.ru>

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23377)
 2025-01-08 11:13:10 +01:00
Frederik Wedel-Heinen
c626fda8a6 Check returns of various sk_*_push functions 
Check returns of sk_POLICY_MAPPING_push, sk_GENERAL_NAME_push,
sk_ACCESS_DESCRIPTION_push, sk_X509_push, sk_X509_NAME_push,
sk_OPENSSL_CSTRING_push, sk_SCT_push, sk_DIST_POINT_push,
sk_OSSL_CMP_CRLSTATUS_push, sk_ASN1_UTF8STRING_push and
sk_ASN1_OBJECT_push and handle appropriately.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26240)
 2025-01-08 11:11:00 +01:00
Frederik Wedel-Heinen
3ffa64cd45 Pass functions with correct signatures to the evp_generic_fetch_xxx methods 
UBSan complains about functions being called with incorrect signatures.
Relates to #22896

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26318)
 2025-01-07 21:24:13 +01:00
Matt Caswell
0f665e87c7 Fix a funding.json error 
"Active" should be "active"

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26327)
 2025-01-07 17:18:36 +00:00
Viktor Dukhovni
d31fce1972 Some PQ-related CSOR OIDs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26321)
 2025-01-07 23:01:44 +11:00
Niels Dossche
f822a48668 Fix potential memory leak in PKCS12_add_key_ex() 
p8 is allocated using EVP_PKEY2PKCS8(), but when PKCS8_add_keyusage()
fails this memory is not freed. Fix this by adding a call to
PKCS8_PRIV_KEY_INFO_free().

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25818)
 2025-01-06 21:32:50 +01:00
Bernd Edlinger
94f95efce9 Fix a potential misaligned memory access 
in test/wpackettest.c:593:18: runtime error: load of misaligned address
for type 'uint64_t', which requires 8 byte alignment.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
2f67a3dc32 Fix the sporadic test failure in 30-test_evp_extra.t 
Fixes #26276

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
c45fddd597 Run fuzz-checker workflow on ubuntu-24.04 
Fix missing afl++-clang package
Use clang-18
Configure ubsan with -fno-sanitize=function

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
eeb3266ebb Fix test failure in 90-test_memleak.t 
recent gcc versions can optimize the memory leak away,
avoid that by declaring the lost variable to be volatile.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
9861be4eef use-of-uninitialized-value in quic_tserver_test 
Fixes #26277

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
e63e889b32 Fix a minor memory sanitizer issue 
Here the undefined value "npa" passed to a function
WPACKET_sub_memcpy_u16(pkt, npa, npalen).
However the value is not really used, because "npalen" is zero,
but the call statememt itself is considered an invalid operation
by the new sanitizer.

The original sanitizer error report was:

==49175==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x55a276b29d6f in tls_construct_stoc_next_proto_neg /home/runner/work/openssl/openssl/ssl/statem/extensions_srvr.c:1518:21
    #1 0x55a276b15d7d in tls_construct_extensions /home/runner/work/openssl/openssl/ssl/statem/extensions.c:909:15
    #2 0x55a276b513dc in tls_construct_server_hello /home/runner/work/openssl/openssl/ssl/statem/statem_srvr.c:2471:10
    #3 0x55a276b2e160 in write_state_machine /home/runner/work/openssl/openssl/ssl/statem/statem.c:896:26
    #4 0x55a276b2e160 in state_machine /home/runner/work/openssl/openssl/ssl/statem/statem.c:490:21
    #5 0x55a276b2f562 in ossl_statem_accept /home/runner/work/openssl/openssl/ssl/statem/statem.c:309:12
    #6 0x55a276a9f867 in SSL_do_handshake /home/runner/work/openssl/openssl/ssl/ssl_lib.c:4890:19
    #7 0x55a276a9f605 in SSL_accept /home/runner/work/openssl/openssl/ssl/ssl_lib.c:2169:12
    #8 0x55a276a3d4db in create_bare_ssl_connection /home/runner/work/openssl/openssl/test/helpers/ssltestlib.c:1281:24
    #9 0x55a276a3d7cb in create_ssl_connection /home/runner/work/openssl/openssl/test/helpers/ssltestlib.c:1350:10
    #10 0x55a276a64c0b in test_npn /home/runner/work/openssl/openssl/test/sslapitest.c:12266:14
    #11 0x55a276b9fc20 in run_tests /home/runner/work/openssl/openssl/test/testutil/driver.c:377:21
    #12 0x55a276ba0b10 in main /home/runner/work/openssl/openssl/test/testutil/main.c:31:15

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
01e657c546 Try to work around the llvm-symbolizer failure 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
ada0265aab Add __isoc23_strtol to unix-symbols.txt 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Bernd Edlinger
5f0dab5e74 Add -fno-sanitize=function to ubsan 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26269)
 2025-01-06 20:46:08 +01:00
Dmitry Misharov
8f0c8e33bf Add linux ppc64le runner 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26312)
 2025-01-06 20:44:32 +01:00
Job Snijders
2e36bb07b5 Clean up ASN1_STRING comment and improve example in docs 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26195)
 2025-01-06 20:39:22 +01:00
Neil Horman
e258454479 add multiplexing test for quic server to ci 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26199)
 2025-01-06 11:24:28 -05:00
Tomas Mraz
ff10a027f9 80-test_cms.t: Fix incorrect plan from bad merge 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26322)
 2025-01-06 13:03:59 +01:00
Jakub Zelenka
894e69e747 Fix CMS encryption with key agreement when originator set 
OpenSSL currently does not support encryption with originator flag so it
should fail nicely instead of segfaulting.

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26014)
 2025-01-06 11:45:02 +01:00
Jakub Zelenka
24dd635eff Fix originator cert leak in cms app 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26014)
 2025-01-06 11:45:02 +01:00
Jonathan Swinney
ebe34f9a62 Optimize x86/aarch64 MD5 implementation 
As suggested in https://github.com/animetosho/md5-optimisation?tab=readme-ov-file#dependency-shortcut-in-g-function,
we can delay the dependency on 'x' by recognizing that ((x & z) | (y & ~z))
is equivalent to ((x & z) + (y + ~z)) in this scenario, and we can perform
those additions independently, leaving our dependency on x to the final
addition. This speeds it up around 5% on both platforms.

Signed-off-by: Oli Gillespie <ogillesp@amazon.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25737)
 2025-01-06 11:43:36 +01:00
Dr. David von Oheimb
0a0862969f openssl-pkeyutl.pod.in: update from SHA-1 to SHA256, fixing default values and examples 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25958)
 2025-01-06 11:41:03 +01:00
Dr. David von Oheimb
cbb16094c3 openssl-pkeyutl.pod.in: various fixes 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25958)
 2025-01-06 11:41:03 +01:00
Dr. David von Oheimb
ddae593a92 apps/pkeyutl: Fix checks and documentation regarding -peerkey 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25958)
 2025-01-06 11:41:03 +01:00
Matt Caswell
563f6b6573 Add a funding.json file 
For details about this file format see:
https://floss.fund/funding-manifest/

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26247)
 2025-01-06 08:19:28 +00:00
Michael Baentsch
817a2b2b49 Correct return value documentation for X509V3_set_ctx() 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26295)
 2025-01-03 16:57:51 +01:00
Frederik Wedel-Heinen
65db21935a Avoid leaking memory when realloc fails 
In ossl_property_merge() we can drop the realloc because it just makes
the allocation smaller.

In quic-hq-interop.c we check the realloc result.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26244)
 2025-01-03 15:58:26 +01:00
Jonathan M. Wilbur
40c55b5aa4 test: allowedAttributeAssignments X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26163)
 2025-01-02 20:06:59 +01:00
Jonathan M. Wilbur
e3f82f2c56 doc: the allowedAttributeAssignments X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26163)
 2025-01-02 20:06:59 +01:00
Jonathan M. Wilbur
9598bc15e9 feat: support the allowedAttributeAssignments X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26163)
 2025-01-02 20:06:59 +01:00
cx
0f6caf7409 Reject invalid FFDHE and ECDHE key shares with SSL_AD_ILLEGAL_PARAMETER alert 
This changes the alert according to RFC 8446.

Fixes: #25402

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25547)
 2025-01-02 14:12:54 +01:00
Niels Dossche
32476957ea Fix potential memory leak in BIO_get_accept_socket() 
When BIO_parse_hostserv() fails it may still have allocated memory, yet
this memory is not freed. Fix it by jumping to the err label.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25817)
 2025-01-02 14:06:51 +01:00
Tomas Mraz
0baa3ac736 core_namemap.c: Use OPENSSL_STRING instead of defining STRING type 
Also avoid leak if stack push fails.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26230)
 2024-12-31 15:03:13 +01:00
Neil Horman
4f37e543d9 Reduce the matrix fanout of interop runner 
Recent test additions have increased the number of jobs spawned by the
interop runner test which exceeds the maximum allowed.

This occurs because the matrix expands to:
7 server elements
6 client elements
7 tests
2 test steps (client interop and server interop

Because of how github ci does matrix expansion, this results in
2 * 7 * 7 * 6 = 588

But most of those are invalid because each of the 2 steps only considers
either the client or server elements, and so get rerun multiple times

Alter the steps to be individual jobs, each with their own reduced
matrix to only run each relevant test once, limiting our job count to
at most 49 jobs.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26275)
 2024-12-30 14:16:17 -05:00
Зишан Мирза
c93f4a1e75 ec_kem.c: Fix ikmlen check 
This makes `ikmlen` have a length of at least `Nsk`.

Closes #26213

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26254)
 2024-12-30 17:13:43 +01:00
Matt Caswell
0958f5a5bc Add a daily run-checker test for the TLS security level 
Add a test to check that if the user reduces the default TLS security level
at configure time, then the tests still pass.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26256)
 2024-12-26 19:55:17 +01:00
Matt Caswell
2986908cc7 Ensure the tests pass even if the default seclevel has been changed 
The compile time default TLS security level can be changed if the user
sets `-DOPENSSL_TLS_SECURITY_LEVEL=x` at configure time (where "x" is some
number, typically 0 or 1).

Since OpenSSL 3.4 tests are failing if the default security level is 0. We
fix the tests for this case.

Fixes #26255

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26256)
 2024-12-26 19:55:17 +01:00
ryuishii
5b33d3e158 X509_ACERT_sign_ctx(): Remove superfluous reference 
CLA: trivial

Fixes #26107

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26120)
 2024-12-26 19:40:54 +01:00
Peter Juhasz
34ea176abf Add CMS_NO_SIGNING_TIME flag to CMS_sign(), CMS_add1_signer() 
Previously there was no way to create a CMS SignedData signature without a
signing time attribute, because CMS_SignerInfo_sign added it unconditionally.
However, there is a use case (PAdES signatures) where this attribute is not
allowed, so this commit introduces a new flag to the CMS API that causes this
attribute to be omitted at signing time.

Also add -no_signing_time option to cms command.

Fixes #15777

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15783)
 2024-12-26 19:33:42 +01:00
Jonathan M. Wilbur
b85e6f5349 fix: ci failures due to symbols missing from history 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26250)
 2024-12-23 13:54:22 +00:00
Jonathan M. Wilbur
3974058a09 doc: the attributeMappings X.509v3 extension 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26157)
 2024-12-23 09:58:15 +00:00
Jonathan M. Wilbur
1e307e65ba test: the attributeMappings X.509v3 extension 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26157)
 2024-12-23 09:58:15 +00:00
Jonathan M. Wilbur
93b5275f6b feat: support the attributeMappings X.509v3 extension 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26157)
 2024-12-23 09:58:15 +00:00
Dmitry Belyavskiy
b3bb214720 Take into account no_store when pushing algorithm 
When we put algorithm to the store, we have a fallback to the
OSSL_LIB_CTX level store when store is NULL.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26197)
 2024-12-20 18:20:17 +01:00
Dmitry Belyavskiy
f6097c7c5d This is a test for nocache provider behavior 
A follow-up to #26038

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26197)
 2024-12-20 18:20:17 +01:00
Andrey Tsygunka
bf2dea0e2c ossl_i2c_ASN1_BIT_STRING(): Fix a possible heap buffer overflow 
When data contains only zero values a buffer overflow happens.

CLA: trivial

Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26190)
 2024-12-20 09:47:34 +01:00
Kalavakolanu, Hema Anmisha
53b34561b5 safe_math.h: Check if __GNUC__ is defined 
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4880

Facing the below issue after openssl is upgraded

Edk2\CryptoPkg\Library\OpensslLib\openssl\include\internal/safe_math.h(19):
warning C4668: '__GNUC__' is not defined as a preprocessor macro, replacing
with '0' for '#if/#elif'

CLA: trivial

Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

Signed-off-by: Kalavakolanu Hema Anmisha <hema.anmisha.kalavakolanu@intel.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26204)
 2024-12-19 17:45:48 +01:00
Tomas Mraz
009fa4f924 test_evp_cipher_pipeline(): Fix memory leaks on errors 
Fixes Coverity 1636844, 1636845

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26206)
 2024-12-19 10:59:53 +01:00
Patrick J. LoPresti
982a9b8bee doc: Correctly reflect parameter constraints in EVP_DecryptUpdate() 
Fixes #26169

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26202)
 2024-12-19 10:57:00 +01:00
Michael Baentsch
50ef944cd6 Fix missing HISTORY doc entries 
Also add a check to find-doc-nits for HISTORY sections.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26188)
 2024-12-18 17:23:57 +01:00
Neil Horman
e0ea913f11 Add amplification limit test to interop quic testing 
Because this ci job only runs from the master branch, we need to add the
test here to validate that our server respects amplification limits in
our ci runs.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26181)
 2024-12-17 12:12:54 -05:00
otherddn1978
82e7a1130a Check whether ctx->pctx != NULL 
If it is NULL, ctx->pctx->pmeth dereference will cause a crash.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26176)
 2024-12-17 14:53:14 +01:00
Ramkumar
c44066bb4c docs: update man3 and man7 with cipher pipeline APIs 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24636)
 2024-12-17 11:59:32 +00:00
Ramkumar
a055154607 test: add evp_extra_test case for cipher pipeline API with fake pipeline provider 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24636)
 2024-12-17 11:59:32 +00:00
Ramkumar
ef7967d0b4 feat: add EVP APIs for cipher pipelining 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24636)
 2024-12-17 11:59:32 +00:00
Ramkumar
81af0b04cb docs: EVP pipeline API design document 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24636)
 2024-12-17 11:59:32 +00:00
Michael Baentsch
0f77b6f14e Update HISTORY sections of libssl functions > 3.0.0 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26158)
 2024-12-16 11:02:08 +01:00
Tomas Mraz
79c9cbbe1f Fix breakage on arm64_32 platforms 
We just avoid the special handling needed for Apple M1.

Fixes #26135

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26145)
 2024-12-13 15:05:21 +01:00
Ryan Farley
ffa1cf69aa openssl-dgst: Document that xoflen is required for shake 
With b911fef216, there is no longer a
default xoflen for shake algorithms. Update the manual to reflect this.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26129)
 2024-12-13 14:54:18 +01:00
Elizarova, Alina
acc2655236 Extension of OPENSSL_ia32cap to accommodate additional CPUID bits 
bits 128 - 191 CPUID.(EAX=07H,ECX=0H).EDX and CPUID.(EAX=07H,ECX=1H).EAX
bits 192 - 255 CPUID.(EAX=07H,ECX=1H).EDX and CPUID.(EAX=07H,ECX=1H).EBX
bits 256 - 319 CPUID.(EAX=07H,ECX=1H).ECX and CPUID.(EAX=24H,ECX=0H).EBX

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25709)
 2024-12-13 14:51:22 +01:00
Sasha Romijn
1b3b5a019a Fix typo in SSL_get_shared_sigalgs docs 
psighash -> psignhash

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26151)
 2024-12-13 11:38:10 +01:00
Neil Horman
005721e1a2 Limit tests with non-openssl clients 
Several quic interop implementations have a server implementation, but
not a client implementation.  Don't bother trying to run those

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26130)
 2024-12-13 11:29:12 +01:00
Michael Baentsch
8cbe6e5a81 Add HISTORY to BIO_s_mem documentation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26146)
 2024-12-13 11:27:19 +01:00
Tomas Mraz
c5257fd8d0 Fix leak of a RAND_POOL in error condition 
Fixes Coverity 1636676

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26154)
 2024-12-13 08:30:18 +01:00
Dr. David von Oheimb
a82c2bf5c9 X509: document non-standard behavior checking EKU extensions in CA and TA certs 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26142)
 2024-12-13 08:26:19 +01:00
Tomas Mraz
be4ce01f9f Fix the intermittent lhash_test failure on Windows 
We must set pending_delete before the actual deletion as another inserting
or deleting thread can pick up the delete callback before the
ossl_ht_write_unlock() call.

This can happen only if no read locks are pending and only on Windows where
we do not use the write mutex to get the callback list.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26152)
 2024-12-13 08:23:21 +01:00
Dmitry Belyavskiy
8ad98cce41 To verify MAC, we need a MAC 
Fixes #26106

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26140)
 2024-12-11 18:27:54 +01:00
Jonathan M. Wilbur
fe89f308ae test: the timeSpecification X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25476)
 2024-12-11 18:26:37 +01:00
Jonathan M. Wilbur
29ab951e9c doc: the timeSpecification X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25476)
 2024-12-11 18:26:37 +01:00
Jonathan M. Wilbur
70b17e5a00 feat: support the timeSpecification X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25476)
 2024-12-11 18:26:37 +01:00
Shakti Shah
02e72ccffa dh_cms_set_peerkey(): Fix the incorrect condition 
Only absent parameters allowed in RFC 3370.

Fixes #25824

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26058)
 2024-12-11 18:03:34 +01:00
Tomas Mraz
d992e8729e Add function to mix in an additional input into a RAND_POOL 
It will be just xor-ed over the existing entropy
in the pool.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26128)
 2024-12-10 19:04:29 +01:00
Neil Horman
dc10ffc283 Fix potential use-after-free in REF_PRINT_COUNT 
We use REF_PRINT_COUNT to dump out the value of various reference
counters in our code

However, we commonly use this macro after an increment or decrement.  On
increment its fine, but on decrement its not, because the macro
dereferences the object holding the counter value, which may be freed by
another thread, as we've given up our ref count to it prior to using the
macro.

The rule is that we can't reference memory for an object once we've
released our reference, so lets fix this by altering REF_PRINT_COUNT to
accept the value returned by CRYPTO_[UP|DOWN]_REF instead.  The
eliminates the need to dereference the memory the object points to an
allows us to use the call after we release our reference count

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25664)
 2024-12-10 14:58:08 +01:00
Tomas Mraz
3bf273b21b Fix memory ordering guarantees and TSAN errors 
If we had refcounted object allowing lockless writes
the relaxed semantics on DOWN_REF would allow scheduling
these writes after simultaneous release of the object by
another thread.

We do not have any such objects yet, but better to make
the refcount correct just in case we will have them
in future.

TSAN doesn't properly understand this so we use
even stronger acq_rel semantics if building with TSAN.

Fixes #25660

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25664)
 2024-12-10 14:58:08 +01:00
Tomas Mraz
420d5d6294 Add test for releasing a shared EVP_PKEY across threads 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25664)
 2024-12-10 14:57:53 +01:00
Tomas Mraz
c4b30d9c6d ossl_cms_get1_crls_ex(): Avoid doublefree if CRL up ref fails 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/26100)

(cherry picked from commit ef0be53f90)
 2024-12-10 10:52:54 +01:00
Tomas Mraz
e2ffc9e7d0 Revert the behavior change of CMS_get1_certs() and CMS_get1_crls() 
Fixes #26079

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/26100)

(cherry picked from commit afd36cbef8)
 2024-12-10 10:52:52 +01:00
Tom Cosgrove
5f9814d95c Remove references to git.openssl.org from README.md 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26122)
 2024-12-10 10:38:15 +01:00
Mohammed Alhabib
604411f886 speed.c: Changed the declaration of aead_ivlen to a #define 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26109)
 2024-12-10 10:36:16 +01:00
Tomas Mraz
5fce85ec52 Exchange jitter and no-ct jobs between daily and on push CI 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26112)
 2024-12-06 15:36:57 +01:00
Tomas Mraz
6bba373ec3 jitter_generate(): Properly mix in the additional input 
By adding the additional input directly to the pool
we were using just the additional input.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26112)
 2024-12-06 15:36:57 +01:00
willmafh
c8bee68185 A typo fix in a comment 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:31:35 +01:00
willmafh
282c405818 Add spaces to make macros more clear 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:28:09 +01:00
willmafh
2e407ea5c6 Code & comments changes to make them in consistent 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:27:51 +01:00
willmafh
df6a69a850 one more empty line for code style consistency 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:27:51 +01:00
willmafh
8a74ed5619 Change all one's complement to ones' complement for consistency 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:26:36 +01:00
willmafh
a1f07a0049 BN_secure_new function indentation correction 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:26:36 +01:00
willmafh
c77d9fcf8e Delete redundant parentheses for code consistency 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:26:27 +01:00
willmafh
764a876b64 Delete a redundant break 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26095)
 2024-12-06 15:25:47 +01:00
Neil Horman
f7c4d4519c Run interop tests on feature/quic-server branch 
We currently run interop tests as a client only from the master branch.
While we are developing quic-server it would be beneficial to also get
interop test results from the quic-server branch run as both a client
and a server, until such time as the feature branch is merged.  Add
building and running of a container in the test harness to our CI set

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26090)
 2024-12-03 15:04:38 +01:00
jsondevers
4d41cc9103 Add handling for additional input in jitter rng 
Fixes #25917

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25966)
 2024-12-03 11:49:33 +01:00
Joachim Vandersmissen
04812ed1de fips: zeroization of ECX public keys 
Commit fa338aa7cd added zeroization of public security parameters as
required by ISO 19790:2012/Cor.1:2015 7.9. However, that commit
overlooked ECX keys, which are used for EdDSA and X25519/X448.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25807)
 2024-12-03 10:37:14 +01:00
Kyle Evans
3d090579e3 providers: stop probing for getentropy(3) on recent FreeBSD 
FreeBSD has supported both getrandom(2) and getentropy(3) since 12.0.
The last version which did *not* have these went EoL in September 2021.
Use getrandom(2) unconditionally and fallback to sysctl kern.arandom if
we do happen to have a FreeBSD that old.

This is generally a necessary step for FreeBSD's _FORTIFY_SOURCE
implementation, which needs to do some symbol renaming tricks with the
getentropy declaration that would otherwise add some platform-specific
hacks here to accommodate.  getentropy(3) uses getrandom(2) internally
on FreeBSD, so we just cut out the middleman.

While we're here, it doesn't seem to make sense to ever prefer the
sysctl on FreeBSD or NetBSD.  For both platforms, it's limited to 256
bytes in a single request while getrandom(2) will generally use the same
backend but service the entire request in one shot, even for larger
amounts of entropy, modulo the EINTR possibility that presents itself
with larger requests.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24903)
 2024-12-03 10:35:49 +01:00
Tomas Mraz
85f17585b0 fips-label.yml: Fix ABI change label removal 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/26080)
 2024-12-02 10:30:23 +01:00
Tomas Mraz
f2348f1f84 Avoid NULL dereference with PKCS7_OP_SET_DETACHED_SIGNATURE 
We would dereference p7->d.sign pointer which can be NULL.

Reported by Han Zheng.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26078)
 2024-12-02 09:44:58 +01:00
Michael Baentsch
4a4505cc64 Document version-specific utility of EVP_PKEY_Q_keygen 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26040)
 2024-11-29 19:06:13 +01:00
Frederik Wedel-Heinen
54332adf29 Minor nit fix to EVP_CipherFinal_ex() return code documentation. 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25849)
 2024-11-29 19:03:16 +01:00
Holger Dengler
f4550fb5b5 Fix memleak in dsa_gen() 
Free the stack return value `dsa` on each early exit.

Fixes #25905

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25948)
 2024-11-29 19:01:01 +01:00
slontis
79c98fc6cc Fix EVP_PKEY_print_private() so that it works with non default providers. 
At some point in time it was decided that the EC keymanagers ec_export()
function would only allow the selection to be both the public + private
parts. If just the private element is selected it returns an error.
Many openssl commandline apps use EVP_PKEY_print_private() which passes
EVP_PKEY_PRIVATE_KEY to the encoder. This selection propagates to
encoder_construct_pkey(). For external providers (such as the fips
provider this will call the keymanagers export() with the selection set
to just the private part.

So we either need to
1) change the selection in EVP_PKEY_print_private() or
2) modify the selection used in the export used in
   encoder_construct_pkey
3) Change the ec_export to allow this.

I have chosen 2) but I am not sure if this is the correct thing to do
or whether it should conditionally do this when the output_type ==
'text'.

Issue was reported by Ilia Okomin (Oracle).

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26004)
 2024-11-29 17:11:23 +01:00
Alexandr Nedvedicky
578760bb6a die() in .tmpl file should not be silently ignored. 
call to die() in perl templates is currently ignored.
any error printed by die() commad appears in template
output.

In order to make sure die() terminates processing we
must ensure we emite `undef` value. This is ensured
by adding a `BROKEN` callback to `fill_in()` Template
method. The callback must return undef to stop processing.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26064)
 2024-11-29 17:07:40 +01:00
Bartel Artem
fdded23b44 apps/passwd.c: Convert a redundant check to assert 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26053)
 2024-11-29 14:33:30 +01:00
Neil Horman
4c04a19860 Fix solaris build in CRYPTO_atomic_store api 
Misnamed variable, just correct it to dst

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26075)
 2024-11-29 12:08:10 +01:00
sftcd
740668f0b5 Use static array (length 256) for copy of OPENSSL_MALLOC_FAILURES 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26039)
 2024-11-28 17:01:28 +01:00
Tomas Mraz
0bba821881 Deprecate all BIO_meth_get_*() functions 
Their use by applications is inherently unsafe.
Fixes #26047

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/26056)
 2024-11-28 16:48:43 +01:00
Niels Dossche
a64d26ac02 Use sk_X509_ATTRIBUTE_deep_copy() to copy attribute stacks in pk7_doit.c 
Clean up the code by using the dedicated stack copy function.

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25713)
 2024-11-28 15:27:08 +01:00
Pauli
ce4b244415 ci: add daily runcheckers to exercise the -DOPENSSL_PEDANTIC_ZEROIZATION option 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
01cfee2cdf fips: change integrity check zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
8d09e61be6 pbkdf2: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
db1d8c90d5 hkdf: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
e73c1faa53 rsa: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
de22c10b97 ffc: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
Pauli
f471061721 ec: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26068)
 2024-11-28 15:13:35 +01:00
willmafh
0b05db0e20 A typo fix in a comment 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26069)
 2024-11-28 15:05:02 +01:00
David Benjamin
847a23757f Document expected BIO operations for libssl 
If your custom BIO does not implement BIO_CTRL_FLUSH, it won't work, but
this is not document anywhere.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26060)
 2024-11-27 13:02:56 +01:00
Richard Levitte
5dbcfbff16 Upgrade action/{upload,download}-artifact to v4 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25920)
 2024-11-27 11:31:35 +01:00
Dimitri John Ledkov
b9886a6f34 fips-jitter: set provider into error state upon CRNG permanent failures 
With fips-jitter build time option, jitter can be inside FIPS
boundary.

Calls to jent_read_entropy() can return permanent failures for
Repetitive Count Test (RTC), Adaptive Proportion Test (APT), LAG
prediction test.

Ensure the module enters error state upon permanent jitter failures.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25957)
 2024-11-25 15:20:55 +01:00
Niels Dossche
98be2e8fb6 Fix potential memory leak on failure of ecx_gen_init() 
When ecx_gen_set_params() returns 0, it could have duplicated the memory
for the parameter OSSL_KDF_PARAM_PROPERTIES already in gctx->propq,
leading to a memory leak.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26015)
 2024-11-25 15:18:26 +01:00
Niels Dossche
d7e8f6f781 Fix potential memory leak on failure of dsa_gen_init() 
When dsa_gen_set_params()  returns 0, it could have duplicated the memory for the parameter
OSSL_PKEY_PARAM_FFC_DIGEST already in gctx->mdname, leading to a memory leak.

Allocated here: 47a80fd203/providers/implementations/keymgmt/dsa_kmgmt.c (L524)
Can return 0 here: 47a80fd203/providers/implementations/keymgmt/dsa_kmgmt.c (L529-L536)

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/26016)
 2024-11-25 15:11:08 +01:00
Tom Cosgrove
ea5817854c Enable AES and SHA3 optimisations on Apple Silicon M4-based macOS systems 
AES gets a performance enhancement of 7-33%.

Tested on an M4 Pro, but the CPU cores are the same on M4 and M4 Max.

Change-Id: I634c03f1d2b50fa5f8ca97dd65975e49d970c72b

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/25940)
 2024-11-22 14:56:04 +01:00
Dimitri John Ledkov
635bf4946a fips: remove redundant RSA encrypt/decrypt KAT 
FIPS 140-2 IG D.9 has become FIPS 140-3 D.G (see "Mapping FIPS 140-2
IGs to FIPS 140-3" in the FIPS 140-3 IG).

The requirements w.r.t. RSA KATs have now been relaxed, meaning that
existing full-message RSA signature verification (which is performed
separately) is sufficient to meet KAT requirements for all RSA
usecases (KEM/Encrypt/Decrypt/Sign/Verify).

Dropping this KAT is very useful, because it is large/expensive on
module startup, but also because it enables in the future to block RSA
Encrypt/Decrypt operations with paddings other than OAEP, which are
legacy or deprecated by either current or draft algorithm transition
SP.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25988)
 2024-11-22 14:26:01 +01:00
Dimitri John Ledkov
5946465a87 fips: zeroize temporary self-check out MD variable 
At least this is done on module startup only.

To satisfy ISO/IEC 19790:2012/Cor.1:2015(E) Section 7.5 [05.10]
requirement.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25945)
 2024-11-22 14:24:59 +01:00
Dmitry Belyavskiy
69d0d93954 .gitignore: Ignoring demo executables 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26009)
 2024-11-22 14:23:10 +01:00
Peiwei Hu
7b08f2566b Remove the negative return values of EVP_KDF_* functions in documents 
None of the EVP_KDF_* functions will ever return a negative value.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25811)
 2024-11-22 12:11:34 +01:00
Peiwei Hu
8baf61d51b Fix wrong return value checks for some functions 
- in particular in use of X509_LOOKUP_load_file, EVP_PKEY_print_params,
EVP_PKEY_keygen, X509_CRL_add1_ext_i2d, EVP_PKEY_keygen_init

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25811)
 2024-11-22 12:10:26 +01:00
Peiwei Hu
b2b995ec2d Fix multiple wrong use of BN_check_prime 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25811)
 2024-11-22 12:09:38 +01:00
Peiwei Hu
1273fae170 Fix multiple wrong checks of EVP_PKEY_set1_encoded_public_key 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25811)
 2024-11-22 12:09:38 +01:00
Peiwei Hu
1a93be1eab apps/lib/apps.c: fix the wrong check in check_cert_attributes 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25811)
 2024-11-22 12:09:38 +01:00
Kai Pastor
e131868678 Mark OPENSSL_armcap_P .hidden in arm asm 
Fixes #25601
Fixes #22414

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22181)
 2024-11-22 11:22:00 +01:00
Neil Horman
2de7e1d698 Fix SSL_write_[ex|ex2] on blocking quic streams 
When writing to a blocking quic stream, we sometimes get duplicate
transmitted data.  This occurs when a call to quic_write_blocking has to
wait for space to become available in the ring buffer.  When we do a
wait, the call sets *written to the value returned in args.total_written
as filled out by the calls to block_until_pred->quic_write_again.
However, the value there is based on the amount we requested, which is
only the remaining data that we didn't append in xso_sstream_write.  So
if we call quic_write_blocking with a buffer of length X, and initially
append Y bytes, and write the remainig X-Y bytes via a block_until_pred
call, then *written will return with the value X-Y, even though we wrote
the full X bytes to the ring buffer.

Fix it by recording the initial amount appended into *written, and then
add the args.total_written value if we have to wait on more space

Fixes openssl/project#924

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26023)
 2024-11-21 09:41:15 -05:00
Tomas Mraz
93bfe97c5b sm2_sig_verify(): Do not call BN_CTX_end() without BN_CTX_start() 
In case of memory allocation failure this
could happen.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25994)
 2024-11-21 11:13:56 +01:00
Michael Baentsch
0c64b1ca03 add new keytype test for EVP_PKEY_Q_keygen 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25972)
 2024-11-21 09:09:45 +00:00
Tomas Mraz
47a80fd203 pkeyutl.c: Avoid freeing pkey at multiple places 
Also fixes a leak of pkey in error case for -verifyrecover.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25987)
 2024-11-20 17:40:26 +01:00
spectre
6f2c97d50a README.md: Fix typo. Change 'the are' to 'there are' 
This pull request fixes a typo in the documentation.
The phrase "the are" has been corrected to "there are".

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25977)
 2024-11-20 17:23:10 +01:00
Michael Baentsch
1a077b38c9 s_cb.c: Move the negotiated group output 
It needs to be always displayed not just with -brief.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25959)
 2024-11-20 17:10:20 +01:00
wangcheng
4c41aa4b33 Add CTX copy function for EVP_MD to optimize the performance of EVP_MD_CTX_copy_ex. 
1. Add OSSL_FUNC_digest_copyctx_fn function for EVP_MD, which is used to copy algctx from the old EVP_MD_CTX to the new one.

2. Add implementation of OSSL_FUNC_digest_copyctx_fn function for default providers.

3. Modify EVP_MD_CTX_copy_ex: When the fetched digest is the same in in and out contexts, use the copy function to copy the members in EVP_MD_CTX if the OSSL_FUNC_digest_copyctx_fn function exists. Otherwise, use the previous method to copy.

4. Add documentation for OSSL_FUNC_digest_copyctx function in doc/man7/provider-digest.pod.

5. Add testcase.

Fixes #25703

Signed-off-by: wangcheng <bangwangnj@163.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25726)
 2024-11-20 14:12:53 +01:00
Dr. David von Oheimb
9ca66fc273 x509_vfy.c and x509_lu.c: refactor find_issuer(), X509_STORE_CTX_get1_issuer(), etc. 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18762)
 2024-11-20 12:48:24 +01:00
Tomas Mraz
6a3d5b6e62 os-zoo CI: Replace macos-12 run with macos-15 
macos-12 runners will be removed in December.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25715)
 2024-11-20 12:19:57 +01:00
Neil Horman
dcb5d6bf88 Add docs for OSSL_PARAM_print_to_buf 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:40:13 -05:00
Neil Horman
63b671626e Make ossl_trace_param_values an official api function 
lots of people may want to print params to a buffer.  Make it part of
our api

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:38:25 -05:00
Neil Horman
4fec10eae7 Add QUERY trace points 
Adds trace messages for method store add/remove and fetch operations

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:36:25 -05:00
Neil Horman
3eed43f8a1 Add a QUERY trace category 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:36:19 -05:00
Neil Horman
11539fd734 Add tracing messages to the provider api 
Adds tracing messages to the
init/teardown/gettable_params/get_params/query/unquery operations for a
provider

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:36:19 -05:00
Neil Horman
193296eaaa Adding a trace category for PROVIDER calls 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25630)
 2024-11-19 08:36:19 -05:00
Dmitry Misharov
5c5b8d2d7c remove ternary from runs-on, security repo is hosted on github.com 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25939)
 2024-11-15 17:44:56 +01:00
Alicja Kario
eaf4da97c9 man ECDSA_sign(3): fix wrong variable names 
the parameters in the function definitions use `siglen` not `sig_len`,
this fixes the doc text.

Signed-off-by: Alicja Kario <hkario@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25927)
 2024-11-13 17:32:45 +01:00
Andrew Dinh
ef39dd058b Change "a SSL" to "an SSL" 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25868)
 2024-11-13 17:24:40 +01:00
Tomas Mraz
837f05fc30 test_hashtable_multithread(): Stress it more 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25669)
 2024-11-13 17:22:37 +01:00
Tomas Mraz
9abd6ca635 Use test_random() in hashtable mt test for reproducibility 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25669)
 2024-11-13 17:22:37 +01:00
Dr. David von Oheimb
577ec498bd Fix doc and use of_X509v3_add_extensions() in case sk_X509_EXTENSION_num(exts) <= 0 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25631)
 2024-11-13 17:19:58 +01:00
Neil Horman
15c6580a76 Add test for SSL_stream_reset 
Add a test to the quic_multistream test suite to reset a stream after
all data has been received by a given stream, ensuring that we don't
crash in the reset operation

Fixes #25410

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25910)
 2024-11-13 10:55:16 -05:00
Neil Horman
bbfffbcaf3 Fix SSL_stream_reset for stream objects which have FIN bit set 
When calling SSL_stream_reset on a QUIC stream object that has received
all data that is expected to be sent (i.e. when the sender has sent a
STREAM frame with the FIN bit set), we encounter the following segfault:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7f0bd28 in ossl_quic_sstream_get_final_size (qss=0x0, final_size=0x0) at ssl/quic/quic_sstream.c:273
273	    if (!qss->have_final_size)
(gdb) bt
0)  0x00007ffff7f0bd28 in ossl_quic_sstream_get_final_size (qss=0x0, final_size=0x0) at ssl/quic/quic_sstream.c:273
1)  0x00007ffff7ef65bf in quic_validate_for_write (xso=0x5555555efcb0, err=0x7fffffffd5e0) at ssl/quic/quic_impl.c:2513
2)  0x00007ffff7ef8ae3 in ossl_quic_stream_reset (ssl=0x5555555efcb0, args=0x0, args_len=0) at ssl/quic/quic_impl.c:3657
3)  0x00007ffff7ebdaa6 in SSL_stream_reset (s=0x5555555efcb0, args=0x0, args_len=0) at ssl/ssl_lib.c:7635
4)  0x0000555555557527 in build_request_set (
    req_list=0x55555555ebd0 "neil1.txt neil2.txt neil3.txt neil4.txt neil5.txt neil6.txt neil7.txt neil8.txt neil9.txt neil10.txt neil11.txt neil12.txt neil13.txt neil14.txt neil15.txt neil16.txt neil17.txt neil18.txt neil19.txt "..., ssl=0x5555555b6f80)
    at demos/guide/quic-hq-interop.c:545
5)  0x00005555555587b2 in main (argc=4, argv=0x7fffffffe568) at demos/guide/quic-hq-interop.c:941

This occurs because:
1) When the stream FIN bit is set, the quic stack frees the underlying
   stream structures immediately within the QUIC stack
and
2) when SSL_stream_reset is called, the call stack indicates we call
   quic_validate_for_write, which attempts to access the
   xso->stream->sstream QUIC_SSTREAM object, which was already freed in
   (1)

The fix I think is pretty straightforward.  On receipt of a STREAM frame
with a FIN bit set, the QUIC stack sets the QUIC_STREAM object state to
QUIC_SSTREAM_STATE_DATA_RECVD, which means we can use that state to
simply assert that the stream is valid for write, which allows it to be
reset properly.

Fixes #25410

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25910)
 2024-11-13 10:55:08 -05:00
Tomas Mraz
21f6c3b4fb Adjustments for the on schedule workflows 
Run them all after 02:00 UTC.
Add possibility to run them on workflow_dispatch.
Add branch 3.4 to the coveralls.yml.
Remove the branches from os-zoo.yml as it is
possible to run on them manually from workflow_dispatch.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25765)
 2024-11-13 12:15:35 +01:00
Holger Dengler
0abbd3e5ac Fix memleaks in cmd_RecordPadding() 
Free the internal copy of parameter `value` on each early
exit.

Fixes #25906

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25926)
 2024-11-13 12:00:26 +01:00
Jonathan M. Wilbur
1f7d2a2887 feat: define and use ossl_bio_print_hex 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25429)
 2024-11-13 11:53:34 +01:00
Jonathan M. Wilbur
80b0a33b38 test: the attributeDescriptor X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25429)
 2024-11-13 11:53:34 +01:00
Jonathan M. Wilbur
044b95837a doc: the attributeDescriptor X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25429)
 2024-11-13 11:53:34 +01:00
Jonathan M. Wilbur
cccdf41010 feat: support the attributeDescriptor X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25429)
 2024-11-13 11:53:34 +01:00
Tomas Mraz
ba6f115ccf txp_generate_stream_frames(): Set stream id in header early enough 
Otherwise we will calculate an incorrect header
size for higher stream ids and won't fit the
frame into the packet.

Fixes #25417

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25928)
 2024-11-12 16:56:09 +01:00
Dr. David von Oheimb
dd73b45e28 APPS/load_key_certs_crls(): refactor to clean up the code a little and add clarifying comments 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/22528)
 2024-11-12 12:27:46 +01:00
Dr. David von Oheimb
012353bdf2 openssl-pkeyutl.pod.in: improve description of -rawin and -digest options 
Fixes #25827

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25831)
 2024-11-09 12:06:38 +01:00
Dr. David von Oheimb
26a826c2d1 openssl-pkeyutl.pod.in: add that -sign is default op, update claim on hash needed for -sign/-verify, etc. 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25831)
 2024-11-09 12:06:07 +01:00
Dr. David von Oheimb
abad748da8 APPS/pkeyutl: add missing high-level check for -verifyrecover being usable only with RSA 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25903)
 2024-11-09 11:43:59 +01:00
Dr. David von Oheimb
fe07cbf9c3 APPS/pkeyutl: remove wrong check for -verifyrecover regarding too long sign/verify input 
Fixed #25898

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25903)
 2024-11-09 11:43:59 +01:00
Matt Caswell
b10cfd93fd Add a test for setting TLSv1.2 ciphersuites on a QUIC object 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25886)
 2024-11-08 14:36:17 +01:00
Matt Caswell
40237bf97a Don't complain with "no cipher match" for QUIC objects 
Calling the functions SSL_CTX_set_cipher_list() or SSL_set_cipher_list() will
return the error "no cipher match" if no TLSv1.2 (or below) ciphers are enabled
after calling them. However this is normal behaviour for QUIC objects which do
not support TLSv1.2 ciphers. Therefore we should suppress that error in this
case.

Fixes #25878

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25886)
 2024-11-08 14:36:17 +01:00
Matt Caswell
e54526413d Add a test for the new_session_cb from a QUIC object 
Setting a new_session_cb should work for a QUIC object just as it does
with a normal TLS object.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25874)
 2024-11-07 12:05:34 +01:00
Matt Caswell
dc84829cc5 Make sure we use the correct SSL object when making a callback 
When processing a callback within libssl that applies to TLS the original
SSL object may have been created for TLS directly, or for QUIC. When making
the callback we must make sure that we use the correct SSL object. In the
case of QUIC we must not use the internal only SSL object.

Fixes #25788

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25874)
 2024-11-07 12:05:34 +01:00
Matt Caswell
f88c2f2d17 Keep hold of a reference to the user SSL in QUIC 
In some cases a QUIC SSL_CONNECTION object needs to get hold of a reference
to the original SSL object as created by the user. We should keep a
reference to it.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25874)
 2024-11-07 12:05:23 +01:00
Vladimirs Ambrosovs
2aaef03339 Bugfixes for params to legacy control translations for EC parameters 
param->ctrl translation: Fix fix_ecdh_cofactor()

In POST_PARAMS_TO_CTRL state the fix_ecdh_cofactor() function should
return value in ctx->p1

param->ctrl translation: fix evp_pkey_ctx_setget_params_to_ctrl
 return

Since some of the ctrl operations may return 0 as valid value
(e.g. ecdh_cofactor value 0 is valid setting), before colling
POST_PARAMS_TO_CTRL, we need to check return value for 0 as well
otherwise the evp_pkey_ctx_setget_params_to_ctrl function fails
without a chance to fix the return value

param->ctrl translation: Set ecdh_cofactor default action_type GET

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22587)
 2024-11-07 10:35:54 +01:00
oleg.hoefling
85a52f7292 Adjust naming authority formatting when printing out admission extension 
Indent namingAuthority section with two spaces to match the parent
node.

Signed-off-by: oleg.hoefling <oleg.hoefling@gmail.com>

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25814)
 2024-11-07 10:29:34 +01:00
Niels Dossche
fa856b0ce0 Fix memory leak on failure in copy_issuer() 
When sk_GENERAL_NAME_reserve() fails, ialt is not freed.
Add the freeing operation in the common error path.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25876)
 2024-11-07 10:19:56 +01:00
Niels Dossche
83b62d41b2 Remove unnecessary sk_GENERAL_NAME_free() calls on NULL 
There are several calls to sk_GENERAL_NAME_free() where the argument is
actually NULL, there are not necessary.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25877)
 2024-11-05 16:14:40 +01:00
Celeste Liu
e899361b98 x509: add a newline after printing Full Name 
We forget it in 58301e24f6.

Fixes #25853

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25854)
 2024-11-05 14:22:10 +01:00
Tomas Mraz
0b234a237c interop-tests.yml: Update to Fedora 40 and fix provisioning breakage 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25847)
 2024-11-05 14:07:30 +01:00
ArtSin
ccaa754b5f Fix uses of EVP_PKEY_Q_keygen with size_t variadic argument 
Fix cases where `int` argument was passed instead of `size_t`.

CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25857)
 2024-11-05 13:49:08 +01:00
Matt Caswell
d1669a14d1 Fix the default_md example in the ca docs 
We should not have an example showing the default_md as md5.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25856)
 2024-11-05 11:12:33 +00:00
Michael Baentsch
b9881e8eb1 Document extensibility of -groups parameter via providers 
Also add brainpool curves

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25821)
 2024-11-04 12:01:18 +01:00
Gábor Tóthvári
8f4cd8e305 Remove two unused union members from struct x509_object_st. 
CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25826)
 2024-11-04 11:52:17 +01:00
Todd Short
a590a7e3bc Use correct alerts for some cert comp errors 
Fixes #25471

Signed-off-by: Todd Short <todd.short@me.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25845)
 2024-11-04 11:50:46 +01:00
Frederik Wedel-Heinen
357e27342e Support DEFAULT keyword and '-' prefix in SSL_CTX_set1_groups_list() 
Fixes #25790

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25813)
 2024-11-04 11:49:49 +01:00
Dr. David von Oheimb
1ee906143c APPS/pkeyutl: strengthen error message on too long sign/verify input 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22910)
 2024-11-04 10:19:04 +01:00
Dr. David von Oheimb
50c0241de2 APPS/pkeyutl: -digest implies -rawin and can only be used with -sign and -verify 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22910)
 2024-11-04 10:19:02 +01:00
Dr. David von Oheimb
c7764dacdf APPS/pkeyutl: improve -rawin usability (implied by Ed25519 and Ed448) and doc 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22910)
 2024-11-04 10:18:24 +01:00
Dr. David von Oheimb
7086332550 CHANGES.md: re-word 'app' to 'command' and 'apps' to 'commands' for consistency 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22910)
 2024-11-04 10:16:04 +01:00
Mohammed Alhabib
607a46d003 apps/speed.c: Fix the benchmarking for AEAD ciphers 
Fixed the benchmarking for the evp aead interface for ccm, gcm, ocb, and siv,
where decryption fails when executing
`openssl speed -evp aes-128-ccm -decrypt` and
`openssl speed -evp aes-128-gcm -decrypt`.

Related issues are [24686](https://github.com/openssl/openssl/issues/24686)
and [24250](https://github.com/openssl/openssl/issues/24250).
Now both encryption and decryption, with or without AAD, executes correctly
without issues.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25823)
 2024-11-04 10:04:23 +01:00
Aditya
539b17b658 apps: Change default cipher to aes-256-cbc for req, cms and smime apps 
Update `CHANGES.md` and `NEWS.md`; remove `no-des` guard from req, cms,
and smime apps

Update MAN pages for default cipher; fix styling by removing braces around single statements

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25839)
 2024-11-04 09:56:55 +01:00
Zheyu Shen
1d160dbf39 Fix incorrect openssl-smime doc sample command for encrypt 
Original documented sample command causes error. PEM recipient cert argument needs to go last.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25829)
 2024-11-01 17:27:19 +01:00
Tomas Mraz
59f5f6c73c speed.c: Check for 0 block size 
Although this cannot really happen check for 0 block size
to avoid division by 0.

Fixes Coverity 1633936

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25822)
 2024-10-31 13:00:10 +01:00
Niels Dossche
8ff6edb9da Fix potential memory leak in OSSL_HPKE_CTX_new() 
ctx->propq is a duplicated string, but the error code does not free
the duplicated string's memory. If e.g. EVP_CIPHER_fetch() fails then
we can leak the string's memory.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25812)
 2024-10-30 11:58:16 +00:00
Aditya
7e3f7f1dbb test: Add test cases for req -cipher option 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25796)
 2024-10-30 11:55:23 +00:00
Aditya
bca1bb2977 req: Add -cipher option to specify private key encryption cipher 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25796)
 2024-10-30 11:55:23 +00:00
Neil Horman
43ba601723 Remove sslkeylog file setup from quic-hq-interop 
Now that libcrypto supports the user of SSLKEYLOGFILE, the interop demo
attempts to open the same file based on the same env variable.

The hq-interop-demo code can just be removed, and it fixes the open
failure when both libcrypto and hq-interop attempt to open and write the
same file, which is causing the nightly failure

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25819)
 2024-10-30 11:49:11 +00:00
Richard Levitte
4c29044a83 fix: util/check-format-commit.sh - fix ending check 
Look at the end result instead of the file name it's stored in

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25810)
 2024-10-30 11:41:55 +00:00
Michael Baentsch
280c1d0f3e output negotiated TLS1.3 group 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25808)
 2024-10-30 11:39:29 +00:00
Tomas Mraz
a3660729e6 speed.c: Check block size before running EVP_Cipher_loop() 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/25792)
 2024-10-28 15:53:31 -04:00
Tomas Mraz
c60a2b1830 test_speed: Explicitly test the crashing command line on sparc 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/25792)
 2024-10-28 15:53:31 -04:00
Matt Caswell
27fa9d33e1 Fix builds on riscv64 using musl 
Some environments using musl are reported to have the hwprobe.h include
file but not have the __NR_riscv_hwprobe define.

Fixes #25772

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/25787)
 2024-10-28 15:44:44 -04:00
Bernd Edlinger
f30d6ba455 Fix ambiguous output of Signature Algorithms 
Signature Algorithms are printed in a SIG+HASH format.
In some cases this is ambiguous like brainpool and RSA-PSS.
And the name of ed25519 and ed448 must be spelled in lower case,
so that the output can be used as a -sigalgs parameter value.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25797)
 2024-10-28 05:52:48 +01:00
Dr. David von Oheimb
80026e5d9e check-format-commit.sh: various improvements; check unstaged changes on empty commit range 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25666)
 2024-10-26 18:52:57 +02:00
Dr. David von Oheimb
380ea5974c check-format-commit.sh: make awk patterns more robust for MacOS and certain flavors of Linux 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25666)
 2024-10-26 18:52:57 +02:00
dependabot[bot]
06aa41a5f5 Dependabot update 
CLA: trivial

(deps): Bump actions/setup-python

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.2.0 to 5.3.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5.2.0...v5.3.0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25795)
 2024-10-24 17:45:24 +00:00
Dimitri John Ledkov
a08a145d4a github: add fips configuration, with legacy transitions turned off 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25762)
 2024-10-24 15:27:43 +02:00
Dimitri John Ledkov
9d70bba135 fips no-des: compile out TDES KAT 
FIPS provider correctly supports no-des build time option and doesn't
advertise DES related algorithms. However KAT test for DES is still
attempted to be executed and fails.

This prevents configuring FIPS provider without legacy behaviour as
defined in SP 800-131Arev2. Also see #25761 internal docs.

Fix `enable-fips no-des` build option, and add a daily checker for
"legacy-free" (as much as currently feasible) FIPS configuration.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25762)
 2024-10-24 15:27:43 +02:00
Frederik Wedel-Heinen
fc0e79461f tls_common.c: Align the calculation of maximal alignment value 
In tls_setup_write_buffer() and tls_setup_read_buffer() the calculation
is different. Make them the same.

Fixes #25746

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25764)
 2024-10-24 15:24:52 +02:00
Alexandr Nedvedicky
3d3bb26a13 Do not confuse TAP::Parser by mixing up stderr with stdout. 
This avoids false psotivie failures on FreeBSD-CI which
suffers most from this issue.

Fixes #23992

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/25613)
 2024-10-23 15:45:57 +02:00
Kurt Roeckx
76783a8286 Dependabot: no longer set an "approval: otc review pending" label 
The label doesn't exist anymore.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25706)
 2024-10-23 15:21:23 +02:00
Tomas Mraz
c5795689c9 Fix missing sendmmsg/recvmmsg on AIX 
This at least fixes the build failures on AIX

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25704)
 2024-10-23 15:19:34 +02:00
Dr. David von Oheimb
72d3e9bac4 TRACE: automatically respect disabled categories 
by fixing OSSL_trace_begin() to return NULL when given category is not enabled

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25652)
 2024-10-23 15:16:37 +02:00
Niels Dossche
e8d963594f Fix memory leaks in ossl_quic_calculate_retry_integrity_tag() 
Fixes #25625

Several error paths return 0 directly instead of going to err to clean
up the objects.

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25636)
 2024-10-23 15:14:08 +02:00
Michael Baentsch
37aa1143c3 Improve documentation about duplicate algorithm registrations 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25624)
 2024-10-23 15:10:49 +02:00
Ingo Franzki
f928304a9d s390x: Don't probe crypto cards for ME/CRT offloading during initialization 
Probing for crypto cards during initialization by issuing an ioctl to the
zcrypt device driver can cause a lot of traffic and overhead, because it
runs for each and every application that uses OpenSSL, regardless if that
application will later perform ME or CRT operations or not.

Fix this by performing no probing during initialization, but detect the
crypto card availability only at the first ME/CRT operation that is subject
to be offloaded. If the ioctl returns ENODEV, then no suitable crypto
card is available in the system, and we disable further offloading
attempts by setting flag OPENSSL_s390xcex_nodev to 1.

Setting the global flag OPENSSL_s390xcex_nodev in case of ENODEV is
intentionally not made in a thread save manner, because the only thing
that could happen is that another thread, that misses the flag update,
also issues an ioctl and gets ENODEV as well.

The file descriptor is not closed in such error cases, because this could
cause raise conditions where we would close a foreign file if the same
file descriptor got reused by another thread. The file descriptor is finally
closed during termination by the atexit handler.

In case the ioctl returns ENOTTY then this indicates that the file descriptor
was closed (e.g. by a sandbox), but in the meantime the same file descriptor
has been reused for another file. Do not use the file descriptor anymore,
and also do not close it during termination.

Fixes: 79040cf29e

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25576)
 2024-10-23 15:07:01 +02:00
Michael Baentsch
e1886edf4b work around oqsprovider out-of-source build bug 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25702)
 2024-10-23 11:12:33 +11:00
Michael Baentsch
8bcf488011 Updated oqsprovider to v0.7.0 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25702)
 2024-10-23 11:12:33 +11:00
Tomas Mraz
36254fda37 Add CHANGES.md and NEWS.md entries for CVE-2024-9143 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/25734)

(cherry picked from commit 233034bc5a)
 2024-10-22 10:45:14 +01:00
Tomas Mraz
1f0cb85047 ecdh_cofactor_derive_test(): Skip the test if the curve is not supported 
It will not be supported if the fips provider was built with no-ec2m.

Fixes #25729

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25731)
 2024-10-21 14:57:20 +01:00
Tomas Mraz
dfc5ba8afa run-checker-merge.yml: Combine no-ec2m with enable-fips 
This can reveal more errors than just no-ec2m.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25731)
 2024-10-21 14:57:20 +01:00
Dmitry Misharov
e84878a7eb update logo 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25725)
 2024-10-21 11:49:25 +01:00
Michael Baentsch
51921b8737 first cut at KEM & key management skeletons 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25640)
 2024-10-21 11:47:16 +01:00
Ondrej Moris
00776cba04 ci: re-organize external tests 
Signed-off-by: Ondrej Moris <omoris@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25587)
 2024-10-21 11:43:03 +01:00
Ondrej Moris
7832374ffb test: clean-up README-external documentation 
Signed-off-by: Ondrej Moris <omoris@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25587)
 2024-10-21 11:43:03 +01:00
Ondrej Moris
e9af1eaa54 test: Add external test for pkcs11-provider 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25587)
 2024-10-21 11:43:03 +01:00
Alicja Kario
144b9ebc3e add test coverage for #25298 
Add test coverage for issue #25298, clean up the json file so
it uses consistent indentation

Signed-off-by: Alicja Kario <hkario@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25329)
 2024-10-21 11:40:16 +01:00
Alicja Kario
bb221d3607 update tlsfuzzer to new version 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25329)
 2024-10-21 11:40:16 +01:00
Neil Horman
5b29c71aa4 updating comments in test recipie 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
5dffe6afb0 updating docs to reflect security risks for SSLKEYLOGFILE 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
6f7273a9b0 Convert keylogging in response to comments 
1) Convert failures in keylog setup to trace messages for a warning-like
   mechanism

2) Convert sslkeylogfile_cb to be a flag used to determine making a
   direct call to the internal logging function

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
a2b5e64907 Fix build break when OPENSSL_NO_SSLKEYLOGFILE is not defined 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
3992add1b7 Update sslkeylog in response to comments 
* instead of keeping an external reference count, just use the
  BIO_up_ref call, and the BIO's callback mechanism to detect the
  final free, for which we set keylog_bio to NULL

* Return an error from SSL_CTX_new_ex if the setup of the keylog file
  fails

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
8458f873a0 Adding documentation to INSTALL 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
825bb7f4bd Enable sslkeylog for some CI builds for checking 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
d381fc54b1 Add test to confirm sslkeylogfile format 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
97d4b67cca Add documentation for SSLKEYLOGFILE 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
Neil Horman
4a69a6d171 Add sslkeylog config option and implementation 
Add a config option for sslkeylog (disabled by default)

When enabled, SSL_CTX_new[_ex] becomes sensitive to the SSLKEYLOGFILE
environment variable.  It records keylog callback messages to the file
specified in the environment variable according to the format specified
in https://www.ietf.org/archive/id/draft-thomson-tls-keylogfile-00.html

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
 2024-10-21 11:34:35 +01:00
olszomal
256f580dcd CHANGES.md: Support for PKCS#7 inner contents verification 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22575)
 2024-10-21 11:32:04 +01:00
olszomal
8cfc26e6c4 Add support for p7->d.sign->contents with the V_ASN1_SEQUENCE type 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22575)
 2024-10-21 11:32:04 +01:00
Tomas Mraz
f4c4674526 Revert API change of OPENSSL_version() 
There was an API change done as part of PR #24450.
This patch reverts it.

Fixes #25690

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25692)
 2024-10-17 13:36:58 +02:00
Richard Levitte
0f8ff8fc25 [DOC] Document the OPENSSL_WINCTX type for OpenSSL_version() 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25693)
 2024-10-17 13:33:06 +02:00
Richard Levitte
7b36037e22 fix: let util/mkbuildinf.pl use SOURCE_DATE_EPOCH, even if it's zero 
Doing this allows reproducible builds, for those who want this.

Fixes #25475

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25699)
 2024-10-17 12:42:45 +02:00
Tomas Mraz
6bb62ab826 openssl-info.pod.in: Add windowscontext option to synopsis in doc 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25712)
 2024-10-16 20:00:19 +02:00
Richard Levitte
5f3fefe2f3 Add 'openssl info' item for the Windows install context 
This information is already present as an 'openssl version' item.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25694)
 2024-10-16 19:29:53 +02:00
Sebastian Andrzej Siewior
50e9d2b188 mem: Don't use posix_memalign() and friends with custom wrapper 
If the application provides custom memory allocations functions via
CRYPTO_set_mem_functions() then those should be used instead something
else like posix_memalign(). The applications might verify alloc and free
calls and pointers from posix_memalign() were never returned by the
implementations.

At least stunnel4 complains here.

Use posix_memalign() or if aligned_alloc() only if the application did
not provide a custom malloc() implementation. In case of a custom
implementation use CRYPTO_malloc() and align the memory accordingly.

Fixes #25678

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25682)
 2024-10-16 10:13:49 +02:00
dependabot[bot]
e524ac548a Dependabot update 
CLA: trivial

(deps): Bump coverallsapp/github-action

Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 2.3.0 to 2.3.2.
- [Release notes](https://github.com/coverallsapp/github-action/releases)
- [Commits](https://github.com/coverallsapp/github-action/compare/v2.3.0...v2.3.2)

---
updated-dependencies:
- dependency-name: coverallsapp/github-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25701)
 2024-10-16 10:05:57 +02:00
Viktor Dukhovni
8e008cb8b2 Harden BN_GF2m_poly2arr against misuse. 
The BN_GF2m_poly2arr() function converts characteristic-2 field
(GF_{2^m}) Galois polynomials from a representation as a BIGNUM bitmask,
to a compact array with just the exponents of the non-zero terms.

These polynomials are then used in BN_GF2m_mod_arr() to perform modular
reduction.  A precondition of calling BN_GF2m_mod_arr() is that the
polynomial must have a non-zero constant term (i.e. the array has `0` as
its final element).

Internally, callers of BN_GF2m_poly2arr() did not verify that
precondition, and binary EC curve parameters with an invalid polynomial
could lead to out of bounds memory reads and writes in BN_GF2m_mod_arr().

The precondition is always true for polynomials that arise from the
standard form of EC parameters for characteristic-two fields (X9.62).
See the "Finite Field Identification" section of:

    https://www.itu.int/ITU-T/formal-language/itu-t/x/x894/2018-cor1/ANSI-X9-62.html

The OpenSSL GF(2^m) code supports only the trinomial and pentanomial
basis X9.62 forms.

This commit updates BN_GF2m_poly2arr() to return `0` (failure) when
the constant term is zero (i.e. the input bitmask BIGNUM is not odd).

Additionally, the return value is made unambiguous when there is not
enough space to also pad the array with a final `-1` sentinel value.
The return value is now always the number of elements (including the
final `-1`) that would be filled when the output array is sufficiently
large.  Previously the same count was returned both when the array has
just enough room for the final `-1` and when it had only enough space
for non-sentinel values.

Finally, BN_GF2m_poly2arr() is updated to reject polynomials whose
degree exceeds `OPENSSL_ECC_MAX_FIELD_BITS`, this guards against
CPU exhausition attacks via excessively large inputs.

The above issues do not arise in processing X.509 certificates.  These
generally have EC keys from "named curves", and RFC5840 (Section 2.1.1)
disallows explicit EC parameters.  The TLS code in OpenSSL enforces this
constraint only after the certificate is decoded, but, even if explicit
parameters are specified, they are in X9.62 form, which cannot represent
problem values as noted above.

Initially reported as oss-fuzz issue 71623.

A closely related issue was earlier reported in
<https://github.com/openssl/openssl/issues/19826>.

Severity: Low, CVE-2024-9143

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25639)
 2024-10-16 09:21:33 +02:00
Christopher Triantafilis
f1607c8a2c Update documentation for SSL_SESSION_set_time_ex() 
Fixes #24322

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25665)
 2024-10-14 12:20:24 +02:00
Dr. David von Oheimb
2c536c8b15 replace various calls to sprintf() by BiO_snprintf() to avoid compiler warnings, e.g., on MacOS 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25534)
 2024-10-12 15:38:07 +02:00
Niels Dossche
b2474b287f Fix memory leak in tls_parse_ctos_psk() 
`sess` is not NULL at this point, and is freed on the success path, but
not on the error path. Fix this by going to the `err` label such that
`SSL_SESSION_free(sess)` is called.

CLA: trivial

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25643)
 2024-10-11 14:54:03 +02:00
slontis
01244adfc6 fipsinstall: Save the 'status indicator' if the FIPS provider is 3.0.X. 
Fixes #23400

The 3.1 FIPS provider no longer writes out the 'status indicator' by
default due to changes related to FIPS 140-3 requirements. For Backwards
compatability if the fipsinstall detects it is loading a 3.0.X FIPS
provider then it will save the 'status indicator' by default.

Disclaimer: Using a fipsinstall command line utility that is not supplied
with the FIPS provider tarball source is not recommended.

This PR deliberately does not attempt to exclude any additional options
that were added after 3.0.X. These additional options will be ignored by older
providers.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/23689)
 2024-10-11 14:52:37 +02:00
Niels Dossche
792b2c8da2 Fix potential double free through SRP_user_pwd_set1_ids() 
If SRP_user_pwd_set1_ids() fails during one of the duplications, or id
is NULL, then the old pointer values are still stored but they are now dangling.
Later when SRP_user_pwd_free() is called these are freed again,
leading to a double free.

Although there are no such uses in OpenSSL as far as I found,
it's still a public API.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25655)
 2024-10-11 14:22:36 +02:00
Andreas Mair
38e8392ba0 Use poll() in BIO_socket_wait() if available 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25055)
 2024-10-11 10:21:07 +01:00
Taylor R Campbell
99548cd16e Avoid undefined behaviour with the <ctype.h> functions. 
fix https://github.com/openssl/openssl/issues/25112

As defined in the C standard:

   In all cases the argument is an int, the value of which shall
   be representable as an unsigned char or shall equal the value
   of the macro EOF.  If the argument has any other value, the
   behavior is undefined.

This is because they're designed to work with the int values returned
by getc or fgetc; they need extra work to handle a char value.

If EOF is -1 (as it almost always is), with 8-bit bytes, the allowed
inputs to the ctype.h functions are:

   {-1, 0, 1, 2, 3, ..., 255}.

However, on platforms where char is signed, such as x86 with the
usual ABI, code like

   char *p = ...;
   ... isspace(*p) ...

may pass in values in the range:

   {-128, -127, -126, ..., -2, -1, 0, 1, ..., 127}.

This has two problems:

1. Inputs in the set {-128, -127, -126, ..., -2} are forbidden.

2. The non-EOF byte 0xff is conflated with the value EOF = -1, so
   even though the input is not forbidden, it may give the wrong
   answer.

Casting char inputs to unsigned char first works around this, by
mapping the (non-EOF character) range {-128, -127, ..., -1} to {128,
129, ..., 255}, leaving no collisions with EOF.  So the above
fragment needs to be:

   char *p = ...;
   ... isspace((unsigned char)*p) ...

This patch inserts unsigned char casts where necessary.  Most of the
cases I changed, I compile-tested using -Wchar-subscripts -Werror on
NetBSD, which defines the ctype.h functions as macros so that they
trigger the warning when the argument has type char.  The exceptions
are under #ifdef __VMS or #ifdef _WIN32.  I left alone calls where
the input is int where the cast would obviously be wrong; and I left
alone calls where the input is already unsigned char so the cast is
unnecessary.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25113)
 2024-10-10 20:47:48 +02:00
Tomas Mraz
6afaa3f41f Revert "TEMPORARY: run daily checks on PR" 
This reverts commit 4c44603d55.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25658)
 2024-10-10 08:26:38 +02:00
Dr. David von Oheimb
ee0bf38e87 improve and move text on OPENSSL_TRACE from doc/man1/openssl.pod to doc/man7/openssl-env.pod 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25540)
 2024-10-09 12:11:01 +02:00
slontis
f5981c9629 Add utility function ossl_param_is_empty() 
Changed all provider implementations that have a set_ctx_params()
to call this function instead of just testing (params == NULL).This
detects the case wherean OSSL_PARAM array contains just a terminator
entry.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25499)
 2024-10-09 11:13:46 +02:00
Dr. David von Oheimb
187952d449 APPS/storeutl: fix case where uri and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25559)
 2024-10-09 11:10:19 +02:00
Dr. David von Oheimb
d1a0bbe658 test/recipes/tconversion.pl: add sub test_file_contains 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25559)
 2024-10-09 11:10:04 +02:00
Pauli
47ebeb1c10 doc: add note about fips jitter option 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
4bdbd830ac doc: add note about the configuration option for the jitter source. 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
4c44603d55 TEMPORARY: run daily checks on PR 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
348c928d66 fips: fix locking issues 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
b448cc1ac4 test: add test for fips-jitter 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
ed524da19a add news and changes entries for the internal jitter source in FIPS 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
fc5fb3c925 fips: mention the internal jitter source in the FIPS README 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
3a01d5d65b jitter: support an internal jitter entropy source in the FIPS provider 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
61f032cc7b Add configuration option to allow the FIPS provider to use the jitter source internally 
Enabling this breaks FIPS compliance unless an entropy assessment and a revalidation
are undertaken.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Pauli
01ec59defd jitter: avoid a signed vs unsigned comparison 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25498)
 2024-10-09 13:53:10 +11:00
Dimitri John Ledkov
6f08353a4b doc: EVP_KDF document the semantic meaning of output 
Explicitely document what semantic meaning do various EVP_KDF
algorithms produce.

PBKDF2 produces cryptographic keys that are subject to cryptographic
security measures, for example as defined in NIST SP 800-132.

All other algorithms produce keying material, not subject to explicit
output length checks in any known standards.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25610)
 2024-10-08 16:05:59 +02:00
Dmitry Belyavskiy
cdbe47bf3c Increase limit for CRL download 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25608)
 2024-10-08 15:59:38 +02:00
Dmitry Belyavskiy
e647220c00 Documenting CRL download usage and restrictions 
Fixes #25603

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25608)
 2024-10-08 15:59:38 +02:00
Pauli
73e720c3a5 evp_libctx_test: fix provider compat CI regression 
The regression was introduced by #25522.

Fixes #25632

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25633)
 2024-10-08 09:28:32 +02:00
Niels Dossche
0a2a8d970f Fix potential memory leak in save_statusInfo() 
If sk_ASN1_UTF8STRING_push() fails then the duplicated string will leak
memory. Add a ASN1_UTF8STRING_free() to fix this.

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25604)
 2024-10-07 17:58:12 +02:00
Niels Dossche
d8b7a6eae9 Fix potential memory leak in PKCS7_signatureVerify() 
Fixes #25594

The code jumps to an error block when EVP_VerifyUpdate fails.
This error block does not free abuf.
In the success path the abuf memory is freed.
Move the free operation to the error block.

CLA: trivial

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25596)
 2024-10-07 17:55:13 +02:00
Olivier Chéron
80a31435e5 Test PBMAC1 with absent PBKDF2 PRF 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25568)
 2024-10-07 17:51:54 +02:00
Olivier Chéron
f3652dff2f Handle PBMAC1 with absent PBKDF2 PRF 
PRF in PBKDF2-params is optional and defaults to hmacWithSHA1.

CLA: trivial

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25568)
 2024-10-07 17:51:54 +02:00
Beat Bolli
0d6544cdf8 check-format-commit: call fewer unneeded processes 
`wc` does not output a file name if the input is stdin.

`awk` reads its file argument; there's no need for `cat`.

`sort -u` outputs unique lines. It should be supported on all platforms,
as it's specified by POSIX.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25562)
 2024-10-07 17:50:27 +02:00
Neil Horman
1c1223ff53 Add some documentation to describe the encap/decap requirements 
Document the fact that we now require unwrappedlen/wrappedlen to be set
to the size of the unwrapped/wrapped buffers

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25522)
 2024-10-07 17:47:17 +02:00
Neil Horman
796b2caa9e Adjust tests to fetch the output len for EVP_PKEY_[en|de]cap 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25522)
 2024-10-07 17:47:17 +02:00
Neil Horman
0f9516855e Update rsasve_recover to properly store outlen on success 
Outlen was never validated in this function prior to use, nor is it set
to the decrypted value on sucess.  Add both of those operations

Fixes #25509

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25522)
 2024-10-07 17:44:23 +02:00
Tomas Mraz
5bc13d5d8c cmp_vfy_test.c: Avoid NULL pointer dereference 
Fixes Coverity 1619463

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25503)
 2024-10-07 17:41:22 +02:00
Klaus Holst Jacobsen
445017152b Added check for __QNX__ define when using in_pktinfo.ipi_spec_dst 
CLA: trivial

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24361)
 2024-10-07 17:39:27 +02:00
lan1120
b69ca92a5e Drop the aid field of the signature prov ctx 
Signed-off-by: lan1120 <lanming@huawei.com>

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23094)
 2024-10-07 17:35:28 +02:00
Neil Horman
76c4f0e8ea Update test/quic-openssl-docker/run_endpoint.sh 
Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25528)
 2024-10-04 17:42:49 +02:00
Neil Horman
a941f5d52e quic-interop: exlude multiplexing 
The multiplexing test works on local runs, but
appears to be failing in CI, possibly due to some environmental
limitation (the test generates a large list of requests in an
environment variable), leading to not sending all the requests needed.
Disable the test for now, and look to re-enable it after release when we
can appropriately diagnose the problem

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25528)
 2024-10-04 17:42:49 +02:00
Neil Horman
c8b050eef1 Update quic interop docker container for chacha20 
Need to update the docker interop container to use the quic-hq-interop
client so that the right alpn is negotiated for chacha20 testing

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25528)
 2024-10-04 17:42:49 +02:00
Neil Horman
5f43a3376b Add SSL_CIPHER_SUITES env variable to quic-hq-interop 
To run the chacha20 test in interop we need to:
1) negotiate an hq-interop alpn
2) only use chacha 20

Item 1 requires the use of quic-hq-interop, the latter requires this
change

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25528)
 2024-10-04 17:42:49 +02:00
slontis
ffa5465e54 Exclude EVP_DigestSign and EVP_DigestVerify related APIs from the FIPS 
provider.

Revert changes to m_sigver.c related to #ifdef FIPS_MODULE and exclude
the file using build.info instead.

Also exclude these calls inside EVP_DigestUpdate() within the FIPS
provider since this API should only be used for self testing digests.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25570)
 2024-10-04 17:41:13 +02:00
slontis
349815b57f Fix rsa_sigalg_set_ctx_params() to return 1 for unknown parameters. 
This keeps the code consistent with the changes done for other
algorithms that support sigalg_set_ctx_params().

set_ctx_params() should always return 1 if the parameter is unknown.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25570)
 2024-10-04 17:41:13 +02:00
slontis
923baa12e1 Change FIPS self tests to use EVP_PKEY_sign/verify API. 
Self tests no longer use the EVP_DigestSign/Verify API's.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25570)
 2024-10-04 17:41:13 +02:00
Maks Mishin
4f48629c9d v3_ncons: Fix difference args names in nc_match_single function 
The arguments of the `nc_match_single` function have different names
in the declaration and definition or are mixed up in places.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25592)
 2024-10-04 12:20:19 +02:00
Dr. David von Oheimb
a571425492 add test/recipes/15-test_pkey.t 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
c8359abb88 APPS/pkey: fix case where infile and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
d5c4a8aecc APPS/pkcs8: fix case where infile and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
421e8d7af8 APPS/ocsp: fix case where reqin and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
1dbb67c4f1 APPS/{ecparam,pkeyparam}: fix case where infile and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
32189981a3 APPS/dsaparam: fix case where infile and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Dr. David von Oheimb
9ae1e6596f APPS/dhparam: fix case where infile and outfile are the same 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25552)
 2024-10-04 12:09:33 +02:00
Tomas Mraz
93d1bb6dff os-zoo.yml: Disable stringop-overflow warning on alpine edge 
fortify-headers are broken due to this warning.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25599)
 2024-10-03 13:12:40 +02:00
Richard Levitte
27af422b1c Update fips-label.yml to make 'Cleanup artifact' conditional 
If it's not conditional in the same manner as the other steps, it fails
because the artifacts aren't present => job failure.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25584)
 2024-10-03 13:06:38 +02:00
Dimitri John Ledkov
c262cc0c04 fips: add lots of potentially missing ossl_prov_is_running checks 
After rudimentary analysis, it appears the below functions can
potentially produce output, whilst the provider is in error state.

These functions were detected using this method:

```
CFLAGS='-save-temps' ./Configure enable-fips --debug
make -j10
find . -name '*.i' | xargs git add -f
git grep --cached -p ossl_prov_is_running | grep libfips-lib > ossl_prov_is_running.txt
git grep --cached -p 'return' | grep  libfips-lib > return.txt
grep '\.i=' return.txt > func-with_return.txt
grep '\.i=' ossl_prov_is_running.txt > func-with-ossl_prov_is_running.txt
grep --fixed-strings --line-regexp --file=func-with-ossl_prov_is_running.txt return.txt > func-without-ossl_prov_is_running.txt
grep -e newctx -e initctx -e dupctx func-without-ossl_prov_is_running.txt  | grep -v ossl_prov_is_running
```

And from there doing manual inspection, as the list was short at that
point.

As in compile with keeping pre-processed source code; and use `git
grep --cached -p` to find these preprocessed files, and scan for calls
to return or opssl_prov_is_running, with function name printed. And
then exclude one from the other, to hopefully get a list of all the
functions that do not check for ossl_prov_is_running.

As number of functions without "func-without-ossl_prov_is_running"
check is large, I do wonder which other functions are "interesting" to
check for. I think I'm not scanning for _update functions
correctly. Any tips on improving above analysis will help with
maintaining such checks going forward.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25580)
 2024-10-02 12:20:53 +02:00
Simo Sorce
5c91f70ba8 Use the correct length value for input salt 
In this function the salt can be either a zero buffer of exactly mdlen
length, or an arbitrary salt of prevsecretlen length.
Although in practice OpenSSL will always pass in a salt of mdlen size
bytes in the current TLS 1.3 code, the openssl kdf command can pass in
arbitrary values (I did it for testing), and a future change in the
higher layer code could also result in unmatched lengths.

If prevsecretlen is > mdlen this will cause incorrect salt expansion, if
prevsecretlen < mdlen this could cause a crash or reading random
information. Inboth case the generated output would be incorrect.

Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25579)
 2024-10-02 12:05:39 +02:00
Pauli
c477fa5a22 ci: add 3.4 to prov-compat-label tests 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25583)
 2024-10-02 08:11:05 +02:00
Pauli
3cc299258c ci: add 3.4 to the provider compatibility test 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25583)
 2024-10-02 08:11:05 +02:00
Pauli
12d14de641 test: add FIPS version check for EC cofactor derive tests 
These were added in #25548 but didn't include a FIPS version check which
causes failures testing older FIPS providers against later versions.

Also change some skips to use TEST_skip.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25582)
 2024-10-01 09:28:27 +10:00
slontis
2f362e99a1 Fix bugs in ECDH cofactor FIPS indicator. 
The code was not detecting that the cofactor was set up correctly
if OSSL_PKEY_PARAM_USE_COFACTOR_ECDH was set, resulting in an incorrect
FIPS indicator error being triggered.

Added a test for all possible combinations of a EVP_PKEY setting
OSSL_PKEY_PARAM_USE_COFACTOR_ECDH and the derive context setting
OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE.

This only affects the B & K curves (which have a cofactor that is not 1).

Bug reported by @abkarcher

Testing this properly, also detected a memory leak of privk when the
FIPS indicator error was triggered (in the case where mode = 0 and
use_cofactor was 1).

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25548)
 2024-09-30 20:07:09 +02:00
Dimitri John Ledkov
fc68cf21b5 kdfs: implement key length check in X9.42 
Similar to other KDFs, the input key should be 112 bits long.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25529)
 2024-09-30 20:03:49 +02:00
Dimitri John Ledkov
3be6387588 docs: document options added in openssl-fipsinstall 3.4+ 
Document new command line options added in 3.4.0

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25546)
 2024-09-30 10:49:02 +01:00
Dimitri John Ledkov
9331a202fe docs: document options added in openssl-fipsinstall 3.2+ 
Document new command line options added in 3.2.0

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25546)
 2024-09-30 10:48:29 +01:00
Dimitri John Ledkov
1b52b24aa4 docs: document options added in openssl-fipsinstall 3.1+ 
Document new command line options added in 3.1.0

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25546)
 2024-09-30 10:46:28 +01:00
Dimitri John Ledkov
634d84324a docs: add HISTORY section to openssl-fipsinstall (3.0+) 
Documents when the command was added.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25546)
 2024-09-30 10:45:28 +01:00
Pauli
c788f1c6be Add CHANGES entry 
To match changes in #25526

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25536)
 2024-09-30 17:58:23 +10:00
Pauli
0081964805 test: fix unit tests for fips CRNG tests 
To match changes in #25526

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25536)
 2024-09-30 17:58:09 +10:00
Pauli
d927eb2950 doc: fix typo in CRNG test documentation. 
To match changes in #25526

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25536)
 2024-09-30 17:57:18 +10:00
Dimitri John Ledkov
ed68623287 fips: Prohibit SHA1 in DH & ECDH exchange 
See Section 5 Key Agreement Using Diffie-Hellman and MQV of
[NIST SP 800-131Ar2](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf).

Strengths less than 112bits is disallowed, thus eliminating SHA1.

Skip cms test case that requires use of SHA1 with X9.42 DH.

Rename ossl_fips_ind_digest_check to ossl_fips_ind_digest_exch_check

Add myself to Changes for fips indicator work

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25517)
 2024-09-27 09:13:05 +02:00
Зишан Мирза
3ef1b7426b Check file name for not being NULL before opening it 
Fixes #24416

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25458)
 2024-09-26 20:35:26 +02:00
Зишан Мирза
4f899849ce Fix examples in EVP_PKEY_encapsulate/decapsulate documentation 
Fixes #25448

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25450)
 2024-09-26 10:29:57 +02:00
Зишан Мирза
ffc5a29608 Remove double engine reference in ossl_ec_key_dup() 
Fixes #25260

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25453)
 2024-09-26 10:26:19 +02:00
Shawn C
8ac42a5f41 Fix NULL ptr dereference on EC_POINT *point 
Use non-usual params of pkcs11 module will trigger a null ptr deref bug. Fix it for #25493

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25496)
 2024-09-26 10:04:30 +02:00
Neil Horman
c4ec708bd5 Rename list macros 
The quic implementation defined a set of LIST_* macros for list
manipulation, which conflicts with the generally support BSD api found
in the queue.h system header.  While this isn't normally a problem, A
report arrived indicating that MacOSX appears to implicitly include
queue.h from another system header which causes definition conflicts.

As the openssl macros are internal only, it seems the most sensible
thing to do is place them in a well known namespace for our library to
avoid the conflict, so add an OSSL_ prefix to all our macros

Fixes #25516

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/25519)
 2024-09-26 10:02:30 +02:00
Dr. David von Oheimb
91ec19e92e check-format.pl: do checks regarding statement/block after for() also on {OSSL_,}LIST_FOREACH{,_*} 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25535)
 2024-09-24 22:19:12 +02:00
Pauli
260ecea0d4 ctr-drbg: always use the DF for OpenSSL's DRBGs 
Force the use of the derivation function when creating OpenSSL's internal
DRBGs.

FIPS mandates the use of a derivation function, so 3.4 cannot be validated as
it stands which run counter to the indicator work that was included.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25511)

(cherry picked from commit 0ab796ef96)
 2024-09-24 17:53:26 +02:00
JohnnySavages
9d71a6622b Check sk_X509_value result before dereference 
issuer passed as second parameter to check_issued may result in
NULL dereference

CLA: trivial

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24760)
 2024-09-24 17:40:26 +02:00
Vladimir Kotal
e7abc2118f document the format of DSA signature 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23762)
 2024-09-23 22:37:03 +02:00
David von Oheimb
1ef3032eac 80-test_cmp_http.t: fix handling of IPv6 server host (localhost '::1') 
Fixes 22467

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:50 +02:00
David von Oheimb
ac91bd88d9 doc/man{1,3}: fix details on IPv6 host addresses and of whitespace in no_proxy 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:50 +02:00
David von Oheimb
fe004a09ac OSSL_HTTP_adapt_proxy(): fix handling of escaped IPv6 host addresses and of whitespace in no_proxy 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:50 +02:00
David von Oheimb
1c90d36ab1 OSSL_HTTP_open(): fix completion with default port for IPv6 host addresses 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:49 +02:00
David von Oheimb
ec4b123a96 http_server.{c,h}: make clear that IPv4 or IPv6 is used by http_server_init() 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:49 +02:00
David von Oheimb
7ec5d5916b http_server.c: fix checks of error return code in http_server_init() 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:39 +02:00
David von Oheimb
907ddee3ea BIO_s_accept.pod: fix whitespace nits: '<=0' -> '<= 0' 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:39 +02:00
Jakub Zelenka
7f62adaf2b Fix smime-type for AuthEnvelopedData 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25482)
 2024-09-19 20:59:25 +02:00
Alex Shaindlin
f5a8f65b80 doc/man3/OSSL_PARAM.pod: Correct the type of data_type 
CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25486)
 2024-09-19 20:53:41 +02:00
erbsland-dev
1299699a90 Clarify Tag Length Setting in OCB Mode 
Fixes #8331: Updated the description for setting the tag length in OCB mode to remove the misleading “when encrypting” and “during encryption” phrasing. This change emphasizes that setting a custom tag length requires a call with NULL, applicable to both encryption and decryption contexts.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25424)
 2024-09-19 20:51:38 +02:00
Paul E. Murphy
daead12df0 Fix big-endian Power10 chacha20 implementation 
Some of the BE specific permutes were incorrect. Fix them.

This passes all tests on a P10/ppc64 debian unstable host.

Fixes #25451

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25483)
 2024-09-19 11:13:35 +02:00
Michael Baentsch
27f20a464b deactivate failing Cloudflare PQ interop tests 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25488)
 2024-09-19 11:06:08 +02:00
Pauli
5ac48fd813 test: add unit tests for fips CRNG tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:44:14 +10:00
Pauli
39dc3c0f34 doc: document the health test EVP_RAND 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:44:14 +10:00
Pauli
6f20c6804e fips: continuous random bit generator tests 
For FIPS 140-3 the continuous tests specified in SP 800-90B need to be
included on the output of any entropy source.

They are implemented here as a replacement for the primary DRBG in the FIPS
provider.  This results in a setup that looks like this:

               +-------------+
               |             |
               | Seed Source |
               |             |
               +------+------+
                      |
                      |
                      v
               +-------------+
               |             |
               |  CRNG Test  |
               |             |
               ++----------+-+
                |          |
                |          |
                v          v
    +--------------+     +--------------+
    |              |     |              |
    | Public DRBG  |     | Private DRBG |
    |              |     |              |
    +--------------+     +--------------+

An additional benefit, that of avoiding DRBG chains, is also gained.
The current standards do not permit the output of one DRBG to be used
as the input for a second (i.e. a chain).

This also leaves open the future possibility of incorporating a seed
source inside the FIPS boundary.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:44:14 +10:00
Pauli
59eaa8c4af rand: remove unused field in DRBG structure 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:43:58 +10:00
Pauli
ce27133708 Add failed entropy continuous test error 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:43:58 +10:00
Pauli
ff157ee2f0 drbg: Fix typo 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25415)
 2024-09-19 08:43:58 +10:00
Matt Caswell
a57c6f8492 Don't restrict what EVP_PKEY_Q_keygen can be used for 
The EVP_PKEY_Q_keygen function contains a list of algorithm type names
and fails if the requested name is not in the list. This prevents the use
of this function for externally supplied key type names.

We should just assume that any unrecognised key type name does not require
a parameter.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25468)
 2024-09-17 16:25:44 +01:00
Orgad Shaneh
6288aa440c Build: Fix circular object deps with old GCC 
When both -o and -MT are used, GCC 4.1 prints the object file twice in
the dependency file. e.g.:

foo.o foo.o: foo.c

If the file name is long, then the second occurrence moves to the next
line. e.g.:

ssl/statem/libssl-shlib-statem_dtls.o \
  ssl/statem/libssl-shlib-statem_dtls.o: ../ssl/statem/statem_dtls.c \

add-depends script scans one line at a time, so when the first line is
processed, the object file becomes a dependency itself.

Fix by removing -MT altogether.

This also fixes makedepend for nonstop platform.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25455)
 2024-09-17 07:19:33 +02:00
Jonathan M. Wilbur
27abf142f6 feat: use ossl_serial_number_print in X509_print_ex 
fixup: Remove trailing space previously added

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 23:40:16 +02:00
Jonathan M. Wilbur
c90451d89d feat: use ossl_serial_number_print in X509_print_ex 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 22:56:02 +02:00
Jonathan M. Wilbur
935f6e63c9 feat: add ossl_serial_number_print 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 22:56:02 +02:00
Jonathan M. Wilbur
4455c1a309 test: the roleSpecCertIdentifier X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 22:56:02 +02:00
Jonathan M. Wilbur
f4887d723e doc: support the roleSpecCertIdentifier X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 22:56:02 +02:00
Jonathan M. Wilbur
bda7b3edbb feat: support the roleSpecCertIdentifier X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25428)
 2024-09-16 22:56:02 +02:00
Dmitry Belyavskiy
d81709316f EVP_get_default_properties - tests 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25434)
 2024-09-16 08:15:52 +10:00
Dmitry Belyavskiy
ac645995c4 EVP_get_default_properties - make update 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25434)
 2024-09-16 08:15:52 +10:00
Dmitry Belyavskiy
41b51bf6bc EVP_get_default_properties - documentation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25434)
 2024-09-16 08:15:52 +10:00
Dmitry Belyavskiy
54fb2fd013 EVP_get_default_properties - implementation 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25434)
 2024-09-16 08:15:52 +10:00
Neil Horman
0fdf965bf0 review fixups for quic-hq-interop 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
a62fb94609 Clean up style issues 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
67b739fba1 Add some more tests to the interop matrix and fixup a typo 
* Add resumption and multiplexing tests
* Remove needless head -n operation when patching implementation.json

Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
e4bfcee240 Adding more documentation 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
1b6638b1d8 Do batching of stream requests 
We have a limited number of streams to use
send requests in accordance with the number of streams we have
and batch requests according to that limit

Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
34d6ec804b support polling of multiple streams 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
3951741224 update quic docker container files 
1) Limit clone depth to allow faster fetches
2) Supply OPENSSL_URL and OPENSSL_BRANCH args to allow for branch
   testing

Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
1b114e39ae Add lots of docs 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
d978e5fb06 Adding session resume support to hq-interop 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:37:08 -04:00
Neil Horman
1df1cb4383 Convert retry test to use hq-interop client 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:35:11 -04:00
Neil Horman
2858149e44 Adding an hq-interop alpn client 
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25426)
 2024-09-13 15:35:11 -04:00
Neil Horman
c8127df04c Detect fin state of a QUIC stream for streams which are completely read 
SSL_poll indicates that a stream which has had the fin bit set on it,
should generate SSL_POLL_EVENT_R events, so that applications can detect
stream completion via SSL_read_ex and SSL_get_error returning
SSL_ERROR_ZERO_RETURN.

However, the quic polling code misses on this, as a client that
completely reads a buffer after receipt has its underlying stream buffer
freed, loosing the fin status

We can however detect stream completion still, as a stream which has
been finalized, and had all its data read will be in the
QUIC_RSTREAM_STATE_DATA_READ state, iff the fin bit was set.

Fix it by checking in test_poll_event_r for that state, and generating a
SSL_POLL_EVENT_R if its found to be true, so as to stay in line with the
docs.

Fixes openssl/private#627

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25399)
 2024-09-13 15:05:29 -04:00
Richard Levitte
8e0d479b98 docs: Correct bad link to provider-keymgmt(7) in provider-signature(7) 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25423)
 2024-09-13 17:08:23 +02:00
Richard Levitte
04c134a95b docs: Document the new signature interface for providers 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25423)
 2024-09-13 17:08:23 +02:00
Sahana Prasad
22c2928a9a IANA has assigned numbers for new TLS Supported Groups in ML-KEM 
https://www.ietf.org/archive/id/draft-kwiatkowski-tls-ecdhe-mlkem-01.html#name-iana-considerations
Signed-off-by: Sahana Prasad <sahana@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25477)
 2024-09-13 14:09:34 +02:00
erbsland-dev
645edf50f0 Add Missing Error Messages for AES-OCB Tag Length Validation 
Related to #8331
Addressing found issues by adding specific error messages to improve
feedback when tag length checks fail for the `EVP_CTRL_AEAD_SET_TAG`
parameter in the AES-OCB algorithm.

