- Sep 04, 2019
-
-
David Woodhouse authored
In commit 6aca8d1a ("Honour mandatory digest on private key in has_usable_cert()") I added two checks for the capabilities of the EVP_PKEY being used. One of them was wrong, as it should only be checking the signature of the X.509 cert (by its issuer) against the sigalgs given in a TLS v1.3 signature_algorithms_cert extension. Remove it. Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Ben Kaduk <kaduk@mit.edu> Reviewed-by:
Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9705)
-
- Aug 30, 2019
-
-
Pauli authored
Reviewed-by:
-
- Aug 29, 2019
-
-
Pauli authored
It lacks exposure of the `shm*` functions and should prefer the GETRANDOM source. Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9735) (cherry picked from commit 280cc0180862ae6664b88d5ea12cb5f599000d36)
-
Pauli authored
Reviewed-by:
-
- Aug 27, 2019
-
-
Cesar Pereida Garcia authored
This commit addresses a side-channel vulnerability present when PVK and MSBLOB key formats are loaded into OpenSSL. The public key was not computed using a constant-time exponentiation function. This issue was discovered and reported by the NISEC group at TAU Finland. Reviewed-by:
Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> Reviewed-by:
-
- Aug 24, 2019
-
-
Pauli authored
There is a problem in the rand_unix.c code when the random seed fd is greater than or equal to FD_SETSIZE and the FDSET overruns its limit and walks the stack. Reviewed-by:
-
- Aug 23, 2019
-
-
Richard Levitte authored
Parsing functions are at liberty to return: 1: when parsing on processing of the parsed value succeeded 0: when the parsed keyword is unknown -1: when the parsed value processing failed Some parsing functions didn't do this quite right, they returned 0 when they should have returned -1, causing a message like this: Line 123: unknown keyword PeerKey When this message (which is displayed when the parsing function returns -1) would have been more appropriate: Line 123: error processing keyword PeerKey = ffdhe2048-2-pub Reviewed-by:
-
- Aug 22, 2019
-
-
Richard Levitte authored
The input reading loop in 'openssl dgst' and 'openssl enc' doesn't check for end of input, and because of the way BIO works, it thereby won't detect that the end is reached before the read is an error. With the FILE BIO, an error occurs when trying to read past EOF, which is fairly much ok, except when the command is used interactively, at least on Unix. The result in that case is that the user has to press Ctrl-D twice for the command to terminate. The issue is further complicated because both these commands use filter BIOs on top of the FILE BIO, so a naïve attempt to check BIO_eof() doesn't quite solve it, since that only checks the state of the source/sink BIO, and the filter BIO may have some buffered data that still needs to be read. Fortunately, there's BIO_pending() that checks exactly that, if any filter BIO has pending data that needs to be processed. We end up having to check both BIO_pending() and BIO_eof(). Thanks to Zsigmond Lőrinczy for the initial effort and inspiration. Fixes #9355 Reviewed-by:
-
- Aug 20, 2019
-
-
Johannes authored
CLA: trivial Reviewed-by:
-
Pauli authored
Improve handling of low entropy at start up from /dev/urandom by waiting for a read(2) call on /dev/random to succeed. Once one such call has succeeded, a shared memory segment is created and persisted as an indicator to other processes that /dev/urandom is properly seeded. This does not fully prevent against attacks weakening the entropy source. An attacker who has control of the machine early in its boot sequence could create the shared memory segment preventing detection of low entropy conditions. However, this is no worse than the current situation. An attacker would also be capable of removing the shared memory segment and causing seeding to reoccur resulting in a denial of service attack. This is partially mitigated by keeping the shared memory alive for the duration of the process's existence. Thus, an attacker would not only need to have called call shmctl(2) with the IPC_RMID command but the system must subsequently enter a state where no instances of libcrypto exist in any process. Even one long running process will prevent this attack. The System V shared memory calls used here go back at least as far as Linux kernel 2.0. Linux kernels 4.8 and later, don't have a reliable way to detect that /dev/urandom has been properly seeded, so a failure is raised for this case (i.e. the getentropy(2) call has already failed). Reviewed-by:
-
- Aug 19, 2019
-
-
Bernd Edlinger authored
Reviewed-by:
-
Rich Salz authored
Backport of https://github.com/openssl/openssl/pull/9602 Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9632)
-
Mykola Baibuz authored
Fixes #9622 CLA: trivial Reviewed-by:
-
Bernd Edlinger authored
Reviewed-by:
-
- Aug 18, 2019
-
-
Patrick Steuer authored
Signed-off-by:
Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by:
-
Patrick Steuer authored
Requesting zero bytes from shake previously led to out-of-bounds write on some platforms. Signed-off-by:
-
Rich Salz authored
Reviewed-by:
-
- Aug 17, 2019
-
-
Bernd Edlinger authored
