37309 Commits

All Branches

Search

Author	SHA1	Message	Date
sashan	1eb79b51e7	- adding rpki-client-portable repository as submodule ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27689)	2025-05-30 13:26:16 -04:00
sashan	f1305ea551	- rpki external test ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27689)	2025-05-30 13:26:16 -04:00
sashan	9465cbf68b	add rpki-client external test ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27689)	2025-05-30 13:26:16 -04:00
Daniel Frink	6c3e111016	Add generated cipher implementation files to gitignore ... A commit was merged recently which change ciphercommon.c and cipher_chacha20_poly1305.c to be generated files. The corresponding .c files were not added to the gitignore, so this commit adds them to avoid them being erroneously tracked in the future. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27715)	2025-05-30 18:15:18 +02:00
Dmitry Belyavskiy	0b968a3572	Cleanup - this constant and functions are no longer in use ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27716)	2025-05-30 18:14:13 +02:00
Norbert Pocs	9ed90fd44c	sslapitest: Add failing test for quic double free ... The double free happened on the EVP_MD object, when we used external quic implementation. This test makes the yield secret callback fail, to make the kdfdigest free path happen. Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27713)	2025-05-30 06:44:38 -04:00
Norbert Pocs	258d3a695e	quic_tls.c: Precede double free on EVP_MD variable ... When external quic implementation is used, the variable is not used and double free happens whe the yield_secret_cb fails. Resolves: #27504 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27713)	2025-05-30 06:44:38 -04:00
Richard Levitte	66454bf8ba	[design] Functions for explicitly fetched signature algorithms ... This design goes into more details what was outlined in the design for [fetching composite (PKEY) algorithms and using them]. It also changes what functionality will be used for this. The design for signature was originally to add modified initializers for DigestSign and DigestVerify, but recent OTC discussions redirected us to have a closer look at EVP_PKEY_sign() and EVP_PKEY_verify(). [fetching composite (PKEY) algorithms and using them]: ./fetching-composite-algorithms.md Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22672)	2025-05-30 11:30:03 +02:00
Tomas Mraz	08b2042a20	Document that FIPS provider cannot be used by multiple libcryptos ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27702)	2025-05-30 08:08:19 +10:00
JiashengJiang	e8deb32af4	test/evp_test.c: Free fetched_digest on error to avoid memory leak ... Call EVP_MD_free() to release fetched_digest if OPENSSL_zalloc() fails, preventing a memory leak. Fixes: 2208ba56eb ("evp_test: Add the missing check after calling OPENSSL_malloc") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27648)	2025-05-29 16:41:37 +02:00
JiashengJiang	00c531a5e3	crypto/property/property.c: Free impl->method to avoid memory leak ... After ossl_method_up_ref() succeeds, impl_free() should be called to free impl->method. Fixes: 860ecfd ("property: check return values from the property locking calls.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27564)	2025-05-29 16:39:51 +02:00
AntonMoryakov	3161f460fa	apps: lib: Prevent potential NULL dereference in init_client() ... apps: lib: Simplify ba_ret handling in init_client() Simplify logic around ba_ret assignment: - Fail early if ba_ret == NULL - Assign directly otherwise, without checking *ba_ret This avoids extra nesting and matches OpenSSL's conventions. CLA: trivial Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com> Co-authored-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26783)	2025-05-29 16:37:41 +02:00
operagxoksana	8ad37051e2	README.md: Improve links to GH workflow badges ... CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27596)	2025-05-29 16:32:54 +02:00
Viktor Dukhovni	005fa3e00e	Note finished state in cipher BIO EOF ... When the cipher BIO encounters a non-retriable EOF (or error), mark the state as "finished", else a subsequent BIO_flush() or attempted read may attempt to finalise the crypto state again, and fail, leading, for example, to users seeing erroneous apparent decryption failure. This is not a new problem, the fix should be backported to all supported releases. It was made more apparent by recent changes to the base64 BIO, which returns a non-retriable EOF when padding is seen at the end of the base64 data, even if the underlying next BIO is "retriable". Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27680)	2025-05-29 16:02:26 +02:00
Neil Horman	864333b455	Attempt to fix occasional failure of quicapi test in ci ... https://github.com/openssl/openssl/actions/runs/15214054228/job/42795224720 the theory I have for the cause of this failure is: 1. qtest_create_quic_connection_ex is called for the client 2. The client is in blocking mode, so we fall into the conditional on line 512 3. We create the server thread on line 519, which is non-blocking 4. The scheduler in the failing case, lets the server run ahead of the client 5. Server thread enters qtest_create_quic_connection_ex and iterates steps 6-9 in the do_while loop starting on line 530 6. Server calls qtest_add_time 7. Server calls ossl_quic_tserver_tick 8. Server calls ossl_quic_tserver_is_term_any, received NULL return 9. Server calls qtest_wait_for_timeout 10. Eventually qtest_wait_for_timeout returns zero, adn the server jumps to the error label, returning zero to globservret, and the thread exits 11. Client thread regains the cpu, and attempts to call SSL_connect, which fails, as the server is no longer listening 12. We fall into the error case on line 556, and SSL_get_error returns SSL_ERROR_SSL, which causes clienterr to get set to 1 13. We exit the do{} while loop on line 581, and do the TEST_true check on line 593. The server having exited wait_for_thread returns true, but globserverret is still zero from step 10 above, and so the test fails I can't prove this is the case, as the test only appears to fail in CI, and we can't dump verbose logging there, lest we affect the timing of the tests, so this is just a theory, but it seems to fit the observations we have. Attempting to fix this, by creating a thread interlock with a condition variable that blocks the server from ticking the quic reactor until such time as the client is about to call SSL_connect to prevent the race condition Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27704)	2025-05-29 05:41:32 -04:00