- Added PROV_R_INVALID_TAG_LENGTH error to indicate when the current tag
  length exceeds the maximum tag length of the algorithm.
- Added `PROV_R_INVALID_TAG_LENGTH` error to indicate when the current tag
  length in the context does not match a custom tag length provided as
  a parameter.
- Added `ERR_R_PASSED_INVALID_ARGUMENT` error to handle cases where an
  invalid pointer is passed in encryption mode.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25425)
 2024-09-13 10:10:34 +02:00
Holger Dengler
9cd4051e47 s390x: Add hardware acceleration for full AES-XTS 
The CPACF instruction KM provides support for accelerating the full
AES-XTS algorithm on newer machines for AES_XTS_128 and AES_XTS_256.

Preliminary measurements showed performance improvements of up to 50%,
dependent on the message size.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25414)
 2024-09-13 09:26:38 +10:00
Tomas Mraz
af8b7e43e4 Update the version to 3.5.0-dev 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25437)
 2024-09-12 19:22:48 +02:00
Richard Levitte
3cd5aeb3cc docs: Document the implemented composite signature+hash algorithms 
The details for RSA and EdDSA have already been documented, albeit the
RSA documentation wasn't conforming properly to the POD format.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25422)
 2024-09-12 15:20:23 +02:00
Daiki Ueno
f37dea418b s_server: Support reading HTTP request from early data 
This would be useful when testing with browsers / downloaders which
support 0-RTT only through HTTP.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/16055)
 2024-09-12 14:19:44 +02:00
Gerd Hoffmann
2a53df6947 fix small footprint builds on arm 
Building with '-D OPENSSL_SMALL_FOOTPRINT' for aarch64 fails due to
'gcm_ghash_4bit' being undeclared.  Fix that by not setting the function
pointer when building with OPENSSL_SMALL_FOOTPRINT, matching openssl
behavior on x86.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25419)
 2024-09-12 09:07:12 +10:00
Michael Baentsch
e8498dc645 document provider dependency handling 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24884)
 2024-09-11 09:33:27 +02:00
Frederik Wedel-Heinen
2478d3b7f5 Cleanup of unused functions and macros in ssl_local.h 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24648)
 2024-09-10 20:43:16 +02:00
Jonathan M. Wilbur
7a4f0c6aea feat: print <none> in issuer serials in ac targeting extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25244)
 2024-09-10 19:17:34 +02:00
Jonathan M. Wilbur
f6b2ab0ba4 test: authorityAttributeIdentifier X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25244)
 2024-09-10 19:17:34 +02:00
Jonathan M. Wilbur
221e8fa131 doc: authorityAttributeIdentifier-related ASN.1 symbols 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25244)
 2024-09-10 19:17:34 +02:00
Jonathan M. Wilbur
a6e0d6d5c0 feat: support the authorityAttributeIdentifier X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25244)
 2024-09-10 19:17:34 +02:00
Randall S. Becker
ad1d0cc999 Add NonStop KLT Configuration for new platform kernel treading model. 
This fix supports the new NonStop KLT threading model, including
configurations and documentation for using this model.

Fixes: fix-24175

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25016)
 2024-09-10 19:16:04 +02:00
Neil Horman
d677482b7e Use Jq to add openssl to interop test harness 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25256)
 2024-09-10 11:38:15 -04:00
Neil Horman
d2157bbb83 Collapse errors down by using || in run_endpoint.sh 
Makes for smaller more consistent coding

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25256)
 2024-09-10 11:38:09 -04:00
Neil Horman
e7e48e7f6c Add interop status badge 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25256)
 2024-09-10 11:38:09 -04:00
Neil Horman
f984323fcd Need to remove our bash settings as we need to interrogate failures 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25256)
 2024-09-10 11:38:09 -04:00
Neil Horman
36d5b38d2b Add local nightly interop running 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25256)
 2024-09-10 11:38:09 -04:00
Tomas Mraz
a4954ea01a Reduce footprint of Windows CI 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25378)
 2024-09-10 16:36:39 +02:00
Tomas Mraz
ecab977464 Add Windows build with enable-fips no-thread-pool no-quic 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25378)
 2024-09-10 16:36:39 +02:00
Tomas Mraz
f0fd24d5f3 Fix no-thread-pool build on Windows 
thread/arch/thread_win.c must be included into libcrypto as rcu depends
on ossl_crypto_mutex implementation on Windows.

Fixes #25337

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Hugo Landau <hlandau@devever.net>
(Merged from https://github.com/openssl/openssl/pull/25378)
 2024-09-10 16:36:39 +02:00
Matt Caswell
c9e36a8221 Add a test for the nonce-type sigopt 
Check that using the nonce-type sigopt via the dgst app works correctly

Based on the reproducer from #25012

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25057)
 2024-09-09 09:51:50 +02:00
Matt Caswell
d244abb651 Don't restrict the ECDSA settable ctx params unnecessarily 
We just allow all possible settables all the time. Some things like the
digest name can't actually be changed in some circumstances - but we already
have checks for those things. It's still possible to pass a digest of the
same name to one that's already been set for example.

Fixes #25012

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25057)
 2024-09-09 09:51:50 +02:00
Matt Caswell
8cc0a97d60 Complain about a missing digest when doing deterministic ECDSA 
We need a digest for the none when doing deterministic ECDSA. Give a
better error message if one hasn't been supplied.

See openssl/openssl#25012

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25057)
 2024-09-09 09:51:50 +02:00
icy17
5d6322741a Add missing security rules about NULL check to various manpages 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25083)
 2024-09-09 09:40:28 +02:00
ha1215
85eb4f303f Minor WINDOWS.md cleanups 
The possessive form of "Windows" has been updated from "Windows's"
to "Windows'".

The function call "a poll(2) call" has been specified as
"a poll(2) system call" for clarity.

The phrase "and supposed" has been corrected to "and was supposed" to
improve sentence structure.

The phrase "However Microsoft has" now includes a comma, revised to
"However, Microsoft has" to enhance readability.

The statement "Supporting these is a pain" has been adjusted to
"Supporting these can be a pain" to better convey potential variability
in user experience.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24242)
 2024-09-09 09:23:38 +02:00
XZ-X
a5cd06f7ff rehash.c: handle possible null pointer returned by OPENSSL_strdup 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24980)
 2024-09-09 09:20:08 +02:00
erbsland-dev
26521fdcf4 Add note for non-interactive use of s_client 
Fixes #8018

Documented the potential issue of premature connection closure in
non-interactive environments, such as cron jobs, when using `s_client`.

Added guidance on using the `-ign_eof` option and input redirection to
ensure proper handling of `stdin` and completion of TLS session data exchange.

Highlight potential issues with the `-ign_eof` flag and provide solutions for
graceful disconnection in SMTP and HTTP/1.1 scenarios to avoid indefinite hangs.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25311)
 2024-09-09 09:14:21 +02:00
erbsland-dev
d52e92f835 Refactor Password Variables to Use const char[] Arrays 
- Converted password declaration from `char*` to `const char[]`.
- Updated `memcpy` and `return` statements accordingly to use `sizeof` instead of predefined lengths.
- Renamed `key_password` into `weak_password` to match test name.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25330)
 2024-09-09 08:58:03 +02:00
erbsland-dev
9808ccc53f Refactor Callback Tests for Improved Memory Management 
Refactor the callback test code to replace global variables with local structures, enhancing memory management and reducing reliance on redundant cleanup logic.

Using a local struct containing a magic number and result flag to ensure the correct handling of user data and to verify that the callback function is invoked at least once during the test.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25330)
 2024-09-09 08:58:03 +02:00
erbsland-dev
5387b71acb Fix Edge Cases in Password Callback Handling 
Fixes #8441: Modify the password callback handling to reserve one byte in the buffer for a null terminator, ensuring compatibility with legacy behavior that puts a terminating null byte at the end.

Additionally, validate the length returned by the callback to ensure it does not exceed the given buffer size. If the returned length is too large, the process now stops gracefully with an appropriate error, enhancing robustness by preventing crashes from out-of-bounds access.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25330)
 2024-09-09 08:58:03 +02:00
erbsland-dev
fa6ae88a47 Add test for BIO password callback functionality 
Related to #8441

This commit introduces a test suite for the password callback mechanism used when reading or writing encrypted and PEM or DER encoded keys via a BIO in OpenSSL. The test is designed to cover various edge cases, particularly focusing on scenarios where the password callback might return unexpected or malformed data from user code.

By simulating different callback behaviors, including negative returns, zero-length passwords, passwords that exactly fill the buffer and wrongly reported lengths. Also testing for the correct behaviour of binary passwords that contain a null byte in the middle.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25330)
 2024-09-09 08:58:03 +02:00
slontis
7845ff7692 Add fips indicator requirements doc 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23609)
 2024-09-08 13:54:39 +10:00
Tomas Mraz
5c82588173 CHANGES.md, NEWS.md: Add 3.5 sections 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25393)
 2024-09-06 16:14:52 +02:00
Tomas Mraz
3e3a2bfcf0 libcrypto/libssl.num: Set the numbers for 3_4_0 symbols 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25393)
 2024-09-06 16:14:52 +02:00
Tomas Mraz
314c327b14 NEWS.md: Add missing link to 3.4 section 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25393)
 2024-09-06 16:14:52 +02:00
Ingo Franzki
dc5afb7e87 s390x: Fix s390x_shake_squeeze() when MSA 12 is available 
On the first squeeze call, when finishing the absorb process, also set
the NIP flag, if we are still in XOF_STATE_INIT state. When MSA 12 is
available, the state buffer A has not been zeroed during initialization,
thus we must also pass the NIP flag here. This situation can happen
when a squeeze is performed without a preceding absorb (i.e. a SHAKE
of the empty message).

Add a test that performs a squeeze without a preceding absorb and check
if the result is correct.

Fixes: 25f5d7b85f

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25388)
 2024-09-06 11:26:06 +02:00
Ingo Franzki
979dc53001 s390x: Fix s390x_sha3_absorb() when no data is processed by KIMD 
If the data to absorb is less than a block, then the KIMD instruction is
called with zero bytes. This is superfluous, and causes incorrect hash
output later on if this is the very first absorb call, i.e. when the
xof_state is still XOF_STATE_INIT and MSA 12 is available. In this case
the NIP flag is set in the function code for KIMD, but KIMD ignores the
NIP flag when it is called with zero bytes to process.

Skip any KIMD calls for zero length data. Also do not set the xof_state
to XOF_STATE_ABSORB until the first call to KIMD with data. That way,
the next KIMD (with non-zero length data) or KLMD call will get the NIP
flag set and will then honor it to produce correct output.

Fixes: 25f5d7b85f

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25388)
 2024-09-06 11:26:05 +02:00
dependabot[bot]
8af4c02ea9 Dependabot update 
CLA: trivial

(deps): Bump actions/setup-python

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.1.1 to 5.2.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5.1.1...v5.2.0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25328)
 2024-09-05 18:12:48 +02:00
dependabot[bot]
65e32c6867 Dependabot update 
CLA: trivial

(deps): bump actions/download-artifact

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.1.7 to 4.1.8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4.1.7...v4.1.8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25385)
 2024-09-05 18:08:11 +02:00
PIums
60725f8511 argon2: Fixed an thread availability error string 
Correctly display the number of requested threads and the number
of available threads.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25375)
 2024-09-05 17:32:01 +02:00
Jiasheng Jiang
f60b3c5fdc crypto/pkcs12/p12_mutl.c: Add check and EVP_MD_free() for EVP_MD_fetch() 
Add check and EVP_MD_free() for EVP_MD_fetch() to avoid NULL pointer
dereference and memory leak, like "md_fetch".

Fixes: fe79159be0 ("Implementation of the RFC 9579, PBMAC1 in PKCS#12")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@outlook.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25370)
 2024-09-05 17:30:28 +02:00
Viktor Dukhovni
8439337036 Drop redundant non-negative checks on unsigned values 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25341)
 2024-09-05 17:28:47 +02:00
Pablo Rodríguez
6fd9bc6568 blank line required to display code in openssl-ts.pod.in 
CLA:trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25338)
 2024-09-05 17:26:58 +02:00
Alessandro Chitarrini
f2b7a00fbb Fix inaccurate comment about default nonce length in demos/cipher/aesccm.c 
Fixes #25270

CLA: trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25318)
 2024-09-05 17:24:32 +02:00
Jonathan M. Wilbur
9183306815 feat: add TCG / platform certificate OIDs 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25312)
 2024-09-05 17:22:40 +02:00
Zhihao Yuan
36840ab577 Recycle the TLS key that holds thread_event_handler 
Fixes #25278

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25300)
 2024-09-05 17:19:53 +02:00
Jiasheng Jiang
09ae1c9f5a Add error return value information for EVP_MD_get_size() 
Add error return value information for EVP_MD_get_size() and
EVP_MD_CTX_get_size() to better guide their usages and avoid
the integer overflow, such as
4a50882 ("ssl_cipher_get_overhead(): Replace size_t with int and add the checks")
and ef9ac2f ("test/bad_dtls_test.c: Add checks for the EVP_MD_CTX_get_size()").

Signed-off-by: Jiasheng Jiang <jiashengjiangcool@outlook.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25282)
 2024-09-05 17:16:45 +02:00
erbsland-dev
d15077d336 Clarify EVP_CipherUpdate() authenticated bytes behavior 
Fixes #8310: Document that the number of authenticated bytes returned by EVP_CipherUpdate() varies with the cipher used. Mention that stream ciphers like ChaCha20 can handle 1 byte at a time, while OCB mode requires processing data one block at a time. Ensure it's clear that passing unpadded data in one call is safe.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24961)
 2024-09-05 17:14:18 +02:00
Georgi Valkov
71ae466181 threads_win: fix improper cast to long * instead of LONG * 
InterlockedExchangeAdd expects arguments of type LONG *, LONG
but the int arguments were improperly cast to long *, long

Note:
- LONG is always 32 bit
- long is 32 bit on Win32 VC x86/x64 and MingW-W64
- long is 64 bit on cygwin64

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24941)
 2024-09-05 17:09:50 +02:00
Georgi Valkov
9f4d8c63e8 threads: follow formatting rules 
Adjust long lines and correct padding in preprocessor lines to
match the formatting rules

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24941)
 2024-09-05 17:09:50 +02:00
Daniel Gustafsson
5efc57caf2 Fix memleak in rsa_cms_sign error path 
If the call to X509_ALGOR_set0 fails then the allocated ASN1_STRING
variable passed as parameter leaks.  Fix by explicitly freeing like
how all other codepaths with X509_ALGOR_set0 do.

Fixes #22680

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24868)
 2024-09-05 17:04:59 +02:00
FdaSilvaYY
2bb83824bb ssl: rework "e_os.h" inclusions 
- Remove e_os.h include from "ssl_local.h"
- Added e_os.h into the files that need it now.
- Move e_os.h to be the very first include

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14344)
 2024-09-05 17:02:51 +02:00
FdaSilvaYY
23b795d34f apps: directly inclusion of "e_os.h when needed 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14344)
 2024-09-05 17:02:51 +02:00
FdaSilvaYY
0022bc81a9 crypto: fix missing <winsock.h> indirection inclusion. 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14344)
 2024-09-05 17:02:51 +02:00
FdaSilvaYY
b2ac9c714e Move inclusion of <winsock.h> out of "e_os.h" into a dedicated header file. 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14344)
 2024-09-05 17:02:51 +02:00
Tomas Mraz
5472786907 Prepare for 3.4 beta 1 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Release: yes
 2024-09-05 09:38:19 +02:00
Tomas Mraz
2648f68f4c Prepare for release of 3.4 alpha 1 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Release: yes
 2024-09-05 09:37:44 +02:00
Tomas Mraz
13add4d27f make update 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Release: yes
 2024-09-05 09:37:42 +02:00
Tomas Mraz
7ed6de997f Copyright year updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Release: yes
 2024-09-05 09:35:49 +02:00
Richard Levitte
210dc9a50d util/mkinstallvars.pl: replace List::Util::pairs with out own 
Unfortunately, List::Util::pairs didn't appear in perl core modules
before 5.19.3, and our minimum requirement is 5.10.

Fortunately, we already have a replacement implementation, and can
re-apply it in this script.

Fixes #25366

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25367)
 2024-09-05 09:04:28 +02:00
Tomas Mraz
c4a5d70d98 CI: Update upload-artifact action to be compatible 
The download-artifact action was updated to 4.x
and the upload-artifact must be kept in sync.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25383)
 2024-09-04 17:17:29 +02:00
dependabot[bot]
2a6305dfcd build(deps): bump actions/download-artifact in /.github/workflows 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 3 to 4.1.7.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v3...v4.1.7)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25374)
 2024-09-04 08:48:29 +02:00
Alexandr Nedvedicky
bbe4571f57 EVP_CIPHER_CTX_get_algor_params() may attempt to access params array 
at position -1 (prams[=1]).

The issue has been reported by coverity check.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25303)
 2024-09-03 21:18:51 +02:00
Ingo Franzki
c23ce35225 s390x: Fix prehash-by-caller handling for ED25519 and ED448 
In case of prehash or prehash-by-caller is set skip the s390x specific
acceleration an fallback to the non-accelerated code path.

Fixes: 6696682774

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25351)
 2024-09-03 21:16:23 +02:00
Ingo Franzki
a75d62637a s390x: Disable HMAC hardware acceleration when an engine is used for the digest 
The TLSProxy uses the 'ossltest' engine to produce known output for digests
and HMAC calls. However, when running on a s390x system that supports
hardware acceleration of HMAC, the engine is not used for calculating HMACs,
but the s390x specific HMAC implementation is used, which does produce correct
output, but not the known output that the engine would produce. This causes
some tests (i.e. test_key_share, test_sslextension, test_sslrecords,
test_sslvertol, and test_tlsextms) to fail.

Disable the s390x HMAC hardware acceleration if an engine is used for the
digest of the HMAC calculation. This provides compatibility for engines that
provide digest implementations, and assume that these implementations are also
used when calculating an HMAC.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25287)
 2024-09-03 21:15:00 +02:00
Tomas Mraz
03b22b4d73 Add CVE-2024-5535 to CHANGES and NEWS 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Release: yes
(cherry picked from commit abcb0f83d060eb816503a6a36959ce8498a24111)
 2024-09-03 21:06:19 +02:00
Viktor Dukhovni
ca979e854b Updated CHANGES and NEWS for CVE-2024-6119 fix 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(cherry picked from commit cf384d35aa)
 2024-09-03 21:04:03 +02:00
Viktor Dukhovni
0890cd13d4 Avoid type errors in EAI-related name check logic. 
The incorrectly typed data is read only, used in a compare operation, so
neither remote code execution, nor memory content disclosure were possible.
However, applications performing certificate name checks were vulnerable to
denial of service.

The GENERAL_TYPE data type is a union, and we must take care to access the
correct member, based on `gen->type`, not all the member fields have the same
structure, and a segfault is possible if the wrong member field is read.

The code in question was lightly refactored with the intent to make it more
obviously correct.

Fixes CVE-2024-6119

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
 2024-09-03 11:58:40 +02:00
Tomas Mraz
5650289743 Add CHANGES.md and NEWS.md updates for the 3.4 release 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25339)
 2024-09-03 11:20:45 +02:00
Brad Smith
01f4b44e07 Add support for elf_aux_info() on OpenBSD 
CLA: trivial

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25346)
 2024-09-02 16:12:48 +02:00
Theo Buehler
16e7da091c Missing .rodata for AVX2/AVX512 codepaths 
This is a follow-up to #23997

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25340)
 2024-09-02 10:26:45 +02:00
Adam (ThinLinc team)
c94d13a069 Detect MinGW 32 bit for NO_INTERLOCKEDOR64 
Builds using 32 bit MinGW will fail, due to the same reasoning described in commit 2d46a44ff2.

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25025)
 2024-09-02 10:24:58 +02:00
Ingo Franzki
d5b3c0e24b s390x: Fix HMAC digest detection 
Use EVP_MD_is_a() instead of EVP_MD_get_type() to detect the digest
type. EVP_MD_get_type() does not always return the expected NID, e.g.
when running in the FIPS provider, EVP_MD_get_type() returns zero,
causing to skip the HMAC acceleration path.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25304)
 2024-09-02 10:23:22 +02:00
Viktor Dukhovni
0cd9dd703e Improve base64 BIO correctness and error reporting 
Also improve related documentation.

- The BIO_FLAGS_BASE64_NO_NL flag did not behave as advertised, only
  leading and trailing, but not internal, whitespace was supported:

      $ echo 'AA AA' | openssl base64 -A -d | wc -c
      0

- Switching from ignored leading input to valid base64 input misbehaved
  when the length of the skipped input was one more than the length of
  the second and subsequent valid base64 lines in the internal 1k
  buffer:

    $ printf '#foo\n#bar\nA\nAAA\nAAAA\n' | openssl base64 -d | wc -c
    0

- When the underlying BIO is retriable, and a read returns less than
  1k of data, some of the already buffered input lines that could have
  been decoded and returned were retained internally for a retry by the
  caller.  This is somewhat surprising, and the new code decodes as many
  of the buffered lines as possible.  Issue reported by Michał Trojnara.

- After all valid data has been read, the next BIO_read(3) should
  return 0 when the input was all valid or -1 if an error was detected.
  This now occurs in more consistently, but further tests and code
  refactoring may be needed to ensure this always happens.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25253)
 2024-08-30 15:09:10 +02:00
Richard Levitte
d1c2c054a4 fix: ossl_digest_get_approved_nid() returns NID_undef on invalid digest 
We checked using 'md_nid < 0', which is faulty.

Impact: DSA and ECDSA signature provider implementations

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24992)
 2024-08-30 11:54:13 +02:00
Richard Levitte
f68ba38e18 Refactor OpenSSL 'ECDSA' EVP_SIGNATURE to also include ECDSA+hash composites 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24992)
 2024-08-30 11:54:13 +02:00
Richard Levitte
bb2be4f066 Refactor OpenSSL 'DSA' EVP_SIGNATURE to also include DSA+hash composites 
(in the code, "sigalg" is used to refer to these composite algorithms,
which is a nod to libcrypto and libssl, where that term is commonly used
for composite algorithms)

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24992)
 2024-08-30 11:54:13 +02:00
Pauli
c6c6af18ea endecode_test.c: Fix !fips v3.0.0 check 
The fips_provider_version_* functions return true if the FIPS provider isn't
loaded.  This is somewhat counterintuitive and the fix in #25327 neglected
this nuance resulting in not running the SM2 tests when the FIPS provider
wasn't being loaded.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25331)
 2024-08-30 11:42:40 +02:00
Richard Levitte
15b748496f exporters for pkg-config: align with the changes for CMake 
The latest CMake exporter changes reworked the the variables in builddata.pm
and installdata.pm.  Unfortunately, the pkg-config exporter templates were
forgotten in that effort.

Fixes #25299

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25308)
 2024-08-30 05:20:48 +02:00
Tomas Mraz
0b97a5505e endecode_test.c: Avoid running the SM2 tests with 3.0.0 FIPS provider 
Fixes #25326

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25327)
 2024-08-29 19:45:47 +02:00
Viktor Dukhovni
b4e4bf29ba Check for excess data in CertificateVerify 
As reported by Alicja Kario, we ignored excess bytes after the
signature payload in TLS CertificateVerify Messages.  These
should not be present.

Fixes: #25298

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25302)
 2024-08-29 19:32:00 +02:00
Joerg Schmidbauer
25f5d7b85f s390x: support CPACF sha3/shake performance improvements 
On newer machines the SHA3/SHAKE performance of CPACF instructions KIMD and KLMD
can be enhanced by using additional modifier bits. This allows the application
to omit initializing the ICV, but also affects the internal processing of the
instructions. Performance is mostly gained when processing short messages.

The new CPACF feature is backwards compatible with older machines, i.e. the new
modifier bits are ignored on older machines. However, to save the ICV
initialization, the application must detect the MSA level and omit the ICV
initialization only if this feature is supported.

Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25235)
 2024-08-29 19:26:06 +02:00
Clemens Lang
6772c2ab1b doc: Document properties param for Argon2 KDF 
The Argon2 KDF uses OSSL_KDF_PARAM_PROPERTIES to fetch implementations
of blake2bmac and blake2b512 if ctx->mac and ctx->md are NULL. This
isn't documented in the manpage, so users that might, for example, want
to fetch an instance of Argon2 with the -fips property query to obtain
a working Argon2 KDF even though the default property query requires
fips=yes are left wondering why this fails.

Fortunately, EVP_KDF(3)/PARAMETERS already explains what the properties
are used for, so we really just need to add a single line.

Signed-off-by: Clemens Lang <cllang@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25306)
 2024-08-29 19:20:05 +02:00
erbsland-dev
80008d4a94 Refactor and Enhance Compression Field Testing 
Fixes #7940: Enhances the existing test for compression methods in the ClientHello message, aligning with RFC 8446 specifications.

Refactored the test code to improve modularity and maintainability, making it easier to extend and modify in the future.

Added checks for the appropriate alerts, ensuring that `SSL_AD_ILLEGAL_PARAMETER` or `SSL_AD_DECODE_ERROR` are correctly triggered as per the RFC 8446 guidelines.

Expanded Test Coverage: Introduced additional test cases to cover scenarios involving:
- Lists of unknown compression methods
- Absence of any compression method
- Validation of a single null compression method, which should always succeed.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25255)
 2024-08-29 19:16:38 +02:00
erbsland-dev
c026101be0 Correct Alert Handling for Missing Compression Methods 
Fixes #7940: Updated the compression check logic to improve protocol compliance. The code now returns `SSL_AD_DECODE_ERROR` when no compression method is provided in the ClientHello message. It returns `SSL_AD_ILLEGAL_PARAMETER` if the “null” compression method (0x00) is missing.

Additionally, refactored the related test code for enhanced readability and maintainability.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25255)
 2024-08-29 19:16:38 +02:00
Richard Levitte
6696682774 Add ED25519 and ED448 support for EVP_PKEY_{sign,verify}_init_ex2() 
In this mode, only the ph instances are supported, and must be set
explicitly through a parameter.  The caller is assumed to pass a
prehash to EVP_PKEY_{sign,verify}().

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24975)
 2024-08-29 19:13:07 +02:00
Richard Levitte
1751334f59 Refactor OpenSSL 'EdDSA' EVP_SIGNATURE to allow use with EVP_PKEY functions 
Add EVP_PKEY_{sign,verify}_message support for our Ed25519 and Ed448
implementations, including ph and ctx variants.

Tests are added with test_evp stanzas.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24975)
 2024-08-29 19:13:06 +02:00
Zhiqing Xie
d20cf21b20 Fix compile err when building VC-CLANG-WIN64-CLANGASM-ARM target 
The error happens with MSVC v143,C++ Clang Compiler for Windows(16.0.5)

Error is "brackets expression not supported on this target" in libcrypto-shlib-bsaes-armv8.obj.asm

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25293)
 2024-08-29 15:38:57 +02:00
Jamie Cui
25bd0c77bf Fix decoder error on SM2 private key 
Added sm2 testcases to endecode_test.c.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25266)
 2024-08-29 15:28:27 +02:00
slontis
14c45338e9 EVP_MD_size() updates 
For SHAKE algorithms we now return 0 from EVP_MD_size().
So all the places that check for < 0 needed to change to <= 0
(Otherwise the behaviour will be to digest nothing in most cases).

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25285)
 2024-08-29 10:29:53 +02:00
slontis
976dd3581a Update code to use EVP_MD_xof() 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25285)
 2024-08-29 10:29:53 +02:00
slontis
c48e56874c XOF / EVP_MD_size() changes. 
Added the function EVP_MD_CTX_get_size_ex() which checks for XOF and
does a ctx get rather than just returning EVP_MD_size().
SHAKE did not have a get_ctx_params() so that had to be added to return the xoflen.

Added a helper function EVP_MD_xof()
EVP_MD_CTX_size() was just an aliased macro for EVP_MD_size(), so to
keep it the same I added an extra function.

EVP_MD_size() always returns 0 for SHAKE now, since it caches the value
of md_size at the time of an EVP_MD_fetch(). This is probably better
than returning the incorrect initial value it was before e.g (16 for
SHAKE128) and returning tht always instead of the set xoflen.

Note BLAKE2B uses "size" instead of "xoflen" to do a similar thing.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25285)
 2024-08-29 10:29:53 +02:00
sashan
6dacee485f RSA decoder should check also sanity of p, q, e, d ... with respect to n 
This issue has been discovered by osss-fuzzer [1]. The test function decodes
RSA key created by fuzzer and calls EVP_PKEY_pairwise_check() which
proceeds to ossl_bn_miller_rabin_is_prime() check which takes too long
exceeding timeout (45secs).

The idea is to fix OSSL_DECODER_from_data() code path so invalid
RSA keys will be refused.

[1] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69134

Test case generated by the fuzzer is added.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25190)
 2024-08-28 16:50:46 +02:00
slontis
f6a296c386 Cleanups for FIPS options.. 
The options in fipsprov.c are now generated using macros with fips_indicator_params.inc.
This should keep the naming consistent.

Some FIPS related headers have moved to providers/fips/include so that
they can use fips_indicator_params.inc.
securitycheck.h now includes fipsindicator.h, and fipsindicator.h includes
fipscommon.h.

fipsinstall.c uses OSSL_PROV_PARAM_ for the configurable FIPS options rather than
using OSSL_PROV_FIPS_PARAM_* as this was confusing as to which one should be used.
fips_names.h just uses aliases now for existing public names.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25162)
 2024-08-28 14:46:16 +02:00
Richard Levitte
accd835f8d fix: for exporters to work for build config, there may be two include dirs 
For CMake / pkg-config configuration files to be used for an uninstalled
build, the include directory in the build directory isn't enough, if that
one is separate from the source directory.  The include directory in the
source directory must be accounted for too.

This includes some lighter refactoring of util/mkinstallvars.pl, with the
result that almost all variables in builddata.pm and installdata.pm have
become arrays, even though unnecessarily for most of them; it was simpler
that way.  The CMake / pkg-config templates are adapted accordingly.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24918)
 2024-08-27 17:20:12 +02:00
Richard Levitte
a82d9e572c fix: exporters/cmake/OpenSSLConfig.cmake.in to work for build config 
This template file is made to make both:

1. OpenSSLConfig.cmake (CMake config used when building a CMake package
   against an uninstalled OpenSSL build)
2. exporters/OpenSSLConfig.cmake (CMake config that's to be installed
   alongside OpenSSL, and is used when building a CMake package against
   an OpenSSL installation).

Variant 1 was unfortunately getting the internal '_ossl_prefix' variable
wrong, which is due to how the perl snippet builds the command(s) to figure
out its value.  That needed some correction.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24918)
 2024-08-27 17:20:12 +02:00
Jonathan M. Wilbur
0acb32052a test: issuedOnBehalfOf X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25241)
 2024-08-27 16:48:57 +02:00
Jonathan M. Wilbur
254693280d feat: add support for issuedOnBehalfOf X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25241)
 2024-08-27 16:48:57 +02:00
Richard Levitte
873f269697 fix coding style 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25000)
 2024-08-27 13:56:28 +02:00
Richard Levitte
9524ca1bf4 doc: Document EVP_{TYPE}_CTX_get_algor etc 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25000)
 2024-08-27 13:56:28 +02:00
Richard Levitte
033dcce2ba feat: Implement EVP_PKEY_CTX_{set,get}_algor_params() and EVP_PKEY_CTX_get_algor() 
This should be sufficient to cover the intent with the following legacy ctrls:

- EVP_PKEY_CTRL_PKCS7_ENCRYPT (through EVP_ASYM_CIPHER implementations)
- EVP_PKEY_CTRL_PKCS7_DECRYPT (through EVP_ASYM_CIPHER implementations)
- EVP_PKEY_CTRL_PKCS7_SIGN (through EVP_SIGNATURE implementations)
- EVP_PKEY_CTRL_CMS_ENCRYPT (through EVP_ASYM_CIPHER implementations)
- EVP_PKEY_CTRL_CMS_DECRYPT (through EVP_ASYM_CIPHER implementations)
- EVP_PKEY_CTRL_CMS_SIGN (through EVP_SIGNATURE implementations)

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25000)
 2024-08-27 13:56:28 +02:00
Richard Levitte
258aaa97b8 feat: Implement EVP_CIPHER_CTX_{set,get}_algor_params() and EVP_CIPHER_CTX_get_algor() 
EVP_CIPHER_CTX_set_algor_params() and EVP_CIPHER_CTX_set_algor_params() can
be used instead of EVP_CIPHER_asn1_to_param() and EVP_CIPHER_param_to_asn1().

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25000)
 2024-08-27 13:56:28 +02:00
Richard Levitte
3b1ea04650 fix: in RC2 implementation, handle both old and new AID.params keys 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25000)
 2024-08-27 13:56:28 +02:00
Richard Levitte
0941666728 Amend the design of AlgorithmIdentifier parameter passing 
I realised that any application that passes AlgorithmIdentifier parameters
to and from a provider may also be interested in the full AlgorithmIdentifier
of the implementation invocation.

Likewise, any application that wants to get the full AlgorithmIdentifier
from an implementation invocation may also want to pass AlgorithmIdentifier
parameters to that same implementation invocation.

These amendments should be useful to cover all intended uses of the legacy
ctrls for PKCS7 and CMS:

- EVP_PKEY_CTRL_PKCS7_ENCRYPT
- EVP_PKEY_CTRL_PKCS7_DECRYPT
- EVP_PKEY_CTRL_PKCS7_SIGN
- EVP_PKEY_CTRL_CMS_ENCRYPT
- EVP_PKEY_CTRL_CMS_DECRYPT
- EVP_PKEY_CTRL_CMS_SIGN

It should also cover a number of other cases that were previously implemented
through EVP_PKEY_ASN1_METHOD, as well as all sorts of other cases where the
application has had to assemble a X509_ALGOR on their own.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25000)
 2024-08-27 13:56:20 +02:00
cx
c07a34e18b Return SSL_AD_UNEXPECTED_MESSAGE alert when receiving any other change_cipher_spec value(RFC 8446) 
Fixes: #25086

CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25257)
 2024-08-26 10:58:10 +01:00
Jonathan M. Wilbur
91432b9ea0 fix: alias auditEntity OID 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24754)
 2024-08-26 10:38:44 +01:00
Jonathan M. Wilbur
dbd3d65d7c test: auditIdentity X.509v3 extension decoding and display 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24754)
 2024-08-26 10:38:44 +01:00
Jonathan M. Wilbur
9216859f7b feat: support auditIdentity X.509v3 extension 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24754)
 2024-08-26 10:38:44 +01:00
Jonathan M. Wilbur
bce3a8d57e fix: wrong name for OID -> auditIdentity 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24754)
 2024-08-26 10:25:23 +01:00
slontis
8e7f39e883 Cleanups for FIPS indicator documentation 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25195)
 2024-08-26 08:28:44 +10:00
slontis
5139b51cea Add FIPS indicator documentation 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25195)
 2024-08-26 08:28:44 +10:00
slontis
c37e21763b Add FIPS indicators to X25519 and X448. 
X25519 and X448 are unapproved in FIPS 140-3
So always trigger the indicator callback if these Keys are used,
and add "fips-indicator" getters that return 0.

This has been added to keygen and key exchange.
(KEM will also require it if ever becomes a FIPS algorithm).

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25246)
 2024-08-25 10:50:05 +10:00
slontis
32b43b9160 Update new FIPS indicator evp_tests to use FIPSversion + Availablein options. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25267)
 2024-08-23 21:26:03 +02:00
slontis
f2a5c80ca4 Revert evp_test change that made "FIPSversion" skip the default provider. 
Fixes #25199
This should be done using "Availablein" if required.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25267)
 2024-08-23 21:25:41 +02:00
slontis
bb1aab38a6 FIPS: Add EDDSA public key validation. 
EVP_PKEY_public_check() can be used by ED25519 and ED448 in order to
determine if the public key is a valid point on the curve.

The FIPS ACVP tests require public key validation tests.
See https://github.com/usnistgov/ACVP-Server/blob/master/gen-val/json-files/EDDSA-KeyVer-1.0/internalProjection.json

Note that this is NOT required to be called before EDDSA signature verification
since it is done internally.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25265)
 2024-08-23 21:23:53 +02:00
slontis
f7fd43402c Update FIPS 140-3 self tests 
Cleanup + remove a few tests that are not required.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25222)
 2024-08-23 11:07:36 +02:00
slontis
06179b4be0 FIPS: Change fips tests to use SHA2 for corruption test. 
Fixes cross testing with OpenSSL 3.4 with removed SHA1 from the self
tests.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25262)
 2024-08-23 10:23:37 +02:00
Ingo Franzki
19b87d2d2b s390x: Fix memory leak in s390x_HMAC_CTX_copy() 
When s390x_HMAC_CTX_copy() is called, but the destination context already
has a buffer allocated, it is not freed before duplicating the buffer from
the source context.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25238)
 2024-08-23 09:11:01 +02:00
Pauli
fe1ce91f7f acvptest: add positive and negative tests for verify message param 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25211)
 2024-08-23 07:17:03 +10:00
Pauli
f5c8000c0a rsa: add verify_message param support 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25211)
 2024-08-23 07:17:03 +10:00
Pauli
b80e2ddb66 ecdsa: add verify_message param support 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25211)
 2024-08-23 07:17:03 +10:00
Pauli
38f1e18e93 param: add OSSL_SIGNATURE_PARAM_FIPS_VERIFY_MESSAGE parameter name 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25211)
 2024-08-23 07:17:02 +10:00
Pauli
a9fc8702e0 doc: document the OSSL_SIGNATURE_PARAM_FIPS_VERIFY_MESSAGE parameter 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25211)
 2024-08-23 07:17:02 +10:00
Tomas Mraz
3c1713aeed fuzz/hashtable.c: rc == -1 on insert is OK when fuzzing 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25273)
 2024-08-22 14:52:43 +02:00
Tomas Mraz
8951ee06b4 ossl_ht_insert(): Allow for 4 iterations of grow_hashtable() 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25273)
 2024-08-22 14:52:43 +02:00
Joachim Vandersmissen
6c39d21a48 Replace PKCS#1 v1.5 padding in RSA PCT 
After December 31, 2023, SP 800-131Ar2 [0] no longer allows PKCS#1 v1.5
padding for RSA "key-transport" (aka encryption and decryption).
There's a few good options to replace this usage in the RSA PCT, but
the simplest is verifying m = (m^e)^d mod n, (where 1 < m < (n − 1)).
This is specified in SP 800-56Br2 (Section 6.4.1.1) [1] and allowed by
FIPS 140-3 IG 10.3.A. In OpenSSL, this corresponds to RSA_NO_PADDING.

[0]: https://doi.org/10.6028/NIST.SP.800-131Ar2
[1]: https://doi.org/10.6028/NIST.SP.800-56Br2

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23832)
 2024-08-22 07:24:29 +10:00
Joachim Vandersmissen
9341e6683c Replace PKCS#1 v1.5 encryption in RSA PCT 
After December 31, 2023, SP 800-131Ar2 [0] no longer allows PKCS#1 v1.5
padding for RSA "key-transport" (aka encryption and decryption).
There's a few good options to replace this usage in the RSA PCT, but
signature generation and verification using PKCS#1 v1.5 padding (which
remains approved) is the simplest.

[0]: https://doi.org/10.6028/NIST.SP.800-131Ar2

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23832)
 2024-08-22 07:24:08 +10:00
Bernd Edlinger
e91384d5b0 Fix error handling in OBJ_add_object 
This fixes the possible memory leak in OBJ_add_object
when a pre-existing object is replaced by a new one,
with identical NID, OID, and/or short/long name.
We do not try to delete any orphans, but only mark
them as type == -1, because the previously returned
pointers from OBJ_nid2obj/OBJ_nid2sn/OBJ_nid2ln
may be cached by applications and can thus not
be cleaned up before the application terminates.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22534)
 2024-08-21 15:53:37 +02:00
Beat Bolli
223e0020e4 x_attrib: fix a memory leak 
The X509_NAME object needs to be free'd even if printing it fails.

Introduced in be5adfd6e3 ("Support subjectDirectoryAttributes and
associatedInformation exts", 2024-06-18), but subsequently moved in
7bcfb41489 ("ossl_print_attribute_value(): use a sequence value only if
type is a sequence", 2024-08-05).

Signed-off-by: Beat Bolli <dev@drbeat.li>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25207)
 2024-08-21 15:51:29 +02:00
Neil Horman
1fb39522a2 Add Changes entry for debuginfo generation 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25174)
 2024-08-21 15:50:30 +02:00
Neil Horman
0fdbcf4c3c Add a test for debuginfo generation 
Add a check to ensure debug info generation works.

We piggyback on a test that already builds DWARF symbols (--debug)
The test
1) makes the debuginfo files
2) runs gdb, loading the libcrypto.so.3 file
3) Check to make sure that the output of gdb indicates that it loads the
   .debug file base on the reference in the loaded file

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25174)
 2024-08-21 15:50:17 +02:00
Neil Horman
a5d56626b9 Add debuginfo build target 
In the webinar we are currently producing on debugging openssl
applications, we talk about ways to allow debugable binaries without
having to ship all the debug DWARF information to production systems.

Add an optional target to do that DWARF separation to aid users

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25174)
 2024-08-21 15:50:17 +02:00
Jiasheng Jiang
55662b6745 test/provider_test.c: Add OSSL_PROVIDER_unload() to avoid memory leak 
Add OSSL_PROVIDER_unload() when OSSL_PROVIDER_add_builtin() fails to avoid memory leak.

Fixes: 5442611dff ("Add a test for OSSL_LIB_CTX_new_child()")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@outlook.com>

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25109)
 2024-08-21 15:38:58 +02:00
Jiasheng Jiang
6e8a1031ed test/provider_fallback_test.c: Add OSSL_PROVIDER_unload() to avoid memory leak 
Add OSSL_PROVIDER_unload() when test_provider() fails to avoid memory leak.

Fixes: f995e5bdcd ("TEST: Add provider_fallback_test, to test aspects of
fallback providers")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@outlook.com>

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25108)
 2024-08-21 15:37:05 +02:00
Matt Caswell
60358f2c5e Fix the alert used on a missing key_share 
RFC8446 requires we send an illegal_parameter alert if we don't get a
key_share back from the server and our kex_modes require one. We were
instead reporting this as missing_extension.

Fixes #25040

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25059)
 2024-08-21 15:35:51 +02:00
slontis
95994ded95 Add additional test cases for Single Step KDF. 
SSKDF KMAC tests added.
Added FIPS indicator tests for SSKDF Hash, HMAC, and KMAC cases.
Added short salt length tests for SSKDF HMAC and KMAC.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25049)
 2024-08-21 15:34:58 +02:00
slontis
ea396c7024 Add FIPS KMAC key check 
This adds a FIPS indicator for KMAC key size.
Note that 112 bits keys are still smaller than the
sizes required to reach 128 bits for KMAC128 and
256 bits for KMAC256

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25049)
 2024-08-21 15:34:58 +02:00
slontis
390f00a1e9 Add HMAC FIPS keysize check. 
HMAC has been changed to use a FIPS indicator for its key check.

HKDF and Single Step use a salt rather than a key when using HMAC,
so we need a mechanism to bypass this check in HMAC.

A seperate 'internal' query table has been added to the FIPS provider
for MACS. Giving HMAC a seprate dispatch table allows KDF's to ignore
the key check. If a KDF requires the key check then it must do the
check itself. The normal MAC dipatch table is used if the user fetches
HMAC directly.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25049)
 2024-08-21 15:34:40 +02:00
Tomas Mraz
d2739fc350 hashtable.c: Code style fixes 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24504)
 2024-08-21 15:21:26 +02:00
Tomas Mraz
f0b1d4d1b0 core_namemap.c: 2048 hashtable buckets should be sufficient 
It is unlikely we would need more than 4000 names and even
with more names (up to 8192) it would still work, just
the performance fo the namemap would degrade.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24504)
 2024-08-21 15:21:26 +02:00
Tomas Mraz
9f7489835d For lockless reads use the whole hashtable for colliding entries 
Instead of just using the neighborhood, fill
subsequent neighborhoods with colliding entries.

If the hashtable is properly sized, it won't degrade
performance too much.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24504)
 2024-08-21 15:21:26 +02:00
Tomas Mraz
4cad608509 Use the new hashtable for core_namemap 
This replaces LHASH in core_namemap with the new hashtable and adds
a reverse mapping in form of stack of stacks instead of iterating
the existing hash table members.

The new hashtable is used in lockless-read mode.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24504)
 2024-08-21 15:21:26 +02:00
Tomas Mraz
71fe7f0983 hashtable: Support lockless reads 
Also build it in the FIPS provider too and properly
report error on insert when hashtable cannot be grown.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24504)
 2024-08-21 15:21:25 +02:00
Tomas Mraz
6cdca7b9fe hashtable.c: Avoid infinite loop in ossl_ht_insert() 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24504)
 2024-08-21 15:21:25 +02:00
Neil Horman
14efc05314 some performance improvements 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24504)
 2024-08-21 15:21:25 +02:00
Neil Horman
435531ec24 alternate collision checking support 
Add full key matching to hashtable

the idea is that on a hash value match we do a full memory comparison of
the unhashed key to validate that its actually the key we're looking for

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24504)
 2024-08-21 15:21:25 +02:00
Richard Levitte
772481cf7c fix: Have util/mkerr.pl comply better with our coding style 
util/mkerr.pl produced lines like these:

    {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),
    "operation not supported for this keytype"},

According to our coding style, they should look like this:

    {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),
     "operation not supported for this keytype"},

This nit was correctly picked up by util/check-format.pl

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24902)
 2024-08-21 10:55:59 +02:00
Richard Levitte
523187df47 Enable RSA-SM3 in the default provider 
It turns out that we didn't allow the combination RSA + SM3 anywhere.

This is perfectly reasonable in the FIPS module, but less so in the default
provider.  This change enables it in the default provider, and adds a simple
evp_test stanza for the RSA-SM3 signature scheme.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23416)
 2024-08-21 08:21:06 +02:00
Richard Levitte
8736de5e77 fix coding style 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23416)
 2024-08-21 08:21:06 +02:00
Richard Levitte
b02cf2fc8f Add new test types in test/evp_test.c, and a test for RSA sigalgs 
With these tests, we get to test:

- EVP_PKEY_sign_init_ex()
- EVP_PKEY_verify_init_ex2()
- EVP_PKEY_verify_recover_init_ex2()
- EVP_PKEY_sign_message_init() and friends
- EVP_PKEY_verify_message_init() and friends

A few test cases for RSA-{hash} are added, in
test/recipes/30-test_evp_data/evppkey_rsa_sigalg.txt

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23416)
 2024-08-21 08:21:06 +02:00
Richard Levitte
572a8371ab Refactor OpenSSL 'RSA' EVP_SIGNATURE to also include RSA+hash composites 
(in the code, "sigalg" is used to refer to these composite algorithms,
which is a nod to libcrypto and libssl, where that term is commonly used
for composite algorithms)

To make this implementation possible, wrappers were added around the hash
function itself, allowing the use of existing hash implementations through
their respective OSSL_DISPATCH tables, but also retaining the dynamic fetch
of hash implementations when the digest_sign / digest_verify functionality
is used.  This wrapper allows implementing the RSA+hash composites through
simple initializer function and a custom OSSL_DISPATCH table for each.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23416)
 2024-08-21 08:21:06 +02:00
Richard Levitte
e675aabb87 Implement functionality for direct use of composite signature algorithms 
The following API groups are extended with a new init function, as well
as an update and final function, to allow the use of explicitly fetched
signature implementations for any composite signature algorithm, like
"sha1WithRSAEncryption":

- EVP_PKEY_sign
- EVP_PKEY_verify
- EVP_PKEY_verify_recover

To support this, providers are required to add a few new functions, not
the least one that declares what key types an signature implementation
supports.

While at this, the validity check in evp_signature_from_algorithm() is
also refactored; the SIGNATURE provider functionality is too complex for
counters.  It's better, or at least more readable, to check function
combinations.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23416)
 2024-08-21 08:21:06 +02:00
Hubert Kario
1985ba60bb Link to the place where signature options are defined 
ca man page: link to section

Signed-off-by: Hubert Kario <hkario@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25011)
 2024-08-20 11:55:36 +02:00
XZ-X
391334dd8c When calling ASN1_item_i2d () check both returned length and allocated pointer 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24979)
 2024-08-20 11:45:14 +02:00
erbsland-dev
dc6993a625 Enhance s_client Output 
Fixes #8123: Clarify cipher and protocol version display
- Added a new line “Protocol:” to display the protocol version separately after the cipher line.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24921)
 2024-08-20 11:16:22 +02:00
Pauli
a0b652825c test: add command line indicator option checking to fipsinstall 
Validate that the relevant options are on when -pedantic is specified,
off when it isn't and can be given to enable the setting.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25194)
 2024-08-20 13:41:44 +10:00
slontis
96de408228 Add FIPS self test updates 
After reviewing the FIPS 140-3 IG self tests requirements the following
were added:

- TDES Decryption (Not sure why this was missing)
- DH changed to use ffdhe2048 instead of P,Q,G params.
- Signature code has been changed to use a msg rather than a digest as input.
(Since some digests dont provide the one shot API, the EVP_DigestSignFinal and
EVP_DigestVerifyFinal needed to be exposed to the FIPS provider). The
code is now shared between ED and the other key types.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25217)
 2024-08-20 10:05:13 +10:00
Ingo Franzki
e113a92e29 test/hmactest: Add further tests for HMAC with multiple update calls 
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25161)
 2024-08-19 18:23:35 +02:00
Ingo Franzki
0499de5add s390x: Add hardware acceleration for HMAC 
The CPACF instruction KMAC provides support for accelerating the HMAC
algorithm on newer machines for HMAC with SHA-224, SHA-256, SHA-384, and
SHA-512.

Preliminary measurements showed performance improvements of up to a factor
of 2, dependent on the message size, whether chunking is used and the size
of the chunks.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25161)
 2024-08-19 18:23:35 +02:00
Ingo Franzki
518b53b139 s390x: Add defines for new CPACF functions 
Add defines for new CPACF functions codes, its required MSA levels, and
document how to disable these functions via the OPENSSL_s390xcap environment
variable.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25161)
 2024-08-19 18:23:35 +02:00
Tomas Mraz
a6c9378e43 Explicitly include e_os.h for close() 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25229)

(cherry picked from commit 0c0c6954bf)
 2024-08-19 12:27:41 +02:00
shridhar kalavagunta
d604834439 RAND_write_file(): Avoid potential file descriptor leak 
If fdopen() call fails we need to close the fd. Also
return early as this is most likely some fatal error.

Fixes #25064

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25081)
 2024-08-19 11:10:43 +02:00
slontis
4c37778a4e CI: Fix GCM IV check in acvp_test for crosstest 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25223)
 2024-08-19 10:25:41 +02:00
Tomas Mraz
5111eacd50 speed.c: Return success with -testmode -async_jobs if not ASYNC_is_capable() 
Fixes #25203

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25204)
 2024-08-19 09:06:33 +02:00
Pauli
34877dbcd4 test: add a default greeting to avoid printing a null pointer. 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/25221)
 2024-08-19 08:31:15 +10:00
slontis
563c51cea0 Add an indicator for AES GCM that returns if the iv has been generated 
internally.

This is not using a strict check since there may be applications that
require the IV to be generated externally (e.g. java).

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25178)
 2024-08-19 07:21:28 +10:00
Andrew Dinh
47645bf7c6 list_tls_signatures(): Avoid leak with zero length builtin_sigalgs 
Fixes Coverity 1616307

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25219)
 2024-08-17 17:32:17 -04:00
Dmitry Belyavskiy
8d28402ce3 We can't check policy if we got an empty stack of certs 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25186)
 2024-08-17 18:09:15 +02:00
Neil Horman
7c3c7374ce Move docker files to test 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25091)
 2024-08-16 14:34:08 -04:00
Neil Horman
4c2242b67c Add workflow to do nightly build of interop container and push to quay 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25091)
 2024-08-16 14:34:08 -04:00
Neil Horman
8ffdfea639 Add dockerfile for generation of a quic interop container 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25091)
 2024-08-16 14:34:08 -04:00
Bernd Edlinger
d550d2aae5 Fix unpredictible refcount handling of d2i functions 
The passed in reference of a ref-counted object
is free'd by d2i functions in the error handling.
However if it is not the last reference, the
in/out reference variable is not set to null here.
This makes it impossible for the caller to handle
the error correctly, because there are numerous
cases where the passed in reference is free'd
and set to null, while in other cases, where the
passed in reference is not free'd, the reference
is left untouched.

Therefore the passed in reference must be set
to NULL even when it was not the last reference.

Fixes #23713

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22809)
 2024-08-16 10:07:52 +02:00
Bernd Edlinger
83951a9979 Extend test case for reused PEM_ASN1_read_bio 
This is related to #22780, simply add test cases
for the different failure modes of PEM_ASN1_read_bio.
Depending on whether the PEM or the DER format is valid or not,
the passed in CRL may be deleted ot not, therefore a statement
like this:

reused_crl = PEM_read_bio_X509_CRL(b, &reused_crl, NULL, NULL);

must be avoided, because it can create memory leaks.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22809)
 2024-08-16 10:07:52 +02:00
Pauli
dcc118cde0 replace static declarations 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25192)
 2024-08-16 11:34:24 +10:00
Pauli
c14003578a Revert "fipsinstall: add ed_no_verify_digested option" 
This reverts commit 70b6d57fd9.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25192)
 2024-08-16 11:34:24 +10:00
Pauli
a6aa2d1f03 Revert "doc: add documentation for -eddsa_no_verify_digested fipsinstall option" 
This reverts commit b00ea9a6a2.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25192)
 2024-08-16 11:34:24 +10:00
Pauli
682b4fe553 Revert "doc: add verify-digested param for EdDSA" 
This reverts commit ab02a297eb.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25192)
 2024-08-16 11:34:24 +10:00
Pauli
3e7334f3c2 Revert "param: add OSSL_SIGNATURE_PARAM_EDDSA_VERIFY_DIGESTED" 
This reverts commit 5abd7e5f79.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25192)
 2024-08-16 11:34:24 +10:00
Pauli
f1b17245b6 Revert "fips: add no digested option to FIPS provider" 
This reverts commit 889277effb.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25192)
 2024-08-16 11:34:22 +10:00
Pauli
7de4770234 Revert "EdDSA: disallow verification from a pregenerated hash when in FIPS" 
This reverts commit 2d759937e2.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25192)
 2024-08-16 11:32:37 +10:00
Pauli
f9e1117cca Revert "test: update EdDSA tests for FIPS and no pre-hashing" 
This reverts commit 09eaf16771.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25192)
 2024-08-16 11:32:37 +10:00
Pauli
357e3265a4 Revert "test: omit failing test when using a FIPS provider that supports eddsa_no_verify_digested" 
This reverts commit 54933db9f0.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25192)
 2024-08-16 11:32:37 +10:00
Pauli
1348f4b5cf Revert "Apply the FIPS_eddsa_no_verify_digested indicator on prehash EdDSA only" 
This reverts commit ca112fccdd.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25192)
 2024-08-16 11:32:37 +10:00
slontis
4b7b40f2f7 FIPS: Remove ability to bypass the FIPS self tests 
This is a FIPS 140-3 requirement.
It should not be done as a FIPS indicator.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25147)
 2024-08-16 10:14:24 +10:00
slontis
a595d624c8 Change existing evp_test KeyGen Ctrls to use provider algorithm 
parameter names.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25008)
 2024-08-15 15:21:14 -04:00
slontis
2a53830958 Update evp_test KeyGen 
The EVP_PKEY_CTX is now created in keygen_test_run().
keygen_test_parse() inserts all values into KEYGEN_TEST_DATA.
The 'Ctrl' parameters have been changed to just be settables,
rather than using legacy controls.

Added EC keygen tests

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25008)
 2024-08-15 15:21:14 -04:00
slontis
e3a453c838 Restrict FIPS EC Keygen to only allow curves with a security strength 
>=112 bits

Add a FIPS indicator to EC keygen

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25008)
 2024-08-15 15:21:14 -04:00
Matt Caswell
8781087a69 Ensure the msg_callback is called on CCS receipt in TLSv1.3 
CCS records are ignore in TLSv1.3. But we should still call the msg_callback
anyway.

Fixes #25166

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25169)
 2024-08-15 20:17:39 +02:00
slontis
05681e0e3e Add FIPS Indicator for ECDH cofactor. 
FIPS KAS requires use of ECC CDH.

The EC 'B' and 'K' curves have a cofactor that is not 1, and this
MUST be multiplied by the private key when deriving the shared secret.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25139)
 2024-08-15 19:48:15 +02:00
Andreas Treichel
0813ffee2f apps/cms.c, apps/smime.c: Fix -crlfeol help messages 
CLA: trivial

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24434)
 2024-08-15 19:45:20 +02:00
David Benjamin
2ec4e95014 Fix SSL_CTX_set1_groups documentation on preference orders 
The documentation currently describes SSL_CTX_set1_groups as a
preference order, but this does not match the typical interpretation of
"preference order" in OpenSSL and TLS. Typically, an application can
order more secure options ahead of less secure ones and pick up TLS's
usual downgrade protection guarantees.

TLS 1.3 servers need to balance an additional consideration: some
options will perform worse than others due to key share prediction. The
prototypical selection procedure is to first select the set of more
secure options, then select the most performant among those.

OpenSSL follows this procedure, but it *unconditionally* treats all
configured curves as equivalent security. Per discussion on GitHub,
OpenSSL's position is that this is an intended behavior.

While not supported by built-in providers, OpenSSL now documents that
external providers can extend the group list and CHANGES.md explicitly
cites post-quantum as a use case. With post-quantum providers, it's
unlikely that application developers actually wanted options to be
equivalent security. To avoid security vulnerabilities arising from
mismatched expectations, update the documentation to clarify the server
behavior.

Per the OTC decision in
https://github.com/openssl/openssl/issues/22203#issuecomment-1744465829,
this documentation fix should be backported to stable branches.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23776)
 2024-08-15 19:42:50 +02:00
Bhaskar Metiya
1d2cbd9b5a apps/req.c: No warning reading from stdin if redirected 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25179)
 2024-08-15 17:59:28 +02:00
Bhaskar Metiya
02b8b7b836 Return SSL_AD_DECRYPT_ERROR alert on PSK binder validation failure (RFC 8446) 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25176)
 2024-08-15 11:21:24 +02:00
Dimitri John Ledkov
8945f406a7 fips: allow to customize provider vendor name 
FIPS providers need to specify identifiable names and versions. Allow
to customize the fips provider name prefix, via VERSION.dat which
already allows to customize version & buildinfo. With this patch
in-place it removes the need of patching code to set customized
provider name.

E.g. echo FIPS_VENDOR=ACME >> VERSION.dat, results in

```
$ OPENSSL_CONF=fips-and-base.cnf ../util/wrap.pl ../apps/openssl list -providers --verbose
Providers:
  base
    name: OpenSSL Base Provider
    version: 3.4.0
    status: active
    build info: 3.4.0-dev
    gettable provider parameters:
      name: pointer to a UTF8 encoded string (arbitrary size)
      version: pointer to a UTF8 encoded string (arbitrary size)
      buildinfo: pointer to a UTF8 encoded string (arbitrary size)
      status: integer (arbitrary size)
  fips
    name: ACME FIPS Provider for OpenSSL
    version: 3.4.0
    status: active
    build info: 3.4.0-dev
    gettable provider parameters:
      name: pointer to a UTF8 encoded string (arbitrary size)
      version: pointer to a UTF8 encoded string (arbitrary size)
      buildinfo: pointer to a UTF8 encoded string (arbitrary size)
      status: integer (arbitrary size)
      security-checks: integer (arbitrary size)
      tls1-prf-ems-check: integer (arbitrary size)
      drbg-no-trunc-md: integer (arbitrary size)
```

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24368)
 2024-08-15 08:33:48 +10:00
Tomas Mraz
ca112fccdd Apply the FIPS_eddsa_no_verify_digested indicator on prehash EdDSA only 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25188)
 2024-08-14 14:52:47 -04:00
Matt Caswell
096a54ee45 Don't compile in support for DSA speed testing if not needed 
If there is no DSA support in the library we should not compile in support
for speed testing of DSA. We should skip it in much the same way that we
do for other algorithms.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25153)
 2024-08-14 18:22:10 +02:00
Matt Caswell
8e82304adb Fix a memory leak in the speed app 
Make sure we free the ecdsa_key object after we have finished using it.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25153)
 2024-08-14 18:22:10 +02:00
Matt Caswell
509022ddf8 Add a test recipe for testing the speed command 
Previously there was no test for the speed command. We just do some simple
testing, running the command with various options to confirm that it doesn't
crash or report errors. We use the new -testmode option to ensure that this
happens quickly and doesn't really run full speed tests.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25153)
 2024-08-14 18:22:10 +02:00
Matt Caswell
1867aac808 Document the new -testmode option to the speed command 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25153)
 2024-08-14 18:21:28 +02:00
Matt Caswell
9309b0b8c7 Add a test mode to the speed app 
We add a testmode option to the speed app which simply runs 1 iteration of
any speed tests. If anything fails along the way the app returns an error
code.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25153)
 2024-08-14 18:21:28 +02:00
Shih-Yi Chen
dbe8059edf Update krb5 to latest master to pick up CVE fixes 
CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25131)

(cherry picked from commit 099a71b48b)
 2024-08-14 17:57:43 +02:00
slontis
5f04124aab Add EDDSA FIPS self tests. 
See FIPS 140-3 IG Section 10.3.A Part 11
Indicates ECDSA requires a sign and verify test.
Note 11 states that HashEdDSA is not required to be tested if PureEdDSA is tested.
Note 12 indicates that both ED25519 and X448 need to be tested.

Since ED uses the oneshot interface, additional API's needed to be exposed to the
FIPS provider using #ifdef FIPS_MODULE.

Changed ED25518 and ED448 to use fips=true in the FIPS provider.
Updated documentation for provider lists for EDDSA.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22112)
 2024-08-14 16:17:47 +02:00
Dmitry Belyavskiy
12ba471c29 Improve the EVP_PKEY_CTX_set_kem_op() documentation 
Fixes #25142

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25164)
 2024-08-14 11:05:11 +02:00
Pauli
21bcae6561 test: Improve coverage for the PBKDF2 unit tests 
Fixes #25136

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25160)
 2024-08-14 08:17:45 +10:00
Dmitry Belyavskiy
bd3b24c3af Encap/decap in pkeyutl - tests 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25127)
 2024-08-13 11:03:11 +02:00
Dmitry Belyavskiy
14fa2f5f47 Encap/decap in pkeyutl - documentation 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25127)
 2024-08-13 11:03:11 +02:00
Dmitry Belyavskiy
12b2e5552b Support of en/decapsulation in the pkeyutl command 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25127)
 2024-08-13 11:03:11 +02:00
Michael Baentsch
38a7183102 adds TLS signature algorithms list feature 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24821)
 2024-08-13 11:48:54 +10:00
pohsingwu
f3c03be3ad Restrict salt length for RSA-PSS in the FIPS provider 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25115)
 2024-08-13 09:55:36 +10:00
pohsingwu
878f74eb08 Setup padding mode correctly in acvp_test 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25115)
 2024-08-12 10:26:42 +08:00
Pauli
2f33265039 fipsmodule.cnf: set the signature digest checks option on installation 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25020)
 2024-08-12 09:30:50 +10:00
Pauli
fc5c86b8c1 fips: support signature-digest-checks in FIPS provider 
Fixes #24936

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25020)
 2024-08-12 09:30:50 +10:00
Pauli
db9eb0f96c test: add unit tests for disallowed XOF digests 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25020)
 2024-08-12 09:30:43 +10:00
Pauli
5ab9f7e249 signatures: disallow XOF digests when doing signatures 
Except for Ed448 and RSA PSS where they are mandatory and allow respectively.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25020)
 2024-08-12 09:30:43 +10:00
Pauli
d8783a1807 fipsinstall: use correct macro for no drbg trunc digest option 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25020)
 2024-08-12 09:30:43 +10:00
Pauli
fcf8390503 test: update fipsinstall tests to cover signature_digest_check option 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25020)
 2024-08-12 09:30:43 +10:00
Pauli
c613f080ca Add signature digest check option to fipsinstall 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25020)
 2024-08-12 09:30:43 +10:00
Pauli
5d6e692c36 doc: document -signature_digest_check option to fipsinstall 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25020)
 2024-08-12 09:30:42 +10:00
Neil Horman
a46abbd66e Fix typing on call to interlockedExchange for windows 
mingw is complaining on builds about the use of InterlockedExchange on a
uint32_t type, as the input parameter here is expected to be LONG
(defined as signed 32 bit on all versions of windows).

the input value (reader_idx) will never grow larger than the group size
of the lock (nominally 2, but always a reasonably small value), so it
should be safe to just cast it to the appropriate type here.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25015)
 2024-08-11 08:23:19 -04:00
Dmitry Belyavskiy
d7b659e185 Fix PBMAC1 MAC verification in FIPS mode 
The check for fetchability PKCS12KDF doesn't make sense when we have a
different MAC mechanism

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25144)
 2024-08-11 10:11:33 +02:00
Pauli
3416c0bff9 test: add error reasons to KBKDF tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:36:03 +10:00
Pauli
fb51e4f611 test: add positive FIPS indicator failure tests for DRBGs 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:36:03 +10:00
Pauli
dc16db61f1 test: add error reasons to TLS 1 PRF tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:35:54 +10:00
Pauli
90f64d064e test: add error reasons to X9.63 test 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:35:54 +10:00
Pauli
0acf9f8934 test: add error reasons to X9.42 test 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:35:54 +10:00
Pauli
41a9aeb672 test: add error reasons to TLS 1.3 KDF tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:35:54 +10:00
Pauli
a969c466b1 test: add error reasons to TLS 1.2 PRF tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:35:54 +10:00
Pauli
3cccd17eed test: add error reasons to Single Step KDF tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:35:54 +10:00
Pauli
20284908c4 test: add error reasons to SSHKDF tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:35:54 +10:00
Pauli
bb3b3abfd5 test: add error reasons to PBKDF2 tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:35:54 +10:00
Pauli
8c24acda18 test: add error reasons to HKDF tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:35:54 +10:00
Pauli
77915ae8eb test: add error reasons to KMAC tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:35:53 +10:00
Pauli
068c9bee37 test: add error reasons to RSA tests 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25135)
 2024-08-10 16:35:53 +10:00
Pauli
8e316edd71 fips: change from function call to macro in rsa_enc.c 
Use of the function instead of the macro for the indicator unapproved check was
noted in: https://github.com/openssl/openssl/pull/25070#discussion_r1706564363
Fix things to use the macro properly.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25134)
 2024-08-10 16:34:51 +10:00
Neil Horman
11adb943ab amend! fixup! limit bignums to 512 bytes 
fixup! limit bignums to 512 bytes

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25013)
 2024-08-09 07:59:03 -04:00
Neil Horman
f0768376e1 limit bignums to 128 bytes 
Keep us from spinning forever doing huge amounts of math in the fuzzer

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25013)
 2024-08-09 07:59:03 -04:00
slontis
250a7adbea Add "no-fips-post" configure option. 
Using this option disables the OpenSSL FIPS provider
self tests.
This is intended for debugging purposes only,
as it breaks FIPS compliance.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25063)
 2024-08-09 09:12:45 +10:00
slontis
ea3888a397 Fix FIPS indicator defines for larger indicies. 
A newer PR is using setable3 now so these indicies should be fixed.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25118)
 2024-08-09 07:16:29 +10:00
Pauli
fd39d1c80c test: add negative tests for KBKDF key size check under FIPS 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25095)
 2024-08-08 08:44:42 +10:00
Pauli
ae87c48895 fips: add kbkdf key length check as per SP 800-131a revision 2 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25095)
 2024-08-08 08:44:38 +10:00
Pauli
6cb6b17171 fips: add kbkdf key check checking function 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25095)
 2024-08-08 08:43:00 +10:00
Pauli
57fb8841dc doc: docment key-check param for kbkdf 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25095)
 2024-08-08 08:42:59 +10:00
Pauli
8d52cf525b doc: document kbkdf key check argument for fipsinstall 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25095)
 2024-08-08 08:42:59 +10:00
Pauli
243b7f399a fips: install with the kbkdf key check option set 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25095)
 2024-08-08 08:42:59 +10:00
Pauli
c2b8af893f params: add kbkdf key check param 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25095)
 2024-08-08 08:42:59 +10:00
Pauli
090247b2e2 fipsinstall: add kbkdf key check option 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25095)
 2024-08-08 08:42:59 +10:00
JulieDzeze1
e77eb1dc0b Update BN_add.pod documentation so it is consistent with header declarations 
CLA: trivial

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24215)
 2024-08-07 19:55:57 +02:00
Mathis Marion
de8861a7e3 Remove duplicate colon in otherName display 
The colon is already added in X509V3_EXT_val_prn(). In fact, the other
branches from i2v_GENERAL_NAME() do not include a trailing colon.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23428)
 2024-08-07 19:53:49 +02:00
Mathis Marion
387491d537 Add OIDs id-kp-wisun-fan-device and id-on-hardwareModule 
Sub-OIDs for {iso(1) identified-organization(3) dod(6) internet(1)
private(4) enterprise(1) 45605} are recorded in the document "Wi-SUN
Assigned Value Registry" (WAVR).

OID id-on-hardwareModule is defined in RFC 4108.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23428)
 2024-08-07 19:53:19 +02:00
Matt Caswell
c0c4e6ba0a Remove the event queue code 
PR #18345 added some code for an event queue. It also added a test for it.
Unfortunately this event queue code has never been used for anything.
Additionally the test was never integrated into a test recipe, so it never
actually gets invoked via "make test". This makes the code entirely dead,
unnecessarily bloats the size of libssl and causes a decrease in our
testing code coverage value.

We remove the dead code.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25100)
 2024-08-07 19:48:26 +02:00
Tomas Mraz
e70e34d857 dh_kmgmt.c: Avoid expensive public key validation for known safe-prime groups 
The partial validation is fully sufficient to check the key validity.

Thanks to Szilárd Pfeiffer for reporting the issue.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25088)
 2024-08-07 19:47:00 +02:00
Tomas Mraz
7bcfb41489 ossl_print_attribute_value(): use a sequence value only if type is a sequence 
Move the switch to print a distinguished name inside the
switch by the printed attribute type, otherwise a malformed
attribute will cause a crash.

Updated the fuzz corpora with the testcase

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25087)
 2024-08-07 19:43:34 +02:00
Tomas Mraz
217e215e99 rsa_pss_compute_saltlen(): Avoid integer overflows and check MD and RSA sizes 
Fixes Coverity 1604651

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25085)
 2024-08-07 19:41:52 +02:00
Tomas Mraz
e3e15e77f1 do_print_ex(): Avoid possible integer overflow 
Fixes Coverity 1604657
Fixes openssl/project#780

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25084)
 2024-08-07 19:39:26 +02:00
Pauli
00f32b22b8 test: update SSL API test in light of PKCS#1 version 1.5 padding change under FIPS 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Pauli
d0575619ad test: update SSL old test in light of PKCS#1 version 1.5 padding change under FIPS 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Pauli
449bc104c8 sslapitest: add meaningful skip messages 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Pauli
29a0f0403f cms: fix tests in light of PKCS#1 version 1.5 padding check 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Pauli
47f8f0d6e5 fips: add PKCS#1 version 1.5 padding check option 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Pauli
e928684320 rsa: disallow PKCS#1 version 1.5 padding for encrpytion under FIPS. 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Pauli
2c73d92b20 fips: add option to disable PKCS#1 version 1.5 padding 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Pauli
61ac0ca154 param: add ASYM_CIPHER_PARAM_PKCS15_PADDING_DISABLED 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Pauli
18fd8f687f doc: document pkcs15-padding-disabled param for RSA 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Pauli
9bd5362a71 doc: fix typos 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Pauli
08bd84b2e4 doc: document the fipsintsall option to disallow PKCS#1 version 1.5 padding for key agreement & transport 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Pauli
dd43e8a9ec fipsinstall: add option to disable RSA PKCS#1 version 1.5 padding 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25070)
 2024-08-07 19:35:51 +02:00
Matt Caswell
2ccd57b2c3 Add a test for a missing supported_versions extension in the HRR 
Confirm that we correctly fail if supported_versions is missing from an
HRR.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25068)
 2024-08-07 19:34:23 +02:00
Matt Caswell
293d0a0052 Check that a supported_versions extension is present in an HRR 
If an HRR is sent then it MUST contain supported_versions according to the
RFC. We were sanity checking any supported_versions extension that was sent
but failed to verify that it was actually present.

Fixes #25041

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25068)
 2024-08-07 19:34:23 +02:00
Leonie Theobald
cc37ef7d90 Add logging support for early data 
-trace option didn't cover early data message which resulted in
misleading logging.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25026)
 2024-08-07 19:32:17 +02:00
FdaSilvaYY
f21ededc3c ssl: factorize and improved hex conversion code 
Add inline qualifier to avoid exporting a function for one unique use

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24968)
 2024-08-07 19:25:10 +02:00
FdaSilvaYY
ca3c6f3829 crypto: factorize to hex chars conversion code. 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24968)
 2024-08-07 19:25:10 +02:00
FdaSilvaYY
668fdb593a ssl: remove stdio.h and sprintf use from libssl. 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24968)
 2024-08-07 19:25:10 +02:00
FdaSilvaYY
2432a9da03 apps: add missing entry to tls extension label list 
noticed by @sftcd

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24968)
 2024-08-07 19:25:10 +02:00
FdaSilvaYY
544fd23f0f Fix '--strict-warnings' build breakage 
... due to a missing const.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24968)
 2024-08-07 19:24:57 +02:00
Dimitri Papadopoulos
7d91d5ba35 Fix typos found by codespell 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24949)
 2024-08-07 19:09:43 +02:00
Tomas Mraz
33adc0767e coveralls.yml: Do not run tests in parallel 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25105)
 2024-08-07 18:53:32 +02:00
icy17
18d491a682 Fix Potential NULL pointer dereference 
CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25065)
 2024-08-07 18:50:18 +02:00
Andrew Dinh
5854b764a7 Use parent directory instead of index.html 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25073)
 2024-08-07 04:57:29 -04:00
Andrew Dinh
ad3d57d271 Update links in CONTRIBUTING.md 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25073)
 2024-08-07 04:57:29 -04:00
Andrew Dinh
d0a49eea4a Fix some small typos 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25073)
 2024-08-07 04:57:29 -04:00
Dmitry Belyavskiy
e5569e0bf1 Test vectors from rfc9579 and creation tests 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24577)
 2024-08-07 10:00:16 +02:00
Dmitry Belyavskiy
38aa61e5a7 Implementation of the RFC 9579, PBMAC1 in PKCS#12 - documentation 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24577)
 2024-08-07 10:00:16 +02:00
Dmitry Belyavskiy
fe79159be0 Implementation of the RFC 9579, PBMAC1 in PKCS#12 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24577)
 2024-08-07 10:00:16 +02:00
Pauli
54933db9f0 test: omit failing test when using a FIPS provider that supports eddsa_no_verify_digested 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
 2024-08-07 17:12:58 +10:00
Pauli
09eaf16771 test: update EdDSA tests for FIPS and no pre-hashing 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
 2024-08-07 17:12:58 +10:00
Pauli
2d759937e2 EdDSA: disallow verification from a pregenerated hash when in FIPS 
Also includes an indicator and the capability to bypass via configuration
or params.

Fixes #24937

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
 2024-08-07 17:12:58 +10:00
Pauli
889277effb fips: add no digested option to FIPS provider 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
 2024-08-07 17:12:58 +10:00
Pauli
5abd7e5f79 param: add OSSL_SIGNATURE_PARAM_EDDSA_VERIFY_DIGESTED 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
 2024-08-07 17:12:58 +10:00
Pauli
ab02a297eb doc: add verify-digested param for EdDSA 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
 2024-08-07 17:12:58 +10:00
Pauli
b00ea9a6a2 doc: add documentation for -eddsa_no_verify_digested fipsinstall option 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
 2024-08-07 17:12:58 +10:00
Pauli
70b6d57fd9 fipsinstall: add ed_no_verify_digested option 
FIPS doesn't permit message hashes to be processed by thee algorithms.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
 2024-08-07 17:12:58 +10:00
slontis
f98e49b326 Add FIPS DSA Keygen tests 
Adjust the existing tests to disable DSA keygen in FIPS mode.

Allow evp_test to load DSA 'KeyParams' that can then be used to
perform a DSA KeyGen.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24978)
 2024-08-06 11:01:13 +02:00
slontis
49a35f0f92 Disallow DSA Keygen in the FIPS provider 
This uses a FIPS indicator.
Since DSA KeyGen is only useful for DSA signing,
it reuses the DSA signing FIPS configuration option and settable ctx name.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24978)
 2024-08-06 11:01:13 +02:00
slontis
d9346c59f4 Add KeyManagement keygen parameter getter/gettable functions. 
Added OSSL_FUNC_keymgmt_gen_get_params() and
OSSL_FUNC_keymgmt_gen_gettable_params()

This will allow a FIPS indicator parameter to be queried after keygen.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24978)
 2024-08-06 11:01:13 +02:00
slontis
7f8ff7ab14 Fix evp_test HKDF failure in crosstest 3.1.2 FIPS provider with master 
Fixes #25089
The test to check if the FIPS indicator was correct failed in 3.1.2
since EVP_PKEY_CTX_get_params() returns 0 if there is no
gettable/getter.

The code has been modified to return 1 if there is no gettable.
Manually reproduced and tested by copying the 3.1.2 FIPS provider to master.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25093)
 2024-08-06 10:17:50 +02:00
Dimitri John Ledkov
20bf3fe236 github: fix quoting in github workflow for jitter tests 
Nested quoting got ignore previously. And this way one can specify
string name directly.

Successfully run with Jitter at
2828901701

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25053)
 2024-08-05 12:54:21 -04:00
pohsingwu
aa3830c3fc Add new configurable item pbkdf2-lower-bound-check 
Since FIPS provider performs lower bound check by default from v3.0, the
default value for new configurable item will be one.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24120)
 2024-08-05 09:57:23 +10:00
pohsingwu
a7f8378e8c Add explicit indicator for PBKDF2 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24120)
 2024-08-05 09:57:23 +10:00
Tomas Mraz
ca1d2db291 Do not implicitly start connection with SSL_handle_events() or SSL_poll() 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25069)
 2024-08-03 09:18:11 -04:00
Tomas Mraz
b1f4aebb74 Return infinity time from SSL_get_event_timeout when the connection is not started 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25069)
 2024-08-03 09:18:11 -04:00
Tomas Mraz
b7f93c7fcb Do not falsely start the connection through SSL_pending()/_has_pending() 
Fixes #25054

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25069)
 2024-08-03 09:18:11 -04:00
Richard Levitte
0beef0ba00 fix: util/mkinstallvars.pl mistreated LDLIBS on Unix (and Windows) 
Don't do comma separation on those platforms.

Fixes #24986

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25018)
 2024-08-03 09:09:02 -04:00
Tomas Mraz
ed7a8bfd74 ssl_evp_cipher_fetch(): Avoid using 3DES from the FIPS provider 
Avoid using a fetched cipher that is decrypt-only
which is the case for 3DES from the fips provider.

Add a decrypt-only parameter to the EVP_CIPHER and test it
in libssl when fetching.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25028)
 2024-08-01 17:29:39 +02:00
Tomas Mraz
3bbcd0c537 3DES ciphersuites are not allowed in FIPS anymore 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25028)
 2024-08-01 17:29:32 +02:00
Tomas Mraz
3bc097d80a Add enable-weak-ssl-ciphers to full_featured CI job 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25028)
 2024-08-01 17:29:32 +02:00
Clemens Lang
5cec58bdff Speed up SSL_add_{file,dir}_cert_subjects_to_stack 
The X509_NAME comparison function converts its arguments to DER using
i2d_X509_NAME before comparing the results using memcmp(). For every
invocation of the comparison function (of which there are many when
loading many certificates), it allocates two buffers of the appropriate
size for the DER encoding.

Switching to static buffers (possibly of X509_NAME_MAX size as defined
in crypto/x509/x_name.c) would not work with multithreaded use, e.g.,
when two threads sort two separate STACK_OF(X509_NAME)s at the same
time. A suitable re-usable buffer could have been added to the
STACK_OF(X509_NAME) if sk_X509_NAME_compfunc did have a void* argument,
or a pointer to the STACK_OF(X509_NAME) – but it does not.

Instead, copy the solution chosen in SSL_load_client_CA_file() by
filling an LHASH_OF(X509_NAME) with all existing names in the stack and
using that to deduplicate, rather than relying on sk_X509_NAME_find(),
which ends up being very slow.

Adjust SSL_add_dir_cert_subjects_to_stack() to keep a local
LHASH_OF(X509_NAME)s over the complete directory it is processing.

In a small benchmark that calls SSL_add_dir_cert_subjects_to_stack()
twice, once on a directory with one entry, and once with a directory
with 1000 certificates, and repeats this in a loop 10 times, this change
yields a speed-up of 5.32:

| Benchmark 1: ./bench 10 dir-1 dir-1000
|   Time (mean ± σ):      6.685 s ±  0.017 s    [User: 6.402 s, System: 0.231 s]
|   Range (min … max):    6.658 s …  6.711 s    10 runs
|
| Benchmark 2: LD_LIBRARY_PATH=. ./bench 10 dir-1 dir-1000
|   Time (mean ± σ):      1.256 s ±  0.013 s    [User: 1.034 s, System: 0.212 s]
|   Range (min … max):    1.244 s …  1.286 s    10 runs
|
| Summary
|   LD_LIBRARY_PATH=. ./bench 10 dir-1 dir-1000 ran
|    5.32 ± 0.06 times faster than ./bench 10 dir-1 dir-1000

In the worst case scenario where many entries are added to a stack that
is then repeatedly used to add more certificates, and with a larger test
size, the speedup is still very significant. With 15000 certificates,
a single pass to load them, followed by attempting to load a subset of
1000 of these 15000 certificates, followed by a single certificate, the
new approach is ~85 times faster:

| Benchmark 1: ./bench 1 dir-15000 dir-1000 dir-1
|   Time (mean ± σ):     176.295 s ±  4.147 s    [User: 174.593 s, System: 0.448 s]
|   Range (min … max):   173.774 s … 185.594 s    10 runs
|
| Benchmark 2: LD_LIBRARY_PATH=. ./bench 1 dir-15000 dir-1000 dir-1
|   Time (mean ± σ):      2.087 s ±  0.034 s    [User: 1.679 s, System: 0.393 s]
|   Range (min … max):    2.057 s …  2.167 s    10 runs
|
| Summary
|   LD_LIBRARY_PATH=. ./bench 1 dir-15000 dir-1000 dir-1 ran
|    84.48 ± 2.42 times faster than ./bench 1 dir-15000 dir-1000 dir-1

Signed-off-by: Clemens Lang <cllang@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25056)
 2024-08-01 17:28:18 +02:00
Marc Brooks
871c534d39 Free fetched digest in show_digests 
Fixes #24892

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25046)
 2024-08-01 11:31:43 +02:00
pohsingwu
6fa9a84386 Update documentation 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/23900)
 2024-08-01 16:47:12 +10:00
pohsingwu
81bb88481d Call key_check_passed in set_ctx_params 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/23900)
 2024-08-01 16:47:12 +10:00
pohsingwu
ba977226cf Add FIPS indicator tests for KDFs 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/23900)
 2024-08-01 16:47:12 +10:00
pohsingwu
1b838621c3 Restrict the length of key-derivation key used in KDFs 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/23900)
 2024-08-01 16:47:12 +10:00
Tomas Mraz
96b59ec4b6 CMS_get1_crls(): Remove redundant check for NULL crls 
Fixes Coverity 1610380

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24928)
 2024-07-31 15:58:24 +02:00
Neil Horman
7408d58714 disable rwlocks on nonstop klt model 
It appears nonstops new threading model defines some level of rwlock
pthread api, but its not working properly.  Disable rwlocks for
_KLT_MODEL_ for now

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24969)
 2024-07-31 08:05:53 -04:00
Neil Horman
9bd5e92aff Add error checking to CRYPTO_atomic_[load|store] calls 
Noted that we didn't check return codes of the atomic loads/stores in
the new hashtable, and they can fail

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24969)
 2024-07-31 08:05:53 -04:00
Neil Horman
8e5cc43e74 Make ossl_ht_delete use read-once semantics 
To ensure that the value of h->md doesn't get recomputed during a delete
operation use ossl_rcu_deref on it

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24969)
 2024-07-31 08:05:53 -04:00
Neil Horman
3190f5c06b Fix CRYPTO_atomic_store 
If the implementation of this function falls to using a pthread lock to
update a value, it should be a write lock, not a read lock

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24969)
 2024-07-31 08:05:53 -04:00
Tomas Mraz
454ca902c7 evp_get_digest/cipherbyname_ex(): Try to fetch if not found 
If the name is not found in namemap, we need
to try to fetch the algorithm and query the
namemap again.

Fixes #19338

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24940)
 2024-07-31 11:25:55 +02:00
Tomas Mraz
4fa9d1f40f Avoid leaking *ba_ret on reconnections 
Also fixes Coverity 1604639
There is no point in checking ba_ret as it can never be NULL.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24931)
 2024-07-31 11:23:16 +02:00
Dimitri John Ledkov
f41b5ffe33 jitter: retry intermittent failures 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24844)
 2024-07-31 14:44:51 +10:00
Dimitri John Ledkov
f8c510cd20 JITTER: implement error handling from jitter library 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24844)
 2024-07-31 14:44:51 +10:00
Dimitri John Ledkov
1e7ff7be23 JITTER: excercise all tests in CI with JITTER seed source under certain build configuration 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24844)
 2024-07-31 14:44:51 +10:00
Dimitri John Ledkov
8f3ebb7d60 JITTER: add documentation 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24844)
 2024-07-31 14:44:51 +10:00
Dimitri John Ledkov
b28b312804 jitter: add a new provider containing a jitter entropy source alone 
This entropy source can be used instead of SEED-SRC. Sample
openssl.cnf configuration is provided. It is built as a separate
provider, because it is likely to require less frequent updates than
fips provider. The same build likely can span multiple generations of
FIPS 140 standard revisions.

Note that rand-instances currently chain from public/private instances
to primary, prior to consuming the seed. Thus currently a unique ESV
needs to be obtained, and resue of jitterentropy.a certificate is not
possible as is. Separately a patch will be sent to allow for
unchaining public/private RAND instances for the purpose of reusing
ESV.

Also I do wonder if it makes sense to create a fips variant of stock
SEED-SRC entropy source, which in addition to using getrandom() also
verifies that the kernel is operating in FIPS mode and thus is likely
a validated entropy source. As in on Linux, check that
/proc/sys/crypto/fips_enabled is set to 1, and similar checks on
Windows / MacOS and so on.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24844)
 2024-07-31 14:44:51 +10:00
slontis
4f5febe2c6 Add FIPS indicator to CMAC. 
There is a issue currently related to CMAC TDES, when the new provider
is tested against older branches.

The new strict check caused backwards compatibility issues when
using old branch with the new FIPS provider.

To get around this CMAC now allows TDES by default, but it can be either
enabled via config or a settable. (i.e it uses an indicator)

Where the TDES cipher check can be done turned out to be problematic.
Shifting the check in the TDES cipherout of the init doesnt work because
ciphers can run thru either final or cipher (and checking on every
cipher call seemed bad). This means it needs to stay in the cipher init.
So the check needs to be done in CMAC BEFORE the underlying TDES cipher
does it check.
When using an indicator the TDES cipher needs its "encrypt-check" set
so that needs to be propagated from the CMAC object. This requires
the ability to set the param at the time the cipher ctx is inited.
An internal function was required in order to pass params to CMAC_Init.

Note also that the check was done where it is, because EVP_Q_mac() calls
EVP_MAC_CTX_set_params(ctx, cipher_param)
EVP_MAC_CTX_set_params(ctx, params)
EVP_MAC_init(ctx, key, keylen, params)
Where the second call to set_params would set up "encrypt-check" after
"cipher".

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25022)
 2024-07-31 09:04:17 +10:00
Pauli
efba3f1351 Add negative tests for SHAKE with PBKDF2 and X9.42 KDF 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24862)
 2024-07-30 18:04:36 +10:00
Pauli
a5827910da Disallow SHAKE when using PBKDF2 and X9.42 KDF 
The operation is non-sensical.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24862)
 2024-07-30 18:04:36 +10:00
slontis
07e4d7f474 Add RSA Signature restrictions for X9.31 padding in the FIPS provider. 
In FIPS 140-3, RSA Signing with X9.31 padding is not approved,
but verification is allowed for legacy purposes. An indicator has been added
for RSA signing with X9.31 padding.

A strict restriction on the size of the RSA modulus has been added
i.e. It must be 1024 + 256 * s (which is part of the ANSI X9.31 spec).

Added implementation comments to the X9.31 padding code

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24021)
 2024-07-29 10:16:30 +10:00
Pauli
9c57eb736e drbg: streamline test for allowed digests 
Under FIPS, we've got a whitelist of algorithms.  There is no need to then
also check for XOF digests because they aren't possible.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25007)
 2024-07-28 18:49:52 +10:00
Neil Horman
4811efe12f fix Coverity 1604662 
Coverity flagged an issue in our bio_enc tests in which we failed to
check the return code of BIO_read for an error condition which can lead
to our length computation going backwards.

Just check the error code before adding it to length

Fixes openssl/project#779

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25006)
 2024-07-27 10:07:35 -04:00
Neil Horman
32185d513c Fix second error from Coverity-161057 
Coverity flagged a second error in this code

we're comparing block_padding and hs_padding for >= 0, which is always
true

With the change to the use of strtoul, inputs that are preceded with a -
(i.e. negative values), are caught already, so the check is redundant

just remove the check entirely

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24993)
 2024-07-26 13:25:18 -04:00
Neil Horman
31cd9cd830 Fix coverity-993406 
Coverity flagged an overflow warning in the cmsapitest.

Its pretty insignificant, but if a huge file is passed in via BIO, its
possible for the length variable returned to overflow.

Just check it as we read to silence coverity on it.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24995)
 2024-07-26 13:16:10 -04:00
slontis
bc43158797 Add FIPS indicator support for Triple-DES encryption. 
This leaves 3DES with the FIPS query "FIPS=yes", which allows
Triple-DES to be used for Decryption by default.

