- Aug 08, 2019
-
-
Shane Lontis authored
Note a flag needed to be added since some ssl tests fail if they output any error (even if the error is ignored). Only ciphers that handle the GET_IV_LEN control set this flag. Fixes #8330 Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9499)
-
- Aug 01, 2019
-
-
Dr. Matthias St. Pierre authored
Complements commit b383aa20 , which added X509_get0_authority_key_id(). const ASN1_OCTET_STRING *X509_get0_authority_key_id(X509 *x); const GENERAL_NAMES *X509_get0_authority_issuer(X509 *x); [NEW] const ASN1_INTEGER *X509_get0_authority_serial(X509 *x); [NEW] Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9494)
-
- Jul 31, 2019
-
-
Antoine Cœur authored
CLA: trivial Reviewed-by:
Shane Lontis <shane.lontis@oracle.com> Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/9295)
-
joe2018Outlookcom authored
Fix: crypto\whrlpool\wp_block.c(90) : warning C4164: '_rotl64' : intrinsic function not declared. Fixes #9487 Reviewed-by:
-
David von Oheimb authored
Reviewed-by:
Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/9466) (cherry picked from commit 7408f6759f1b0100438ca236ea8f549454aaf2d5)
-
- Jul 23, 2019
-
-
Pauli authored
The rand pool support allocates maximal sized buffers -- this is typically 12288 bytes in size. These pools are allocated in secure memory which is a scarse resource. They are also allocated per DRBG of which there are up to two per thread. This change allocates 64 byte pools and grows them dynamically if required. 64 is chosen to be sufficiently large so that pools do not normally need to grow. Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9428) (cherry picked from commit a6a66e4511eec0f4ecc2943117a42b3723eb2222)
-
Bernd Edlinger authored
The additional data allocates 12K per DRBG instance in the secure memory, which is not necessary. Also nonces are not considered secret. [extended tests] Reviewed-by:
-
- Jul 24, 2019
-
-
Dr. Matthias St. Pierre authored
The check is redundant, because <openssl/x509v3.h> is included. Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
-
Dr. Matthias St. Pierre authored
This include guard inside an object file comes as a surprise and serves no purpose anymore. It seems like this object file was included by crypto/threads/mttest.c at some time, but the include directive was removed in commit bb8abd67 . Reviewed-by:
-
Bernd Edlinger authored
This avoids leaking bit 0 of the private key. Backport-of: #9363 Reviewed-by:
Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/9435)
-
- Jul 23, 2019
-
-
Pauli authored
Reviewed-by:
-
- Jul 21, 2019
-
-
Richard Levitte authored
These weren't available in Cygwin at the time our DSO code was written, but things have changed since. Fixes #9385 Reviewed-by:
-
- Jul 18, 2019
-
-
Shane Lontis authored
Cosmetic changes to use the X509_STORE_lock/unlock functions. Renamed some ctx variables to store. Reviewed-by:
-
- Jul 17, 2019
-
-
Patrick Steuer authored
Signed-off-by:
Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by:
-
- Jul 15, 2019
-
-
Krists Krilovs authored
x509 store's objects cache can get corrupted when using dir lookup method in multithreaded application. Claim x509 store's lock when accessing objects cache. CLA: trivial Reviewed-by:
Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by:
-
- Jul 08, 2019
-
-
Dmitry Belyavskiy authored
Reviewed-by:
-
Lei Maohui authored
Modified rev to rev64, because rev only takes integer registers. https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90827 Otherwise, the following error will occur. Error: operand 1 must be an integer register -- `rev v31.16b,v31.16b' CLA: trivial Signed-off-by:
Lei Maohui <leimaohui@cn.fujitsu.com> Reviewed-by:
-
- Jul 07, 2019
-
-
Bernd Edlinger authored
Happens when trying to generate 4 or 5 bit safe primes. [extended tests] Reviewed-by:
-
- Jul 02, 2019
-
-
Bernd Edlinger authored
The member value.ptr is undefined for those ASN1 types. Reviewed-by:
-
Bernd Edlinger authored
BOOLEAN does not have valid data in the value.ptr member, thus don't use it here. Fixes #9276 [extended tests] Reviewed-by:
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
- Jul 01, 2019
-
-
Matt Caswell authored
The maximum key length for rc5 is 2040 bits so we should not attempt to use keys longer than this. Issue found by OSS-Fuzz and Guido Vranken. Reviewed-by:
-
- Jun 30, 2019
-
-
Antoine Cœur authored
CLA: trivial Reviewed-by:
-
- Jun 24, 2019
-
-
Pauli authored
Reviewed-by:
-
Pauli authored