Norbert Pocs	3423c30db3	Document EVP_CIPHER failure for missing provider function ... When writing a new CIPHER implementation the OSSL_FUNC_cipher_get_params must be present, otherwise the fetch fails. This behaviour is seen in function evp_cipher_cache_constants@crypto/evp/evp_lib.c. Resolves: #25801 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27696)	2025-05-28 10:33:39 +02:00
JiashengJiang	e0ae801728	apps/cmp.c: Free bio on error to avoid memory leak ... Call BIO_free() to release bio if ASN1_i2d_bio_of() fails, preventing a memory leak. Fixes: 6a3579e190 ("CMP: add support for requesting cert template using genm/genp") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27647)	2025-05-27 19:51:55 +02:00
Tomas Mraz	0873cd1b68	OSSL_CMP_MSG_http_perform(): Remove extraneous %s from debug log print ... Also add missing ":" to another log print. Fixes #27634 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/27635)	2025-05-27 19:50:41 +02:00
JiashengJiang	9882d389df	crypto/pkcs7/pk7_smime.c: Add BIO_free() to avoid memory leak ... Add BIO_free() to free tmpout if OPENSSL_malloc() fails to avoid memory leak. Fixes: 8e70485 ("RT3955: Reduce some stack usage") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27631)	2025-05-27 19:49:07 +02:00
JiashengJiang	0dc6ea55a1	apps/pkeyutl.c: Add OPENSSL_free() to avoid a memory leak ... If EVP_PKEY_CTX_ctrl_str() fails, the code jumps to 'end' label without freeing passwd, causing a memory leak. Fixes: 9d1bf5f7de ("Add option to read pkeyopts interactively") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27470)	2025-05-27 19:47:17 +02:00
Pauli	fa2e4f7bad	test: use EVP_PKEY_get_security_category function in tests ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:51 +10:00
Pauli	73188a01bd	doc: document EVP_PKEY_get_security_category function ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:51 +10:00
Pauli	445e2797e6	add EVP_PKEY_get_security_category to exported symbols ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	8bdb122877	evp: add EVP_PKEY_get_security_category function ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	bb05bf76dc	slh-dsa: add security category checks to evp_test data ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	1d4d18daae	rsa: add security category checks to evp_test data ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	0bc71fd519	ml-kem: add security category checks to evp_test data ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	1f000a4112	ml-dsa: add security category checks to evp_test data ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	6cc9a3fd0b	ecx: add security category checks to evp_test data ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	ae36afee11	ec: add security category checks to evp_test data ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	fdc0c8a3ab	dsa: add security category checks to evp_test data ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	17e7e85d15	dh: add security category checks to evp_test data ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	3b9f957c79	slh-dsa: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	4da326af2a	rsa: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	32bc8e3434	ml-kem: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	64328438f6	ml-dsa: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	2f1890eb18	ecx/ml-kem: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	077ed48edf	ecx: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	5dcf3806e2	ec: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	3851771792	dsa: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	4577a4a59f	dh: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	c3215ac573	evp_test: support security-category for public key operations ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:43 +10:00
Pauli	8f373f11d2	doc: document the security category param for pkeys ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:43 +10:00
Pauli	c58085d4a9	Add security-category param name ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:43 +10:00
Norbert Pocs	a0d1af6574	quic-interop-ci: Fix docker install ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27687)	2025-05-23 15:02:47 -04:00
Richard Levitte	8bd89f15c9	Add more instructions in HACKING.md ... It's been long since it was updated or refined, and it was a bit too vague in certain areas. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27674)	2025-05-23 18:08:51 +02:00
Tomas Mraz	52a2b3d82f	Avoid leaking duplicated EVP_PKEY_CTX in case of error ... Fixes Coverity 1647946 1647947 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27686) (cherry picked from commit 240228979b)	2025-05-23 17:39:09 +02:00
widneve	6543f34dda	Fix memory leaks after failure of PKCS7_add_signed_attribute() ... If PKCS7_add_signed_attribute fails, seq never escapes out of the callee and will therefore result in a memory leak. This is similar to ed3d277127. CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27670)	2025-05-23 17:36:53 +02:00
klaus triendl	afd32bcb54	Updated Windows notes on the use of “no-makedepend” for new builds ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27361)	2025-05-22 16:08:15 +02:00
Norbert Pocs	d7be888244	quic-interop-ci: Fix failing CI ... The issue was a flaky "impossible to reach server" in the CI. The issue was caused by introduction of indeterminism to docker networking (docker engine v28.0) and docker compose is affected by that since v2.33.1. Using constant network interface names solves the issue. The "interface_name" was introduced in docker compose v2.36.0. Resolves: https://github.com/openssl/project/issues/1182 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27682)	2025-05-22 11:09:54 +02:00