Disallow CMAC using Triple-DES in FIPS.
This does not use a FIPS indicator.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24960)
 2024-07-26 14:26:49 +10:00
Pauli
8fe150cce8 test: fix failing KDF tests with changed behaviour 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24917)
 2024-07-26 10:10:14 +10:00
Pauli
50a91de440 changes: add no_short_mac entry 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24917)
 2024-07-26 10:10:14 +10:00
Pauli
3762a56b87 test: add unit tests for no-short-mac 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24917)
 2024-07-26 10:10:14 +10:00
Pauli
98fbe67924 prov: add no-short-mac code to KMAC 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24917)
 2024-07-26 10:10:14 +10:00
Pauli
d791c2c486 fips: wire in the no-short-mac option 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24917)
 2024-07-26 10:10:13 +10:00
Pauli
3440a9a0e2 doc: document no-short-mac param 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24917)
 2024-07-26 10:09:31 +10:00
Pauli
3f15ec76a4 paramnames: add params for no-short-mac option 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24917)
 2024-07-26 10:09:31 +10:00
Pauli
fc98a2f6ad doc: document no_short_mac option to fipsinstall 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24917)
 2024-07-26 10:09:29 +10:00
Pauli
00231a6ae9 fipsinstall: add no_short_mac option 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24917)
 2024-07-26 10:08:43 +10:00
Pauli
4a002f51f0 evp_test: check MAC FIPS approved flag 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24917)
 2024-07-26 10:08:43 +10:00
slontis
85caa417e0 Disable DSA signing in the FIPS provider. 
This is a FIPS 140-3 requirement.
This uses a FIP indicator if either the FIPS configurable "dsa_sign_disabled" is set to 0,
OR OSSL_SIGNATURE_PARAM_FIPS_SIGN_CHECK is set to 0 in the dsa signing context.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24799)
 2024-07-26 09:24:04 +10:00
Neil Horman
86fd4c1df9 Fix Coverity-1604641 
Coverity flagged an overflow warning here that can occur if BIO_write
returns an error.

The overflow itself is a bit of a non-issue, but if BIO_write returns
< 0, then the return from i2a_ASN1_OBJECT will be some odd value
representing whatever the offset from the error code to the number of
bytes the dump may or may not have written (or some larger negative
error code if both fail.

So lets fix it.  Only do the dump if the BIO_write call returned 0 or
greaater.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/24976)
 2024-07-25 14:23:39 -04:00
pohsingwu
3c6e114959 Fix typo in mk-fipsmodule-cnf.pl 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24977)
 2024-07-25 09:34:51 +10:00
Jonathan M. Wilbur
34e8ddfc44 doc: the basicAttConstraints X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24847)
 2024-07-24 16:14:17 -04:00
Jonathan M. Wilbur
aa51de6d6a test: the basicAttConstraints X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24847)
 2024-07-24 16:14:17 -04:00
Jonathan M. Wilbur
7f5db0c9a9 feat: support the basicAttConstraints X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24847)
 2024-07-24 16:14:17 -04:00
Neil Horman
ec1d8ead28 Fix strtoul test on alpine/musl 
The strtoul tests that were recently added had a compile time check for
__WORDSIZE to properly determine the string to use for an maximal
unsigned long.  Unfortunately musl libc doesn't define __WORDSIZE so we
were in a position where on that platform we fall to the 32 bit unsigned
long variant, which breaks on x86 platforms.

Fix it by doing a preprocessor comparisong on ULONG_MAX instead.

NOTE: This works because preprocessors do arithmetic evaluation on
macros for every compiler we support.  We should be wary of some more
esoteric compilers though.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24974)
 2024-07-24 12:03:16 -04:00
pohsingwu
14e46600c6 Restrict digest in set_ctx_params 
In this commit, we also return different error if the digest is XOF.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23889)
 2024-07-24 13:16:08 +10:00
pohsingwu
5e25b8afc0 Add FIPS indicator tests for KDFs 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23889)
 2024-07-24 13:16:08 +10:00
pohsingwu
6d47e819f2 Restrict digest algorithm used in KDFs 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23889)
 2024-07-24 13:16:08 +10:00
Neil Horman
4f619ca622 Ensure cmd from fuzz buffer is always valid 
The quic-srtm fuzzer uses a loop in which an integer command is
extracted from the fuzzer buffer input to determine the action to take,
switching on the values between 0 and 3, and ignoring all other
commands.  Howver in the failing fuzzer test case here:
https://oss-fuzz.com/testcase-detail/5618331942977536

The buffer provided shows a large number of 0 values (indicating an SRTM
add command), and almost no 1, 2, or 3 values.  As such, the fuzzer only
truly exercises the srtm add path, which has the side effect of growing
the SRTM hash table unboundedly, leading to a timeout when 10 entries
need to be iterated over when the hashtable doall command is executed.

Fix this by ensuring that the command is always valid, and reasonably
distributed among all the operations with some modulo math.

Introducing this change bounds the hash table size in the reproducer
test case to less than half of the initially observed size, and avoids
the timeout.

Fixes openssl/project#679

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24827)
 2024-07-23 08:20:15 -04:00
Dimitri Papadopoulos
aececda752 unnecessary whitespace before a quoted newline 
Found by running the checkpatch.pl Linux script to enforce coding style.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22097)
 2024-07-22 06:55:35 -04:00
Dimitri Papadopoulos
001b92d68d Prefer ARRAY_SIZE(...) 
In OpenSSL, it's actually OSSL_NELEM() in "internal/nelem.h".

Found by running the checkpatch.pl Linux script to enforce coding style.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22097)
 2024-07-22 06:55:35 -04:00
Dimitri Papadopoulos
f83707dc6d open brace '{' following struct go on the same line 
Found by running the checkpatch.pl Linux script to enforce coding style.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22097)
 2024-07-22 06:55:35 -04:00
Dimitri Papadopoulos
962431d58b that open brace { should be on the previous line 
Found by running the checkpatch.pl Linux script to enforce coding style.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22097)
 2024-07-22 06:55:35 -04:00
Dimitri Papadopoulos
1cf2f8231e Remove trailing whitespace 
Found by running the checkpatch.pl Linux script to enforce coding style.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22097)
 2024-07-22 06:55:35 -04:00
jasper-smit-servicenow
a4fd948512 Update X509V3_get_d2i.pod returned pointer needs to be freed 
CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24927)
 2024-07-21 12:39:14 -04:00
Tomas Mraz
b2deefb9d2 i2d_name_canon(): Check overflow in len accumulation 
Fixes Coverity 1604638

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24930)
 2024-07-21 12:24:51 -04:00
Georgi Valkov
10c36d2f8d gitignore: add .DS_Store 
macOS creates .DS_Store files all over the place while browsing
directories. Add it to the list of ignored files.

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24942)
 2024-07-21 12:09:15 -04:00
Richard Levitte
787e1dd941 fix: style nits 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24854)
 2024-07-21 12:04:49 -04:00
Richard Levitte
b96e10b9f9 fix: refactor the EVP_PKEY_OP checks 
On the one hand, we have public macros that are collections of EVP_PKEY_OP
bits, like EVP_PKEY_OP_TYPE_SIG, obviously meant to be used like this:

    if ((ctx->operation & EVP_PKEY_OP_TYPE_SIG) == 0) ...

On the other hand, we also have internal test macros, like
EVP_PKEY_CTX_IS_SIGNATURE_OP(), obviously meant to be used like this:

    if (EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx)) ...

Unfortunately, these two sets of macros were completely separate, forcing
developers to keep them both sync, manually.

This refactor makes the internal macros use the corresponding public macros,
and adds the missing public macros, for consistency.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24854)
 2024-07-21 12:04:49 -04:00
Tomas Mraz
a988704147 tls13_meth.c: Check for negative return from EVP_CIPHER_CTX_get_iv_length() 
Fixes Coverity 1598052

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24929)
 2024-07-21 12:00:20 -04:00
slontis
53b0527dd7 Remove check for RSA encryption allowing X9.31 padding. 
X9.31 is a Signature Standard, and should not apply to encryption.

rsa_ossl_public_encrypt() does not allow this padding mode.
The openssl rsautil command line tool already failed if the
-x931 option was used with -encrypt

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24938)
 2024-07-21 11:54:58 -04:00
Pauli
98afa01f3e fips: correctly initialise FIPS indicator settables 
The `memset(3)` just happened to work because 2s complement.
This is more robust.

Also reduced the size of the indicator structure.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24923)
 2024-07-19 17:33:19 +02:00
Tomas Mraz
8a79f5bc18 prov-compat-label.yml: Do not test fips provider from master 
The master branch will be modified by the PR so the result will
be misleading.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24933)
 2024-07-19 17:32:05 +02:00
Tomas Mraz
d357e5476a Fix the provider compatibility CI 
Added missing fips version checks in rand_test.c and evprand.txt

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24933)
 2024-07-19 17:32:05 +02:00
Neil Horman
50066236eb Fix coverity-1604661 
Coverity called out an error in asn1parse_main, indicating that the
for(;;) loop which repeatedly reads from a bio and updates the length
value num, may overflow said value prior to exiting the loop.

We could probably call this a false positive, but on very large PEM
file, I suppose it could happen, so just add a check to ensure that num
doesn't go from a large positive to a large negative value inside the
loop

Fixes openssl/private#571

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24910)
 2024-07-18 19:09:10 +02:00
Neil Horman
0b67643ade Fix coverity-1610057 
Coverity caught a error in a recent change, in which atoi was used to
assign a value to two size_t variables, and then checked them for being
>= 0, which will always be true.

given that atoi returns an undefined value (usually zero) in the event
of a failure, theres no good way to check the return value of atoi for
validitiy.

Instead use OPENSSL_strtoul and confirm both that the translation
passed, and that the endptr value is at the NULL terminator (indicating
that the entire string was consumed)

Fixes openssl/private#552

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24861)
 2024-07-18 19:07:52 +02:00
Neil Horman
863e44c1e0 Add a stroul test 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24861)
 2024-07-18 19:07:52 +02:00
Neil Horman
04f7729c40 Add an OPENSSL_strtoul wrapper 
utility function to give us sane checking on strtoul conversions

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24861)
 2024-07-18 19:07:52 +02:00
Tomas Mraz
202ef97edc Allow short reads in asn1_d2i_read_bio() 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/22486)
 2024-07-18 19:05:46 +02:00
erbsland-dev
0d4663ca6a Improve clarity and readability of password input documentation 
Fixed #7310: Enhanced existing documentation for password input methods
- Refined descriptions for password input methods: `file:`, `fd:`, and `stdin`
- Enhanced readability and consistency in the instructions
- Clarified handling of multiple lines in read files.
- Clarified that `fd:` is not supported on Windows.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24878)
 2024-07-18 19:03:13 +02:00
Randall S. Becker
1b2ab42ed7 Change strnlen() to OPENSSL_strnlen() in fuzz/provider. 
strnlen() is not portable. It is preferable to use the wrapper.

Fixes: #24908

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24912)
 2024-07-18 17:26:55 +02:00
Gerd Hoffmann
d7af3f7aa7 fix vs2019 warning 
windows vs2019 throws warnings when compiling openssl for edk2:

ERROR - Compiler #2220 from [2024-07-15 13:43:34] [build-stdout] d:\a\edk2\edk2\CryptoPkg\Library\OpensslLib\openssl\ssl\statem\statem_clnt.c(1895) : the following warning is treated as an error
WARNING - Compiler #4701 from [2024-07-15 13:43:34] [build-stdout] d:\a\edk2\edk2\CryptoPkg\Library\OpensslLib\openssl\ssl\statem\statem_clnt.c(1895) : potentially uninitialized local variable 'peer_rpk' used
WARNING - Compiler #4703 from [2024-07-15 13:43:34] [build-stdout] d:\a\edk2\edk2\CryptoPkg\Library\OpensslLib\openssl\ssl\statem\statem_clnt.c(1895) : potentially uninitialized local pointer variable 'peer_rpk' used

Explicitly initialize the peer_rpk variable to make the compiler happy.

Yes, it's a false positive, but you have to check the tls_process_rpk()
body in another source file to see that, which apparently is beyond the
compiler's capabilities.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24895)
 2024-07-18 16:13:41 +02:00
Tomas Mraz
7e7c41dff6 Fix test_cms recipe 
The number of tests was not bumped in 29bbe7d008

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24926)
 2024-07-18 09:42:57 +02:00
Richard Levitte
7821b7b977 fix: util/check-format-commit.sh to handle one-line diff hunks 
For multi-line hunks, 'git diff -U0' outputs a pair of START,COUNT
indicators to show where the hunk starts and ends.  However, if the hunk is
just one line, only START is output, with the COUNT of 1 being implied.
Typically, this happens for copyright change hunks, like this:

    --- a/crypto/evp/evp_err.c
    +++ b/crypto/evp/evp_err.c
    @@ -3 +3 @@
    - * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
    + * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.

This is normal unified diff output, and our script must adapt.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24900)
 2024-07-18 05:45:52 +02:00
Tomas Mraz
cf3d65b866 EVP_PKEY-DH.pod: Clarify the manpage in regards to DH and DHX types 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/24819)
 2024-07-17 16:39:00 +02:00
Tomas Mraz
45611a8a89 Document that DH and DHX key types cannot be used together in KEX 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/24819)
 2024-07-17 16:39:00 +02:00
Georgi Valkov
ce6b2f9826 threads_pthread, threads_win: improve code consistency 
Improve code consistency between threads_pthread.c and threads_win.c
threads_pthread.c has good comments, let's copy them to threads_win.c
In many places uint64_t or LONG int was used, and assignments were
performed between variables with different sizes.
Unify the code to use uint32_t. In 32 bit architectures it is easier
to perform 32 bit atomic operations. The size is large enough to hold
the list of operations.
Fix result of atomic_or_uint_nv improperly casted to int *
instead of int.

Note:
In general size_t should be preferred for size and index, due to its
descriptive name, however it is more convenient to use uint32_t for
consistency between platforms and atomic calls.

READER_COUNT and ID_VAL return results that fit 32 bit. Cast them to
uint32_t to save a few CPU cycles, since they are used in 32 bit
operations anyway.

TODO:
In struct rcu_lock_st, qp_group can be moved before id_ctr
for better alignment, which would save 8 bytes.

allocate_new_qp_group has a parameter count of type int.
Signed values should be avoided as size or index.
It is better to use unsigned, e.g uint32_t, even though
internally this is assigned to a uint32_t variable.

READER_SIZE is 16 in threads_pthread.c, and 32 in threads_win.c
Using a common size for consistency should be prefered.

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24803)
 2024-07-17 16:37:07 +02:00
Georgi Valkov
a2c74d7af6 threads_win: fix build error with mingw64 
This fixes a build error regression on mingw64 introduced by me in
16beec98d2

In get_hold_current_qp, uint32_t variables were improperly
used to hold the value of reader_idx, which is defined as long int.
So I used CRYPTO_atomic_load_int, where a comment states
On Windows, LONG is always the same size as int

There is a size confusion, because
Win32 VC x86/x64: LONG, long, long int are 32 bit
MingW-W64: LONG, long, long int are 32 bit
cygwin64: LONG is 32 bit, long, long int are 64 bit

Fix:
- define reader_idx as uint32_t
- edit misleading comment, to clarify:
On Windows, LONG (but not long) is always the same size as int.

Fixes the following build error, reported in [1].
crypto/threads_win.c: In function 'get_hold_current_qp':
crypto/threads_win.c:184:32: error: passing argument 1 of 'CRYPTO_atomic_load_int' from incompatible pointer type [-Wincompatible-pointer-types]
  184 |         CRYPTO_atomic_load_int(&lock->reader_idx, (int *)&qp_idx,
      |                                ^~~~~~~~~~~~~~~~~
      |                                |
      |                                volatile long int *

[1] https://github.com/openssl/openssl/pull/24405#issuecomment-2211602282

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24803)
 2024-07-17 16:37:07 +02:00
Dr. David von Oheimb
29bbe7d008 {CMS,PKCS7}_verify(): use 'certs' parameter ('-certfile' option) also for chain building 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18916)
 2024-07-17 16:34:53 +02:00
Dr. David von Oheimb
cc31db1eb6 CMS_get1_{certs,crls}(): make sure they return NULL only on error 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18916)
 2024-07-17 16:34:53 +02:00
Neil Horman
22e08c7cdc Fix coverity-1604666 
Coverity recently flaged an error in which the return value for
EVP_MD_get_size wasn't checked for negative values prior to use, which
can cause underflow later in the function.

Just add the check and error out if get_size returns an error.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24896)
 2024-07-17 16:30:55 +02:00
Neil Horman
a753547eef Fix coverity-1604665 
Coverity issued an error in the opt_uintmax code, detecting a potential
overflow on a cast to ossl_intmax_t

Looks like it was just a typo, casting m from uintmax_t to ossl_intmax_t

Fix it by correcting the cast to be ossl_uintmax_t, as would be expected

Theres also some conditionals that seem like they should be removed, but
I'll save that for later, as there may be some corner cases in which
ossl_uintmax_t isn't equal in size to uintmax_t..maybe.

Fixes openssl/private#567

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24897)
 2024-07-17 09:50:36 +02:00
Pauli
90c3db9e6a Unit test for switching from KMAC to other MAC in kbkdf. 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24883)
 2024-07-17 14:14:52 +10:00
Pauli
f35fc4f184 Fix kbkdf bug if MAC is set to KMAC and then something else 
A context that is set to KMAC sets the is_kmac flag and this cannot be reset.
So a user that does kbkdf using KMAC and then wants to use HMAC or CMAC will
experience a failure.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24883)
 2024-07-17 14:14:41 +10:00
Pauli
4ac531ddcb Document the fips-indicator param for the test RNG 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24851)
 2024-07-17 10:43:21 +10:00
Pauli
df32ba9e92 Add unit tests for the TEST-RAND FIPS indicator 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24851)
 2024-07-17 10:43:21 +10:00
Pauli
924321a519 Add FIPS indicator for TEST-RAND 
The indicator is always non-FIPS, since this is used for internal tasks and
hasn't been validated.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24851)
 2024-07-17 10:43:21 +10:00
erbsland-dev
2dd74d3acb Add tests for long configuration lines with backslashes 
Introduce new test files to verify behavior with config lines longer than 512 characters containing backslashes. Updated test plan to include these new test scenarios.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24890)
 2024-07-16 21:32:40 +02:00
erbsland-dev
f54e4bc51b Fix line continuation check in config parser 
Fixes #8038: Previously, line continuation logic did not account for the 'again' flag, which could cause incorrect removal of a backslash character in the middle of a line. This fix ensures that line continuation is correctly handled only when 'again' is false, thus improving the reliability of the configuration parser.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24890)
 2024-07-16 21:32:40 +02:00
erbsland-dev
f692ceeedc Clarify in-place encryption behavior in documentation 
Fixes #7941: Update the `EVP_EncryptUpdate` documentation to specify that in-place encryption is guaranteed only if the context does not contain incomplete data from previous operations.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24887)
 2024-07-16 13:20:58 -04:00
Neil Horman
c1a27bdeb9 Fix cmake generator 
PR #24678 modified some environment variables and locations that the
cmake exporter depended on, resulting in empty directory resolution.
Adjust build build.info and input variable names to match up again

Fixes #24874

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24877)
 2024-07-16 11:12:04 -04:00
Tomas Mraz
b916940752 Optimization of ossl_ec_key_public_check() 
We can do just the quick check if cofactor == 1 as the
fact that the point is on the curve already implies
that order * point = infinity.

Fixes #21833

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24816)
 2024-07-16 15:36:46 +02:00
Neil Horman
01753c09bb Set down_load factor on hash table when culling items in doall 
oss-fuzz noted this issue:
https://oss-fuzz.com/testcase-detail/5363002606419968

Which reports a heap buffer overflow during ossl_method_cache_flush_some

Its occuring because we delete items from the hash table while inside
its doall iterator

The iterator in lhash.c does a reverse traversal of all buckets in the
hash table, and at some point a removal during an iteration leads to the
hash table shrinking, by calling contract.  When that happens, the
bucket index becomes no longer valid, and if the index we are on is
large, it exceeds the length of the list, leading to an out of band
reference, and the heap buffer overflow report.

Fix it by preventing contractions from happening during the iteration,
but setting the down_load factor to 0, and restoring it to its initial
value after the iteration is done

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24867)
 2024-07-16 06:05:14 -04:00
Pauli
2c3f1a6cad Fix parameter types int -> integer changes 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24881)
 2024-07-16 06:42:05 +02:00
Matt Caswell
5c6975bd44 Fix a copy & paste error in the EVP_RAND docs 
The "max_request" string is defined via the OSSL_RAND_PARAM_MAX_REQUEST
macro.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24863)
 2024-07-15 16:42:24 -04:00
Daniel Gustafsson
b33f2697d9 Rearrange code examples in docs for clarity 
The introduction of a deprecation notice between the header include
line and the function prototypes left the inclusion in the previous
block.  Move the #include to after the deprecation notice to ensure
that the headers is included together with the corresponding MDX_y*
functions.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24864)
 2024-07-15 12:21:31 -04:00
Neil Horman
9884568569 Fix coverity-1510058 
coverity noted a recent change made a call to OSSL_PARAM_get_size_t
without checking the return code, as is practice in all other call
sites.

Just add the check.

Fixes openssl/private#551

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24860)
 2024-07-15 10:10:00 +10:00
Neil Horman
42230f294a Convert check-format-commits.sh to use allowlist 
Initially check-format-commits.sh tried to check everything, using a
banlist to exlude files not appropriate for checking.

Its becoming clear that that approach isn't workable, given that the
number of files that we should not check far outweighs the number of
files that we should check.

Ideally we should be checking .c files, .h files and their .in
counterparts, everything else should be excluded (at least for now)

convert the script to using an allowlist, only checking the above list,
and ignoring everything else

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24865)
 2024-07-13 12:23:52 -04:00
Matt Caswell
e8c7febc8f Fix a minor typo in the documentation of RAND_set_seed_source_type() 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24858)
 2024-07-12 18:08:44 +02:00
Richard Levitte
edb5dd56fc fix(stylecheck): Take advantage of check-format-commit.sh's new capability 
.github/workflows/style-checks.yml now runs util/check-format-commit.sh
with the whole range of commits of the given PR.  This allows code style
fixups to be in a separate commit.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24856)
 2024-07-12 15:37:07 +01:00
Richard Levitte
c2083f4ec6 feat: enhance util/check-format-commit.sh to be able to handle a commit range 
Additionally, the 'git diff' call is modified to not show context lines, as
it's confusing to have style nits displayed on lines the author of the
commits hasn't touched.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24856)
 2024-07-12 15:36:50 +01:00
erbsland-dev
b74646b627 Document Internal EVP_MD_CTX_ Flags 
Add documentation for the internal flags `EVP_MD_CTX_FLAG_CLEANED` and
`EVP_MD_CTX_FLAG_REUSE`, explicitly stating that these flags are for
internal use only and must not be used in user code.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24829)
 2024-07-12 15:54:35 +02:00
Georgi Valkov
20da3dabc4 o_fopen: fix coding style and build error with VS2010 
Follow the coding style to place variable definitions before code

Fixes a build error on Windows 2003 with VS2010 introduced in [1]
crypto\o_fopen.c(45) : error C2143: syntax error : missing ';' before 'type'
crypto\o_fopen.c(46) : error C2275: 'DWORD' : illegal use of this type as an expression
        E:\Program Files (x86)\Microsoft SDKs\Windows\v7.0A\include\windef.h(152) : see declaration of 'DWORD'
crypto\o_fopen.c(46) : error C2146: syntax error : missing ';' before identifier 'flags'
crypto\o_fopen.c(46) : error C2065: 'flags' : undeclared identifier

[1] 917f37195a

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24853)
 2024-07-12 11:23:56 +01:00
Tomas Mraz
b24a8200ab x_attrib.c: Fix print_hex() function 
- Better handle 0 length input
- Use OPENSSL_buf2hexstr() instead of OPENSSL_buf2hexstr_ex()
  which fixes insufficient length of the allocate buffer.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24771)
 2024-07-12 11:20:35 +01:00
Hongren Zheng
6cf42ad392 riscv: Fix cpuid_obj asm checks for sm4/sm3 
Similar to #22881 / #23752

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/24486)
 2024-07-12 11:09:02 +01:00
Richard Levitte
6eb648941e fix: drop DSA <=> dsaWithSHA1 aliasing 
For some reason, DSA has been aliased with dsaWithSHA1 for an eternity.
They are not the same, though, and should never have been aliased in the
first place.

This was first discovered with 'openssl list':

    $ openssl list -signature-algorithms
    ...
    { 1.2.840.10040.4.1, 1.2.840.10040.4.3, 1.3.14.3.2.12, 1.3.14.3.2.13, 1.3.14.3.2.27, DSA, DSA-old, DSA-SHA, DSA-SHA1, DSA-SHA1-old, dsaEncryption, dsaEncryption-old, dsaWithSHA, dsaWithSHA1, dsaWithSHA1-old } @ default

This isn't good at all, as it confuses the key algorithms signature
function with a signature scheme that involves SHA1, and it makes it
look like OpenSSL's providers offer a DSA-SHA1 implementation (which
they currently do not do).

Breaking this aliasing apart (i.e. aliasing DSA, DSA-old, dsaEncryption
and dsaEncryption-old separately from the names that involve SHA) appears
harmless as far as OpenSSL's test suite goes.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24828)
 2024-07-12 11:20:23 +02:00
Dmitry Misharov
8b591dceef deploy docs.openssl.org on doc changes 
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24839)
 2024-07-12 10:59:15 +02:00
Neil Horman
861e1f450c ignore various files in commit checker 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24845)
 2024-07-11 23:13:47 -04:00
sashan
ad33d62396 EVP_DigestUpdate(): Check if ctx->update is set 
The issue has been discovered by libFuzzer running on provider target.
There are currently three distinct reports which are addressed by
code change here.

    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69236#c1
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69243#c1
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69261#c1

the issue has been introduced with openssl 3.0.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24753)
 2024-07-11 21:48:56 +02:00
Matt Caswell
939dd479ac Limit the number of commands that can be used in the quic-lcidm fuzzer 
The fuzzer was reporting a spurious timeout due to excessive numbers of
commands in a single file. We limit the number of commands to avoid this.

Found by OSSFuzz

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24831)
 2024-07-11 14:17:11 -04:00
Neil Horman
c86d37cec9 Modify check-format to match line length coding style 
In an effort to clarify our coding style, generally line lengths SHOULD
be no longer than 80 columns but MUST be no longer than 100 columns

Modify the check-format.pl script to account for this.

Replace the -l|--sloppy-len option (which modifies the max line length
to 84 rather than 80 cols), with -l|--strict-len which reduces allowed
line length to 80 cols from the new default 100 cols).

Also fix up a typo in the docs indicating --sloppy-bodylen has a short
-l option (its actually -b)

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/24841)
 2024-07-11 12:28:25 -04:00
dependabot[bot]
00163371fa Dependabot update 
CLA: trivial

(deps): Bump actions/setup-python

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.1.0 to 5.1.1.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5.1.0...v5.1.1)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24843)
 2024-07-11 09:53:55 +02:00
slontis
06da147373 Add FIPS indicators to evp_test 
evp_test code needed to be modified to defer setting algorithm contexts
until the run phase. The parse functions also defer setting into the context
until the run phase, which allows the context to initialize in a controlled order.
This allows params to be passed into the algorithm init function.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24623)
 2024-07-11 08:29:54 +10:00
slontis
c13ddf0a6c Change all existing FIPS configurable checks to use FIPS indicators. 
This changes the logic to always do the security checks and then decide
what to do based on if this passes or not. Failure of a check causes
either a failure OR the FIPS indicator callback to be triggered.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24623)
 2024-07-11 08:29:43 +10:00
slontis
d4848934a6 Add FIPS indicator helpers 
Each provider algorithm context can use these helpers to add indicator
support.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24623)
 2024-07-11 08:29:43 +10:00
slontis
0557d6c62b Add FIPS indicator callback. 
Add a FIPS indicator callback that can be set via
OSSL_INDICATOR_set_callback(). This callback is intended to be run
whenever a non approved algorithm check has occurred and strict checking
has been disabled.The callback may be used to
log non approved algorithms. The callback is passed a type and
description string as well as the cbarg specified in OSSL_INDICATOR_set_callback.
The return value can be either 0 or 1.
A value of 0 can be used for testing purposes to force an error to occur from the algorithm
that called the callback.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24623)
 2024-07-11 08:29:43 +10:00
Jiasheng Jiang
45cada1339 apps/rehash.c: Add the check for the EVP_MD_get_size() 
Add the check for the return value of EVP_MD_get_size() to avoid invalid negative
numbers and then explicitly cast from int to size_t.

Add the check to prevent that EVP_MD_get_size() returns a value greater
than EVP_MAX_MD_SIZE.

Signed-off-by: Jiasheng Jiang <jiashengjiangcool@outlook.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24802)
 2024-07-10 18:23:44 +02:00
Dr. David von Oheimb
eaf577c865 extend X509_REQ_add_extensions_nid() and thuis APPS/req to support augmenting/overriding existing extensions 
Fixes #11169

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24792)
 2024-07-10 16:19:26 +02:00
Dr. David von Oheimb
4925af7bb8 add X509v3_add_extensions() 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24792)
 2024-07-10 16:19:26 +02:00
Dr. David von Oheimb
94b40ec455 refactor and constify X509_REQ_get_extensions() 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24792)
 2024-07-10 16:19:26 +02:00
Dr. David von Oheimb
b0ebb87ab5 constify ossl_x509at_add1_attr() 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24792)
 2024-07-10 16:19:06 +02:00
Dr. David von Oheimb
77600210e2 X509at_add1_attr*(): extend error entry on duplicate attribute 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24792)
 2024-07-10 16:19:06 +02:00
Dr. David von Oheimb
39424d9601 apps/req: avoid needless hint on using -help on duplicate extensions added via -addext 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24792)
 2024-07-10 16:19:06 +02:00
Tomas Mraz
850bd09cf9 windows_comp.yml: Run openssl after it is built 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24820)
 2024-07-10 15:20:49 +02:00
Neil Horman
fc22d74c53 Add a style-check workflow 
Add a CI job that evaluates style issues, restricted only to lines
changed for the affected files in a given commit

Also provide a mechanism to waive those style issues.  by applying the
style:exempted label to a PR, the checks are still run (its nice to see
what they are regardless), but the test will pass CI regardless of
weather any issues are found.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24806)
 2024-07-10 07:31:14 -04:00
Neil Horman
acae12eb78 Add a check-format-commit.sh script 
Add a wrapper script to check-format.pl, which is capable of analyzing
commits rather than just a file.  for a provided commit this script:

1) runs check-format.pl on the files changed in the provided commit

2) filters the output of check-format.pl, only producing lines that
   match ranges of changed lines in those files

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24806)
 2024-07-10 07:31:14 -04:00
erbsland-dev
2a45839778 Enhance documentation for BN_mask_bits() 
Fixes #5537

Added a note that the error check for `BN_mask_bits()` depends
on the internal representation that depends on the platform's word size.
Included a reference to the `BN_num_bits()` function for precise bit checking.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24812)
 2024-07-10 11:49:00 +02:00
Stephen Farrell
21dfb97596 Extend TLSv1.3 record layer padding API calls 
Added SSL_set_block_padding_ex() and SSL_CTX_set_block_padding_ex()
to allow separate padding block size values for handshake messages
and application data messages.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24796)
 2024-07-10 11:44:39 +02:00
erbsland-dev
b544047c99 Add documentation for deprecated CMAC_CTX functions 
Fixes #5539: Create a new manual page `CMAC_CTX.pod` documenting the deprecated `CMAC_CTX` functions and add the necessary build dependencies. This page includes function descriptions, usage details, and replacement suggestions with the `EVP_MAC` interface.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24814)
 2024-07-10 09:46:24 +02:00
erbsland-dev
2c1ef172f8 Add and Update Documentation for TS_VERIFY_CTX Functions 
Mark the existing `TS_VERIFY_CTX_set_certs` function as deprecated in the
documentation.
Add missing documentation for the deprecated functions `TS_VERIFY_CTX_set_data`,
`TS_VERIFY_CTX_set_imprint`, and `TS_VERIFY_CTX_set_store`.
Write missing documentation for the following functions:
- `TS_VERIFY_CTX_new`
- `TS_VERIFY_CTX_init`
- `TS_VERIFY_CTX_free`
- `TS_VERIFY_CTX_cleanup`
- `TS_VERIFY_CTX_set_flags`
- `TS_VERIFY_CTX_add_flags`
- `TS_VERIFY_CTX_set0_data`
- `TS_VERIFY_CTX_set0_imprint`
- `TS_VERIFY_CTX_set0_store`
- `TS_VERIFY_CTX_set0_certs`

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24701)
 2024-07-10 09:40:34 +02:00
erbsland-dev
6f811d839f Replace and Deprecate TS_VERIFY_CTX Functions 
Fixes #18854

Replace and deprecate the functions `TS_VERIFY_CTX_set_data`,
`TS_VERIFY_CTX_set_store`, `TS_VERIFY_CTX_set_certs`, `TS_VERIFY_CTX_set_imprint`
with new versions: `TS_VERIFY_CTX_set0_data`,
`TS_VERIFY_CTX_set0_store`, `TS_VERIFY_CTX_set0_certs` and `TS_VERIFY_CTX_set0_imprint`.

The previous functions had poorly documented memory handling, potentially
leading to memory leaks. The new functions improve memory management and provide
clearer usage.

Also, update existing code to use the new function calls instead of the deprecated
ones.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24701)
 2024-07-10 09:39:53 +02:00
olszomal
7751887025 Clarify supported curves in the s_client/s_server documentation 
Mention that supported curves (aka groups) include named EC parameters
as well as X25519 and X448 or FFDHE groups.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24774)
 2024-07-10 09:36:03 +02:00
Tomas Mraz
7b1e008d38 os-zoo.yml: Cleanup unnecessary -Wno-switch-default 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24787)
 2024-07-10 09:34:42 +02:00
Neil Horman
d8def79838 read lock store on ossl_method_store_do_all 
Theres a data race between ossl_method_store_insert and
ossl_method_store_do_all, as the latter doesn't take the property lock
before iterating.

However, we can't lock in do_all, as the call stack in several cases
later attempts to take the write lock.

The choices to fix it are I think:
1) add an argument to indicate to ossl_method_store_do_all weather to
   take the read or write lock when doing iterations, and add an
   is_locked api to the ossl_property_[read|write] lock family so that
   subsequent callers can determine if they need to take a lock or not

2) Clone the algs sparse array in ossl_method_store_do_all and use the
   clone to iterate with no lock held, ensuring that updates to the
   parent copy of the sparse array are left untoucheTheres a data race
   between ossl_method_store_insert and ossl_method_store_do_all, as the
   latter doesn't take the property lock before iterating.

I think method (2), while being a bit more expensive, is probably the
far less invasive way to go here

Fixes #24672

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24782)
 2024-07-09 11:27:53 +02:00
Neil Horman
97bfbb98b0 Allow openssl version to function in the absence of a config file 
the openssl application attempts to load a config file on startup
always, calling x509_get_default_cert_area() to locate the file.  On
Windows builds with -DOSSL_WINCTX set, this fails if the corresponding
registry keys are unset. allow openssl to continue to function properly
for applets that don't actually require a configuration file.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
aa08335852 Fix sed/awk usage in windows ci jobs 
The addition of sed and awk, while available in the windows vm's for CI
in powershell, don't behave as I would expect (though the same commands
work with a local installation on windows using GnuWin32).  In trying to
figure out what was going on I found it was far more stable and
predictable to use the powershell -split and -replace commands instead
of sed and awk

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
a8f99f98d6 Avoid chicken and egg problem with reg setting 
Because openssl with -DOSSL_WINCTX no longer falls back to build time
defines, we have a chicken and egg problem.  CI needs to query openssl
for its version string so registry keys can be set properly, but openssl
version refuses to run because no configuration file can be found

So we work around it by, for the purposes of setting the registry keys,
we set OPENSSL_CONF to a know config file, so that openssl version runs
properly.

Once the version is extracted, we can set the registry keys, and openssl
will function properly without OPENSSL_CONF set

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
aa4fc5ea4a Adjust ci to only use major.minor when setting reg keys 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
caaea8f343 Update defaults to install keys against major.minor 
we want patch level updates to use the same keys, so only create the key
against the major.minor version

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
bf74cf35cf Fixes for defaults code 
Fix up some indenting, and ensure that the run_once routines don't get
defined if OSSL_WINCTX isn't defined to avoid compiler errors

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
290452f2bd Augment version.c to not display -w options on non-windows 
Don't need the -w option on non-windows builds

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
62dd0f1762 Update NOTES-WINDOWS.md 
The behavior of windows with registry keys is somewhat confusing, and
based on both build time defines, and reg key availablility.  Add a
table defining behavior in all cases

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
7c58769a03 Add Changes entry 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
917f37195a Allow OPENSSLDIR/ENGINESDIR/MODULESDIR to be NULL 
To prevent inadvertent use of insecure directories, we need to be able
to detect and react when our new registry keys aren't set, which implies
allowing the values for the dynamic representations of
OPENSSLDIR/ENGINESDIR/MODULESDIR to return NULL.  This in turn requires
that we detect and handle NULL string in several call sites that
previously assumed they would never be NULL.  This commit fixes those up

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
c7dae9c263 Update docs 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
4fc9e5e011 update windows_comp ci run to use new registry reads 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
901e27982c Update NOTES-WINDOWS for typos/grammar 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
4edcf0b450 Don't fall back to pre-defined constants on windows 
We don't want to allow windows systems on new installs to use
OPENSSLDIR/MODULESDIR/ENGINESDIR at all, as it makes no sense to define
paths at build time that have no meaning at install time.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
525f2bf564 Fix windows ci to use proper OSSL_WINCTX define 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
630e3a1684 Change WININSTALLCONTEXT to OSSL_WINCTX 
Make it more in line with other command line defines, and a bit shorter

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
f4540c1b14 dont fall back to build time defaults on windows 
to prevent security issues, don't fall back to build time default
locations, instead return the string "UNDEFINED"

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
c1c6756156 Correct use of workflow ENV vars on windows 
On windows ci we're using powershell operations, need to follow those
rules

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
1730918161 Add a unit test to validate the functionality of our reg key lookups 
Add a test to check to make sure our registry key lookups work.  note
this test only runs on windows (clearly), but also only if the registry
keys are set via an installer or some other manual process (to be done
in the CI workflow)

Also add workflow steps to set registry keys for testing

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
e6c77f2685 convert users of build time defaults to use new defaults api 
Now that we can query for install time registry keys on windows, convert
users of these macros to use the api instead

Add a unit test to validate the functionality of our reg key lookups

Add a test to check to make sure our registry key lookups work.  note
this test only runs on windows (clearly), but also only if the registry
keys are set via an installer or some other manual process (to be done
in the CI workflow)

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:44 -04:00
Neil Horman
dd2b22d88c Add defaults api to openssl build 
Build time defaults aren't great for windows, in which various macros
(like OPENSSLDIR) are selected at build time, but may be selected
differently at install time.  Add an internal defaults api to return the
build time constants on unix systems, but instead query registry keys
for the form:
HLKM\SOFTWARE\OpenSSL-{version}-{wininstallcontext}
Such that each built version of openssl may maintain its own set of
registry keys to identify these locations, and be set administratiely as
appropriate at install or run time

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24450)
 2024-07-09 04:01:30 -04:00
Radek Krejci
c215d75f94 Avoid NULL pointer dereference 
Function readbuffer_gets() misses some of the initial checks of its
arguments. Not checking them can lead to a later NULL pointer
dereferences.

The checks are now unified with the checks in readbuffer_read()
function.

CLA: trivial
Fixes #23915

Signed-off-by: Radek Krejci <radek.krejci@oracle.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23918)
 2024-07-08 21:55:30 +02:00
Dr. David von Oheimb
f35c089413 check_format.pl: fix detection of 'if' with single stmt in braces without 'else' 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24805)
 2024-07-08 18:45:18 +02:00
MrRurikov
35b1472f07 Add (void) cast to result of ossl_quic_rxfc_on_retire() 
Return value of function 'ossl_quic_rxfc_on_retire', called at
quic_stream_map.c:767, is not checked, but it is usually checked
for this function.

CLA: trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24794)
 2024-07-08 18:17:15 +02:00
Bernd Edlinger
82a13a1f50 Fix possible double-free in pkcs7 add_attribute function 
The problem is the ownership of the input parameter value
is transfered to the X509_ATTRIBUTE object attr, as soon
as X509_ATTRIBUTE_create succeeds, but when an error happens
after that point there is no way to get the ownership back
to the caller, which is necessary to fullfill the API contract.

Fixed that by moving the call to X509_ATTRIBUTE_create to the
end of the function, and make sure that no errors are possible
after that point.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22721)
 2024-07-08 12:25:45 +02:00
Tomas Mraz
29696af689 fuzz/decoder.c: Lower the limits on key checks 
These checks still take too long time on clusterfuzz
so they are longer than the timeout limit.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/24781)
 2024-07-05 07:45:53 -04:00
Daniel Gustafsson
59c415a45f Fix incorrect sentence 
Remove superfluous "the" from sentence.

CLA: trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24790)
 2024-07-04 19:17:02 +02:00
Jonathan M. Wilbur
708b8559f1 test: userNotice X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24761)
 2024-07-04 09:36:11 +02:00
Jonathan M. Wilbur
2ef6fa1cdd feat: support userNotice X.509v3 extension 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24761)
 2024-07-04 09:36:11 +02:00
Frederik Wedel-Heinen
070b6a9654 Allow shared iOS builds 
Fixes #24545

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24649)
 2024-07-04 09:29:12 +02:00
cchinchole
3f4da93678 Unlock only when lock was successful 
Addressing issue (#24517):
Updated the example in CRYPTO_THREAD_run_once.pod to reflect that an unlock call should not be made if a write_lock failed.
Updated BIO_lookup_ex in bio_addr.c and ossl_engine_table_select in eng_table.c to not call unlock if the lock failed.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24779)
 2024-07-03 15:03:00 -04:00
cchinchole
e6174ca4d4 Fixes for potential deadlock 
Fixes (#24517):
(3/3) Addresses the potential deadlock if an error occurs from up_ref
in functions ENGINE_get_first, ENGINE_get_last, ENGINE_get_next, and
ENGINE_get_prev in file crypto/engine/eng_list.c

CLA: trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24780)
 2024-07-03 16:04:53 +02:00
Tomas Mraz
b5863e9259 Configure: Remove -Wswitch-default from strict warnings 
Also move -Wno-tautological-constant-out-of-range-compare to
clang-specific options as it is not supported by gcc.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24758)

(cherry picked from commit 3d9c6b16d8)
 2024-07-03 11:26:26 +02:00
Richard Levitte
cfe0bbdeca fix: remove some odd empty lines 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24776)
 2024-07-03 11:24:07 +02:00
Richard Levitte
bb90a7861c fix: openssl speed: RSA encryption is on the pubkey, not the privkey 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24776)
 2024-07-03 11:24:07 +02:00
Neil Horman
2c7cae53bc Convert hashtable to using ossl_rcu_deref on lookup 
The new hashtable has an issue on non-64 bit builds.  We use
CRYPTO_atomic_load to load a pointer value when doing lookups, but that
API relies on the expectation that pointers are 64 bits wide.  On 32 bit
systems, we try to load 64 bits using CRYPTO_atomic_load into a 32 bit
pointer, which overruns our stack

Fix this by no longer using CRYPTO_atomic_load for value fetches from
the hashtable.  Instead use ossl_rcu_deref, whcih operates on void
pointers and is safe on all arches

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24682)
 2024-07-03 09:07:21 +02:00
Dr. David von Oheimb
b1e7bc5bdf BIO_f_base64.pod and openssl-enc.pod.in: improve description on newline handling 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18783)
 2024-07-02 20:24:58 +02:00
Tomas Mraz
3f7b355733 OPENSSL_hexstr2buf_ex(): Handle zero-length input correctly 
In case of zero-length input the code wrote one byte
before the start of the output buffer. The length
of the output was also reported incorrectly in this case.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24770)
 2024-07-02 20:13:56 +02:00
JohnnySavages
16311dbf53 Check EC_GROUP_get0_order result before dereference 
CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24755)
 2024-07-01 10:03:38 +02:00
Georgi Valkov
16beec98d2 threads_win: fix build error with VS2010 x86 
InterlockedAnd64 and InterlockedAdd64 are not available on VS2010 x86.
We already have implemented replacements for other functions, such as
InterlockedOr64. Apply the same approach to fix the errors.
A CRYPTO_RWLOCK rw_lock is added to rcu_lock_st.

Replace InterlockedOr64 and InterlockedOr with CRYPTO_atomic_load and
CRYPTO_atomic_load_int, using the existing design pattern.

Add documentation and tests for the new atomic functions
CRYPTO_atomic_add64, CRYPTO_atomic_and

Fixes:
libcrypto.lib(libcrypto-lib-threads_win.obj) : error LNK2019: unresolved external symbol _InterlockedAdd64 referenced in function _get_hold_current_qp
libcrypto.lib(libcrypto-lib-threads_win.obj) : error LNK2019: unresolved external symbol _InterlockedOr referenced in function _get_hold_current_qp
libcrypto.lib(libcrypto-lib-threads_win.obj) : error LNK2019: unresolved external symbol _InterlockedAnd64 referenced in function _update_qp
libcrypto.lib(libcrypto-lib-threads_win.obj) : error LNK2019: unresolved external symbol _InterlockedOr64 referenced in function _ossl_synchronize_rcu

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24405)
 2024-07-01 10:02:02 +02:00
Neil Horman
f96563297e Add badges for daily checks and provider compat 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24762)
 2024-06-30 08:18:03 -04:00
Neil Horman
fccefa7016 Remove appveyor badge and replace it with os zoo badge 
We don't use appveyor anymore. Replace it with the os zoo badge, so we
can more persistently see when its breaking

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24762)
 2024-06-30 08:18:03 -04:00
Richard Levitte
5a9c90b1e5 OpenSSL::Test: Avoid running IPv6 related tests if IPv6 was explicitly disabled 
It's possible to disable IPv6  explicitly when configuring OpenSSL.  In that
case, IPv6 related tests should be skipped.

This is solved by having OpenSSL::Test::Utils::have_IPv6() check configuration
first, before trying to determine if the machine supports IPv6.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24748)
 2024-06-29 08:36:00 +02:00
Pauli
1eb122aa0c Clarify DRBG seeding. 
There is a legacy code path that OpenSSL won't use anymore but applications
could.  Add a comment indicating this to avoid confusion for people not
intimately conversant with the nuances in the RNG code.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24745)
 2024-06-29 14:11:28 +10:00
sanumesh
7afa7731e9 Add aix-clang and aix64-clang configuration 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24609)
 2024-06-28 15:18:59 +02:00
Neil Horman
93a644d14a Remove macos-11 from CI 
Recent build failure on os-zoo reports:
A brownout will take place on June, 8:00 AM – 2:00 PM EST to raise awareness of the upcoming macOS-11 environment removal.

It appears that github is retiring macos-11, so we may as well remove it
to prepare

Fixes #24739

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24744)
 2024-06-28 11:17:59 +02:00
Neil Horman
15974897b7 Disable default case checks on clang 18 
Recent updates in CI have upgraded clang to clang-18, which gripes when
it finds a switch statement without a default case.  We should add those
cases in, but since we have a lot of those, and CI is currently failing,
disable the check until we get them fixed up

Fixes #24739

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24744)
 2024-06-28 11:17:59 +02:00
Neil Horman
68c7575afc Enable ipv6 use if available 
Recently, it appears alpine containers added ipv6, which breaks our ipv6
ssl old tests because the perl test recipie runs the ipv6 test based on
runtime availability, even if the build time selection is to disable
ipv6.

Fix it by modifying the os zoo ci run to enable ipv6 in the build if its
available on the container

Fixes #24739

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24744)
 2024-06-28 11:17:59 +02:00
Drokov Pavel
940059d545 p12_npas.c: Remove call with unused return value 
CLA: trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23275)
 2024-06-28 09:12:03 +02:00
Jonathan M. Wilbur
41c1b6f0a5 ossl_print_attribute_value(): Multiple minor fixes for style and other errors 
- use correct return values
- do not modify pointer in the atrtribute after decoding with d2i_X509_NAME()
- make oid parameter const in print_oid
- use OPENSSL_buf2hexstr_ex
- simplify return code translation from BIO_printf()

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24725)
 2024-06-28 09:01:48 +02:00
sgzmd
fbd6609bb2 Free appname if it was set after initializing crypto. 
Fixes #24729

CLA: trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24730)
 2024-06-27 19:49:52 +02:00
Vita Batrla
981d129a56 docs: document that *_free(NULL) does nothing 
Explicitly documents that *_free(NULL) does nothing.
Fixes two cases where that wasn't true.
Fixes #24675.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24735)
 2024-06-27 18:26:26 +02:00
Matt Caswell
214c724e00 Add a test for an empty NextProto message 
It is valid according to the spec for a NextProto message to have no
protocols listed in it. The OpenSSL implementation however does not allow
us to create such a message. In order to check that we work as expected
when communicating with a client that does generate such messages we have
to use a TLSProxy test.

Follow on from CVE-2024-5535

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24716)
 2024-06-27 10:30:52 +01:00
Matt Caswell
de71058567 Add explicit testing of ALN and NPN in sslapitest 
We already had some tests elsewhere - but this extends that testing with
additional tests.

Follow on from CVE-2024-5535

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24716)
 2024-06-27 10:30:51 +01:00
Matt Caswell
238fa464d6 Add ALPN validation in the client 
The ALPN protocol selected by the server must be one that we originally
advertised. We should verify that it is.

Follow on from CVE-2024-5535

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24716)
 2024-06-27 10:30:51 +01:00
Matt Caswell
e10a3a84bf Correct return values for tls_construct_stoc_next_proto_neg 
Return EXT_RETURN_NOT_SENT in the event that we don't send the extension,
rather than EXT_RETURN_SENT. This actually makes no difference at all to
the current control flow since this return value is ignored in this case
anyway. But lets make it correct anyway.

Follow on from CVE-2024-5535

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24716)
 2024-06-27 10:30:51 +01:00
Matt Caswell
9925c97a8e Allow an empty NPN/ALPN protocol list in the tests 
Allow ourselves to configure an empty NPN/ALPN protocol list and test what
happens if we do.

Follow on from CVE-2024-5535

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24716)
 2024-06-27 10:30:51 +01:00
Matt Caswell
0d883f6309 Add a test for SSL_select_next_proto 
Follow on from CVE-2024-5535

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24716)
 2024-06-27 10:30:51 +01:00
Matt Caswell
a210f580f4 Clarify the SSL_select_next_proto() documentation 
We clarify the input preconditions and the expected behaviour in the event
of no overlap.

Follow on from CVE-2024-5535

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24716)
 2024-06-27 10:30:51 +01:00
Matt Caswell
fc8ff75814 Use correctly formatted ALPN data in tserver 
The QUIC test server was using incorrectly formatted ALPN data. With the
previous implementation of SSL_select_next_proto this went unnoticed. With
the new stricter implemenation it was failing.

Follow on from CVE-2024-5535

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24716)
 2024-06-27 10:30:51 +01:00
Matt Caswell
c6e1ea2235 More correctly handle a selected_len of 0 when processing NPN 
In the case where the NPN callback returns with SSL_TLEXT_ERR_OK, but
the selected_len is 0 we should fail. Previously this would fail with an
internal_error alert because calling OPENSSL_malloc(selected_len) will
return NULL when selected_len is 0. We make this error detection more
explicit and return a handshake failure alert.

Follow on from CVE-2024-5535

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24716)
 2024-06-27 10:30:51 +01:00
Matt Caswell
2ebbe2d7ca Fix SSL_select_next_proto 
Ensure that the provided client list is non-NULL and starts with a valid
entry. When called from the ALPN callback the client list should already
have been validated by OpenSSL so this should not cause a problem. When
called from the NPN callback the client list is locally configured and
will not have already been validated. Therefore SSL_select_next_proto
should not assume that it is correctly formatted.

We implement stricter checking of the client protocol list. We also do the
same for the server list while we are about it.

CVE-2024-5535

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24716)
 2024-06-27 10:30:51 +01:00
Jonathan M. Wilbur
b76a6c26a2 test: add tests for acceptable policies exts 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24663)
 2024-06-26 15:00:27 +02:00
Jonathan M. Wilbur
2b735fe219 feat: add acceptablePrivilegePolicies and acceptableCertPolicies exts 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24663)
 2024-06-26 15:00:13 +02:00
Kelvin Lee
0169bbbd1c MASM: Need to strip arguments after .pdata or .xdata 
For MASM,

.section .pdata,"r"

got translated to:

.pdata,"r"    SEGMENT READONLY ALIGN(4)

that breaks ml64.
Previous version of x86_64-xlate.pl did strip that ',"r"'.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Sasa Nedvedicky <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24714)
 2024-06-26 12:03:45 +02:00
Tomas Mraz
55c1458303 evp_pkey_ctx_setget_params_to_ctrl(): Always properly set ctx.action_type 
Fixes #24698

Some applicable translations are bidirectional so they have
NONE action_type. However we need to set the real action_type
in the ctx.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24709)
 2024-06-26 11:52:02 +02:00
Richard Levitte
30dc37d798 Adapt all the exporter files to the new vars from util/mkinstallvars.pl 
With this, the pkg-config files take better advantage of relative directory
values.

Fixes #24298

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24687)
 2024-06-25 21:32:43 +02:00
Richard Levitte
6e0fd246e7 Give util/mkinstallvars.pl more fine grained control over var dependencies 
Essentially, we try to do what GNU does.  'prefix' is used to define the
defaults for 'exec_prefix' and 'libdir', and these are then used to define
further directory values.  util/mkinstallvars.pl is changed to reflect that
to the best of our ability.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24687)
 2024-06-25 21:32:34 +02:00
Ingo Franzki
a9064366e8 Fix memory leak in x509_req_test 
Running the x509_req_test with address sanitizer shows a memory leak:

==186455==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 53 byte(s) in 1 object(s) allocated from:
    #0 0x3ffad5f47af in malloc (/lib64/libasan.so.8+0xf47af) (BuildId: 93b3d2536d76f772a95880d76c746c150daabbee)
    #1 0x3ffac4214fb in CRYPTO_malloc crypto/mem.c:202
    #2 0x3ffac421759 in CRYPTO_zalloc crypto/mem.c:222
    #3 0x100e58f in test_mk_file_path test/testutil/driver.c:450
    #4 0x1004671 in test_x509_req_detect_invalid_version test/x509_req_test.c:32
    #5 0x100d247 in run_tests test/testutil/driver.c:342
    #6 0x10042e3 in main test/testutil/main.c:31
    #7 0x3ffaad34a5b in __libc_start_call_main (/lib64/libc.so.6+0x34a5b) (BuildId: 461b58df774538594b6173825bed67a9247a014d)
    #8 0x3ffaad34b5d in __libc_start_main@GLIBC_2.2 (/lib64/libc.so.6+0x34b5d) (BuildId: 461b58df774538594b6173825bed67a9247a014d)
    #9 0x1004569  (/root/openssl/test/x509_req_test+0x1004569) (BuildId: ab6bce0e531df1e3626a8f506d07f6ad7c7c6d57)
SUMMARY: AddressSanitizer: 53 byte(s) leaked in 1 allocation(s).

The certFilePath that is obtained via test_mk_file_path() must be freed when
no longer used.

While at it, make the certFilePath variable a local variable, there is no need
to have this a global static variable.

Fixes: 7d2c0a4b1f

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24715)
 2024-06-25 16:09:22 +02:00
erbsland-dev
57b83edc46 bio_ssl.c: Do not call SSL_shutdown if not inited 
Fixes #4545

If free is called for an SSL BIO that is in initialization phase,
the `SSL_shutdown` call is omitted.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24705)
 2024-06-25 16:06:17 +02:00
Karol Brzuskiewicz
42a8ef844e Fix usage of deallocated EVP_RAND_CTX after execution of FIPS on-demand self tests 
Once RNG is used, triggering FIPS on-demand self tests (via
OSSL_PROVIDER_self_test() API) crashes the application. This happens because the
RNG context is stored before self tests, and restored after their execution.
In the meantime - before context restoration - RAND_set0_private() function is
called, which decrements the stored RNG context reference counter and frees it.
To resolve the issue, the stored RNG context refcount has been incremented via
the EVP_RAND_CTX_up_ref() API to avoid its deallocation during the RNG context
switch performed by the self test function.
The provider_status_test test has been updated to reproduce the issue as
a regression test.

Signed-off-by: Karol Brzuskiewicz <kabr@arista.com>

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24599)
 2024-06-24 19:02:43 +02:00
Tomas Mraz
d38f62ea11 Allow calling OPENSSL_INIT_free() with NULL argument 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24681)
 2024-06-24 15:49:35 +02:00
David Benjamin
3fc784835c stricter parser for ipv4_from_asc 
reject invalid IPv4 addresses in ipv4_from_asc

The old scanf-based parser accepted all kinds of invalid inputs like:
"1.2.3.4.5"
"1.2.3.4 "
"1.2.3. 4"
" 1.2.3.4"
"1.2.3.4."
"1.2.3.+4"
"1.2.3.4.example.test"
"1.2.3.01"
"1.2.3.0x1"
Thanks to Amir Mohamadi for pointing this out.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24438)
 2024-06-24 15:43:12 +02:00
Tomas Mraz
94567d6889 Add Provider compatibility on PR CI job 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24537)
 2024-06-24 15:40:09 +02:00
Jonathan M. Wilbur
be5adfd6e3 Support subjectDirectoryAttributes and associatedInformation exts 
Added tests for SDA and AI extensions.
Added internal function ossl_print_attribute_value() with documentation.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24669)
 2024-06-24 15:33:21 +02:00
Dimitri Papadopoulos
8f250985ad Fix typos found by codespell 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/24691)
 2024-06-24 15:09:11 +02:00
erbsland-dev
89c9c3b857 Extend mask of ssl_method_st to 64-bit 
Fixes #23260: The bit count for `SSL_OP_*` flags has exceeded 32 bits, making it impossible to handle newer flags and protocol extensions with the existing 32-bit variables. This commit extends the `mask` field in the `ssl_method_st` structure to 64-bit, aligning them with the previously extended 64-bit `options` field.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24692)
 2024-06-23 10:09:07 -04:00
Richard Levitte
b23cd39f0a [DOCS] Correct history in doc/man3/OSSL_STORE_LOADER.pod 
Bulk editing had history wrongly specify current functions as deprecated,
among other small errors.

Fixes #24678

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24680)
 2024-06-22 06:28:26 +02:00
erbsland-dev
7d2c0a4b1f Make x509_req_test ANSI Compatible 
Update the `x509_req_test` to ensure ANSI compatibility. The integrated certificate string was too long, so the PEM certificate has been moved to `certs/x509-req-detect-invalid-version.pem`. The test have been updated to load this certificate from the file on disk.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24677)
 2024-06-21 15:40:45 -04:00
erbsland-dev
895ecd0ce8 Add Test for Verification Failure on Incorrect X509 Version 
Tests #5738: Introduce a new test to verify that a malformed X509 request with the version field set to version 6 fails either early when reading from data or later when `X509_REQ_verify` is called.
Adding a new test recipe `60-test_x509_req.t`

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24677)
 2024-06-21 15:40:45 -04:00
erbsland-dev
7fab3c7d61 Add Version Check for CSR Verification 
Fixes #5738: This change introduces a check for the version number of a CSR document before its signature is verified. If the version number is not 1 (encoded as zero), the verification function fails with an `X509_R_UNSUPPORTED_VERSION` error.

To minimize impact, this check is only applied when verifying a certificate signing request using the `-verify` argument, resulting in a `X509_REQ_verify` call. This ensures that malformed certificate requests are rejected by a certification authority, enhancing security and preventing potential issues.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24677)
 2024-06-21 15:40:45 -04:00
Hubert Kario
03448ba21b s_client: use the full buffer for reads 
Use full allocated buffer for reads to not call into switch() over and
over; also increase the size of the buffer to 16 kiB (max for TLS
records). The server side already is using 16 kiB buffers.

Signed-off-by: Hubert Kario <hkario@redhat.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24688)
 2024-06-21 13:09:17 -04:00
Tomas Mraz
663dbc9c9c Fix regression of EVP_PKEY_CTX_add1_hkdf_info() with older providers 
If there is no get_ctx_params() implemented in the key exchange
provider implementation the fallback will not work. Instead
check the gettable_ctx_params() to see if the fallback should be
performed.

Fixes #24611

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24661)
 2024-06-21 16:41:33 +02:00
Robert Schulze
af82623d32 Incorporate more review feedback 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24673)
 2024-06-21 07:57:56 -04:00
Robert Schulze
8d934a7592 Incorporate review feedback 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24673)
 2024-06-21 07:57:56 -04:00
Robert Schulze
79886c85b3 Fix data race between SSL_SESSION_list_add and ssl_session_dup 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24673)
 2024-06-21 07:57:56 -04:00
Tomas Mraz
2f0b4974df Add test for ASN1_item_verify() 
This is a test for https://github.com/openssl/openssl/issues/24575
Original idea by Theo Buehler.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24576)
 2024-06-21 10:03:42 +02:00
Tomas Mraz
8d380f85da ASN1_item_verify_ctx(): Return -1 on fatal errors 
Fixes #24575

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24576)
 2024-06-21 10:03:42 +02:00
Jonathan M. Wilbur
a7ed61ce8b feat: add delegatedNameConstraints and holderNameConstraints exts 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24664)
 2024-06-20 19:59:22 +02:00
Todd Short
2e9cd409c0 Add comp.h to gitignore 
Signed-off-by: Todd Short <todd.short@me.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24676)
 2024-06-20 17:02:20 +02:00
Tomas Mraz
c0088b9937 Add CHANGES.md entry for the EC/DSA nonce generation fixes 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24660)

(cherry picked from commit 72bff68f6a)
 2024-06-20 16:58:28 +02:00
Neil Horman
f7252d736d Some minor nit corrections in the thread code for rcu 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24630)

(cherry picked from commit d38d264228)
 2024-06-20 16:56:39 +02:00
Frederik Wedel-Heinen
fa49560451 Fix handling of max_fragment_length extension for PSK 
A psk session was assumed to be a resumption which failed a check
when parsing the max_fragment_length extension hello from the client.

Relevant code from PR#18130 which was a suggested fix to the issue
was cherry-picked.

Fixes #18121

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24513)
 2024-06-20 16:49:51 +02:00
Rajeev Ranjan
6a3579e190 CMP: add support for requesting cert template using genm/genp 
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24409)
 2024-06-20 13:38:13 +02:00
Daniel McCarney
e2a4d68a03 docs: fix SSL_CTX_set_tlsext_ticket_key_cb typos 
* "shortcuts the TLS" -> "shortcuts the TLS handshake"
* "don't occur" -> "doesn't occur"
* "storing client certificate" -> "storing the client certificate"
* "an all other" -> "and all other"

CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24674)
 2024-06-20 10:13:44 +02:00
Et7f3
d5412c94a3 ossl_store.pod: Correct the example of OSSL_STORE API usage 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24056)
 2024-06-19 18:56:11 +02:00
Jaime Hablutzel
f159d861e2 Fix typo in openssl-verification-options documentation. 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24662)
 2024-06-19 12:57:32 +02:00
Dr. David von Oheimb
5aec3f4a72 CMP app: fix combination of -certout and -chainout with equal filename argument 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24267)
 2024-06-18 13:52:57 -04:00
Viktor Dukhovni
f4b4a185b5 MVP demo TLS server 
- No concurrency, one client-at-a-time
- Blocking
- No client certs
- Fixed chain and key file names
- Minimal support for session resumption

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24505)
 2024-06-18 13:49:11 -04:00
sashan
7301759afe fix potential memory leak in PKCS12_add_key_ex() 
function must make sure memorry allocated for `p8`
gets freed in error path. Issue reported by LuMingYinDetect

Fixes #24453

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24456)
 2024-06-18 13:36:56 -04:00
Randall S. Becker
929fcc5712 Remove configuration targets and related documentation for Guardian builds. 
The intermediate configuration items to support Guardian builds are left
in place as a convenience for users who want to set up configurations
for Guardian on their own.

Fixes: #22175

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24579)
 2024-06-18 13:32:13 -04:00
Jonathan M. Wilbur
58301e24f6 Add support for targetingInformation X.509v3 extension 
Support for the targetingInformation X.509v3 extension defined in ITU-T
Recommendation X.509 (2019), Section 17.1.2.2. This extension is used
in attribute certificates.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22206)
 2024-06-17 14:03:25 +02:00
Dr. David von Oheimb
40948c4c74 OSSL_CMP_{validate_msg,CTX_new}.pod: add warning notes on OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23814)
 2024-06-17 10:54:03 +02:00
Dr. David von Oheimb
b893ceef2f OSSL_CMP_validate_msg(): fix check such that OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR becomes usable again 
Fixes #23706

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23814)
 2024-06-17 10:54:03 +02:00
Dr. David von Oheimb
f8acb534e4 80-test_cmp_http_data/test_connection.csv: disable localhost test as not supported on some hosts 
Fixes #22870

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23756)
 2024-06-17 08:59:33 +02:00
Richard Levitte
6e01d3114b Configure: make absolutedir() use rel2abs() on Windows too 
perl's realpath() seems to be buggy on Windows, so we turn to rel2abs()
there as well.

Fixes #23593

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24569)
 2024-06-15 08:02:18 -04:00
Amir Mohammadi
1977c00f00 Fix memory leak in quic_trace.c 
Fixes #24340

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24568)
 2024-06-10 10:45:54 +02:00
Ruslan Baratov
d4700c0b23 [Docs] Notes about freeing objects 
- Free objects returned from PEM read
- Free objects returned from d2i_*

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24478)
 2024-06-07 08:44:18 +02:00
Tomas Mraz
140540189c test/prov_config_test.c: Cleanup and fix potential leaks 
Fixes #24106

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24107)
 2024-06-07 08:42:46 +02:00
Dmitry Misharov
417dad1e37 add static analysis workflow for on-premise Coverity Connect 
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24534)
 2024-06-06 16:08:39 +02:00
Richard Levitte
a9fa07f47c Drop the old PGP key fingerprint 
All public releases have the information of the new PGP key in
doc/fingerprints.txt, so it is finally time to drop the old.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24563)
 2024-06-06 16:03:38 +02:00
shridhar kalavagunta
5bbdbce856 Fix memory leak on error in crypto/conf/conf_mod.c 
Fixes #24111

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24119)
 2024-06-05 13:15:29 +02:00
Watson Ladd
23b6ef4894 Allow group methods to customize initialization for speed 
This commit also adds an implementation for P256 that avoids some
expensive initialization of Montgomery arithmetic structures in favor
of precomputation. Since ECC groups are not always cached by higher
layers this brings significant savings to TLS handshakes.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22746)
 2024-06-05 11:11:52 +02:00
Randall S. Becker
0e2567d729 Disable 70-test_quic_multistream.t when building with PUT threads. 
The test recipe includes a TEST_skip when OpenSSL is built with _PUT_MODEL_
based on design assumptions for QUIC and incompatibility with PUT wrapper
methods.

Fixes: #24442
Fixes: #24431

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24468)
 2024-06-04 14:43:45 +02:00
Tomas Mraz
ae20c423f9 Update CHANGES.md and NEWS.md for the upcoming release 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24549)

(cherry picked from commit 6152b08631)
 2024-06-04 14:36:37 +02:00
Tomas Mraz
0285160ffa Skip newly added blocked OAEP SHAKE testcases with old fips providers 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24529)
 2024-05-31 14:36:22 +02:00
CoolThi
9fcf57b459 Remove the dead store in EVP_DecryptFinal_ex 
CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24526)
 2024-05-30 19:04:05 +02:00
Ruslan Baratov
0c73d65eea [Docs] SSL_*_use will increment reference counter 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24520)
 2024-05-30 18:47:55 +02:00
sanumesh
dda1635cbf enable AES-XTS optimization for AIX 
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24518)
 2024-05-30 18:46:43 +02:00
shridhar kalavagunta
0986e128ff cmp_hdr_test.c: Fix leaks in error cases 
Fixes #24475

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24511)
 2024-05-30 18:43:12 +02:00
Gerd Hoffmann
7bc10f6ce2 uefi: move variables 
Fixes "unused variable" warnings with OPENSSL_SYS_UEFI.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24459)
 2024-05-30 18:38:12 +02:00
Gerd Hoffmann
7b33501a74 uefi: add typedef for uintptr_t 
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24459)
 2024-05-30 18:38:12 +02:00
sashan
cfaa79f837 Fix potential memory leak in OSSL_IETF_ATTR_SYNTAX_add1_value() 
The function may leak memory if it deals with an unknown type.
Issue reported by LuMingYinDetect.

Fixes #24452

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24454)
 2024-05-30 18:34:22 +02:00
Alexander Kanavin
f7ded920f3 CHANGES.md: add an entry about newly deprecated time-related functions 
Signed-off-by: Alexander Kanavin <alex@linutronix.de>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24307)
 2024-05-30 18:31:22 +02:00
Alexander Kanavin
00a6d0743a ssl_sess.c: deprecate SSL_SESSION_get_time/SSL_SESSION_set_time 
Adjust the manpages at the same time so that only the new
functions are being presented.

Fixes: #23648

Signed-off-by: Alexander Kanavin <alex@linutronix.de>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24307)
 2024-05-30 18:31:22 +02:00
Alexander Kanavin
86c9bb1378 ssl_sess.c: deprecate SSL_CTX_flush_sessions in favour of _ex() replacement 
The original function is using long for time and is therefore
not Y2038-safe.

Signed-off-by: Alexander Kanavin <alex@linutronix.de>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24307)
 2024-05-30 18:31:22 +02:00
Alexander Kanavin
0ce2a09ae6 include/openssl/macros.h: define deprecation macros for 3.4 
Signed-off-by: Alexander Kanavin <alex@linutronix.de>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24307)
 2024-05-30 18:31:21 +02:00
Alexander Kanavin
1fb51deda4 util/perl/OpenSSL/ParseC.pm: correctly parse OSSL_DEPRECATEDIN_..._FOR 
Suggested by Matt Caswell.

Signed-off-by: Alexander Kanavin <alex@linutronix.de>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24307)
 2024-05-30 18:31:21 +02:00
Gopal Sharma
a5e93f1c5b Removed hard coded value for cap in function ossl_rsa_multip_cap 
As suggested at https://github.com/openssl/openssl/pull/23280#discussion_r1452113014, removing hard coded value for cap.

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/23311)
 2024-05-30 14:46:06 +02:00
Richard Levitte
f6b307d860 VMS: Redefine _XOPEN_SOURCE_EXTENDED with the value 1 
Some versions if the VMS C system header files seem to require this.

Fixes #24466

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24470)
 2024-05-29 16:06:40 +02:00
Amir Mohammadi
abe05fda8b Fix potential memory leak in test_bad_dtls 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24464)
 2024-05-29 13:26:05 +01:00
Michael Baentsch
90e7c12f1b Update configurable sigalgs documentation for providers 
also adding to SignatureAlgorithms section

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24499)
 2024-05-29 09:38:48 +02:00
sanumesh
36ba419286 threads_pthread.c: change inline to ossl_inline 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24502)
 2024-05-28 17:19:18 +02:00
Nek Saikou
434e7f7cb4 ecstresstest.c: Fix memory leak on error 
Fixes #24476
CLA: trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24488)
 2024-05-28 15:54:40 +02:00
Matt Caswell
c1bd38a003 Further extend the SSL_free_buffers testing 
We extend the testing to test what happens when pipelining is in use.

Follow on from CVE-2024-4741

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24395)
 2024-05-28 13:28:27 +01:00
Matt Caswell
05752478df Move the ability to load the dasync engine into ssltestlib.c 
The sslapitest has a helper function to load the dasync engine which is
useful for testing pipelining. We would like to have the same facility
from sslbuffertest, so we move the function to the common location
ssltestlib.c

Follow on from CVE-2024-4741

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24395)
 2024-05-28 13:28:13 +01:00
Matt Caswell
566f306916 Extend the SSL_free_buffers testing 
Test that attempting to free the buffers at points where they should not
be freed works as expected.

Follow on from CVE-2024-4741

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24395)
 2024-05-28 13:28:13 +01:00
Matt Caswell
bfb8128190 Set rl->packet to NULL after we've finished using it 
In order to ensure we do not have a UAF we reset the rl->packet pointer
to NULL after we free it.

Follow on from CVE-2024-4741

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24395)
 2024-05-28 13:28:13 +01:00
Matt Caswell
38690cab18 Only free the read buffers if we're not using them 
If we're part way through processing a record, or the application has
not released all the records then we should not free our buffer because
they are still needed.

CVE-2024-4741

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24395)
 2024-05-28 13:28:13 +01:00
sashan
da9342ed5e Move stack of compression methods from libssl to OSSL_LIB_CTX 
The compression methods are now a global variable in libssl.
This change moves it into OSSL library context.

It is necessary to eliminate atexit call from libssl.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24414)
 2024-05-28 08:56:13 +02:00
Ingo Franzki
184d29dbab speed: Fix regression of measuring shake with -evp 
After commit b911fef216 speed with shake128 or
shake256 does not run anymore:

  # openssl speed -seconds 1 -evp shake128 -bytes 256
  Doing shake128 ops for 1s on 256 size blocks: shake128 error!
  000003FF9B7F2080:error:1C8000A6:Provider routines:keccak_final:invalid digest
                     length:providers/implementations/digests/sha3_prov.c:117:
  version: 3.4.0-dev
  ...
  type            256 bytes
  shake128             0.00

Function EVP_Digest_loop() must use EVP_DigestInit_ex2(), EVP_DigestUpdate(),
and EVP_DigestFinalXOF() in case of shake instead of just EVP_Digest() to get
around this.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24462)
 2024-05-28 08:48:36 +02:00
Dimitri John Ledkov
05faa4ffee rand: remove unimplemented librandom stub code 
Clean up of unsuable / no-op code.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24465)
 2024-05-24 12:03:21 +02:00
Max Ammann
46f55238d2 EVP_CIPHER_CTX_get_key_length(): Add null check of ctx->cipher 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22964)
 2024-05-24 11:57:10 +02:00
Max Ammann
f3b988dc29 Add provider fuzzer 
Test recipe 99-test_fuzz_provider.t added.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22964)
 2024-05-24 11:56:41 +02:00
Randall S. Becker
b9e084f139 Added an explicit yield (OP_SLEEP) to QUIC testing for cooperative threading. 
Fixes: #24442

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24443)
 2024-05-22 17:29:03 +02:00
Dimitri John Ledkov
a0da3cb468 test: remove the just added, but now unrealistic, shake128 OAEP tests 
These were added as a POC in #24387. However, such combinations are no
longer unusable since #24105 got merged.

This should unbreak all build failures on mainline.

Partially reverts: 1bfc8d17f3 (rsa-oaep: block SHAKE usage in FIPS
mode, 2024-05-13)

Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24463)
 2024-05-22 17:02:00 +02:00
PiotrBzdrega
3472732cd2 signal.h included two times 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24445)
 2024-05-22 15:33:12 +02:00
Dimitri John Ledkov
1bfc8d17f3 rsa-oaep: block SHAKE usage in FIPS mode 
NIST SP 800-56 rev2 only allows using approved hash algorithms in
OAEP. Unlike FIPS 186-5 it doesn't have text allowing to use XOF SHAKE
functions. Maybe future revisions of SP 800-56 will adopt similar text
to FIPS 186-5 and allow XOF as MD and MGF (not MGF1).

RFC documents do not specify if SHAKE is allowed or blocked for usage
(i.e. there is no equivalent of RFC 8692 or RFC 8702 for OAEP). Status
quo allows their usage.

Add test cases for SHAKE in RSA-OAEP as allowed in default provider,
and blocked in fips.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24387)
 2024-05-22 15:31:00 +02:00
Dimitri John Ledkov
973ddaa03f rsa-pss: add tests checking for SHAKE usage in RSA-PSS 
FIPS 186-5, RFC 8692, RFC 8702 all agree and specify that Shake shall
be used directly as MGF (not as a hash in MGF1). Add tests that try to
specify shake hash as MGF1 to ensure that fails.

Separately the above standards specify how to use SHAKE as a message
digest with either fixed or minimum output lengths. However, currently
shake is not part of allowed hashes.

Note that rsa_setup_md()/rsa_setup_mgf1_md() call
ossl_digest_rsa_sign_get_md_nid() ->
ossl_digest_get_approved_nid_with_sha1() ->
ossl_digest_get_approved_nid() which only contain sha1/sha2/sha3
digests without XOF.

The digest test case will need to be replace if/when shake with
minimum output lengths is added to ossl_digest_get_approved_nid().

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24387)
 2024-05-22 15:31:00 +02:00
Alexandr Nedvedicky
7884bedc04 fix crash in ecp_nistz256_point_add_affine() 
The .rodata section with precomputed constant `ecp_nistz256_precomputed` needs to be
terminated by .text, because the ecp_nistz256_precomputed' happens to be the
first section in the file. The lack of .text makes code to arrive into the same
.rodata section where ecp_nistz256_precomputed is found. The exception is raised
as soon as CPU attempts to execute the code from read only section.

Fixes #24184

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24192)
 2024-05-22 15:15:04 +02:00
Ruslan Baratov
a73e07dbb7 [Docs] Default value for verification flags is 'SSL_VERIFY_NONE' 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24435)
 2024-05-22 15:12:24 +02:00
Richard Levitte
4e8c4b77ef Add installation documentation and notes on ANSI C and POSIX 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24173)
 2024-05-22 09:59:32 +02:00
Richard Levitte
8cf9ac9c20 When defining ossl_ssize_t = ssize_t, remember to include sys/types.h 
ssize_t isn't a C language type in any C language level, but is a POSIX type
defined in <sys/types.h>, so make sure to include that before use.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24173)
 2024-05-22 09:59:32 +02:00
Richard Levitte
f352c808ed For Unix, refactor OSSL_sleep() to use nanosleep() instead of usleep() 
usleep() is obsolete since POSIX.1-2001 and removed in POSIX.1-2008,
in favor of nanosleep(), which has been present since POSIX.1-2001.

The exceptions for DJGPP and TANDEM are preserved.  Also, just in case
nanosleep() turns out to be unavailable on any Unix machinery that we
are unaware of, we allow a revert to using usleep() by defining
OPENSSL_USE_USLEEP.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24173)
 2024-05-22 09:59:32 +02:00
Richard Levitte
34f35473c0 Work on ANSI C compatibility: modifying the github workflow 
The github workflow that attempts to check that OpenSSL ANSI C compatible
defined '_DEFAULT_SOURCE', which effectively turns gcc and clang into a C99
compiler...  perhaps not with regard to pure language features, but it enables
a few too many types and functions that aren't defined in ANSI C library, or
in some cases, in any C language level library.

Instead of '_DEFAULT_SOURCE', this modification defines '_XOPEN_SOURCE=1' and
'_POSIX_SOURCE=200809L', to enable the use of 'timezone', 'ssize_t' and 'strdup()'.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24173)
 2024-05-22 09:59:31 +02:00
Hongren Zheng
a192b2439c fips provider: explicitly setup cpuid when initializing 
Fixes: #23979

Previously fips module relied on OPENSSL_cpuid_setup
being used as constructor by the linker to correctly
setup the capability vector, either via .section .init
(for x86_64) or via __attribute__((constructor)).

This would make ld.so call OPENSSL_cpuid_setup before
the init function for fips module. However, this early
constructing behavior has several disadvantages:

1. Not all platform/toolchain supports such behavior

2. Initialisation sequence is not well defined, and
some function might not be initialized when cpuid_setup
is called

3. Implicit path is hard to maintain and debug

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24419)
 2024-05-20 10:14:39 +02:00
shridhar kalavagunta
4dbd4925df Fix mem leak in threadpool_test.c 
Fixes #24104

Added a goto label for cleanup.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24412)
 2024-05-20 10:11:35 +02:00
James Muir
45f5d51b72 Fix typo in CONTRIBUTING.md 
CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24413)
 2024-05-17 09:09:59 +02:00
Tomas Mraz
85ccbab216 Check DSA parameters for excessive sizes before validating 
This avoids overly long computation of various validation
checks.

Fixes CVE-2024-4603

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24346)
 2024-05-16 15:44:40 +02:00
Tomas Mraz
e91579db09 Sync up CHANGES.md with 3.3 branch 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24346)
 2024-05-16 15:44:32 +02:00
Andrew Golovashevich
a6afe2b29a Additional testcases for bn_gcd 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24332)
 2024-05-15 13:38:24 +02:00
Andrew Golovashevich
aaa1bda718 Optimizated calculation of shared power of 2 in bn_gcd 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24332)
 2024-05-15 13:37:48 +02:00
DominikN
5a0c92cf09 Update openssl-smime.pod.in 
Remove duplicate entries for -nocerts and -noattr

CLA:trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24052)
 2024-05-15 13:28:43 +02:00
Ruslan Baratov
987baef4fa [Docs] 'SSL_CTX_set_cert_store' ownership of 'store' 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24375)
 2024-05-15 12:22:40 +02:00
Matt Caswell
50153ad2bb Suppress a spurious error from the sysdefault test 
Running the sysdefault test results in spurious error output - even
though the test has actually passed

Fixes #24383

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24384)
 2024-05-15 12:14:24 +02:00
Tomas Mraz
ad3f28c5fb Document that SHAKE-128 and SHAKE-256 have no default digest length 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24105)
 2024-05-15 12:10:32 +02:00
Tomas Mraz
b911fef216 Intentionally break EVP_DigestFinal for SHAKE128 and SHAKE256 
It will work only if OSSL_DIGEST_PARAM_XOFLEN is set.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24105)
 2024-05-15 12:10:32 +02:00
Liu-Ermeng
170620675d fix sm2 encryption implementation bug. 
According to the "GB/T 32918.4-2016"
section 6.1 encryption, step A5:
If result of the "KDF" is all zeros, we should go back to
the begin(step A1).

section 7.1 decryption, step B4:
If result of the "KDF" is all zeros, we should raise error and exit.

Signed-off-by: Liu-Ermeng <liuermeng2@huawei.com>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23210)
 2024-05-15 11:17:14 +02:00
Tomas Mraz
f6e4698085 sslapitest.c: With fips skip tests depending on X25519 and X448 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24347)
 2024-05-14 18:10:02 +02:00
Tomas Mraz
d2af5e4c94 90-test_sslapi.t: Fix execution of sslapitest with fips provider 
Default configuration of the fips provider for tests is pedantic
which means that sslapitest was not fully executed with fips provider.

The ems check must be switched off for full execution.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24347)
 2024-05-14 18:10:02 +02:00
Tomas Mraz
887572b85d Add 3.2 and 3.3 branches to Provider compat CI 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24347)
 2024-05-14 18:10:02 +02:00
irosay
3e9d933882 Release pkey_ctx on initialization failure 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24366)
 2024-05-14 17:58:34 +02:00
Jonathan M. Wilbur
50f2e2146a fix: extension critical definition to default false 
Signed-off-by: Jonathan M. Wilbur <jonathan@wilbur.space>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21230)
 2024-05-14 16:04:51 +02:00
Trust-Worthy
77a30b70eb evp_test: Added the special private key that triggers bug (CVE-2011-4354) 
The bug triggers in 32 bit linux distros running openssl 0.9.8g.

This adds a regression test case.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24235)
 2024-05-14 15:57:19 +02:00
Alexandr Nedvedicky
fb323b2775 zeroize rsa->p,rsa->q on error 
this is rquired by fipd-186-5 section A.1.6, step 7:
	Zeroize the internally generated values that are not returned

In OpenSSL code we need to zero p, q members of rsa structure. The rsa
structure is provided by ossl_rsa_fips186_4_gen_prob_primes() caller.

The remaining values (variables) mentioned by standard are zeroed
already in functions we call from ossl_rsa_fips186_4_gen_prob_primes().

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24358)
 2024-05-14 15:55:41 +02:00
Rajeev Ranjan
b6a5e80167 Add support for integrity-only cipher suites for TLS v1.3 
- add test vectors for tls1_3 integrity-only ciphers
- recmethod_local.h: add new member for MAC
- tls13_meth.c: add MAC only to tls 1.3
- tls13_enc.c: extend function to add MAC only
- ssl_local.h: add ssl_cipher_get_evp_md_mac()
- s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
- ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it
- tls13secretstest.c: add dummy test function
- Configure: add integrity-only-ciphers option
- document the new ciphers

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22903)
 2024-05-14 15:39:15 +02:00
Rajeev Ranjan
61f32392dd cipher_null.c: add NULL check 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22903)
 2024-05-14 15:38:52 +02:00
naaysayer
f5462572a1 apps/pkcs12: Not writing the private key file until the import password is verified 
Fixes #904

CLA: trivial

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23729)
 2024-05-14 15:36:33 +02:00
Frederik Wedel-Heinen
125719ba11 Remove SSL_ENC_FLAG_EXPLICIT_IV which is only set and never read. 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24036)
 2024-05-14 15:34:07 +02:00
Jacob Champion
a401aaf9ed Add reason codes with the correct offset for two alerts 
Fixes #24300. The current values of SSL_R_NO_APPLICATION_PROTOCOL and
SSL_R_PSK_IDENTITY_NOT_FOUND don't allow for a correct lookup of the
corresponding reason strings.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24351)
 2024-05-14 15:27:17 +02:00
Georgi Valkov
d8dd1dfdf5 threads_win: fix build error with VS2010 
VC 2010 or earlier compilers do not support static inline.
To work around this problem, we can use the ossl_inline macro.

Fixes:
crypto\threads_win.c(171) : error C2054: expected '(' to follow 'inline'
crypto\threads_win.c(172) : error C2085: 'get_hold_current_qp' : not in formal parameter list
crypto\threads_win.c(172) : error C2143: syntax error : missing ';' before '{'
crypto\threads_win.c(228) : warning C4013: 'get_hold_current_qp' undefined; assuming extern returning int
crypto\threads_win.c(228) : warning C4047: '=' : 'rcu_qp *' differs in levels of indirection from 'int'

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24370)
 2024-05-14 15:25:38 +02:00
Hongren Zheng
f94d773f94 crypto/riscvcap: fix function declaration for hwprobe_to_cap 
error: function declaration isn't a prototype [-Werror=strict-prototypes]

Fixes: 66ad636b9 ("riscv: use hwprobe syscall for capability detection")

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24373)
 2024-05-14 15:24:26 +02:00
Daiki Ueno
7860bca22c doc: Fix description of EVP_CIPHER_CTX_dup 
This fixes a couple of copy and paste error from EVP_MD_CTX_dup,
where: EVP_CIPHER_CTX_dup is useful to avoid multiple
EVP_CIPHER_fetch (instead of EVP_MD_fetch) and returns
EVP_CIPHER_CTX (instead of EVP_MD_CTX).

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24376)
 2024-05-14 09:28:26 +02:00
Georgi Valkov
c02f952b48 quic_multistream_test: fix undefined symbol snprintf with VS2010 
As snprintf is not available everywhere, use BIO_snprintf instead.

Fixes:
        IF EXIST test\quic_multistream_test.exe.manifest DEL /F /Q test\quic_multistream_test.exe.manifest
        "link" /nologo /debug setargv.obj /subsystem:console /opt:ref  /nologo /debug @V:\_tmp\nm4.tmp
quic_multistream_test-bin-quic_multistream_test.obj : error LNK2019: unresolved external symbol _snprintf referenced in function _helper_init
test\quic_multistream_test.exe : fatal error LNK1120: 1 unresolved externals
NMAKE : fatal error U1077: '"E:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\BIN\link.EXE"' : return code '0x460'

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24369)
 2024-05-14 09:06:49 +02:00
Dimitri John Ledkov
fa338aa7cd fips: zeroization of public security parameters (PSPs) 
ISO 19790:2012/Cor.1:2015 7.9 requires cryptographic module to provide
methods to zeroise all unproctected security sensitive parameters
(which inclues both Critical/Private **and** Public security
parameters). And those that are temprorarly stored are required to be
zeroised after they are no longer needed at security levels 2 and
higher.

Comply with the above requirements by always zeroising public security
parameters whenever they are freed.

This is currently done under the FIPS feature, however the requirement
comes from the ISO 19790:2012 which may also be needed in other
jurisdictions. If not always. Note FIPS 140-3 includes ISO 19790:2012
by reference.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24355)
 2024-05-13 11:14:11 +02:00
willmafh
fa4ee40434 Typo fixes 
and an addition of an empty line to follow the code style

CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23721)
 2024-05-13 11:10:35 +02:00
Hongren Zheng
87314d24c4 Implement riscv_vlen_asm for riscv32 
riscvcap.c: undefined reference to 'riscv_vlen_asm'

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24270)
 2024-05-10 17:02:49 +02:00
Tomas Mraz
3de3d481b2 tls_provider_init(): Rename prov_ctx to xor_prov_ctx to clarify 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24103)
 2024-05-10 13:51:55 +02:00
Tomas Mraz
2a5d733e64 tls_provider_init(): Fix leaks in error cases 
Fixes #24101

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24103)
 2024-05-10 13:51:55 +02:00
Jiasheng Jiang
4a5088259e ssl_cipher_get_overhead(): Replace size_t with int and add the checks 
Replace the type of "mac", "out", and "blk" with int to avoid implicit
conversion when it is assigned by EVP_MD_get_size(),
EVP_CIPHER_get_iv_length(), and EVP_CIPHER_get_block_size().
Moreover, add the checks to avoid integer overflow.

Fixes: 045bd04706 ("Add DTLS_get_data_mtu() function")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23935)
 2024-05-10 11:35:22 +02:00
Hongren Zheng
d318411019 Add OPENSSL_riscvcap man page 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24172)
 2024-05-09 10:50:42 +02:00
Hongren Zheng
c1bf576037 Print CPUINFO also for riscv processors 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24172)
 2024-05-09 10:50:42 +02:00
Hongren Zheng
66ad636b97 riscv: use hwprobe syscall for capability detection 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24172)
 2024-05-09 10:50:42 +02:00
dependabot[bot]
13d37d8f75 Dependabot update: Bump coverallsapp/github-action 
CLA: trivial

(deps): Bump coverallsapp/github-action

Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 2.2.3 to 2.3.0.
- [Release notes](https://github.com/coverallsapp/github-action/releases)
- [Commits](https://github.com/coverallsapp/github-action/compare/v2.2.3...v2.3.0)

---
updated-dependencies:
- dependency-name: coverallsapp/github-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24350)
 2024-05-09 09:37:47 +02:00
Tomas Mraz
fb6584987a OSSL_LIB_CTX_load_config() must not be called concurrently on same libctx 
The semantics of such concurrent call is not defined.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24275)
 2024-05-09 09:20:58 +02:00
Tomas Mraz
3e191f4879 Add tests for conf_diagnostics 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24275)
 2024-05-09 09:20:58 +02:00
Tomas Mraz
64bfdebdc0 Do not overwrite conf diagnostics in OSSL_LIB_CTX if not set in config file 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24275)
 2024-05-09 09:20:58 +02:00
Tomas Mraz
a0d37e200f Add documentation for OSSL_LIB_CTX_set/get_conf_diagnostics 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24275)
 2024-05-09 09:20:58 +02:00
Tomas Mraz
af0561d7e7 Set SSL_CONF_FLAG_SHOW_ERRORS when conf_diagnostics is enabled 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24275)
 2024-05-09 09:20:58 +02:00
Tomas Mraz
a0084946f5 Do not use bit fields for context data flag variables 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24275)
 2024-05-09 09:20:58 +02:00
Tomas Mraz
21819f78b0 Make conf_diagnostics apply also to the SSL conf errors 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24275)
 2024-05-09 09:20:25 +02:00
Yangyu Chen
f6ce48f5b8 chacha-riscv64-v-zbb.pl: better format 
This patch merged the `add` and `xor` part of chacha_sub_round, which are
same in RISC-V Vector only and Zvkb implementation. There is no change to
the generated ASM code except for the indent.

Signed-off-by: Yangyu Chen <cyy@cyyself.name>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24069)
 2024-05-08 11:10:45 +02:00
Yangyu Chen
c857205407 chacha-riscv64-v-zbb.pl: add comment about vector register allocation 
Since we can do group operations on vector registers in RISC-V, some vector
registers will be used without being explicitly referenced. Thus, comments
on vector register allocation should be added to improve the code
readability and maintainability.