This feature is enabled by default outside of FIPS builds which ban such actions completely. Encryption is always disallowed and will generate an error. Reviewed-by:
-
- Jun 21, 2019
-
-
Bernd Edlinger authored
This is a bit annoying, if for instance "openssl genrsa -aes128" tries to read a 4+ character size password, but CTRL-C does no longer work after a RETURN key, since the flag UI_FLAG_REDOABLE is set by UI_set_result_ex, together with the error "You must type in 4 to 1023 characters". Thus remove the REDOABLE flag to allow CTRL-C to work. [extended tests] Reviewed-by:
-
- Jun 19, 2019
-
-
Rebecca Cran authored
CLA: trivial Reviewed-by:
Ben Kaduk <kaduk@mit.edu> Reviewed-by:
-
Tomas Mraz authored
The BIO_FLAGS_NONCLEAR_RST flag behavior was not properly documented and it also caused the length to be incorrectly set after the reset operation. Reviewed-by:
-
- Jun 18, 2019
-
-
Bernd Edlinger authored
When bufsize == 0, openssl_strerror_r should return 0 (if _GNU_SOURCE is defined), to be consistent with non-_GNU_SOURCE variants, which exhibit the same behavior. Fix a few cases, where the return value of openssl_strerror_r was ignored. Reviewed-by:
-
Rebecca Cran authored
This avoids the case where a UEFI build on FreeBSD tries to call the system issetugid function instead of returning 0 as it should do. CLA: trivial Reviewed-by:
-
- Jun 11, 2019
-
-
Matt Caswell authored
When compiling with --strict-warnings using gcc 7.4.0 the compiler complains that a case falls through, even though there is an explicit comment stating this. Moving the comment outside of the conditional compilation section resolves this. Reviewed-by:
-
Bernd Edlinger authored
Reviewed-by:
-
- Jun 10, 2019
-
-
Tomas Mraz authored
The lookup for ::1 with getaddrinfo() might return error even if the ::1 would work if AI_ADDRCONFIG flag is used. Fixes: #9053 Reviewed-by:
-
- Jun 09, 2019
-
-
Dr. Matthias St. Pierre authored
The DEVRANDOM_WAIT feature added a select() call to wait for the `/dev/random` device to become readable before reading from the `/dev/urandom` device. It was introduced in commit 38023b87f037 in order to mitigate the fact that the `/dev/urandom` device does not block until the initial seeding of the kernel CSPRNG has completed, contrary to the behaviour of the `getrandom()` system call. It turned out that this change had negative side effects on performance which were not acceptable. After some discussion it was decided to revert this feature and leave it up to the OS resp. the platform maintainer to ensure a proper initialization during early boot time. Fixes #9078 This partially reverts commit 38023b87f037. Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit a08714e18131b1998faa0113e5bd4024044654ac) (Merged from https://github.com/openssl/openssl/pull/9118)
-
- Jun 07, 2019
-
-
Acheev Bhagat authored
Reviewed-by:
-
- Jun 04, 2019
-
-
Vitezslav Cizek authored
The 4 kB SPACE_SYS_STR_REASONS in crypto/err/err.c isn't enough for some locales. The Russian locales consume 6856 bytes, Ukrainian even 7000. build_SYS_str_reasons() contains an overflow check: if (cnt > sizeof(strerror_pool)) cnt = sizeof(strerror_pool); But since commit 9f15e5b911ba6053e09578f190354568e01c07d7 it no longer works as cnt is incremented once more after the condition. cnt greater than sizeof(strerror_pool) results in an unbounded OPENSSL_strlcpy() in openssl_strerror_r(), eventually causing a crash. When the first received error string was empty or contained only spaces, cur would move in front of the start of the strerror_pool. Also don't call openssl_strerror_r when the pool is full. Reviewed-by:
-
- Jun 03, 2019
-
-
Shane Lontis authored
Fixes #8923 Found using the openssl cms -resign option. This uses an alternate path to do the signing which was not adding the required signed attribute content type. The content type attribute should always exist since it is required is there are any signed attributes. As the signing time attribute is always added in code, the content type attribute is also required. The CMS_si_check_attributes() method adds validity checks for signed and unsigned attributes e.g. The message digest attribute is a signed attribute that must exist if any signed attributes exist, it cannot be an unsigned attribute and there must only be one instance containing a single value. Reviewed-by:
-
- May 31, 2019
-
-
David Benjamin authored
Reviewed-by:
-
Retropotenza authored
CLA: trivial Fixes #8911 Reviewed-by:
-
- May 30, 2019
-
-
Pauli authored
Reviewed-by:
-