Reviewed-by:
Kurt Roeckx <kurt@roeckx.be> Reviewed-by:
-
- Aug 15, 2019
-
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
Omid Najafi authored
The error was from the alignment syntax of the code. More details: https://stackoverflow.com/questions/57316823/arm-assembly-syntax-in-vst-vld-commands?noredirect=1#comment101133590_57316823 CLA: trivial Fixes: #9518 Reviewed-by:
-
Richard Levitte authored
When OpenSSL is configured with 'no-stdio', TEST_ENG_OPENSSL_RC4_P_INIT shouldn't be defined, as that test uses stdio. Fixes #9597 Reviewed-by:
-
- Aug 14, 2019
-
-
Matt Caswell authored
Actually supply a chain and then test: 1) A successful check of both the ee and chain certs 2) A failure to check the ee cert 3) A failure to check a chain cert Reviewed-by:
-
Matt Caswell authored
The function SSL_check_chain() can be used by applications to check that a cert and chain is compatible with the negotiated parameters. This could be useful (for example) from the certificate callback. Unfortunately this function was applying TLSv1.2 sig algs rules and did not work correctly if TLSv1.3 was negotiated. We refactor tls_choose_sigalg to split it up and create a new function find_sig_alg which can (optionally) take a certificate and key as parameters and find an appropriate sig alg if one exists. If the cert and key are not supplied then we try to find a cert and key from the ones we have available that matches the shared sig algs. Reviewed-by:
-
opensslonzos-github authored
Fix a few places where calling ossl_isdigit does the wrong thing on EBCDIC based systems. Replaced with ascii_isdigit. Reviewed-by:
-
Paul Yang authored
Add memory management description in X509_STORE_add_cert, otherwise users will not be aware that they are leaking memory... Reviewed-by:
Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by:
-
- Aug 13, 2019
-
-
Tomas Mraz authored
We should not retry on EAI_MEMORY as that error is most probably fatal and not depending on AI_ADDRCONFIG hint. Also report the error from the first call if the second call fails as that one would be most probably the more interesting one. Reviewed-by:
-
Tomas Mraz authored
Do not try to discern the error return value on getaddrinfo() failure but when retrying set the AI_NUMERICHOST to avoid DNS lookups. Fixes: #9053 Reviewed-by:
-
- Aug 12, 2019
-
-
Richard Levitte authored
A local 'make clean' did some sweeping removals of files execpt for the .git directory. This is a little too sweeping, as other dotted files might be cleaned away if they happen to match the pattern that's searched for. An example is a symlink .dir-locals.el that would keep disappearing if you build in the source tree and do a make clean... So we change this to leave all dotted files alone. Our builds do not produce such files anyway, so this is a harmless (or rather, less harmful) change. Reviewed-by:
-
Richard Levitte authored
Fixes #9244 Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9572)
-
Denis Ovsienko authored
Fixup INSTALL and a couple man pages to get rid of "the the" and "in the in the". CLA: trivial Reviewed-by:
Paul Yang <kaishen.yy@antfin.com> Reviewed-by:
-
- Aug 09, 2019
-
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Create a PSS certificate with parameter restrictions Reviewed-by:
-
Matt Caswell authored
A default digest of SHA256 was being returned for RSA PSS even if the PSS parameters indicated a different digest must be used. We change this so that the correct default digest is returned and additionally mark this as mandatory for PSS. This bug had an impact on sig alg selection in libssl. Due to this issue an incorrect sig alg might be selected in the event that a server is configured with an RSA-PSS cert with parameter restrictions. Fixes #9545 Reviewed-by:
-
Vladimir Kotal authored
Reviewed-by:
-
Vladimir Kotal authored
fixes #8936 Reviewed-by:
-
- Aug 08, 2019
-
-
Martin Ukrop authored
The meaning of the X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY and X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT error codes were still reversed in the X509_STORE_CTX_get_error function documentation. This used to be the problem also in the verify application documentation, but was fixed on 2010-02-23 in 7d3d1788 . Reviewed-by:
Shane Lontis <shane.lontis@oracle.com> Reviewed-by:
-
Matt Caswell authored
Ensure users understand that they need to have appropriate permissions to write to the install location. Reviewed-by:
-
Shane Lontis authored
Note a flag needed to be added since some ssl tests fail if they output any error (even if the error is ignored). Only ciphers that handle the GET_IV_LEN control set this flag. Fixes #8330 Reviewed-by:
-
- Aug 06, 2019
-
-
Matt Caswell authored
They incorrectly said that i2d_ECDSA_SIG returns 0 on error. In fact it returns a negative value on error. We fix this by moving the i2d_ECDSA_SIG/d2i_ECDSA_SIG docs onto the same page as all the other d2i/i2d docs. Fixes #9517 Reviewed-by:
-
Matt Caswell authored
The macro TLS_MD_MASTER_SECRET_CONST is supposed to hold the ascii string "extended master secret". On EBCDIC machines it actually contained the value "extecded master secret" Reviewed-by:
-