Signed-off-by: Yangyu Chen <cyy@cyyself.name>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24069)
 2024-05-08 11:10:45 +02:00
Yangyu Chen
03ce37e117 riscv: Provide a vector only implementation of Chacha20 cipher 
Although we have a Zvkb version of Chacha20, the Zvkb from the RISC-V
Vector Cryptography Bit-manipulation extension was ratified in late 2023
and does not come to the RVA23 Profile. Many CPUs in 2024 currently do not
support Zvkb but may have Vector and Bit-manipulation, which are already in
the RVA22 Profile. This commit provides a vector-only implementation that
replaced the vror with vsll+vsrl+vor and can provide enough speed for
Chacha20 for new CPUs this year.

Signed-off-by: Yangyu Chen <cyy@cyyself.name>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24069)
 2024-05-08 11:10:45 +02:00
Viktor Dukhovni
7cbca5a6d6 Avoid memory leak in x509_test error path 
Fixes #23897

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23991)
 2024-05-08 10:53:54 +02:00
Tomas Mraz
deaa83af70 Fix Coverity issues 1596850, 1596851 and 1596852 
These are newly introduced memory leaks and UAF in evp_test.c

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24339)
 2024-05-08 09:13:56 +10:00
shridhar kalavagunta
57bb112c07 Move ossl_asn1_string_to_time_t() to libtestutil 
It is not used anywhere else than in tests.

Fixes #22965

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23269)
 2024-05-07 12:07:49 +02:00
Huiyue Xu
69bd5e4fff Add linux-arm64ilp32-clang target 
While clang 15 config target by '--target', not cannot support
'-mabi=ilp32', so add the linux-arm64ilp32-clang target.

Signed-off-by: Huiyue Xu <xuhuiyue@huawei.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22666)
 2024-05-07 11:48:58 +02:00
Florian Greinacher
0fff6a2cf4 Fix invalid expression syntax 
The expression had an extra '$' character which made it always evaluate to true.

See https://github.com/boostsecurityio/poutine/blob/main/docs/content/en/rules/if_always_true.md.

CLA: trivial

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24325)
 2024-05-07 09:29:51 +02:00
Craig Lorentzen
1c4f968469 Security hardening: Expose Build flags for Position Independed Execution (PIE) 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22596)
 2024-05-06 10:56:17 +02:00
Matt Caswell
97c6489b39 Fix undefined behaviour in the event of a zero length session id 
Don't attempt to memcpy a NULL pointer if the length is 0.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24309)
 2024-05-06 10:44:22 +02:00
Matt Caswell
aecaaccaf9 Document the SSL_set_session_secret_cb() function 
This function is only useful for EAP-FAST, but was previously undocumented.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24309)
 2024-05-06 10:44:22 +02:00
Matt Caswell
91c7ab27ce Set the server sig algs before calling the session_secret_cb 
Setting the server sig algs sets up the certificate "s3->tmp.valid_flags".
These are needed when calling ssl3_choose_cipher() which can happen
immediately after calling the session_secret_cb

Fixes #24213

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24309)
 2024-05-06 10:44:14 +02:00
Matt Caswell
c8dddc61d4 Add a test for the session_secret_cb 
Ensure that if a session_secret_cb is being used that a connection can
be successfully made

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24309)
 2024-05-06 10:44:14 +02:00
Jiasheng Jiang
327261c076 test/threadstest.c: Add checks for CRYPTO_THREAD_lock_new() 
Add checks for the return value of CRYPTO_THREAD_lock_new() in order to avoid Null pointer dereference.

Fixes: 5f8b812931 ("Add locking to atomic operations in rw/rcu tests")
Fixes: d0e1a0ae70 ("RCU lock implementation")
Fixes: 71a04cfca0 ("Implement new multi-threading API")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24313)
 2024-05-06 10:24:22 +02:00
Dimitri John Ledkov
51fd52b8a7 gitignore: ignore newly generated header 
Ignore generated include/openssl/x509_acert.h introduced in
https://github.com/openssl/openssl/pull/15857

Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24287)
 2024-05-06 10:23:10 +02:00
Bernd Edlinger
6d2a01cdfb Fix error handling in CMS_EncryptedData_encrypt 
That caused several memory leaks in case of error.
Also when the CMS object that is created by CMS_EncryptedData_encrypt
is not used in the normal way, but instead just deleted
by CMS_ContentInfo_free some memory was lost.

Fixes #21985

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22031)
 2024-05-06 10:13:20 +02:00
Veronika Hanulíková
fedbfff42d Add processing by chunks to mac tests 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21727)
 2024-05-06 08:57:51 +10:00
Veronika Hanulíková
5f4983f99b Add processing by chunks to encoding tests 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21727)
 2024-05-06 08:57:51 +10:00
Veronika Hanulíková
1208d526d3 Add processing by chunks to digest, sign, verify tests 
Input value is parsed into chunks, which are separately
stored in the buffer stack. When chunk size is set,
"Count" and "Copy" parameters are skipped.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21727)
 2024-05-06 08:57:51 +10:00
Veronika Hanulíková
2c8dc43bff Add processing by chunks to cipher tests in evp_test 
When cipher does not support variable fragmentation,
the test is skipped.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21727)
 2024-05-06 08:57:51 +10:00
Veronika Hanulíková
0bfd744f8d Add option for setting size of processed data chunks 
For tests in `evp_test`, which support processing in batches.
When not set or set to 0, data are processed with default
sizes (as before).

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21727)
 2024-05-06 08:57:51 +10:00
Neil Horman
067fbc01b9 Reduce optimization in hppa builds 
We're getting some odd errors in the lhash test on hppa.  Analysis shows
that the crash is happening randomly in various places, but always
occurs during an indexed load of register r11 or r23.  Root cause hasn't
been completely determined, but given that:

1) hppa is an unadopted platform
2) asan/ubsan/threadsan shows no issues with the affected code elsewhere
3) The hppa build does not have threading enabled
4) reducing the optimization level to 01 quashes the problem

The belief is that this is either a bug in gcc optimization, or an issue
in the qemu emulator we use to test.

Since this is causing CI failures, I'm proposing that we just lower the
optimization level of the build to -01 to avoid the problem, and address
it more throughly should an actual platform user encounter an error

Fixes #24272

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24318)
 2024-05-02 15:34:21 +02:00
Tomas Mraz
a380ae85be Correct top for EC/DSA nonces if BN_DEBUG is on 
Otherwise following operations would bail out in bn_check_top().

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24265)
 2024-05-02 09:21:30 +02:00
Tomas Mraz
8a1f654680 Adjust FIPS EC/DSA self test data for different nonce generation 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24265)
 2024-05-02 09:21:30 +02:00
Tomas Mraz
9c85f6cd2d Rename BN_generate_dsa_nonce() to ossl_bn_gen_dsa_nonce_fixed_top() 
And create a new BN_generate_dsa_nonce() that corrects the BIGNUM top.
We do this to avoid leaking fixed top numbers via the public API.

Also add a slight optimization in ossl_bn_gen_dsa_nonce_fixed_top()
and make it LE/BE agnostic.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24265)
 2024-05-02 09:21:30 +02:00
Tomas Mraz
13b3ca5c99 Add ossl_bn_priv_rand_range_fixed_top() and use it for EC/DSA 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24265)
 2024-05-02 09:16:36 +02:00
Tomas Mraz
2d285fa873 Make ossl_gen_deterministic_nonce_rfc6979() constant time 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24265)
 2024-05-02 09:16:36 +02:00
Tomas Mraz
d7d1bdcb6a Make BN_generate_dsa_nonce() constant time and non-biased 
Co-authored-by: Paul Dale <ppzgs1@gmail.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24265)
 2024-05-02 09:16:36 +02:00
sapph2c
fd6be6c55b Fixed typo in CRYPTO_THREAD_run_once.pod 
CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24303)
 2024-05-01 15:21:26 +02:00
sapph2c
f4601b6de7 Fixed typos in ossl_ht_new.pod, EVP_PKEY_decrypt.pod, and RSA_public_encrypt.pod 
CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24304)
 2024-05-01 15:15:26 +02:00
Rajeev Ranjan
ee28152e86 CMP: Improvements of the support for requesting CRL 
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23768)
 2024-05-01 14:59:39 +02:00
Dr. David von Oheimb
40a200f9e7 CMP: add support for genm with crlStatusList and genp with crls 
Introduce the capability to retrieve and update Certificate Revocation Lists
(CRLs) in the CMP client, as specified in section 4.3.4 of RFC 9483.

To request a CRL update, the CMP client can send a genm message with the
option -infotype crlStatusList. The server will respond with a genp message
containing the updated CRL, using the -infoType id-it-crls. The client can
then save the CRL in a specified file using the -crlout parameter.

Co-authored-by: Rajeev Ranjan <ranjan.rajeev@siemens.com>

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23768)
 2024-05-01 14:58:35 +02:00
Matt Caswell
1848c561ec Fix intermittent sslapitest early data related failures 
Early data is time sensitive. We have an approx 8 second allowance between
writing the early data and reading it. If we exceed that time tests will
fail. This can sometimes (rarely) occur in normal CI operation. We can try
and detect this and just ignore the result of such test failures if the test
has taken too long. We assume anything over 7 seconds is too long.

This is a partial fix for #22605

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23966)
 2024-05-01 08:51:28 +01:00
Matt Caswell
afb6ce0d0f Use OSSL_TIME instead of using arithmetic directly on time_t 
We have functions for adding/subtracting time. We should use them.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23966)
 2024-05-01 08:51:28 +01:00
Robert Schulze
af75373eea Fix race for X509 store found by thread sanitizer 
The following issue was found in automatic tests with thread sanitizer
builds in ClickHouse (which uses OpenSSL 3.2.1) [0].

The first stack [1] does proper locking (function 'x509_store_add',
x509_lu.c) but in the second stack [2], function 'get_cert_by_subject_ex'
(by_dir.b) forgets to lock when calling 'sk_X509_OBJECT_is_sorted'.

[0] https://github.com/ClickHouse/ClickHouse/issues/63049

[1] WARNING: ThreadSanitizer: data race (pid=1870)
  Write of size 4 at 0x7b08003d6810 by thread T552 (mutexes: write M0, write M1, write M2, write M3):
    #0 OPENSSL_sk_insert build_docker/./contrib/openssl/crypto/stack/stack.c:280:16 (clickhouse+0x203ad7e4) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #1 OPENSSL_sk_push build_docker/./contrib/openssl/crypto/stack/stack.c:401:12 (clickhouse+0x203ad7e4)
    #2 x509_store_add build_docker/./contrib/openssl/crypto/x509/x509_lu.c:419:17 (clickhouse+0x203d4a52) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #3 X509_STORE_add_cert build_docker/./contrib/openssl/crypto/x509/x509_lu.c:432:10 (clickhouse+0x203d48a2) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #4 X509_load_cert_file_ex build_docker/./contrib/openssl/crypto/x509/by_file.c:127:18 (clickhouse+0x203b74e6) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #5 get_cert_by_subject_ex build_docker/./contrib/openssl/crypto/x509/by_dir.c:333:22 (clickhouse+0x203b684c) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #6 X509_LOOKUP_by_subject_ex build_docker/./contrib/openssl/crypto/x509/x509_lu.c:105:16 (clickhouse+0x203d46ec) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #7 ossl_x509_store_ctx_get_by_subject build_docker/./contrib/openssl/crypto/x509/x509_lu.c:360:17 (clickhouse+0x203d46ec)
    #8 X509_STORE_CTX_get1_issuer build_docker/./contrib/openssl/crypto/x509/x509_lu.c:782:10 (clickhouse+0x203d56cb) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #9 get1_trusted_issuer build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:3194:10 (clickhouse+0x203db4a9) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #10 build_chain build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:3324:40 (clickhouse+0x203db4a9)
    #11 verify_chain build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:240:15 (clickhouse+0x203dbe27) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #12 x509_verify_x509 build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:358 (clickhouse+0x203d7fd8) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #13 X509_verify_cert build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:293:56 (clickhouse+0x203d8215) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #14 ssl_verify_internal build_docker/./contrib/openssl/ssl/ssl_cert.c:496:13 (clickhouse+0x2019a2a4) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #15 ssl_verify_cert_chain build_docker/./contrib/openssl/ssl/ssl_cert.c:543:12 (clickhouse+0x2019a402) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #16 tls_post_process_server_certificate build_docker/./contrib/openssl/ssl/statem/statem_clnt.c:2072:9 (clickhouse+0x20227658) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #17 ossl_statem_client_post_process_message build_docker/./contrib/openssl/ssl/statem/statem_clnt.c:1159:16 (clickhouse+0x202272ee) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #18 read_state_machine build_docker/./contrib/openssl/ssl/statem/statem.c:712:35 (clickhouse+0x2021e96d) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #19 state_machine build_docker/./contrib/openssl/ssl/statem/statem.c:478:21 (clickhouse+0x2021e96d)
    #20 ossl_statem_connect build_docker/./contrib/openssl/ssl/statem/statem.c:297:12 (clickhouse+0x2021ddce) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #21 SSL_do_handshake build_docker/./contrib/openssl/ssl/ssl_lib.c:4746:19 (clickhouse+0x201a5781) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #22 SSL_connect build_docker/./contrib/openssl/ssl/ssl_lib.c:2208:12 (clickhouse+0x201a5893) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #23 Poco::Net::SecureSocketImpl::connectSSL(bool) build_docker/./base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp:206:11 (clickhouse+0x1d179567) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)

[2] Previous read of size 4 at 0x7b08003d6810 by thread T553 (mutexes: write M4, write M5, write M6):
    #0 OPENSSL_sk_is_sorted build_docker/./contrib/openssl/crypto/stack/stack.c:490:33 (clickhouse+0x203adcff) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #1 get_cert_by_subject_ex build_docker/./contrib/openssl/crypto/x509/by_dir.c:423:10 (clickhouse+0x203b6d8f) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #2 X509_LOOKUP_by_subject_ex build_docker/./contrib/openssl/crypto/x509/x509_lu.c:105:16 (clickhouse+0x203d46ec) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #3 ossl_x509_store_ctx_get_by_subject build_docker/./contrib/openssl/crypto/x509/x509_lu.c:360:17 (clickhouse+0x203d46ec)
    #4 X509_STORE_CTX_get1_issuer build_docker/./contrib/openssl/crypto/x509/x509_lu.c:782:10 (clickhouse+0x203d56cb) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #5 get1_trusted_issuer build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:3194:10 (clickhouse+0x203db4a9) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #6 build_chain build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:3324:40 (clickhouse+0x203db4a9)
    #7 verify_chain build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:240:15 (clickhouse+0x203dbe27) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #8 x509_verify_x509 build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:358 (clickhouse+0x203d7fd8) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #9 X509_verify_cert build_docker/./contrib/openssl/crypto/x509/x509_vfy.c:293:56 (clickhouse+0x203d8215) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #10 ssl_verify_internal build_docker/./contrib/openssl/ssl/ssl_cert.c:496:13 (clickhouse+0x2019a2a4) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #11 ssl_verify_cert_chain build_docker/./contrib/openssl/ssl/ssl_cert.c:543:12 (clickhouse+0x2019a402) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #12 tls_post_process_server_certificate build_docker/./contrib/openssl/ssl/statem/statem_clnt.c:2072:9 (clickhouse+0x20227658) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #13 ossl_statem_client_post_process_message build_docker/./contrib/openssl/ssl/statem/statem_clnt.c:1159:16 (clickhouse+0x202272ee) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #14 read_state_machine build_docker/./contrib/openssl/ssl/statem/statem.c:712:35 (clickhouse+0x2021e96d) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #15 state_machine build_docker/./contrib/openssl/ssl/statem/statem.c:478:21 (clickhouse+0x2021e96d)
    #16 ossl_statem_connect build_docker/./contrib/openssl/ssl/statem/statem.c:297:12 (clickhouse+0x2021ddce) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #17 SSL_do_handshake build_docker/./contrib/openssl/ssl/ssl_lib.c:4746:19 (clickhouse+0x201a5781) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #18 SSL_connect build_docker/./contrib/openssl/ssl/ssl_lib.c:2208:12 (clickhouse+0x201a5893) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)
    #19 Poco::Net::SecureSocketImpl::connectSSL(bool) build_docker/./base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp:206:11 (clickhouse+0x1d179567) (BuildId: 3ceefd39df36d762f06bf9aab19cfc3467e4558b)

CLA: trivial

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24295)
 2024-04-30 17:21:56 +02:00
Neil Horman
c04901be78 Fix alignment errors in hashtable fuzzer 
we extract several values (uint16_t and uint64_t from the fuzzer buff
passed in, but they weren't aligned on 2 and 8 byte boundaries.  Adjust
the fuzzer to memcpy data to the target variables to avoid unalignment
issues

Fixes #24272

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24276)
 2024-04-30 12:53:51 +02:00
leerubin13
2d29a8a7e8 ess_lib.c: Changed ERR_LIB_CMS to ERR_LIB_ESS 
This fixes an incorrect error message.

Fixes #24224
CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24290)
 2024-04-30 09:21:30 +02:00
Daniel McCarney
6a4a714045 doc: clarify SSL_CIPHER_description allocation 
Previously the documentation for `SSL_CIPHER_description` said:
> If buf is provided, it must be at least 128 bytes, otherwise a buffer
> will be allocated using OPENSSL_malloc().

In reality, `OPENSSL_malloc` is only invoked if the provided `buf`
argument is `NULL`. If the `buf` arg is not `NULL`, but smaller than
128 bytes, the function returns `NULL` without attempting to allocate
a new buffer for the description.

This commit adjusts the documentation to better describe the implemented
behaviour.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23921)
 2024-04-29 11:04:31 +02:00
Dmitry Misharov
58ffcbbdc3 archive artifacts before upload 
Some CI jobs produce a significant amount artifacts and it takes a lot
of time to upload them into GitHub artifacts storage. It will be much
faster to upload only one archive with artifacts.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24264)
 2024-04-29 10:34:40 +02:00
Michael Baentsch
7b1829fa37 updated to oqs-provider 0.6.0 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24261)
 2024-04-29 10:29:22 +02:00
Tomas Mraz
f4fcc21fdc 82-test_ocsp_cert_chain.t: kill -HUP the server after client quits 
This ensures even if the connection for some reason
fails, the server will terminate and the test won't get
stuck.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/23857)
 2024-04-29 10:25:39 +02:00
Tomas Mraz
7054412ea8 82-test_ocsp_cert_chain.t: Terminate the server after 1 connection 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/23857)
 2024-04-29 10:25:39 +02:00
Neil Horman
933f57dfe2 Raise an error on syscall failure in tls_retry_write_records 
Record the errno when we get a syscall failure in
tls_retry_write_records

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23723)
 2024-04-26 17:10:38 +02:00
Neil Horman
3dcd85139f Make a failure in ktls_sendfile a syscall error 
a failure in ktls_sendfile results in an error in ERR_LIB_SSL, but its
really a syscall error, since ktls_sendfile just maps to a call to the
sendfile syscall.  Encode it as such

Fixes #23722

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23723)
 2024-04-26 17:10:34 +02:00
Neil Horman
3059052992 Fix coverity 1596617 
Somehow a double free slipped into conf_mod.c, remove it

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24263)
 2024-04-26 17:09:06 +02:00
Neil Horman
badda78325 Fix coverity-1596616 
Need to add a null check prior to derefencing pointer for free

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24263)
 2024-04-26 17:09:06 +02:00
Takehiko Yokota
bde66e828d Add an Apple privacy info file for OpenSSL 
Added PrivacyInfo.xcprivacy to os-dep/Apple/ dir.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24260)
 2024-04-26 14:01:36 +02:00
Jiasheng Jiang
48e3cf25a8 ssl/statem: Replace size_t with int and add the checks 
Replace the type of variables with int to avoid implicit conversion when it is assigned by EVP_MD_get_size().
Moreover, add the checks to avoid integer overflow.

Fixes: 6594189 ("Merge early_data_info extension into early_data")
Fixes: 9368f86 ("Add TLSv1.3 client side external PSK support")
Fixes: 1053a6e ("Implement Server side of PSK extension parsing")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23937)
 2024-04-26 09:28:55 +02:00
Viktor Dukhovni
6d01857040 Avoid duplicate default CApath lookups 
Fixes #21067

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24140)
 2024-04-26 09:03:44 +02:00
Dimitri John Ledkov
15d6114d99 hkdf: when HMAC key is all zeros, still set a valid key length 
By itself, this is no change in any computation. However, this will
unlock enforcing minimum key lengths for NIST and FIPS 140-3
requirements.

Also reading RFC8448 and RFC5869, this seems to be strictly correct
too.

Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24204)
 2024-04-25 14:00:05 +02:00
hrtarsia
5d218b0e44 Fix grammar in srp_verifier.txt 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24237)
 2024-04-25 11:07:20 +02:00
Merreck
7c30519765 sha512.c: Grammar Fixes and Spell Checks in Implementation Notes 
Added commas for sentence openers in Implementation Notes. Fixed
spelling of "reasons" section of the notes.

CLA: trivial

Co-authored-by: Tom Cosgrove <tom.cosgrove@arm.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24241)
 2024-04-25 10:44:01 +02:00
hrtarsia
c81b7b059f Fix grammar in certificates.txt 
CLA: trivial

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24238)
 2024-04-24 18:55:41 +02:00
Tomas Mraz
599bc929ba Update perl-actions/install-with-cpanm version in CI 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/23613)
 2024-04-24 17:57:13 +02:00
Damian Hobson-Garcia
f892397c52 Add Attribute Certificate suport comments to CHANGES and NEWS 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:08:05 +01:00
Damian Hobson-Garcia
11cd18c60d x509_acert: Add more parsing and printing tests 
These have been extracted from the boucycastle test code.
Make sure that these certificates can be safely and correctly parsed
and printed.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:08:05 +01:00
Damian Hobson-Garcia
dab96a4f60 x509_acert: Load attributes from config file section 
Several of the attribute values defined for use by attribute certificates
use multi-valued data in an ASN.1 SEQUENCE. Allow reading of these values
from a configuration file, similar to how generic X.509 extensions are
handled.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:08:05 +01:00
Damian Hobson-Garcia
d10b020e2e fuzz: Add attribute certificate fuzz test 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:08:03 +01:00
Damian Hobson-Garcia
f90d97caab x509_acert: Add simple API tests 
Add a some simple API tests for reading, printing, signing
and verifying attribute certificates.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:05:35 +01:00
Damian Hobson-Garcia
0e8020a45b Add IETFAttrSyntax type support 
The IETFAtrrSyntax type is used for the values of several attributes
defined in RFC 5755 for use with attribute certificates.
Specifically this type is used with the "Charging Identity" and
"Group" attributes.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:05:35 +01:00
Damian Hobson-Garcia
1eeec94f1f x509_acert: Add and retrieve certificate extensions 
Add API to manage attribute certificate extensions

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:05:35 +01:00
Damian Hobson-Garcia
b97fb22f59 x509_acert: Add API to sign and verify attribute certificates 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:05:35 +01:00
Damian Hobson-Garcia
62960b8710 x509_acert: Add, remove and get attribute certificate attributes 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:05:35 +01:00
Damian Hobson-Garcia
6b167313f4 Attribute certificate printing functions 
Add functions to print an attribute certificate.  Several
attribute value types defined by the RFC 5755 specification
are multi-field values (i.e ASN1_SEQUENCE rather than an ASN1_STRING
or similar format).  Currently those values are printed using
`ASN1_item_print`.  A more user-friendly output mechanism (maybe
similar to the i2r_ functions used for X509 extensions) could be
added in future.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:05:35 +01:00
Damian Hobson-Garcia
9e1a8b5ecc Attribute certificate getter and setter API 
Only fields that are allowed by RFC 5755 are
accessible through this API.  Fields that are only supported
in version 1 attribute certificates (e.g. the AttCertIssuer
v1Form fields) are not implemented.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:05:35 +01:00
Damian Hobson-Garcia
7dcee34c8f Add RFC 5755 attribute certificate support 
Add support for attribute certificates (v2) as described
in RFC 5755 profile.

Attribute certificates provide a mechanism to manage authorization
information separately from the identity information provided by
public key certificates.

This initial patch adds the ASN.1 definitions
and I/O API.  Accessor functions for the certificate fields
will be added in subsequent patches.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)
 2024-04-24 14:05:32 +01:00
Randall S. Becker
0339382aba Remove all references to FLOSS for NonStop Builds. 
FLOSS is no longer a dependency for NonStop as of the deprecation of the SPT
thread model builds.

Fixes: #24214

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24217)
 2024-04-24 09:35:29 +02:00
Neil Horman
ca43171b3c updating fuzz-corpora submodule 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23671)
 2024-04-24 12:03:30 +10:00
Neil Horman
2a54ec0bdd adding a multithreaded hashtable test 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23671)
 2024-04-24 12:03:30 +10:00
Neil Horman
f597acb71b Adding hashtable fuzzer 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23671)
 2024-04-24 12:03:30 +10:00
Neil Horman
cc4ea5e000 Introduce new internal hashtable implementation 
Create a new hashtable that is more efficient than the existing LHASH_OF
implementation.  the new ossl_ht api offers several new features that
improve performance opportunistically

* A more generalized hash function.  Currently using fnv1a, provides a
  more general hash function, but can still be overridden where needed

* Improved locking and reference counting.  This hash table is
  internally locked with an RCU lock, and optionally reference counts
  elements, allowing for users to not have to create and manage their
  own read/write locks

* Lockless operation.  The hash table can be configured to operate
  locklessly on the read side, improving performance, at the sacrifice
  of the ability to grow the hash table or delete elements from it

* A filter function allowing for the retrieval of several elements at a
  time matching a given criteria without having to hold a lock
  permanently

* a doall_until iterator variant, that allows callers which need to
  iterate over the entire hash table until a given condition is met (as
  defined by the return value of the iterator callback).  This allows
  for callers attempting to do expensive cache searches for a small
  number of elements to terminate the iteration early, saving cpu cycles

* Dynamic type safety.  The hash table provides operations to set and
  get data of a specific type without having to define a type at the
  instatiation point

* Multiple data type storage.  The hash table can store multiple data
  types allowing for more flexible usage

* Ubsan safety.  Because the API deals with concrete single types
  (HT_KEY and HT_VALUE), leaving specific type casting to the call
  recipient with dynamic type validation, this implementation is safe
  from the ubsan undefined behavior warnings that require additional
  thunking on callbacks.

Testing of this new hashtable with an equivalent hash function, I can
observe approximately a 6% performance improvement in the lhash_test

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23671)
 2024-04-24 12:03:30 +10:00
Neil Horman
7e45ac6891 Add CRYPTO_atomic_store api 
Generally we can get away with just using CRYPTO_atomic_load to do
stores by reversing the source and target variables, but doing so
creates a problem for the thread sanitizer as CRYPTO_atomic_load hard
codes an __ATOMIC_ACQUIRE constraint, which confuses tsan into thinking
that loads and stores aren't properly ordered, leading to RAW/WAR
hazzards getting reported.  Instead create a CRYPTO_atomic_store api
that is identical to the load variant, save for the fact that the value
is a unit64_t rather than a pointer that gets stored using an
__ATOMIC_RELEASE constraint, satisfying tsan.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23671)
 2024-04-24 12:03:03 +10:00
Neil Horman
f39a862818 Fix list appending in win ossl_rcu_call 
The ossl_rcu_call function for windows creates a linked list loop.  fix
it to work like the pthread version properly

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23671)
 2024-04-24 12:03:03 +10:00
Neil Horman
3bcac46035 Make thread sanitizer cope with rcu locks 
This is unfortunate, but seems necessecary

tsan in gcc/clang tracks data races by recording memory references made
while various locks are held.  If it finds that a given address is
read/written while under lock (or under no locks without the use of
atomics), it issues a warning

this creates a specific problem for rcu, because on the write side of a
critical section, we write data under the protection of a lock, but by
definition the read side has no lock, and so rcu warns us about it,
which is really a false positive, because we know that, even if a
pointer changes its value, the data it points to will be valid.

The best way to fix it, short of implementing tsan hooks for rcu locks
in any thread sanitizer in the field, is to 'fake it'.  If thread
sanitization is activated, then in ossl_rcu_write_[lock|unlock] we add
annotations to make the sanitizer think that, after the write lock is
taken, that we immediately unlock it, and lock it right before we unlock
it again.  In this way tsan thinks there are no locks held while
referencing protected data on the read or write side.

we still need to use atomics to ensure that tsan recognizes that we are
doing atomic accesses safely, but thats ok, and we still get warnings if
we don't do that properly

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23671)
 2024-04-24 12:03:03 +10:00
Neil Horman
a928f26813 Coverity found the following issues: 
1591471
1591474
1591476

which pertain to memory leaks in the conf_mod code

If an error is encountered after the module STACK_OF is duplicated or
created in the new_modules variable, we need to remember to free it in
the error path

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23462)
 2024-04-24 11:39:41 +10:00
Neil Horman
d092208bd6 Fix potential divide by zero error 
Coverity caught the following issues:
1591477
1591475
1591473
1591470

all of which are simmilar, in that they catch potential divide by zero
in double values.  It can't actually happen since the the threads which
increment these counters don't exit until they reach non-zero values,
but its easy to add the checks, so lets do that to ensure that we don't
change something in the future that causes it.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23462)
 2024-04-24 11:39:41 +10:00
shridhar kalavagunta
264ff64b94 Invoke tear_down when exiting test_encode_tls_sct() prematurely 
Fixes #24121

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24222)
 2024-04-23 11:33:42 +02:00
Logan Upchurch
5454ef7cb3 crypto/threads_pthread.c: Fix typos found by codespell 
CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24206)
 2024-04-23 11:26:29 +02:00
Hubert Kario
9816127463 Be more explicit about RSAES-PKCS#1v1.5 error handling 
And add a note how to perform side-channel free error stack handling.

Signed-off-by: Hubert Kario <hkario@redhat.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24159)
 2024-04-22 15:56:40 +02:00
Tim Perry
972ee925b1 Use empty renegotiate extension instead of SCSV for TLS > 1.0 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24161)
 2024-04-22 13:23:28 +01:00
Neil Horman
6ee369cd6e Fix missing NULL check in prov_config_test 
coverity-1596500 caught a missing null check.  We should never hit it as
the test harness always sets the environment variable, but lets add the
check for safety

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24208)
 2024-04-22 12:15:59 +01:00
Rajeev Ranjan
fc9649f61a fix sending error when no root CA cert update available 
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24169)
 2024-04-22 08:28:25 +02:00
slontis
6594baf645 Fix migration guide mappings for i2o/o2i_ECPublicKey 
Fixes #23854

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24041)
 2024-04-19 14:16:28 -04:00
Neil Horman
24d16d3a19 Make rcu_thread_key context-aware 
Currently, rcu has a global bit of data, the CRYPTO_THREAD_LOCAL object
to store per thread data.  This works in some cases, but fails in FIPS,
becuase it contains its own copy of the global key.

So
1) Make the rcu_thr_key a per-context variable, and force
   ossl_rcu_lock_new to be context aware

2) Store a pointer to the context in the lock object

3) Use the context to get the global thread key on read/write lock

4) Use ossl_thread_start_init to properly register a cleanup on thread
   exit

5) Fix up missed calls to OSSL_thread_stop() in our tests

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24162)
 2024-04-19 09:22:53 -04:00
Richard Levitte
faa4a10ebe OSSL_STORE: Add reference docs for the built-in Windows store implementation 
Fixes openssl/project#422

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24170)
 2024-04-19 14:20:58 +02:00
Enji Cooper
8574fa5f40 openssl fipsinstall: fix cosmetic wart 
This change makes the message on failure consistent with the message on
success by trimming a single space in the error message.

CLA: trivial
Signed-off-by: Enji Cooper <yaneurabeya@gmail.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24180)
 2024-04-19 10:35:38 +02:00
Tomas Mraz
0977eac565 Adjust tests that were depending on X25519 and X448 in fips 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24099)
 2024-04-19 10:32:27 +02:00
Dimitri John Ledkov
fccd1615ee Exclude X25519 and X448 from capabilities advertised by FIPS provider 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24099)
 2024-04-19 10:32:27 +02:00
Tomas Mraz
52ca56090c Make X25519 and X448 FIPS unapproved 
Partially fixes: #22105

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24099)
 2024-04-19 10:32:27 +02:00
Neil Horman
4e3c1e6206 Fix up path generation to use OPENSSL_MODULES 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24025)
 2024-04-18 18:38:56 +02:00
Neil Horman
b80fed3f27 Update modulepath test for provider config to skip if not present 
If the p_test.so library isn't present, don't run the test

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24025)
 2024-04-18 18:38:39 +02:00
Neil Horman
91a77cbf66 Add test for OSSL_PROVIDER_load with module path set 
Ensure that, with the modulepath setting set in a config field, that we
are able to load a provider from the path relative to OPENSSL_MODULES

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24025)
 2024-04-18 18:38:39 +02:00
Neil Horman
bc9595963a set module path from template 
Modules that aren't activated at conf load time don't seem to set the
module path from the template leading to load failures.  Make sure to
set that

Fixes #24020

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24025)
 2024-04-18 18:38:39 +02:00
Hugo Landau
c3542b22fa QUIC TXP: Fix reserve calculations for PING frames 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24122)
 2024-04-18 17:42:26 +02:00
Viktor Dukhovni
1692e0d225 Fix fragile explicit cert date tests. 
The tests used localtime to format "today's" date, but then extracted a
GMT date from the cert.  The comparison breaks when run late in the
evening west of UTC, or early in the AM hours east of UTC.

Also took care of case when test runs at stroke of midnight, by
accepting either the "today" before the cert creation, or the
"today" after, should they be different.

Fixes fragile tests in #21716

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24139)
 2024-04-18 14:20:54 +02:00
rlvkleinhenz
4174f26141 Update provider-compatibility.yml 
Documentation Change: Line 34

Changed 'utl' to 'url' to correctly reflect the variables used in the releases in this file.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24164)
 2024-04-18 13:33:06 +02:00
Dwiczz
35950cea02 Updated list formatting, added hyperlinks, modernized syntax 
Updated list formatting to allow for easier readability, Added/adjusted hyperlinks, modernized command substitution syntax

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24165)
 2024-04-18 11:02:29 +02:00
Richard Levitte
e1fd043ad7 .ctags.d is previous, include it in our tarballs 
This is a simple change of .gitattributes, so our tarballs continue to
be a reproducible output of a util/mktar.sh (i.e. git archive with no
other funny business).

Fixes #24090

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24156)
 2024-04-17 18:41:59 +02:00
Jerry Shih
da8b6308bd Use scalar ALU and vector ALU together for chacha20 stream cipher 
Fixes #24070

Use scalar ALU for 1 chacha block with rvv ALU simultaneously.
The tail elements(non-multiple of block length) will be handled by
the scalar logic.

Use rvv path if the input length > chacha_block_size.

And we have about 1.2x improvement comparing with the original code.

Reviewed-by: Hongren Zheng <i@zenithal.me>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24097)
 2024-04-17 16:55:03 +02:00
Yangyu Chen
96939f1e2c poly1305.c: fix typo on POLY1305_BLOCK_SIZE 
no code change

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24136)
 2024-04-17 09:41:14 +02:00
Theo Buehler
25391acc14 Unable to run asm code on OpenBSD (amd64) 
In order to get asm code running on OpenBSD we must place
all constants into .rodata sections.

davidben@ also pointed out we need to adjust `x86_64-xlate.pl` perlasm
script to adjust read-olny sections for various flavors (OSes). Those
changes were cherry-picked from boringssl.

closes #23312

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23997)
 2024-04-17 09:38:06 +02:00
Alexandr Nedvedicky
fc807a0349 extend x86_64-xlate.pl perlasm so it can handle .rodata sections properly 
For nasm/masm assembler flavors the xlate script must make sure the code
won't land in .rodata section along the data.

For masm we also need to introduce an .align option which can be passed
along section header. It's hint for masm to align rodata/rdata section
properly.

Also macos-x flavor requires small tweak to emit proper section header
for its assembler style.

Changes for masm flavor are based on SEGMENT description [1] in
MASM reference manual.

Changes for nasm flavor are based on nasm 2.14 manual chapter 7 [2].

Details behind macos-x changes can be found in 'Overview of the Mach-O
Executable Format' [3]

[1] https://learn.microsoft.com/en-us/cpp/assembler/masm/segment?view=msvc-170

[2] https://nasm.us/xdoc/2.14rc0/html/nasmdoc7.html

[3] https://developer.apple.com/library/archive/documentation/Performance/Conceptual/CodeFootprint/Articles/MachOOverview.html

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23997)
 2024-04-17 09:33:57 +02:00
Tomas Mraz
8d8a014430 fuzz/decoder.c: Limit the EVP_PKEY_param_check on DHX keys as well 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24126)
 2024-04-17 09:30:11 +02:00
Viktor Dukhovni
14bed67221 Define KU_ constants via corresponding X509v3_KU_ 
Also wrap X509v3_KU_UNDEF in `#ifndef OPENSSL_NO_DEPRECATED_3_4`.

Fixes #22955

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24138)
 2024-04-17 09:09:25 +02:00
trinity-1686a
299996fb1f Handle empty param in EVP_PKEY_CTX_add1_hkdf_info 
Fixes #24130
The regression was introduced in PR #23456.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24141)
 2024-04-17 08:52:51 +02:00
Alexandr Nedvedicky
c062403abd OpenSSL 3.2.0, QUIC, macOS, error 56 on connected UDP socket 
current `translate_msg()` function attempts to set `->msg_name`
(and `->msg_namelen`) with `BIO`'s peer name (connection destination)
regardless if underlying socket is connected or not. Such implementation
uncovers differences in socket implementation between various OSes.

As we have learned hard way `sendmsg()` and `sendmmsg()` on `OpenBSD`
and (`MacOS` too) fail to send messages with `->msg_name` being
set on connected socket. In such case the caller receives
`EISCON` errro.

I think `translate_msg()` caller should provide a hint to indicate
whether we deal with connected (or un-connected) socket. For
connected sockets the peer's name should not be set/filled
by `translate_msg()`. On the other hand if socket is un-connected,
then `translate_msg()` must populate `->msg_name` and `->msg_namelen`
members.

The caller can use `getpeername(2)` to see if socket is
connected. If `getpeername()` succeeds then we must be dealing
with connected socket and `translate_msg()` must not set
`->msg_name` and `->msg_namelen` members. If `getpeername(2)`
fails, then `translate_msg()` must provide peer's name (destination
address) in `->msg_name` and set `->msg_namelen` accordingly.

The propposed fix introduces `is_connected()` function,
which applies `getpeername()` to socket bound to `BIO` instance.
The `dgram_sendmmsg()` uses `is_connected()` as a hint
for `translate_msg()` function, so msghdr gets initialized
with respect to socket state.

The change also modifies existing `test/quic_client_test.c`
so it also covers the case of connected socket. To keep
things simple we can introduce optional argument `connect_first`
to `./quic_client_test` function. Without `connect_first`
the test run as usual. With `connect_first` the test creates
and connects socket first. Then it passes such socket to
`BIO` sub-system to perform `QUIC` connect test as usual.

Fixes #23251

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23396)
 2024-04-16 16:36:57 +02:00
Richard Levitte
4ffef97d37 doc/fingerprints.txt: Add the future OpenSSL release key 
This will be used for future releases

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24063)
 2024-04-16 16:18:21 +02:00
Richard Levitte
a02077d4d7 crypto/threads_pthread.c: refactor all atomics fallbacks for type safety 
The atomics fallbacks were using 'void *' as a generic transport for all
possible scalar and pointer types, with the hypothesis that a pointer is
as large as the largest possible scalar type that we would use.

Then enters the use of uint64_t, which is larger than a pointer on any
32-bit system (or any system that has 32-bit pointer configurations).

We could of course choose a larger type as a generic transport.  However,
that only pushes the problem forward in time...  and it's still a hack.
It's therefore safer to reimplement the fallbacks per type that atomics
are used for, and deal with missing per type fallbacks when the need
arrises in the future.

For test build purposes, the macro USE_ATOMIC_FALLBACKS is introduced.
If OpenSSL is configured with '-DUSE_ATOMIC_FALLBACKS', the fallbacks
will be used, unconditionally.

Fixes #24096

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24123)
 2024-04-16 09:18:01 +02:00
Richard Levitte
81f393498b crypto/threads_pthread.c: Cleanup misaligned preprocessor directives 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24123)
 2024-04-16 09:18:01 +02:00
Neil Horman
3c0bb68c75 Remove repetitive words 
Signed-off-by: fanqiaojun <fanqiaojun@yeah.net>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24128)
 2024-04-16 09:07:05 +02:00
afshinpir
bd73e1e62c Adding missing NULL pointer check 
CLA: trivial
In the provider store API, it is not necessary to provide both open and
attach method at the same time and providing at least one of them is
enough. Adding some null pointer checks to prevent exceptions in case
of not providing both methods at the same time.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23703)
 2024-04-15 10:29:14 +02:00
Tomas Mraz
993c2407d0 list_provider_info(): Fix leak on error 
Fixes #24110

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24117)
 2024-04-15 09:09:32 +02:00
Neil Horman
d4188f2486 Augment README.md in top level to indicate Makefile presence 
Note that they are available but only meant as a guide to self building,
and are not used expressly to build as part of the overall openssl build

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24047)
 2024-04-12 08:02:20 -04:00
Neil Horman
693071c088 disable http3 demo on windows 
The external nghttp3 library seems to have a linking issue on windows
(several missing symbols).  Disable that build in windows for now until
its fixed

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24047)
 2024-04-12 08:02:20 -04:00
Neil Horman
6195c08d10 make addr_len the right sign in sslecho 
cygwin caught a signedness difference in this pointer.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24047)
 2024-04-12 08:02:20 -04:00
Neil Horman
793a4056ad Replace getline with fgets in sslecho demo 
Windows doesn't support getline, so we need to use fgets here

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24047)
 2024-04-12 08:02:20 -04:00
Neil Horman
4ad6e549fa dont include unistd.h on windows for sslecho 
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24047)
 2024-04-12 08:02:20 -04:00
Neil Horman
3b56cd4f04 Don't include unistd.h in sconnect for windows 
The platform doesn't support it

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24047)
 2024-04-12 08:02:20 -04:00
Neil Horman
7acdd776e3 Fix signal handling in saccept for windows 
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24047)
 2024-04-12 08:02:19 -04:00
Neil Horman
f2f13cff21 Fix warnings found by clang in CI 
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24047)
 2024-04-12 08:02:19 -04:00
Neil Horman
44f05ded99 Enable demos in select builds 
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24047)
 2024-04-12 08:02:19 -04:00
Neil Horman
7a7fbeb924 fix all the warnings in our demos and make them enableable 
Fix up the warnings in the demos and make them configurable with
enable-demos

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24047)
 2024-04-12 08:02:19 -04:00
Neil Horman
2000281dad Convert demos to primary build system 
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/24047)
 2024-04-12 08:02:19 -04:00
Tomas Mraz
875db35ac6 ossl_provider_new(): Fix memory leak on error 
Fixes #24095

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24100)
 2024-04-12 10:58:38 +02:00
Tomas Mraz
682ed1b86e make_addressPrefix(): Fix a memory leak in error case 
Fixes #24098

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24102)
 2024-04-12 10:56:28 +02:00
Neil Horman
8e5918fb8e Fix duplicate mutex allocation in threads_win.c 
Creating an rcu lock does a double allocation of the underlying mutex.
Not sure how asan didn't catch this, but we clearly have a duplicate
line here

Fixes #24085

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24086)
 2024-04-11 12:22:33 -04:00
Richard Levitte
491bbb444c VMS: Move defining _XOPEN_SOURCE and _XOPEN_SOURCE_EXTENDED to config target 
For all other platforms that need these macros defined, that's how it's
done, so we have VMS follow suit.  That avoids a crash between in source
definitions and command line definitions on some other platforms.

Fixes #24075

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24083)

(cherry picked from commit 7f04bb065d)
 2024-04-11 13:06:49 +02:00
Oleg Bulatov
2fd6c12e85 crypto/provider_core.c: Allocate activatecnt_lock 
CRYPTO_atomic_add has a lock as a parameter, which is often ignored, but in
some cases (for example, when BROKEN_CLANG_ATOMICS is defined) it is required.

There is no easy way to determine if the lock is needed or not. The current
logic looks like this:

    if defined(OPENSSL_THREADS) && !defined(CRYPTO_TDEBUG) && !defined(OPENSSL_SYS_WINDOWS)
      if defined(__GNUC__) && defined(__ATOMIC_ACQ_REL) && !defined(BROKEN_CLANG_ATOMICS)
        - It works without the lock, but in general the need for the
          lock depends on __atomic_is_lock_free results
      elif defined(__sun) && (defined(__SunOS_5_10) || defined(__SunOS_5_11))
        - The lock is not needed (unless ret is NULL, which should never
          happen?)
      else
        - The lock is required
      endif
    else
      - The lock is not needed
    endif

Adding such conditions outside of crypto.h is error-prone, so it is better to
always allocate the lock, otherwise CRYPTO_atomic_add may silently fail.

Fixes #23376.

CLA: trivial
Fixes: fc570b2605 ("Avoid taking a write lock in ossl_provider_doall_activated()")
Signed-off-by: Oleg Bulatov <oleg@bulatov.me>

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24081)
 2024-04-11 10:07:28 +02:00
Hugo Landau
8cd3f34758 Change approach to SSL_pending API 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24040)

(cherry picked from commit 5a13d35f24)
 2024-04-10 15:49:00 +02:00
Hugo Landau
da01235692 QUIC APL: Revise SSL_pending and SSL_has_pending handling for s_client compat 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24040)

(cherry picked from commit 7c33eb1e7f)
 2024-04-10 15:48:35 +02:00
Hugo Landau
26dd6ba070 QUIC QSM: Add function to determine if data is waiting 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24040)

(cherry picked from commit 3c2bc702eb)
 2024-04-10 15:48:25 +02:00
Dimitri John Ledkov
60f69680b2 test: fix 20-test_dgst.t to use hexkey 
Currently 20-test_dgst.t calls a quite bogus command:

    $ openssl dgst -sha256 -hmac -macopt hexkey:FFFF test/data.bin test/data.bin
    hexkey:FFFF: No such file or directory
    HMAC-SHA2-256(test/data.bin)= b6727b7bb251dfa65846e0a8223bdd57d244aa6d7e312cb906d8e21f2dee3a57
    HMAC-SHA2-256(test/data.bin)= b6727b7bb251dfa65846e0a8223bdd57d244aa6d7e312cb906d8e21f2dee3a57
    805B632D4A730000:error:80000002:system library:file_ctrl:No such file or directory:crypto/bio/bss_file.c:297:calling fopen(hexkey:FFF, r)
    805B632D4A730000:error:10080002:BIO routines:file_ctrl:system lib:crypto/bio/bss_file.c:300:

Does not check status code, discards stderr, and verifies the
checksums as per above. Note that the checksum is for the HMAC key
"-macopt", and `hexkey:FFFF` is attempted to be opened as a file.

See HMAC values for key `-macopt` and `hexkey:FFFF` using `openssl-mac`:

    $ openssl mac -digest SHA256 -macopt hexkey:$(printf '%s' '-macopt' | xxd -p -u) -in ./test/data.bin HMAC
    B6727B7BB251DFA65846E0A8223BDD57D244AA6D7E312CB906D8E21F2DEE3A57

    $ openssl mac -digest SHA256 -macopt hexkey:FFFF -in ./test/data.bin HMAC
    7C02D4A17D2560A5BB6763EDBF33F3A34F415398F8F2E07F04B83FFD7C087DAE

Fix this test case to actually use HMAC with hexkey:FFFF as intended.

Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24068)
 2024-04-10 09:33:56 +02:00
Tomas Mraz
27005cecc7 Document that private and pairwise checks are not bounded by key size 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24049)
 2024-04-10 09:28:59 +02:00
Tomas Mraz
9fc61ba0a7 fuzz/decoder.c: Limit the key sizes on which checks are run 
In particular the DH safe prime check will be limited to 8192 bits
and the private and pairwise checks are limited to 16384 bits on
any key types.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24049)
 2024-04-10 09:28:59 +02:00
olszomal
c89baf8710 Fix socket descriptor checks on Windows 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24035)
 2024-04-10 09:25:23 +02:00
Dimitri Papadopoulos
15eb7b6875 Fix typos found by codespell 
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24013)
 2024-04-10 09:24:15 +02:00
Hubert Kario
9b87c5a3ff man EVP_PKEY_CTX_set_params: document params is a list 
Signed-off-by: Hubert Kario <hkario@redhat.com>

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23986)
 2024-04-10 09:22:48 +02:00
Tom Cosgrove
88c74fe05b aarch64: fix BTI in bsaes assembly code 
Change-Id: I63f0fb2af5eb9cea515dec96485325f8efd50511

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/23982)
 2024-04-10 09:20:12 +02:00
Neil Horman
f5b5a35c84 Ensure proper memory barriers around ossl_rcu_deref/ossl_rcu_assign_ptr 
Since the addition of macos14 M1 runners in our CI jobs we've been
seeing periodic random failures in the test_threads CI job.
Specifically we've seen instances in which the shared pointer in the
test (which points to a monotonically incrementing uint64_t went
backwards.

From taking a look at the disassembled code in the failing case, we see
that __atomic_load_n when emitted in clang 15 looks like this
0000000100120488 <_ossl_rcu_uptr_deref>:
100120488: f8bfc000     ldapr   x0, [x0]
10012048c: d65f03c0     ret

Notably, when compiling with gcc on the same system we get this output
instead:
0000000100120488 <_ossl_rcu_uptr_deref>:
100120488: f8bfc000     ldar   x0, [x0]
10012048c: d65f03c0     ret

Checking the arm docs for the difference between ldar and ldapr:
https://developer.arm.com/documentation/ddi0602/2023-09/Base-Instructions/LDAPR--Load-Acquire-RCpc-Register-
https://developer.arm.com/documentation/dui0802/b/A64-Data-Transfer-Instructions/LDAR

It seems that the ldar instruction provides a global cpu fence, not
completing until all writes in a given cpus writeback queue have
completed

Conversely, the ldapr instruction attmpts to achieve performance
improvements by honoring the Local Ordering register available in the
system coprocessor, only flushing writes in the same address region as
other cpus on the system.

I believe that on M1 virtualized cpus the ldapr is not properly ordering
writes, leading to an out of order read, despite the needed fencing.
I've opened an issue with apple on this here:
https://developer.apple.com/forums/thread/749530

I believe that it is not safe to issue an ldapr instruction unless the
programmer knows that the Local order registers are properly configured
for use on the system.

So to fix it I'm proposing with this patch that we, in the event that:
1) __APPLE__ is defined
AND
2) __clang__ is defined
AND
3) __aarch64__ is defined

during the build, that we override the ATOMIC_LOAD_N macro in the rcu
code such that it uses a custom function with inline assembly to emit
the ldar instruction rather than the ldapr instruction.  The above
conditions should get us to where this is only used on more recent MAC
cpus, and only in the case where the affected clang compiler emits the
offending instruction.

I've run this patch 10 times in our CI and failed to reproduce the
issue, whereas previously I could trigger it within 5 runs routinely.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23974)
 2024-04-10 09:18:07 +02:00
Tomas Mraz
65fe3e846f Downgrade also the download-artifact action 
It has to have the same version as upload-artifact.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24065)
 2024-04-10 09:10:45 +02:00
Jiasheng Jiang
309c7ffd17 ffc/ffc_params_generate.c: Add the check for the EVP_MD_get_size() 
Add the check for the EVP_MD_get_size() to avoid invalid negative numbers.

Fixes: 4f2271d58a ("Add ACVP fips module tests")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23970)
 2024-04-09 20:47:47 +02:00
Jiasheng Jiang
f5fde94c54 ts/ts_rsp_sign.c: Add the check for the EVP_MD_CTX_get_size() 
Add the check for the return value of EVP_MD_CTX_get_size() to avoid invalid negative numbers.

Fixes: c7235be6e3 ("RFC 3161 compliant time stamp request creation, response generation and response verification.")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23960)
 2024-04-09 20:47:00 +02:00
Jiasheng Jiang
f4174b6db4 signature/dsa_sig.c: Add checks for the EVP_MD_get_size() 
Add checks for the EVP_MD_get_size() to avoid integer overflow and then explicitly cast from int to size_t.

Fixes: 45a845e40b ("Add EVP_DigestSign/EVP_DigestVerify support for DSA")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23948)
 2024-04-09 20:45:26 +02:00
Jiasheng Jiang
df0ee35b53 signature/ecdsa_sig.c: Add checks for the EVP_MD_get_size() 
Add checks for the EVP_MD_get_size() to avoid integer overflow and then explicitly cast from int to size_t.

Fixes: edd3b7a309 ("Add ECDSA to providers")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23947)
 2024-04-09 20:44:17 +02:00
Neil Horman
4feb4a2b2c Add docs noting requirements for SM2 signing 
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23887)
 2024-04-09 20:41:15 +02:00
Neil Horman
d6a8adeccd Add check for public key presence on sm2 signing 
SM2 requires that the public EC_POINT be present in a key when signing.
If its not there we crash on a NULL pointer.  Add a check to ensure that
its present, and raise an error if its not

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23887)
 2024-04-09 20:38:58 +02:00
Jiasheng Jiang
beb82177dd APPS: Add missing OPENSSL_free() and combine the error handler 
Add the OPENSSL_free() in the error handler to release the "*md_value"
allocated by app_malloc(). To make the code clear and avoid possible
future errors, combine the error handler in the "err" tag.
Then, we only need to use "goto err" instead of releasing the memory
separately.

Since the EVP_MD_get_size() may return negative numbers when an error occurs,
create_query() may fail to catch the error since it only considers 0 as an
error code.

Therefore, unifying the error codes of create_digest() from non-positive
numbers to 0 is better, which also benefits future programming.

Fixes: c7235be ("RFC 3161 compliant time stamp request creation, response generation and response verification.")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/23873)
 2024-04-09 20:34:50 +02:00
Tom Cosgrove
b3be6cc89e Fix "Error finalizing cipher loop" when running openssl speed -evp -decrypt 
When using CCM, openssl speed uses the loop function EVP_Update_loop_ccm() which
sets a (fake) tag when decrypting. When using -aead (which benchmarks a different
sequence than normal, to be comparable to TLS operation), the loop function
EVP_Update_loop_aead() is used, which also sets a tag when decrypting.

However, when using defaults, the loop function EVP_Update_loop() is used, which
does not set a tag on decryption, leading to "Error finalizing cipher loop".

To fix this, set a fake tag value if we're doing decryption on an AEAD cipher in
EVP_Update_loop(). We don't check the return value: this shouldn't really be able
to fail, and if it does, the following EVP_DecryptUpdate() is almost certain to
fail, so that can catch it.

The decryption is certain to fail (well, almost certain, but with a very low
probability of success), but this is no worse than at present. This minimal
change means that future benchmarking data should be comparable to previous
benchmarking data.

(This is benchmarking code: don't write real apps like this!)

Fixes #23657

Change-Id: Id581cf30503c1eb766464e315b1f33914040dcf7

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23757)
 2024-04-09 20:27:39 +02:00
Todd Short
6b566687b5 Fix EVP_PKEY_CTX_add1_hkdf_info() behavior 
Fix #23448

`EVP_PKEY_CTX_add1_hkdf_info()` behaves like a `set1` function.

Fix the setting of the parameter in the params code.
Update the TLS_PRF code to also use the params code.
Add tests.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23456)
 2024-04-09 20:19:07 +02:00
slontis
56e4d112ae Add demo for ECDH key exchange 
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22916)
 2024-04-09 20:15:31 +02:00
Stephan Wurm
8120223773 apps: ca,req,x509: Add explicit start and end dates options 
- Added options `-not_before` (start date) and `-not-after` (end date)
  for explicit setting of the validity period of a certificate in the
  apps `ca`, `req` and `x509`
- The new options accept time strings or "today"
- In app `ca`, use the new options as aliases of the already existing
  options `-startdate` and `-enddate`
- When used in apps `req` and `x509`, the end date must be >= the start
  date, in app `ca` end date < start date is also accepted
- In any case, `-not-after` overrides the `-days` option
- Added helper function `check_cert_time_string` to validate given
  certificate time strings
- Use the new helper function in apps `ca`, `req` and `x509`
- Moved redundant code for time string checking into `set_cert_times`
  helper function.
- Added tests for explicit start and end dates in apps `req` and `x509`
- test: Added auxiliary functions for parsing fields from `-text`
  formatted output to `tconversion.pl`
- CHANGES: Added to new section 3.4

Signed-off-by: Stephan Wurm <atomisirsi@gsklan.de>

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21716)
 2024-04-09 20:13:31 +02:00
slontis
4514e02cdf Check range of RSA plaintext and ciphertext when using no padding. 
Fixes #24051

RSA with 'no padding' corresponds to RSAEP/RSADP.
The code was not checking the lower bounds.
The bounds are specified in SP800-56Br2, section 7.1.1.1 and 7.1.2.1
Note that RFC8017 expresses the range in a sentence using the word
between, and there is some ambiguity in this.
The upper bounds have change to match the definition in SP800.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24061)
 2024-04-09 14:30:43 +02:00
Matt Caswell
496bc128fd Copyright year updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Release: yes
(cherry picked from commit 3764f200f9)

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24034)
 2024-04-09 13:43:27 +02:00
Richard Levitte
b646179229 Copyright year updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Release: yes
(cherry picked from commit 0ce7d1f355)

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24034)
 2024-04-09 13:43:26 +02:00
Tomas Mraz
111a8fd344 Sync libcrypto.num and libssl.num with 3.3 branch 
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24034)
 2024-04-09 13:43:26 +02:00
Tomas Mraz
eb33768e87 Sync CHANGES.md and NEWS.md with 3.3 branch 
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24034)
 2024-04-09 13:43:26 +02:00
Tomas Mraz
649705961c Update the version to 3.4.0-dev 
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24034)
 2024-04-09 13:43:26 +02:00
Matt Caswell
4a3e8f0830 Add a test for session cache overflow 
Test sessions behave as we expect even in the case that an overflow
occurs when adding a new session into the session cache.

Related to CVE-2024-2511

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24042)
 2024-04-08 12:06:25 +02:00
Matt Caswell
21df7f04f6 Hardening around not_resumable sessions 
Make sure we can't inadvertently use a not_resumable session

Related to CVE-2024-2511

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24042)
 2024-04-08 12:06:25 +02:00
Matt Caswell
03c4b0eab6 Add a CHANGES.md/NEWS.md entry for the unbounded memory growth bug 
Related to CVE-2024-2511

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24042)
 2024-04-08 12:06:25 +02:00
Matt Caswell
7984fa683e Fix unconstrained session cache growth in TLSv1.3 
In TLSv1.3 we create a new session object for each ticket that we send.
We do this by duplicating the original session. If SSL_OP_NO_TICKET is in
use then the new session will be added to the session cache. However, if
early data is not in use (and therefore anti-replay protection is being
used), then multiple threads could be resuming from the same session
simultaneously. If this happens and a problem occurs on one of the threads,
then the original session object could be marked as not_resumable. When we
duplicate the session object this not_resumable status gets copied into the
new session object. The new session object is then added to the session
cache even though it is not_resumable.

Subsequently, another bug means that the session_id_length is set to 0 for
sessions that are marked as not_resumable - even though that session is
still in the cache. Once this happens the session can never be removed from
the cache. When that object gets to be the session cache tail object the
cache never shrinks again and grows indefinitely.

CVE-2024-2511

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24042)
 2024-04-08 12:06:25 +02:00
Matt Caswell
cfeaf33a26 Extend the multi_resume test for simultaneous resumptions 
Test what happens if the same session gets resumed multiple times at the
same time - and one of them gets marked as not_resumable.

Related to CVE-2024-2511

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24042)
 2024-04-08 12:06:25 +02:00
Matt Caswell
0447cd690f Add a test for session cache handling 
Repeatedly create sessions to be added to the cache and ensure we never
exceed the expected size.

Related to CVE-2024-2511

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24042)
 2024-04-08 12:06:04 +02:00
Jiangning Liu
e7f1afe4f7 Enable SHA3 unrolling and EOR3 optimization for Ampere 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23929)
 2024-04-08 11:54:29 +02:00
Randall S. Becker
0d2a5f600c NonStop: Do not call sleep() with a 0 value 
This change ensures that sleep(0) is not invoked to cause unexpected
duplicate thread context switches when _REENTRANT is specified.

Fixes: #24009

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24012)

(cherry picked from commit c89fe57449)
 2024-04-05 16:07:47 +02:00
Richard Levitte
a19553cd87 Diverse small VMS build fixups 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24008)

(cherry picked from commit 1a4b029af5)
 2024-04-04 18:16:05 +02:00
Dmitry Misharov
089271601a downgrade upload-artifact action to v3 
GitHub Enterpise Server is not compatible with upload-artifact@v4+.
https://github.com/actions/upload-artifact/tree/v4

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24029)
 2024-04-04 17:48:43 +02:00
Tomas Mraz
a16f2e7651 openssl-crl(1): The -verify option is implied by -CA* options 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24024)
 2024-04-04 17:45:26 +02:00
Tomas Mraz
e898c36731 DEFINE_STACK_OF.pod: Fix prototypes of sk_TYPE_free/zero() 
They take non-const STACK_OF(TYPE)* argument.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24023)
 2024-04-04 10:46:51 +02:00
Kurt Roeckx
84756fe206 Fix syntax of dependabot.yml 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23899)
 2024-04-04 08:47:08 +02:00
Warner Losh
9aad59c224 posix_async: FreeBSD also defines {make|swap|get|set}context 
FreeBSD also defines {make|swap|get|set}context for backward
compatibility, despite also exposing POSIX_VERSION 200809L
in FreeBSD 15-current.

Note: There's no fallback for POSIX_VERSION 200809 without
these routines, so maybe that should be a #error?

CLA: Trivial

Sponsored by:		Netflix

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23885)
 2024-04-04 08:45:13 +02:00
Tomas Mraz
de8e79e064 Add design document about handing some MAX defines 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/23883)
 2024-04-04 08:43:53 +02:00
slontis
e817766c0f Add 'documentation policy' link to CONTRIBUTING guide. 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23875)
 2024-04-04 08:41:40 +02:00
slontis
5e908e6068 Update Documentation for EVP_DigestSign, EVP_DigestVerify. 
Fixes #23075

In OpenSSL 3.2 EVP_DigestSign and EVP_DigestVerify
were changed so that a flag is set once these functions
do a one-shot sign or verify operation. This PR updates the
documentation to match the behaviour.

Investigations showed that prior to 3.2 different key
type behaved differently if multiple calls were done.

By accident X25519 and X448 would produce the same signature,
but ECDSA and RSA remembered the digest state between calls,
so the signature was different when multiple calls were done.

Because of this undefined behaviour something needed to be done,
so keeping the 'only allow it to be called once' behaviour
seems a reasonable approach.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23834)
 2024-04-04 08:39:38 +02:00
Job Snijders
2410cb42e6 Align 'openssl req' string_mask docs to how the software really works 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23699)
 2024-04-04 08:35:41 +02:00
willmafh
5962c717c4 typo fix 
CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23675)
 2024-04-04 08:34:17 +02:00
willmafh
0af048e4c3 SSL_alert_desc_string_long(): Delete unnecessary underline 
It is not present in other alert description strings.

CLA: trivial

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23675)
 2024-04-04 08:33:21 +02:00
Drokov Pavel
90849b520b Remove receiving of unused return value 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/23276)
 2024-04-04 08:31:16 +02:00
Tomas Mraz
81b7aa7186 Workaround the relocation truncated to fit problem on m68k builds 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24028)
 2024-04-03 12:41:21 +02:00
Jiasheng Jiang
882a387d0d rsa/rsa_pmeth.c: Add the checks for the EVP_MD_CTX_get_size() 
Add the checks for the return value of EVP_MD_CTX_get_size() before explicitly
cast them to size_t to avoid the integer overflow.

Fixes: 75d44c0452 ("Store digests as EVP_MD instead of a NID.")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23953)
 2024-04-03 11:21:29 +02:00
Adrien Zinger
c45ca0656f Fix GCC compilation -Waggressive-loop-optimizations 
GCC 13.1.0 were reporting a compilation warning with -O2/3 and
-Waggressive-loop-optimizations. GCC is raising an undefined behavior in the
while loop. Replace the while loop with a memset call at the top of the
function.

Fixes #21088

CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23898)
 2024-04-02 13:21:59 -04:00
Hugo Landau
5673680022 BIO_s_connect: Do not set keepalive on dgram sockets 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24015)
 2024-04-02 19:04:10 +02:00
Vladimir Kotal
15585af97e Document change of -verify behavior in crl and req apps 
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23983)
 2024-04-02 18:42:49 +02:00
pohsingwu
23fd48da04 Use RFC 5869 test case for HKDF self-test 
According to NIST SP 800-131Ar2 section 8, the length of the
key-derivation key shall be at least 112 bits.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23833)
 2024-04-02 18:25:14 +02:00
Bernd Edlinger
294782f3b5 Remove handling of NULL sig param in ossl_ecdsa_deterministic_sign 
The handling of sig=NULL was broken in this function, but since it
is only used internally and was never called with sig=NULL, it is
better to return an error in that case.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23529)
 2024-04-02 17:47:29 +02:00
Bernd Edlinger
1fa2bf9b18 Fix handling of NULL sig parameter in ECDSA_sign and similar 
The problem is, that it almost works to pass sig=NULL to the
ECDSA_sign, ECDSA_sign_ex and DSA_sign, to compute the necessary
space for the resulting signature.
But since the ECDSA signature is non-deterministic
(except when ECDSA_sign_setup/ECDSA_sign_ex are used)
the resulting length may be different when the API is called again.
This can easily cause random memory corruption.
Several internal APIs had the same issue, but since they are
never called with sig=NULL, it is better to make them return an
error in that case, instead of making the code more complex.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23529)
 2024-04-02 17:47:29 +02:00
Bernd Edlinger
387418893e Fix openssl req with -addext subjectAltName=dirName 
The syntax check of the -addext fails because the
X509V3_CTX is used to lookup the referenced section,
but the wrong configuration file is used, where only
a default section with all passed in -addext lines is available.
Thus it was not possible to use the subjectAltName=dirName:section
as an -addext parameter.  Probably other extensions as well.

This change affects only the syntax check, the real extension
was already created with correct parameters.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23669)
 2024-04-02 17:35:25 +02:00
Hubert Kario
36e2fbe38b ASYNC_start_job: more readable documentation for handling ASYNC* APIs 
Signed-off-by: Hubert Kario <hkario@redhat.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23941)
 2024-04-02 10:45:30 -04:00
Jiasheng Jiang
e53a7ccd11 Alter the check 
Alter the check since 0 md size is an error.

Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/23940)
 2024-04-02 10:31:10 -04:00
Jiasheng Jiang
165797c7d8 ssl/ssl_lib.c: Add the check before cast from int to unsigned 
Add the check before cast from int to unsigned to avoid integer overflow since EVP_MD_get_size() may return negative numbers.

Fixes: 919ba00942 ("DANE support structures, constructructors and accessors")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/23940)
 2024-04-02 10:31:10 -04:00
dependabot[bot]
de85587911 Bump actions/setup-python from 5.0.0 to 5.1.0 
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.0.0 to 5.1.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5.0.0...v5.1.0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
CLA: trivial

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23977)
 2024-04-02 15:52:27 +02:00
Simo Sorce
693c479a2c Explicitly state what -keys does 
Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/23919)
 2024-04-02 15:31:10 +02:00
Jiasheng Jiang
d53497670d Alter the variable name 
Alter the variable name to make it more meaningful.

Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23942)
 2024-04-02 05:37:00 -04:00
Jiasheng Jiang
bcf81f742d ssl/tls13_enc.c: Replace size_t with int and add the checks 
Replace the type of variables with int to avoid implicit cast when they are assigned by EVP_MD_get_size().
Moreover, add the checks to avoid integer overflow.

Fixes: 6612d87b89 ("Use the correct size for TLSv1.3 finished keys")
Fixes: 34574f193b ("Add support for TLS1.3 secret generation")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23942)
 2024-04-02 05:37:00 -04:00
Jiasheng Jiang
9f6a48749a ssl/t1_lib.c: Add checks for the EVP_MD_get_size() 
Add checks for the EVP_MD_get_size() to avoid unexpected negative numbers.

Fixes: b362ccab5c ("Security framework.")
Fixes: 0fe3db251a ("Use size of server key when selecting signature algorithm.")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/23943)
 2024-04-02 05:23:54 -04:00
Jiasheng Jiang
68d6dd3354 rands/drbg_hash.c: Add checks for the EVP_MD_get_size() 
Add checks for the EVP_MD_get_size() to avoid integer overflow and then explicitly cast from int to size_t.

Fixes: 8bf3665196 ("Added DRBG_HMAC & DRBG_HASH + Added defaults for setting DRBG for master/public/private + renamed generate_counter back to reseed_counter + generated new cavs data tests")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23944)
 2024-04-02 05:07:02 -04:00
Neil Horman
5f8b812931 Add locking to atomic operations in rw/rcu tests 
I neglected to add locks to the calls to CRYPTO_atomic_add in these
test, which on newer compilers is fine, as atomic operations are
defined.  However on older compilers the __ATOMIC_ACQ_REL definition is
missing causing these function to be implemented using an rwlock, which
when NULL causes the locks to fail.

Fix this my creating the lock and using them appropriately

Fixes #24000

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/24001)
 2024-04-02 04:12:16 -04:00
Jiasheng Jiang
81f2b0420a rands/drbg_hmac.c: Add checks for the EVP_MD_get_size() 
Add checks for the EVP_MD_get_size() to avoid integer overflow and then explicitly cast from int to size_t.

Fixes: 8bf3665196 ("Added DRBG_HMAC & DRBG_HASH + Added defaults for setting DRBG for master/public/private + renamed generate_counter back to reseed_counter + generated new cavs data tests")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23945)
 2024-04-01 16:02:08 -04:00
Jiasheng Jiang
e97f468589 macs/kmac_prov.c: Add checks for the EVP_MD_get_size() 
Add checks for the EVP_MD_get_size() to avoid integer overflow and then explicitly cast from int to size_t.

Fixes: 6e624a6453 ("KMAC implementation using EVP_MAC")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23946)
 2024-04-01 15:16:44 -04:00
Jiasheng Jiang
6c0f154750 signature/rsa_sig.c: Add checks for the EVP_MD_get_size() 
Add checks for the EVP_MD_get_size() to avoid integer overflow and then explicitly cast from int to size_t.

Fixes: 6f4b766315 ("PROV: add RSA signature implementation")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23949)
 2024-04-01 14:11:52 -04:00
Jiasheng Jiang
7638f4016a kdfs/hmacdrbg_kdf.c: Add checks for the EVP_MD_get_size() 
Add checks for the EVP_MD_get_size() to avoid integer overflow and then explicitly cast from int to size_t.

Fixes: f3090fc710 ("Implement deterministic ECDSA sign (RFC6979)")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23950)
 2024-04-01 13:58:16 -04:00
Jiasheng Jiang
ef9ac2f9b8 test/bad_dtls_test.c: Add checks for the EVP_MD_CTX_get_size() 
Add the check for the EVP_MD_CTX_get_size() to avoid integer overflow when it is implicitly casted from int to size_t in evp_pkey_ctx_store_cached_data().
The call path is do_PRF() -> EVP_PKEY_CTX_add1_tls1_prf_seed() -> evp_pkey_ctx_set1_octet_string() -> EVP_PKEY_CTX_ctrl() -> evp_pkey_ctx_store_cached_data().

Fixes: 16938284cf ("Add basic test for Cisco DTLS1_BAD_VER and record replay handling")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23952)
 2024-04-01 13:13:46 -04:00
Jiasheng Jiang
99fe4c1066 Add OPENSSL_free to avoid mem leak 
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23955)
 2024-04-01 12:59:17 -04:00
Jiasheng Jiang
18a30b5637 store/store_lib.c: Add the checks for the EVP_MD_CTX_get_size() 
Add the checks for the return value of EVP_MD_CTX_get_size() before explicitly cast them to size_t to avoid the integer overflow.

Fixes: fac8673b8a ("STORE: Add the possibility to search for specific information")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23955)
 2024-04-01 12:59:17 -04:00
Jiasheng Jiang
15e06b12ee dsa/dsa_pmeth.c: Add the checks for the EVP_MD_CTX_get_size() 
Add the checks for the return value of EVP_MD_CTX_get_size() before explicitly cast them to size_t to avoid the integer overflow.

Fixes: 9d04f83410 ("Add DSA digest length checks.")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23954)
 2024-03-30 14:49:37 -04:00
Jiasheng Jiang
56e63f570b x509/x509_set.c: Add the check for the EVP_MD_CTX_get_size() 
Add the check for the return value of EVP_MD_CTX_get_size() to avoid invalid negative numbers.

Fixes: 786dd2c22c ("Add support for custom signature parameters")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23956)
 2024-03-30 09:23:56 -04:00
Jiasheng Jiang
2b6f307721 Break the if statement up into 2 if statements 
Break the if statement up into 2 if statements to avoid call
EVP_MD_get_size() twice.

Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23959)
 2024-03-30 09:05:32 -04:00
Jiasheng Jiang
64963c8b7a signature/sm2_sig.c: Add the check for the EVP_MD_CTX_get_size() 
Add the check for the return value of EVP_MD_CTX_get_size() to avoid invalid negative numbers.

Fixes: d0b79f8631 ("Add SM2 signature algorithm to default provider")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23959)
 2024-03-30 09:05:31 -04:00
Alex Bozarth
4169d58c85 Allow provider sigalgs in SignatureAlgorithms conf 
Though support for provider-based signature algorithms was added in
ee58915 this functionality did not work with the SignatureAlgorithms
configuration command. If SignatureAlgorithms is set then the provider
sigalgs are not used and instead it used the default value.

This PR adds a check against the provider-base sigalg list when parsing
the SignatureAlgorithms value.

Based-on-patch-by: Martin Schmatz <mrt@zurich.ibm.com>
Fixes #22761

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/22779)
 2024-03-29 21:54:38 +01:00
Job Snijders
397051a40d Reject setting invalid CSR versions 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23965)
 2024-03-29 15:48:00 -04:00
Jiasheng Jiang
e582b2b22b rsa/rsa_ameth.c: Add the check for the EVP_MD_get_size() 
Add the check for the EVP_MD_get_size() to avoid invalid negative numbers.

Fixes: 17c63d1cca ("RSA PSS ASN1 signing method")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23973)
 2024-03-29 15:34:32 -04:00
Neil Horman
1967539e21 Fix threadstest wrapping again 
Stochastic failures in the RCU test on MACOSX are occuring.  Due to beta
release, disabling this test on MACOSX until post 3.3 release

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23967)
 2024-03-26 10:27:23 -04:00
Tomas Mraz
e7d5d61b66 Update gost-engine submodule to fix the CI 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/23773)
 2024-03-26 15:09:22 +01:00
Vladimir Kotal
6af739b79b apps/req,crl: exit with 1 on verification failure 
Fixes #23771

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/23773)
 2024-03-26 15:08:36 +01:00
Viliam Lejčík
a4cbffcd89 Add NULL check before accessing PKCS7 encrypted algorithm 
Printing content of an invalid test certificate causes application crash, because of NULL dereference:

user@user:~/openssl$ openssl pkcs12 -in test/recipes/80-test_pkcs12_data/bad2.p12 -passin pass: -info
MAC: sha256, Iteration 2048
MAC length: 32, salt length: 8
PKCS7 Encrypted data: Segmentation fault (core dumped)

Added test cases for pkcs12 bad certificates

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23632)
 2024-03-25 18:26:24 +01:00
Jiasheng Jiang
87e747000f Replace size_t with int and add the check for the EVP_MD_get_size() 
Replace the type of "digest_size" with int to avoid implicit conversion when it is assigned by EVP_MD_get_size().
Moreover, add the check for the "digest_size".

Fixes: 29ce1066bc ("Update the demos/README file because it is really old. New demos should provide best practice for API use. Add demonstration for computing a SHA3-512 digest - digest/EVP_MD_demo")
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23924)
 2024-03-25 17:49:03 +01:00
Jiasheng Jiang
f13ddaab69 Replace unsigned with int 
Replace the type of "digest_length" with int to avoid implicit conversion when it is assigned by EVP_MD_get_size().
Otherwise, it may pass the following check and cause the integer overflow error when EVP_MD_get_size() returns negative numbers.
Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23922)
 2024-03-25 17:45:33 +01:00
sashan
01eaf20385 fix demos/sslecho/main.c so it builds on OpenBSD too 
trying to build `demos/sslecho/main.c` shipped by current openssl
fails with error as follows:
```
cc -I../../include -g -Wall   -c -o main.o main.c
main.c:35:24: error: variable has incomplete type 'struct sockaddr_in'
    struct sockaddr_in addr;
                       ^
main.c:35:12: note: forward declaration of 'struct sockaddr_in'
    struct sockaddr_in addr;
           ^
main.c:46:32: error: use of undeclared identifier 'INADDR_ANY'
        addr.sin_addr.s_addr = INADDR_ANY;
                               ^
main.c:152:24: error: variable has incomplete type 'struct sockaddr_in'
    struct sockaddr_in addr;
                       ^
main.c:152:12: note: forward declaration of 'struct sockaddr_in'
    struct sockaddr_in addr;
           ^
3 errors generated.
gmake: *** [<builtin>: main.o] Error 1
```

including `netinet/in.h` fixes the build

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23936)
 2024-03-25 13:49:47 +01:00
Tomas Mraz
7394de95b6 Add 3.3 and 3.2 branches to Coveralls builds 
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23938)
 2024-03-25 13:44:27 +01:00
Randall S. Becker
4a9e48f727 Correct OSSL_sleep for NonStop PUT model by introducing sleep(). 
This fix also removes SPT model support as it was previously deprecated.
Upcoming threading models on the platform should be supportable without change
to this method.

Fixes: #23923
Fixes: #23927
Fixes: #23928

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23926)
 2024-03-23 09:22:31 -04:00
Yavor Georgiev
24109dca5a Don’t use the recvmmsg dgram method on Android <5 
recvmmsg and sendmmsg were only added to Android’s C library in version 5, starting with API Level 21.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23754)
 2024-03-22 16:59:41 +01:00
olszomal
f1c14f1853 Fixed a typo and grammar in openssl-ts.pod 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23913)
 2024-03-22 16:50:20 +01:00
Dmitry Misharov
395ab201a7 fix uploading artifacts for paramertrized jobs 
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23933)
 2024-03-22 12:02:58 +01:00
Neil Horman
b50c174ee3 Make counters in rcu/rw threads torture test 64 bit 
Its possible in some conditions for the rw/rcu torture tests to wrap the
counter, leading to false positive failures, make them 64 bits to avoid
this

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23724)
 2024-03-22 11:06:59 +01:00
Dmitry Misharov
ada9d8c785 Add M1 macOS runner to some workflows 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23724)
 2024-03-22 11:06:34 +01:00
Jakov Smolić
347f05e893 riscv: Fix remaining asm checks 
There are additional asm checks which don't check for OPENSSL_CPUID_OBJ
causing the build to still fail on riscv [1], so fix them in the same
manner as ff27959769

[1] https://bugs.gentoo.org/923956
Fixes: https://github.com/openssl/openssl/issues/22871

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23752)

(cherry picked from commit daf1f8d64f)
 2024-03-22 11:03:36 +01:00
Matt Hauck
53ef123f48 Update FIPS hmac key documentation 
The documentation is slightly incorrect about the FIPS hmac key.

CLA: trivial

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23846)
 2024-03-22 10:48:14 +01:00
Hugo Landau
9abcf11696 Move artifact upload code into the shell script 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23551)
 2024-03-21 17:57:50 +00:00
Hugo Landau
f2db70962c Experimental support for uploading qlog artifacts 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23551)
 2024-03-21 17:57:50 +00:00
2018 changed files with 174462 additions and 18620 deletions
Download patch file Download diff file Expand all files Collapse all files

5
.gitattributes vendored
View file

@ -2,11 +2,16 @@
*.der binary
/fuzz/corpora/** binary
*.pfx binary
test/recipes/15-test_ml_dsa_codecs_data/*.dat binary
test/recipes/15-test_ml_kem_codecs_data/*.dat binary
# For git archive
fuzz/corpora/** export-ignore
Configurations/*.norelease.conf export-ignore
# We generally avoid anything with a name starting with a period.
# However, .ctags.d is precious, so we don't ignore that.
.* export-ignore
.ctags.d !export-ignore
util/mktar.sh export-ignore
krb5 export-ignore
pyca-cryptography export-ignore

19
.github/dependabot.yml vendored
View file

@ -4,13 +4,12 @@ updates:
directory: "/"
schedule:
interval: "daily"
commit-message:
prefix: "Dependabot update\n\nCLA: trivial\n\n"
include: "scope"
labels:
- "dependencies"
- "cla: trivial"
- "approval: review pending"
- "approval: otc review pending"
reviewers:
- "openssl/committers"
commit-message:
prefix: "Dependabot update\n\nCLA: trivial\n\n"
include: "scope"
labels:
- "dependencies"
- "cla: trivial"
- "approval: review pending"
reviewers:
- "openssl/committers"

25
.github/workflows/build_quic_interop_container.yml vendored Normal file
View file

@ -0,0 +1,25 @@
name: "Build openssl interop container from master"
on:
schedule:
- cron: '40 02 * * *'
workflow_dispatch:
jobs:
update_quay_container:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: "log in to quay.io"
run: |
docker login -u openssl-ci+machine -p ${{ secrets.QUAY_IO_PASSWORD }} quay.io
- name: "Build container"
run: |
cd test/quic-openssl-docker/
docker build -t quay.io/openssl-ci/openssl-quic-interop:latest .
- name: "Push to quay"
run: |
docker push quay.io/openssl-ci/openssl-quic-interop:latest

341
.github/workflows/ci.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -26,7 +26,7 @@ env:
jobs:
check_update:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- name: install unifdef
run: |
@ -45,7 +45,7 @@ jobs:
run: git diff --exit-code
check_docs:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: config
@ -65,25 +65,28 @@ jobs:
# We are not as strict with libraries, but rather adapt to what's
# expected to be available in a certain version of each platform.
check-ansi:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: config
run: CPPFLAGS=-ansi ./config --banner=Configured no-asm no-makedepend enable-buildtest-c++ enable-fips --strict-warnings -D_DEFAULT_SOURCE && perl configdata.pm --dump
run: CPPFLAGS='-ansi -D_XOPEN_SOURCE=1 -D_POSIX_C_SOURCE=200809L' ./config --banner=Configured enable-sslkeylog no-asm no-secure-memory no-makedepend enable-buildtest-c++ enable-fips --strict-warnings && perl configdata.pm --dump
- name: make
run: make -s -j4
basic_gcc:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: localegen
run: sudo locale-gen tr_TR.UTF-8
- name: fipsvendor
# Make one fips build use a customized FIPS vendor
run: echo "FIPS_VENDOR=CI" >> VERSION.dat
- name: config
# enable-quic is on by default, but we leave it here to check we're testing the explicit enable somewhere
run: CC=gcc ./config --banner=Configured enable-fips enable-quic --strict-warnings && perl configdata.pm --dump
run: CC=gcc ./config --banner=Configured enable-demos enable-h3demo enable-sslkeylog enable-fips enable-quic --strict-warnings && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -91,16 +94,24 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test
- name: check fipsvendor
run: |
util/wrap.pl -fips apps/openssl list -providers | grep 'name: CI FIPS Provider for OpenSSL$'
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@basic-gcc"
path: artifacts.tar.gz
basic_clang:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
run: CC=clang ./config --banner=Configured no-fips --strict-warnings && perl configdata.pm --dump
run: CC=clang ./config --banner=Configured enable-demos enable-h3demo no-fips --strict-warnings && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -108,36 +119,84 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@basic-clang"
path: artifacts.tar.gz
self-hosted:
if: github.repository == 'openssl/openssl'
strategy:
matrix:
os: [freebsd-13.2, ubuntu-arm64-22.04]
runs-on: ${{ matrix.os }}-self-hosted
continue-on-error: true
linux-arm64:
runs-on: ${{ github.repository == 'openssl/openssl' && 'linux-arm64' || 'ubuntu-24.04-arm' }}
steps:
- uses: actions/checkout@v4
- name: config
run: ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
run: ./config enable-demos enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
- name: config dump
run: ./configdata.pm --dump
- name: make
run: make -j4
- name: get cpu info
run: ./util/opensslwrap.sh version -c
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@linux-arm64"
path: artifacts.tar.gz
freebsd-x86_64:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: config
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: |
sudo pkg install -y gcc perl5
./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
- name: config dump
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: ./configdata.pm --dump
- name: make
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: make -j4
- name: make test
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
run: |
./util/opensslwrap.sh version -c
.github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@BSD-x86_64"
path: artifacts.tar.gz
minimal:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
run: ./config --banner=Configured --strict-warnings no-bulk no-pic no-asm -DOPENSSL_NO_SECURE_MEMORY -DOPENSSL_SMALL_FOOTPRINT && perl configdata.pm --dump
run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-bulk no-pic no-asm -DOPENSSL_NO_SECURE_MEMORY -DOPENSSL_SMALL_FOOTPRINT && perl configdata.pm --dump
- name: make
run: make -j4 # verbose, so no -s here
- name: get cpu info
@ -145,16 +204,21 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@minimal"
path: artifacts.tar.gz
no-deprecated:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
run: ./config --banner=Configured --strict-warnings no-deprecated enable-fips && perl configdata.pm --dump
run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-deprecated enable-fips && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -162,16 +226,21 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@no-deprecated"
path: artifacts.tar.gz
no-shared-ubuntu:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
run: ./config --banner=Configured --strict-warnings no-shared no-fips && perl configdata.pm --dump
run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-shared no-fips && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -179,17 +248,25 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@no-shared-ubuntu"
path: artifacts.tar.gz
no-shared-macos:
runs-on: macos-latest
if: github.server_url == 'https://github.com'
strategy:
fail-fast: false
matrix:
os: [macos-13, macos-14]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
run: ./config --banner=Configured --strict-warnings no-shared no-fips && perl configdata.pm --dump
run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-shared no-fips && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -197,10 +274,15 @@ jobs:
sysctl machdep.cpu
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@no-shared-${{ matrix.os }}"
path: artifacts.tar.gz
non-caching:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -210,7 +292,7 @@ jobs:
sudo cat /proc/sys/vm/mmap_rnd_bits
sudo sysctl -w vm.mmap_rnd_bits=28
- name: config
run: ./config --banner=Configured --debug enable-asan enable-ubsan no-cached-fetch no-fips no-dtls no-tls1 no-tls1-method no-tls1_1 no-tls1_1-method no-async && perl configdata.pm --dump
run: ./config --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ubsan no-cached-fetch no-fips no-dtls no-tls1 no-tls1-method no-tls1_1 no-tls1_1-method no-async && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -218,10 +300,15 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0 TESTS="-test_fuzz* -test_ssl_* -test_sslapi -test_evp -test_cmp_http -test_verify -test_cms -test_store -test_enc -[01][0-9]"
run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="-test_fuzz* -test_ssl_* -test_sslapi -test_evp -test_cmp_http -test_verify -test_cms -test_store -test_enc -[01][0-9]"
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@non-caching"
path: artifacts.tar.gz
address_ub_sanitizer:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -231,7 +318,7 @@ jobs:
sudo cat /proc/sys/vm/mmap_rnd_bits
sudo sysctl -w vm.mmap_rnd_bits=28
- name: config
run: ./config --banner=Configured --debug enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
run: ./config --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -239,10 +326,15 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0
run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@address_ub_sanitizer"
path: artifacts.tar.gz
fuzz_tests:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -260,10 +352,16 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0 TESTS="test_fuzz*"
run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="test_fuzz*"
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@fuzz_tests"
path: artifacts.tar.gz
if-no-files-found: ignore
memory_sanitizer:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -274,7 +372,7 @@ jobs:
sudo sysctl -w vm.mmap_rnd_bits=28
- name: config
# --debug -O1 is to produce a debug build that runs in a reasonable amount of time
run: CC=clang ./config --banner=Configured --debug -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
run: CC=clang ./config --banner=Configured --debug no-shared -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips no-slh-dsa && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -282,10 +380,15 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0
run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@memory_sanitizer"
path: artifacts.tar.gz
threads_sanitizer:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -295,7 +398,7 @@ jobs:
sudo cat /proc/sys/vm/mmap_rnd_bits
sudo sysctl -w vm.mmap_rnd_bits=28
- name: config
run: CC=clang ./config --banner=Configured no-fips --strict-warnings -fsanitize=thread && perl configdata.pm --dump
run: CC=clang ./config --banner=Configured no-shared no-fips --strict-warnings -g -fsanitize=thread && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -303,10 +406,15 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make V=1 TESTS="test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic*" test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test V=1 TESTS="test_lhash test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic*"
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@threads_sanitizer"
path: artifacts.tar.gz
enable_non-default_options:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -314,7 +422,7 @@ jobs:
- name: modprobe tls
run: sudo modprobe tls
- name: config
run: ./config --banner=Configured --strict-warnings no-ec enable-ssl-trace enable-zlib enable-zlib-dynamic enable-crypto-mdebug enable-egd enable-ktls enable-fips no-threads && perl configdata.pm --dump
run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-ec enable-ssl-trace enable-zlib enable-zlib-dynamic enable-crypto-mdebug enable-egd enable-ktls enable-fips no-threads && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -322,10 +430,15 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@enable_non-default_options"
path: artifacts.tar.gz
full_featured:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -335,11 +448,11 @@ jobs:
- name: Enable sctp
run: sudo modprobe sctp
- name: Enable auth in sctp
run: sudo sysctl -w net.sctp.auth_enable=1
run: sudo sysctl -w net.sctp.auth_enable=1
- name: install extra config support
run: sudo apt-get -y install libsctp-dev abigail-tools libzstd-dev zstd
- name: config
run: ./config --banner=Configured --strict-warnings enable-ktls enable-fips enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-ssl3 enable-ssl3-method enable-trace enable-zlib enable-zstd && perl configdata.pm --dump
run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo enable-ktls enable-fips enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-trace enable-zlib enable-zstd && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -347,16 +460,21 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@full_featured"
path: artifacts.tar.gz
no-legacy:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
run: ./config --banner=Configured --strict-warnings no-legacy enable-fips && perl configdata.pm --dump
run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-legacy enable-fips && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -364,16 +482,21 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@no-legacy"
path: artifacts.tar.gz
legacy:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
run: ./config --banner=Configured -Werror --debug no-afalgeng no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-fips && perl configdata.pm --dump
run: ./config --banner=Configured -Werror --debug no-afalgeng enable-demos enable-h3demo no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-fips && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
@ -381,7 +504,12 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: .github/workflows/make-test
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@legacy"
path: artifacts.tar.gz
# out-of-source-and-install checks multiple things at the same time:
# - That building, testing and installing works from an out-of-source
@ -389,7 +517,7 @@ jobs:
# - That building, testing and installing works with a read-only source
# tree
out-of-readonly-source-and-install-ubuntu:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
@ -405,7 +533,7 @@ jobs:
mkdir ./install
- name: config
run: |
../source/config --banner=Configured enable-fips enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
../source/config --banner=Configured enable-demos enable-h3demo enable-fips enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
perl configdata.pm --dump
working-directory: ./build
- name: make
@ -417,15 +545,23 @@ jobs:
./util/opensslwrap.sh version -c
working-directory: ./build
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: ../source/.github/workflows/make-test
working-directory: ./build
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@out-of-readonly-source-and-install-ubuntu"
path: build/artifacts.tar.gz
- name: make install
run: make install
working-directory: ./build
out-of-readonly-source-and-install-macos:
runs-on: macos-latest
if: github.server_url == 'https://github.com'
strategy:
fail-fast: false
matrix:
os: [macos-13, macos-14]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
with:
@ -441,7 +577,7 @@ jobs:
mkdir ./install
- name: config
run: |
../source/config --banner=Configured enable-fips enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
../source/config --banner=Configured enable-fips enable-demos enable-h3demo enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
perl configdata.pm --dump
working-directory: ./build
- name: make
@ -453,14 +589,19 @@ jobs:
./util/opensslwrap.sh version -c
working-directory: ./build
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
run: ../source/.github/workflows/make-test
working-directory: ./build
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "ci@out-of-readonly-source-and-install-${{ matrix.os }}"
path: build/artifacts.tar.gz
- name: make install
run: make install
working-directory: ./build
external-tests:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
external-tests-misc:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
@ -468,9 +609,9 @@ jobs:
- name: package installs
run: |
sudo apt-get update
sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy
sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy gdb
- name: install cpanm and Test2::V0 for gost_engine testing
uses: perl-actions/install-with-cpanm@v1
uses: perl-actions/install-with-cpanm@stable
with:
install: Test2::V0
- name: setup hostname workaround
@ -479,6 +620,7 @@ jobs:
run: ./config --banner=Configured --strict-warnings --debug no-afalgeng enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump
- name: make
run: make -s -j4
- uses: dtolnay/rust-toolchain@stable
- name: get cpu info
run: |
cat /proc/cpuinfo
@ -487,13 +629,42 @@ jobs:
run: make test TESTS="test_external_gost_engine"
- name: test external krb5
run: make test TESTS="test_external_krb5"
- name: test external_tlsfuzzer
- name: test external tlsfuzzer
run: make test TESTS="test_external_tlsfuzzer"
- name: test external Cloudflare quiche
run: make test TESTS="test_external_cf_quiche" VERBOSE=1
- name: test ability to produce debuginfo files
run: |
make debuginfo
gdb < <(echo -e "file ./libcrypto.so.3\nquit") > ./results
grep -q "Reading symbols from.*libcrypto\.so\.3\.debug" results
external-tests-providers:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: package installs
run: |
sudo apt-get update
sudo apt-get -yq install meson pkg-config gnutls-bin libnss3-tools libnss3-dev libsofthsm2 opensc expect
- name: config
run: ./config --banner=Configured --strict-warnings --debug enable-external-tests && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: test external oqs-provider
run: make test TESTS="test_external_oqsprovider"
# Disabled temporarily: https://github.com/latchset/pkcs11-provider/pull/525#discussion_r1982805969
# - name: test external pkcs11-provider
# run: make test TESTS="test_external_pkcs11_provider" VERBOSE=1
external-test-pyca:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
external-tests-pyca:
runs-on: ubuntu-latest
strategy:
matrix:
RUST:
@ -509,7 +680,7 @@ jobs:
- name: make
run: make -s -j4
- name: Setup Python
uses: actions/setup-python@v5.0.0
uses: actions/setup-python@v5.3.0
with:
python-version: ${{ matrix.PYTHON }}
- uses: dtolnay/rust-toolchain@master
@ -521,21 +692,3 @@ jobs:
./util/opensslwrap.sh version -c
- name: test external pyca
run: make test TESTS="test_external_pyca" VERBOSE=1
external-test-cf-quiche:
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Configure OpenSSL
run: ./config --banner=Configured --strict-warnings enable-external-tests && perl configdata.pm --dump
- name: make
run: make -s -j4
- uses: dtolnay/rust-toolchain@stable
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: test external Cloudflare quiche
run: make test TESTS="test_external_cf_quiche" VERBOSE=1

31
.github/workflows/compiler-zoo.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -19,17 +19,11 @@ jobs:
matrix:
zoo: [
{
cc: gcc-7,
distro: ubuntu-20.04
}, {
cc: gcc-8,
distro: ubuntu-20.04
}, {
cc: gcc-9,
distro: ubuntu-20.04
distro: ubuntu-22.04
}, {
cc: gcc-10,
distro: ubuntu-20.04
distro: ubuntu-22.04
}, {
cc: gcc-11,
distro: ubuntu-22.04
@ -40,27 +34,12 @@ jobs:
cc: gcc-13,
distro: ubuntu-22.04,
gcc-ppa-name: ubuntu-toolchain-r/test
}, {
cc: clang-6.0,
distro: ubuntu-20.04
}, {
cc: clang-7,
distro: ubuntu-20.04
}, {
cc: clang-8,
distro: ubuntu-20.04
}, {
cc: clang-9,
distro: ubuntu-20.04
}, {
cc: clang-10,
distro: ubuntu-20.04
}, {
cc: clang-11,
distro: ubuntu-20.04
distro: ubuntu-22.04
}, {
cc: clang-12,
distro: ubuntu-20.04
distro: ubuntu-22.04
}, {
cc: clang-13,
distro: ubuntu-22.04

79
.github/workflows/coveralls.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -7,34 +7,74 @@
name: Coverage
# Run once a day
on:
schedule:
- cron: '49 0 * * *'
- cron: '15 02 * * *'
workflow_dispatch:
inputs:
branch:
description: Branch to measure coverage
required: true
default: master
extra_config:
description: Extra options for configuration script
default: ""
permissions:
contents: read
jobs:
define-matrix:
runs-on: ubuntu-latest
outputs:
branches: ${{ steps.branches.outputs.branches }}
steps:
- name: Define branches
id: branches
run: |
if [ "${{ github.event_name}}" = "workflow_dispatch" ]; then
MATRIX=$(cat << EOF
[{
"branch": "${{ github.event.inputs.branch }}",
"extra_config": "${{ github.event.inputs.extra_config }}"
}]
EOF
)
else
MATRIX=$(cat << EOF
[{
"branch": "openssl-3.4",
"extra_config": "no-afalgeng enable-fips enable-tfo"
}, {
"branch": "openssl-3.3",
"extra_config": "no-afalgeng enable-fips enable-tfo"
}, {
"branch": "openssl-3.2",
"extra_config": "no-afalgeng enable-fips enable-tfo"
}, {
"branch": "openssl-3.1",
"extra_config": "no-afalgeng enable-fips"
}, {
"branch": "openssl-3.0",
"extra_config": "no-afalgeng enable-fips"
}, {
"branch": "master",
"extra_config": "no-afalgeng enable-fips enable-tfo"
}]
EOF
)
fi
echo "branches<<EOF"$'\n'"$MATRIX"$'\n'EOF >> "$GITHUB_OUTPUT"
coverage:
needs: define-matrix
permissions:
checks: write # for coverallsapp/github-action to create new checks
contents: read # for actions/checkout to fetch code
strategy:
fail-fast: false
matrix:
branches: [
{
branch: openssl-3.1,
extra_config: no-afalgeng enable-fips
}, {
branch: openssl-3.0,
extra_config: no-afalgeng enable-fips
}, {
branch: master,
extra_config: no-afalgeng enable-fips enable-tfo
}
]
branches: ${{ fromJSON(needs.define-matrix.outputs.branches) }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
@ -50,7 +90,7 @@ jobs:
sudo apt-get -yq install lcov
sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy
- name: install Test2::V0 for gost_engine testing
uses: perl-actions/install-with-cpanm@v1
uses: perl-actions/install-with-cpanm@stable
with:
install: Test2::V0
- name: setup hostname workaround
@ -66,17 +106,16 @@ jobs:
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} TESTS='-test_external_krb5'
run: make test TESTS='-test_external_krb5' EVP_TEST_EXTENDED=1
- name: generate coverage info
run: lcov -d . -c
--exclude "${PWD}/test/*"
--exclude "${PWD}/test/helpers/*"
--exclude "${PWD}/test/testutil/*"
--exclude "${PWD}/fuzz/*"
--exclude "/usr/include/*"
--ignore-errors mismatch
-o ./lcov.info
- name: Coveralls upload
uses: coverallsapp/github-action@v2.2.3
uses: coverallsapp/github-action@v2.3.2
with:
github-token: ${{ secrets.github_token }}
git-branch: ${{ matrix.branches.branch }}

44
.github/workflows/cross-compiles.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -50,25 +50,31 @@ jobs:
}, {
arch: aarch64-linux-gnu,
libs: libc6-dev-arm64-cross,
target: linux-aarch64
target: linux-aarch64,
fips: no
}, {
arch: alpha-linux-gnu,
libs: libc6.1-dev-alpha-cross,
target: linux-alpha-gcc
target: linux-alpha-gcc,
fips: no
}, {
arch: arm-linux-gnueabi,
libs: libc6-dev-armel-cross,
target: linux-armv4,
fips: no,
tests: -test_includes -test_store -test_x509_store
}, {
arch: arm-linux-gnueabihf,
libs: libc6-dev-armhf-cross,
target: linux-armv4,
fips: no,
tests: -test_includes -test_store -test_x509_store
}, {
# gcc hppa seems to have some potential compiler issues
# with -O2 on this platform, reduce optimization to -01
arch: hppa-linux-gnu,
libs: libc6-dev-hppa-cross,
target: -static linux-generic32,
target: -static -O1 linux-generic32,
fips: no,
tests: -test_includes -test_store -test_x509_store
}, {
@ -92,26 +98,28 @@ jobs:
arch: mipsel-linux-gnu,
libs: libc6-dev-mipsel-cross,
target: linux-mips32,
fips: no,
tests: -test_includes -test_store -test_x509_store
}, {
arch: powerpc64le-linux-gnu,
libs: libc6-dev-ppc64el-cross,
# The default compiler for this platform on Ubuntu 20.04 seems
# buggy and causes test failures. Dropping the optimisation level
# resolves it.
target: -O2 linux-ppc64le
target: linux-ppc64le,
fips: no
}, {
arch: riscv64-linux-gnu,
libs: libc6-dev-riscv64-cross,
target: linux64-riscv64
target: linux64-riscv64,
fips: no
}, {
arch: s390x-linux-gnu,
libs: libc6-dev-s390x-cross,
target: linux64-s390x -Wno-stringop-overflow
target: linux64-s390x -Wno-stringop-overflow,
fips: no
}, {
arch: sh4-linux-gnu,
libs: libc6-dev-sh4-cross,
target: no-async linux-latomic,
fips: no,
tests: -test_includes -test_store -test_x509_store
},
@ -126,7 +134,7 @@ jobs:
}, {
arch: m68k-linux-gnu,
libs: libc6-dev-m68k-cross,
target: -mcfv4e linux-latomic -Wno-stringop-overflow no-quic,
target: -mcfv4e -mxgot linux-latomic -Wno-stringop-overflow no-quic,
tests: none
}, {
arch: mips-linux-gnu,
@ -148,7 +156,7 @@ jobs:
tests: none
}
]
runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
runs-on: ubuntu-latest
steps:
- name: install package repository
if: matrix.platform.ppa != ''
@ -201,18 +209,24 @@ jobs:
- name: make all tests
if: github.event_name == 'push' && matrix.platform.tests == ''
run: |
make test HARNESS_JOBS=${HARNESS_JOBS:-4} \
.github/workflows/make-test \
TESTS="-test_afalg" \
QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
- name: make some tests
if: github.event_name == 'push' && matrix.platform.tests != 'none' && matrix.platform.tests != ''
run: |
make test HARNESS_JOBS=${HARNESS_JOBS:-4} \
.github/workflows/make-test \
TESTS="${{ matrix.platform.tests }} -test_afalg" \
QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
- name: make evp tests
if: github.event_name == 'pull_request' && matrix.platform.tests != 'none'
run: |
make test HARNESS_JOBS=${HARNESS_JOBS:-4} \
.github/workflows/make-test \
TESTS="test_evp*" \
QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
- name: save artifacts
uses: actions/upload-artifact@v4
with:
name: "cross-compiles@${{ matrix.platform.arch }}"
path: artifacts.tar.gz
if-no-files-found: ignore

23
.github/workflows/deploy-docs-openssl-org.yml vendored Normal file
View file

@ -0,0 +1,23 @@
name: "Trigger docs.openssl.org deployment"
on:
push:
branches:
- "openssl-3.[0-9]+"
- "master"
paths:
- "doc/man*/**"
jobs:
trigger:
runs-on: ubuntu-latest
steps:
- name: "Trigger deployment workflow"
run: |
gh workflow run -f branch=${{ github.ref_name }} deploy-site.yaml
sleep 3
RUN_ID=$(gh run list -w deploy-site.yaml -L 1 --json databaseId -q ".[0].databaseId")
gh run watch ${RUN_ID} --exit-status
env:
GH_REPO: "openssl/openssl-docs"
GH_TOKEN: ${{ secrets.OPENSSL_MACHINE_TOKEN }}

2
.github/workflows/fips-checksums.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy

3
.github/workflows/fips-label.yml vendored
View file

@ -80,6 +80,7 @@ jobs:
}
}
- name: 'Cleanup artifact'
if: ${{ github.event.workflow_run.conclusion == 'success' }}
run: rm artifact.zip pr_num
- name: 'Download abidiff artifact'
@ -133,7 +134,7 @@ jobs:
issue_number: pr_num,
owner: context.repo.owner,
repo: context.repo.repo,
name: 'severity: fips change'
name: 'severity: ABI change'
});
}
}

26
.github/workflows/fuzz-checker.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -21,28 +21,28 @@ jobs:
{
name: AFL,
config: enable-fuzz-afl no-module,
install: afl++-clang,
install: afl++,
cc: afl-clang-fast
}, {
name: libFuzzer,
config: enable-fuzz-libfuzzer enable-asan enable-ubsan,
libs: --with-fuzzer-lib=/usr/lib/llvm-12/lib/libFuzzer.a --with-fuzzer-include=/usr/include/clang/12/include/fuzzer,
install: libfuzzer-12-dev,
cc: clang-12,
linker: clang++-12,
config: enable-fuzz-libfuzzer enable-asan enable-ubsan -fno-sanitize=function,
libs: --with-fuzzer-lib=/usr/lib/llvm-18/lib/libFuzzer.a --with-fuzzer-include=/usr/include/clang/18/include/fuzzer,
install: libfuzzer-18-dev,
cc: clang-18,
linker: clang++-18,
tests: -test_memleak
}, {
name: libFuzzer+,
config: enable-fuzz-libfuzzer enable-asan enable-ubsan -fsanitize-coverage=trace-cmp -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION,
libs: --with-fuzzer-lib=/usr/lib/llvm-12/lib/libFuzzer.a --with-fuzzer-include=/usr/include/clang/12/include/fuzzer,
config: enable-fuzz-libfuzzer enable-asan enable-ubsan -fno-sanitize=function -fsanitize-coverage=trace-cmp -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION,
libs: --with-fuzzer-lib=/usr/lib/llvm-18/lib/libFuzzer.a --with-fuzzer-include=/usr/include/clang/18/include/fuzzer,
extra: enable-fips enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment enable-tls1_3 enable-weak-ssl-ciphers enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-nextprotoneg,
install: libfuzzer-12-dev,
cc: clang-12,
linker: clang++-12,
install: libfuzzer-18-dev,
cc: clang-18,
linker: clang++-18,
tests: -test_memleak
}
]
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
steps:
- name: install packages
run: |

8
.github/workflows/interop-tests.yml vendored
View file

@ -6,12 +6,14 @@
name: Interoperability tests with GnuTLS and NSS
on:
schedule:
- cron: '0 6 * * *'
- cron: '55 02 * * *'
workflow_dispatch:
jobs:
test:
runs-on: ubuntu-22.04
container:
image: docker.io/fedora:39
image: docker.io/fedora:40
options: --sysctl net.ipv6.conf.lo.disable_ipv6=0
timeout-minutes: 90
strategy:
@ -48,6 +50,6 @@ jobs:
- name: Run interop tests
run: |
cd interop
tmt run -av plans -n interop tests -f "tag: interop-openssl & tag: interop-$COMPONENT" provision -h local execute -h tmt --interactive
tmt run -av plans -n interop tests -f "tag: interop-openssl & tag: interop-$COMPONENT" provision -h local --feeling-safe execute -h tmt --interactive
openssl version
echo "Finished - important to prevent unwanted output truncating"

2
.github/workflows/main.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy

42
.github/workflows/make-release.yml vendored Normal file
View file

@ -0,0 +1,42 @@
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
name: "Make release"
on:
push:
tags:
- "openssl-*"
jobs:
release:
runs-on: "releaser"
steps:
- name: "Checkout"
uses: "actions/checkout@v4"
with:
fetch-depth: 1
ref: ${{ github.ref_name }}
github-server-url: "https://github.openssl.org/"
repository: "openssl/openssl"
token: ${{ secrets.GHE_TOKEN }}
path: ${{ github.ref_name }}
- name: "Prepare assets"
run: |
cd ${{ github.ref_name }}
./util/mktar.sh
mkdir assets && mv ${{ github.ref_name }}.tar.gz assets/ && cd assets
openssl sha1 -r ${{ github.ref_name }}.tar.gz > ${{ github.ref_name }}.tar.gz.sha1
openssl sha256 -r ${{ github.ref_name }}.tar.gz > ${{ github.ref_name }}.tar.gz.sha256
gpg -u ${{ vars.signing_key_uid }} -o ${{ github.ref_name }}.tar.gz.asc -sba ${{ github.ref_name }}.tar.gz
- name: "Create release"
env:
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
run: |
VERSION=$(echo ${{ github.ref_name }} | cut -d "-" -f 2-)
PRE_RELEASE=$([[ ${{ github.ref_name }} =~ alpha|beta ]] && echo "-p" || echo "")
gh release create ${{ github.ref_name }} $PRE_RELEASE -t "OpenSSL $VERSION" -d --notes " " -R ${{ github.repository }} ${{ github.ref_name }}/assets/*

43
.github/workflows/make-test vendored Executable file
View file

@ -0,0 +1,43 @@
#!/usr/bin/env bash
set -eo pipefail
cleanup() {
# Remove if nothing was generated.
[ -d artifacts ] && find artifacts -type d -empty -delete
}
trap cleanup EXIT
# Make a central directory to store all output artifacts of our test run to
# avoid having to configure multiple upload-artifacts steps in the workflow
# file.
OSSL_CI_ARTIFACTS_PATH="artifacts/"
if [ -n "${GITHUB_RUN_NUMBER}" ]; then
OSSL_CI_ARTIFACTS_PATH="artifacts/github-${GITHUB_JOB}-${GITHUB_RUN_NUMBER}-${GITHUB_RUN_ID}/"
fi
mkdir -p "$OSSL_CI_ARTIFACTS_PATH"
export OSSL_CI_ARTIFACTS_PATH="$(cd "$OSSL_CI_ARTIFACTS_PATH"; pwd)"
# Run the tests. This might fail, but we need to capture artifacts anyway.
set +e
make test HARNESS_JOBS=${HARNESS_JOBS:-4} "$@"
RESULT=$?
set -e
# Move an interesting subset of the test-runs data we want into the artifacts
# staging directory.
for test_name in quic_multistream; do
if [ -d "test-runs/test_${test_name}" ]; then
mv "test-runs/test_${test_name}" "$OSSL_CI_ARTIFACTS_PATH/"
fi
done
# Log the artifact tree.
echo "::group::List of artifact files generated"
echo "Test suite exited with $RESULT, artifacts path is $OSSL_CI_ARTIFACTS_PATH"
(cd "$OSSL_CI_ARTIFACTS_PATH"; find . -type f | sort)
echo "::endgroup::"
echo "Archive artifacts"
tar -czf artifacts.tar.gz $OSSL_CI_ARTIFACTS_PATH
exit $RESULT

106
.github/workflows/os-zoo.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -9,7 +9,8 @@ name: OS Zoo CI
on:
schedule:
- cron: '0 5 * * *'
- cron: '50 02 * * *'
workflow_dispatch:
permissions:
contents: read
@ -21,23 +22,23 @@ jobs:
matrix:
tag: [edge, latest]
cc: [gcc, clang]
branch: [openssl-3.0, openssl-3.1, master]
runs-on: ubuntu-latest
container:
image: docker.io/library/alpine:${{ matrix.tag }}
env:
# https://www.openwall.com/lists/musl/2022/02/16/14
EXTRA_CFLAGS: ${{ matrix.cc == 'clang' && '-Wno-sign-compare' || '' }}
# See https://www.openwall.com/lists/musl/2022/02/16/14
# for the reason why -Wno-sign-compare is needed with clang
# -Wno-stringop-overflow is needed to silence a bogus
# warning on new fortify-headers with gcc
EXTRA_CFLAGS: ${{ matrix.cc == 'clang' && '-Wno-sign-compare' || matrix.tag == 'edge' && '-Wno-stringop-overflow' || '' }}
CC: ${{ matrix.cc }}
steps:
- name: install packages
run: apk --no-cache add build-base perl linux-headers ${{ matrix.cc }}
- uses: actions/checkout@v4
with:
ref: ${{ matrix.branch }}
- name: config
run: |
./config --banner=Configured no-shared -Wall -Werror enable-fips --strict-warnings -DOPENSSL_USE_IPV6=0 \
./config --banner=Configured no-shared -Wall -Werror enable-fips --strict-warnings \
${EXTRA_CFLAGS}
- name: config dump
run: ./configdata.pm --dump
@ -54,7 +55,6 @@ jobs:
strategy:
fail-fast: false
matrix:
branch: [openssl-3.0, openssl-3.1, master]
zoo:
- image: docker.io/library/debian:10
install: apt-get update && apt-get install -y gcc make perl
@ -83,8 +83,6 @@ jobs:
container: ${{ matrix.zoo.image }}
steps:
- uses: actions/checkout@v4
with:
ref: ${{ matrix.branch }}
- name: install packages
run: ${{ matrix.zoo.install }}
- name: config
@ -104,13 +102,10 @@ jobs:
strategy:
fail-fast: false
matrix:
branch: [openssl-3.0, openssl-3.1, master]
os: [macos-11, macos-12, macos-13]
os: [macos-13, macos-14, macos-15]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
with:
ref: ${{ matrix.branch }}
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
@ -130,13 +125,10 @@ jobs:
strategy:
fail-fast: false
matrix:
branch: [openssl-3.0, openssl-3.1, master]
os: [windows-2019, windows-2022]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
with:
ref: ${{ matrix.branch }}
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- uses: ilammy/msvc-dev-cmd@v1
@ -167,12 +159,8 @@ jobs:
working-directory: _build
run: nmake test VERBOSE_FAILURE=yes HARNESS_JOBS=4
self-hosted:
strategy:
matrix:
os: [freebsd-13.2, ubuntu-arm64-22.04]
runs-on: ${{ matrix.os }}-self-hosted
continue-on-error: true
linux-arm64:
runs-on: linux-arm64
steps:
- uses: actions/checkout@v4
- name: config
@ -185,3 +173,73 @@ jobs:
run: ./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
linux-ppc64le:
runs-on: linux-ppc64le
steps:
- uses: actions/checkout@v4
- name: config
run: ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
- name: config dump
run: ./configdata.pm --dump
- name: make
run: make -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
linux-s390x:
runs-on: linux-s390x
steps:
- uses: actions/checkout@v4
- name: config
run: ./config enable-fips enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
- name: config dump
run: ./configdata.pm --dump
- name: make
run: make -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
freebsd-x86_64:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: config
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: |
sudo pkg install -y gcc perl5
./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
- name: config dump
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: ./configdata.pm --dump
- name: make
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
shutdown_vm: false
run: make -j4
- name: make test
uses: cross-platform-actions/action@v0.26.0
with:
operating_system: freebsd
version: "13.4"
run: |
./util/opensslwrap.sh version -c
.github/workflows/make-test

272
.github/workflows/prov-compat-label.yml vendored Normal file
View file

@ -0,0 +1,272 @@
# Copyright 2023-2024 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
# This verifies that FIPS and legacy providers built against some earlier
# released versions continue to run against the current branch.
name: Provider compatibility for PRs
on: [pull_request]
permissions:
contents: read
env:
opts: enable-rc5 enable-md2 enable-ssl3 enable-weak-ssl-ciphers enable-zlib
jobs:
fips-releases:
if: ${{ contains(github.event.pull_request.labels.*.name,'extended tests') }}
strategy:
matrix:
release: [
# Formally released versions should be added here.
# `dir' it the directory inside the tarball.
# `tgz' is the name of the tarball.
# `url' is the download URL.
{
dir: openssl-3.0.0,
tgz: openssl-3.0.0.tar.gz,
url: "https://www.openssl.org/source/old/3.0/openssl-3.0.0.tar.gz",
},
{
dir: openssl-3.0.8,
tgz: openssl-3.0.8.tar.gz,
url: "https://www.openssl.org/source/openssl-3.0.8.tar.gz",
},
{
dir: openssl-3.0.9,
tgz: openssl-3.0.9.tar.gz,
url: "https://www.openssl.org/source/openssl-3.0.9.tar.gz",
},
{
dir: openssl-3.1.2,
tgz: openssl-3.1.2.tar.gz,
url: "https://www.openssl.org/source/openssl-3.1.2.tar.gz",
},
]
runs-on: ubuntu-latest
steps:
- name: create download directory
run: mkdir downloads
- name: download release source
run: wget --no-verbose ${{ matrix.release.url }}
working-directory: downloads
- name: unpack release source
run: tar xzf downloads/${{ matrix.release.tgz }}
- name: localegen
run: sudo locale-gen tr_TR.UTF-8
- name: config release
run: |
./config --banner=Configured enable-shared enable-fips ${{ env.opts }}
working-directory: ${{ matrix.release.dir }}
- name: config dump release
run: ./configdata.pm --dump
working-directory: ${{ matrix.release.dir }}
- name: make release
run: make -s -j4
working-directory: ${{ matrix.release.dir }}
- name: create release artifacts
run: |
tar cz -H posix -f ${{ matrix.release.tgz }} ${{ matrix.release.dir }}
- name: show module versions from release
run: |
./util/wrap.pl -fips apps/openssl list -provider-path providers \
-provider base \
-provider default \
-provider fips \
-provider legacy \
-providers
working-directory: ${{ matrix.release.dir }}
- uses: actions/upload-artifact@v4
with:
name: ${{ matrix.release.tgz }}
path: ${{ matrix.release.tgz }}
retention-days: 7
development-branches:
if: ${{ contains(github.event.pull_request.labels.*.name,'extended tests') }}
strategy:
matrix:
branch: [
# Currently supported FIPS capable branches should be added here.
# `name' is the branch name used to checkout out.
# `dir' directory that will be used to build and test in.
# `tgz' is the name of the tarball use to keep the artifacts of
# the build.
{
name: '',
dir: PR,
tgz: PR.tar.gz,
}, {
name: openssl-3.0,
dir: branch-3.0,
tgz: branch-3.0.tar.gz,
}, {
name: openssl-3.1,
dir: branch-3.1,
tgz: branch-3.1.tar.gz,
}, {
name: openssl-3.2,
dir: branch-3.2,
tgz: branch-3.2.tar.gz,
}, {
name: openssl-3.3,
dir: branch-3.3,
tgz: branch-3.3.tar.gz,
}, {
name: openssl-3.4,
dir: branch-3.4,
tgz: branch-3.4.tar.gz,
}, {
name: master,
dir: branch-master,
tgz: branch-master.tar.gz,
},
]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
path: ${{ matrix.branch.dir }}
repository: openssl/openssl
ref: ${{ matrix.branch.name }}
- name: localegen
run: sudo locale-gen tr_TR.UTF-8
- name: config branch
run: |
./config --banner=Configured enable-shared enable-fips ${{ env.opts }}
working-directory: ${{ matrix.branch.dir }}
- name: config dump current
run: ./configdata.pm --dump
working-directory: ${{ matrix.branch.dir }}
- name: make branch
run: make -s -j4
working-directory: ${{ matrix.branch.dir }}
- name: create branch artifacts
run: |
tar cz -H posix -f ${{ matrix.branch.tgz }} ${{ matrix.branch.dir }}
- name: show module versions from branch
run: |
./util/wrap.pl -fips apps/openssl list -provider-path providers \
-provider base \
-provider default \
-provider fips \
-provider legacy \
-providers
working-directory: ${{ matrix.branch.dir }}
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
working-directory: ${{ matrix.branch.dir }}
- uses: actions/upload-artifact@v4
with:
name: ${{ matrix.branch.tgz }}
path: ${{ matrix.branch.tgz }}
retention-days: 7
cross-testing:
if: ${{ contains(github.event.pull_request.labels.*.name,'extended tests') }}
needs: [fips-releases, development-branches]
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
# These can't be figured out earlier and included here as a variable
# substitution.
#
# Note that releases are not used as a test environment for
# later providers. Problems in these situations ought to be
# caught by cross branch testing before the release.
tree_a: [ branch-3.4, branch-3.3, branch-3.2, branch-3.1, branch-3.0,
openssl-3.0.0, openssl-3.0.8, openssl-3.0.9, openssl-3.1.2 ]
tree_b: [ PR ]
include:
- tree_a: PR
tree_b: branch-master
- tree_a: PR
tree_b: branch-3.4
- tree_a: PR
tree_b: branch-3.3
- tree_a: PR
tree_b: branch-3.2
- tree_a: PR
tree_b: branch-3.1
- tree_a: PR
tree_b: branch-3.0
steps:
- name: early exit checks
id: early_exit
run: |
if [ "${{ matrix.tree_a }}" = "${{ matrix.tree_b }}" ]; \
then \
echo "Skipping because both are the same version"; \
exit 1; \
fi
continue-on-error: true
- uses: actions/download-artifact@v4.1.8
if: steps.early_exit.outcome == 'success'
with:
name: ${{ matrix.tree_a }}.tar.gz
- name: unpack first build
if: steps.early_exit.outcome == 'success'
run: tar xzf "${{ matrix.tree_a }}.tar.gz"
- uses: actions/download-artifact@v4.1.8
if: steps.early_exit.outcome == 'success'
with:
name: ${{ matrix.tree_b }}.tar.gz
- name: unpack second build
if: steps.early_exit.outcome == 'success'
run: tar xzf "${{ matrix.tree_b }}.tar.gz"
- name: set up cross validation of FIPS from A with tree from B
if: steps.early_exit.outcome == 'success'
run: |
cp providers/fips.so ../${{ matrix.tree_b }}/providers/
cp providers/fipsmodule.cnf ../${{ matrix.tree_b }}/providers/
working-directory: ${{ matrix.tree_a }}
- name: show module versions from cross validation
if: steps.early_exit.outcome == 'success'
run: |
./util/wrap.pl -fips apps/openssl list -provider-path providers \
-provider base \
-provider default \
-provider fips \
-provider legacy \
-providers
working-directory: ${{ matrix.tree_b }}
- name: get cpu info
if: steps.early_exit.outcome == 'success'
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
working-directory: ${{ matrix.tree_b }}
- name: run cross validation tests of FIPS from A with tree from B
if: steps.early_exit.outcome == 'success'
run: |
make test HARNESS_JOBS=${HARNESS_JOBS:-4}
working-directory: ${{ matrix.tree_b }}

39
.github/workflows/provider-compatibility.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2023-2024 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -10,12 +10,15 @@
name: Provider compatibility across versions
# NOTE: if this is being run on pull_request, it will **not** use the pull
# request's branch. It is hardcoded to use the master branch.
#
on: #[pull_request]
# Please note there is no point in running this job on PR as the tests
# will always run against the tips of the branches in the main repository
# and not the branch from the PR.
# Use the `extended tests` label to run provider compatibility checks
# on PRs.
on:
schedule:
- cron: '0 15 * * *'
- cron: '10 02 * * *'
workflow_dispatch:
permissions:
contents: read
@ -31,7 +34,7 @@ jobs:
# Formally released versions should be added here.
# `dir' it the directory inside the tarball.
# `tgz' is the name of the tarball.
# `utl' is the download URL.
# `url' is the download URL.
{
dir: openssl-3.0.0,
tgz: openssl-3.0.0.tar.gz,
@ -116,6 +119,18 @@ jobs:
name: openssl-3.1,
dir: branch-3.1,
tgz: branch-3.1.tar.gz,
}, {
name: openssl-3.2,
dir: branch-3.2,
tgz: branch-3.2.tar.gz,
}, {
name: openssl-3.3,
dir: branch-3.3,
tgz: branch-3.3.tar.gz,
}, {
name: openssl-3.4,
dir: branch-3.4,
tgz: branch-3.4.tar.gz,
}, {
name: master,
dir: branch-master,
@ -187,9 +202,11 @@ jobs:
# Note that releases are not used as a test environment for
# later providers. Problems in these situations ought to be
# caught by cross branch testing before the release.
tree_a: [ branch-master, branch-3.1, branch-3.0,
tree_a: [ branch-master, branch-3.4, branch-3.3,
branch-3.2, branch-3.1, branch-3.0,
openssl-3.0.0, openssl-3.0.8, openssl-3.0.9, openssl-3.1.2 ]
tree_b: [ branch-master, branch-3.1, branch-3.0 ]
tree_b: [ branch-master, branch-3.4, branch-3.3,
branch-3.2, branch-3.1, branch-3.0 ]
steps:
- name: early exit checks
id: early_exit
@ -201,7 +218,7 @@ jobs:
fi
continue-on-error: true
- uses: actions/download-artifact@v4
- uses: actions/download-artifact@v4.1.8
if: steps.early_exit.outcome == 'success'
with:
name: ${{ matrix.tree_a }}.tar.gz
@ -209,7 +226,7 @@ jobs:
if: steps.early_exit.outcome == 'success'
run: tar xzf "${{ matrix.tree_a }}.tar.gz"
- uses: actions/download-artifact@v4
- uses: actions/download-artifact@v4.1.8
if: steps.early_exit.outcome == 'success'
with:
name: ${{ matrix.tree_b }}.tar.gz

6
.github/workflows/run-checker-ci.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -27,10 +27,12 @@ jobs:
no-dtls,
no-ec,
no-ecx,
no-ml-dsa,
no-ml-kem,
no-http,
no-legacy,
no-sock,
enable-ssl-trace,
no-ssl-trace,
no-stdio,
no-threads,
no-thread-pool,

67
.github/workflows/run-checker-daily.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -10,7 +10,9 @@ name: Run-checker daily
on:
schedule:
- cron: '0 6 * * *'
- cron: '30 02 * * *'
workflow_dispatch:
permissions:
contents: read
@ -43,12 +45,12 @@ jobs:
no-cmac,
no-comp,
enable-crypto-mdebug,
no-crypto-mdebug,
enable-crypto-mdebug-backtrace,
no-crypto-mdebug-backtrace,
no-ct,
enable-demos,
no-deprecated,
no-des,
no-devcryptoeng,
# enable-devcryptoeng, # Cannot work on Linux
no-docs,
no-dsa,
no-dtls1,
@ -58,25 +60,24 @@ jobs:
no-ecdh,
no-ecdsa,
enable-ec_nistp_64_gcc_128,
no-ec_nistp_64_gcc_128,
enable-egd,
no-egd,
no-engine,
no-external-tests,
# enable-external-tests, # Requires extra setup
enable-fips,
enable-fips enable-acvp-tests,
enable-fips no-tls1_3,
no-fuzz-afl,
no-fuzz-libfuzzer,
enable-fips no-des no-dsa no-ec2m,
# enable-fuzz-afl, # Requires extra setup
# enable-fuzz-libfuzzer, # Requires extra setup
no-gost,
enable-h3demo,
enable-heartbeats,
no-heartbeats,
enable-hqinterop,
no-hw,
no-hw-padlock,
no-idea,
no-makedepend,
enable-md2,
no-md2,
no-md4,
no-mdc2,
no-msan,
@ -89,9 +90,7 @@ jobs:
no-posix-io,
no-psk,
no-rc2,
no-rc4,
enable-rc5,
no-rc5,
no-rdrand,
no-rfc3779,
no-ripemd,
@ -109,9 +108,9 @@ jobs:
no-sock,
no-sse2,
no-ssl,
no-ssl3,
no-ssl3-method,
no-ssl-trace,
enable-ssl3,
enable-ssl3-method,
enable-sslkeylog,
no-static-engine no-shared,
no-tests,
enable-tfo,
@ -120,19 +119,19 @@ jobs:
no-tls1_1-method,
no-tls1_2-method,
no-tls1-method,
no-trace,
enable-trace,
no-ubsan,
no-ui-console,
no-unit-test,
enable-unit-test,
no-uplink,
no-weak-ssl-ciphers,
no-whirlpool,
no-zlib,
enable-zlib-dynamic,
no-zlib-dynamic,
-DOPENSSL_PEDANTIC_ZEROIZATION,
-DOPENSSL_PEDANTIC_ZEROIZATION enable-fips,
-DOPENSSL_NO_BUILTIN_OVERFLOW_CHECKING,
-DSSL3_ALIGN_PAYLOAD=4
-DSSL3_ALIGN_PAYLOAD=4,
-DOPENSSL_TLS_SECURITY_LEVEL=0
]
runs-on: ubuntu-latest
steps:
@ -313,7 +312,7 @@ jobs:
enable_tfo:
strategy:
matrix:
os: [ ubuntu-latest, macos-latest ]
os: [ ubuntu-latest, macos-13, macos-14 ]
runs-on: ${{matrix.os}}
steps:
- uses: actions/checkout@v4
@ -344,3 +343,25 @@ jobs:
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
memory_sanitizer_slh_dsa:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: Adjust ASLR for sanitizer
run: |
sudo cat /proc/sys/vm/mmap_rnd_bits
sudo sysctl -w vm.mmap_rnd_bits=28
- name: config
# --debug -O1 is to produce a debug build that runs in a reasonable amount of time
run: CC=clang ./config --banner=Configured --debug no-shared -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0

58
.github/workflows/run-checker-merge.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -18,23 +18,24 @@ jobs:
fail-fast: false
matrix:
opt: [
enable-asan enable-ubsan no-shared no-asm -DOPENSSL_SMALL_FOOTPRINT,
no-ct,
enable-asan enable-ubsan no-shared no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function,
no-dso,
no-dynamic-engine,
no-ec2m,
no-ec2m enable-fips,
no-engine no-shared,
no-err,
no-filenames,
enable-ubsan no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=alignment,
enable-ubsan no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function,
no-module,
no-ocsp,
no-pinshared,
no-srp,
no-srtp,
no-ts,
no-integrity-only-ciphers,
enable-weak-ssl-ciphers,
enable-zlib,
enable-pie,
]
runs-on: ubuntu-latest
steps:
@ -57,3 +58,50 @@ jobs:
if [ -x apps/openssl ] ; then ./util/opensslwrap.sh version -c ; fi
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
jitter:
runs-on: ubuntu-latest
steps:
- name: checkout openssl
uses: actions/checkout@v4
- name: checkout jitter
uses: actions/checkout@v4
with:
repository: smuellerDD/jitterentropy-library
ref: v3.5.0
path: jitter
- name: build jitter
run: make -C jitter/
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: config
run: ./config --with-rand-seed=none enable-jitter enable-fips-jitter --with-jitter-include=jitter/ --with-jitter-lib=jitter/ -DOPENSSL_DEFAULT_SEED_SRC=JITTER && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
threads_sanitizer_atomic_fallback:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
run: git submodule update --init --depth 1 fuzz/corpora
- name: Adjust ASLR for sanitizer
run: |
sudo cat /proc/sys/vm/mmap_rnd_bits
sudo sysctl -w vm.mmap_rnd_bits=28
- name: config
run: CC=clang ./config --banner=Configured no-shared no-fips --strict-warnings -g -fsanitize=thread -DBROKEN_CLANG_ATOMICS && perl configdata.pm --dump
- name: make
run: make -s -j4
- name: get cpu info
run: |
cat /proc/cpuinfo
./util/opensslwrap.sh version -c
- name: make test
run: make test V=1 TESTS="test_lhash test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic*"

71
.github/workflows/run_quic_interop.yml vendored Normal file
View file

@ -0,0 +1,71 @@
name: "Run openssl quic interop testing"
on:
workflow_run:
workflows: ["Build openssl interop container from master"]
types: [completed]
workflow_dispatch:
jobs:
run_quic_interop_openssl_client:
strategy:
matrix:
tests: [http3, transfer, handshake, retry, chacha20, resumption, multiplexing, ipv6]
servers: [quic-go, ngtcp2, mvfst, quiche, nginx, msquic, haproxy]
exclude:
- servers: msquic
tests: retry
fail-fast: false
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
repository: 'quic-interop/quic-interop-runner'
fetch-depth: 0
- name: Install dependencies
run: |
pip install -r requirements.txt
sudo add-apt-repository ppa:wireshark-dev/stable
sudo apt-get update
sudo apt-get install -y tshark
- name: Patch implementations file
run: |
jq '.openssl = { image: "quay.io/openssl-ci/openssl-quic-interop"
, url: "https://github.com/openssl/openssl"
, role: "both"
}' ./implementations.json > ./implementations.tmp
mv ./implementations.tmp implementations.json
- name: "run interop with openssl client"
run: |
python3 ./run.py -c openssl -t ${{ matrix.tests }} -s ${{ matrix.servers }} --log-dir ./logs-client -d
run_quic_interop_openssl_server:
strategy:
matrix:
tests: [http3, transfer, handshake, retry, chacha20, resumption, amplificationlimit, ipv6]
clients: [quic-go, ngtcp2, mvfst, quiche, msquic, openssl, chrome]
exclude:
- clients: mvfst
tests: amplificationlimit
fail-fast: false
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
repository: 'quic-interop/quic-interop-runner'
fetch-depth: 0
- name: Install dependencies
run: |
pip install -r requirements.txt
sudo add-apt-repository ppa:wireshark-dev/stable
sudo apt-get update
sudo apt-get install -y tshark
- name: Patch implementations file
run: |
jq '.openssl = { image: "quay.io/openssl-ci/openssl-quic-interop"
, url: "https://github.com/openssl/openssl"
, role: "both"
}' ./implementations.json > ./implementations.tmp
mv ./implementations.tmp implementations.json
- name: "run interop with openssl server"
run: |
python3 ./run.py -s openssl -t ${{ matrix.tests }} -c ${{ matrix.clients }} --log-dir ./logs-server -d

39
.github/workflows/static-analysis-on-prem.yml vendored Normal file
View file

@ -0,0 +1,39 @@
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
name: Static Analysis On Prem
on:
schedule:
- cron: '25 02 * * *'
workflow_dispatch:
permissions:
contents: read
jobs:
coverity-analysis:
runs-on: ubuntu-latest
container: quay.io/openssl-ci/coverity-analysis:2024.3.1
steps:
- name: Put license
run: echo ${{ secrets.COVERITY_LICENSE }} | base64 -d > /opt/coverity-analysis/bin/license.dat
- name: Put auth key file
run: |
echo ${{ secrets.COVERITY_AUTH_KEY }} | base64 -d > /auth_key_file.txt
chmod 0600 /auth_key_file.txt
- uses: actions/checkout@v4
- name: Config
run: CC=gcc ./config --banner=Configured --debug enable-fips enable-rc5 enable-md2 enable-ssl3 enable-nextprotoneg enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-shared enable-buildtest-c++ enable-external-tests -DPEDANTIC
- name: Config dump
run: ./configdata.pm --dump
- name: Make
run: cov-build --dir cov-int make -s -j4
- name: Analyze
run: cov-analyze --dir cov-int --strip-path $(pwd)
- name: Commit defects
run: cov-commit-defects --url https://coverity.openssl.org:443 --stream OpenSSL --dir cov-int --auth-key-file /auth_key_file.txt

3
.github/workflows/static-analysis.yml vendored
View file

@ -10,7 +10,8 @@ name: Static Analysis
#Run once a day
on:
schedule:
- cron: '20 0 * * *'
- cron: '20 02 * * *'
workflow_dispatch:
permissions:
contents: read

52
.github/workflows/style-checks.yml vendored Normal file
View file

@ -0,0 +1,52 @@
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
name: Coding style validation
on: [pull_request]
env:
PR_NUMBER: ${{ github.event.number }}
GH_TOKEN: ${{ github.token }}
permissions:
contents: read
jobs:
check-style:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
path: openssl
- name: check style for each commit
working-directory: openssl
shell: bash
run: |
ERRORS_FOUND=0
git fetch origin $GITHUB_BASE_REF:$GITHUB_BASE_REF
REFSTART=$(git rev-parse $GITHUB_BASE_REF)
REFEND=$(git rev-parse HEAD)
echo "Checking from $REFSTART to $REFEND"
echo "::group::Style report for commits $REFSTART..$REFEND"
set +e
./util/check-format-commit.sh $REFSTART..$REFEND
if [ $? -ne 0 ]
then
ERRORS_FOUND=1
fi
set -e
echo "::endgroup::"
SKIP_TEST=$(gh pr view $PR_NUMBER --json labels --jq '.labels[] | select(.name == "style: waived") | .name')
if [ -z "$SKIP_TEST" ]
then
exit $ERRORS_FOUND
else
echo "PR $PR_NUMBER is marked with style: waived, waiving style check errors"
exit 0
fi

47
.github/workflows/windows.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -17,15 +17,17 @@ jobs:
# Run a job for each of the specified target architectures:
strategy:
matrix:
os:
- windows-2019
- windows-2022
platform:
- arch: win64
os: windows-2019
config: enable-fips
- arch: win64
os: windows-2022
config: enable-fips no-thread-pool no-quic
- arch: win32
os: windows-2022
config: --strict-warnings no-fips
runs-on: ${{ github.server_url == 'https://github.com' && matrix.os || format('{0}-self-hosted', matrix.os) }}
runs-on: ${{ matrix.platform.os }}
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -41,7 +43,7 @@ jobs:
- name: config
working-directory: _build
run: |
perl ..\Configure --banner=Configured no-makedepend ${{ matrix.platform.config }}
perl ..\Configure --banner=Configured no-makedepend -DOSSL_WINCTX=openssl ${{ matrix.platform.config }}
perl configdata.pm --dump
- name: build
working-directory: _build
@ -51,6 +53,21 @@ jobs:
with:
url: "https://download.sysinternals.com/files/Coreinfo.zip"
target: _build/coreinfo/
- name: Gather openssl version info
working-directory: _build
run: |
apps/openssl.exe version -v
apps/openssl.exe version -v | %{($_ -split '\s+')[1]}
apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'}
echo "OSSL_VERSION=$(apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'})" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
- name: Set registry keys
working-directory: _build
run: |
echo ${Env:OSSL_VERSION}
reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v ENGINESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32
- name: get cpu info
working-directory: _build
continue-on-error: true
@ -66,7 +83,7 @@ jobs:
run: nmake test VERBOSE_FAILURE=yes TESTS=-test_fuzz* HARNESS_JOBS=4
- name: install
# Run on 64 bit only as 32 bit is slow enough already
if: $${{ matrix.platform.arch == 'win64' }}
if: ${{ matrix.platform.arch == 'win64' }}
run: |
mkdir _dest
nmake install DESTDIR=_dest
@ -75,9 +92,9 @@ jobs:
strategy:
matrix:
os:
- windows-2019
# Reducing CI footprint - windows-2019
- windows-2022
runs-on: ${{ github.server_url == 'https://github.com' && matrix.os || format('{0}-self-hosted', matrix.os) }}
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -88,7 +105,7 @@ jobs:
- name: config
working-directory: _build
run: |
perl ..\Configure --banner=Configured no-makedepend no-shared no-fips enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-trace enable-crypto-mdebug VC-WIN64A-masm
perl ..\Configure --banner=Configured enable-demos no-makedepend no-shared no-fips enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-trace enable-crypto-mdebug -DOSSL_WINCTX=openssl VC-WIN64A-masm
perl configdata.pm --dump
- name: build
working-directory: _build
@ -113,8 +130,8 @@ jobs:
matrix:
os:
- windows-2019
- windows-2022
runs-on: ${{ github.server_url == 'https://github.com' && matrix.os || format('{0}-self-hosted', matrix.os) }}
# Reducing CI footprint - windows-2022
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- name: checkout fuzz/corpora submodule
@ -125,7 +142,7 @@ jobs:
- name: config
working-directory: _build
run: |
perl ..\Configure --banner=Configured no-makedepend no-bulk no-deprecated no-fips no-asm no-threads -DOPENSSL_SMALL_FOOTPRINT
perl ..\Configure --banner=Configured enable-demos no-makedepend no-bulk no-deprecated no-fips no-asm no-threads -DOPENSSL_SMALL_FOOTPRINT -DOSSL_WINCTX=openssl
perl configdata.pm --dump
- name: build
working-directory: _build
@ -155,11 +172,11 @@ jobs:
# - windows-2022
platform:
- arch: win64
config: -DCMAKE_C_COMPILER=gcc --strict-warnings no-fips
config: -DCMAKE_C_COMPILER=gcc --strict-warnings enable-demos no-fips
# are we really learning sth new from win32? So let's save some CO2 for now disabling this
# - arch: win32
# config: -DCMAKE_C_COMPILER=gcc --strict-warnings no-fips
runs-on: ${{ github.server_url == 'https://github.com' && matrix.os || format('{0}-self-hosted', matrix.os) }}
runs-on: ${{ matrix.os }}
env:
CYGWIN_NOWINPATH: 1
SHELLOPTS: igncr

41
.github/workflows/windows_comp.yml vendored
View file

@ -1,4 +1,4 @@
# Copyright 2022-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2022-2024 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -11,6 +11,7 @@ on:
pull_request:
paths:
- 'crypto/comp/*.c'
- '.github/workflows/windows_comp.yml'
push:
paths:
- '**.c'
@ -36,11 +37,27 @@ jobs:
- name: config
working-directory: _build
run: |
perl ..\Configure enable-comp enable-zstd --with-zstd-include=C:\vcpkg\packages\zstd_x64-windows\include --with-zstd-lib=C:\vcpkg\packages\zstd_x64-windows\lib\zstd.lib no-makedepend VC-WIN64A
perl ..\Configure enable-comp enable-zstd --with-zstd-include=C:\vcpkg\packages\zstd_x64-windows\include --with-zstd-lib=C:\vcpkg\packages\zstd_x64-windows\lib\zstd.lib no-makedepend -DOSSL_WINCTX=openssl VC-WIN64A
perl configdata.pm --dump
- name: build
working-directory: _build
run: nmake
- name: Gather openssl version info
working-directory: _build
run: |
$env:Path+=";C:\vcpkg\packages\zstd_x64-windows\bin"
apps/openssl.exe version -v
apps/openssl.exe version -v | %{($_ -split '\s+')[1]}
apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'}
echo "OSSL_VERSION=$(apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'})" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
- name: Set registry keys
working-directory: _build
run: |
echo ${Env:OSSL_VERSION}
reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v ENGINESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32
- name: download coreinfo
uses: suisei-cn/actions-download-file@v1.6.0
with:
@ -50,6 +67,7 @@ jobs:
working-directory: _build
continue-on-error: true
run: |
$env:Path+=";C:\vcpkg\packages\zstd_x64-windows\bin"
7z.exe x coreinfo/Coreinfo.zip
./Coreinfo64.exe -accepteula -f
./apps/openssl.exe version -c
@ -78,11 +96,27 @@ jobs:
- name: config
working-directory: _build
run: |
perl ..\Configure enable-comp enable-brotli --with-brotli-include=C:\vcpkg\packages\brotli_x64-windows\include --with-brotli-lib=C:\vcpkg\packages\brotli_x64-windows\lib no-makedepend VC-WIN64A
perl ..\Configure enable-comp enable-brotli --with-brotli-include=C:\vcpkg\packages\brotli_x64-windows\include --with-brotli-lib=C:\vcpkg\packages\brotli_x64-windows\lib no-makedepend -DOSSL_WINCTX=openssl VC-WIN64A
perl configdata.pm --dump
- name: build
working-directory: _build
run: nmake
- name: Gather openssl version info
working-directory: _build
run: |
$env:Path+=";C:\vcpkg\packages\brotli_x64-windows\bin"
apps/openssl.exe version -v
apps/openssl.exe version -v | %{($_ -split '\s+')[1]}
apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'}
echo "OSSL_VERSION=$(apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'})" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
- name: Set registry keys
working-directory: _build
run: |
echo ${Env:OSSL_VERSION}
reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v ENGINESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32
- name: download coreinfo
uses: suisei-cn/actions-download-file@v1.6.0
with:
@ -92,6 +126,7 @@ jobs:
working-directory: _build
continue-on-error: true
run: |
$env:Path+=";C:\vcpkg\packages\brotli_x64-windows\bin"
7z.exe x coreinfo/Coreinfo.zip
./Coreinfo64.exe -accepteula -f
./apps/openssl.exe version -c

75
.gitignore vendored
View file

@ -35,6 +35,7 @@
/include/openssl/bio.h
/include/openssl/cmp.h
/include/openssl/cms.h
/include/openssl/comp.h
/include/openssl/conf.h
/include/openssl/configuration.h
/include/openssl/crmf.h
@ -54,6 +55,7 @@
/include/openssl/ui.h
/include/openssl/x509.h
/include/openssl/x509v3.h
/include/openssl/x509_acert.h
/include/openssl/x509_vfy.h
/include/openssl/core_names.h
/include/internal/param_names.h
@ -65,6 +67,7 @@
doc/man1/openssl-*.pod
# Auto generated der files
providers/common/der/der_slh_dsa_gen.c
providers/common/der/der_digests_gen.c
providers/common/der/der_dsa_gen.c
providers/common/der/der_ec_gen.c
@ -72,6 +75,8 @@ providers/common/der/der_ecx_gen.c
providers/common/der/der_rsa_gen.c
providers/common/der/der_wrap_gen.c
providers/common/der/der_sm2_gen.c
providers/common/der/der_ml_dsa_gen.c
providers/common/include/prov/der_slh_dsa.h
providers/common/include/prov/der_dsa.h
providers/common/include/prov/der_ec.h
providers/common/include/prov/der_ecx.h
@ -79,6 +84,7 @@ providers/common/include/prov/der_rsa.h
providers/common/include/prov/der_digests.h
providers/common/include/prov/der_wrap.h
providers/common/include/prov/der_sm2.h
providers/common/include/prov/der_ml_dsa.h
# error code files
/crypto/err/openssl.txt.old
@ -116,6 +122,70 @@ providers/common/include/prov/der_sm2.h
/test/threadstest_fips
/test/timing_load_creds
# Demo applications
/demos/bio/client-arg
/demos/bio/client-conf
/demos/bio/saccept
/demos/bio/sconnect
/demos/bio/server-arg
/demos/bio/server-cmod
/demos/bio/server-conf
/demos/cipher/aesccm
/demos/cipher/aesgcm
/demos/cipher/aeskeywrap
/demos/cipher/ariacbc
/demos/cms/cms_comp
/demos/cms/cms_ddec
/demos/cms/cms_dec
/demos/cms/cms_denc
/demos/cms/cms_enc
/demos/cms/cms_sign
/demos/cms/cms_sign2
/demos/cms/cms_uncomp
/demos/cms/cms_ver
/demos/digest/BIO_f_md
/demos/digest/EVP_MD_demo
/demos/digest/EVP_MD_stdin
/demos/digest/EVP_MD_xof
/demos/encode/ec_encode
/demos/encode/rsa_encode
/demos/encrypt/rsa_encrypt
/demos/guide/quic-client-block
/demos/guide/quic-client-non-block
/demos/guide/quic-hq-interop
/demos/guide/quic-multi-stream
/demos/guide/tls-client-block
/demos/guide/tls-client-non-block
/demos/http3/libnghttp3.pc
/demos/http3/nghttp3/
/demos/http3/ossl-nghttp3-demo
/demos/kdf/argon2
/demos/kdf/hkdf
/demos/kdf/pbkdf2
/demos/kdf/scrypt
/demos/keyexch/x25519
/demos/mac/cmac-aes256
/demos/mac/gmac
/demos/mac/hmac-sha512
/demos/mac/poly1305
/demos/pkey/EVP_PKEY_DSA_keygen
/demos/pkey/EVP_PKEY_DSA_paramfromdata
/demos/pkey/EVP_PKEY_DSA_paramgen
/demos/pkey/EVP_PKEY_DSA_paramvalidate
/demos/pkey/EVP_PKEY_EC_keygen
/demos/pkey/EVP_PKEY_RSA_keygen
/demos/signature/EVP_DSA_Signature_demo
/demos/signature/EVP_EC_Signature_demo
/demos/signature/EVP_ED_Signature_demo
/demos/signature/rsa_pss_direct
/demos/signature/rsa_pss_hash
/demos/smime/smdec
/demos/smime/smenc
/demos/smime/smsign
/demos/smime/smsign2
/demos/smime/smver
/demos/sslecho/sslecho
# Certain files that get created by tests on the fly
/test-runs
/test/buildtest_*
@ -139,7 +209,6 @@ providers/common/include/prov/der_sm2.h
/tools/c_rehash.pl
/util/shlib_wrap.sh
/util/wrap.pl
/util/quicserver
/tags
/TAGS
*.map
@ -147,6 +216,9 @@ providers/common/include/prov/der_sm2.h
/apps/progs.c
/apps/progs.h
# macOS
.DS_Store
# Windows (legacy)
/tmp32
/tmp32.dbg
@ -167,7 +239,6 @@ providers/common/include/prov/der_sm2.h
# Files created on other branches that are not held in git, and are not
# needed on this branch
/include/openssl/asn1_mac.h
/include/openssl/des_old.h
/include/openssl/fips.h
/include/openssl/fips_rand.h

3
.gitmodules vendored
View file

@ -32,3 +32,6 @@
path = fuzz/corpora
url = https://github.com/openssl/fuzz-corpora
branch = main
[submodule "pkcs11-provider"]
path = pkcs11-provider
url = https://github.com/latchset/pkcs11-provider.git

2
AUTHORS.md
View file

@ -12,6 +12,7 @@ Groups
* OpenSSL Software Services, Inc.
* OpenSSL Software Foundation, Inc.
* Google LLC
Individuals
-----------
@ -48,4 +49,5 @@ Individuals
* Tim Hudson
* Tomáš Mráz
* Ulf Möller
* Valerii Krygin
* Viktor Dukhovni

664
CHANGES.md
View file

@ -12,6 +12,8 @@ appropriate release branch.
OpenSSL Releases
----------------
- [OpenSSL 3.5](#openssl-35)
- [OpenSSL 3.4](#openssl-34)
- [OpenSSL 3.3](#openssl-33)
- [OpenSSL 3.2](#openssl-32)
- [OpenSSL 3.1](#openssl-31)
@ -23,10 +25,554 @@ OpenSSL Releases
- [OpenSSL 1.0.0](#openssl-100)
- [OpenSSL 0.9.x](#openssl-09x)
OpenSSL 3.5
-----------
### Changes between 3.5 and 3.6 [xx XXX xxxx]
* none yet
### Changes between 3.4 and 3.5 [xx XXX xxxx]
* Added server side support for QUIC
*Hugo Landau, Matt Caswell, Tomáš Mráz, Neil Horman, Sasha Nedvedicky, Andrew Dinh*
* Added a `no-tls-deprecated-ec` configuration option.
The `no-tls-deprecated-ec` option disables support for TLS elliptic curve
groups deprecated in RFC8422 at compile time. This does not affect use of
the associated curves outside TLS. By default support for these groups is
compiled in, but, as before, they are not included in the default run-time
list of supported groups.
With the `enable-tls-deprecated-ec` option these TLS groups remain enabled at
compile time even if the default configuration is changed, provided the
underlying EC curves remain implemented.
*Viktor Dukhovni*
* Added new API to enable 0-RTT for 3rd party QUIC stacks.
*Cheng Zhang*
* Added support for a new callback registration `SSL_CTX_set_new_pending_conn_cb`,
which allows for application notification of new connection SSL object
creation, which occurs independently of calls to `SSL_accept_connection()`.
Note: QUIC objects passed through SSL callbacks should not have their state
mutated via calls back into the SSL api until such time as they have been
received via a call to `SSL_accept_connection()`.
*Neil Horman*
* Add SLH-DSA as specified in FIPS 205.
*Shane Lontis and Dr Paul Dale*
* ML-KEM as specified in FIPS 203.
Based on the original implementation in BoringSSL, ported from C++ to C,
refactored, and integrated into the OpenSSL default and FIPS providers.
Including also the X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024
TLS hybrid key post-quantum/classical key agreement schemes.
*Michael Baentsch, Viktor Dukhovni, Shane Lontis and Paul Dale*
* Add ML-DSA as specified in FIPS 204.
The base code was derived from BoringSSL C++ code.
*Shane Lontis, Viktor Dukhovni and Paul Dale*
* Added new API calls to enable 3rd party QUIC stacks to use the OpenSSL TLS
implementation.
*Matt Caswell*
* The default DRBG implementations have been changed to prefer to fetch
algorithm implementations from the default provider (the provider the
DRBG implementation is built in) regardless of the default properties
set in the configuration file. The code will still fallback to find
an implementation, as done previously, if needed.
*Simo Sorce*
* Initial support for opaque symmetric keys objects. These replace the ad-hoc byte
arrays that are pervasive throughout the library.
*Dmitry Belyavskiy and Simo Sorce*
* For TLSv1.3: Add capability for a client to send multiple key shares. Extend the scope of
`SSL_OP_CIPHER_SERVER_PREFERENCE` to cover server-side key exchange group selection.
Extend the server-side key exchange group selection algorithm and related group list syntax
to support multiple group priorities, e.g. to prioritize (hybrid-)KEMs.
*David Kelsey*, *Martin Schmatz*
* The default TLS group list setting is now set to:
`?*X25519MLKEM768 / ?*X25519:?secp256r1 / ?X448:?secp384r1:?secp521r1 / ?ffdhe2048:?ffdhe3072`
This means two key shares (X25519MLKEM768 and X25519) will be sent by
default by the TLS client. GOST groups and FFDHE groups larger than 3072
bits are no longer enabled by default.
*Viktor Dukhovni*
* A new random generation API has been introduced which modifies all
of the L<RAND_bytes(3)> family of calls so they are routed through a
specific named provider instead of being resolved via the normal DRBG
chaining. In a future OpenSSL release, this will obsolete RAND_METHOD.
*Dr Paul Dale*
* New inline functions were added to support loads and stores of unsigned
16-bit, 32-bit and 64-bit integers in either little-endian or big-endian
form, regardless of the host byte-order. See the `OPENSSL_load_u16_le(3)`
manpage for details.
*Viktor Dukhovni*
* All the `BIO_meth_get_*()` functions allowing reuse of the internal OpenSSL
BIO method implementations were deprecated. The reuse is unsafe due to
dependency on the code of the internal methods not changing.
*Tomáš Mráz*
* Support DEFAULT keyword and '-' prefix in `SSL_CTX_set1_groups_list()`.
`SSL_CTX_set1_groups_list()` now supports the DEFAULT keyword which sets the
available groups to the default selection. The '-' prefix allows the calling
application to remove a group from the selection.
*Frederik Wedel-Heinen*
* Updated the default encryption cipher for the `req`, `cms`, and `smime` applications
from `des-ede3-cbc` to `aes-256-cbc`.
AES-256 provides a stronger 256-bit key encryption than legacy 3DES.
*Aditya*
* Enhanced PKCS#7 inner contents verification.
In the `PKCS7_verify()` function, the BIO *indata parameter refers to the
signed data if the content is detached from p7. Otherwise, indata should be
NULL, and then the signed data must be in p7.
The previous OpenSSL implementation only supported MIME inner content
[RFC 5652, section 5.2].
The added functionality now enables support for PKCS#7 inner content
[RFC 2315, section 7].
*Małgorzata Olszówka*
* The `-rawin` option of the `pkeyutl` command is now implied (and thus no
longer required) when using `-digest` or when signing or verifying with an
Ed25519 or Ed448 key.
The `-digest` and `-rawin` option may only be given with `-sign` or `verify`.
*David von Oheimb*
* `X509_PURPOSE_add()` has been modified
to take `sname` instead of `id` as the primary purpose identifier.
For its convenient use, `X509_PURPOSE_get_unused_id()` has been added.
This work was sponsored by Siemens AG.
*David von Oheimb*
* Added support for central key generation in CMP.
This work was sponsored by Siemens AG.
*Rajeev Ranjan*
* Optionally allow the FIPS provider to use the `JITTER` entropy source.
Note that using this option will require the resulting FIPS provider
to undergo entropy source validation [ESV] by the [CMVP], without this
the FIPS provider will not be FIPS compliant. Enable this using the
configuration option `enable-fips-jitter`.
*Paul Dale*
* Extended `OPENSSL_ia32cap` support to accommodate additional `CPUID`
feature/capability bits in leaf `0x7` (Extended Feature Flags) as well
as leaf `0x24` (Converged Vector ISA).
*Dan Zimmerman, Alina Elizarova*
* Cipher pipelining support for provided ciphers with new API functions
EVP_CIPHER_can_pipeline(), EVP_CipherPipelineEncryptInit(),
EVP_CipherPipelineDecryptInit(), EVP_CipherPipelineUpdate(),
and EVP_CipherPipelineFinal(). Cipher pipelining support allows application to
submit multiple chunks of data in one cipher update call, thereby allowing the
provided implementation to take advantage of parallel computing. There are
currently no built-in ciphers that support pipelining. This new API replaces
the legacy pipeline API [SSL_CTX_set_max_pipelines](https://docs.openssl.org/3.3/man3/SSL_CTX_set_split_send_fragment/) used with Engines.
*Ramkumar*
* Add CMS_NO_SIGNING_TIME flag to CMS_sign(), CMS_add1_signer()
Previously there was no way to create a CMS SignedData signature without a
signing time attribute, because CMS_SignerInfo_sign added it unconditionally.
However, there is a use case (PAdES signatures [ETSI EN 319 142-1](https://www.etsi.org/deliver/etsi_en/319100_319199/31914201/01.01.01_60/en_31914201v010101p.pdf) )
where this attribute is not allowed, so a new flag was added to the CMS API
that causes this attribute to be omitted at signing time.
The new `-no_signing_time` option of the `cms` command enables this flag.
*Juhász Péter*
* Parallel dual-prime 1024/1536/2048-bit modular exponentiation for
AVX_IFMA capable processors (Intel Sierra Forest and its successor).
This optimization brings performance enhancement, ranging from 1.8 to 2.2
times, for the sign/decryption operations of rsaz-2k/3k/4k (`openssl speed rsa`)
on the Intel Sierra Forest.
*Zhiguo Zhou, Wangyang Guo (Intel Corp)*
* VAES/AVX-512 support for AES-XTS.
For capable processors (>= Intel Icelake), this provides a
vectorized implementation of AES-XTS with a throughput improvement
between 1.3x to 2x, depending on the block size.
*Pablo De Lara Guarch, Dan Pittman*
* Fix EVP_DecodeUpdate(): do not write padding zeros to the decoded output.
According to the documentation,
for every 4 valid base64 bytes processed (ignoring whitespace, carriage returns and line feeds),
EVP_DecodeUpdate() produces 3 bytes of binary output data
(except at the end of data terminated with one or two padding characters).
However, the function behaved like an EVP_DecodeBlock():
produces exactly 3 output bytes for every 4 input bytes.
Such behaviour could cause writes to a non-allocated output buffer
if a user allocates its size based on the documentation and knowing the padding size.
The fix makes EVP_DecodeUpdate() produce
exactly as many output bytes as in the initial non-encoded message.
*Valerii Krygin*
OpenSSL 3.4
-----------
### Changes between 3.4.1 and 3.4.2 [xx XXX xxxx]
* When displaying distinguished names in the openssl application escape control
characters by default.
*Tomáš Mráz*
### Changes between 3.4.0 and 3.4.1 [11 Feb 2025]
* Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected.
Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a
server may fail to notice that the server was not authenticated, because
handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode
is set.
([CVE-2024-12797])
*Viktor Dukhovni*
* Fixed timing side-channel in ECDSA signature computation.
There is a timing signal of around 300 nanoseconds when the top word of
the inverted ECDSA nonce value is zero. This can happen with significant
probability only for some of the supported elliptic curves. In particular
the NIST P-521 curve is affected. To be able to measure this leak, the
attacker process must either be located in the same physical computer or
must have a very fast network connection with low latency.
([CVE-2024-13176])
*Tomáš Mráz*
* Reverted the behavior change of CMS_get1_certs() and CMS_get1_crls()
that happened in the 3.4.0 release. These functions now return NULL
again if there are no certs or crls in the CMS object.
*Tomáš Mráz*
### Changes between 3.3 and 3.4.0 [22 Oct 2024]
* For the FIPS provider only, replaced the primary DRBG with a continuous
health check module. This also removes the now forbidden DRBG chaining.
*Paul Dale*
* Improved base64 BIO correctness and error reporting.
*Viktor Dukhovni*
* Added support for directly fetched composite signature algorithms such as
RSA-SHA2-256 including new API functions in the EVP_PKEY_sign,
EVP_PKEY_verify and EVP_PKEY_verify_recover groups.
*Richard Levitte*
* XOF Digest API improvements
EVP_MD_CTX_get_size() and EVP_MD_CTX_size are macros that were aliased to
EVP_MD_get_size which returns a constant value. XOF Digests such as SHAKE
have an output size that is not fixed, so calling EVP_MD_get_size() is not
sufficent. The existing macros now point to the new function
EVP_MD_CTX_get_size_ex() which will retrieve the "size" for a XOF digest,
otherwise it falls back to calling EVP_MD_get_size(). Note that the SHAKE
implementation did not have a context getter previously, so the "size" will
only be able to be retrieved with new providers.
Also added a EVP_xof() helper.
*Shane Lontis*
* Added FIPS indicators to the FIPS provider.
FIPS 140-3 requires indicators to be used if the FIPS provider allows
non-approved algorithms. An algorithm is approved if it passes all
required checks such as minimum key size. By default an error will
occur if any check fails. For backwards compatibility individual
algorithms may override the checks by using either an option in the
FIPS configuration OR in code using an algorithm context setter.
Overriding the check means that the algorithm is not FIPS compliant.
OSSL_INDICATOR_set_callback() can be called to register a callback
to log unapproved algorithms. At the end of any algorithm operation
the approved status can be queried using an algorithm context getter.
FIPS provider configuration options are set using 'openssl fipsinstall'.
Note that new FIPS 140-3 restrictions have been enforced such as
RSA Encryption using PKCS1 padding is no longer approved.
Documentation related to the changes can be found on the [fips_module(7)]
manual page.
[fips_module(7)]: https://docs.openssl.org/master/man7/fips_module/#FIPS indicators
*Shane Lontis, Paul Dale, Po-Hsing Wu and Dimitri John Ledkov*
* Added support for hardware acceleration for HMAC on S390x architecture.
*Ingo Franzki*
* Added debuginfo Makefile target for unix platforms to produce
a separate DWARF info file from the corresponding shared libs.
*Neil Horman*
* Added support for encapsulation and decapsulation operations in the
pkeyutl command.
*Dmitry Belyavskiy*
* Added implementation of RFC 9579 (PBMAC1) in PKCS#12.
*Dmitry Belyavskiy*
* Add a new random seed source RNG `JITTER` using a statically linked
jitterentropy library.
*Dimitri John Ledkov*
* Added a feature to retrieve configured TLS signature algorithms,
e.g., via the openssl list command.
*Michael Baentsch*
* Deprecated TS_VERIFY_CTX_set_* functions and added replacement
TS_VERIFY_CTX_set0_* functions with improved semantics.
*Tobias Erbsland*
* Redesigned Windows use of OPENSSLDIR/ENGINESDIR/MODULESDIR such that
what were formerly build time locations can now be defined at run time
with registry keys. See NOTES-WINDOWS.md.
*Neil Horman*
* Added options `-not_before` and `-not_after` for explicit setting
start and end dates of certificates created with the `req` and `x509`
commands. Added the same options also to `ca` command as alias for
`-startdate` and `-enddate` options.
*Stephan Wurm*
* The X25519 and X448 key exchange implementation in the FIPS provider
is unapproved and has `fips=no` property.
*Tomáš Mráz*
* SHAKE-128 and SHAKE-256 implementations have no default digest length
anymore. That means these algorithms cannot be used with
EVP_DigestFinal/_ex() unless the `xoflen` param is set before.
This change was necessary because the preexisting default lengths were
half the size necessary for full collision resistance supported by these
algorithms.
*Tomáš Mráz*
* Setting `config_diagnostics=1` in the config file will cause errors to
be returned from SSL_CTX_new() and SSL_CTX_new_ex() if there is an error
in the ssl module configuration.
*Tomáš Mráz*
* An empty renegotiate extension will be used in TLS client hellos instead
of the empty renegotiation SCSV, for all connections with a minimum TLS
version > 1.0.
*Tim Perry*
* Added support for integrity-only cipher suites TLS_SHA256_SHA256 and
TLS_SHA384_SHA384 in TLS 1.3, as defined in RFC 9150.
This work was sponsored by Siemens AG.
*Rajeev Ranjan*
* Added support for retrieving certificate request templates and CRLs in CMP,
with the respective CLI options `-template`,
`-crlcert`, `-oldcrl`, `-crlout`, `-crlform>`, and `-rsp_crl`.
This work was sponsored by Siemens AG.
*Rajeev Ranjan*
* Added support for issuedOnBehalfOf, auditIdentity, basicAttConstraints,
userNotice, acceptablePrivilegePolicies, acceptableCertPolicies,
subjectDirectoryAttributes, associatedInformation, delegatedNameConstraints,
holderNameConstraints and targetingInformation X.509v3 extensions.
*Jonathan M. Wilbur*
* Added Attribute Certificate (RFC 5755) support. Attribute
Certificates can be created, parsed, modified and printed via the
public API. There is no command-line tool support at this time.
*Damian Hobson-Garcia*
* Added support to build Position Independent Executables (PIE). Configuration
option `enable-pie` configures the cflag '-fPIE' and ldflag '-pie' to
support Address Space Layout Randomization (ASLR) in the openssl executable,
removes reliance on external toolchain configurations.
*Craig Lorentzen*
* SSL_SESSION_get_time()/SSL_SESSION_set_time()/SSL_CTX_flush_sessions() have
been deprecated in favour of their respective ..._ex() replacement functions
which are Y2038-safe.
*Alexander Kanavin*
* ECC groups may now customize their initialization to save CPU by using
precomputed values. This is used by the P-256 implementation.
*Watson Ladd*
OpenSSL 3.3
-----------
### Changes between 3.2 and 3.3 [xx XXX xxxx]
### Changes between 3.3.2 and 3.3.3 [xx XXX xxxx]
* Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
curve parameters.
Use of the low-level GF(2^m) elliptic curve APIs with untrusted
explicit values for the field polynomial can lead to out-of-bounds memory
reads or writes.
Applications working with "exotic" explicit binary (GF(2^m)) curve
parameters, that make it possible to represent invalid field polynomials
with a zero constant term, via the above or similar APIs, may terminate
abruptly as a result of reading or writing outside of array bounds. Remote
code execution cannot easily be ruled out.
([CVE-2024-9143])
*Viktor Dukhovni*
### Changes between 3.3.1 and 3.3.2 [3 Sep 2024]
* Fixed possible denial of service in X.509 name checks.
Applications performing certificate name checks (e.g., TLS clients checking
server certificates) may attempt to read an invalid memory address when
comparing the expected name with an `otherName` subject alternative name of
an X.509 certificate. This may result in an exception that terminates the
application program.
([CVE-2024-6119])
*Viktor Dukhovni*
* Fixed possible buffer overread in SSL_select_next_proto().
Calling the OpenSSL API function SSL_select_next_proto with an empty
supported client protocols buffer may cause a crash or memory contents
to be sent to the peer.
([CVE-2024-5535])
*Matt Caswell*
### Changes between 3.3.0 and 3.3.1 [4 Jun 2024]
* Fixed potential use after free after SSL_free_buffers() is called.
The SSL_free_buffers function is used to free the internal OpenSSL
buffer used when processing an incoming record from the network.
The call is only expected to succeed if the buffer is not currently
in use. However, two scenarios have been identified where the buffer
is freed even when still in use.
The first scenario occurs where a record header has been received
from the network and processed by OpenSSL, but the full record body
has not yet arrived. In this case calling SSL_free_buffers will succeed
even though a record has only been partially processed and the buffer
is still in use.
The second scenario occurs where a full record containing application
data has been received and processed by OpenSSL but the application has
only read part of this data. Again a call to SSL_free_buffers will
succeed even though the buffer is still in use.
([CVE-2024-4741])
*Matt Caswell*
* Fixed an issue where checking excessively long DSA keys or parameters may
be very slow.
Applications that use the functions EVP_PKEY_param_check() or
EVP_PKEY_public_check() to check a DSA public key or DSA parameters may
experience long delays. Where the key or parameters that are being checked
have been obtained from an untrusted source this may lead to a Denial of
Service.
To resolve this issue DSA keys larger than OPENSSL_DSA_MAX_MODULUS_BITS
will now fail the check immediately with a DSA_R_MODULUS_TOO_LARGE error
reason.
([CVE-2024-4603])
*Tomáš Mráz*
* Improved EC/DSA nonce generation routines to avoid bias and timing
side channel leaks.
Thanks to Florian Sieck from Universität zu Lübeck and George Pantelakis
and Hubert Kario from Red Hat for reporting the issues.
*Tomáš Mráz and Paul Dale*
### Changes between 3.2 and 3.3.0 [9 Apr 2024]
* The `-verify` option to the `openssl crl` and `openssl req` will make
the program exit with 1 on failure.
*Vladimír Kotal*
* The BIO_get_new_index() function can only be called 127 times before it
reaches its upper bound of BIO_TYPE_MASK. It will now correctly return an
@ -95,6 +641,8 @@ OpenSSL 3.3
- `certProfile` request message header and respective `-profile` CLI option
- support for delayed delivery of all types of response messages
This work was sponsored by Siemens AG.
*David von Oheimb*
* The build of exporters (such as `.pc` files for pkg-config) cleaned up to
@ -150,6 +698,11 @@ OpenSSL 3.3
*Hugo Landau*
* Limited support for polling of QUIC connection and stream objects in a
non-blocking manner. Refer to the SSL_poll(3) manpage for details.
*Hugo Landau*
* Added APIs to allow querying the size and utilisation of a QUIC stream's
write buffer. Refer to the SSL_get_value_uint(3) manpage for details.
@ -163,11 +716,72 @@ OpenSSL 3.3
*Alexandr Nedvedicky*
* Applied AES-GCM unroll8 optimisation to Microsoft Azure Cobalt 100
*Tom Cosgrove*
* Added X509_STORE_get1_objects to avoid issues with the existing
X509_STORE_get0_objects API in multi-threaded applications. Refer to the
documentation for details.
*David Benjamin*
* Added assembly implementation for md5 on loongarch64
*Min Zhou*
* Optimized AES-CTR for ARM Neoverse V1 and V2
*Fisher Yu*
* Enable AES and SHA3 optimisations on Apple Silicon M3-based MacOS systems
similar to M1/M2.
*Tom Cosgrove*
* Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple
times with different output sizes.
*Shane Lontis, Holger Dengler*
* Various optimizations for cryptographic routines using RISC-V vector crypto
extensions
*Christoph Müllner, Charalampos Mitrodimas, Ard Biesheuvel, Phoebe Chen,
Jerry Shih*
* Accept longer context for TLS 1.2 exporters
While RFC 5705 implies that the maximum length of a context for exporters is
65535 bytes as the length is embedded in uint16, the previous implementation
enforced a much smaller limit, which is less than 1024 bytes. This
restriction has been removed.
*Daiki Ueno*
OpenSSL 3.2
-----------
### Changes between 3.2.1 and 3.2.2 [xx XXX xxxx]
* Fixed an issue where some non-default TLS server configurations can cause
unbounded memory growth when processing TLSv1.3 sessions. An attacker may
exploit certain server configurations to trigger unbounded memory growth that
would lead to a Denial of Service
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option
is being used (but not if early_data is also configured and the default
anti-replay protection is in use). In this case, under certain conditions,
the session cache can get into an incorrect state and it will fail to flush
properly as it fills. The session cache will continue to grow in an unbounded
manner. A malicious client could deliberately create the scenario for this
failure to force a Denial of Service. It may also happen by accident in
normal operation.
([CVE-2024-2511])
*Matt Caswell*
* Fixed bug where SSL_export_keying_material() could not be used with QUIC
connections. (#23560)
@ -334,11 +948,6 @@ OpenSSL 3.2
*Fergus Dall*
* Added support for securely getting root CA certificate update in
CMP.
*David von Oheimb*
* Improved contention on global write locks by using more read locks where
appropriate.
@ -591,21 +1200,24 @@ OpenSSL 3.2
* Lutz Jänicke*
* The `x509`, `ca`, and `req` apps now produce X.509 v3 certificates.
* The `x509`, `ca`, and `req` commands now produce X.509 v3 certificates.
The `-x509v1` option of `req` prefers generation of X.509 v1 certificates.
`X509_sign()` and `X509_sign_ctx()` make sure that the certificate has
X.509 version 3 if the certificate information includes X.509 extensions.
*David von Oheimb*
* Fix and extend certificate handling and the apps `x509`, `verify` etc.
* Fix and extend certificate handling and the commands `x509`, `verify` etc.
such as adding a trace facility for debugging certificate chain building.
*David von Oheimb*
* Various fixes and extensions to the CMP+CRMF implementation and the `cmp` app
in particular supporting requests for central key generation, generalized
polling, and various types of genm/genp exchanges defined in CMP Updates.
in particular supporting various types of genm/genp exchanges such as getting
CA certificates and root CA cert updates defined in CMP Updates [RFC 9480],
as well as the `-srvcertout` and `-serial` CLI options.
This work was sponsored by Siemens AG.
*David von Oheimb*
@ -904,7 +1516,7 @@ OpenSSL 3.1
* Add FIPS provider configuration option to enforce the
Extended Master Secret (EMS) check during the TLS1_PRF KDF.
The option '-ems-check' can optionally be supplied to
The option '-ems_check' can optionally be supplied to
'openssl fipsinstall'.
*Shane Lontis*
@ -927,7 +1539,7 @@ OpenSSL 3.1
*Orr Toledano*
* s_client and s_server apps now explicitly say when the TLS version
* `s_client` and `s_server` commands now explicitly say when the TLS version
does not include the renegotiation mechanism. This avoids confusion
between that scenario versus when the TLS version includes secure
renegotiation but the peer lacks support for it.
@ -1978,7 +2590,8 @@ breaking changes, and mappings for the large list of deprecated functions.
*Nicola Tuveri*
* Behavior of the `pkey` app is changed, when using the `-check` or `-pubcheck`
* Behavior of the `pkey` command is changed,
when using the `-check` or `-pubcheck`
switches: a validation failure triggers an early exit, returning a failure
exit status to the parent process.
@ -2894,7 +3507,7 @@ breaking changes, and mappings for the large list of deprecated functions.
this switch breaks interoperability with correct implementations.
* Fix a use after free bug in d2i_X509_PUBKEY when overwriting a
re-used X509_PUBKEY object if the second PUBKEY is malformed.
reused X509_PUBKEY object if the second PUBKEY is malformed.
*Bernd Edlinger*
@ -4228,7 +4841,7 @@ OpenSSL 1.1.0
*Billy Bob Brumley, Nicola Tuveri*
* Fix a use after free bug in d2i_X509_PUBKEY when overwriting a
re-used X509_PUBKEY object if the second PUBKEY is malformed.
reused X509_PUBKEY object if the second PUBKEY is malformed.
*Bernd Edlinger*
@ -8218,7 +8831,7 @@ OpenSSL 1.0.1
*Matt Caswell*
* Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
built with the no-ssl3 option and an SSL v3 ClientHello is received the ssl
method would be set to NULL which could later result in a NULL pointer
dereference. Thanks to Frank Schmirler for reporting this issue.
([CVE-2014-3569])
@ -9283,7 +9896,7 @@ OpenSSL 1.0.0
*Matt Caswell*
* Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
built with the no-ssl3 option and an SSL v3 ClientHello is received the ssl
method would be set to NULL which could later result in a NULL pointer
dereference. Thanks to Frank Schmirler for reporting this issue.
([CVE-2014-3569])
@ -15414,7 +16027,7 @@ s-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
*stefank@valicert.com via Richard Levitte*
* Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
* Add an SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently
doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be
the bitwise-OR of the two for use by the majority of applications
@ -15963,7 +16576,7 @@ s-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
### Changes between 0.9.6a and 0.9.6b [9 Jul 2001]
* Change ssleay_rand_bytes (crypto/rand/md_rand.c)
to avoid a SSLeay/OpenSSL PRNG weakness pointed out by
to avoid an SSLeay/OpenSSL PRNG weakness pointed out by
Markku-Juhani O. Saarinen <markku-juhani.saarinen@nokia.com>:
PRNG state recovery was possible based on the output of
one PRNG request appropriately sized to gain knowledge on
@ -16348,7 +16961,7 @@ s-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
*Bodo Moeller*
* Store verify_result within SSL_SESSION also for client side to
avoid potential security hole. (Re-used sessions on the client side
avoid potential security hole. (Reused sessions on the client side
always resulted in verify_result==X509_V_OK, not using the original
result of the server certificate verification.)
@ -18564,7 +19177,7 @@ s-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
* Bugfix: ssl23_get_client_hello did not work properly when called in
state SSL23_ST_SR_CLNT_HELLO_B, i.e. when the first 7 bytes of
a SSLv2-compatible client hello for SSLv3 or TLSv1 could be read,
an SSLv2-compatible client hello for SSLv3 or TLSv1 could be read,
but a retry condition occurred while trying to read the rest.
*Bodo Moeller*
@ -20540,6 +21153,13 @@ ndif
<!-- Links -->
[CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511
[CVE-2024-0727]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-0727
[CVE-2023-6237]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6237
[CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129
@ -20728,3 +21348,5 @@ ndif
[CVE-2002-0657]: https://www.openssl.org/news/vulnerabilities.html#CVE-2002-0657
[CVE-2002-0656]: https://www.openssl.org/news/vulnerabilities.html#CVE-2002-0656
[CVE-2002-0655]: https://www.openssl.org/news/vulnerabilities.html#CVE-2002-0655
[CMVP]: https://csrc.nist.gov/projects/cryptographic-module-validation-program
[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations

10
CONTRIBUTING.md
View file

@ -3,13 +3,13 @@ HOW TO CONTRIBUTE TO OpenSSL
Please visit our [Getting Started] page for other ideas about how to contribute.
[Getting Started]: <https://www.openssl.org/community/getting-started.html>
[Getting Started]: <https://openssl-library.org/community/getting-started>
Development is done on GitHub in the [openssl/openssl] repository.
[openssl/openssl]: <https://github.com/openssl/openssl>
To request new a feature, ask a question, or report a bug,
To request a new feature, ask a question, or report a bug,
please open an [issue on GitHub](https://github.com/openssl/openssl/issues).
To submit a patch or implement a new feature, please open a
@ -67,7 +67,8 @@ guidelines:
often. We do not accept merge commits, you will have to remove them
(usually by rebasing) before it will be acceptable.
4. Code provided should follow our [coding style] and compile without warnings.
4. Code provided should follow our [coding style] and [documentation policy]
and compile without warnings.
There is a [Perl tool](util/check-format.pl) that helps
finding code formatting mistakes and other coding style nits.
Where `gcc` or `clang` is available, you should use the
@ -76,7 +77,8 @@ guidelines:
Clean builds via GitHub Actions are required. They are started automatically
whenever a PR is created or updated by committers.
[coding style]: https://www.openssl.org/policies/technical/coding-style.html
[coding style]: https://openssl-library.org/policies/technical/coding-style/
[documentation policy]: https://openssl-library.org/policies/technical/documentation-policy/
5. When at all possible, code contributions should include tests. These can
either be added to an existing test, or completely new. Please see

21
Configurations/00-base-templates.conf
View file

@ -59,6 +59,8 @@ my %targets=(
includes =>
sub {
my @incs = ();
push @incs, $withargs{jitter_include}
if !$disabled{jitter} && $withargs{jitter_include};
push @incs, $withargs{brotli_include}
if !$disabled{brotli} && $withargs{brotli_include};
push @incs, $withargs{zlib_include}
@ -76,9 +78,27 @@ my %targets=(
AR => "ar",
ARFLAGS => "qc",
CC => "cc",
OBJCOPY => "objcopy",
bin_cflags =>
sub {
my @flags = ();
if (!defined($disabled{pie})) {
push(@flags, "-fPIE");
}
return join(" ", @flags);
},
bin_lflags =>
sub {
my @flags = ();
if (!defined($disabled{pie})) {
push(@flags, "-pie");
}
return join(" ", @flags);
},
lflags =>
sub {
my @libs = ();
push(@libs, "-L".$withargs{jitter_lib}) if $withargs{jitter_lib};
push(@libs, "-L".$withargs{zlib_lib}) if $withargs{zlib_lib};
push(@libs, "-L".$withargs{brotli_lib}) if $withargs{brotli_lib};
push(@libs, "-L".$withargs{zstd_lib}) if $withargs{zstd_lib};
@ -87,6 +107,7 @@ my %targets=(
ex_libs =>
sub {
my @libs = ();
push(@libs, "-l:libjitterentropy.a") if !defined($disabled{jitter});
push(@libs, "-lz") if !defined($disabled{zlib}) && defined($disabled{"zlib-dynamic"});
if (!defined($disabled{brotli}) && defined($disabled{"brotli-dynamic"})) {
push(@libs, "-lbrotlienc");

46
Configurations/10-main.conf
View file

@ -777,7 +777,14 @@ my %targets = (
asm_arch => 'aarch64',
perlasm_scheme => "linux64",
},
"linux-arm64ilp32-clang" => { # clang config abi by --target
inherit_from => [ "linux-generic32" ],
CC => "clang",
CXX => "clang++",
bn_ops => "SIXTY_FOUR_BIT RC4_CHAR",
asm_arch => 'aarch64',
perlasm_scheme => "linux64",
},
"linux-mips32" => {
# Configure script adds minimally required -march for assembly
# support, if no -march was specified at command line.
@ -1407,6 +1414,25 @@ my %targets = (
AR => add("-X32"),
RANLIB => add("-X32"),
},
# To enable openxl compiler for aix
# If 17.1 openxl runtime is available, -latomic can be used
# instead of -DBROKEN_CLANG_ATOMICS
"aix-clang" => {
inherit_from => [ "aix-common" ],
CC => "ibm-clang",
CFLAGS => picker(debug => "-O0 -g",
release => "-O"),
cflags => combine("-Wno-implicit-function-declaration -mcmodel=large -DBROKEN_CLANG_ATOMICS",
threads("-pthread")),
ex_libs => add(threads("-pthread")),
bn_ops => "BN_LLONG RC4_CHAR",
asm_arch => 'ppc32',
perlasm_scheme => "aix32",
shared_cflag => "-fpic",
shared_ldflag => add("-shared"),
AR => add("-X32"),
RANLIB => add("-X32"),
},
# shared_target of "aix-solib" builds shared libraries packaged
# without archives. This improves the behavior of inter-library
# references (libssl depending on libcrypto) when building with
@ -1438,6 +1464,23 @@ my %targets = (
AR => add("-X64"),
RANLIB => add("-X64"),
},
"aix64-clang" => {
inherit_from => [ "aix-common" ],
CC => "ibm-clang",
CFLAGS => picker(debug => "-O0 -g",
release => "-O"),
cflags => combine("-maix64 -Wno-implicit-function-declaration -mcmodel=large",
threads("-pthread")),
ex_libs => add(threads("-pthread")),
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
asm_arch => 'ppc64',
perlasm_scheme => "aix64",
shared_cflag => "-fpic",
shared_ldflag => add("-shared"),
shared_extension => "64.so.\$(SHLIB_VERSION_NUMBER)",
AR => add("-X64"),
RANLIB => add("-X64"),
},
"aix64-cc-solib" => {
inherit_from => [ "aix64-cc" ],
shared_target => "aix-solib",
@ -2055,6 +2098,7 @@ my %targets = (
cflag_incfirst => '/FIRST_INCLUDE=',
lib_defines =>
add("OPENSSL_USE_NODELETE",
"_XOPEN_SOURCE", "_XOPEN_SOURCE_EXTENDED=1",
sub {
return vms_info()->{def_zlib}
? "LIBZ=\"\"\"".vms_info()->{def_zlib}."\"\"\"" : ();

2
Configurations/15-ios.conf
View file

@ -11,7 +11,7 @@ my %targets = (
template => 1,
inherit_from => [ "darwin-common" ],
sys_id => "iOS",
disable => [ "shared", "async" ],
disable => [ "async" ],
},
"ios-xcrun" => {
inherit_from => [ "ios-common" ],

59
Configurations/50-cppbuilder.conf
View file

@ -58,5 +58,64 @@ my %targets = (
shared_defflag => '',
perl_platform => 'Windows::cppbuilder',
uplink_arch => 'common',
},
"BC-64" => {
inherit_from => [ "BASE_Windows" ],
sys_id => "WIN64",
bn_ops => "BN_LLONG",
thread_scheme => "winthreads",
cc => "bcc64",
CPP => "cpp64 -oCON -Sc -Sr",
defines => add("WIN32_LEAN_AND_MEAN", "OPENSSL_SYS_WIN64",
"L_ENDIAN", "DSO_WIN32", "_stricmp=stricmp",
"_strnicmp=strnicmp", "_setmode=setmode"),
cflags => picker(default => add("-q -c",
threads("-tM"),
shared("-tR")),
debug => "-Od -v -vi- -D_DEBUG",
release => "-O2"),
bin_cflags => "-tWC",
lib_cflags => shared("-tWD -D_WINDLL -D_DLL"),
coutflag => "-o",
# -Sx isn't documented, but 'cpp64 -H -S' explains it:
#
# -Sx Omit preprocessed text in output
makedepcmd => "cpp64 -oCON -Sx -Hp",
makedep_scheme => "embarcadero",
LD => "ilink64",
LDFLAGS => picker(default => "-x -Gn -q -w-dup",
debug => '-j"$(BDS)\lib\win64\debug" ' .
'-L"$(BDS)\lib\win64\debug" -v',
release => '-j"$(BDS)\lib\win64\release" ' .
'-L"$(BDS)\lib\win64\release"'),
bin_lflags => "-ap -Tpe c0x64.o wildargs.o",
ldoutflag => ",",
ldpostoutflag => ",,",
ld_resp_delim => " +\n",
ex_libs => add(sub {
my @ex_libs = ("import64.a",
($disabled{shared}
? ($disabled{threads} ? "cw64.a" : "cw64mt.a")
: ($disabled{threads} ? "cw64i.a" : "cw64mti.a")));
push @ex_libs, "ws2_32.a" unless $disabled{sock};
return join(" ", @ex_libs);
}),
AR => "tlib",
ARFLAGS => "/P256 /N /u",
ar_resp_delim => " &\n",
RC => "brcc32",
RCFLAGS => '-i"$(BDS)\include\windows\sdk"',
rcoutflag => "-fo",
shared_target => "win-shared",
shared_ldflag => "-aa -Tpd c0d64.o",
lddefflag => ",",
ldresflag => ",",
ld_implib_rule => 'implib -a $< $**',
dso_scheme => "win64",
shared_defflag => '',
perl_platform => 'Windows::cppbuilder',
uplink_arch => 'common',
}
);

32
Configurations/50-nonstop.conf
View file

@ -173,6 +173,15 @@
ex_libs => '-lput',
},
######################################################################
# Build models
'nonstop-model-klt' => {
template => 1,
defines => ['_KLT_MODEL_',
'_REENTRANT', '_THREAD_SUPPORT_FUNCTIONS'],
ex_libs => '-lklt',
},
######################################################################
# Now for the entries themselves, let's combine things!
'nonstop-nsx' => {
@ -211,6 +220,16 @@
multibin => '64-put',
disable => ['atexit'],
},
'nonstop-nsx_64_klt' => {
inherit_from => [ 'nonstop-common',
'nonstop-archenv-x86_64-oss',
'nonstop-lp64-x86_64',
'nonstop-efloat-x86_64',
'nonstop-model-klt' ],
multilib => '64-klt',
multibin => '64-klt',
disable => ['atexit'],
},
'nonstop-nsx_g' => {
inherit_from => [ 'nonstop-common',
'nonstop-archenv-x86_64-guardian',
@ -262,16 +281,3 @@
multibin => '64-put',
disable => ['atexit'],
},
'nonstop-nse_g' => {
inherit_from => [ 'nonstop-common',
'nonstop-archenv-itanium-guardian',
'nonstop-ilp32', 'nonstop-nfloat-itanium' ],
disable => ['threads','atexit'],
},
'nonstop-nse_g_tandem' => {
inherit_from => [ 'nonstop-common',
'nonstop-archenv-itanium-guardian',
'nonstop-ilp32', 'nonstop-tfloat-itanium' ],
disable => ['threads','atexit'],
},

5
Configurations/50-win-clang-cl.conf
View file

@ -11,7 +11,7 @@ my %targets = (
multilib => "-arm64",
asm_arch => "aarch64",
AS => "clang-cl.exe",
ASFLAGS => "/nologo /Zi",
ASFLAGS => "/nologo /Zi --target=arm64-pc-windows-msvc",
asflags => "/c",
asoutflag => "/Fo",
perlasm_scheme => "win64",
@ -25,8 +25,9 @@ my %targets = (
bn_ops => "SIXTY_FOUR_BIT RC4_CHAR",
multilib => "-arm64",
asm_arch => "aarch64",
CFLAGS => add("--target=arm64-pc-windows-msvc"),
AS => "clang-cl.exe",
ASFLAGS => "/nologo /Zi",
ASFLAGS => "/nologo /Zi --target=arm64-pc-windows-msvc",
asflags => "/c",
asoutflag => "/Fo",
perlasm_scheme => "win64",

2
Configurations/descrip.mms.tmpl
View file

@ -239,7 +239,7 @@
# from these directories.
push @{$unified_info{includes_extra}->{$obj}}, qw(./quic);
}
foreach (grep /\[\.ssl\.(?:quic|record|statem)\].*?\.o$/, keys %{$unified_info{sources}}) {
foreach (grep /\[\.ssl\.(?:quic|record|statem|rio)\].*?\.o$/, keys %{$unified_info{sources}}) {
my $obj = platform->obj($_);
# Most of the files in [.ssl.record] and [.ssl.statem] include
# "../ssl_local.h", which includes things like "record/record.h".

13
Configurations/unix-Makefile.tmpl
View file

@ -373,6 +373,7 @@ CFLAGS={- join(' ', @{$config{CFLAGS}}) -}
CXXFLAGS={- join(' ', @{$config{CXXFLAGS}}) -}
LDFLAGS= {- join(' ', @{$config{LDFLAGS}}) -}
EX_LIBS= {- join(' ', @{$config{LDLIBS}}) -}
OBJCOPY={- $config{OBJCOPY} -}
MAKEDEPEND={- $config{makedepcmd} -}
@ -533,6 +534,11 @@ LANG=C
{- dependmagic('build_programs', 'Build the openssl executables and scripts'); -}: build_programs_nodep
all: build_sw {- "build_docs" if !$disabled{docs}; -} ## Build software and documentation
debuginfo: $(SHLIBS)
@set -e; for i in $(SHLIBS); do \
$(OBJCOPY) --only-keep-debug $$i $$i.debug; \
$(OBJCOPY) --strip-debug --add-gnu-debuglink=$$i.debug $$i; \
done;
##@ Documentation
build_generated_pods: $(GENERATED_PODS)
@ -1167,7 +1173,7 @@ generate_buildinfo: generate_doc_buildinfo
.PHONY: doc-nits md-nits
doc-nits: build_generated_pods ## Evaluate OpenSSL documentation
$(PERL) $(SRCDIR)/util/find-doc-nits -c -n -l -e
$(PERL) $(SRCDIR)/util/find-doc-nits -c -n -l -e -i
# This uses "mdl", the markdownlint application, which is written in ruby.
# The source is at https://github.com/markdownlint/markdownlint
@ -1332,8 +1338,7 @@ errors:
include/internal/asn1.h
include/internal/sslconf.h );
my @cryptoskipheaders = ( @sslheaders_tmpl,
qw( include/openssl/asn1_mac.h
include/openssl/conf_api.h
qw( include/openssl/conf_api.h
include/openssl/ebcdic.h
include/openssl/opensslconf.h
include/openssl/symhacks.h ) );
@ -1740,7 +1745,7 @@ EOF
} elsif ($makedep_scheme eq 'gcc' && !grep /\.rc$/, @srcs) {
$recipe .= <<"EOF";
$obj: $deps
$cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -MT \$\@ -c -o \$\@ $srcs
$cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -c -o \$\@ $srcs
\@touch $dep.tmp
\@if cmp $dep.tmp $dep > /dev/null 2> /dev/null; then \\
rm -f $dep.tmp; \\

86
Configure
View file

@ -1,6 +1,6 @@
#! /usr/bin/env perl
# -*- mode: perl; -*-
# Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@ -77,6 +77,15 @@ EOF
# Generic OpenSSL-style methods relating to this support
# are always compiled but return NULL if the hardware
# support isn't compiled.
#
# enable-demos Enable the building of the example code in the demos directory
# enable-h3demo Enable the http3 demo, which currently only links to the
# external nghttp3 library on unix platforms
#
# enable-hqinterop
# Enable the building of the hq-interop code for construction
# of the interop container
#
# no-hw do not compile support for any crypto hardware.
# [no-]threads [don't] try to create a library that is suitable for
# multithreaded applications (default is "threads" if we
@ -167,7 +176,6 @@ my @gcc_devteam_warn = qw(
-Wshadow
-Wformat
-Wno-type-limits
-Wno-tautological-constant-out-of-range-compare
-Wundef
-Werror
-Wmissing-prototypes
@ -184,11 +192,11 @@ my @gcc_devteam_warn = qw(
# -Wextended-offsetof -- no, needed in CMS ASN1 code
my @clang_devteam_warn = qw(
-Wno-unknown-warning-option
-Wswitch-default
-Wno-parentheses-equality
-Wno-language-extension-token
-Wno-extended-offsetof
-Wno-missing-braces
-Wno-tautological-constant-out-of-range-compare
-Wconditional-uninitialized
-Wincompatible-pointer-types-discards-qualifiers
-Wmissing-variable-declarations
@ -443,6 +451,9 @@ my @disablables = (
"crypto-mdebug",
"ct",
"default-thread-pool",
"demos",
"h3demo",
"hqinterop",
"deprecated",
"des",
"devcryptoeng",
@ -466,11 +477,15 @@ my @disablables = (
"filenames",
"fips",
"fips-securitychecks",
"fips-post",
"fips-jitter",
"fuzz-afl",
"fuzz-libfuzzer",
"gost",
"http",
"idea",
"integrity-only-ciphers",
"jitter",
"ktls",
"legacy",
"loadereng",
@ -478,6 +493,8 @@ my @disablables = (
"md2",
"md4",
"mdc2",
"ml-dsa",
"ml-kem",
"module",
"msan",
"multiblock",
@ -486,6 +503,7 @@ my @disablables = (
"ocsp",
"padlockeng",
"pic",
"pie",
"pinshared",
"poly1305",
"posix-io",
@ -505,6 +523,7 @@ my @disablables = (
"shared",
"siphash",
"siv",
"slh-dsa",
"sm2",
"sm2-precomp",
"sm3",
@ -517,11 +536,13 @@ my @disablables = (
"ssl-trace",
"static-engine",
"stdio",
"sslkeylog",
"tests",
"tfo",
"thread-pool",
"threads",
"tls",
"tls-deprecated-ec",
"trace",
"ts",
"ubsan",
@ -564,18 +585,24 @@ my %deprecated_disablables = (
our %disabled = ( # "what" => "comment"
"fips" => "default",
"fips-jitter" => "default",
"asan" => "default",
"brotli" => "default",
"brotli-dynamic" => "default",
"buildtest-c++" => "default",
"crypto-mdebug" => "default",
"crypto-mdebug-backtrace" => "default",
"demos" => "default",
"h3demo" => "default",
"hqinterop" => "default",
"devcryptoeng" => "default",
"ec_nistp_64_gcc_128" => "default",
"egd" => "default",
"external-tests" => "default",
"fuzz-afl" => "default",
"fuzz-libfuzzer" => "default",
"pie" => "default",
"jitter" => "default",
"ktls" => "default",
"md2" => "default",
"msan" => "default",
@ -583,6 +610,7 @@ our %disabled = ( # "what" => "comment"
"sctp" => "default",
"ssl3" => "default",
"ssl3-method" => "default",
"sslkeylog" => "default",
"tfo" => "default",
"trace" => "default",
"ubsan" => "default",
@ -605,8 +633,8 @@ my @disable_cascades = (
"ec", "engine",
"filenames",
"idea", "ktls",
"md4", "multiblock", "nextprotoneg",
"ocsp", "ocb", "poly1305", "psk",
"md4", "ml-dsa", "ml-kem", "multiblock",
"nextprotoneg", "ocsp", "ocb", "poly1305", "psk",
"rc2", "rc4", "rmd160",
"seed", "siphash", "siv",
"sm3", "sm4", "srp",
@ -622,7 +650,8 @@ my @disable_cascades = (
"brotli" => [ "brotli-dynamic" ],
"zstd" => [ "zstd-dynamic" ],
"des" => [ "mdc2" ],
"ec" => [ "ec2m", "ecdsa", "ecdh", "sm2", "gost", "ecx" ],
"deprecated" => [ "tls-deprecated-ec" ],
"ec" => [ qw(ec2m ecdsa ecdh sm2 gost ecx tls-deprecated-ec) ],
"dgram" => [ "dtls", "quic", "sctp" ],
"sock" => [ "dgram", "tfo" ],
"dtls" => [ @dtls ],
@ -676,7 +705,8 @@ my @disable_cascades = (
"cmp" => [ "crmf" ],
"fips" => [ "fips-securitychecks", "acvp-tests" ],
"fips" => [ "fips-securitychecks", "fips-post", "acvp-tests",
"fips-jitter" ],
"threads" => [ "thread-pool" ],
"thread-pool" => [ "default-thread-pool" ],
@ -745,6 +775,7 @@ my %user = (
RANLIB => env('RANLIB'),
RC => env('RC') || env('WINDRES'),
RCFLAGS => [ env('RCFLAGS') || () ],
OBJCOPY => undef,
RM => undef,
);
# Info about what "make variables" may be prefixed with the cross compiler
@ -805,7 +836,7 @@ my %cmdvars = (); # Stores FOO='blah' type arguments
my %unsupported_options = ();
my %deprecated_options = ();
# If you change this, update apps/version.c
my @known_seed_sources = qw(getrandom devrandom os egd none rdcpu librandom);
my @known_seed_sources = qw(getrandom devrandom os egd none rdcpu);
my @seed_sources = ();
while (@argvcopy)
{
@ -935,10 +966,19 @@ while (@argvcopy)
{
delete $disabled{"brotli"};
}
elsif ($1 eq "pie")
{
delete $disabled{"pie"};
}
elsif ($1 eq "zstd-dynamic")
{
delete $disabled{"zstd"};
}
elsif ($1 eq "fips-jitter")
{
delete $disabled{"fips"};
delete $disabled{"jitter"};
}
my $algo = $1;
delete $disabled{$algo};
@ -1005,6 +1045,14 @@ while (@argvcopy)
{
$config{openssldir}=$1;
}
elsif (/^--with-jitter-include=(.*)$/)
{
$withargs{jitter_include}=$1;
}
elsif (/^--with-jitter-lib=(.*)$/)
{
$withargs{jitter_lib}=$1;
}
elsif (/^--with-zlib-lib=(.*)$/)
{
$withargs{zlib_lib}=$1;
@ -1297,11 +1345,15 @@ if (scalar(grep { $_ eq 'none' } @seed_sources) > 0) {
============================== WARNING ===============================
You have selected the --with-rand-seed=none option, which effectively
disables automatic reseeding of the OpenSSL random generator.
disables automatic reseeding of the OpenSSL SEED-SRC random generator.
All operations depending on the random generator such as creating keys
will not work unless the random generator is seeded manually by the
application.
Instead of manually seeding, a different random generator can be set
at runtime in openssl.cnf or configured at build time with
-DOPENSSL_DEFAULT_SEED_SRC.
Please read the 'Note on random number generation' section in the
INSTALL.md instructions and the RAND_DRBG(7) manual page for more
details.
@ -1313,6 +1365,11 @@ push @{$config{openssl_feature_defines}},
map { (my $x = $_) =~ tr|[\-a-z]|[_A-Z]|; "OPENSSL_RAND_SEED_$x" }
@seed_sources;
my $provider_string = $disabled{"fips-post"} ? "non-compliant FIPS Provider" : "FIPS Provider";
$config{FIPS_VENDOR} =
(defined $version{FIPS_VENDOR} ? "$version{FIPS_VENDOR} $provider_string for OpenSSL" : "OpenSSL $provider_string");
# Backward compatibility?
if ($target =~ m/^CygWin32(-.*)$/) {
$target = "Cygwin".$1;
@ -1658,7 +1715,7 @@ if (!$disabled{makedepend}) {
disable('unavailable', 'makedepend') unless $config{makedep_scheme};
}
if (!$disabled{asm} && !$predefined_C{__MACH__} && $^O ne 'VMS') {
if (!$disabled{asm} && !$predefined_C{__MACH__} && $^O ne 'VMS' && !$predefined_C{_AIX}) {
# probe for -Wa,--noexecstack option...
if ($predefined_C{__clang__}) {
# clang has builtin assembler, which doesn't recognize --help,
@ -1883,7 +1940,7 @@ foreach my $what (sort keys %disabled) {
$skipdir{engines} = $what if $what eq 'engine';
$skipdir{"crypto/$skipdir"} = $what
unless $what eq 'async' || $what eq 'err' || $what eq 'dso';
unless $what eq 'async' || $what eq 'err' || $what eq 'dso' || $what eq 'http';
}
}
@ -3507,6 +3564,13 @@ sub absolutedir {
return rel2abs($dir);
}
# realpath() on Windows seems to check if the directory actually exists,
# which isn't what is wanted here. All we want to know is if a directory
# spec is absolute, not if it exists.
if ($^O eq "MSWin32") {
return rel2abs($dir);
}
# We use realpath() on Unix, since no other will properly clean out
# a directory spec.
use Cwd qw/realpath/;

136
INSTALL.md
View file

@ -52,6 +52,8 @@ To install OpenSSL, you will need:
* Perl 5 with core modules (please read [NOTES-PERL.md](NOTES-PERL.md))
* The Perl module `Text::Template` (please read [NOTES-PERL.md](NOTES-PERL.md))
* an ANSI C compiler
* POSIX C library (at least POSIX.1-2008), or compatible types and
functionality.
* a development environment in the form of development libraries and C
header files
* a supported operating system
@ -65,6 +67,7 @@ issues and other details, please read one of these:
* [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md)
* [Notes for the OpenVMS platform](NOTES-VMS.md)
* [Notes for the HPE NonStop platform](NOTES-NONSTOP.md)
* [Notes on POSIX](NOTES-POSIX.md)
* [Notes on Perl](NOTES-PERL.md)
* [Notes on Valgrind](NOTES-VALGRIND.md)
@ -507,11 +510,6 @@ This source is ignored by the FIPS provider.
Use the `RDSEED` or `RDRAND` command on x86 or `RNDRRS` command on aarch64
if provided by the CPU.
### librandom
Use librandom (not implemented yet).
This source is ignored by the FIPS provider.
### none
Disable automatic seeding. This is the default on some operating systems where
@ -523,6 +521,35 @@ at the end of this document.
[rng]: #notes-on-random-number-generation
### jitter
When configured with `enable-jitter`, a "JITTER" RNG is compiled that
can provide an alternative software seed source. It can be configured
by setting `seed` option in `openssl.cnf`. A minimal `openssl.cnf` is
shown below:
openssl_conf = openssl_init
[openssl_init]
random = random
[random]
seed=JITTER
It uses a statically linked [jitterentropy-library] as the seed source.
Additional configuration flags available:
--with-jitter-include=DIR
The directory for the location of the jitterentropy.h include file, if
it is outside the system include path.
--with-jitter-lib=DIR
This is the directory containing the static libjitterentropy.a
library, if it is outside the system library path.
Setting the FIPS HMAC key
-------------------------
@ -530,7 +557,7 @@ Setting the FIPS HMAC key
As part of its self-test validation, the FIPS module must verify itself
by performing a SHA-256 HMAC computation on itself. The default key is
the SHA256 value of "the holy handgrenade of antioch" and is sufficient
the SHA256 value of "holy hand grenade of antioch" and is sufficient
for meeting the FIPS requirements.
To change the key to a different value, use this flag. The value should
@ -754,6 +781,12 @@ Don't build support for Elliptic Curves.
Don't build support for binary Elliptic Curves
### no-tls-deprecated-ec
Disable legacy TLS EC groups that were deprecated in RFC8422. These are the
Koblitz curves, B<secp160r1>, B<secp160r2>, B<secp192r1>, B<secp224r1>, and the
binary Elliptic curves that would also be disabled by C<no-ec2m>.
### enable-ec_nistp_64_gcc_128
Enable support for optimised implementations of some commonly used NIST
@ -807,6 +840,26 @@ Build (and install) the FIPS provider
Don't perform FIPS module run-time checks related to enforcement of security
parameters such as minimum security strength of keys.
### no-fips-post
Don't perform FIPS module Power On Self Tests.
This option MUST be used for debugging only as it makes the FIPS provider
non-compliant. It is useful when setting breakpoints in FIPS algorithms.
### enable-fips-jitter
Use the CPU Jitter library as a FIPS validated entropy source.
This option will only produce a compliant FIPS provider if you have:
1. independently performed the required [SP 800-90B] entropy assessments;
2. meet the minimum required entropy as specified by [jitterentropy-library];
3. obtain an [ESV] certificate for the [jitterentropy-library] and
4. have had the resulting FIPS provider certified by the [CMVP].
Failure to do all of these will produce a non-compliant FIPS provider.
### enable-fuzz-libfuzzer, enable-fuzz-afl
Build with support for fuzzing using either libfuzzer or AFL.
@ -838,6 +891,16 @@ Disabling this also disables the legacy algorithms: MD2 (already disabled by def
Don't generate dependencies.
### no-ml-dsa
Disable Module-Lattice-Based Digital Signature Standard (ML-DSA) support.
ML-DSA is based on CRYSTALS-DILITHIUM. See [FIPS 204].
### no-ml-kem
Disable Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)
support. ML-KEM is based on CRYSTALS-KYBER. See [FIPS 203].
### no-module
Don't build any dynamically loadable engines.
@ -870,6 +933,10 @@ As synonym for `no-padlockeng`. Deprecated and should not be used.
Don't build with support for Position Independent Code.
### enable-pie
Build with support for Position Independent Execution.
### no-pinshared
Don't pin the shared libraries.
@ -923,6 +990,11 @@ Do not create shared libraries, only static ones.
See [Notes on shared libraries](#notes-on-shared-libraries) below.
### no-slh-dsa
Disable Stateless Hash Based Digital Signature Standard support.
(SLH-DSA is based on SPHINCS+. See [FIPS 205])
### no-sm2-precomp
Disable using the SM2 precomputed table on aarch64 to make the library smaller.
@ -1027,6 +1099,17 @@ Build with support for the integrated tracing api.
See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details.
### enable-sslkeylog
Build with support for the SSLKEYLOGFILE environment variable
When enabled, setting SSLKEYLOGFILE to a file path records the keys exchanged
during a TLS handshake for use in analysis tools like wireshark. Note that the
use of this mechanism allows for decryption of application payloads found in
captured packets using keys from the key log file and therefore has significant
security consequences. See Section 3 of
[the draft standard for SSLKEYLOGFILE](https://datatracker.ietf.org/doc/draft-ietf-tls-keylogfile/)
### no-ts
Don't build Time Stamping (TS) Authority support.
@ -1113,6 +1196,10 @@ synonymous with `no-ssl3`. Note this only affects version negotiation.
OpenSSL will still provide the methods for applications to explicitly select
the individual protocol versions.
### no-integrity-only-ciphers
Don't build support for integrity only ciphers in tls.
### no-{protocol}-method
no-{ssl3|tls1|tls1_1|tls1_2|dtls1|dtls1_2}-method
@ -1134,9 +1221,9 @@ Build with support for the specified algorithm.
### no-{algorithm}
no-{aria|bf|blake2|camellia|cast|chacha|cmac|
des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb|
poly1305|rc2|rc4|rmd160|scrypt|seed|
siphash|siv|sm2|sm3|sm4|whirlpool}
des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ml-dsa|
ml-kem|ocb|poly1305|rc2|rc4|rmd160|scrypt|
seed|siphash|siv|sm2|sm3|sm4|whirlpool}
Build without support for the specified algorithm.
@ -1291,7 +1378,7 @@ Configure OpenSSL
### Automatic Configuration
In previous version, the `config` script determined the platform type and
compiler and then called `Configure`. Starting with this release, they are
compiler and then called `Configure`. Starting with version 3.0, they are
the same.
#### Unix / Linux / macOS
@ -1634,6 +1721,12 @@ described here. Examine the Makefiles themselves for the full list.
build_docs
Build all documentation components.
debuginfo
On unix platforms, this target can be used to create .debug
libraries, which separate the DWARF information in the
shared library ELF files into a separate file for use
in post-mortem (core dump) debugging
clean
Remove all build artefacts and return the directory to a "clean"
state.
@ -1746,7 +1839,7 @@ More about our support resources can be found in the [SUPPORT] file.
### Configuration Errors
If the `./Configure` or `./Configure` command fails with an error message,
If the `./config` or `./Configure` command fails with an error message,
read the error message carefully and try to figure out whether you made
a mistake (e.g., by providing a wrong option), or whether the script is
working incorrectly. If you think you encountered a bug, please
@ -1958,3 +2051,24 @@ is used, as it is the version of the GNU assembler that will be checked.
[10-main.conf]:
Configurations/10-main.conf
[CMVP]:
<https://csrc.nist.gov/projects/cryptographic-module-validation-program>
[ESV]:
<https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations>
[FIPS 203]:
<https://csrc.nist.gov/pubs/fips/203/final>
[FIPS 204]:
<https://csrc.nist.gov/pubs/fips/204/final>
[SP 800-90B]:
<https://csrc.nist.gov/pubs/sp/800/90/b/final>
[jitterentropy-library]:
<https://github.com/smuellerDD/jitterentropy-library>
[FIPS 205]:
<https://csrc.nist.gov/pubs/fips/205/final>

302
NEWS.md
View file

@ -7,6 +7,8 @@ release. For more details please read the CHANGES file.
OpenSSL Releases
----------------
- [OpenSSL 3.5](#openssl-35)
- [OpenSSL 3.4](#openssl-34)
- [OpenSSL 3.3](#openssl-33)
- [OpenSSL 3.2](#openssl-32)
- [OpenSSL 3.1](#openssl-31)
@ -18,18 +20,302 @@ OpenSSL Releases
- [OpenSSL 1.0.0](#openssl-100)
- [OpenSSL 0.9.x](#openssl-09x)
OpenSSL 3.5
-----------
### Major changes between OpenSSL 3.5 and OpenSSL 3.6 [under development]
* none
### Major changes between OpenSSL 3.4 and OpenSSL 3.5 [under development]
OpenSSL 3.5.0 is a feature release adding significant new functionality to
OpenSSL.
This release incorporates the following potentially significant or incompatible
changes:
* Default encryption cipher for the `req`, `cms`, and `smime` applications
changed from `des-ede3-cbc` to `aes-256-cbc`.
* The TLS supported groups list has been changed in favor of PQC support.
* The default TLS keyshares have been changed to offer X25519MLKEM768 and
and X25519.
This release adds the following new features:
* Support for server side QUIC (RFC 9000)
* Support for 3rd party QUIC stacks
* Support for PQC algorithms (ML-KEM, ML-DSA, SLH-DSA)
* Allow the FIPS provider to optionally use the `JITTER` seed source.
Because this seed source is not part of the OpenSSL FIPS validations,
it should only be enabled after the [jitterentropy-library] has been
assessed for entropy quality. Moreover, the FIPS provider including
this entropy source will need to obtain an [ESV] from the [CMVP] before
FIPS compliance can be claimed. Enable this using the configuration
option `enable-fips-jitter`.
* Support for central key generation in CMP
* Support added for opaque symmetric key objects (EVP_SKEY).
* Support for multiple TLS keyshares.
OpenSSL 3.4
-----------
### Major changes between OpenSSL 3.4.0 and OpenSSL 3.4.1 [11 Feb 2025]
OpenSSL 3.4.1 is a security patch release. The most severe CVE fixed in this
release is High.
This release incorporates the following bug fixes and mitigations:
* Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected.
([CVE-2024-12797])
* Fixed timing side-channel in ECDSA signature computation.
([CVE-2024-13176])
### Major changes between OpenSSL 3.3 and OpenSSL 3.4.0 [22 Oct 2024]
OpenSSL 3.4.0 is a feature release adding significant new functionality to
OpenSSL.
This release incorporates the following potentially significant or incompatible
changes:
* Deprecation of TS_VERIFY_CTX_set_* functions and addition of replacement
TS_VERIFY_CTX_set0_* functions with improved semantics
* Redesigned use of OPENSSLDIR/ENGINESDIR/MODULESDIR on Windows such that
what were formerly build time locations can now be defined at run time
with registry keys
* The X25519 and X448 key exchange implementation in the FIPS provider
is unapproved and has `fips=no` property.
* SHAKE-128 and SHAKE-256 implementations have no default digest length
anymore. That means these algorithms cannot be used with
EVP_DigestFinal/_ex() unless the `xoflen` param is set before.
* Setting `config_diagnostics=1` in the config file will cause errors to
be returned from SSL_CTX_new() and SSL_CTX_new_ex() if there is an error
in the ssl module configuration.
* An empty renegotiate extension will be used in TLS client hellos instead
of the empty renegotiation SCSV, for all connections with a minimum TLS
version > 1.0.
* Deprecation of SSL_SESSION_get_time(), SSL_SESSION_set_time() and
SSL_CTX_flush_sessions() functions in favor of their respective `_ex`
functions which are Y2038-safe on platforms with Y2038-safe `time_t`
This release adds the following new features:
* Support for directly fetched composite signature algorithms such as
RSA-SHA2-256 including new API functions
* FIPS indicators support in the FIPS provider and various updates of the FIPS
provider required for future FIPS 140-3 validations
* Implementation of RFC 9579 (PBMAC1) in PKCS#12
* An optional additional random seed source RNG `JITTER` using a statically
linked jitterentropy library
* New options `-not_before` and `-not_after` for explicit setting start and
end dates of certificates created with the `req` and `x509` apps
* Support for integrity-only cipher suites TLS_SHA256_SHA256 and
TLS_SHA384_SHA384 in TLS 1.3, as defined in RFC 9150
* Support for retrieving certificate request templates and CRLs in CMP
* Support for additional X.509v3 extensions related to Attribute Certificates
* Initial Attribute Certificate (RFC 5755) support
* Possibility to customize ECC groups initialization to use precomputed values
to save CPU time and use of this feature by the P-256 implementation
OpenSSL 3.3
-----------
### Major changes between OpenSSL 3.2 and OpenSSL 3.3 [under development]
### Major changes between OpenSSL 3.3.2 and OpenSSL 3.3.3 [under development]
OpenSSL 3.3.3 is a security patch release. The most severe CVE fixed in this
release is Low.
This release incorporates the following bug fixes and mitigations:
* Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
curve parameters.
([CVE-2024-9143])
### Major changes between OpenSSL 3.3.1 and OpenSSL 3.3.2 [3 Sep 2024]
OpenSSL 3.3.2 is a security patch release. The most severe CVE fixed in this
release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fixed possible denial of service in X.509 name checks
([CVE-2024-6119])
* Fixed possible buffer overread in SSL_select_next_proto()
([CVE-2024-5535])
### Major changes between OpenSSL 3.3.0 and OpenSSL 3.3.1 [4 Jun 2024]
OpenSSL 3.3.1 is a security patch release. The most severe CVE fixed in this
release is Low.
This release incorporates the following bug fixes and mitigations:
* Fixed potential use after free after SSL_free_buffers() is called
([CVE-2024-4741])
* Fixed an issue where checking excessively long DSA keys or parameters may
be very slow
([CVE-2024-4603])
### Major changes between OpenSSL 3.2 and OpenSSL 3.3.0 [9 Apr 2024]
OpenSSL 3.3.0 is a feature release adding significant new functionality to
OpenSSL.
This release adds the following new features:
* Support for qlog for tracing QUIC connections has been added
* Added APIs to allow configuring the negotiated idle timeout for QUIC
connections, and to allow determining the number of additional streams
that can currently be created for a QUIC connection.
* Added APIs to allow disabling implicit QUIC event processing for QUIC SSL
objects
* Added APIs to allow querying the size and utilisation of a QUIC stream's
write buffer
* New API `SSL_write_ex2`, which can be used to send an end-of-stream (FIN)
condition in an optimised way when using QUIC.
* Limited support for polling of QUIC connection and stream objects in a
non-blocking manner.
* Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple
times with different output sizes.
* Added exporter for CMake on Unix and Windows, alongside the pkg-config
exporter.
* The BLAKE2s hash algorithm matches BLAKE2b's support for configurable
output length.
* The EVP_PKEY_fromdata function has been augmented to allow for the
derivation of CRT (Chinese Remainder Theorem) parameters when requested
* Added API functions SSL_SESSION_get_time_ex(), SSL_SESSION_set_time_ex()
using time_t which is Y2038 safe on 32 bit systems when 64 bit time
is enabled
* Unknown entries in TLS SignatureAlgorithms, ClientSignatureAlgorithms
config options and the respective calls to SSL[_CTX]_set1_sigalgs() and
SSL[_CTX]_set1_client_sigalgs() that start with `?` character are
ignored and the configuration will still be used.
* Added `-set_issuer` and `-set_subject` options to `openssl x509` to
override the Issuer and Subject when creating a certificate. The `-subj`
option now is an alias for `-set_subject`.
* Added several new features of CMPv3 defined in RFC 9480 and RFC 9483
* New option `SSL_OP_PREFER_NO_DHE_KEX`, which allows configuring a TLS1.3
server to prefer session resumption using PSK-only key exchange over PSK
with DHE, if both are available.
* New atexit configuration switch, which controls whether the OPENSSL_cleanup
is registered when libcrypto is unloaded.
* Added X509_STORE_get1_objects to avoid issues with the existing
X509_STORE_get0_objects API in multi-threaded applications.
* Support for using certificate profiles and extened delayed delivery in CMP
This release incorporates the following potentially significant or incompatible
changes:
* Applied AES-GCM unroll8 optimisation to Microsoft Azure Cobalt 100
* Optimized AES-CTR for ARM Neoverse V1 and V2
* Enable AES and SHA3 optimisations on Apple Silicon M3-based MacOS systems
similar to M1/M2.
* Various optimizations for cryptographic routines using RISC-V vector crypto
extensions
* Added assembly implementation for md5 on loongarch64
* Accept longer context for TLS 1.2 exporters
* The activate and soft_load configuration settings for providers in
openssl.cnf have been updated to require a value of [1|yes|true|on]
(in lower or UPPER case) to enable the setting. Conversely a value
of [0|no|false|off] will disable the setting.
* In `openssl speed`, changed the default hash function used with `hmac` from
`md5` to `sha256`.
* The `-verify` option to the `openssl crl` and `openssl req` will make the
program exit with 1 on failure.
* The d2i_ASN1_GENERALIZEDTIME(), d2i_ASN1_UTCTIME(), ASN1_TIME_check(), and
related functions have been augmented to check for a minimum length of
the input string, in accordance with ITU-T X.690 section 11.7 and 11.8.
* OPENSSL_sk_push() and sk_<TYPE>_push() functions now return 0 instead of -1
if called with a NULL stack argument.
* New limit on HTTP response headers is introduced to HTTP client. The
default limit is set to 256 header lines.
This release incorporates the following bug fixes and mitigations:
* The BIO_get_new_index() function can only be called 127 times before it
reaches its upper bound of BIO_TYPE_MASK and will now return -1 once its
exhausted.
A more detailed list of changes in this release can be found in the
[CHANGES.md] file.
Users interested in using the new QUIC functionality are encouraged to read the
[README file for QUIC][README-QUIC.md], which provides links to relevant
documentation and example code.
As always, bug reports and issues relating to OpenSSL can be [filed on our issue
tracker][issue tracker].
OpenSSL 3.2
-----------
### Major changes between OpenSSL 3.2.0 and OpenSSL 3.2.1 [under development]
### Major changes between OpenSSL 3.2.1 and OpenSSL 3.2.2 [under development]
OpenSSL 3.2.2 is a security patch release. The most severe CVE fixed in this
release is Low.
This release incorporates the following bug fixes and mitigations:
* Fixed unbounded memory growth with session handling in TLSv1.3
([CVE-2024-2511])
### Major changes between OpenSSL 3.2.0 and OpenSSL 3.2.1 [30 Jan 2024]
OpenSSL 3.2.1 is a security patch release. The most severe CVE fixed in this
release is Low.
@ -38,8 +324,10 @@ This release incorporates the following bug fixes and mitigations:
* Fixed PKCS12 Decoding crashes
([CVE-2024-0727])
* Fixed excessive time spent checking invalid RSA public keys
([CVE-2023-6237])
* Fixed POLY1305 MAC implementation corrupting vector registers on PowerPC
CPUs which support PowerISA 2.07
([CVE-2023-6129])
@ -1592,6 +1880,13 @@ OpenSSL 0.9.x
<!-- Links -->
[CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511
[CVE-2024-0727]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-0727
[CVE-2023-6237]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6237
[CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129
@ -1764,3 +2059,6 @@ OpenSSL 0.9.x
[CHANGES.md]: ./CHANGES.md
[README-QUIC.md]: ./README-QUIC.md
[issue tracker]: https://github.com/openssl/openssl/issues
[CMVP]: https://csrc.nist.gov/projects/cryptographic-module-validation-program
[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
[jitterentropy-library]: https://github.com/smuellerDD/jitterentropy-library

33
NOTES-ANSI.md Normal file
View file

@ -0,0 +1,33 @@
Notes on ANSI C
===============
When building for pure ANSI C (C89/C90), you must configure with at least
the following configuration settings:
- `no-asm`
There are cases of `asm()` calls in our C source, which isn't supported
in pure ANSI C.
- `no-secure-memory`
The secure memory calls aren't supported with ANSI C.
- `-D_XOPEN_SOURCE=1`
This macro enables the use of the following types, functions and global
variables:
- `timezone`
- `-D_POSIX_C_SOURCE=200809L`
This macro enables the use of the following types, functions and global
variables:
- `ssize_t`
- `strdup()`
It's arguable that with gcc and clang, all of these issues are removed when
defining the macro `_DEFAULT_SOURCE`. However, that effectively sets the C
language level to C99, which isn't ANSI C.

34
NOTES-NONSTOP.md
View file

@ -19,9 +19,7 @@ About c99 compiler
The c99 compiler is required for building OpenSSL from source. While c11
may work, it has not been broadly tested. c99 is the only compiler
prerequisite needed to build OpenSSL 3.0 on this platform. You should also
have the FLOSS package installed on your system. The ITUGLIB FLOSS package
is the only FLOSS variant that has been broadly tested.
prerequisite needed to build OpenSSL 3.0 on this platform.
Threading Models
----------------
@ -32,11 +30,21 @@ for each on the TNS/X (L-Series) platform:
* `nonstop-nsx` or default will select an unthreaded 32-bit build.
* `nonstop-nsx_64` selects an unthreaded 64-bit memory and file length build.
* `nonstop-nsx_64_klt` selects the 64-bit memory and file length KLT build.
* `nonstop-nsx_put` selects the PUT build.
* `nonstop-nsx_64_put` selects the 64-bit memory and file length PUT build.
The KLT threading model is a newly released model on NonStop. It implements
kernel-level threading. KLT provides much closer threading to what OpenSSL
uses for Linux-like threading models. KLT continues to use the pthread library
API. There is no supported 32-bit or Guardian builds for KLT. Note: KLT is
not currently available but is planned for post-2024.
The SPT threading model is no longer supported as of OpenSSL 3.2.
The PUT model is incompatible with the QUIC capability. This capability should
be disabled when building with PUT.
### TNS/E Considerations
The TNS/E platform is build using the same set of builds specifying `nse`
@ -123,12 +131,9 @@ correctly, you also need the `COMP_ROOT` set, as in:
`COMP_ROOT` needs to be in Windows form.
`Configure` must specify the `no-makedepend` option otherwise errors will
result when running the build because the c99 cross-compiler does not support
the `gcc -MT` option. An example of a `Configure` command to be run from the
OpenSSL directory is:
An example of a `Configure` command to be run from the OpenSSL directory is:
./Configure nonstop-nsx_64 no-makedepend --with-rand-seed=rdcpu
./Configure nonstop-nsx_64 --with-rand-seed=rdcpu
Do not forget to include any OpenSSL cross-compiling prefix and certificate
options when creating your libraries.
@ -216,15 +221,12 @@ Example Configure Targets
-------------------------
For OSS targets, the main DLL names will be `libssl.so` and `libcrypto.so`.
For GUARDIAN targets, DLL names will be `ssl` and `crypto`. The following
assumes that your PWD is set according to your installation standards.
The following assumes that your PWD is set according to your installation
standards.
./Configure nonstop-nsx --prefix=${PWD} \
--openssldir=${PWD}/ssl no-threads \
--with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
./Configure nonstop-nsx_g --prefix=${PWD} \
--openssldir=${PWD}/ssl no-threads \
--with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
./Configure nonstop-nsx_put --prefix=${PWD} \
--openssldir=${PWD}/ssl threads "-D_REENTRANT" \
--with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
@ -234,9 +236,6 @@ assumes that your PWD is set according to your installation standards.
./Configure nonstop-nsx_64_put --prefix=${PWD} \
--openssldir=${PWD}/ssl threads "-D_REENTRANT" \
--with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
./Configure nonstop-nsx_g_tandem --prefix=${PWD} \
--openssldir=${PWD}/ssl no-threads \
--with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
./Configure nonstop-nse --prefix=${PWD} \
--openssldir=${PWD}/ssl no-threads \
@ -253,6 +252,3 @@ assumes that your PWD is set according to your installation standards.
./Configure nonstop-nse_64_put --prefix=${PWD} \
--openssldir=${PWD}/ssl threads "-D_REENTRANT"
--with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
./Configure nonstop-nse_g_tandem --prefix=${PWD} \
--openssldir=${PWD}/ssl no-threads \
--with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}

20
NOTES-POSIX.md Normal file
View file

@ -0,0 +1,20 @@
Notes on POSIX
==============
There are few instances where OpenSSL requires a POSIX C library, at least
version 1-2008, or compatible enough functionality.
There are exceptions, though, for platforms that do not have a POSIX
library, or where there are quirks that need working around. A notable
platform is Windows, where POSIX functionality may be available, but where
the function names are prefixed with an underscore, and where some POSIX
types are not present (such as `ssize_t`).
Platforms that do have a POSIX library may still not have them accessible
unless the following macros are defined:
_POSIX_C_SOURCE=200809L
_XOPEN_SOURCE=1
This is, for example, the case when building with gcc or clang and using the
flag `-ansi`.

16
NOTES-VALGRIND.md
View file

@ -1,9 +1,9 @@
Notes on Valgrind
=================
Valgrind is a test harness that includes many tools such as memcheck,
[Valgrind](https://valgrind.org/) is a test harness that includes many tools such as memcheck,
which is commonly used to check for memory leaks, etc. The default tool
run by Valgrind is memcheck. There are other tools available, but this
run by Valgrind is memcheck. There are [other tools available](https://valgrind.org/info/tools.html), but this
will focus on memcheck.
Valgrind runs programs in a virtual machine, this means OpenSSL unit
@ -13,11 +13,11 @@ Requirements
------------
1. Platform supported by Valgrind
See <http://valgrind.org/info/platforms.html>
- See [Valgrind Supported Platforms](http://valgrind.org/info/platforms.html)
2. Valgrind installed on the platform
See <http://valgrind.org/downloads/current.html>
- See [Valgrind Current Releases](http://valgrind.org/downloads/current.html)
3. OpenSSL compiled
See [INSTALL.md](INSTALL.md)
- See [INSTALL.md](INSTALL.md)
Running Tests
-------------
@ -32,7 +32,7 @@ to allow programs to find shared libraries. The variable can be modified
to specify a different executable environment.
EXE_SHELL=\
"`/bin/pwd`/util/wrap.pl valgrind --error-exitcode=1 --leak-check=full -q"
"$(/bin/pwd)/util/wrap.pl valgrind --error-exitcode=1 --leak-check=full -q"
This will start up Valgrind with the default checker (`memcheck`).
The `--error-exitcode=1` option specifies that Valgrind should exit with an
@ -62,11 +62,11 @@ file [test/README.md](test/README.md).
Example command line:
$ make test EXE_SHELL="`/bin/pwd`/util/wrap.pl valgrind --error-exitcode=1 \
$ make test EXE_SHELL="$(/bin/pwd)/util/wrap.pl valgrind --error-exitcode=1 \
--leak-check=full -q" OPENSSL_ia32cap=":0"
If an error occurs, you can then run the specific test via the `TESTS` variable
with the `VERBOSE` or `VF` or `VFP` options to gather additional information.
$ make test VERBOSE=1 TESTS=test_test EXE_SHELL="`/bin/pwd`/util/wrap.pl \
$ make test VERBOSE=1 TESTS=test_test EXE_SHELL="$(/bin/pwd)/util/wrap.pl \
valgrind --error-exitcode=1 --leak-check=full -q" OPENSSL_ia32cap=":0"

52
NOTES-WINDOWS.md
View file

@ -99,31 +99,41 @@ check the INSTALL.md file.
Installation directories
------------------------
The default installation directories are derived from environment
variables.
On most Unix platforms installation directories are determined at build time via
constant defines. On Windows platforms however, installation directories are
determined via registry keys, as it is common practice to build OpenSSL and
install it to a variety of locations.
For VC-WIN32, the following defaults are use:
The following keys:
PREFIX: %ProgramFiles(x86)%\OpenSSL
OPENSSLDIR: %CommonProgramFiles(x86)%\SSL
`\\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenSSL-<version>-<ctx>\OPENSSLDIR`
`\\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenSSL-<version>-<ctx>\ENGINESDIR`
`\\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenSSL-<version>-<ctx>\MODULESDIR`
For VC-WIN64, the following defaults are use:
Can be administratively set, and openssl will take the paths found there as the
values for OPENSSLDIR, ENGINESDIR and MODULESDIR respectively.
PREFIX: %ProgramW6432%\OpenSSL
OPENSSLDIR: %CommonProgramW6432%\SSL
To enable the reading of registry keys from windows builds, add
`-DOSSL_WINCTX=<string>`to the Configure command line. This define is used
at build-time to construct library build specific registry key paths of the
format:
`\\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\OpenSSL-<version>-<ctx>`
Should those environment variables not exist (on a pure Win32
installation for examples), these fallbacks are used:
Where `<version>` is the major.minor version of the library being
built, and `<ctx>` is the value specified by `-DOPENSSL_WINCTX`. This allows
for multiple openssl builds to be created and installed on a single system, in
which each library can use its own set of registry keys.
PREFIX: %ProgramFiles%\OpenSSL
OPENSSLDIR: %CommonProgramFiles%\SSL
Note the installer available at <https://github.com/openssl/installer> will set
these keys when the installer is run.
ALSO NOTE that those directories are usually write protected, even if
your account is in the Administrators group. To work around that,
start the command prompt by right-clicking on it and choosing "Run as
Administrator" before running `nmake install`. The other solution
is, of course, to choose a different set of directories by using
`--prefix` and `--openssldir` when configuring.
A summary table of behavior on Windows platforms
|`OSSL_WINCTX`|Registry key|OpenSSL Behavior |
|-------------|------------|------------------------------------------|
|Defined | Defined |OpenSSL Reads Paths from Registry |
|Defined | Undefined |OpenSSL returns errors on module/conf load|
|Undefined | N/A |OpenSSL uses build time defaults |
Special notes for Universal Windows Platform builds, aka `VC-*-UWP`
-------------------------------------------------------------------
@ -138,8 +148,8 @@ Native builds using Embarcadero C++Builder
=========================================
This toolchain (a descendant of Turbo/Borland C++) is an alternative to MSVC.
OpenSSL currently includes an experimental 32-bit configuration targeting the
Clang-based compiler (`bcc32c.exe`) in v10.3.3 Community Edition.
OpenSSL currently includes experimental 32-bit and 64-bit configurations targeting the
Clang-based compiler (`bcc32c.exe` and `bcc64.exe`) in v10.3.3 Community Edition.
<https://www.embarcadero.com/products/cbuilder/starter>
1. Install Perl.
@ -148,6 +158,8 @@ Clang-based compiler (`bcc32c.exe`) in v10.3.3 Community Edition.
3. Go to the root of the OpenSSL source directory and run:
`perl Configure BC-32 --prefix=%CD%`
for Win64 builds use:
`perl Configure BC-64 --prefix=%CD%`
4. `make -N`

30
README-FIPS.md
View file

@ -166,3 +166,33 @@ Documentation about using the FIPS module is available on the [fips_module(7)]
manual page.
[fips_module(7)]: https://www.openssl.org/docs/manmaster/man7/fips_module.html
Entropy Source
==============
The FIPS provider typically relies on an external entropy source,
specified during OpenSSL build configuration (default: `os`). However, by
enabling the `enable-fips-jitter` option during configuration, an internal
jitter entropy source will be used instead. Note that this will cause
the FIPS provider to operate in a non-compliant mode unless an entropy
assessment [ESV] and validation through the [CMVP] are additionally conducted.
Note that the `enable-fips-jitter` option is only available in OpenSSL
versions 3.5 and later.
[CMVP]: https://csrc.nist.gov/projects/cryptographic-module-validation-program
[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
3rd-Party Vendor Builds
=====================================
Some Vendors choose to patch/modify/build their own FIPS provider,
test it with a Security Laboratory and submit it under their own CMVP
certificate, instead of using OpenSSL Project submissions. When doing
so, FIPS provider should uniquely identify its own name and version
number. The build infrastructure allows to customize FIPS provider
build information via changes to strings in `VERSION.dat`.
Setting "PRE_RELEASE_TAG" (dashed suffix), "BUILD_METADATA" (plus
suffix), and "FIPS_VENDOR" allow to control reported FIPS provider
name and build version as required for CMVP submission.

35
README.md
View file

@ -4,7 +4,10 @@ Welcome to the OpenSSL Project
[![openssl logo]][www.openssl.org]
[![github actions ci badge]][github actions ci]
[![appveyor badge]][appveyor jobs]
![Nightly OS Zoo ci badge](https://github.com/openssl/openssl/actions/workflows/os-zoo.yml/badge.svg)
![Provider Compatibility](https://github.com/openssl/openssl/actions/workflows/provider-compatibility.yml/badge.svg)
![Quic Interop](https://github.com/openssl/openssl/actions/workflows/run_quic_interop.yml/badge.svg)
![Daily checks](https://github.com/openssl/openssl/actions/workflows/run-checker-daily.yml/badge.svg)
OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit
for the TLS (formerly SSL), DTLS and QUIC (currently client side only)
@ -64,7 +67,7 @@ For Production Use
------------------
Source code tarballs of the official releases can be downloaded from
[www.openssl.org/source](https://www.openssl.org/source).
[openssl-library.org/source/](https://openssl-library.org/source/).
The OpenSSL project does not distribute the toolkit in binary form.
However, for a large variety of operating systems precompiled versions
@ -84,22 +87,18 @@ the source tarballs, having a local copy of the git repository with
the entire project history gives you much more insight into the
code base.
The official OpenSSL Git Repository is located at [git.openssl.org].
There is a GitHub mirror of the repository at [github.com/openssl/openssl],
The main OpenSSL Git repository is private.
There is a public GitHub mirror of it at [github.com/openssl/openssl],
which is updated automatically from the former on every commit.
A local copy of the Git Repository can be obtained by cloning it from
the original OpenSSL repository using
git clone git://git.openssl.org/openssl.git
or from the GitHub mirror using
A local copy of the Git repository can be obtained by cloning it from
the GitHub mirror using
git clone https://github.com/openssl/openssl.git
If you intend to contribute to OpenSSL, either to fix bugs or contribute
new features, you need to fork the OpenSSL repository openssl/openssl on
GitHub and clone your public fork instead.
new features, you need to fork the GitHub mirror and clone your public fork
instead.
git clone https://github.com/yourname/openssl.git
@ -159,7 +158,7 @@ available online.
Demos
-----
The are numerous source code demos for using various OpenSSL capabilities in the
There are numerous source code demos for using various OpenSSL capabilities in the
[demos subfolder](./demos).
Wiki
@ -199,7 +198,7 @@ attempting to develop or distribute cryptographic code.
Copyright
=========
Copyright (c) 1998-2023 The OpenSSL Project Authors
Copyright (c) 1998-2025 The OpenSSL Project Authors
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
@ -211,14 +210,6 @@ All rights reserved.
<https://www.openssl.org>
"OpenSSL Homepage"
[git.openssl.org]:
<https://git.openssl.org>
"OpenSSL Git Repository"
[git.openssl.org]:
<https://git.openssl.org>
"OpenSSL Git Repository"
[github.com/openssl/openssl]:
<https://github.com/openssl/openssl>
"OpenSSL GitHub Mirror"

2
VERSION.dat
View file

@ -1,5 +1,5 @@
MAJOR=3
MINOR=3
MINOR=6
PATCH=0
PRE_RELEASE_TAG=dev
BUILD_METADATA=

8
apps/asn1parse.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -127,7 +127,8 @@ int asn1parse_main(int argc, char **argv)
dump = strtol(opt_arg(), NULL, 0);
break;
case OPT_STRPARSE:
sk_OPENSSL_STRING_push(osk, opt_arg());
if (sk_OPENSSL_STRING_push(osk, opt_arg()) <= 0)
goto end;
break;
case OPT_GENSTR:
genstr = opt_arg();
@ -216,6 +217,9 @@ int asn1parse_main(int argc, char **argv)
i = BIO_read(in, &(buf->data[num]), BUFSIZ);
if (i <= 0)
break;
/* make sure num doesn't overflow */
if (i > LONG_MAX - num)
goto end;
num += i;
}
}

2
apps/build.info
View file

@ -16,7 +16,7 @@ $OPENSSLSRC=\
enc.c errstr.c \
genpkey.c kdf.c mac.c nseq.c passwd.c pkcs7.c \
pkcs8.c pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c \
s_client.c s_server.c s_time.c sess_id.c smime.c speed.c \
s_client.c s_server.c s_time.c sess_id.c skeyutl.c smime.c speed.c \
spkac.c verify.c version.c x509.c rehash.c storeutl.c \
list.c info.c fipsinstall.c pkcs12.c
IF[{- !$disabled{'ec'} -}]

36
apps/ca.c
View file

@ -1,11 +1,13 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "internal/e_os.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@ -150,7 +152,7 @@ typedef enum OPTION_choice {
OPT_IN, OPT_INFORM, OPT_OUT, OPT_DATEOPT, OPT_OUTDIR, OPT_VFYOPT,
OPT_SIGOPT, OPT_NOTEXT, OPT_BATCH, OPT_PRESERVEDN, OPT_NOEMAILDN,
OPT_GENCRL, OPT_MSIE_HACK, OPT_CRL_LASTUPDATE, OPT_CRL_NEXTUPDATE,
OPT_CRLDAYS, OPT_CRLHOURS, OPT_CRLSEC,
OPT_CRLDAYS, OPT_CRLHOURS, OPT_CRLSEC, OPT_NOT_BEFORE, OPT_NOT_AFTER,
OPT_INFILES, OPT_SS_CERT, OPT_SPKAC, OPT_REVOKE, OPT_VALID,
OPT_EXTENSIONS, OPT_EXTFILE, OPT_STATUS, OPT_UPDATEDB, OPT_CRLEXTS,
OPT_RAND_SERIAL, OPT_QUIET,
@ -199,10 +201,13 @@ const OPTIONS ca_options[] = {
"Always create a random serial; do not store it"},
{"multivalue-rdn", OPT_MULTIVALUE_RDN, '-',
"Deprecated; multi-valued RDNs support is always on."},
{"startdate", OPT_STARTDATE, 's', "Cert notBefore, YYMMDDHHMMSSZ"},
{"startdate", OPT_STARTDATE, 's',
"[CC]YYMMDDHHMMSSZ value for notBefore certificate field"},
{"not_before", OPT_NOT_BEFORE, 's', "An alias for -startdate"},
{"enddate", OPT_ENDDATE, 's',
"YYMMDDHHMMSSZ cert notAfter (overrides -days)"},
{"days", OPT_DAYS, 'p', "Number of days to certify the cert for"},
"[CC]YYMMDDHHMMSSZ value for notAfter certificate field, overrides -days"},
{"not_after", OPT_NOT_AFTER, 's', "An alias for -enddate"},
{"days", OPT_DAYS, 'p', "Number of days from today to certify the cert for"},
{"extensions", OPT_EXTENSIONS, 's',
"Extension section (override value in config file)"},
{"extfile", OPT_EXTFILE, '<',
@ -359,9 +364,11 @@ opthelp:
/* obsolete */
break;
case OPT_STARTDATE:
case OPT_NOT_BEFORE:
startdate = opt_arg();
break;
case OPT_ENDDATE:
case OPT_NOT_AFTER:
enddate = opt_arg();
break;
case OPT_DAYS:
@ -874,22 +881,8 @@ end_of_options:
if (startdate == NULL)
startdate =
app_conf_try_string(conf, section, ENV_DEFAULT_STARTDATE);
if (startdate != NULL && !ASN1_TIME_set_string_X509(NULL, startdate)) {
BIO_printf(bio_err,
"start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
goto end;
}
if (startdate == NULL)
startdate = "today";
if (enddate == NULL)
enddate = app_conf_try_string(conf, section, ENV_DEFAULT_ENDDATE);
if (enddate != NULL && !ASN1_TIME_set_string_X509(NULL, enddate)) {
BIO_printf(bio_err,
"end date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
goto end;
}
if (days == 0) {
if (!app_conf_try_number(conf, section, ENV_DEFAULT_DAYS, &days))
days = 0;
@ -898,6 +891,9 @@ end_of_options:
BIO_printf(bio_err, "cannot lookup how many days to certify for\n");
goto end;
}
if (days != 0 && enddate != NULL)
BIO_printf(bio_err,
"Warning: -enddate or -not_after option overriding -days option\n");
if (rand_ser) {
if ((serial = BN_new()) == NULL || !rand_serial(serial, NULL)) {
@ -1671,7 +1667,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
goto end;
}
if (!set_cert_times(ret, startdate, enddate, days))
if (!set_cert_times(ret, startdate, enddate, days, 0))
goto end;
if (enddate != NULL) {

518
apps/cmp.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2019
* Copyright Siemens AG 2015-2019
*
@ -10,6 +10,7 @@
*/
/* This app is disabled when OPENSSL_NO_CMP is defined. */
#include "internal/e_os.h"
#include <string.h>
#include <ctype.h>
@ -94,6 +95,11 @@ static char *opt_oldwithold = NULL;
static char *opt_newwithnew = NULL;
static char *opt_newwithold = NULL;
static char *opt_oldwithnew = NULL;
static char *opt_crlcert = NULL;
static char *opt_oldcrl = NULL;
static char *opt_crlout = NULL;
static char *opt_template = NULL;
static char *opt_keyspec = NULL;
/* client authentication */
static char *opt_ref = NULL;
@ -118,6 +124,8 @@ static char *opt_profile = NULL;
/* certificate enrollment */
static char *opt_newkey = NULL;
static char *opt_newkeypass = NULL;
static int opt_centralkeygen = 0;
static char *opt_newkeyout = NULL;
static char *opt_subject = NULL;
static int opt_days = 0;
static char *opt_reqexts = NULL;
@ -143,6 +151,12 @@ static int opt_revreason = CRL_REASON_NONE;
/* credentials format */
static char *opt_certform_s = "PEM";
static int opt_certform = FORMAT_PEM;
/*
* DER format is the preferred choice for saving a CRL because it allows for
* more efficient storage, especially when dealing with large CRLs.
*/
static char *opt_crlform_s = "DER";
static int opt_crlform = FORMAT_ASN1;
static char *opt_keyform_s = NULL;
static int opt_keyform = FORMAT_UNDEF;
static char *opt_otherpass = NULL;
@ -187,6 +201,9 @@ static char *opt_srv_trusted = NULL;
static char *opt_srv_untrusted = NULL;
static char *opt_ref_cert = NULL;
static char *opt_rsp_cert = NULL;
static char *opt_rsp_key = NULL;
static char *opt_rsp_keypass = NULL;
static char *opt_rsp_crl = NULL;
static char *opt_rsp_extracerts = NULL;
static char *opt_rsp_capubs = NULL;
static char *opt_rsp_newwithnew = NULL;
@ -215,8 +232,10 @@ typedef enum OPTION_choice {
OPT_CONFIG, OPT_SECTION, OPT_VERBOSITY,
OPT_CMD, OPT_INFOTYPE, OPT_PROFILE, OPT_GENINFO,
OPT_TEMPLATE, OPT_KEYSPEC,
OPT_NEWKEY, OPT_NEWKEYPASS, OPT_SUBJECT,
OPT_NEWKEY, OPT_NEWKEYPASS, OPT_CENTRALKEYGEN,
OPT_NEWKEYOUT, OPT_SUBJECT,
OPT_DAYS, OPT_REQEXTS,
OPT_SANS, OPT_SAN_NODEFAULT,
OPT_POLICIES, OPT_POLICY_OIDS, OPT_POLICY_OIDS_CRITICAL,
@ -237,12 +256,13 @@ typedef enum OPTION_choice {
OPT_IGNORE_KEYUSAGE, OPT_UNPROTECTED_ERRORS, OPT_NO_CACHE_EXTRACERTS,
OPT_SRVCERTOUT, OPT_EXTRACERTSOUT, OPT_CACERTSOUT,
OPT_OLDWITHOLD, OPT_NEWWITHNEW, OPT_NEWWITHOLD, OPT_OLDWITHNEW,
OPT_CRLCERT, OPT_OLDCRL, OPT_CRLOUT,
OPT_REF, OPT_SECRET, OPT_CERT, OPT_OWN_TRUSTED, OPT_KEY, OPT_KEYPASS,
OPT_DIGEST, OPT_MAC, OPT_EXTRACERTS,
OPT_UNPROTECTED_REQUESTS,
OPT_CERTFORM, OPT_KEYFORM,
OPT_CERTFORM, OPT_CRLFORM, OPT_KEYFORM,
OPT_OTHERPASS,
#ifndef OPENSSL_NO_ENGINE
OPT_ENGINE,
@ -267,7 +287,8 @@ typedef enum OPTION_choice {
OPT_SRV_REF, OPT_SRV_SECRET,
OPT_SRV_CERT, OPT_SRV_KEY, OPT_SRV_KEYPASS,
OPT_SRV_TRUSTED, OPT_SRV_UNTRUSTED,
OPT_REF_CERT, OPT_RSP_CERT, OPT_RSP_EXTRACERTS, OPT_RSP_CAPUBS,
OPT_REF_CERT, OPT_RSP_CERT, OPT_RSP_KEY, OPT_RSP_KEYPASS,
OPT_RSP_CRL, OPT_RSP_EXTRACERTS, OPT_RSP_CAPUBS,
OPT_RSP_NEWWITHNEW, OPT_RSP_NEWWITHOLD, OPT_RSP_OLDWITHNEW,
OPT_POLL_COUNT, OPT_CHECK_AFTER,
OPT_GRANT_IMPLICITCONF,
@ -302,11 +323,19 @@ const OPTIONS cmp_options[] = {
"Comma-separated list of OID and value to place in generalInfo PKIHeader"},
{OPT_MORE_STR, 0, 0,
"of form <OID>:int:<n> or <OID>:str:<s>, e.g. \'1.2.3.4:int:56789, id-kp:str:name'"},
{ "template", OPT_TEMPLATE, 's',
"File to save certTemplate received in genp of type certReqTemplate"},
{ "keyspec", OPT_KEYSPEC, 's',
"Optional file to save Key specification received in genp of type certReqTemplate"},
OPT_SECTION("Certificate enrollment"),
{"newkey", OPT_NEWKEY, 's',
"Private or public key for the requested cert. Default: CSR key or client key"},
{"newkeypass", OPT_NEWKEYPASS, 's', "New private key pass phrase source"},
{"centralkeygen", OPT_CENTRALKEYGEN, '-',
"Request central (server-side) key generation. Default is local generation"},
{"newkeyout", OPT_NEWKEYOUT, 's',
"File to save centrally generated key, in PEM format"},
{"subject", OPT_SUBJECT, 's',
"Distinguished Name (DN) of subject to use in the requested cert template"},
{OPT_MORE_STR, 0, 0,
@ -428,6 +457,12 @@ const OPTIONS cmp_options[] = {
"File to save NewWithOld cert received in genp of type rootCaKeyUpdate"},
{ "oldwithnew", OPT_OLDWITHNEW, 's',
"File to save OldWithNew cert received in genp of type rootCaKeyUpdate"},
{ "crlcert", OPT_CRLCERT, 's',
"certificate to request a CRL for in genm of type crlStatusList"},
{ "oldcrl", OPT_OLDCRL, 's',
"CRL to request update for in genm of type crlStatusList"},
{ "crlout", OPT_CRLOUT, 's',
"File to save new CRL received in genp of type 'crls'"},
OPT_SECTION("Client authentication"),
{"ref", OPT_REF, 's',
@ -459,6 +494,8 @@ const OPTIONS cmp_options[] = {
OPT_SECTION("Credentials format"),
{"certform", OPT_CERTFORM, 's',
"Format (PEM or DER) to use when saving a certificate to a file. Default PEM"},
{"crlform", OPT_CRLFORM, 's',
"Format (PEM or DER) to use when saving a CRL to a file. Default DER"},
{"keyform", OPT_KEYFORM, 's',
"Format of the key input (ENGINE, other values ignored)"},
{"otherpass", OPT_OTHERPASS, 's',
@ -544,6 +581,14 @@ const OPTIONS cmp_options[] = {
"Certificate to be expected for rr and any oldCertID in kur messages"},
{"rsp_cert", OPT_RSP_CERT, 's',
"Certificate to be returned as mock enrollment result"},
{"rsp_key", OPT_RSP_KEY, 's',
"Private key for the certificate to be returned as mock enrollment result"},
{OPT_MORE_STR, 0, 0,
"Key to be returned for central key pair generation"},
{"rsp_keypass", OPT_RSP_KEYPASS, 's',
"Response private key (and cert) pass phrase source"},
{"rsp_crl", OPT_RSP_CRL, 's',
"CRL to be returned in genp of type crls"},
{"rsp_extracerts", OPT_RSP_EXTRACERTS, 's',
"Extra certificates to be included in mock certification responses"},
{"rsp_capubs", OPT_RSP_CAPUBS, 's',
@ -599,9 +644,10 @@ static varref cmp_vars[] = { /* must be in same order as enumerated above! */
{&opt_config}, {&opt_section}, {(char **)&opt_verbosity},
{&opt_cmd_s}, {&opt_infotype_s}, {&opt_profile}, {&opt_geninfo},
{&opt_template}, {&opt_keyspec},
{&opt_newkey}, {&opt_newkeypass}, {&opt_subject},
{(char **)&opt_days}, {&opt_reqexts},
{&opt_newkey}, {&opt_newkeypass}, {(char **)&opt_centralkeygen},
{&opt_newkeyout}, {&opt_subject}, {(char **)&opt_days}, {&opt_reqexts},
{&opt_sans}, {(char **)&opt_san_nodefault},
{&opt_policies}, {&opt_policy_oids}, {(char **)&opt_policy_oids_critical},
{(char **)&opt_popo}, {&opt_csr},
@ -623,13 +669,14 @@ static varref cmp_vars[] = { /* must be in same order as enumerated above! */
{(char **)&opt_no_cache_extracerts},
{&opt_srvcertout}, {&opt_extracertsout}, {&opt_cacertsout},
{&opt_oldwithold}, {&opt_newwithnew}, {&opt_newwithold}, {&opt_oldwithnew},
{&opt_crlcert}, {&opt_oldcrl}, {&opt_crlout},
{&opt_ref}, {&opt_secret},
{&opt_cert}, {&opt_own_trusted}, {&opt_key}, {&opt_keypass},
{&opt_digest}, {&opt_mac}, {&opt_extracerts},
{(char **)&opt_unprotected_requests},
{&opt_certform_s}, {&opt_keyform_s},
{&opt_certform_s}, {&opt_crlform_s}, {&opt_keyform_s},
{&opt_otherpass},
#ifndef OPENSSL_NO_ENGINE
{&opt_engine},
@ -652,7 +699,8 @@ static varref cmp_vars[] = { /* must be in same order as enumerated above! */
{&opt_srv_ref}, {&opt_srv_secret},
{&opt_srv_cert}, {&opt_srv_key}, {&opt_srv_keypass},
{&opt_srv_trusted}, {&opt_srv_untrusted},
{&opt_ref_cert}, {&opt_rsp_cert}, {&opt_rsp_extracerts}, {&opt_rsp_capubs},
{&opt_ref_cert}, {&opt_rsp_cert}, {&opt_rsp_key}, {&opt_rsp_keypass},
{&opt_rsp_crl}, {&opt_rsp_extracerts}, {&opt_rsp_capubs},
{&opt_rsp_newwithnew}, {&opt_rsp_newwithold}, {&opt_rsp_oldwithnew},
{(char **)&opt_poll_count}, {(char **)&opt_check_after},
@ -1010,6 +1058,19 @@ static int setup_certs(char *files, const char *desc, void *ctx,
return ok;
}
static int setup_mock_crlout(void *ctx, const char *file, const char *desc)
{
X509_CRL *crl;
int ok;
if (file == NULL)
return 1;
if ((crl = load_crl(file, FORMAT_UNDEF, 0, desc)) == NULL)
return 0;
ok = ossl_cmp_mock_srv_set1_crlOut(ctx, crl);
X509_CRL_free(crl);
return ok;
}
/*
* parse and transform some options, checking their syntax.
* Returns 1 on success, 0 on error
@ -1057,6 +1118,11 @@ static int transform_opts(void)
CMP_err("unknown option given for certificate storing format");
return 0;
}
if (opt_crlform_s != NULL
&& !opt_format(opt_crlform_s, OPT_FMT_PEMDER, &opt_crlform)) {
CMP_err("unknown option given for CRL storing format");
return 0;
}
return 1;
}
@ -1147,11 +1213,28 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
if (opt_rsp_cert == NULL) {
CMP_warn("no -rsp_cert given for mock server");
} else {
if (!setup_cert(srv_ctx, opt_rsp_cert, opt_keypass,
if (!setup_cert(srv_ctx, opt_rsp_cert, opt_rsp_keypass,
"cert the mock server returns on certificate requests",
(add_X509_fn_t)ossl_cmp_mock_srv_set1_certOut))
goto err;
}
if (opt_rsp_key != NULL) {
EVP_PKEY *pkey = load_key_pwd(opt_rsp_key, opt_keyform,
opt_rsp_keypass, engine,
"private key for enrollment cert");
if (pkey == NULL
|| !ossl_cmp_mock_srv_set1_keyOut(srv_ctx, pkey)) {
EVP_PKEY_free(pkey);
goto err;
}
EVP_PKEY_free(pkey);
}
cleanse(opt_rsp_keypass);
if (!setup_mock_crlout(srv_ctx, opt_rsp_crl,
"CRL to be returned by the mock server"))
goto err;
if (!setup_certs(opt_rsp_extracerts,
"CMP extra certificates for mock server", srv_ctx,
(add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_chainOut))
@ -1619,11 +1702,27 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
if (!set_name(opt_issuer, OSSL_CMP_CTX_set1_issuer, ctx, "issuer"))
return 0;
if (opt_cmd == CMP_IR || opt_cmd == CMP_CR || opt_cmd == CMP_KUR) {
if (opt_reqin == NULL && opt_newkey == NULL
if (opt_reqin == NULL && opt_newkey == NULL && !opt_centralkeygen
&& opt_key == NULL && opt_csr == NULL && opt_oldcert == NULL) {
CMP_err("missing -newkey (or -key) to be certified and no -csr, -oldcert, -cert, or -reqin option given, which could provide fallback public key");
CMP_err("missing -newkey (or -key) to be certified and no -csr, -oldcert, -cert, or -reqin option given, which could provide fallback public key."
" Neither central key generation is requested.");
return 0;
}
if (opt_popo == OSSL_CRMF_POPO_NONE && !opt_centralkeygen) {
CMP_info("POPO is disabled, which implies -centralkeygen");
opt_centralkeygen = 1;
}
if (opt_centralkeygen) {
if (opt_popo > OSSL_CRMF_POPO_NONE) {
CMP_err1("-popo value %d is inconsistent with -centralkeygen", opt_popo);
return 0;
}
if (opt_newkeyout == NULL) {
CMP_err("-newkeyout not given, nowhere to save centrally generated key");
return 0;
}
opt_popo = OSSL_CRMF_POPO_NONE;
}
if (opt_newkey == NULL
&& opt_popo != OSSL_CRMF_POPO_NONE
&& opt_popo != OSSL_CRMF_POPO_RAVERIFIED) {
@ -1671,6 +1770,12 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
CMP_warn1("-policies %s", msg);
if (opt_policy_oids != NULL)
CMP_warn1("-policy_oids %s", msg);
if (opt_popo != OSSL_CRMF_POPO_NONE - 1)
CMP_warn1("-popo %s", msg);
if (opt_centralkeygen)
CMP_warn1("-popo -1 or -centralkeygen %s", msg);
if (opt_newkeyout != NULL)
CMP_warn1("-newkeyout %s", msg);
if (opt_cmd != CMP_P10CR) {
if (opt_implicit_confirm)
CMP_warn1("-implicit_confirm %s, and 'p10cr'", msg);
@ -1775,13 +1880,14 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
pkey = load_pubkey(file, format, 0, pass, engine, desc);
priv = 0;
}
cleanse(opt_newkeypass);
if (pkey == NULL || !OSSL_CMP_CTX_set0_newPkey(ctx, priv, pkey)) {
EVP_PKEY_free(pkey);
return 0;
}
} else if (opt_reqin != NULL
&& opt_key == NULL && opt_csr == NULL && opt_oldcert == NULL) {
&& opt_key == NULL && opt_csr == NULL && opt_oldcert == NULL
&& !opt_centralkeygen) {
if (!set_fallback_pubkey(ctx))
return 0;
}
@ -1915,20 +2021,20 @@ static int add_certProfile(OSSL_CMP_CTX *ctx, const char *name)
if ((sk = sk_ASN1_UTF8STRING_new_reserve(NULL, 1)) == NULL)
return 0;
if ((utf8string = ASN1_UTF8STRING_new()) == NULL)
goto err;
if (!ASN1_STRING_set(utf8string, name, (int)strlen(name))) {
ASN1_STRING_free(utf8string);
goto err;
}
/* Due to sk_ASN1_UTF8STRING_new_reserve(NULL, 1), this surely succeeds: */
(void)sk_ASN1_UTF8STRING_push(sk, utf8string);
if ((itav = OSSL_CMP_ITAV_new0_certProfile(sk)) == NULL)
goto err;
if (OSSL_CMP_CTX_push0_geninfo_ITAV(ctx, itav))
return 1;
OSSL_CMP_ITAV_free(itav);
return 0;
if ((utf8string = ASN1_UTF8STRING_new()) == NULL)
goto err;
if (!ASN1_STRING_set(utf8string, name, (int)strlen(name))) {
ASN1_STRING_free(utf8string);
goto err;
}
/* Due to sk_ASN1_UTF8STRING_new_reserve(NULL, 1), this surely succeeds: */
(void)sk_ASN1_UTF8STRING_push(sk, utf8string);
if ((itav = OSSL_CMP_ITAV_new0_certProfile(sk)) == NULL)
goto err;
if (OSSL_CMP_CTX_push0_geninfo_ITAV(ctx, itav))
return 1;
OSSL_CMP_ITAV_free(itav);
return 0;
err:
sk_ASN1_UTF8STRING_pop_free(sk, ASN1_UTF8STRING_free);
@ -1973,7 +2079,7 @@ static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)
if (*ptr != '\0') {
if (*ptr != ',') {
CMP_err1("Missing ',' or end of -geninfo arg after int at %.40s",
ptr);
ptr);
goto err;
}
ptr++;
@ -2132,6 +2238,17 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
if (opt_oldwithnew != NULL)
CMP_warn1("-oldwithnew %s", msg);
}
if (opt_cmd != CMP_GENM || opt_infotype != NID_id_it_certReqTemplate) {
const char *msg = "option is ignored unless -cmd 'genm' and -infotype 'certReqTemplate' is given";
if (opt_template != NULL)
CMP_warn1("-template %s", msg);
if (opt_keyspec != NULL)
CMP_warn1("-keyspec %s", msg);
} else {
if (opt_template == NULL)
CMP_err("missing -template option for genm with infotype certReqTemplate");
}
if (!setup_verification_ctx(ctx))
goto err;
@ -2248,6 +2365,18 @@ static int write_cert(BIO *bio, X509 *cert)
return 0;
}
static int write_crl(BIO *bio, X509_CRL *crl)
{
if (opt_crlform != FORMAT_PEM && opt_crlform != FORMAT_ASN1) {
BIO_printf(bio_err, "error: unsupported type '%s' for writing CRLs\n",
opt_crlform_s);
return 0;
}
return opt_crlform == FORMAT_PEM ? PEM_write_bio_X509_CRL(bio, crl)
: i2d_X509_CRL_bio(bio, crl);
}
/*
* If file != NULL writes out a stack of certs to the given file.
* If certs is NULL, the file is emptied.
@ -2295,6 +2424,35 @@ static int save_free_certs(STACK_OF(X509) *certs,
return n;
}
static int save_crl(X509_CRL *crl,
const char *file, const char *desc)
{
BIO *bio = NULL;
int res = 0;
if (file == NULL)
return 1;
if (crl != NULL)
CMP_info2("received %s, saving to file '%s'", desc, file);
if ((bio = BIO_new(BIO_s_file())) == NULL
|| !BIO_write_filename(bio, (char *)file)) {
CMP_err2("could not open file '%s' for writing %s",
file, desc);
goto end;
}
if (!write_crl(bio, crl)) {
CMP_err2("cannot write %s to file '%s'", desc, file);
goto end;
}
res = 1;
end:
BIO_free(bio);
return res;
}
static int delete_file(const char *file, const char *desc)
{
if (file == NULL)
@ -2328,6 +2486,64 @@ static int save_cert_or_delete(X509 *cert, const char *file, const char *desc)
}
}
static int save_crl_or_delete(X509_CRL *crl, const char *file, const char *desc)
{
if (file == NULL)
return 1;
return (crl == NULL) ? delete_file(file, desc) : save_crl(crl, file, desc);
}
static int save_template(const char *file, const OSSL_CRMF_CERTTEMPLATE *tmpl)
{
BIO *bio = BIO_new_file(file, "wb");
if (bio == NULL) {
CMP_err1("error saving certTemplate from genp: cannot open file %s",
file);
return 0;
}
if (!ASN1_i2d_bio_of(OSSL_CRMF_CERTTEMPLATE, i2d_OSSL_CRMF_CERTTEMPLATE,
bio, tmpl)) {
CMP_err1("error saving certTemplate from genp: cannot write file %s",
file);
return 0;
} else {
CMP_info1("stored certTemplate from genp to file '%s'", file);
}
BIO_free(bio);
return 1;
}
static int save_keyspec(const char *file, const OSSL_CMP_ATAVS *keyspec)
{
BIO *bio = BIO_new_file(file, "wb");
if (bio == NULL) {
CMP_err1("error saving keySpec from genp: cannot open file %s", file);
return 0;
}
if (!ASN1_i2d_bio_of(OSSL_CMP_ATAVS, i2d_OSSL_CMP_ATAVS, bio, keyspec)) {
CMP_err1("error saving keySpec from genp: cannot write file %s", file);
return 0;
} else {
CMP_info1("stored keySpec from genp to file '%s'", file);
}
BIO_free(bio);
return 1;
}
static const char *nid_name(int nid)
{
const char *name = OBJ_nid2ln(nid);
if (name == NULL)
name = OBJ_nid2sn(nid);
if (name == NULL)
name = "<unknown OID>";
return name;
}
static int print_itavs(const STACK_OF(OSSL_CMP_ITAV) *itavs)
{
int i, ret = 1;
@ -2727,6 +2943,15 @@ static int get_opts(int argc, char **argv)
case OPT_OLDWITHNEW:
opt_oldwithnew = opt_str();
break;
case OPT_CRLCERT:
opt_crlcert = opt_str();
break;
case OPT_OLDCRL:
opt_oldcrl = opt_str();
break;
case OPT_CRLOUT:
opt_crlout = opt_str();
break;
case OPT_V_CASES:
if (!opt_verify(o, vpm))
@ -2744,13 +2969,24 @@ static int get_opts(int argc, char **argv)
case OPT_GENINFO:
opt_geninfo = opt_str();
break;
case OPT_TEMPLATE:
opt_template = opt_str();
break;
case OPT_KEYSPEC:
opt_keyspec = opt_str();
break;
case OPT_NEWKEY:
opt_newkey = opt_str();
break;
case OPT_NEWKEYPASS:
opt_newkeypass = opt_str();
break;
case OPT_CENTRALKEYGEN:
opt_centralkeygen = 1;
break;
case OPT_NEWKEYOUT:
opt_newkeyout = opt_str();
break;
case OPT_SUBJECT:
opt_subject = opt_str();
break;
@ -2822,6 +3058,9 @@ static int get_opts(int argc, char **argv)
case OPT_CERTFORM:
opt_certform_s = opt_str();
break;
case OPT_CRLFORM:
opt_crlform_s = opt_str();
break;
case OPT_KEYFORM:
opt_keyform_s = opt_str();
break;
@ -2905,6 +3144,15 @@ static int get_opts(int argc, char **argv)
case OPT_RSP_CERT:
opt_rsp_cert = opt_str();
break;
case OPT_RSP_KEY:
opt_rsp_key = opt_str();
break;
case OPT_RSP_KEYPASS:
opt_rsp_keypass = opt_str();
break;
case OPT_RSP_CRL:
opt_rsp_crl = opt_str();
break;
case OPT_RSP_EXTRACERTS:
opt_rsp_extracerts = opt_str();
break;
@ -3047,6 +3295,71 @@ static int cmp_server(OSSL_CMP_CTX *srv_cmp_ctx)
}
#endif
static void print_keyspec(OSSL_CMP_ATAVS *keySpec)
{
const char *desc = "specifications contained in keySpec from genp";
BIO *mem;
int i;
const char *p;
long len;
if (keySpec == NULL) {
CMP_info1("No %s", desc);
return;
}
mem = BIO_new(BIO_s_mem());
if (mem == NULL) {
CMP_err1("Out of memory - cannot dump key %s", desc);
return;
}
BIO_printf(mem, "Key %s:\n", desc);
for (i = 0; i < sk_OSSL_CMP_ATAV_num(keySpec); i++) {
OSSL_CMP_ATAV *atav = sk_OSSL_CMP_ATAV_value(keySpec, i);
ASN1_OBJECT *type = OSSL_CMP_ATAV_get0_type(atav /* may be NULL */);
int nid = OBJ_obj2nid(type);
switch (nid) {
case NID_id_regCtrl_algId:
{
X509_ALGOR *alg = OSSL_CMP_ATAV_get0_algId(atav);
const ASN1_OBJECT *oid;
int paramtype;
const void *param;
X509_ALGOR_get0(&oid, &paramtype, &param, alg);
BIO_printf(mem, "Key algorithm: ");
i2a_ASN1_OBJECT(mem, oid);
if (paramtype == V_ASN1_UNDEF || alg->parameter == NULL) {
BIO_printf(mem, "\n");
} else {
BIO_printf(mem, " - ");
ASN1_item_print(mem, (ASN1_VALUE *)alg,
0, ASN1_ITEM_rptr(X509_ALGOR), NULL);
}
}
break;
case NID_id_regCtrl_rsaKeyLen:
BIO_printf(mem, "Key algorithm: RSA %d\n",
OSSL_CMP_ATAV_get_rsaKeyLen(atav));
break;
default:
BIO_printf(mem, "Invalid key spec: %s\n", nid_name(nid));
break;
}
}
BIO_printf(mem, "End of key %s", desc);
len = BIO_get_mem_data(mem, &p);
if (len > INT_MAX)
CMP_err1("Info too large - cannot dump key %s", desc);
else
CMP_info2("%.*s", (int)len, p);
BIO_free(mem);
return;
}
static void print_status(void)
{
/* print PKIStatusInfo */
@ -3141,6 +3454,94 @@ static int do_genm(OSSL_CMP_CTX *ctx)
end_upd:
X509_free(oldwithold);
return res;
} else if (opt_infotype == NID_id_it_crlStatusList) {
X509_CRL *oldcrl = NULL, *crl = NULL;
X509 *crlcert = NULL;
int res = 0;
const char *desc = "CRL from genp of type 'crls'";
if (opt_oldcrl == NULL && opt_crlcert == NULL) {
CMP_err("Missing -oldcrl and no -crlcert given for -infotype crlStatusList");
return 0;
}
if (opt_crlout == NULL) {
CMP_err("Missing -crlout for -infotype crlStatusList");
return 0;
}
if (opt_crlcert != NULL) {
crlcert = load_cert_pwd(opt_crlcert, opt_otherpass,
"Cert for genm with -infotype crlStatusList");
if (crlcert == NULL)
goto end_crlupd;
}
if (opt_oldcrl != NULL) {
oldcrl = load_crl(opt_oldcrl, FORMAT_UNDEF, 0,
"CRL for genm with -infotype crlStatusList");
if (oldcrl == NULL)
goto end_crlupd;
}
if (opt_oldcrl != NULL && opt_crlcert != NULL) {
if (X509_NAME_cmp(X509_CRL_get_issuer(oldcrl),
X509_get_issuer_name(crlcert))
!= 0)
CMP_warn("-oldcrl and -crlcert have different issuer");
}
if (!OSSL_CMP_get1_crlUpdate(ctx, crlcert, oldcrl, &crl))
goto end_crlupd;
if (crl == NULL)
CMP_info("no CRL update available");
if (!save_crl_or_delete(crl, opt_crlout, desc))
goto end_crlupd;
res = 1;
end_crlupd:
X509_free(crlcert);
X509_CRL_free(oldcrl);
X509_CRL_free(crl);
return res;
} else if (opt_infotype == NID_id_it_certReqTemplate) {
OSSL_CRMF_CERTTEMPLATE *certTemplate;
OSSL_CMP_ATAVS *keySpec;
int res = 0;
if (!OSSL_CMP_get1_certReqTemplate(ctx, &certTemplate, &keySpec))
return 0;
if (certTemplate == NULL) {
CMP_warn("no certificate request template available");
if (!delete_file(opt_template, "certTemplate from genp"))
return 0;
if (opt_keyspec != NULL
&& !delete_file(opt_keyspec, "keySpec from genp"))
return 0;
return 1;
}
if (!save_template(opt_template, certTemplate))
goto tmpl_end;
print_keyspec(keySpec);
if (opt_keyspec != NULL) {
if (keySpec == NULL) {
CMP_warn("no key specifications available");
if (!delete_file(opt_keyspec, "keySpec from genp"))
goto tmpl_end;
} else if (!save_keyspec(opt_keyspec, keySpec)) {
goto tmpl_end;
}
}
res = 1;
tmpl_end:
OSSL_CRMF_CERTTEMPLATE_free(certTemplate);
sk_OSSL_CMP_ATAV_pop_free(keySpec, OSSL_CMP_ATAV_free);
return res;
} else {
OSSL_CMP_ITAV *req;
STACK_OF(OSSL_CMP_ITAV) *itavs;
@ -3358,10 +3759,10 @@ int cmp_main(int argc, char **argv)
if (opt_reqout_only != NULL) {
const char *msg = "option is ignored since -reqout_only option is given";
#if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
# if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
if (opt_server != NULL)
CMP_warn1("-server %s", msg);
#endif
# endif
if (opt_use_mock_srv)
CMP_warn1("-use_mock_srv %s", msg);
if (opt_reqout != NULL)
@ -3435,13 +3836,56 @@ int cmp_main(int argc, char **argv)
opt_extracertsout, "extra") < 0)
goto err;
if (newcert != NULL && (opt_cmd == CMP_IR || opt_cmd == CMP_CR
|| opt_cmd == CMP_KUR || opt_cmd == CMP_P10CR))
if (!save_cert_or_delete(newcert, opt_certout, "newly enrolled")
|| save_free_certs(OSSL_CMP_CTX_get1_newChain(cmp_ctx),
opt_chainout, "chain") < 0
|| save_free_certs(OSSL_CMP_CTX_get1_caPubs(cmp_ctx),
opt_cacertsout, "CA") < 0)
|| opt_cmd == CMP_KUR || opt_cmd == CMP_P10CR)) {
STACK_OF(X509) *newchain = OSSL_CMP_CTX_get1_newChain(cmp_ctx);
if (newcert != NULL && newchain != NULL /* NULL is on error only */
&& opt_certout != NULL && opt_chainout != NULL
&& strcmp(opt_certout, opt_chainout) == 0) {
if (!X509_add_cert(newchain, newcert, X509_ADD_FLAG_PREPEND
| X509_ADD_FLAG_UP_REF)) {
sk_X509_pop_free(newchain, X509_free);
goto err;
}
if (!save_free_certs(newchain, opt_chainout, "newly enrolled cert and chain"))
goto err;
} else {
if (save_free_certs(newchain, opt_chainout, "chain") < 0
|| !save_cert_or_delete(newcert, opt_certout, "newly enrolled"))
goto err;
}
if (save_free_certs(OSSL_CMP_CTX_get1_caPubs(cmp_ctx),
opt_cacertsout, "CA") < 0)
goto err;
if (opt_centralkeygen) {
EVP_CIPHER *cipher = NULL;
char *pass_string = NULL;
BIO *out;
int result = 1;
EVP_PKEY *new_key = OSSL_CMP_CTX_get0_newPkey(cmp_ctx, 1 /* priv */);
if (new_key == NULL)
goto err;
if ((out = bio_open_owner(opt_newkeyout, FORMAT_PEM, 1)) == NULL)
goto err;
if (opt_newkeypass != NULL) {
pass_string = get_passwd(opt_newkeypass,
"Centrally generated private key password");
cipher = EVP_CIPHER_fetch(app_get0_libctx(), SN_aes_256_cbc, app_get0_propq());
}
CMP_info1("saving centrally generated key to file '%s'", opt_newkeyout);
if (PEM_write_bio_PrivateKey(out, new_key, cipher, NULL, 0, NULL,
(void *)pass_string) <= 0)
result = 0;
BIO_free(out);
clear_free(pass_string);
EVP_CIPHER_free(cipher);
if (!result)
goto err;
}
}
if (!OSSL_CMP_CTX_reinit(cmp_ctx))
goto err;
}

68
apps/cms.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2008-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2008-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -69,7 +69,8 @@ typedef enum OPTION_choice {
OPT_DIGEST, OPT_DIGEST_CREATE, OPT_COMPRESS, OPT_UNCOMPRESS,
OPT_ED_DECRYPT, OPT_ED_ENCRYPT, OPT_DEBUG_DECRYPT, OPT_TEXT,
OPT_ASCIICRLF, OPT_NOINTERN, OPT_NOVERIFY, OPT_NOCERTS,
OPT_NOATTR, OPT_NODETACH, OPT_NOSMIMECAP, OPT_BINARY, OPT_KEYID,
OPT_NOATTR, OPT_NODETACH, OPT_NOSMIMECAP, OPT_NO_SIGNING_TIME,
OPT_BINARY, OPT_KEYID,
OPT_NOSIGS, OPT_NO_CONTENT_VERIFY, OPT_NO_ATTR_VERIFY, OPT_INDEF,
OPT_NOINDEF, OPT_CRLFEOL, OPT_NOOUT, OPT_RR_PRINT,
OPT_RR_ALL, OPT_RR_FIRST, OPT_RCTFORM, OPT_CERTFILE, OPT_CAFILE,
@ -133,7 +134,7 @@ const OPTIONS cms_options[] = {
{"binary", OPT_BINARY, '-',
"Treat input as binary: do not translate to canonical form"},
{"crlfeol", OPT_CRLFEOL, '-',
"Use CRLF as EOL termination instead of CR only" },
"Use CRLF as EOL termination instead of LF only" },
{"asciicrlf", OPT_ASCIICRLF, '-',
"Perform CRLF canonicalisation when signing"},
@ -175,7 +176,10 @@ const OPTIONS cms_options[] = {
OPT_SECTION("Signing"),
{"md", OPT_MD, 's', "Digest algorithm to use"},
{"signer", OPT_SIGNER, 's', "Signer certificate input file"},
{"certfile", OPT_CERTFILE, '<', "Other certificates file"},
{"certfile", OPT_CERTFILE, '<',
"Extra signer and intermediate CA certificates to include when signing"},
{OPT_MORE_STR, 0, 0,
"or to use as preferred signer certs and for chain building when verifying"},
{"cades", OPT_CADES, '-',
"Include signingCertificate attribute (CAdES-BES)"},
{"nodetach", OPT_NODETACH, '-', "Use opaque signing"},
@ -183,6 +187,8 @@ const OPTIONS cms_options[] = {
"Don't include signer's certificate when signing"},
{"noattr", OPT_NOATTR, '-', "Don't include any signed attributes"},
{"nosmimecap", OPT_NOSMIMECAP, '-', "Omit the SMIMECapabilities attribute"},
{"no_signing_time", OPT_NO_SIGNING_TIME, '-',
"Omit the signing time attribute"},
{"receipt_request_all", OPT_RR_ALL, '-',
"When signing, create a receipt request for all recipients"},
{"receipt_request_first", OPT_RR_FIRST, '-',
@ -426,6 +432,9 @@ int cms_main(int argc, char **argv)
case OPT_NOSMIMECAP:
flags |= CMS_NOSMIMECAP;
break;
case OPT_NO_SIGNING_TIME:
flags |= CMS_NO_SIGNING_TIME;
break;
case OPT_BINARY:
flags |= CMS_BINARY;
break;
@ -502,13 +511,15 @@ int cms_main(int argc, char **argv)
if (rr_from == NULL
&& (rr_from = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(rr_from, opt_arg());
if (sk_OPENSSL_STRING_push(rr_from, opt_arg()) <= 0)
goto end;
break;
case OPT_RR_TO:
if (rr_to == NULL
&& (rr_to = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(rr_to, opt_arg());
if (sk_OPENSSL_STRING_push(rr_to, opt_arg()) <= 0)
goto end;
break;
case OPT_PRINT:
noout = print = 1;
@ -585,13 +596,15 @@ int cms_main(int argc, char **argv)
if (sksigners == NULL
&& (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(sksigners, signerfile);
if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
goto end;
if (keyfile == NULL)
keyfile = signerfile;
if (skkeys == NULL
&& (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(skkeys, keyfile);
if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
goto end;
keyfile = NULL;
}
signerfile = opt_arg();
@ -609,12 +622,14 @@ int cms_main(int argc, char **argv)
if (sksigners == NULL
&& (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(sksigners, signerfile);
if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
goto end;
signerfile = NULL;
if (skkeys == NULL
&& (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(skkeys, keyfile);
if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
goto end;
}
keyfile = opt_arg();
break;
@ -668,7 +683,8 @@ int cms_main(int argc, char **argv)
key_param->next = nparam;
key_param = nparam;
}
sk_OPENSSL_STRING_push(key_param->param, opt_arg());
if (sk_OPENSSL_STRING_push(key_param->param, opt_arg()) <= 0)
goto end;
break;
case OPT_V_CASES:
if (!opt_verify(o, vpm))
@ -714,7 +730,6 @@ int cms_main(int argc, char **argv)
}
/* Remaining args are files to process. */
argc = opt_num_rest();
argv = opt_rest();
if ((rr_allorfirst != -1 || rr_from != NULL) && rr_to == NULL) {
@ -755,12 +770,14 @@ int cms_main(int argc, char **argv)
if (sksigners == NULL
&& (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(sksigners, signerfile);
if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
goto end;
if (skkeys == NULL && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
if (keyfile == NULL)
keyfile = signerfile;
sk_OPENSSL_STRING_push(skkeys, keyfile);
if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
goto end;
}
if (sksigners == NULL) {
BIO_printf(bio_err, "No signer certificate specified\n");
@ -819,15 +836,8 @@ int cms_main(int argc, char **argv)
}
if (operation == SMIME_ENCRYPT) {
if (!cipher) {
#ifndef OPENSSL_NO_DES
cipher = (EVP_CIPHER *)EVP_des_ede3_cbc();
#else
BIO_printf(bio_err, "No cipher selected\n");
goto end;
#endif
}
if (!cipher)
cipher = (EVP_CIPHER *)EVP_aes_256_cbc();
if (secret_key && !secret_keyid) {
BIO_printf(bio_err, "No secret key id\n");
goto end;
@ -1001,7 +1011,7 @@ int cms_main(int argc, char **argv)
goto end;
pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
if (kparam != NULL) {
if (pctx != NULL && kparam != NULL) {
if (!cms_set_pkey_param(pctx, kparam->param))
goto end;
}
@ -1042,8 +1052,15 @@ int cms_main(int argc, char **argv)
pwri_tmp = NULL;
}
if (!(flags & CMS_STREAM)) {
if (!CMS_final(cms, in, NULL, flags))
if (!CMS_final(cms, in, NULL, flags)) {
if (originator != NULL
&& ERR_GET_REASON(ERR_peek_error())
== CMS_R_ERROR_UNSUPPORTED_STATIC_KEY_AGREEMENT) {
BIO_printf(bio_err, "Cannot use originator for encryption\n");
goto end;
}
goto end;
}
}
} else if (operation == SMIME_ENCRYPTED_ENCRYPT) {
cms = CMS_EncryptedData_encrypt_ex(in, cipher, secret_key,
@ -1294,6 +1311,7 @@ int cms_main(int argc, char **argv)
X509_free(cert);
X509_free(recip);
X509_free(signer);
X509_free(originator);
EVP_PKEY_free(key);
EVP_CIPHER_free(cipher);
EVP_CIPHER_free(wrap_cipher);

7
apps/crl.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -248,9 +248,10 @@ int crl_main(int argc, char **argv)
EVP_PKEY_free(pkey);
if (i < 0)
goto end;
if (i == 0)
if (i == 0) {
BIO_printf(bio_err, "verify failure\n");
else
goto end;
} else
BIO_printf(bio_err, "verify OK\n");
}

11
apps/crl2pkcs7.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -138,7 +138,9 @@ int crl2pkcs7_main(int argc, char **argv)
if ((crl_stack = sk_X509_CRL_new_null()) == NULL)
goto end;
p7s->crl = crl_stack;
sk_X509_CRL_push(crl_stack, crl);
if (!sk_X509_CRL_push(crl_stack, crl))
goto end;
crl = NULL; /* now part of p7 for OPENSSL_freeing */
}
@ -216,7 +218,10 @@ static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile)
while (sk_X509_INFO_num(sk)) {
xi = sk_X509_INFO_shift(sk);
if (xi->x509 != NULL) {
sk_X509_push(stack, xi->x509);
if (!sk_X509_push(stack, xi->x509)) {
X509_INFO_free(xi);
goto end;
}
xi->x509 = NULL;
count++;
}

4
apps/demoSRP/srp_verifier.txt
View file

@ -1,6 +1,6 @@
# This is a file that will be filled by the openssl srp routine.
# You can initialize the file with additional groups, these are
# records starting with an I followed by the g and N values and the id.
# records starting with an 'I' followed by the 'g' and 'N' values and the ID.
# The exact values ... you have to dig this out from the source of srp.c
# or srp_vfy.c
# The last value of an I is used as the default group for new users.
# The last value of an 'I' is used as the default group for new users.

235
apps/dgst.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -24,6 +24,9 @@
#undef BUFSIZE
#define BUFSIZE 1024*8
static int do_fp_oneshot_sign(BIO *out, EVP_MD_CTX *ctx, BIO *in, int sep, int binout,
EVP_PKEY *key, unsigned char *sigin, int siglen,
const char *sig_name, const char *file);
int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen,
EVP_PKEY *key, unsigned char *sigin, int siglen,
const char *sig_name, const char *md_name,
@ -93,7 +96,7 @@ const OPTIONS dgst_options[] = {
int dgst_main(int argc, char **argv)
{
BIO *in = NULL, *inp, *bmd = NULL, *out = NULL;
BIO *in = NULL, *inp = NULL, *bmd = NULL, *out = NULL;
ENGINE *e = NULL, *impl = NULL;
EVP_PKEY *sigkey = NULL;
STACK_OF(OPENSSL_STRING) *sigopts = NULL, *macopts = NULL;
@ -111,6 +114,8 @@ int dgst_main(int argc, char **argv)
unsigned char *buf = NULL, *sigbuf = NULL;
int engine_impl = 0;
struct doall_dgst_digests dec;
EVP_MD_CTX *signctx = NULL;
int oneshot_sign = 0;
buf = app_malloc(BUFSIZE, "I/O buffer");
md = (EVP_MD *)EVP_get_digestbyname(argv[0]);
@ -278,8 +283,6 @@ int dgst_main(int argc, char **argv)
}
if (keyfile != NULL) {
int type;
if (want_pub)
sigkey = load_pubkey(keyfile, keyform, 0, NULL, e, "public key");
else
@ -290,14 +293,16 @@ int dgst_main(int argc, char **argv)
*/
goto end;
}
type = EVP_PKEY_get_id(sigkey);
if (type == EVP_PKEY_ED25519 || type == EVP_PKEY_ED448) {
/*
* We implement PureEdDSA for these which doesn't have a separate
* digest, and only supports one shot.
*/
BIO_printf(bio_err, "Key type not supported for this operation\n");
goto end;
{
char def_md[80];
if (EVP_PKEY_get_default_digest_name(sigkey, def_md,
sizeof(def_md)) == 2
&& strcmp(def_md, "UNDEF") == 0)
oneshot_sign = 1;
signctx = EVP_MD_CTX_new();
if (signctx == NULL)
goto end;
}
}
@ -342,7 +347,9 @@ int dgst_main(int argc, char **argv)
EVP_PKEY_CTX *pctx = NULL;
int res;
if (BIO_get_md_ctx(bmd, &mctx) <= 0) {
if (oneshot_sign) {
mctx = signctx;
} else if (BIO_get_md_ctx(bmd, &mctx) <= 0) {
BIO_printf(bio_err, "Error getting context\n");
goto end;
}
@ -379,6 +386,11 @@ int dgst_main(int argc, char **argv)
/* we use md as a filter, reading from 'in' */
else {
EVP_MD_CTX *mctx = NULL;
if (oneshot_sign) {
BIO_printf(bio_err, "Oneshot algorithms don't use a digest\n");
goto end;
}
if (BIO_get_md_ctx(bmd, &mctx) <= 0) {
BIO_printf(bio_err, "Error getting context\n");
goto end;
@ -407,19 +419,20 @@ int dgst_main(int argc, char **argv)
goto end;
}
}
inp = BIO_push(bmd, in);
if (!oneshot_sign) {
inp = BIO_push(bmd, in);
if (md == NULL) {
EVP_MD_CTX *tctx;
if (md == NULL) {
EVP_MD_CTX *tctx;
BIO_get_md_ctx(bmd, &tctx);
md = EVP_MD_CTX_get1_md(tctx);
BIO_get_md_ctx(bmd, &tctx);
md = EVP_MD_CTX_get1_md(tctx);
}
if (md != NULL)
md_name = EVP_MD_get0_name(md);
}
if (md != NULL)
md_name = EVP_MD_get0_name(md);
if (xoflen > 0) {
if (!(EVP_MD_get_flags(md) & EVP_MD_FLAG_XOF)) {
if (!EVP_MD_xof(md)) {
BIO_printf(bio_err, "Length can only be specified for XOF\n");
goto end;
}
@ -436,8 +449,12 @@ int dgst_main(int argc, char **argv)
if (argc == 0) {
BIO_set_fp(in, stdin, BIO_NOCLOSE);
ret = do_fp(out, buf, inp, separator, out_bin, xoflen, sigkey, sigbuf,
siglen, NULL, md_name, "stdin");
if (oneshot_sign)
ret = do_fp_oneshot_sign(out, signctx, in, separator, out_bin,
sigkey, sigbuf, siglen, NULL, "stdin");
else
ret = do_fp(out, buf, inp, separator, out_bin, xoflen,
sigkey, sigbuf, siglen, NULL, md_name, "stdin");
} else {
const char *sig_name = NULL;
@ -452,9 +469,16 @@ int dgst_main(int argc, char **argv)
ret = EXIT_FAILURE;
continue;
} else {
if (do_fp(out, buf, inp, separator, out_bin, xoflen,
sigkey, sigbuf, siglen, sig_name, md_name, argv[i]))
ret = EXIT_FAILURE;
if (oneshot_sign) {
if (do_fp_oneshot_sign(out, signctx, in, separator, out_bin,
sigkey, sigbuf, siglen, sig_name,
argv[i]))
ret = EXIT_FAILURE;
} else {
if (do_fp(out, buf, inp, separator, out_bin, xoflen,
sigkey, sigbuf, siglen, sig_name, md_name, argv[i]))
ret = EXIT_FAILURE;
}
}
(void)BIO_reset(bmd);
}
@ -468,6 +492,7 @@ int dgst_main(int argc, char **argv)
BIO_free_all(out);
EVP_MD_free(md);
EVP_PKEY_free(sigkey);
EVP_MD_CTX_free(signctx);
sk_OPENSSL_STRING_free(sigopts);
sk_OPENSSL_STRING_free(macopts);
OPENSSL_free(sigbuf);
@ -479,7 +504,7 @@ int dgst_main(int argc, char **argv)
static void show_digests(const OBJ_NAME *name, void *arg)
{
struct doall_dgst_digests *dec = (struct doall_dgst_digests *)arg;
const EVP_MD *md = NULL;
EVP_MD *md = NULL;
/* Filter out signed digests (a.k.a signature algorithms) */
if (strstr(name->name, "rsa") != NULL || strstr(name->name, "RSA") != NULL)
@ -491,8 +516,7 @@ static void show_digests(const OBJ_NAME *name, void *arg)
/* Filter out message digests that we cannot use */
md = EVP_MD_fetch(app_get0_libctx(), name->name, app_get0_propq());
if (md == NULL) {
md = EVP_get_digestbyname(name->name);
if (md == NULL)
if (EVP_get_digestbyname(name->name) == NULL)
return;
}
@ -503,6 +527,8 @@ static void show_digests(const OBJ_NAME *name, void *arg)
} else {
BIO_printf(dec->bio, " ");
}
EVP_MD_free(md);
}
/*
@ -543,6 +569,54 @@ static const char *newline_escape_filename(const char *file, int *backslash)
return (const char*)file_cpy;
}
static void print_out(BIO *out, unsigned char *buf, size_t len,
int sep, int binout,
const char *sig_name, const char *md_name, const char *file)
{
int i, backslash = 0;
if (binout) {
BIO_write(out, buf, len);
} else if (sep == 2) {
file = newline_escape_filename(file, &backslash);
if (backslash == 1)
BIO_puts(out, "\\");
for (i = 0; i < (int)len; i++)
BIO_printf(out, "%02x", buf[i]);
BIO_printf(out, " *%s\n", file);
OPENSSL_free((char *)file);
} else {
if (sig_name != NULL) {
BIO_puts(out, sig_name);
if (md_name != NULL)
BIO_printf(out, "-%s", md_name);
BIO_printf(out, "(%s)= ", file);
} else if (md_name != NULL) {
BIO_printf(out, "%s(%s)= ", md_name, file);
} else {
BIO_printf(out, "(%s)= ", file);
}
for (i = 0; i < (int)len; i++) {
if (sep && (i != 0))
BIO_printf(out, ":");
BIO_printf(out, "%02x", buf[i]);
}
BIO_printf(out, "\n");
}
}
static void print_verify_result(BIO *out, int i)
{
if (i > 0)
BIO_printf(out, "Verified OK\n");
else if (i == 0)
BIO_printf(out, "Verification failure\n");
else
BIO_printf(bio_err, "Error verifying data\n");
}
int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen,
EVP_PKEY *key, unsigned char *sigin, int siglen,
@ -550,7 +624,7 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
const char *file)
{
size_t len = BUFSIZE;
int i, backslash = 0, ret = EXIT_FAILURE;
int i, ret = EXIT_FAILURE;
unsigned char *allocated_buf = NULL;
while (BIO_pending(bp) || !BIO_eof(bp)) {
@ -566,16 +640,9 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
EVP_MD_CTX *ctx;
BIO_get_md_ctx(bp, &ctx);
i = EVP_DigestVerifyFinal(ctx, sigin, (unsigned int)siglen);
if (i > 0) {
BIO_printf(out, "Verified OK\n");
} else if (i == 0) {
BIO_printf(out, "Verification failure\n");
goto end;
} else {
BIO_printf(bio_err, "Error verifying data\n");
goto end;
}
ret = EXIT_SUCCESS;
print_verify_result(out, i);
if (i > 0)
ret = EXIT_SUCCESS;
goto end;
}
if (key != NULL) {
@ -616,39 +683,7 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
if ((int)len < 0)
goto end;
}
if (binout) {
BIO_write(out, buf, len);
} else if (sep == 2) {
file = newline_escape_filename(file, &backslash);
if (backslash == 1)
BIO_puts(out, "\\");
for (i = 0; i < (int)len; i++)
BIO_printf(out, "%02x", buf[i]);
BIO_printf(out, " *%s\n", file);
OPENSSL_free((char *)file);
} else {
if (sig_name != NULL) {
BIO_puts(out, sig_name);
if (md_name != NULL)
BIO_printf(out, "-%s", md_name);
BIO_printf(out, "(%s)= ", file);
} else if (md_name != NULL) {
BIO_printf(out, "%s(%s)= ", md_name, file);
} else {
BIO_printf(out, "(%s)= ", file);
}
for (i = 0; i < (int)len; i++) {
if (sep && (i != 0))
BIO_printf(out, ":");
BIO_printf(out, "%02x", buf[i]);
}
BIO_printf(out, "\n");
}
print_out(out, buf, len, sep, binout, sig_name, md_name, file);
ret = EXIT_SUCCESS;
end:
if (allocated_buf != NULL)
@ -656,3 +691,55 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
return ret;
}
/*
* Some new algorithms only support one shot operations.
* For these we need to buffer all input and then do the sign on the
* total buffered input. These algorithms set a NULL digest name which is
* then used inside EVP_DigestVerify() and EVP_DigestSign().
*/
static int do_fp_oneshot_sign(BIO *out, EVP_MD_CTX *ctx, BIO *in, int sep, int binout,
EVP_PKEY *key, unsigned char *sigin, int siglen,
const char *sig_name, const char *file)
{
int res, ret = EXIT_FAILURE;
size_t len = 0;
int buflen = 0;
int maxlen = 16 * 1024 * 1024;
uint8_t *buf = NULL, *sig = NULL;
buflen = bio_to_mem(&buf, maxlen, in);
if (buflen <= 0) {
BIO_printf(bio_err, "Read error in %s\n", file);
return ret;
}
if (sigin != NULL) {
res = EVP_DigestVerify(ctx, sigin, siglen, buf, buflen);
print_verify_result(out, res);
if (res > 0)
ret = EXIT_SUCCESS;
goto end;
}
if (key != NULL) {
if (EVP_DigestSign(ctx, NULL, &len, buf, buflen) != 1) {
BIO_printf(bio_err, "Error getting maximum length of signed data\n");
goto end;
}
sig = app_malloc(len, "Signature buffer");
if (EVP_DigestSign(ctx, sig, &len, buf, buflen) != 1) {
BIO_printf(bio_err, "Error signing data\n");
goto end;
}
print_out(out, sig, len, sep, binout, sig_name, NULL, file);
ret = EXIT_SUCCESS;
} else {
BIO_printf(bio_err, "key must be set for one-shot algorithms\n");
goto end;
}
end:
OPENSSL_free(sig);
OPENSSL_clear_free(buf, buflen);
return ret;
}

8
apps/dhparam.c
View file

@ -179,10 +179,6 @@ int dhparam_main(int argc, char **argv)
goto end;
}
out = bio_open_default(outfile, 'w', outformat);
if (out == NULL)
goto end;
/* DH parameters */
if (num && !g)
g = 2;
@ -322,6 +318,10 @@ int dhparam_main(int argc, char **argv)
}
}
out = bio_open_default(outfile, 'w', outformat);
if (out == NULL)
goto end;
if (text)
EVP_PKEY_print_params(out, pkey, 4, NULL);

8
apps/dsaparam.c
View file

@ -150,10 +150,6 @@ int dsaparam_main(int argc, char **argv)
numbits = num;
private = genkey ? 1 : 0;
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
ctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(), "DSA", app_get0_propq());
if (ctx == NULL) {
BIO_printf(bio_err,
@ -200,6 +196,10 @@ int dsaparam_main(int argc, char **argv)
goto end;
}
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (text) {
EVP_PKEY_print_params(out, params, 0, NULL);
}

28
apps/ecparam.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2002-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@ -67,13 +67,11 @@ const OPTIONS ecparam_options[] = {
static int list_builtin_curves(BIO *out)
{
int ret = 0;
EC_builtin_curve *curves = NULL;
size_t n, crv_len = EC_get_builtin_curves(NULL, 0);
curves = app_malloc((int)sizeof(*curves) * crv_len, "list curves");
if (!EC_get_builtin_curves(curves, crv_len))
goto end;
EC_get_builtin_curves(curves, crv_len);
for (n = 0; n < crv_len; n++) {
const char *comment = curves[n].comment;
@ -87,10 +85,8 @@ static int list_builtin_curves(BIO *out)
BIO_printf(out, " %-10s: ", sname);
BIO_printf(out, "%s\n", comment);
}
ret = 1;
end:
OPENSSL_free(curves);
return ret;
return 1;
}
int ecparam_main(int argc, char **argv)
@ -192,18 +188,18 @@ int ecparam_main(int argc, char **argv)
if (!app_RAND_load())
goto end;
private = genkey ? 1 : 0;
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (list_curves) {
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (list_builtin_curves(out))
ret = 0;
goto end;
}
private = genkey ? 1 : 0;
if (curve_name != NULL) {
OSSL_PARAM params[4];
OSSL_PARAM *p = params;
@ -276,8 +272,12 @@ int ecparam_main(int argc, char **argv)
goto end;
}
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (text
&& !EVP_PKEY_print_params(out, params_key, 0, NULL)) {
&& EVP_PKEY_print_params(out, params_key, 0, NULL) <= 0) {
BIO_printf(bio_err, "unable to print params\n");
goto end;
}

93
apps/enc.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -49,7 +49,8 @@ typedef enum OPTION_choice {
OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A,
OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE,
OPT_UPPER_S, OPT_IV, OPT_MD, OPT_ITER, OPT_PBKDF2, OPT_CIPHER,
OPT_SALTLEN, OPT_R_ENUM, OPT_PROV_ENUM
OPT_SALTLEN, OPT_R_ENUM, OPT_PROV_ENUM,
OPT_SKEYOPT, OPT_SKEYMGMT
} OPTION_CHOICE;
const OPTIONS enc_options[] = {
@ -105,6 +106,8 @@ const OPTIONS enc_options[] = {
#ifndef OPENSSL_NO_ZLIB
{"z", OPT_Z, '-', "Compress or decompress encrypted data using zlib"},
#endif
{"skeyopt", OPT_SKEYOPT, 's', "Key options as opt:value for opaque symmetric key handling"},
{"skeymgmt", OPT_SKEYMGMT, 's', "Symmetric key management name for opaque symmetric key handling"},
{"", OPT_CIPHER, '-', "Any supported cipher"},
OPT_R_OPTIONS,
@ -134,6 +137,7 @@ int enc_main(int argc, char **argv)
int base64 = 0, informat = FORMAT_BINARY, outformat = FORMAT_BINARY;
int ret = 1, inl, nopad = 0;
unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH];
int rawkey_set = 0;
unsigned char *buff = NULL, salt[EVP_MAX_IV_LENGTH];
int saltlen = 0;
int pbkdf2 = 0;
@ -150,6 +154,10 @@ int enc_main(int argc, char **argv)
BIO *bbrot = NULL;
int do_zstd = 0;
BIO *bzstd = NULL;
STACK_OF(OPENSSL_STRING) *skeyopts = NULL;
const char *skeymgmt = NULL;
EVP_SKEY *skey = NULL;
EVP_SKEYMGMT *mgmt = NULL;
/* first check the command name */
if (strcmp(argv[0], "base64") == 0)
@ -310,6 +318,17 @@ int enc_main(int argc, char **argv)
case OPT_NONE:
cipher = NULL;
break;
case OPT_SKEYOPT:
if ((skeyopts == NULL &&
(skeyopts = sk_OPENSSL_STRING_new_null()) == NULL) ||
sk_OPENSSL_STRING_push(skeyopts, opt_arg()) == 0) {
BIO_printf(bio_err, "%s: out of memory\n", prog);
goto end;
}
break;
case OPT_SKEYMGMT:
skeymgmt = opt_arg();
break;
case OPT_R_CASES:
if (!opt_rand(o))
goto end;
@ -391,7 +410,7 @@ int enc_main(int argc, char **argv)
str = pass;
}
if ((str == NULL) && (cipher != NULL) && (hkey == NULL)) {
if ((str == NULL) && (cipher != NULL) && (hkey == NULL) && (skeyopts == NULL)) {
if (1) {
#ifndef OPENSSL_NO_UI_CONSOLE
for (;;) {
@ -571,6 +590,7 @@ int enc_main(int argc, char **argv)
/* split and move data back to global buffer */
memcpy(key, tmpkeyiv, iklen);
memcpy(iv, tmpkeyiv+iklen, ivlen);
rawkey_set = 1;
} else {
BIO_printf(bio_err, "*** WARNING : "
"deprecated key derivation used.\n"
@ -581,6 +601,7 @@ int enc_main(int argc, char **argv)
BIO_printf(bio_err, "EVP_BytesToKey failed\n");
goto end;
}
rawkey_set = 1;
}
/*
* zero the complete buffer or the string passed from the command
@ -618,6 +639,16 @@ int enc_main(int argc, char **argv)
}
/* wiping secret data as we no longer need it */
cleanse(hkey);
rawkey_set = 1;
}
/*
* At this moment we know whether we trying to use raw bytes as the key
* or an opaque symmetric key. We do not allow both options simultaneously.
*/
if (rawkey_set > 0 && skeyopts != NULL) {
BIO_printf(bio_err, "Either a raw key or the 'skeyopt' args must be used.\n");
goto end;
}
if ((benc = BIO_new(BIO_f_cipher())) == NULL)
@ -633,24 +664,51 @@ int enc_main(int argc, char **argv)
if (wrap == 1)
EVP_CIPHER_CTX_set_flags(ctx, EVP_CIPHER_CTX_FLAG_WRAP_ALLOW);
if (!EVP_CipherInit_ex(ctx, cipher, e, NULL, NULL, enc)) {
BIO_printf(bio_err, "Error setting cipher %s\n",
EVP_CIPHER_get0_name(cipher));
ERR_print_errors(bio_err);
goto end;
if (rawkey_set) {
if (!EVP_CipherInit_ex(ctx, cipher, e, key,
(hiv == NULL && wrap == 1 ? NULL : iv), enc)) {
BIO_printf(bio_err, "Error setting cipher %s\n",
EVP_CIPHER_get0_name(cipher));
ERR_print_errors(bio_err);
goto end;
}
} else {
OSSL_PARAM *params = NULL;
mgmt = EVP_SKEYMGMT_fetch(app_get0_libctx(),
skeymgmt != NULL ? skeymgmt : EVP_CIPHER_name(cipher),
app_get0_propq());
if (mgmt == NULL)
goto end;
params = app_params_new_from_opts(skeyopts,
EVP_SKEYMGMT_get0_imp_settable_params(mgmt));
if (params == NULL)
goto end;
skey = EVP_SKEY_import(app_get0_libctx(), EVP_SKEYMGMT_get0_name(mgmt),
app_get0_propq(), OSSL_SKEYMGMT_SELECT_ALL, params);
OSSL_PARAM_free(params);
if (skey == NULL) {
BIO_printf(bio_err, "Error creating opaque key object for skeymgmt %s\n",
skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher));
ERR_print_errors(bio_err);
goto end;
}
if (!EVP_CipherInit_SKEY(ctx, cipher, skey,
(hiv == NULL && wrap == 1 ? NULL : iv),
EVP_CIPHER_get_iv_length(cipher), enc, NULL)) {
BIO_printf(bio_err, "Error setting an opaque key for cipher %s\n",
EVP_CIPHER_get0_name(cipher));
ERR_print_errors(bio_err);
goto end;
}
}
if (nopad)
EVP_CIPHER_CTX_set_padding(ctx, 0);
if (!EVP_CipherInit_ex(ctx, NULL, NULL, key,
(hiv == NULL && wrap == 1 ? NULL : iv), enc)) {
BIO_printf(bio_err, "Error setting cipher %s\n",
EVP_CIPHER_get0_name(cipher));
ERR_print_errors(bio_err);
goto end;
}
if (debug) {
BIO_set_callback_ex(benc, BIO_debug_callback_ex);
BIO_set_callback_arg(benc, (char *)bio_err);
@ -716,6 +774,9 @@ int enc_main(int argc, char **argv)
}
end:
ERR_print_errors(bio_err);
sk_OPENSSL_STRING_free(skeyopts);
EVP_SKEYMGMT_free(mgmt);
EVP_SKEY_free(skey);
OPENSSL_free(strbuf);
OPENSSL_free(buff);
BIO_free(in);

17
apps/engine.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -316,7 +316,8 @@ int engine_main(int argc, char **argv)
* names, and then setup to parse the rest of the line as flags. */
prog = argv[0];
while ((argv1 = argv[1]) != NULL && *argv1 != '-') {
sk_OPENSSL_CSTRING_push(engines, argv1);
if (!sk_OPENSSL_CSTRING_push(engines, argv1))
goto end;
argc--;
argv++;
}
@ -352,10 +353,12 @@ int engine_main(int argc, char **argv)
test_avail++;
break;
case OPT_PRE:
sk_OPENSSL_STRING_push(pre_cmds, opt_arg());
if (sk_OPENSSL_STRING_push(pre_cmds, opt_arg()) <= 0)
goto end;
break;
case OPT_POST:
sk_OPENSSL_STRING_push(post_cmds, opt_arg());
if (sk_OPENSSL_STRING_push(post_cmds, opt_arg()) <= 0)
goto end;
break;
}
}
@ -370,12 +373,14 @@ int engine_main(int argc, char **argv)
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
goto end;
}
sk_OPENSSL_CSTRING_push(engines, *argv);
if (!sk_OPENSSL_CSTRING_push(engines, *argv))
goto end;
}
if (sk_OPENSSL_CSTRING_num(engines) == 0) {
for (e = ENGINE_get_first(); e != NULL; e = ENGINE_get_next(e)) {
sk_OPENSSL_CSTRING_push(engines, ENGINE_get_id(e));
if (!sk_OPENSSL_CSTRING_push(engines, ENGINE_get_id(e)))
goto end;
}
}

359
apps/fipsinstall.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -38,8 +38,30 @@ typedef enum OPTION_choice {
OPT_NO_LOG, OPT_CORRUPT_DESC, OPT_CORRUPT_TYPE, OPT_QUIET, OPT_CONFIG,
OPT_NO_CONDITIONAL_ERRORS,
OPT_NO_SECURITY_CHECKS,
OPT_TLS_PRF_EMS_CHECK,
OPT_TLS_PRF_EMS_CHECK, OPT_NO_SHORT_MAC,
OPT_DISALLOW_PKCS15_PADDING, OPT_RSA_PSS_SALTLEN_CHECK,
OPT_DISALLOW_SIGNATURE_X931_PADDING,
OPT_HMAC_KEY_CHECK, OPT_KMAC_KEY_CHECK,
OPT_DISALLOW_DRGB_TRUNC_DIGEST,
OPT_SIGNATURE_DIGEST_CHECK,
OPT_HKDF_DIGEST_CHECK,
OPT_TLS13_KDF_DIGEST_CHECK,
OPT_TLS1_PRF_DIGEST_CHECK,
OPT_SSHKDF_DIGEST_CHECK,
OPT_SSKDF_DIGEST_CHECK,
OPT_X963KDF_DIGEST_CHECK,
OPT_DISALLOW_DSA_SIGN,
OPT_DISALLOW_TDES_ENCRYPT,
OPT_HKDF_KEY_CHECK,
OPT_KBKDF_KEY_CHECK,
OPT_TLS13_KDF_KEY_CHECK,
OPT_TLS1_PRF_KEY_CHECK,
OPT_SSHKDF_KEY_CHECK,
OPT_SSKDF_KEY_CHECK,
OPT_X963KDF_KEY_CHECK,
OPT_X942KDF_KEY_CHECK,
OPT_NO_PBKDF2_LOWER_BOUND_CHECK,
OPT_ECDH_COFACTOR_CHECK,
OPT_SELF_TEST_ONLOAD, OPT_SELF_TEST_ONINSTALL
} OPTION_CHOICE;
@ -48,7 +70,7 @@ const OPTIONS fipsinstall_options[] = {
{"help", OPT_HELP, '-', "Display this summary"},
{"pedantic", OPT_PEDANTIC, '-', "Set options for strict FIPS compliance"},
{"verify", OPT_VERIFY, '-',
"Verify a config file instead of generating one"},
"Verify a config file instead of generating one"},
{"module", OPT_MODULE, '<', "File name of the provider module"},
{"provider_name", OPT_PROV_NAME, 's', "FIPS provider name"},
{"section_name", OPT_SECTION_NAME, 's',
@ -64,8 +86,55 @@ const OPTIONS fipsinstall_options[] = {
"Forces self tests to run once on module installation"},
{"ems_check", OPT_TLS_PRF_EMS_CHECK, '-',
"Enable the run-time FIPS check for EMS during TLS1_PRF"},
{"no_short_mac", OPT_NO_SHORT_MAC, '-', "Disallow short MAC output"},
{"no_drbg_truncated_digests", OPT_DISALLOW_DRGB_TRUNC_DIGEST, '-',
"Disallow truncated digests with Hash and HMAC DRBGs"},
{"signature_digest_check", OPT_SIGNATURE_DIGEST_CHECK, '-',
"Enable checking for approved digests for signatures"},
{"hmac_key_check", OPT_HMAC_KEY_CHECK, '-', "Enable key check for HMAC"},
{"kmac_key_check", OPT_KMAC_KEY_CHECK, '-', "Enable key check for KMAC"},
{"hkdf_digest_check", OPT_HKDF_DIGEST_CHECK, '-',
"Enable digest check for HKDF"},
{"tls13_kdf_digest_check", OPT_TLS13_KDF_DIGEST_CHECK, '-',
"Enable digest check for TLS13-KDF"},
{"tls1_prf_digest_check", OPT_TLS1_PRF_DIGEST_CHECK, '-',
"Enable digest check for TLS1-PRF"},
{"sshkdf_digest_check", OPT_SSHKDF_DIGEST_CHECK, '-',
"Enable digest check for SSHKDF"},
{"sskdf_digest_check", OPT_SSKDF_DIGEST_CHECK, '-',
"Enable digest check for SSKDF"},
{"x963kdf_digest_check", OPT_X963KDF_DIGEST_CHECK, '-',
"Enable digest check for X963KDF"},
{"dsa_sign_disabled", OPT_DISALLOW_DSA_SIGN, '-',
"Disallow DSA signing"},
{"tdes_encrypt_disabled", OPT_DISALLOW_TDES_ENCRYPT, '-',
"Disallow Triple-DES encryption"},
{"rsa_pkcs15_padding_disabled", OPT_DISALLOW_PKCS15_PADDING, '-',
"Disallow PKCS#1 version 1.5 padding for RSA encryption"},
{"rsa_pss_saltlen_check", OPT_RSA_PSS_SALTLEN_CHECK, '-',
"Enable salt length check for RSA-PSS signature operations"},
{"rsa_sign_x931_disabled", OPT_DISALLOW_SIGNATURE_X931_PADDING, '-',
"Disallow X931 Padding for RSA signing"},
{"hkdf_key_check", OPT_HKDF_KEY_CHECK, '-',
"Enable key check for HKDF"},
{"kbkdf_key_check", OPT_KBKDF_KEY_CHECK, '-',
"Enable key check for KBKDF"},
{"tls13_kdf_key_check", OPT_TLS13_KDF_KEY_CHECK, '-',
"Enable key check for TLS13-KDF"},
{"tls1_prf_key_check", OPT_TLS1_PRF_KEY_CHECK, '-',
"Enable key check for TLS1-PRF"},
{"sshkdf_key_check", OPT_SSHKDF_KEY_CHECK, '-',
"Enable key check for SSHKDF"},
{"sskdf_key_check", OPT_SSKDF_KEY_CHECK, '-',
"Enable key check for SSKDF"},
{"x963kdf_key_check", OPT_X963KDF_KEY_CHECK, '-',
"Enable key check for X963KDF"},
{"x942kdf_key_check", OPT_X942KDF_KEY_CHECK, '-',
"Enable key check for X942KDF"},
{"no_pbkdf2_lower_bound_check", OPT_NO_PBKDF2_LOWER_BOUND_CHECK, '-',
"Disable lower bound check for PBKDF2"},
{"ecdh_cofactor_check", OPT_ECDH_COFACTOR_CHECK, '-',
"Enable Cofactor check for ECDH"},
OPT_SECTION("Input"),
{"in", OPT_IN, '<', "Input config file, used when verifying"},
@ -86,8 +155,33 @@ typedef struct {
unsigned int self_test_onload : 1;
unsigned int conditional_errors : 1;
unsigned int security_checks : 1;
unsigned int hmac_key_check : 1;
unsigned int kmac_key_check : 1;
unsigned int tls_prf_ems_check : 1;
unsigned int no_short_mac : 1;
unsigned int drgb_no_trunc_dgst : 1;
unsigned int signature_digest_check : 1;
unsigned int hkdf_digest_check : 1;
unsigned int tls13_kdf_digest_check : 1;
unsigned int tls1_prf_digest_check : 1;
unsigned int sshkdf_digest_check : 1;
unsigned int sskdf_digest_check : 1;
unsigned int x963kdf_digest_check : 1;
unsigned int dsa_sign_disabled : 1;
unsigned int tdes_encrypt_disabled : 1;
unsigned int rsa_pkcs15_padding_disabled : 1;
unsigned int rsa_pss_saltlen_check : 1;
unsigned int sign_x931_padding_disabled : 1;
unsigned int hkdf_key_check : 1;
unsigned int kbkdf_key_check : 1;
unsigned int tls13_kdf_key_check : 1;
unsigned int tls1_prf_key_check : 1;
unsigned int sshkdf_key_check : 1;
unsigned int sskdf_key_check : 1;
unsigned int x963kdf_key_check : 1;
unsigned int x942kdf_key_check : 1;
unsigned int pbkdf2_lower_bound_check : 1;
unsigned int ecdh_cofactor_check : 1;
} FIPS_OPTS;
/* Pedantic FIPS compliance */
@ -95,8 +189,33 @@ static const FIPS_OPTS pedantic_opts = {
1, /* self_test_onload */
1, /* conditional_errors */
1, /* security_checks */
1, /* hmac_key_check */
1, /* kmac_key_check */
1, /* tls_prf_ems_check */
1, /* no_short_mac */
1, /* drgb_no_trunc_dgst */
1, /* signature_digest_check */
1, /* hkdf_digest_check */
1, /* tls13_kdf_digest_check */
1, /* tls1_prf_digest_check */
1, /* sshkdf_digest_check */
1, /* sskdf_digest_check */
1, /* x963kdf_digest_check */
1, /* dsa_sign_disabled */
1, /* tdes_encrypt_disabled */
1, /* rsa_pkcs15_padding_disabled */
1, /* rsa_pss_saltlen_check */
1, /* sign_x931_padding_disabled */
1, /* hkdf_key_check */
1, /* kbkdf_key_check */
1, /* tls13_kdf_key_check */
1, /* tls1_prf_key_check */
1, /* sshkdf_key_check */
1, /* sskdf_key_check */
1, /* x963kdf_key_check */
1, /* x942kdf_key_check */
1, /* pbkdf2_lower_bound_check */
1, /* ecdh_cofactor_check */
};
/* Default FIPS settings for backward compatibility */
@ -104,8 +223,33 @@ static FIPS_OPTS fips_opts = {
1, /* self_test_onload */
1, /* conditional_errors */
1, /* security_checks */
0, /* hmac_key_check */
0, /* kmac_key_check */
0, /* tls_prf_ems_check */
0, /* no_short_mac */
0, /* drgb_no_trunc_dgst */
0, /* signature_digest_check */
0, /* hkdf_digest_check */
0, /* tls13_kdf_digest_check */
0, /* tls1_prf_digest_check */
0, /* sshkdf_digest_check */
0, /* sskdf_digest_check */
0, /* x963kdf_digest_check */
0, /* dsa_sign_disabled */
0, /* tdes_encrypt_disabled */
0, /* rsa_pkcs15_padding_disabled */
0, /* rsa_pss_saltlen_check */
0, /* sign_x931_padding_disabled */
0, /* hkdf_key_check */
0, /* kbkdf_key_check */
0, /* tls13_kdf_key_check */
0, /* tls1_prf_key_check */
0, /* sshkdf_key_check */
0, /* sskdf_key_check */
0, /* x963kdf_key_check */
0, /* x942kdf_key_check */
1, /* pbkdf2_lower_bound_check */
0, /* ecdh_cofactor_check */
};
static int check_non_pedantic_fips(int pedantic, const char *name)
@ -140,7 +284,8 @@ err:
return ret;
}
static int load_fips_prov_and_run_self_test(const char *prov_name)
static int load_fips_prov_and_run_self_test(const char *prov_name,
int *is_fips_140_2_prov)
{
int ret = 0;
OSSL_PROVIDER *prov = NULL;
@ -170,7 +315,16 @@ static int load_fips_prov_and_run_self_test(const char *prov_name)
BIO_printf(bio_err, "\t%-10s\t%s\n", "version:", vers);
if (OSSL_PARAM_modified(params + 2))
BIO_printf(bio_err, "\t%-10s\t%s\n", "build:", build);
} else {
*p++ = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_VERSION,
&vers, sizeof(vers));
*p = OSSL_PARAM_construct_end();
if (!OSSL_PROVIDER_get_params(prov, params)) {
BIO_printf(bio_err, "Failed to query FIPS module parameters\n");
goto end;
}
}
*is_fips_140_2_prov = (strncmp("3.0.", vers, 4) == 0);
ret = 1;
end:
OSSL_PROVIDER_unload(prov);
@ -223,22 +377,83 @@ static int write_config_fips_section(BIO *out, const char *section,
VERSION_VAL) <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_CONDITIONAL_ERRORS,
opts->conditional_errors ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_SECURITY_CHECKS,
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SECURITY_CHECKS,
opts->security_checks ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_TLS1_PRF_EMS_CHECK,
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HMAC_KEY_CHECK,
opts->hmac_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_KMAC_KEY_CHECK,
opts->kmac_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TLS1_PRF_EMS_CHECK,
opts->tls_prf_ems_check ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_NO_SHORT_MAC,
opts->no_short_mac ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_DRBG_TRUNC_DIGEST,
opts->drgb_no_trunc_dgst ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SIGNATURE_DIGEST_CHECK,
opts->signature_digest_check ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HKDF_DIGEST_CHECK,
opts->hkdf_digest_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n",
OSSL_PROV_PARAM_TLS13_KDF_DIGEST_CHECK,
opts->tls13_kdf_digest_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n",
OSSL_PROV_PARAM_TLS1_PRF_DIGEST_CHECK,
opts->tls1_prf_digest_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n",
OSSL_PROV_PARAM_SSHKDF_DIGEST_CHECK,
opts->sshkdf_digest_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSKDF_DIGEST_CHECK,
opts->sskdf_digest_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n",
OSSL_PROV_PARAM_X963KDF_DIGEST_CHECK,
opts->x963kdf_digest_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_DSA_SIGN_DISABLED,
opts->dsa_sign_disabled ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TDES_ENCRYPT_DISABLED,
opts->tdes_encrypt_disabled ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n",
OSSL_PROV_PARAM_RSA_PKCS15_PAD_DISABLED,
opts->rsa_pkcs15_padding_disabled ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n",
OSSL_PROV_PARAM_RSA_PSS_SALTLEN_CHECK,
opts->rsa_pss_saltlen_check ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n",
OSSL_PROV_PARAM_RSA_SIGN_X931_PAD_DISABLED,
opts->sign_x931_padding_disabled ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HKDF_KEY_CHECK,
opts->hkdf_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_KBKDF_KEY_CHECK,
opts->kbkdf_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n",
OSSL_PROV_PARAM_TLS13_KDF_KEY_CHECK,
opts->tls13_kdf_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TLS1_PRF_KEY_CHECK,
opts->tls1_prf_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSHKDF_KEY_CHECK,
opts->sshkdf_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSKDF_KEY_CHECK,
opts->sskdf_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_X963KDF_KEY_CHECK,
opts->x963kdf_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_X942KDF_KEY_CHECK,
opts->x942kdf_key_check ? "1": "0") <= 0
|| BIO_printf(out, "%s = %s\n",
OSSL_PROV_PARAM_PBKDF2_LOWER_BOUND_CHECK,
opts->pbkdf2_lower_bound_check ? "1" : "0") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_ECDH_COFACTOR_CHECK,
opts->ecdh_cofactor_check ? "1": "0") <= 0
|| !print_mac(out, OSSL_PROV_FIPS_PARAM_MODULE_MAC, module_mac,
module_mac_len))
goto end;
if (install_mac != NULL && install_mac_len > 0) {
if (install_mac != NULL
&& install_mac_len > 0
&& opts->self_test_onload == 0) {
if (!print_mac(out, OSSL_PROV_FIPS_PARAM_INSTALL_MAC, install_mac,
install_mac_len)
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_INSTALL_STATUS,
INSTALL_STATUS_VAL) <= 0)
goto end;
goto end;
}
ret = 1;
end:
@ -255,12 +470,12 @@ static CONF *generate_config_and_load(const char *prov_name,
CONF *conf = NULL;
mem_bio = BIO_new(BIO_s_mem());
if (mem_bio == NULL)
if (mem_bio == NULL)
return 0;
if (!write_config_header(mem_bio, prov_name, section)
|| !write_config_fips_section(mem_bio, section,
module_mac, module_mac_len,
opts, NULL, 0))
|| !write_config_fips_section(mem_bio, section,
module_mac, module_mac_len,
opts, NULL, 0))
goto end;
conf = app_load_config_bio(mem_bio, NULL);
@ -356,6 +571,7 @@ end:
int fipsinstall_main(int argc, char **argv)
{
int ret = 1, verify = 0, gotkey = 0, gotdigest = 0, pedantic = 0;
int is_fips_140_2_prov = 0, set_selftest_onload_option = 0;
const char *section_name = "fips_sect";
const char *mac_name = "HMAC";
const char *prov_name = "fips";
@ -382,7 +598,7 @@ int fipsinstall_main(int argc, char **argv)
switch (o) {
case OPT_EOF:
case OPT_ERR:
opthelp:
opthelp:
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
goto cleanup;
case OPT_HELP:
@ -409,12 +625,89 @@ opthelp:
goto end;
fips_opts.security_checks = 0;
break;
case OPT_HMAC_KEY_CHECK:
fips_opts.hmac_key_check = 1;
break;
case OPT_KMAC_KEY_CHECK:
fips_opts.kmac_key_check = 1;
break;
case OPT_TLS_PRF_EMS_CHECK:
fips_opts.tls_prf_ems_check = 1;
break;
case OPT_NO_SHORT_MAC:
fips_opts.no_short_mac = 1;
break;
case OPT_DISALLOW_DRGB_TRUNC_DIGEST:
fips_opts.drgb_no_trunc_dgst = 1;
break;
case OPT_SIGNATURE_DIGEST_CHECK:
fips_opts.signature_digest_check = 1;
break;
case OPT_HKDF_DIGEST_CHECK:
fips_opts.hkdf_digest_check = 1;
break;
case OPT_TLS13_KDF_DIGEST_CHECK:
fips_opts.tls13_kdf_digest_check = 1;
break;
case OPT_TLS1_PRF_DIGEST_CHECK:
fips_opts.tls1_prf_digest_check = 1;
break;
case OPT_SSHKDF_DIGEST_CHECK:
fips_opts.sshkdf_digest_check = 1;
break;
case OPT_SSKDF_DIGEST_CHECK:
fips_opts.sskdf_digest_check = 1;
break;
case OPT_X963KDF_DIGEST_CHECK:
fips_opts.x963kdf_digest_check = 1;
break;
case OPT_DISALLOW_DSA_SIGN:
fips_opts.dsa_sign_disabled = 1;
break;
case OPT_DISALLOW_TDES_ENCRYPT:
fips_opts.tdes_encrypt_disabled = 1;
break;
case OPT_RSA_PSS_SALTLEN_CHECK:
fips_opts.rsa_pss_saltlen_check = 1;
break;
case OPT_DISALLOW_SIGNATURE_X931_PADDING:
fips_opts.sign_x931_padding_disabled = 1;
break;
case OPT_DISALLOW_PKCS15_PADDING:
fips_opts.rsa_pkcs15_padding_disabled = 1;
break;
case OPT_HKDF_KEY_CHECK:
fips_opts.hkdf_key_check = 1;
break;
case OPT_KBKDF_KEY_CHECK:
fips_opts.kbkdf_key_check = 1;
break;
case OPT_TLS13_KDF_KEY_CHECK:
fips_opts.tls13_kdf_key_check = 1;
break;
case OPT_TLS1_PRF_KEY_CHECK:
fips_opts.tls1_prf_key_check = 1;
break;
case OPT_SSHKDF_KEY_CHECK:
fips_opts.sshkdf_key_check = 1;
break;
case OPT_SSKDF_KEY_CHECK:
fips_opts.sskdf_key_check = 1;
break;
case OPT_X963KDF_KEY_CHECK:
fips_opts.x963kdf_key_check = 1;
break;
case OPT_X942KDF_KEY_CHECK:
fips_opts.x942kdf_key_check = 1;
break;
case OPT_NO_PBKDF2_LOWER_BOUND_CHECK:
if (!check_non_pedantic_fips(pedantic, "no_pbkdf2_lower_bound_check"))
goto end;
fips_opts.pbkdf2_lower_bound_check = 0;
break;
case OPT_ECDH_COFACTOR_CHECK:
fips_opts.ecdh_cofactor_check = 1;
break;
case OPT_QUIET:
quiet = 1;
/* FALLTHROUGH */
@ -454,11 +747,13 @@ opthelp:
verify = 1;
break;
case OPT_SELF_TEST_ONLOAD:
set_selftest_onload_option = 1;
fips_opts.self_test_onload = 1;
break;
case OPT_SELF_TEST_ONINSTALL:
if (!check_non_pedantic_fips(pedantic, "self_test_oninstall"))
goto end;
set_selftest_onload_option = 1;
fips_opts.self_test_onload = 0;
break;
}
@ -478,7 +773,7 @@ opthelp:
ret = OSSL_PROVIDER_available(NULL, prov_name) ? 0 : 1;
if (!quiet) {
BIO_printf(bio_err, "FIPS provider is %s\n",
ret == 0 ? "available" : " not available");
ret == 0 ? "available" : "not available");
}
}
goto end;
@ -556,34 +851,43 @@ opthelp:
if (!do_mac(ctx, read_buffer, module_bio, module_mac, &module_mac_len))
goto end;
if (fips_opts.self_test_onload == 0) {
mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
strlen(INSTALL_STATUS_VAL));
if (mem_bio == NULL) {
BIO_printf(bio_err, "Unable to create memory BIO\n");
goto end;
}
if (!do_mac(ctx2, read_buffer, mem_bio, install_mac, &install_mac_len))
goto end;
} else {
install_mac_len = 0;
/* Calculate the MAC for the indicator status - it may not be used */
mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
strlen(INSTALL_STATUS_VAL));
if (mem_bio == NULL) {
BIO_printf(bio_err, "Unable to create memory BIO\n");
goto end;
}
if (!do_mac(ctx2, read_buffer, mem_bio, install_mac, &install_mac_len))
goto end;
if (verify) {
if (fips_opts.self_test_onload == 1)
install_mac_len = 0;
if (!verify_config(in_fname, section_name, module_mac, module_mac_len,
install_mac, install_mac_len))
goto end;
if (!quiet)
BIO_printf(bio_err, "VERIFY PASSED\n");
} else {
conf = generate_config_and_load(prov_name, section_name, module_mac,
module_mac_len, &fips_opts);
if (conf == NULL)
goto end;
if (!load_fips_prov_and_run_self_test(prov_name))
if (!load_fips_prov_and_run_self_test(prov_name, &is_fips_140_2_prov))
goto end;
/*
* In OpenSSL 3.1 the code was changed so that the status indicator is
* not written out by default since this is a FIPS 140-3 requirement.
* For backwards compatibility - if the detected FIPS provider is 3.0.X
* (Which was a FIPS 140-2 validation), then the indicator status will
* be written to the config file unless 'self_test_onload' is set on the
* command line.
*/
if (set_selftest_onload_option == 0 && is_fips_140_2_prov)
fips_opts.self_test_onload = 0;
fout =
out_fname == NULL ? dup_bio_out(FORMAT_TEXT)
: bio_open_default(out_fname, 'w', FORMAT_TEXT);
@ -591,6 +895,7 @@ opthelp:
BIO_printf(bio_err, "Failed to open file\n");
goto end;
}
if (!write_config_fips_section(fout, section_name,
module_mac, module_mac_len, &fips_opts,
install_mac, install_mac_len))

51
apps/genpkey.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -106,7 +106,7 @@ cleanup:
int genpkey_main(int argc, char **argv)
{
CONF *conf = NULL;
BIO *in = NULL, *out = NULL, *outpubkey = NULL;
BIO *mem_out = NULL, *mem_outpubkey = NULL;
ENGINE *e = NULL;
EVP_PKEY *pkey = NULL;
EVP_PKEY_CTX *ctx = NULL;
@ -237,14 +237,16 @@ int genpkey_main(int argc, char **argv)
goto end;
}
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
mem_out = BIO_new(BIO_s_mem());
if (mem_out == NULL)
goto end;
BIO_set_mem_eof_return(mem_out, 0);
if (outpubkeyfile != NULL) {
outpubkey = bio_open_owner(outpubkeyfile, outformat, private);
if (outpubkey == NULL)
mem_outpubkey = BIO_new(BIO_s_mem());
if (mem_outpubkey == NULL)
goto end;
BIO_set_mem_eof_return(mem_outpubkey, 0);
}
if (verbose)
@ -257,17 +259,17 @@ int genpkey_main(int argc, char **argv)
goto end;
if (do_param) {
rv = PEM_write_bio_Parameters(out, pkey);
rv = PEM_write_bio_Parameters(mem_out, pkey);
} else if (outformat == FORMAT_PEM) {
assert(private);
rv = PEM_write_bio_PrivateKey(out, pkey, cipher, NULL, 0, NULL, pass);
if (rv > 0 && outpubkey != NULL)
rv = PEM_write_bio_PUBKEY(outpubkey, pkey);
rv = PEM_write_bio_PrivateKey(mem_out, pkey, cipher, NULL, 0, NULL, pass);
if (rv > 0 && mem_outpubkey != NULL)
rv = PEM_write_bio_PUBKEY(mem_outpubkey, pkey);
} else if (outformat == FORMAT_ASN1) {
assert(private);
rv = i2d_PrivateKey_bio(out, pkey);
if (rv > 0 && outpubkey != NULL)
rv = i2d_PUBKEY_bio(outpubkey, pkey);
rv = i2d_PrivateKey_bio(mem_out, pkey);
if (rv > 0 && mem_outpubkey != NULL)
rv = i2d_PUBKEY_bio(mem_outpubkey, pkey);
} else {
BIO_printf(bio_err, "Bad format specified for key\n");
goto end;
@ -282,9 +284,9 @@ int genpkey_main(int argc, char **argv)
if (text) {
if (do_param)
rv = EVP_PKEY_print_params(out, pkey, 0, NULL);
rv = EVP_PKEY_print_params(mem_out, pkey, 0, NULL);
else
rv = EVP_PKEY_print_private(out, pkey, 0, NULL);
rv = EVP_PKEY_print_private(mem_out, pkey, 0, NULL);
if (rv <= 0) {
BIO_puts(bio_err, "Error printing key\n");
@ -294,14 +296,25 @@ int genpkey_main(int argc, char **argv)
end:
sk_OPENSSL_STRING_free(keyopt);
if (ret != 0)
if (ret != 0) {
ERR_print_errors(bio_err);
} else {
if (mem_outpubkey != NULL) {
rv = mem_bio_to_file(mem_outpubkey, outpubkeyfile, outformat, private);
if (!rv)
BIO_printf(bio_err, "Error writing to outpubkey: '%s'. Error: %s\n", outpubkeyfile, strerror(errno));
}
if (mem_out != NULL) {
rv = mem_bio_to_file(mem_out, outfile, outformat, private);
if (!rv)
BIO_printf(bio_err, "Error writing to outfile: '%s'. Error: %s\n", outpubkeyfile, strerror(errno));
}
}
EVP_PKEY_free(pkey);
EVP_PKEY_CTX_free(ctx);
EVP_CIPHER_free(cipher);
BIO_free_all(out);
BIO_free_all(outpubkey);
BIO_free(in);
BIO_free_all(mem_out);
BIO_free_all(mem_outpubkey);
release_engine(e);
OPENSSL_free(pass);
NCONF_free(conf);

11
apps/include/apps.h
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -10,10 +10,8 @@
#ifndef OSSL_APPS_H
# define OSSL_APPS_H
# include "internal/e_os.h" /* struct timeval for DTLS */
# include "internal/common.h" /* for HAS_PREFIX */
# include "internal/nelem.h"
# include "internal/sockets.h" /* for openssl_fdset() */
# include <assert.h>
# include <stdarg.h>
@ -65,6 +63,7 @@ BIO *dup_bio_err(int format);
BIO *bio_open_owner(const char *filename, int format, int private);
BIO *bio_open_default(const char *filename, char mode, int format);
BIO *bio_open_default_quiet(const char *filename, char mode, int format);
int mem_bio_to_file(BIO *in, const char *filename, int format, int private);
char *app_conf_try_string(const CONF *cnf, const char *group, const char *name);
int app_conf_try_number(const CONF *conf, const char *group, const char *name,
long *result);
@ -82,8 +81,12 @@ int has_stdin_waiting(void);
# endif
void corrupt_signature(const ASN1_STRING *signature);
/* Helpers for setting X509v3 certificate fields notBefore and notAfter */
int check_cert_time_string(const char *time, const char *desc);
int set_cert_times(X509 *x, const char *startdate, const char *enddate,
int days);
int days, int strict_compare_times);
int set_crl_lastupdate(X509_CRL *crl, const char *lastupdate);
int set_crl_nextupdate(X509_CRL *crl, const char *nextupdate,
long days, long hours, long secs);

4
apps/include/cmp_mock_srv.h
View file

@ -1,5 +1,5 @@
/*
* Copyright 2018-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Siemens AG 2018-2020
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@ -22,6 +22,8 @@ void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx);
int ossl_cmp_mock_srv_set1_refCert(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
int ossl_cmp_mock_srv_set1_keyOut(OSSL_CMP_SRV_CTX *srv_ctx, EVP_PKEY *pkey);
int ossl_cmp_mock_srv_set1_crlOut(OSSL_CMP_SRV_CTX *srv_ctx, X509_CRL *crl);
int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
STACK_OF(X509) *chain);
int ossl_cmp_mock_srv_set1_caPubsOut(OSSL_CMP_SRV_CTX *srv_ctx,

5
apps/include/opt.h
View file

@ -1,5 +1,5 @@
/*
* Copyright 2018-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -295,6 +295,7 @@
# define OPT_PROV_ENUM \
OPT_PROV__FIRST=1600, \
OPT_PROV_PROVIDER, OPT_PROV_PROVIDER_PATH, OPT_PROV_PROPQUERY, \
OPT_PROV_PARAM, \
OPT_PROV__LAST
# define OPT_CONFIG_OPTION \
@ -304,12 +305,14 @@
OPT_SECTION("Provider"), \
{ "provider-path", OPT_PROV_PROVIDER_PATH, 's', "Provider load path (must be before 'provider' argument if required)" }, \
{ "provider", OPT_PROV_PROVIDER, 's', "Provider to load (can be specified multiple times)" }, \
{ "provparam", OPT_PROV_PARAM, 's', "Set a provider key-value parameter" }, \
{ "propquery", OPT_PROV_PROPQUERY, 's', "Property query used when fetching algorithms" }
# define OPT_PROV_CASES \
OPT_PROV__FIRST: case OPT_PROV__LAST: break; \
case OPT_PROV_PROVIDER: \
case OPT_PROV_PROVIDER_PATH: \
case OPT_PROV_PARAM: \
case OPT_PROV_PROPQUERY
/*

4
apps/include/platform.h
View file

@ -1,5 +1,5 @@
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -16,7 +16,7 @@
/*
* VMS C only for now, implemented in vms_decc_init.c
* If other C compilers forget to terminate argv with NULL, this function
* can be re-used.
* can be reused.
*/
char **copy_argv(int *argc, char *argv[]);
# endif

13
apps/info.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -14,7 +14,7 @@
typedef enum OPTION_choice {
OPT_COMMON,
OPT_CONFIGDIR, OPT_ENGINESDIR, OPT_MODULESDIR, OPT_DSOEXT, OPT_DIRNAMESEP,
OPT_LISTSEP, OPT_SEEDS, OPT_CPUSETTINGS
OPT_LISTSEP, OPT_SEEDS, OPT_CPUSETTINGS, OPT_WINDOWSCONTEXT
} OPTION_CHOICE;
const OPTIONS info_options[] = {
@ -32,6 +32,7 @@ const OPTIONS info_options[] = {
{"listsep", OPT_LISTSEP, '-', "List separator character"},
{"seeds", OPT_SEEDS, '-', "Seed sources"},
{"cpusettings", OPT_CPUSETTINGS, '-', "CPU settings info"},
{"windowscontext", OPT_WINDOWSCONTEXT, '-', "Windows install context"},
{NULL}
};
@ -40,6 +41,7 @@ int info_main(int argc, char **argv)
int ret = 1, dirty = 0, type = 0;
char *prog;
OPTION_CHOICE o;
const char *typedata;
prog = opt_init(argc, argv, info_options);
while ((o = opt_next()) != OPT_EOF) {
@ -84,6 +86,10 @@ opthelp:
type = OPENSSL_INFO_CPU_SETTINGS;
dirty++;
break;
case OPT_WINDOWSCONTEXT:
type = OPENSSL_INFO_WINDOWS_CONTEXT;
dirty++;
break;
}
}
if (!opt_check_rest_arg(NULL))
@ -97,7 +103,8 @@ opthelp:
goto opthelp;
}
BIO_printf(bio_out, "%s\n", OPENSSL_info(type));
typedata = OPENSSL_info(type);
BIO_printf(bio_out, "%s\n", typedata == NULL ? "Undefined" : typedata);
ret = 0;
end:
return ret;

77
apps/lib/app_provider.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -8,6 +8,7 @@
*/
#include "apps.h"
#include <ctype.h>
#include <string.h>
#include <openssl/err.h>
#include <openssl/provider.h>
@ -65,6 +66,78 @@ static int opt_provider_path(const char *path)
return OSSL_PROVIDER_set_default_search_path(app_get0_libctx(), path);
}
struct prov_param_st {
char *name;
char *key;
char *val;
int found;
};
static int set_prov_param(OSSL_PROVIDER *prov, void *vp)
{
struct prov_param_st *p = (struct prov_param_st *)vp;
if (p->name != NULL && strcmp(OSSL_PROVIDER_get0_name(prov), p->name) != 0)
return 1;
p->found = 1;
return OSSL_PROVIDER_add_conf_parameter(prov, p->key, p->val);
}
static int opt_provider_param(const char *arg)
{
struct prov_param_st p;
char *copy, *tmp;
int ret = 0;
if ((copy = OPENSSL_strdup(arg)) == NULL
|| (p.val = strchr(copy, '=')) == NULL) {
opt_printf_stderr("%s: malformed '-provparam' option value: '%s'\n",
opt_getprog(), arg);
goto end;
}
/* Drop whitespace on both sides of the '=' sign */
*(tmp = p.val++) = '\0';
while (tmp > copy && isspace(_UC(*--tmp)))
*tmp = '\0';
while (isspace(_UC(*p.val)))
++p.val;
/*
* Split the key on ':', to get the optional provider, empty or missing
* means all.
*/
if ((p.key = strchr(copy, ':')) != NULL) {
*p.key++ = '\0';
p.name = *copy != '\0' ? copy : NULL;
} else {
p.name = NULL;
p.key = copy;
}
/* The key must not be empty */
if (*p.key == '\0') {
opt_printf_stderr("%s: malformed '-provparam' option value: '%s'\n",
opt_getprog(), arg);
goto end;
}
p.found = 0;
ret = OSSL_PROVIDER_do_all(app_get0_libctx(), set_prov_param, (void *)&p);
if (ret == 0) {
opt_printf_stderr("%s: Error setting provider '%s' parameter '%s'\n",
opt_getprog(), p.name, p.key);
} else if (p.found == 0) {
opt_printf_stderr("%s: No provider named '%s' is loaded\n",
opt_getprog(), p.name);
ret = 0;
}
end:
OPENSSL_free(copy);
return ret;
}
int opt_provider(int opt)
{
const int given = provider_option_given;
@ -78,6 +151,8 @@ int opt_provider(int opt)
return app_provider_load(app_get0_libctx(), opt_arg());
case OPT_PROV_PROVIDER_PATH:
return opt_provider_path(opt_arg());
case OPT_PROV_PARAM:
return opt_provider_param(opt_arg());
case OPT_PROV_PROPQUERY:
return app_set_propq(opt_arg());
}

1
apps/lib/app_rand.c
View file

@ -7,6 +7,7 @@
* https://www.openssl.org/source/license.html
*/
#include "internal/e_os.h" /* LIST_SEPARATOR_CHAR */
#include "apps.h"
#include <openssl/bio.h>
#include <openssl/err.h>

215
apps/lib/apps.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -48,6 +48,9 @@
#include "s_apps.h"
#include "apps.h"
#include "internal/sockets.h" /* for openssl_fdset() */
#include "internal/e_os.h"
#ifdef _WIN32
static int WIN32_rename(const char *from, const char *to);
# define rename(from, to) WIN32_rename((from), (to))
@ -189,7 +192,11 @@ int set_nameopt(const char *arg)
unsigned long get_nameopt(void)
{
return
nmflag_set ? nmflag : XN_FLAG_SEP_CPLUS_SPC | ASN1_STRFLGS_UTF8_CONVERT;
nmflag_set ? nmflag : XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN
| ASN1_STRFLGS_ESC_CTRL
| ASN1_STRFLGS_UTF8_CONVERT
| ASN1_STRFLGS_DUMP_UNKNOWN
| ASN1_STRFLGS_DUMP_DER;
}
void dump_cert_text(BIO *out, X509 *x)
@ -895,11 +902,15 @@ static const char *format2string(int format)
return "PEM";
case FORMAT_ASN1:
return "DER";
case FORMAT_PVK:
return "PVK";
case FORMAT_MSBLOB:
return "MSBLOB";
}
return NULL;
}
/* Set type expectation, but clear it if objects of different types expected. */
/* Set type expectation, but set to 0 if objects of multiple types expected. */
#define SET_EXPECT(val) \
(expect = expect < 0 ? (val) : (expect == (val) ? (val) : 0))
#define SET_EXPECT1(pvar, val) \
@ -907,6 +918,7 @@ static const char *format2string(int format)
*(pvar) = NULL; \
SET_EXPECT(val); \
}
/* Provide (error msg) text for some of the credential types to be loaded. */
#define FAIL_NAME \
(ppkey != NULL ? "private key" : ppubkey != NULL ? "public key" : \
pparams != NULL ? "key parameters" : \
@ -914,7 +926,9 @@ static const char *format2string(int format)
pcrl != NULL ? "CRL" : pcrls != NULL ? "CRLs" : NULL)
/*
* Load those types of credentials for which the result pointer is not NULL.
* Reads from stdio if uri is NULL and maybe_stdin is nonzero.
* Reads from stdin if 'uri' is NULL and 'maybe_stdin' is nonzero.
* 'format' parameter may be FORMAT_PEM, FORMAT_ASN1, or 0 for no hint.
* desc may contain more detail on the credential(s) to be loaded for error msg
* For non-NULL ppkey, pcert, and pcrl the first suitable value found is loaded.
* If pcerts is non-NULL and *pcerts == NULL then a new cert list is allocated.
* If pcerts is non-NULL then all available certificates are appended to *pcerts
@ -942,24 +956,38 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
OSSL_PARAM itp[2];
const OSSL_PARAM *params = NULL;
/* 'failed' describes type of credential to load for potential error msg */
if (failed == NULL) {
if (!quiet)
BIO_printf(bio_err, "Internal error: nothing to load from %s\n",
BIO_printf(bio_err, "Internal error: nothing was requested to load from %s\n",
uri != NULL ? uri : "<stdin>");
return 0;
}
/* suppress any extraneous errors left over from failed parse attempts */
ERR_set_mark();
SET_EXPECT1(ppkey, OSSL_STORE_INFO_PKEY);
SET_EXPECT1(ppubkey, OSSL_STORE_INFO_PUBKEY);
SET_EXPECT1(pparams, OSSL_STORE_INFO_PARAMS);
SET_EXPECT1(pcert, OSSL_STORE_INFO_CERT);
/*
* Up to here, the follwing holds.
* If just one of the ppkey, ppubkey, pparams, and pcert function parameters
* is nonzero, expect > 0 indicates which type of credential is expected.
* If expect == 0, more than one of them is nonzero (multiple types expected).
*/
if (pcerts != NULL) {
if (*pcerts == NULL && (*pcerts = sk_X509_new_null()) == NULL) {
if (!quiet)
BIO_printf(bio_err, "Out of memory loading");
goto end;
}
/*
* Adapt the 'expect' variable:
* set to OSSL_STORE_INFO_CERT if no other type is expected so far,
* otherwise set to 0 (indicating that multiple types are expected).
*/
SET_EXPECT(OSSL_STORE_INFO_CERT);
}
SET_EXPECT1(pcrl, OSSL_STORE_INFO_CRL);
@ -969,6 +997,11 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
BIO_printf(bio_err, "Out of memory loading");
goto end;
}
/*
* Adapt the 'expect' variable:
* set to OSSL_STORE_INFO_CRL if no other type is expected so far,
* otherwise set to 0 (indicating that multiple types are expected).
*/
SET_EXPECT(OSSL_STORE_INFO_CRL);
}
@ -1008,6 +1041,7 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
BIO_printf(bio_err, "Could not open file or uri for loading");
goto end;
}
/* expect == 0 means here multiple types of credentials are to be loaded */
if (expect > 0 && !OSSL_STORE_expect(ctx, expect)) {
if (!quiet)
BIO_printf(bio_err, "Internal error trying to load");
@ -1015,6 +1049,8 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
}
failed = NULL;
/* from here, failed != NULL only if actually an error has been detected */
while ((ppkey != NULL || ppubkey != NULL || pparams != NULL
|| pcert != NULL || pcerts != NULL || pcrl != NULL || pcrls != NULL)
&& !OSSL_STORE_eof(ctx)) {
@ -1084,7 +1120,7 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
ncrls += ok;
break;
default:
/* skip any other type */
/* skip any other type; ok stays == 1 */
break;
}
OSSL_STORE_INFO_free(info);
@ -1098,18 +1134,22 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
end:
OSSL_STORE_close(ctx);
if (ncerts > 0)
pcerts = NULL;
if (ncrls > 0)
pcrls = NULL;
/* see if any of the requested types of credentials was not found */
if (failed == NULL) {
if (ncerts > 0)
pcerts = NULL;
if (ncrls > 0)
pcrls = NULL;
failed = FAIL_NAME;
if (failed != NULL && !quiet)
BIO_printf(bio_err, "Could not find");
}
if (failed != NULL && !quiet) {
unsigned long err = ERR_peek_last_error();
/* continue the error message with the type of credential affected */
if (desc != NULL && strstr(desc, failed) != NULL) {
BIO_printf(bio_err, " %s", desc);
} else {
@ -1570,9 +1610,9 @@ int save_serial(const char *serialfile, const char *suffix,
OPENSSL_strlcpy(buf[0], serialfile, BSIZE);
} else {
#ifndef OPENSSL_SYS_VMS
j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", serialfile, suffix);
BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", serialfile, suffix);
#else
j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", serialfile, suffix);
BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", serialfile, suffix);
#endif
}
out = BIO_new_file(buf[0], "w");
@ -1614,11 +1654,11 @@ int rotate_serial(const char *serialfile, const char *new_suffix,
goto err;
}
#ifndef OPENSSL_SYS_VMS
j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", serialfile, new_suffix);
j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s.%s", serialfile, old_suffix);
BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", serialfile, new_suffix);
BIO_snprintf(buf[1], sizeof(buf[1]), "%s.%s", serialfile, old_suffix);
#else
j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", serialfile, new_suffix);
j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s-%s", serialfile, old_suffix);
BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", serialfile, new_suffix);
BIO_snprintf(buf[1], sizeof(buf[1]), "%s-%s", serialfile, old_suffix);
#endif
if (rename(serialfile, buf[1]) < 0 && errno != ENOENT
#ifdef ENOTDIR
@ -1770,13 +1810,13 @@ int save_index(const char *dbfile, const char *suffix, CA_DB *db)
goto err;
}
#ifndef OPENSSL_SYS_VMS
j = BIO_snprintf(buf[2], sizeof(buf[2]), "%s.attr", dbfile);
j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s.attr.%s", dbfile, suffix);
j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", dbfile, suffix);
BIO_snprintf(buf[2], sizeof(buf[2]), "%s.attr", dbfile);
BIO_snprintf(buf[1], sizeof(buf[1]), "%s.attr.%s", dbfile, suffix);
BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", dbfile, suffix);
#else
j = BIO_snprintf(buf[2], sizeof(buf[2]), "%s-attr", dbfile);
j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s-attr-%s", dbfile, suffix);
j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", dbfile, suffix);
BIO_snprintf(buf[2], sizeof(buf[2]), "%s-attr", dbfile);
BIO_snprintf(buf[1], sizeof(buf[1]), "%s-attr-%s", dbfile, suffix);
BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", dbfile, suffix);
#endif
out = BIO_new_file(buf[0], "w");
if (out == NULL) {
@ -1820,17 +1860,17 @@ int rotate_index(const char *dbfile, const char *new_suffix,
goto err;
}
#ifndef OPENSSL_SYS_VMS
j = BIO_snprintf(buf[4], sizeof(buf[4]), "%s.attr", dbfile);
j = BIO_snprintf(buf[3], sizeof(buf[3]), "%s.attr.%s", dbfile, old_suffix);
j = BIO_snprintf(buf[2], sizeof(buf[2]), "%s.attr.%s", dbfile, new_suffix);
j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s.%s", dbfile, old_suffix);
j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", dbfile, new_suffix);
BIO_snprintf(buf[4], sizeof(buf[4]), "%s.attr", dbfile);
BIO_snprintf(buf[3], sizeof(buf[3]), "%s.attr.%s", dbfile, old_suffix);
BIO_snprintf(buf[2], sizeof(buf[2]), "%s.attr.%s", dbfile, new_suffix);
BIO_snprintf(buf[1], sizeof(buf[1]), "%s.%s", dbfile, old_suffix);
BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", dbfile, new_suffix);
#else
j = BIO_snprintf(buf[4], sizeof(buf[4]), "%s-attr", dbfile);
j = BIO_snprintf(buf[3], sizeof(buf[3]), "%s-attr-%s", dbfile, old_suffix);
j = BIO_snprintf(buf[2], sizeof(buf[2]), "%s-attr-%s", dbfile, new_suffix);
j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s-%s", dbfile, old_suffix);
j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", dbfile, new_suffix);
BIO_snprintf(buf[4], sizeof(buf[4]), "%s-attr", dbfile);
BIO_snprintf(buf[3], sizeof(buf[3]), "%s-attr-%s", dbfile, old_suffix);
BIO_snprintf(buf[2], sizeof(buf[2]), "%s-attr-%s", dbfile, new_suffix);
BIO_snprintf(buf[1], sizeof(buf[1]), "%s-%s", dbfile, old_suffix);
BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", dbfile, new_suffix);
#endif
if (rename(dbfile, buf[1]) < 0 && errno != ENOENT
#ifdef ENOTDIR
@ -2184,7 +2224,7 @@ int check_cert_attributes(BIO *bio, X509 *x, const char *checkhost,
if (print)
BIO_printf(bio, "Hostname %s does%s match certificate\n",
checkhost, valid_host == 1 ? "" : " NOT");
ret = ret && valid_host;
ret = ret && valid_host > 0;
}
if (checkemail != NULL) {
@ -2192,7 +2232,7 @@ int check_cert_attributes(BIO *bio, X509 *x, const char *checkhost,
if (print)
BIO_printf(bio, "Email %s does%s match certificate\n",
checkemail, valid_mail ? "" : " NOT");
ret = ret && valid_mail;
ret = ret && valid_mail > 0;
}
if (checkip != NULL) {
@ -2200,7 +2240,7 @@ int check_cert_attributes(BIO *bio, X509 *x, const char *checkhost,
if (print)
BIO_printf(bio, "IP %s does%s match certificate\n",
checkip, valid_ip ? "" : " NOT");
ret = ret && valid_ip;
ret = ret && valid_ip > 0;
}
return ret;
@ -2483,18 +2523,24 @@ static STACK_OF(X509_CRL) *crls_http_cb(const X509_STORE_CTX *ctx,
crldp = X509_get_ext_d2i(x, NID_crl_distribution_points, NULL, NULL);
crl = load_crl_crldp(crldp);
sk_DIST_POINT_pop_free(crldp, DIST_POINT_free);
if (!crl) {
sk_X509_CRL_free(crls);
return NULL;
}
sk_X509_CRL_push(crls, crl);
if (crl == NULL || !sk_X509_CRL_push(crls, crl))
goto error;
/* Try to download delta CRL */
crldp = X509_get_ext_d2i(x, NID_freshest_crl, NULL, NULL);
crl = load_crl_crldp(crldp);
sk_DIST_POINT_pop_free(crldp, DIST_POINT_free);
if (crl)
sk_X509_CRL_push(crls, crl);
if (crl != NULL && !sk_X509_CRL_push(crls, crl))
goto error;
return crls;
error:
X509_CRL_free(crl);
sk_X509_CRL_free(crls);
return NULL;
}
void store_setup_crl_download(X509_STORE *st)
@ -2952,11 +2998,6 @@ int raw_read_stdin(void *buf, int siz)
return recv(fileno_stdin(), buf, siz, 0);
}
#else
# if defined(__TANDEM)
# if defined(OPENSSL_TANDEM_FLOSS)
# include <floss.h(floss_read)>
# endif
# endif
int raw_read_stdin(void *buf, int siz)
{
return read(fileno_stdin(), buf, siz);
@ -2975,21 +3016,11 @@ int raw_write_stdout(const void *buf, int siz)
}
#elif defined(OPENSSL_SYS_TANDEM) && defined(OPENSSL_THREADS) \
&& defined(_SPT_MODEL_)
# if defined(__TANDEM)
# if defined(OPENSSL_TANDEM_FLOSS)
# include <floss.h(floss_write)>
# endif
# endif
int raw_write_stdout(const void *buf, int siz)
{
return write(fileno(stdout), (void *)buf, siz);
}
#else
# if defined(__TANDEM)
# if defined(OPENSSL_TANDEM_FLOSS)
# include <floss.h(floss_write)>
# endif
# endif
int raw_write_stdout(const void *buf, int siz)
{
return write(fileno_stdout(), buf, siz);
@ -3208,6 +3239,32 @@ BIO *bio_open_default_quiet(const char *filename, char mode, int format)
return bio_open_default_(filename, mode, format, 1);
}
int mem_bio_to_file(BIO *in, const char *filename, int format, int private)
{
int rv = 0, ret = 0;
BIO *out = NULL;
BUF_MEM *mem_buffer = NULL;
rv = BIO_get_mem_ptr(in, &mem_buffer);
if (rv <= 0) {
BIO_puts(bio_err, "Error reading mem buffer\n");
goto end;
}
out = bio_open_owner(filename, format, private);
if (out == NULL)
goto end;
rv = BIO_write(out, mem_buffer->data, mem_buffer->length);
if (rv < 0 || (size_t)rv != mem_buffer->length)
BIO_printf(bio_err, "Error writing to output file: '%s'\n", filename);
else
ret = 1;
end:
if (!ret)
ERR_print_errors(bio_err);
BIO_free_all(out);
return ret;
}
void wait_for_async(SSL *s)
{
/* On Windows select only works for sockets, so we simply don't wait */
@ -3275,23 +3332,54 @@ void corrupt_signature(const ASN1_STRING *signature)
s[signature->length - 1] ^= 0x1;
}
int set_cert_times(X509 *x, const char *startdate, const char *enddate,
int days)
int check_cert_time_string(const char *time, const char *desc)
{
if (time == NULL || strcmp(time, "today") == 0
|| ASN1_TIME_set_string_X509(NULL, time))
return 1;
BIO_printf(bio_err,
"%s is invalid, it should be \"today\" or have format [CC]YYMMDDHHMMSSZ\n",
desc);
return 0;
}
int set_cert_times(X509 *x, const char *startdate, const char *enddate,
int days, int strict_compare_times)
{
if (!check_cert_time_string(startdate, "start date"))
return 0;
if (!check_cert_time_string(enddate, "end date"))
return 0;
if (startdate == NULL || strcmp(startdate, "today") == 0) {
if (X509_gmtime_adj(X509_getm_notBefore(x), 0) == NULL)
if (X509_gmtime_adj(X509_getm_notBefore(x), 0) == NULL) {
BIO_printf(bio_err, "Error setting notBefore certificate field\n");
return 0;
}
} else {
if (!ASN1_TIME_set_string_X509(X509_getm_notBefore(x), startdate))
if (!ASN1_TIME_set_string_X509(X509_getm_notBefore(x), startdate)) {
BIO_printf(bio_err, "Error setting notBefore certificate field\n");
return 0;
}
}
if (enddate != NULL && strcmp(enddate, "today") == 0) {
enddate = NULL;
days = 0;
}
if (enddate == NULL) {
if (X509_time_adj_ex(X509_getm_notAfter(x), days, 0, NULL)
== NULL)
if (X509_time_adj_ex(X509_getm_notAfter(x), days, 0, NULL) == NULL) {
BIO_printf(bio_err, "Error setting notAfter certificate field\n");
return 0;
}
} else if (!ASN1_TIME_set_string_X509(X509_getm_notAfter(x), enddate)) {
BIO_printf(bio_err, "Error setting notAfter certificate field\n");
return 0;
}
if (ASN1_TIME_compare(X509_get0_notAfter(x), X509_get0_notBefore(x)) < 0) {
BIO_printf(bio_err, "%s: end date before start date\n",
strict_compare_times ? "Error" : "Warning");
if (strict_compare_times)
return 0;
}
return 1;
}
@ -3448,6 +3536,7 @@ int opt_legacy_okay(void)
{
int provider_options = opt_provider_option_given();
int libctx = app_get0_libctx() != NULL || app_get0_propq() != NULL;
/*
* Having a provider option specified or a custom library context or
* property query, is a sure sign we're not using legacy.

176
apps/lib/cmp_mock_srv.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2018-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Siemens AG 2018-2020
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@ -16,10 +16,11 @@
#include <openssl/cmperr.h>
/* the context for the CMP mock server */
typedef struct
{
typedef struct {
X509 *refCert; /* cert to expect for oldCertID in kur/rr msg */
X509 *certOut; /* certificate to be returned in cp/ip/kup msg */
EVP_PKEY *keyOut; /* Private key to be returned for central keygen */
X509_CRL *crlOut; /* CRL to be returned in genp for crls */
STACK_OF(X509) *chainOut; /* chain of certOut to add to extraCerts field */
STACK_OF(X509) *caPubsOut; /* used in caPubs of ip and in caCerts of genp */
X509 *newWithNew; /* to return in newWithNew of rootKeyUpdate */
@ -87,6 +88,37 @@ static mock_srv_ctx *mock_srv_ctx_new(void)
DEFINE_OSSL_SET1_CERT(refCert)
DEFINE_OSSL_SET1_CERT(certOut)
int ossl_cmp_mock_srv_set1_keyOut(OSSL_CMP_SRV_CTX *srv_ctx, EVP_PKEY *pkey)
{
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
if (ctx == NULL) {
ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
return 0;
}
if (pkey != NULL && !EVP_PKEY_up_ref(pkey))
return 0;
EVP_PKEY_free(ctx->keyOut);
ctx->keyOut = pkey;
return 1;
}
int ossl_cmp_mock_srv_set1_crlOut(OSSL_CMP_SRV_CTX *srv_ctx,
X509_CRL *crl)
{
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
if (ctx == NULL) {
ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
return 0;
}
if (crl != NULL && !X509_CRL_up_ref(crl))
return 0;
X509_CRL_free(ctx->crlOut);
ctx->crlOut = crl;
return 1;
}
int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
STACK_OF(X509) *chain)
{
@ -257,8 +289,9 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
STACK_OF(X509) **caPubs)
{
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
int bodytype;
int bodytype, central_keygen;
OSSL_CMP_PKISI *si = NULL;
EVP_PKEY *keyOut = NULL;
if (ctx == NULL || cert_req == NULL
|| certOut == NULL || chainOut == NULL || caPubs == NULL) {
@ -342,6 +375,23 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
&& (*certOut = X509_dup(ctx->certOut)) == NULL)
/* Should return a cert produced from request template, see FR #16054 */
goto err;
central_keygen = OSSL_CRMF_MSG_centralkeygen_requested(crm, p10cr);
if (central_keygen < 0)
goto err;
if (central_keygen == 1
&& (ctx->keyOut == NULL
|| (keyOut = EVP_PKEY_dup(ctx->keyOut)) == NULL
|| !OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx),
1 /* priv */, keyOut))) {
EVP_PKEY_free(keyOut);
goto err;
}
/*
* Note that this uses newPkey to return the private key
* and does not check whether the 'popo' field is absent.
*/
if (ctx->chainOut != NULL
&& (*chainOut = X509_chain_up_ref(ctx->chainOut)) == NULL)
goto err;
@ -391,19 +441,129 @@ static OSSL_CMP_PKISI *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
return OSSL_CMP_PKISI_dup(ctx->statusOut);
}
/* return -1 for error, 0 for no update available */
static int check_client_crl(const STACK_OF(OSSL_CMP_CRLSTATUS) *crlStatusList,
const X509_CRL *crl)
{
OSSL_CMP_CRLSTATUS *crlstatus;
DIST_POINT_NAME *dpn = NULL;
GENERAL_NAMES *issuer = NULL;
ASN1_TIME *thisupd = NULL;
if (sk_OSSL_CMP_CRLSTATUS_num(crlStatusList) != 1) {
ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_CRLSTATUSLIST);
return -1;
}
if (crl == NULL)
return 0;
crlstatus = sk_OSSL_CMP_CRLSTATUS_value(crlStatusList, 0);
if (!OSSL_CMP_CRLSTATUS_get0(crlstatus, &dpn, &issuer, &thisupd))
return -1;
if (issuer != NULL) {
GENERAL_NAME *gn = sk_GENERAL_NAME_value(issuer, 0);
if (gn != NULL && gn->type == GEN_DIRNAME) {
X509_NAME *gen_name = gn->d.dirn;
if (X509_NAME_cmp(gen_name, X509_CRL_get_issuer(crl)) != 0) {
ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_CRL_ISSUER);
return -1;
}
} else {
ERR_raise(ERR_LIB_CMP, CMP_R_SENDER_GENERALNAME_TYPE_NOT_SUPPORTED);
return -1; /* error according to RFC 9483 section 4.3.4 */
}
}
return thisupd == NULL
|| ASN1_TIME_compare(thisupd, X509_CRL_get0_lastUpdate(crl)) < 0;
}
static OSSL_CMP_ITAV *process_genm_itav(mock_srv_ctx *ctx, int req_nid,
const OSSL_CMP_ITAV *req)
{
OSSL_CMP_ITAV *rsp;
OSSL_CMP_ITAV *rsp = NULL;
switch (req_nid) {
case NID_id_it_caCerts:
rsp = OSSL_CMP_ITAV_new_caCerts(ctx->caPubsOut);
break;
case NID_id_it_rootCaCert:
rsp = OSSL_CMP_ITAV_new_rootCaKeyUpdate(ctx->newWithNew,
ctx->newWithOld,
ctx->oldWithNew);
{
X509 *rootcacert = NULL;
if (!OSSL_CMP_ITAV_get0_rootCaCert(req, &rootcacert))
return NULL;
if (rootcacert != NULL
&& X509_NAME_cmp(X509_get_subject_name(rootcacert),
X509_get_subject_name(ctx->newWithNew)) != 0)
/* The subjects do not match */
rsp = OSSL_CMP_ITAV_new_rootCaKeyUpdate(NULL, NULL, NULL);
else
rsp = OSSL_CMP_ITAV_new_rootCaKeyUpdate(ctx->newWithNew,
ctx->newWithOld,
ctx->oldWithNew);
}
break;
case NID_id_it_crlStatusList:
{
STACK_OF(OSSL_CMP_CRLSTATUS) *crlstatuslist = NULL;
int res = 0;
if (!OSSL_CMP_ITAV_get0_crlStatusList(req, &crlstatuslist))
return NULL;
res = check_client_crl(crlstatuslist, ctx->crlOut);
if (res < 0)
rsp = NULL;
else
rsp = OSSL_CMP_ITAV_new_crls(res == 0 ? NULL : ctx->crlOut);
}
break;
case NID_id_it_certReqTemplate:
{
OSSL_CRMF_CERTTEMPLATE *reqtemp;
OSSL_CMP_ATAVS *keyspec = NULL;
X509_ALGOR *keyalg = NULL;
OSSL_CMP_ATAV *rsakeylen, *eckeyalg;
int ok = 0;
if ((reqtemp = OSSL_CRMF_CERTTEMPLATE_new()) == NULL)
return NULL;
if (!OSSL_CRMF_CERTTEMPLATE_fill(reqtemp, NULL, NULL,
X509_get_issuer_name(ctx->refCert),
NULL))
goto crt_err;
if ((keyalg = X509_ALGOR_new()) == NULL)
goto crt_err;
(void)X509_ALGOR_set0(keyalg, OBJ_nid2obj(NID_X9_62_id_ecPublicKey),
V_ASN1_UNDEF, NULL); /* cannot fail */
eckeyalg = OSSL_CMP_ATAV_new_algId(keyalg);
rsakeylen = OSSL_CMP_ATAV_new_rsaKeyLen(4096);
ok = OSSL_CMP_ATAV_push1(&keyspec, eckeyalg)
&& OSSL_CMP_ATAV_push1(&keyspec, rsakeylen);
OSSL_CMP_ATAV_free(eckeyalg);
OSSL_CMP_ATAV_free(rsakeylen);
X509_ALGOR_free(keyalg);
if (!ok)
goto crt_err;
rsp = OSSL_CMP_ITAV_new0_certReqTemplate(reqtemp, keyspec);
return rsp;
crt_err:
OSSL_CRMF_CERTTEMPLATE_free(reqtemp);
OSSL_CMP_ATAVS_free(keyspec);
return NULL;
}
break;
default:
rsp = OSSL_CMP_ITAV_dup(req);

1
apps/lib/engine_loader.c
View file

@ -14,6 +14,7 @@
*/
#define OPENSSL_SUPPRESS_DEPRECATED
#include "internal/e_os.h"
#include "apps.h"
#ifndef OPENSSL_NO_ENGINE

19
apps/lib/http_server.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -18,20 +18,16 @@
#endif
#include <ctype.h>
#include "internal/e_os.h"
#include "http_server.h"
#include "internal/sockets.h"
#include "internal/sockets.h" /* for openssl_fdset() */
#include <openssl/err.h>
#include <openssl/trace.h>
#include <openssl/rand.h>
#include "s_apps.h"
#include "log.h"
#if defined(__TANDEM)
# if defined(OPENSSL_TANDEM_FLOSS)
# include <floss.h(floss_fork)>
# endif
#endif
#define HTTP_PREFIX "HTTP/"
#define HTTP_VERSION_PATT "1." /* allow 1.x */
#define HTTP_PREFIX_VERSION HTTP_PREFIX""HTTP_VERSION_PATT
@ -200,7 +196,7 @@ BIO *http_server_init(const char *prog, const char *port, int verb)
int port_num;
char name[40];
snprintf(name, sizeof(name), "*:%s", port); /* port may be "0" */
BIO_snprintf(name, sizeof(name), "*:%s", port); /* port may be "0" */
if (verb >= 0 && !log_set_verbosity(prog, verb))
return NULL;
bufbio = BIO_new(BIO_f_buffer());
@ -208,8 +204,9 @@ BIO *http_server_init(const char *prog, const char *port, int verb)
goto err;
acbio = BIO_new(BIO_s_accept());
if (acbio == NULL
|| BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) < 0
|| BIO_set_accept_name(acbio, name) < 0) {
|| BIO_set_accept_ip_family(acbio, BIO_FAMILY_IPANY) <= 0 /* IPv4/6 */
|| BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) <= 0
|| BIO_set_accept_name(acbio, name) <= 0) {
log_HTTP(prog, LOG_ERR, "error setting up accept BIO");
goto err;
}

5
apps/lib/names.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -22,7 +22,8 @@ void collect_names(const char *name, void *vdata)
{
STACK_OF(OPENSSL_CSTRING) *names = vdata;
sk_OPENSSL_CSTRING_push(names, name);
/* A failure to push cannot be handled so we ignore the result. */
(void)sk_OPENSSL_CSTRING_push(names, name);
}
void print_names(BIO *out, STACK_OF(OPENSSL_CSTRING) *names)

4
apps/lib/opt.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2015-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -646,7 +646,7 @@ int opt_uintmax(const char *value, ossl_uintmax_t *result)
opt_number_error(value);
return 0;
}
*result = (ossl_intmax_t)m;
*result = (ossl_uintmax_t)m;
errno = oerrno;
return 1;
}

60
apps/lib/s_cb.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -243,10 +243,10 @@ static const char *get_sigtype(int nid)
return "ECDSA";
case NID_ED25519:
return "Ed25519";
return "ed25519";
case NID_ED448:
return "Ed448";
return "ed448";
case NID_id_GostR3410_2001:
return "gost2001";
@ -292,6 +292,26 @@ static int do_print_sigalgs(BIO *out, SSL *s, int shared)
SSL_get_sigalgs(s, i, &sign_nid, &hash_nid, NULL, &rsign, &rhash);
if (i)
BIO_puts(out, ":");
switch (rsign | rhash << 8) {
case 0x0809:
BIO_puts(out, "rsa_pss_pss_sha256");
continue;
case 0x080a:
BIO_puts(out, "rsa_pss_pss_sha384");
continue;
case 0x080b:
BIO_puts(out, "rsa_pss_pss_sha512");
continue;
case 0x081a:
BIO_puts(out, "ecdsa_brainpoolP256r1_sha256");
continue;
case 0x081b:
BIO_puts(out, "ecdsa_brainpoolP384r1_sha384");
continue;
case 0x081c:
BIO_puts(out, "ecdsa_brainpoolP512r1_sha512");
continue;
}
sstr = get_sigtype(sign_nid);
if (sstr)
BIO_printf(out, "%s", sstr);
@ -396,16 +416,28 @@ int ssl_print_groups(BIO *out, SSL *s, int noshared)
int ssl_print_tmp_key(BIO *out, SSL *s)
{
const char *keyname;
EVP_PKEY *key;
if (!SSL_get_peer_tmp_key(s, &key))
if (!SSL_get_peer_tmp_key(s, &key)) {
if (SSL_version(s) == TLS1_3_VERSION)
BIO_printf(out, "Negotiated TLS1.3 group: %s\n",
SSL_group_to_name(s, SSL_get_negotiated_group(s)));
return 1;
BIO_puts(out, "Server Temp Key: ");
}
BIO_puts(out, "Peer Temp Key: ");
switch (EVP_PKEY_get_id(key)) {
case EVP_PKEY_RSA:
BIO_printf(out, "RSA, %d bits\n", EVP_PKEY_get_bits(key));
break;
case EVP_PKEY_KEYMGMT:
if ((keyname = EVP_PKEY_get0_type_name(key)) == NULL)
keyname = "?";
BIO_printf(out, "%s\n", keyname);
break;
case EVP_PKEY_DH:
BIO_printf(out, "DH, %d bits\n", EVP_PKEY_get_bits(key));
break;
@ -704,7 +736,7 @@ void msg_cb(int write_p, int version, int content_type, const void *buf,
(void)BIO_flush(bio);
}
static STRINT_PAIR tlsext_types[] = {
static const STRINT_PAIR tlsext_types[] = {
{"server name", TLSEXT_TYPE_server_name},
{"max fragment length", TLSEXT_TYPE_max_fragment_length},
{"client certificate URL", TLSEXT_TYPE_client_certificate_url},
@ -746,6 +778,7 @@ static STRINT_PAIR tlsext_types[] = {
{"psk kex modes", TLSEXT_TYPE_psk_kex_modes},
{"certificate authorities", TLSEXT_TYPE_certificate_authorities},
{"post handshake auth", TLSEXT_TYPE_post_handshake_auth},
{"early_data", TLSEXT_TYPE_early_data},
{NULL}
};
@ -1273,6 +1306,7 @@ void print_verify_detail(SSL *s, BIO *bio)
void print_ssl_summary(SSL *s)
{
const char *sigalg;
const SSL_CIPHER *c;
X509 *peer = SSL_get0_peer_certificate(s);
EVP_PKEY *peer_rpk = SSL_get0_peer_rpk(s);
@ -1290,13 +1324,13 @@ void print_ssl_summary(SSL *s)
BIO_puts(bio_err, "\n");
if (SSL_get_peer_signature_nid(s, &nid))
BIO_printf(bio_err, "Hash used: %s\n", OBJ_nid2sn(nid));
if (SSL_get_peer_signature_type_nid(s, &nid))
BIO_printf(bio_err, "Signature type: %s\n", get_sigtype(nid));
if (SSL_get0_peer_signature_name(s, &sigalg))
BIO_printf(bio_err, "Signature type: %s\n", sigalg);
print_verify_detail(s, bio_err);
} else if (peer_rpk != NULL) {
BIO_printf(bio_err, "Peer used raw public key\n");
if (SSL_get_peer_signature_type_nid(s, &nid))
BIO_printf(bio_err, "Signature type: %s\n", get_sigtype(nid));
if (SSL_get0_peer_signature_name(s, &sigalg))
BIO_printf(bio_err, "Signature type: %s\n", sigalg);
print_verify_detail(s, bio_err);
} else {
BIO_puts(bio_err, "No peer certificate or raw public key\n");
@ -1305,12 +1339,8 @@ void print_ssl_summary(SSL *s)
ssl_print_point_formats(bio_err, s);
if (SSL_is_server(s))
ssl_print_groups(bio_err, s, 1);
else
ssl_print_tmp_key(bio_err, s);
#else
if (!SSL_is_server(s))
ssl_print_tmp_key(bio_err, s);
#endif
ssl_print_tmp_key(bio_err, s);
}
int config_ctx(SSL_CONF_CTX *cctx, STACK_OF(OPENSSL_STRING) *str,

25
apps/lib/s_socket.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -37,15 +37,10 @@ typedef unsigned int u_int;
#ifndef OPENSSL_NO_SOCK
# include "internal/e_os.h"
# include "apps.h"
# include "s_apps.h"
# include "internal/sockets.h"
# if defined(__TANDEM)
# if defined(OPENSSL_TANDEM_FLOSS)
# include <floss.h(floss_read)>
# endif
# endif
# include "internal/sockets.h" /* for openssl_fdset() */
# include <openssl/bio.h>
# include <openssl/err.h>
@ -90,9 +85,6 @@ int init_client(int *sock, const char *host, const char *port,
int ret;
int options = 0;
if (tfo && ba_ret != NULL)
*ba_ret = NULL;
if (BIO_sock_init() != 1)
return 0;
@ -419,6 +411,12 @@ int do_server(int *accept_sock, const char *host, const char *port,
BIO_closesocket(asock);
break;
}
if (naccept != -1)
naccept--;
if (naccept == 0)
BIO_closesocket(asock);
BIO_set_tcp_ndelay(sock, 1);
i = (*cb)(sock, type, protocol, context);
@ -449,11 +447,12 @@ int do_server(int *accept_sock, const char *host, const char *port,
BIO_closesocket(sock);
} else {
if (naccept != -1)
naccept--;
i = (*cb)(asock, type, protocol, context);
}
if (naccept != -1)
naccept--;
if (i < 0 || naccept == 0) {
BIO_closesocket(asock);
ret = i;

6
apps/lib/tlssrp_depr.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2005 Nokia. All rights reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@ -178,7 +178,7 @@ static int ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)
goto err;
}
BIO_printf(bio_err,
"SRP parameters set: username = \"%s\" info=\"%s\" \n",
"SRP parameters set: username = \"%s\" info=\"%s\"\n",
p->login, p->user->info);
ret = SSL_ERROR_NONE;
@ -199,7 +199,7 @@ int set_up_srp_verifier_file(SSL_CTX *ctx, srpsrvparm *srp_callback_parm,
srp_callback_parm->login = NULL;
if (srp_callback_parm->vb == NULL) {
BIO_printf(bio_err, "Failed to initialize SRP verifier file \n");
BIO_printf(bio_err, "Failed to initialize SRP verifier file\n");
return 0;
}
if ((ret =

10
apps/lib/vms_term_sock.c
View file

@ -353,7 +353,7 @@ static int CreateSocketPair (int SocketFamily,
/*
** Get the binary (64-bit) time of the specified timeout value
*/
sprintf (AscTimeBuff, "0 0:0:%02d.00", SOCKET_PAIR_TIMEOUT_VALUE);
BIO_snprintf(AscTimeBuff, sizeof(AscTimeBuff), "0 0:0:%02d.00", SOCKET_PAIR_TIMEOUT_VALUE);
AscTimeDesc.dsc$w_length = strlen (AscTimeBuff);
AscTimeDesc.dsc$a_pointer = AscTimeBuff;
status = sys$bintim (&AscTimeDesc, BinTimeBuff);
@ -567,10 +567,10 @@ static void LogMessage (char *msg, ...)
/*
** Format the message buffer
*/
sprintf (MsgBuff, "%02d-%s-%04d %02d:%02d:%02d [%08X] %s\n",
LocTime->tm_mday, Month[LocTime->tm_mon],
(LocTime->tm_year + 1900), LocTime->tm_hour, LocTime->tm_min,
LocTime->tm_sec, pid, msg);
BIO_snprintf(MsgBuff, sizeof(MsgBuff), "%02d-%s-%04d %02d:%02d:%02d [%08X] %s\n",
LocTime->tm_mday, Month[LocTime->tm_mon],
(LocTime->tm_year + 1900), LocTime->tm_hour, LocTime->tm_min,
LocTime->tm_sec, pid, msg);
/*
** Get any variable arguments and add them to the print of the message

297
apps/list.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -10,6 +10,8 @@
/* We need to use some deprecated APIs */
#define OPENSSL_SUPPRESS_DEPRECATED
#include "internal/e_os.h"
#include <string.h>
#include <openssl/evp.h>
#include <openssl/err.h>
@ -21,6 +23,9 @@
#include <openssl/store.h>
#include <openssl/core_names.h>
#include <openssl/rand.h>
#include <openssl/safestack.h>
#include <openssl/ssl.h>
#include <openssl/tls1.h>
#include "apps.h"
#include "app_params.h"
#include "progs.h"
@ -53,6 +58,7 @@ IS_FETCHABLE(mac, EVP_MAC)
IS_FETCHABLE(kdf, EVP_KDF)
IS_FETCHABLE(rand, EVP_RAND)
IS_FETCHABLE(keymgmt, EVP_KEYMGMT)
IS_FETCHABLE(skeymgmt, EVP_SKEYMGMT)
IS_FETCHABLE(signature, EVP_SIGNATURE)
IS_FETCHABLE(kem, EVP_KEM)
IS_FETCHABLE(asym_cipher, EVP_ASYM_CIPHER)
@ -71,7 +77,7 @@ static void legacy_cipher_fn(const EVP_CIPHER *c,
{
if (select_name != NULL
&& (c == NULL
|| OPENSSL_strcasecmp(select_name, EVP_CIPHER_get0_name(c)) != 0))
|| OPENSSL_strcasecmp(select_name, EVP_CIPHER_get0_name(c)) != 0))
return;
if (c != NULL) {
BIO_printf(arg, " %s\n", EVP_CIPHER_get0_name(c));
@ -98,8 +104,9 @@ static void collect_ciphers(EVP_CIPHER *cipher, void *stack)
STACK_OF(EVP_CIPHER) *cipher_stack = stack;
if (is_cipher_fetchable(cipher)
&& sk_EVP_CIPHER_push(cipher_stack, cipher) > 0)
EVP_CIPHER_up_ref(cipher);
&& EVP_CIPHER_up_ref(cipher)
&& sk_EVP_CIPHER_push(cipher_stack, cipher) <= 0)
EVP_CIPHER_free(cipher); /* up-ref successful but push to stack failed */
}
static void list_ciphers(const char *prefix)
@ -182,8 +189,9 @@ static void collect_digests(EVP_MD *digest, void *stack)
STACK_OF(EVP_MD) *digest_stack = stack;
if (is_digest_fetchable(digest)
&& sk_EVP_MD_push(digest_stack, digest) > 0)
EVP_MD_up_ref(digest);
&& EVP_MD_up_ref(digest)
&& sk_EVP_MD_push(digest_stack, digest) <= 0)
EVP_MD_free(digest); /* up-ref successful but push to stack failed */
}
static void list_digests(const char *prefix)
@ -314,8 +322,9 @@ static void collect_kdfs(EVP_KDF *kdf, void *stack)
STACK_OF(EVP_KDF) *kdf_stack = stack;
if (is_kdf_fetchable(kdf)
&& sk_EVP_KDF_push(kdf_stack, kdf) > 0)
EVP_KDF_up_ref(kdf);
&& EVP_KDF_up_ref(kdf)
&& sk_EVP_KDF_push(kdf_stack, kdf) <= 0)
EVP_KDF_free(kdf); /* up-ref successful but push to stack failed */
}
static void list_kdfs(void)
@ -384,8 +393,9 @@ static void collect_rands(EVP_RAND *rand, void *stack)
STACK_OF(EVP_RAND) *rand_stack = stack;
if (is_rand_fetchable(rand)
&& sk_EVP_RAND_push(rand_stack, rand) > 0)
EVP_RAND_up_ref(rand);
&& EVP_RAND_up_ref(rand)
&& sk_EVP_RAND_push(rand_stack, rand) <= 0)
EVP_RAND_free(rand); /* up-ref successful but push to stack failed */
}
static void list_random_generators(void)
@ -510,8 +520,9 @@ static void collect_encoders(OSSL_ENCODER *encoder, void *stack)
STACK_OF(OSSL_ENCODER) *encoder_stack = stack;
if (is_encoder_fetchable(encoder)
&& sk_OSSL_ENCODER_push(encoder_stack, encoder) > 0)
OSSL_ENCODER_up_ref(encoder);
&& OSSL_ENCODER_up_ref(encoder)
&& sk_OSSL_ENCODER_push(encoder_stack, encoder) <= 0)
OSSL_ENCODER_free(encoder); /* up-ref successful but push to stack failed */
}
static void list_encoders(void)
@ -575,8 +586,9 @@ static void collect_decoders(OSSL_DECODER *decoder, void *stack)
STACK_OF(OSSL_DECODER) *decoder_stack = stack;
if (is_decoder_fetchable(decoder)
&& sk_OSSL_DECODER_push(decoder_stack, decoder) > 0)
OSSL_DECODER_up_ref(decoder);
&& OSSL_DECODER_up_ref(decoder)
&& sk_OSSL_DECODER_push(decoder_stack, decoder) <= 0)
OSSL_DECODER_free(decoder); /* up-ref successful but push to stack failed */
}
static void list_decoders(void)
@ -637,8 +649,9 @@ static void collect_keymanagers(EVP_KEYMGMT *km, void *stack)
STACK_OF(EVP_KEYMGMT) *km_stack = stack;
if (is_keymgmt_fetchable(km)
&& sk_EVP_KEYMGMT_push(km_stack, km) > 0)
EVP_KEYMGMT_up_ref(km);
&& EVP_KEYMGMT_up_ref(km)
&& sk_EVP_KEYMGMT_push(km_stack, km) <= 0)
EVP_KEYMGMT_free(km); /* up-ref successful but push to stack failed */
}
static void list_keymanagers(void)
@ -687,6 +700,61 @@ static void list_keymanagers(void)
sk_EVP_KEYMGMT_pop_free(km_stack, EVP_KEYMGMT_free);
}
DEFINE_STACK_OF(EVP_SKEYMGMT)
static int skeymanager_cmp(const EVP_SKEYMGMT * const *a,
const EVP_SKEYMGMT * const *b)
{
return strcmp(OSSL_PROVIDER_get0_name(EVP_SKEYMGMT_get0_provider(*a)),
OSSL_PROVIDER_get0_name(EVP_SKEYMGMT_get0_provider(*b)));
}
static void collect_skeymanagers(EVP_SKEYMGMT *km, void *stack)
{
STACK_OF(EVP_SKEYMGMT) *km_stack = stack;
if (is_skeymgmt_fetchable(km)
&& sk_EVP_SKEYMGMT_push(km_stack, km) > 0)
EVP_SKEYMGMT_up_ref(km);
}
static void list_skeymanagers(void)
{
int i;
STACK_OF(EVP_SKEYMGMT) *km_stack = sk_EVP_SKEYMGMT_new(skeymanager_cmp);
EVP_SKEYMGMT_do_all_provided(app_get0_libctx(), collect_skeymanagers,
km_stack);
sk_EVP_SKEYMGMT_sort(km_stack);
for (i = 0; i < sk_EVP_SKEYMGMT_num(km_stack); i++) {
EVP_SKEYMGMT *k = sk_EVP_SKEYMGMT_value(km_stack, i);
STACK_OF(OPENSSL_CSTRING) *names = NULL;
if (select_name != NULL && !EVP_SKEYMGMT_is_a(k, select_name))
continue;
names = sk_OPENSSL_CSTRING_new(name_cmp);
if (names != NULL && EVP_SKEYMGMT_names_do_all(k, collect_names, names)) {
const char *desc = EVP_SKEYMGMT_get0_description(k);
BIO_printf(bio_out, " Name: ");
if (desc != NULL)
BIO_printf(bio_out, "%s", desc);
else
BIO_printf(bio_out, "%s", sk_OPENSSL_CSTRING_value(names, 0));
BIO_printf(bio_out, "\n");
BIO_printf(bio_out, " Type: Provider Algorithm\n");
BIO_printf(bio_out, " IDs: ");
print_names(bio_out, names);
BIO_printf(bio_out, " @ %s\n",
OSSL_PROVIDER_get0_name(EVP_SKEYMGMT_get0_provider(k)));
}
sk_OPENSSL_CSTRING_free(names);
}
sk_EVP_SKEYMGMT_pop_free(km_stack, EVP_SKEYMGMT_free);
}
DEFINE_STACK_OF(EVP_SIGNATURE)
static int signature_cmp(const EVP_SIGNATURE * const *a,
const EVP_SIGNATURE * const *b)
@ -700,8 +768,9 @@ static void collect_signatures(EVP_SIGNATURE *sig, void *stack)
STACK_OF(EVP_SIGNATURE) *sig_stack = stack;
if (is_signature_fetchable(sig)
&& sk_EVP_SIGNATURE_push(sig_stack, sig) > 0)
EVP_SIGNATURE_up_ref(sig);
&& EVP_SIGNATURE_up_ref(sig)
&& sk_EVP_SIGNATURE_push(sig_stack, sig) <= 0)
EVP_SIGNATURE_free(sig); /* up-ref successful but push to stack failed */
}
static void list_signatures(void)
@ -747,6 +816,90 @@ static void list_signatures(void)
BIO_printf(bio_out, " -\n");
}
static int list_provider_tls_sigalgs(const OSSL_PARAM params[], void *data)
{
const OSSL_PARAM *p;
/* Get registered IANA name */
p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_IANA_NAME);
if (p != NULL && p->data_type == OSSL_PARAM_UTF8_STRING) {
if (*((int *)data) > 0)
BIO_printf(bio_out, ":");
BIO_printf(bio_out, "%s", (char *)(p->data));
/* mark presence of a provider-based sigalg */
*((int *)data) = 2;
}
/* As built-in providers don't have this capability, never error */
return 1;
}
static int list_tls_sigalg_caps(OSSL_PROVIDER *provider, void *cbdata)
{
OSSL_PROVIDER_get_capabilities(provider, "TLS-SIGALG",
list_provider_tls_sigalgs,
cbdata);
/* As built-in providers don't have this capability, never error */
return 1;
}
#if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
static void list_tls_groups(int version, int all)
{
SSL_CTX *ctx = NULL;
STACK_OF(OPENSSL_CSTRING) *groups;
size_t i, num;
if ((groups = sk_OPENSSL_CSTRING_new_null()) == NULL) {
BIO_printf(bio_err, "ERROR: Memory allocation\n");
return;
}
if ((ctx = SSL_CTX_new(TLS_method())) == NULL) {
BIO_printf(bio_err, "ERROR: Memory allocation\n");
goto err;
}
if (!SSL_CTX_set_min_proto_version(ctx, version)
|| !SSL_CTX_set_max_proto_version(ctx, version)) {
BIO_printf(bio_err, "ERROR: setting TLS protocol version\n");
goto err;
}
if (!SSL_CTX_get0_implemented_groups(ctx, all, groups)) {
BIO_printf(bio_err, "ERROR: getting implemented TLS group list\n");
goto err;
}
num = sk_OPENSSL_CSTRING_num(groups);
for (i = 0; i < num; ++i) {
BIO_printf(bio_out, "%s%c", sk_OPENSSL_CSTRING_value(groups, i),
(i < num - 1) ? ':' : '\n');
}
err:
SSL_CTX_free(ctx);
sk_OPENSSL_CSTRING_free(groups);
return;
}
#endif
static void list_tls_signatures(void)
{
int tls_sigalg_listed = 0;
char *builtin_sigalgs = SSL_get1_builtin_sigalgs(app_get0_libctx());
if (builtin_sigalgs != NULL) {
if (builtin_sigalgs[0] != 0) {
BIO_printf(bio_out, "%s", builtin_sigalgs);
tls_sigalg_listed = 1;
}
OPENSSL_free(builtin_sigalgs);
}
if (!OSSL_PROVIDER_do_all(NULL, list_tls_sigalg_caps, &tls_sigalg_listed))
BIO_printf(bio_err,
"ERROR: could not list all provider signature algorithms\n");
if (tls_sigalg_listed < 2)
BIO_printf(bio_out,
"\nNo TLS sig algs registered by currently active providers");
BIO_printf(bio_out, "\n");
}
DEFINE_STACK_OF(EVP_KEM)
static int kem_cmp(const EVP_KEM * const *a,
const EVP_KEM * const *b)
@ -760,8 +913,9 @@ static void collect_kem(EVP_KEM *kem, void *stack)
STACK_OF(EVP_KEM) *kem_stack = stack;
if (is_kem_fetchable(kem)
&& sk_EVP_KEM_push(kem_stack, kem) > 0)
EVP_KEM_up_ref(kem);
&& EVP_KEM_up_ref(kem)
&& sk_EVP_KEM_push(kem_stack, kem) <= 0)
EVP_KEM_free(kem); /* up-ref successful but push to stack failed */
}
static void list_kems(void)
@ -819,8 +973,9 @@ static void collect_asymciph(EVP_ASYM_CIPHER *asym_cipher, void *stack)
STACK_OF(EVP_ASYM_CIPHER) *asym_cipher_stack = stack;
if (is_asym_cipher_fetchable(asym_cipher)
&& sk_EVP_ASYM_CIPHER_push(asym_cipher_stack, asym_cipher) > 0)
EVP_ASYM_CIPHER_up_ref(asym_cipher);
&& EVP_ASYM_CIPHER_up_ref(asym_cipher)
&& sk_EVP_ASYM_CIPHER_push(asym_cipher_stack, asym_cipher) <= 0)
EVP_ASYM_CIPHER_free(asym_cipher); /* up-ref successful but push to stack failed */
}
static void list_asymciphers(void)
@ -881,8 +1036,9 @@ static void collect_kex(EVP_KEYEXCH *kex, void *stack)
STACK_OF(EVP_KEYEXCH) *kex_stack = stack;
if (is_keyexch_fetchable(kex)
&& sk_EVP_KEYEXCH_push(kex_stack, kex) > 0)
EVP_KEYEXCH_up_ref(kex);
&& EVP_KEYEXCH_up_ref(kex)
&& sk_EVP_KEYEXCH_push(kex_stack, kex) <= 0)
EVP_KEYEXCH_free(kex); /* up-ref successful but push to stack failed */
}
static void list_keyexchanges(void)
@ -1161,8 +1317,9 @@ static void collect_store_loaders(OSSL_STORE_LOADER *store, void *stack)
{
STACK_OF(OSSL_STORE_LOADER) *store_stack = stack;
if (sk_OSSL_STORE_LOADER_push(store_stack, store) > 0)
OSSL_STORE_LOADER_up_ref(store);
if (OSSL_STORE_LOADER_up_ref(store)
&& sk_OSSL_STORE_LOADER_push(store_stack, store) <= 0)
OSSL_STORE_LOADER_free(store); /* up-ref successful but push to stack failed */
}
static void list_store_loaders(void)
@ -1209,6 +1366,7 @@ static int provider_cmp(const OSSL_PROVIDER * const *a,
static int collect_providers(OSSL_PROVIDER *provider, void *stack)
{
STACK_OF(OSSL_PROVIDER) *provider_stack = stack;
/*
* If OK - result is the index of inserted data
* Error - result is -1 or 0
@ -1230,6 +1388,7 @@ static void list_provider_info(void)
}
if (OSSL_PROVIDER_do_all(NULL, &collect_providers, providers) != 1) {
sk_OSSL_PROVIDER_free(providers);
BIO_printf(bio_err, "ERROR: Memory allocation\n");
return;
}
@ -1458,11 +1617,22 @@ typedef enum HELPLIST_CHOICE {
OPT_PK_ALGORITHMS, OPT_PK_METHOD, OPT_DISABLED,
OPT_KDF_ALGORITHMS, OPT_RANDOM_INSTANCES, OPT_RANDOM_GENERATORS,
OPT_ENCODERS, OPT_DECODERS, OPT_KEYMANAGERS, OPT_KEYEXCHANGE_ALGORITHMS,
OPT_KEM_ALGORITHMS, OPT_SIGNATURE_ALGORITHMS, OPT_ASYM_CIPHER_ALGORITHMS,
OPT_STORE_LOADERS, OPT_PROVIDER_INFO,
OPT_OBJECTS, OPT_SELECT_NAME,
OPT_SKEYMANAGERS,
OPT_KEM_ALGORITHMS, OPT_SIGNATURE_ALGORITHMS,
OPT_TLS_SIGNATURE_ALGORITHMS, OPT_ASYM_CIPHER_ALGORITHMS,
OPT_STORE_LOADERS, OPT_PROVIDER_INFO, OPT_OBJECTS,
OPT_SELECT_NAME,
#if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
OPT_ALL_TLS_GROUPS, OPT_TLS_GROUPS,
# if !defined(OPENSSL_NO_TLS1_2)
OPT_TLS1_2,
# endif
# if !defined(OPENSSL_NO_TLS1_3)
OPT_TLS1_3,
# endif
#endif
#ifndef OPENSSL_NO_DEPRECATED_3_0
OPT_ENGINES,
OPT_ENGINES,
#endif
OPT_PROV_ENUM
} HELPLIST_CHOICE;
@ -1494,20 +1664,23 @@ const OPTIONS list_options[] = {
{"mac-algorithms", OPT_MAC_ALGORITHMS, '-',
"List of message authentication code algorithms"},
#ifndef OPENSSL_NO_DEPRECATED_3_0
{"cipher-commands", OPT_CIPHER_COMMANDS, '-',
"List of cipher commands (deprecated)"},
{"cipher-commands", OPT_CIPHER_COMMANDS, '-',
"List of cipher commands (deprecated)"},
#endif
{"cipher-algorithms", OPT_CIPHER_ALGORITHMS, '-',
"List of symmetric cipher algorithms"},
{"encoders", OPT_ENCODERS, '-', "List of encoding methods" },
{"decoders", OPT_DECODERS, '-', "List of decoding methods" },
{"key-managers", OPT_KEYMANAGERS, '-', "List of key managers" },
{"skey-managers", OPT_SKEYMANAGERS, '-', "List of symmetric key managers" },
{"key-exchange-algorithms", OPT_KEYEXCHANGE_ALGORITHMS, '-',
"List of key exchange algorithms" },
{"kem-algorithms", OPT_KEM_ALGORITHMS, '-',
"List of key encapsulation mechanism algorithms" },
{"signature-algorithms", OPT_SIGNATURE_ALGORITHMS, '-',
"List of signature algorithms" },
{"tls-signature-algorithms", OPT_TLS_SIGNATURE_ALGORITHMS, '-',
"List of TLS signature algorithms" },
{"asymcipher-algorithms", OPT_ASYM_CIPHER_ALGORITHMS, '-',
"List of asymmetric cipher algorithms" },
{"public-key-algorithms", OPT_PK_ALGORITHMS, '-',
@ -1516,6 +1689,20 @@ const OPTIONS list_options[] = {
"List of public key methods"},
{"store-loaders", OPT_STORE_LOADERS, '-',
"List of store loaders"},
#if !defined(OPENSSL_NO_TLS1_2) || !defined(OPENSSL_NO_TLS1_3)
{"tls-groups", OPT_TLS_GROUPS, '-',
"List implemented TLS key exchange 'groups'" },
{"all-tls-groups", OPT_ALL_TLS_GROUPS, '-',
"List implemented TLS key exchange 'groups' and all aliases" },
# ifndef OPENSSL_NO_TLS1_2
{"tls1_2", OPT_TLS1_2, '-',
"When listing 'groups', list those compatible with TLS1.2"},
# endif
# ifndef OPENSSL_NO_TLS1_3
{"tls1_3", OPT_TLS1_3, '-',
"When listing 'groups', list those compatible with TLS1.3"},
# endif
#endif
{"providers", OPT_PROVIDER_INFO, '-',
"List of provider information"},
#ifndef OPENSSL_NO_DEPRECATED_3_0
@ -1538,6 +1725,14 @@ int list_main(int argc, char **argv)
HELPLIST_CHOICE o;
int one = 0, done = 0;
int print_newline = 0;
#if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
int all_tls_groups = 0;
# if !defined(OPENSSL_NO_TLS1_3)
unsigned int tls_version = TLS1_3_VERSION;
# else
unsigned int tls_version = TLS1_2_VERSION;
# endif
#endif
struct {
unsigned int commands:1;
unsigned int all_algorithms:1;
@ -1552,9 +1747,12 @@ int list_main(int argc, char **argv)
unsigned int encoder_algorithms:1;
unsigned int decoder_algorithms:1;
unsigned int keymanager_algorithms:1;
unsigned int skeymanager_algorithms:1;
unsigned int signature_algorithms:1;
unsigned int tls_signature_algorithms:1;
unsigned int keyexchange_algorithms:1;
unsigned int kem_algorithms:1;
unsigned int tls_groups:1;
unsigned int asym_cipher_algorithms:1;
unsigned int pk_algorithms:1;
unsigned int pk_method:1;
@ -1623,15 +1821,40 @@ opthelp:
case OPT_KEYMANAGERS:
todo.keymanager_algorithms = 1;
break;
case OPT_SKEYMANAGERS:
todo.skeymanager_algorithms = 1;
break;
case OPT_SIGNATURE_ALGORITHMS:
todo.signature_algorithms = 1;
break;
case OPT_TLS_SIGNATURE_ALGORITHMS:
todo.tls_signature_algorithms = 1;
break;
case OPT_KEYEXCHANGE_ALGORITHMS:
todo.keyexchange_algorithms = 1;
break;
case OPT_KEM_ALGORITHMS:
todo.kem_algorithms = 1;
break;
#if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
case OPT_TLS_GROUPS:
todo.tls_groups = 1;
break;
case OPT_ALL_TLS_GROUPS:
all_tls_groups = 1;
todo.tls_groups = 1;
break;
# if !defined(OPENSSL_NO_TLS1_2)
case OPT_TLS1_2:
tls_version = TLS1_2_VERSION;
break;
# endif
# if !defined(OPENSSL_NO_TLS1_3)
case OPT_TLS1_3:
tls_version = TLS1_3_VERSION;
break;
# endif
#endif
case OPT_ASYM_CIPHER_ALGORITHMS:
todo.asym_cipher_algorithms = 1;
break;
@ -1685,7 +1908,7 @@ opthelp:
BIO_printf(bio_out, "\n"); \
} \
cmd; \
} while(0)
} while (0)
if (todo.commands)
MAYBE_ADD_NL(list_type(FT_general, one));
@ -1741,14 +1964,22 @@ opthelp:
MAYBE_ADD_NL(list_decoders());
if (todo.keymanager_algorithms)
MAYBE_ADD_NL(list_keymanagers());
if (todo.skeymanager_algorithms)
MAYBE_ADD_NL(list_skeymanagers());
if (todo.signature_algorithms)
MAYBE_ADD_NL(list_signatures());
if (todo.tls_signature_algorithms)
MAYBE_ADD_NL(list_tls_signatures());
if (todo.asym_cipher_algorithms)
MAYBE_ADD_NL(list_asymciphers());
if (todo.keyexchange_algorithms)
MAYBE_ADD_NL(list_keyexchanges());
if (todo.kem_algorithms)
MAYBE_ADD_NL(list_kems());
#if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
if (todo.tls_groups)
MAYBE_ADD_NL(list_tls_groups(tls_version, all_tls_groups));
#endif
if (todo.pk_algorithms)
MAYBE_ADD_NL(list_pkey());
if (todo.pk_method)

20
apps/ocsp.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -33,12 +33,6 @@
#include <openssl/bn.h>
#include <openssl/x509v3.h>
#if defined(__TANDEM)
# if defined(OPENSSL_TANDEM_FLOSS)
# include <floss.h(floss_fork)>
# endif
#endif
#if defined(OPENSSL_SYS_VXWORKS)
/* not supported */
int setpgid(pid_t pid, pid_t pgid)
@ -559,10 +553,6 @@ int ocsp_main(int argc, char **argv)
&& respin == NULL && !(port != NULL && ridx_filename != NULL))
goto opthelp;
out = bio_open_default(outfile, 'w', FORMAT_TEXT);
if (out == NULL)
goto end;
if (req == NULL && (add_nonce != 2))
add_nonce = 0;
@ -715,6 +705,10 @@ redo_accept:
}
}
out = bio_open_default(outfile, 'w', FORMAT_TEXT);
if (out == NULL)
goto end;
if (req_text && req != NULL)
OCSP_REQUEST_print(out, req, 0);
@ -1055,6 +1049,10 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
}
bs = OCSP_BASICRESP_new();
if (bs == NULL) {
*resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, bs);
goto end;
}
thisupd = X509_gmtime_adj(NULL, 0);
if (ndays != -1)
nextupd = X509_time_adj_ex(NULL, ndays, nmin * 60, NULL);

4
apps/openssl-vms.cnf
View file

@ -342,8 +342,8 @@ path = pkix/
# Server authentication
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
ignore_keyusage = 1 # potentially needed quirk
unprotected_errors = 1 # potentially needed quirk
ignore_keyusage = 1 # quirk needed to accept Insta CA cert not including digitalsignature
unprotected_errors = 1 # quirk needed to accept negative responses possibly not protected
extracertsout = insta.extracerts.pem
# Client authentication

2
apps/openssl.c
View file

@ -7,6 +7,8 @@
* https://www.openssl.org/source/license.html
*/
#include "internal/e_os.h"
#include <stdio.h>
#include <stdlib.h>
#include "internal/common.h"

4
apps/openssl.cnf
View file

@ -342,8 +342,8 @@ path = pkix/
# Server authentication
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
ignore_keyusage = 1 # potentially needed quirk
unprotected_errors = 1 # potentially needed quirk
ignore_keyusage = 1 # quirk needed to accept Insta CA cert not including digitalsignature
unprotected_errors = 1 # quirk needed to accept negative responses possibly not protected
extracertsout = insta.extracerts.pem
# Client authentication

19
apps/passwd.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -369,8 +369,7 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
if (magic_len > 0)
salt_out += 2 + magic_len;
if (salt_len > 8)
goto err;
assert(salt_len <= 8);
md = EVP_MD_CTX_new();
if (md == NULL
@ -589,7 +588,8 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
OPENSSL_strlcat(out_buf, ascii_dollar, sizeof(out_buf));
if (rounds_custom) {
char tmp_buf[80]; /* "rounds=999999999" */
sprintf(tmp_buf, "rounds=%u", rounds);
BIO_snprintf(tmp_buf, sizeof(tmp_buf), "rounds=%u", rounds);
#ifdef CHARSET_EBCDIC
/* In case we're really on a ASCII based platform and just pretend */
if (tmp_buf[0] != 0x72) /* ASCII 'r' */
@ -706,15 +706,14 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
cp = out_buf + strlen(out_buf);
*cp++ = ascii_dollar[0];
# define b64_from_24bit(B2, B1, B0, N) \
# define b64_from_24bit(B2, B1, B0, N) \
do { \
unsigned int w = ((B2) << 16) | ((B1) << 8) | (B0); \
int i = (N); \
while (i-- > 0) \
{ \
*cp++ = cov_2char[w & 0x3f]; \
w >>= 6; \
} \
while (i-- > 0) { \
*cp++ = cov_2char[w & 0x3f]; \
w >>= 6; \
} \
} while (0)
switch (magic[0]) {

125
apps/pkcs12.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1999-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -70,7 +70,7 @@ typedef enum OPTION_choice {
OPT_NAME, OPT_CSP, OPT_CANAME,
OPT_IN, OPT_OUT, OPT_PASSIN, OPT_PASSOUT, OPT_PASSWORD, OPT_CAPATH,
OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_ENGINE,
OPT_R_ENUM, OPT_PROV_ENUM, OPT_JDKTRUST,
OPT_R_ENUM, OPT_PROV_ENUM, OPT_JDKTRUST, OPT_PBMAC1_PBKDF2, OPT_PBMAC1_PBKDF2_MD,
#ifndef OPENSSL_NO_DES
OPT_LEGACY_ALG
#endif
@ -147,6 +147,8 @@ const OPTIONS pkcs12_options[] = {
#endif
{"macalg", OPT_MACALG, 's',
"Digest algorithm to use in MAC (default SHA256)"},
{"pbmac1_pbkdf2", OPT_PBMAC1_PBKDF2, '-', "Use PBMAC1 with PBKDF2 instead of MAC"},
{"pbmac1_pbkdf2_md", OPT_PBMAC1_PBKDF2_MD, 's', "Digest to use for PBMAC1 KDF (default SHA256)"},
{"iter", OPT_ITER, 'p', "Specify the iteration count for encryption and MAC"},
{"noiter", OPT_NOITER, '-', "Don't use encryption iteration"},
{"nomaciter", OPT_NOMACITER, '-', "Don't use MAC iteration)"},
@ -170,14 +172,14 @@ int pkcs12_main(int argc, char **argv)
int use_legacy = 0;
#endif
/* use library defaults for the iter, maciter, cert, and key PBE */
int iter = 0, maciter = 0;
int iter = 0, maciter = 0, pbmac1_pbkdf2 = 0;
int macsaltlen = PKCS12_SALT_LEN;
int cert_pbe = NID_undef;
int key_pbe = NID_undef;
int ret = 1, macver = 1, add_lmk = 0, private = 0;
int noprompt = 0;
char *passinarg = NULL, *passoutarg = NULL, *passarg = NULL;
char *passin = NULL, *passout = NULL, *macalg = NULL;
char *passin = NULL, *passout = NULL, *macalg = NULL, *pbmac1_pbkdf2_md = NULL;
char *cpass = NULL, *mpass = NULL, *badpass = NULL;
const char *CApath = NULL, *CAfile = NULL, *CAstore = NULL, *prog;
int noCApath = 0, noCAfile = 0, noCAstore = 0;
@ -283,6 +285,12 @@ int pkcs12_main(int argc, char **argv)
case OPT_MACALG:
macalg = opt_arg();
break;
case OPT_PBMAC1_PBKDF2:
pbmac1_pbkdf2 = 1;
break;
case OPT_PBMAC1_PBKDF2_MD:
pbmac1_pbkdf2_md = opt_arg();
break;
case OPT_CERTPBE:
if (!set_pbe(&cert_pbe, opt_arg()))
goto opthelp;
@ -320,7 +328,8 @@ int pkcs12_main(int argc, char **argv)
if (canames == NULL
&& (canames = sk_OPENSSL_STRING_new_null()) == NULL)
goto end;
sk_OPENSSL_STRING_push(canames, opt_arg());
if (sk_OPENSSL_STRING_push(canames, opt_arg()) <= 0)
goto end;
break;
case OPT_IN:
infile = opt_arg();
@ -700,10 +709,20 @@ int pkcs12_main(int argc, char **argv)
}
if (maciter != -1) {
if (!PKCS12_set_mac(p12, mpass, -1, NULL, macsaltlen, maciter, macmd)) {
BIO_printf(bio_err, "Error creating PKCS12 MAC; no PKCS12KDF support?\n");
BIO_printf(bio_err, "Use -nomac if MAC not required and PKCS12KDF support not available.\n");
goto export_end;
if (pbmac1_pbkdf2 == 1) {
if (!PKCS12_set_pbmac1_pbkdf2(p12, mpass, -1, NULL,
macsaltlen, maciter,
macmd, pbmac1_pbkdf2_md)) {
BIO_printf(bio_err, "Error creating PBMAC1\n");
goto export_end;
}
} else {
if (!PKCS12_set_mac(p12, mpass, -1, NULL, macsaltlen, maciter, macmd)) {
BIO_printf(bio_err, "Error creating PKCS12 MAC; no PKCS12KDF support?\n");
BIO_printf(bio_err,
"Use -nomac or -pbmac1_pbkdf2 if PKCS12KDF support not available\n");
goto export_end;
}
}
}
assert(private);
@ -732,9 +751,6 @@ int pkcs12_main(int argc, char **argv)
in = bio_open_default(infile, 'r', FORMAT_PKCS12);
if (in == NULL)
goto end;
out = bio_open_owner(outfile, FORMAT_PEM, private);
if (out == NULL)
goto end;
p12 = PKCS12_init_ex(NID_pkcs7_data, app_get0_libctx(), app_get0_propq());
if (p12 == NULL) {
@ -777,23 +793,64 @@ int pkcs12_main(int argc, char **argv)
X509_ALGOR_get0(&macobj, NULL, NULL, macalgid);
BIO_puts(bio_err, "MAC: ");
i2a_ASN1_OBJECT(bio_err, macobj);
BIO_printf(bio_err, ", Iteration %ld\n",
tmaciter != NULL ? ASN1_INTEGER_get(tmaciter) : 1L);
BIO_printf(bio_err, "MAC length: %ld, salt length: %ld\n",
tmac != NULL ? ASN1_STRING_length(tmac) : 0L,
tsalt != NULL ? ASN1_STRING_length(tsalt) : 0L);
}
if (macver) {
EVP_KDF *pkcs12kdf;
if (OBJ_obj2nid(macobj) == NID_pbmac1) {
PBKDF2PARAM *pbkdf2_param = PBMAC1_get1_pbkdf2_param(macalgid);
pkcs12kdf = EVP_KDF_fetch(app_get0_libctx(), "PKCS12KDF",
app_get0_propq());
if (pkcs12kdf == NULL) {
BIO_printf(bio_err, "Error verifying PKCS12 MAC; no PKCS12KDF support.\n");
BIO_printf(bio_err, "Use -nomacver if MAC verification is not required.\n");
goto end;
if (pbkdf2_param == NULL) {
BIO_printf(bio_err, ", Unsupported KDF or params for PBMAC1\n");
} else {
const ASN1_OBJECT *prfobj;
int prfnid;
BIO_printf(bio_err, " using PBKDF2, Iteration %ld\n",
ASN1_INTEGER_get(pbkdf2_param->iter));
BIO_printf(bio_err, "Key length: %ld, Salt length: %d\n",
ASN1_INTEGER_get(pbkdf2_param->keylength),
ASN1_STRING_length(pbkdf2_param->salt->value.octet_string));
if (pbkdf2_param->prf == NULL) {
prfnid = NID_hmacWithSHA1;
} else {
X509_ALGOR_get0(&prfobj, NULL, NULL, pbkdf2_param->prf);
prfnid = OBJ_obj2nid(prfobj);
}
BIO_printf(bio_err, "PBKDF2 PRF: %s\n", OBJ_nid2sn(prfnid));
}
PBKDF2PARAM_free(pbkdf2_param);
} else {
BIO_printf(bio_err, ", Iteration %ld\n",
tmaciter != NULL ? ASN1_INTEGER_get(tmaciter) : 1L);
BIO_printf(bio_err, "MAC length: %ld, salt length: %ld\n",
tmac != NULL ? ASN1_STRING_length(tmac) : 0L,
tsalt != NULL ? ASN1_STRING_length(tsalt) : 0L);
}
EVP_KDF_free(pkcs12kdf);
}
if (macver) {
const X509_ALGOR *macalgid;
const ASN1_OBJECT *macobj;
PKCS12_get0_mac(NULL, &macalgid, NULL, NULL, p12);
if (macalgid == NULL) {
BIO_printf(bio_err, "Warning: MAC is absent!\n");
goto dump;
}
X509_ALGOR_get0(&macobj, NULL, NULL, macalgid);
if (OBJ_obj2nid(macobj) != NID_pbmac1) {
EVP_KDF *pkcs12kdf;
pkcs12kdf = EVP_KDF_fetch(app_get0_libctx(), "PKCS12KDF",
app_get0_propq());
if (pkcs12kdf == NULL) {
BIO_printf(bio_err, "Error verifying PKCS12 MAC; no PKCS12KDF support.\n");
BIO_printf(bio_err, "Use -nomacver if MAC verification is not required.\n");
goto end;
}
EVP_KDF_free(pkcs12kdf);
}
/* If we enter empty password try no password first */
if (!mpass[0] && PKCS12_verify_mac(p12, NULL, 0)) {
/* If mac and crypto pass the same set it to NULL too */
@ -834,6 +891,11 @@ int pkcs12_main(int argc, char **argv)
dump:
assert(private);
out = bio_open_owner(outfile, FORMAT_PEM, private);
if (out == NULL)
goto end;
if (!dump_certs_keys_p12(out, p12, cpass, -1, options, passout, enc)) {
BIO_printf(bio_err, "Error outputting keys and certificates\n");
ERR_print_errors(bio_err);
@ -901,7 +963,11 @@ int dump_certs_keys_p12(BIO *out, const PKCS12 *p12, const char *pass,
} else if (bagnid == NID_pkcs7_encrypted) {
if (options & INFO) {
BIO_printf(bio_err, "PKCS7 Encrypted data: ");
alg_print(p7->d.encrypted->enc_data->algorithm);
if (p7->d.encrypted == NULL) {
BIO_printf(bio_err, "<no data>\n");
} else {
alg_print(p7->d.encrypted->enc_data->algorithm);
}
}
bags = PKCS12_unpack_p7encdata(p7, pass, passlen);
} else {
@ -1251,8 +1317,7 @@ int print_attribs(BIO *out, const STACK_OF(X509_ATTRIBUTE) *attrlst,
}
if (X509_ATTRIBUTE_count(attr)) {
for (j = 0; j < X509_ATTRIBUTE_count(attr); j++)
{
for (j = 0; j < X509_ATTRIBUTE_count(attr); j++) {
av = X509_ATTRIBUTE_get0_type(attr, j);
print_attribute(out, av);
}

8
apps/pkcs8.c
View file

@ -227,9 +227,6 @@ int pkcs8_main(int argc, char **argv)
informat == FORMAT_UNDEF ? FORMAT_PEM : informat);
if (in == NULL)
goto end;
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (topk8) {
pkey = load_key(infile, informat, 1, passin, e, "key");
@ -240,6 +237,8 @@ int pkcs8_main(int argc, char **argv)
ERR_print_errors(bio_err);
goto end;
}
if ((out = bio_open_owner(outfile, outformat, private)) == NULL)
goto end;
if (nocrypt) {
assert(private);
if (outformat == FORMAT_PEM) {
@ -361,6 +360,9 @@ int pkcs8_main(int argc, char **argv)
}
assert(private);
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (outformat == FORMAT_PEM) {
if (traditional)
PEM_write_bio_PrivateKey_traditional(out, pkey, NULL, NULL, 0,

8
apps/pkey.c
View file

@ -208,10 +208,6 @@ int pkey_main(int argc, char **argv)
goto end;
}
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
if (pubin)
pkey = load_pubkey(infile, informat, 1, passin, e, "Public Key");
else
@ -219,6 +215,10 @@ int pkey_main(int argc, char **argv)
if (pkey == NULL)
goto end;
out = bio_open_owner(outfile, outformat, private);
if (out == NULL)
goto end;
#ifndef OPENSSL_NO_EC
if (asn1_encoding != NULL || point_format != NULL) {
OSSL_PARAM params[3], *p = params;

6
apps/pkeyparam.c
View file

@ -97,9 +97,6 @@ int pkeyparam_main(int argc, char **argv)
in = bio_open_default(infile, 'r', FORMAT_PEM);
if (in == NULL)
goto end;
out = bio_open_default(outfile, 'w', FORMAT_PEM);
if (out == NULL)
goto end;
pkey = PEM_read_bio_Parameters_ex(in, NULL, app_get0_libctx(),
app_get0_propq());
if (pkey == NULL) {
@ -107,6 +104,9 @@ int pkeyparam_main(int argc, char **argv)
ERR_print_errors(bio_err);
goto end;
}
out = bio_open_default(outfile, 'w', FORMAT_PEM);
if (out == NULL)
goto end;
if (check) {
if (e == NULL)

285
apps/pkeyutl.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -20,25 +20,40 @@
#define KEY_PUBKEY 2
#define KEY_CERT 3
static EVP_PKEY *get_pkey(const char *kdfalg,
const char *keyfile, int keyform, int key_type,
char *passinarg, int pkey_op, ENGINE *e);
static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
const char *keyfile, int keyform, int key_type,
char *passinarg, int pkey_op, ENGINE *e,
const int impl, int rawin, EVP_PKEY **ppkey,
int pkey_op, ENGINE *e,
const int engine_impl, int rawin,
EVP_PKEY *pkey /* ownership is passed to ctx */,
EVP_MD_CTX *mctx, const char *digestname,
OSSL_LIB_CTX *libctx, const char *propq);
const char *kemop, OSSL_LIB_CTX *libctx, const char *propq);
static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
ENGINE *e);
static int do_keyop(EVP_PKEY_CTX *ctx, int pkey_op,
unsigned char *out, size_t *poutlen,
const unsigned char *in, size_t inlen);
const unsigned char *in, size_t inlen,
unsigned char *secret, size_t *psecretlen);
static int do_raw_keyop(int pkey_op, EVP_MD_CTX *mctx,
EVP_PKEY *pkey, BIO *in,
int filesize, unsigned char *sig, int siglen,
unsigned char **out, size_t *poutlen);
static int only_nomd(EVP_PKEY *pkey)
{
#define MADE_UP_MAX_MD_NAME_LEN 100
char defname[MADE_UP_MAX_MD_NAME_LEN];
int deftype;
deftype = EVP_PKEY_get_default_digest_name(pkey, defname, sizeof(defname));
return deftype == 2 /* Mandatory */
&& strcmp(defname, "UNDEF") == 0;
}
typedef enum OPTION_choice {
OPT_COMMON,
OPT_ENGINE, OPT_ENGINE_IMPL, OPT_IN, OPT_OUT,
@ -47,6 +62,7 @@ typedef enum OPTION_choice {
OPT_DERIVE, OPT_SIGFILE, OPT_INKEY, OPT_PEERKEY, OPT_PASSIN,
OPT_PEERFORM, OPT_KEYFORM, OPT_PKEYOPT, OPT_PKEYOPT_PASSIN, OPT_KDF,
OPT_KDFLEN, OPT_R_ENUM, OPT_PROV_ENUM,
OPT_DECAP, OPT_ENCAP, OPT_SECOUT, OPT_KEMOP,
OPT_CONFIG,
OPT_RAWIN, OPT_DIGEST
} OPTION_CHOICE;
@ -63,12 +79,13 @@ const OPTIONS pkeyutl_options[] = {
{"verify", OPT_VERIFY, '-', "Verify with public key"},
{"encrypt", OPT_ENCRYPT, '-', "Encrypt input data with public key"},
{"decrypt", OPT_DECRYPT, '-', "Decrypt input data with private key"},
{"derive", OPT_DERIVE, '-', "Derive shared secret"},
{"derive", OPT_DERIVE, '-', "Derive shared secret from own and peer (EC)DH keys"},
{"decap", OPT_DECAP, '-', "Decapsulate shared secret"},
{"encap", OPT_ENCAP, '-', "Encapsulate shared secret"},
OPT_CONFIG_OPTION,
OPT_SECTION("Input"),
{"in", OPT_IN, '<', "Input file - default stdin"},
{"rawin", OPT_RAWIN, '-', "Indicate the input data is in raw form"},
{"inkey", OPT_INKEY, 's', "Input key, by default private key"},
{"pubin", OPT_PUBIN, '-', "Input key is a public key"},
{"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
@ -81,19 +98,24 @@ const OPTIONS pkeyutl_options[] = {
OPT_SECTION("Output"),
{"out", OPT_OUT, '>', "Output file - default stdout"},
{"asn1parse", OPT_ASN1PARSE, '-', "asn1parse the output data"},
{"secret", OPT_SECOUT, '>', "File to store secret on encapsulation"},
{"asn1parse", OPT_ASN1PARSE, '-',
"parse the output as ASN.1 data to check its DER encoding and print errors"},
{"hexdump", OPT_HEXDUMP, '-', "Hex dump output"},
{"verifyrecover", OPT_VERIFYRECOVER, '-',
"Verify with public key, recover original data"},
"Verify RSA signature, recovering original signature input data"},
OPT_SECTION("Signing/Derivation"),
OPT_SECTION("Signing/Derivation/Encapsulation"),
{"rawin", OPT_RAWIN, '-',
"Indicate that the signature/verification input data is not yet hashed"},
{"digest", OPT_DIGEST, 's',
"Specify the digest algorithm when signing the raw input data"},
"The digest algorithm to use for signing/verifying raw input data. Implies -rawin"},
{"pkeyopt", OPT_PKEYOPT, 's', "Public key options as opt:value"},
{"pkeyopt_passin", OPT_PKEYOPT_PASSIN, 's',
"Public key option that is read as a passphrase argument opt:passphrase"},
{"kdf", OPT_KDF, 's', "Use KDF algorithm"},
{"kdflen", OPT_KDFLEN, 'p', "KDF algorithm output length"},
{"kemop", OPT_KEMOP, 's', "KEM operation specific to the key algorithm"},
OPT_R_OPTIONS,
OPT_PROV_OPTIONS,
@ -103,23 +125,23 @@ const OPTIONS pkeyutl_options[] = {
int pkeyutl_main(int argc, char **argv)
{
CONF *conf = NULL;
BIO *in = NULL, *out = NULL;
BIO *in = NULL, *out = NULL, *secout = NULL;
ENGINE *e = NULL;
EVP_PKEY_CTX *ctx = NULL;
EVP_PKEY *pkey = NULL;
char *infile = NULL, *outfile = NULL, *sigfile = NULL, *passinarg = NULL;
char *infile = NULL, *outfile = NULL, *secoutfile = NULL, *sigfile = NULL, *passinarg = NULL;
char hexdump = 0, asn1parse = 0, rev = 0, *prog;
unsigned char *buf_in = NULL, *buf_out = NULL, *sig = NULL;
unsigned char *buf_in = NULL, *buf_out = NULL, *sig = NULL, *secret = NULL;
OPTION_CHOICE o;
int buf_inlen = 0, siglen = -1;
int keyform = FORMAT_UNDEF, peerform = FORMAT_UNDEF;
int keysize = -1, pkey_op = EVP_PKEY_OP_SIGN, key_type = KEY_PRIVKEY;
int engine_impl = 0;
int ret = 1, rv = -1;
size_t buf_outlen;
size_t buf_outlen = 0, secretlen = 0;
const char *inkey = NULL;
const char *peerkey = NULL;
const char *kdfalg = NULL, *digestname = NULL;
const char *kdfalg = NULL, *digestname = NULL, *kemop = NULL;
int kdflen = 0;
STACK_OF(OPENSSL_STRING) *pkeyopts = NULL;
STACK_OF(OPENSSL_STRING) *pkeyopts_passin = NULL;
@ -147,6 +169,9 @@ int pkeyutl_main(int argc, char **argv)
case OPT_OUT:
outfile = opt_arg();
break;
case OPT_SECOUT:
secoutfile = opt_arg();
break;
case OPT_SIGFILE:
sigfile = opt_arg();
break;
@ -216,6 +241,16 @@ int pkeyutl_main(int argc, char **argv)
case OPT_DERIVE:
pkey_op = EVP_PKEY_OP_DERIVE;
break;
case OPT_DECAP:
pkey_op = EVP_PKEY_OP_DECAPSULATE;
break;
case OPT_ENCAP:
key_type = KEY_PUBKEY;
pkey_op = EVP_PKEY_OP_ENCAPSULATE;
break;
case OPT_KEMOP:
kemop = opt_arg();
break;
case OPT_KDF:
pkey_op = EVP_PKEY_OP_DERIVE;
key_type = KEY_NONE;
@ -259,25 +294,8 @@ int pkeyutl_main(int argc, char **argv)
if (!app_RAND_load())
goto end;
if (rawin && pkey_op != EVP_PKEY_OP_SIGN && pkey_op != EVP_PKEY_OP_VERIFY) {
BIO_printf(bio_err,
"%s: -rawin can only be used with -sign or -verify\n",
prog);
goto opthelp;
}
if (digestname != NULL && !rawin) {
BIO_printf(bio_err,
"%s: -digest can only be used with -rawin\n",
prog);
goto opthelp;
}
if (rawin && rev) {
BIO_printf(bio_err, "%s: -rev cannot be used with raw input\n",
prog);
goto opthelp;
}
if (digestname != NULL)
rawin = 1;
if (kdfalg != NULL) {
if (kdflen == 0) {
@ -291,7 +309,41 @@ int pkeyutl_main(int argc, char **argv)
goto opthelp;
} else if (peerkey != NULL && pkey_op != EVP_PKEY_OP_DERIVE) {
BIO_printf(bio_err,
"%s: no peer key given (-peerkey parameter).\n", prog);
"%s: -peerkey option not allowed without -derive.\n", prog);
goto opthelp;
} else if (peerkey == NULL && pkey_op == EVP_PKEY_OP_DERIVE) {
BIO_printf(bio_err,
"%s: missing -peerkey option for -derive operation.\n", prog);
goto opthelp;
}
pkey = get_pkey(kdfalg, inkey, keyform, key_type, passinarg, pkey_op, e);
if (pkey_op == EVP_PKEY_OP_VERIFYRECOVER && !EVP_PKEY_is_a(pkey, "RSA")) {
BIO_printf(bio_err, "%s: -verifyrecover can be used only with RSA\n", prog);
goto end;
}
if (pkey_op == EVP_PKEY_OP_SIGN || pkey_op == EVP_PKEY_OP_VERIFY) {
if (only_nomd(pkey)) {
if (digestname != NULL) {
const char *alg = EVP_PKEY_get0_type_name(pkey);
BIO_printf(bio_err,
"%s: -digest (prehash) is not supported with %s\n",
prog, alg != NULL ? alg : "(unknown key type)");
goto end;
}
rawin = 1;
}
} else if (digestname != NULL || rawin) {
BIO_printf(bio_err,
"%s: -digest and -rawin can only be used with -sign or -verify\n", prog);
goto opthelp;
}
if (rawin && rev) {
BIO_printf(bio_err, "%s: -rev cannot be used with raw input\n", prog);
goto opthelp;
}
@ -301,9 +353,8 @@ int pkeyutl_main(int argc, char **argv)
goto end;
}
}
ctx = init_ctx(kdfalg, &keysize, inkey, keyform, key_type,
passinarg, pkey_op, e, engine_impl, rawin, &pkey,
mctx, digestname, libctx, app_get0_propq());
ctx = init_ctx(kdfalg, &keysize, pkey_op, e, engine_impl, rawin, pkey,
mctx, digestname, kemop, libctx, app_get0_propq());
if (ctx == NULL) {
BIO_printf(bio_err, "%s: Error initializing context\n", prog);
goto end;
@ -356,8 +407,10 @@ int pkeyutl_main(int argc, char **argv)
goto end;
}
} else {
/* Get password as a passin argument: First split option name
* and passphrase argument into two strings */
/*
* Get password as a passin argument: First split option name
* and passphrase argument into two strings
*/
*passin = 0;
passin++;
if (app_passwd(passin, NULL, &passwd, NULL) == 0) {
@ -387,7 +440,7 @@ int pkeyutl_main(int argc, char **argv)
goto end;
}
if (pkey_op != EVP_PKEY_OP_DERIVE) {
if (pkey_op != EVP_PKEY_OP_DERIVE && pkey_op != EVP_PKEY_OP_ENCAPSULATE) {
in = bio_open_default(infile, 'r', FORMAT_BINARY);
if (infile != NULL) {
struct stat st;
@ -398,9 +451,33 @@ int pkeyutl_main(int argc, char **argv)
if (in == NULL)
goto end;
}
out = bio_open_default(outfile, 'w', FORMAT_BINARY);
if (out == NULL)
goto end;
if (pkey_op == EVP_PKEY_OP_DECAPSULATE && outfile != NULL) {
if (secoutfile != NULL) {
BIO_printf(bio_err, "%s: Decapsulation produces only a shared "
"secret and no output. The '-out' option "
"is not applicable.\n", prog);
goto end;
}
if ((out = bio_open_owner(outfile, 'w', FORMAT_BINARY)) == NULL)
goto end;
} else {
out = bio_open_default(outfile, 'w', FORMAT_BINARY);
if (out == NULL)
goto end;
}
if (pkey_op == EVP_PKEY_OP_ENCAPSULATE
|| pkey_op == EVP_PKEY_OP_DECAPSULATE) {
if (secoutfile == NULL && pkey_op == EVP_PKEY_OP_ENCAPSULATE) {
BIO_printf(bio_err, "KEM-based shared-secret derivation requires "
"the '-secret <file>' option\n");
goto end;
}
/* For backwards compatibility, default decap secrets to the output */
if (secoutfile != NULL
&& (secout = bio_open_owner(secoutfile, 'w', FORMAT_BINARY)) == NULL)
goto end;
}
if (sigfile != NULL) {
BIO *sigbio = BIO_new_file(sigfile, "rb");
@ -429,6 +506,7 @@ int pkeyutl_main(int argc, char **argv)
size_t i;
unsigned char ctmp;
size_t l = (size_t)buf_inlen;
for (i = 0; i < l / 2; i++) {
ctmp = buf_in[i];
buf_in[i] = buf_in[l - 1 - i];
@ -439,12 +517,13 @@ int pkeyutl_main(int argc, char **argv)
/* Sanity check the input if the input is not raw */
if (!rawin
&& buf_inlen > EVP_MAX_MD_SIZE
&& (pkey_op == EVP_PKEY_OP_SIGN
|| pkey_op == EVP_PKEY_OP_VERIFY)) {
BIO_printf(bio_err,
"Error: The input data looks too long to be a hash\n");
goto end;
&& (pkey_op == EVP_PKEY_OP_SIGN || pkey_op == EVP_PKEY_OP_VERIFY)) {
if (buf_inlen > EVP_MAX_MD_SIZE) {
BIO_printf(bio_err,
"Error: The non-raw input data length %d is too long - max supported hashed size is %d\n",
buf_inlen, EVP_MAX_MD_SIZE);
goto end;
}
}
if (pkey_op == EVP_PKEY_OP_VERIFY) {
@ -473,13 +552,19 @@ int pkeyutl_main(int argc, char **argv)
rv = 1;
} else {
rv = do_keyop(ctx, pkey_op, NULL, (size_t *)&buf_outlen,
buf_in, (size_t)buf_inlen);
buf_in, (size_t)buf_inlen, NULL, (size_t *)&secretlen);
}
if (rv > 0 && buf_outlen != 0) {
buf_out = app_malloc(buf_outlen, "buffer output");
if (rv > 0
&& (secretlen > 0 || (pkey_op != EVP_PKEY_OP_ENCAPSULATE
&& pkey_op != EVP_PKEY_OP_DECAPSULATE))
&& (buf_outlen > 0 || pkey_op == EVP_PKEY_OP_DECAPSULATE)) {
if (buf_outlen > 0)
buf_out = app_malloc(buf_outlen, "buffer output");
if (secretlen > 0)
secret = app_malloc(secretlen, "secret output");
rv = do_keyop(ctx, pkey_op,
buf_out, (size_t *)&buf_outlen,
buf_in, (size_t)buf_inlen);
buf_in, (size_t)buf_inlen, secret, (size_t *)&secretlen);
}
}
if (rv <= 0) {
@ -500,48 +585,48 @@ int pkeyutl_main(int argc, char **argv)
} else {
BIO_write(out, buf_out, buf_outlen);
}
/* Backwards compatible decap output fallback */
if (secretlen > 0)
BIO_write(secout ? secout : out, secret, secretlen);
end:
if (ret != 0)
ERR_print_errors(bio_err);
EVP_MD_CTX_free(mctx);
EVP_PKEY_CTX_free(ctx);
EVP_PKEY_free(pkey);
EVP_MD_free(md);
release_engine(e);
BIO_free(in);
BIO_free_all(out);
BIO_free_all(secout);
OPENSSL_free(buf_in);
OPENSSL_free(buf_out);
OPENSSL_free(sig);
OPENSSL_free(secret);
sk_OPENSSL_STRING_free(pkeyopts);
sk_OPENSSL_STRING_free(pkeyopts_passin);
NCONF_free(conf);
return ret;
}
static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
const char *keyfile, int keyform, int key_type,
char *passinarg, int pkey_op, ENGINE *e,
const int engine_impl, int rawin,
EVP_PKEY **ppkey, EVP_MD_CTX *mctx, const char *digestname,
OSSL_LIB_CTX *libctx, const char *propq)
static EVP_PKEY *get_pkey(const char *kdfalg,
const char *keyfile, int keyform, int key_type,
char *passinarg, int pkey_op, ENGINE *e)
{
EVP_PKEY *pkey = NULL;
EVP_PKEY_CTX *ctx = NULL;
ENGINE *impl = NULL;
char *passin = NULL;
int rv = -1;
X509 *x;
if (((pkey_op == EVP_PKEY_OP_SIGN) || (pkey_op == EVP_PKEY_OP_DECRYPT)
|| (pkey_op == EVP_PKEY_OP_DERIVE))
&& (key_type != KEY_PRIVKEY && kdfalg == NULL)) {
BIO_printf(bio_err, "A private key is needed for this operation\n");
goto end;
return NULL;
}
if (!app_passwd(passinarg, NULL, &passin, NULL)) {
BIO_printf(bio_err, "Error getting password\n");
goto end;
return NULL;
}
switch (key_type) {
case KEY_PRIVKEY:
@ -564,6 +649,20 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
break;
}
OPENSSL_free(passin);
return pkey;
}
static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
int pkey_op, ENGINE *e,
const int engine_impl, int rawin,
EVP_PKEY *pkey /* ownership is passed to ctx */,
EVP_MD_CTX *mctx, const char *digestname,
const char *kemop, OSSL_LIB_CTX *libctx, const char *propq)
{
EVP_PKEY_CTX *ctx = NULL;
ENGINE *impl = NULL;
int rv = -1;
#ifndef OPENSSL_NO_ENGINE
if (engine_impl)
@ -578,7 +677,7 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
if (kdfnid == NID_undef) {
BIO_printf(bio_err, "The given KDF \"%s\" is unknown.\n",
kdfalg);
goto end;
return NULL;
}
}
if (impl != NULL)
@ -587,20 +686,17 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
ctx = EVP_PKEY_CTX_new_from_name(libctx, kdfalg, propq);
} else {
if (pkey == NULL)
goto end;
return NULL;
*pkeysize = EVP_PKEY_get_size(pkey);
if (impl != NULL)
ctx = EVP_PKEY_CTX_new(pkey, impl);
else
ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq);
if (ppkey != NULL)
*ppkey = pkey;
EVP_PKEY_free(pkey);
}
if (ctx == NULL)
goto end;
return NULL;
if (rawin) {
EVP_MD_CTX_set_pkey_ctx(mctx, ctx);
@ -642,6 +738,18 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
case EVP_PKEY_OP_DERIVE:
rv = EVP_PKEY_derive_init(ctx);
break;
case EVP_PKEY_OP_ENCAPSULATE:
rv = EVP_PKEY_encapsulate_init(ctx, NULL);
if (rv > 0 && kemop != NULL)
rv = EVP_PKEY_CTX_set_kem_op(ctx, kemop);
break;
case EVP_PKEY_OP_DECAPSULATE:
rv = EVP_PKEY_decapsulate_init(ctx, NULL);
if (rv > 0 && kemop != NULL)
rv = EVP_PKEY_CTX_set_kem_op(ctx, kemop);
break;
}
}
@ -650,18 +758,16 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
ctx = NULL;
}
end:
OPENSSL_free(passin);
return ctx;
}
static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
ENGINE *e)
{
EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(ctx);
EVP_PKEY *peer = NULL;
ENGINE *engine = NULL;
int ret;
int ret = 1;
if (peerform == FORMAT_ENGINE)
engine = e;
@ -670,8 +776,14 @@ static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
BIO_printf(bio_err, "Error reading peer key %s\n", file);
return 0;
}
ret = EVP_PKEY_derive_set_peer(ctx, peer) > 0;
if (strcmp(EVP_PKEY_get0_type_name(peer), EVP_PKEY_get0_type_name(pkey)) != 0) {
BIO_printf(bio_err,
"Type of peer public key: %s does not match type of private key: %s\n",
EVP_PKEY_get0_type_name(peer), EVP_PKEY_get0_type_name(pkey));
ret = 0;
} else {
ret = EVP_PKEY_derive_set_peer(ctx, peer) > 0;
}
EVP_PKEY_free(peer);
return ret;
@ -679,9 +791,11 @@ static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
static int do_keyop(EVP_PKEY_CTX *ctx, int pkey_op,
unsigned char *out, size_t *poutlen,
const unsigned char *in, size_t inlen)
const unsigned char *in, size_t inlen,
unsigned char *secret, size_t *pseclen)
{
int rv = 0;
switch (pkey_op) {
case EVP_PKEY_OP_VERIFYRECOVER:
rv = EVP_PKEY_verify_recover(ctx, out, poutlen, in, inlen);
@ -703,6 +817,14 @@ static int do_keyop(EVP_PKEY_CTX *ctx, int pkey_op,
rv = EVP_PKEY_derive(ctx, out, poutlen);
break;
case EVP_PKEY_OP_ENCAPSULATE:
rv = EVP_PKEY_encapsulate(ctx, out, poutlen, secret, pseclen);
break;
case EVP_PKEY_OP_DECAPSULATE:
rv = EVP_PKEY_decapsulate(ctx, secret, pseclen, in, inlen);
break;
}
return rv;
}
@ -720,8 +842,7 @@ static int do_raw_keyop(int pkey_op, EVP_MD_CTX *mctx,
int buf_len = 0;
/* Some algorithms only support oneshot digests */
if (EVP_PKEY_get_id(pkey) == EVP_PKEY_ED25519
|| EVP_PKEY_get_id(pkey) == EVP_PKEY_ED448) {
if (only_nomd(pkey)) {
if (filesize < 0) {
BIO_printf(bio_err,
"Error: unable to determine file size for oneshot operation\n");

8
apps/prime.c
View file

@ -145,10 +145,14 @@ opthelp:
}
BN_print(bio_out, bn);
r = BN_check_prime(bn, NULL, NULL);
if (r < 0) {
BIO_printf(bio_err, "Error checking prime\n");
goto end;
}
BIO_printf(bio_out, " (%s) %s prime\n",
argv[0],
BN_check_prime(bn, NULL, NULL)
? "is" : "is not");
r == 1 ? "is" : "is not");
}
}

15
apps/rehash.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 2015-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2013-2014 Timo Teräs <timo.teras@gmail.com>
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@ -8,6 +8,7 @@
* https://www.openssl.org/source/license.html
*/
#include "internal/e_os.h" /* LIST_SEPARATOR_CHAR */
#include "apps.h"
#include "progs.h"
@ -140,7 +141,7 @@ static int add_entry(enum Type type, unsigned int hash, const char *filename,
}
for (ep = bp->first_entry; ep; ep = ep->next) {
if (digest && memcmp(digest, ep->digest, evpmdsize) == 0) {
if (digest && memcmp(digest, ep->digest, (size_t)evpmdsize) == 0) {
BIO_printf(bio_err,
"%s: warning: skipping duplicate %s in %s\n",
opt_getprog(),
@ -183,7 +184,7 @@ static int add_entry(enum Type type, unsigned int hash, const char *filename,
if (need_symlink && !ep->need_symlink) {
ep->need_symlink = 1;
bp->num_needed++;
memcpy(ep->digest, digest, evpmdsize);
memcpy(ep->digest, digest, (size_t)evpmdsize);
}
return 0;
}
@ -553,12 +554,20 @@ int rehash_main(int argc, char **argv)
evpmd = EVP_sha1();
evpmdsize = EVP_MD_get_size(evpmd);
if (evpmdsize <= 0 || evpmdsize > EVP_MAX_MD_SIZE)
goto end;
if (*argv != NULL) {
while (*argv != NULL)
errs += do_dir(*argv++, h);
} else if ((env = getenv(X509_get_default_cert_dir_env())) != NULL) {
char lsc[2] = { LIST_SEPARATOR_CHAR, '\0' };
m = OPENSSL_strdup(env);
if (m == NULL) {
BIO_puts(bio_err, "out of memory\n");
errs = 1;
goto end;
}
for (e = strtok(m, lsc); e != NULL; e = strtok(NULL, lsc))
errs += do_dir(e, h);
OPENSSL_free(m);

63
apps/req.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@ -30,6 +30,7 @@
#ifndef OPENSSL_NO_DSA
# include <openssl/dsa.h>
#endif
#include "internal/e_os.h" /* For isatty() */
#define BITS "default_bits"
#define KEYFILE "default_keyfile"
@ -43,7 +44,7 @@
#define DEFAULT_KEY_LENGTH 2048
#define MIN_KEY_LENGTH 512
#define DEFAULT_DAYS 30 /* default cert validity period in days */
#define DEFAULT_DAYS 30 /* default certificate validity period in days */
#define UNSET_DAYS -2 /* -1 may be used for testing expiration checks */
#define EXT_COPY_UNSET -1
@ -80,6 +81,7 @@ static int batch = 0;
typedef enum OPTION_choice {
OPT_COMMON,
OPT_CIPHER,
OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_KEYGEN_ENGINE, OPT_KEY,
OPT_PUBKEY, OPT_NEW, OPT_CONFIG, OPT_KEYFORM, OPT_IN, OPT_OUT,
OPT_KEYOUT, OPT_PASSIN, OPT_PASSOUT, OPT_NEWKEY,
@ -87,7 +89,7 @@ typedef enum OPTION_choice {
OPT_VERIFY, OPT_NOENC, OPT_NODES, OPT_NOOUT, OPT_VERBOSE, OPT_UTF8,
OPT_NAMEOPT, OPT_REQOPT, OPT_SUBJ, OPT_SUBJECT, OPT_TEXT,
OPT_X509, OPT_X509V1, OPT_CA, OPT_CAKEY,
OPT_MULTIVALUE_RDN, OPT_DAYS, OPT_SET_SERIAL,
OPT_MULTIVALUE_RDN, OPT_NOT_BEFORE, OPT_NOT_AFTER, OPT_DAYS, OPT_SET_SERIAL,
OPT_COPY_EXTENSIONS, OPT_EXTENSIONS, OPT_REQEXTS, OPT_ADDEXT,
OPT_PRECERT, OPT_MD,
OPT_SECTION, OPT_QUIET,
@ -97,6 +99,7 @@ typedef enum OPTION_choice {
const OPTIONS req_options[] = {
OPT_SECTION("General"),
{"help", OPT_HELP, '-', "Display this summary"},
{"cipher", OPT_CIPHER, 's', "Specify the cipher for private key encryption"},
#ifndef OPENSSL_NO_ENGINE
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
{"keygen_engine", OPT_KEYGEN_ENGINE, 's',
@ -127,7 +130,11 @@ const OPTIONS req_options[] = {
"Print the subject of the output request or cert"},
{"multivalue-rdn", OPT_MULTIVALUE_RDN, '-',
"Deprecated; multi-valued RDNs support is always on."},
{"days", OPT_DAYS, 'p', "Number of days cert is valid for"},
{"not_before", OPT_NOT_BEFORE, 's',
"[CC]YYMMDDHHMMSSZ value for notBefore certificate field"},
{"not_after", OPT_NOT_AFTER, 's',
"[CC]YYMMDDHHMMSSZ value for notAfter certificate field, overrides -days"},
{"days", OPT_DAYS, 'p', "Number of days certificate is valid for"},
{"set_serial", OPT_SET_SERIAL, 's', "Serial number to use"},
{"copy_extensions", OPT_COPY_EXTENSIONS, 's',
"copy extensions from request when using -x509"},
@ -245,7 +252,7 @@ int req_main(int argc, char **argv)
LHASH_OF(OPENSSL_STRING) *addexts = NULL;
X509 *new_x509 = NULL, *CAcert = NULL;
X509_REQ *req = NULL;
EVP_CIPHER *cipher = NULL;
const EVP_CIPHER *cipher = NULL;
int ext_copy = EXT_COPY_UNSET;
BIO *addext_bio = NULL;
char *extsect = NULL;
@ -259,6 +266,7 @@ int req_main(int argc, char **argv)
char *template = default_config_file, *keyout = NULL;
const char *keyalg = NULL;
OPTION_CHOICE o;
char *not_before = NULL, *not_after = NULL;
int days = UNSET_DAYS;
int ret = 1, gen_x509 = 0, i = 0, newreq = 0, verbose = 0, progress = 1;
int informat = FORMAT_UNDEF, outformat = FORMAT_PEM, keyform = FORMAT_UNDEF;
@ -267,9 +275,7 @@ int req_main(int argc, char **argv)
long newkey_len = -1;
unsigned long chtype = MBSTRING_ASC, reqflag = 0;
#ifndef OPENSSL_NO_DES
cipher = (EVP_CIPHER *)EVP_des_ede3_cbc();
#endif
cipher = (EVP_CIPHER *)EVP_aes_256_cbc();
opt_set_unknown_name("digest");
prog = opt_init(argc, argv, req_options);
@ -423,9 +429,15 @@ int req_main(int argc, char **argv)
case OPT_CAKEY:
CAkeyfile = opt_arg();
break;
case OPT_NOT_BEFORE:
not_before = opt_arg();
break;
case OPT_NOT_AFTER:
not_after = opt_arg();
break;
case OPT_DAYS:
days = atoi(opt_arg());
if (days < -1) {
if (days <= UNSET_DAYS) {
BIO_printf(bio_err, "%s: -days parameter arg must be >= -1\n",
prog);
goto end;
@ -470,7 +482,7 @@ int req_main(int argc, char **argv)
}
i = duplicated(addexts, p);
if (i == 1)
goto opthelp;
goto end;
if (i == -1)
BIO_printf(bio_err, "Internal error handling -addext %s\n", p);
if (i < 0 || BIO_printf(addext_bio, "%s\n", p) < 0)
@ -479,6 +491,13 @@ int req_main(int argc, char **argv)
case OPT_PRECERT:
newreq = precert = 1;
break;
case OPT_CIPHER:
cipher = EVP_get_cipherbyname(opt_arg());
if (cipher == NULL) {
BIO_printf(bio_err, "Unknown cipher: %s\n", opt_arg());
goto opthelp;
}
break;
case OPT_MD:
digest = opt_unknown();
break;
@ -494,14 +513,18 @@ int req_main(int argc, char **argv)
if (!gen_x509) {
if (days != UNSET_DAYS)
BIO_printf(bio_err, "Ignoring -days without -x509; not generating a certificate\n");
BIO_printf(bio_err, "Warning: Ignoring -days without -x509; not generating a certificate\n");
if (not_before != NULL)
BIO_printf(bio_err, "Warning: Ignoring -not_before without -x509; not generating a certificate\n");
if (not_after != NULL)
BIO_printf(bio_err, "Warning: Ignoring -not_after without -x509; not generating a certificate\n");
if (ext_copy == EXT_COPY_NONE)
BIO_printf(bio_err, "Ignoring -copy_extensions 'none' when -x509 is not given\n");
BIO_printf(bio_err, "Warning: Ignoring -copy_extensions 'none' when -x509 is not given\n");
}
if (infile == NULL) {
if (gen_x509)
newreq = 1;
else if (!newreq)
else if (!newreq && isatty(fileno_stdin()))
BIO_printf(bio_err,
"Warning: Will read cert request from stdin since no -in option is given\n");
}
@ -573,7 +596,7 @@ int req_main(int argc, char **argv)
X509V3_CTX ctx;
X509V3_set_ctx_test(&ctx);
X509V3_set_nconf(&ctx, addext_conf);
X509V3_set_nconf(&ctx, req_conf);
if (!X509V3_EXT_add_nconf(addext_conf, &ctx, "default", NULL)) {
BIO_printf(bio_err, "Error checking extensions defined using -addext\n");
goto end;
@ -802,10 +825,11 @@ int req_main(int argc, char **argv)
if (!X509_set_issuer_name(new_x509, issuer))
goto end;
if (days == UNSET_DAYS) {
if (days == UNSET_DAYS)
days = DEFAULT_DAYS;
}
if (!set_cert_times(new_x509, NULL, NULL, days))
else if (not_after != NULL)
BIO_printf(bio_err,"Warning: -not_after option overriding -days option\n");
if (!set_cert_times(new_x509, not_before, not_after, days, 1))
goto end;
if (!X509_set_subject_name(new_x509, n_subj))
goto end;
@ -918,9 +942,10 @@ int req_main(int argc, char **argv)
if (i < 0)
goto end;
if (i == 0)
if (i == 0) {
BIO_printf(bio_err, "Certificate request self-signature verify failure\n");
else /* i > 0 */
goto end;
} else /* i > 0 */
BIO_printf(bio_out, "Certificate request self-signature verify OK\n");
}

14
apps/s_client.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2005 Nokia. All rights reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@ -16,6 +16,7 @@
#include <errno.h>
#include <openssl/e_os2.h>
#include "internal/nelem.h"
#include "internal/sockets.h" /* for openssl_fdset() */
#ifndef OPENSSL_NO_SOCK
@ -55,7 +56,7 @@ typedef unsigned int u_int;
#endif
#undef BUFSIZZ
#define BUFSIZZ 1024*8
#define BUFSIZZ 1024*16
#define S_CLIENT_IRC_READ_TIMEOUT 8
#define USER_DATA_MODE_NONE 0
@ -207,7 +208,8 @@ static int psk_use_session_cb(SSL *s, const EVP_MD *md,
const SSL_CIPHER *cipher = NULL;
if (psksess != NULL) {
SSL_SESSION_up_ref(psksess);
if (!SSL_SESSION_up_ref(psksess))
goto err;
usesess = psksess;
} else {
long key_len;
@ -2167,6 +2169,9 @@ int s_client_main(int argc, char **argv)
if (tfo)
BIO_printf(bio_c_out, "Connecting via TFO\n");
re_start:
/* peer_addr might be set from previous connections */
BIO_ADDR_free(peer_addr);
peer_addr = NULL;
if (init_client(&sock, host, port, bindhost, bindport, socket_family,
socket_type, protocol, tfo, !isquic, &peer_addr) == 0) {
BIO_printf(bio_err, "connect:errno=%d\n", get_last_socket_error());
@ -3172,7 +3177,7 @@ int s_client_main(int argc, char **argv)
}
}
#endif
k = SSL_read(con, sbuf, 1024 /* BUFSIZZ */ );
k = SSL_read(con, sbuf, BUFSIZZ);
switch (SSL_get_error(con, k)) {
case SSL_ERROR_NONE:
@ -3483,6 +3488,7 @@ static void print_stuff(BIO *bio, SSL *s, int full)
c = SSL_get_current_cipher(s);
BIO_printf(bio, "%s, Cipher is %s\n",
SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));
BIO_printf(bio, "Protocol: %s\n", SSL_get_version(s));
if (peer != NULL) {
EVP_PKEY *pktmp;

54
apps/s_server.c
View file

@ -1,5 +1,5 @@
/*
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
* Copyright 2005 Nokia. All rights reserved.
*
@ -9,6 +9,8 @@
* https://www.openssl.org/source/license.html
*/
#include "internal/e_os.h"
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
@ -22,6 +24,7 @@
#include <openssl/async.h>
#include <openssl/ssl.h>
#include <openssl/decoder.h>
#include "internal/sockets.h" /* for openssl_fdset() */
#ifndef OPENSSL_NO_SOCK
@ -206,7 +209,9 @@ static int psk_find_session_cb(SSL *ssl, const unsigned char *identity,
}
if (psksess != NULL) {
SSL_SESSION_up_ref(psksess);
if (!SSL_SESSION_up_ref(psksess))
return 0;
*sess = psksess;
return 1;
}
@ -1754,9 +1759,9 @@ int s_server_main(int argc, char *argv[])
goto end;
}
#endif
if (early_data && (www > 0 || rev)) {
if (early_data && rev) {
BIO_printf(bio_err,
"Can't use -early_data in combination with -www, -WWW, -HTTP, or -rev\n");
"Can't use -early_data in combination with -rev\n");
goto end;
}
@ -3153,7 +3158,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
int i, j, k, dot;
SSL *con;
const SSL_CIPHER *c;
BIO *io, *ssl_bio, *sbio;
BIO *io, *ssl_bio, *sbio, *edio;
#ifdef RENEG
int total_bytes = 0;
#endif
@ -3175,7 +3180,8 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
p = buf = app_malloc(bufsize + 1, "server www buffer");
io = BIO_new(BIO_f_buffer());
ssl_bio = BIO_new(BIO_f_ssl());
if ((io == NULL) || (ssl_bio == NULL))
edio = BIO_new(BIO_s_mem());
if ((io == NULL) || (ssl_bio == NULL) || (edio == NULL))
goto err;
if (s_nbio) {
@ -3235,6 +3241,12 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
goto err;
io = BIO_push(filter, io);
filter = BIO_new(BIO_f_ebcdic_filter());
if (filter == NULL)
goto err;
edio = BIO_push(filter, edio);
#endif
if (s_debug) {
@ -3251,8 +3263,35 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
SSL_set_msg_callback_arg(con, bio_s_msg ? bio_s_msg : bio_s_out);
}
if (early_data) {
int edret = SSL_READ_EARLY_DATA_ERROR;
size_t readbytes;
while (edret != SSL_READ_EARLY_DATA_FINISH) {
for (;;) {
edret = SSL_read_early_data(con, buf, bufsize, &readbytes);
if (edret != SSL_READ_EARLY_DATA_ERROR)
break;
switch (SSL_get_error(con, 0)) {
case SSL_ERROR_WANT_WRITE:
case SSL_ERROR_WANT_ASYNC:
case SSL_ERROR_WANT_READ:
/* Just keep trying - busy waiting */
continue;
default:
BIO_printf(bio_err, "Error reading early data\n");
ERR_print_errors(bio_err);
goto err;
}
}
if (readbytes > 0)
BIO_write(edio, buf, (int)readbytes);
}
}
for (;;) {
i = BIO_gets(io, buf, bufsize + 1);
i = BIO_gets(!BIO_eof(edio) ? edio : io, buf, bufsize + 1);
if (i < 0) { /* error */
if (!BIO_should_retry(io) && !SSL_waiting_for_async(con)) {
if (!s_quiet)
@ -3592,6 +3631,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
OPENSSL_free(buf);
BIO_free(ssl_bio);
BIO_free_all(io);
BIO_free_all(edio);
return ret;
}

Some files were not shown because too many files have changed in this diff Show more