5705 Commits

Author	SHA1	Message	Date
Norbert Pocs	258d3a695e	quic_tls.c: Precede double free on EVP_MD variable ... When external quic implementation is used, the variable is not used and double free happens whe the yield_secret_cb fails. Resolves: #27504 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27713)	2025-05-30 06:44:38 -04:00
JiashengJiang	0ba71c0a24	ssl/t1_lib.c: Free gix if sk_TLS_GROUP_IX_push() fails to avoid memory leak ... Add OPENSSL_free() to free gix if sk_TLS_GROUP_IX_push() fails to avoid memory leak Fixes: 4b1c73d2dd ("ML-KEM hybrids for TLS") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27568)	2025-05-19 08:38:25 +02:00
Norbert Pocs	e66097fc66	s3_lib.c: Use illegal_parameter for failing encapsulation in ml_kem ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27627)	2025-05-16 11:11:07 +02:00
Neil Horman	99ea6b3843	Add NULL check in ossl_quic_get_peer_token ... If a peer address hasn't been set on a quic channel yet, we will not yield a token from our hashtable of available tokens. Fail the get_peer_token lookup in that event Fixes #27608 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27610)	2025-05-15 08:28:39 -04:00
Norbert Pocs	5da4ea10be	s3_lib.c: Handle weak x keys as illegal_parameter alert ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27597)	2025-05-15 10:48:32 +02:00
Matt Caswell	aa8bca2e81	Stop a TLSv1.3 server emitting an unsolicited PSK extension ... If we attempt to accept a connection on an SSL object, and the application has set an SSL_SESSION on that SSL object then we can mistakenly believe that we are resuming and emit an unsolicited PSK extension back to the client. This can especially happen when using SSL_clear() which leaves any SSL_SESSION associated with the SSL object. See https://github.com/openssl/openssl/discussions/27563#discussioncomment-13049352 and https://github.com/openssl/openssl/discussions/24567 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27584)	2025-05-13 14:12:21 +02:00
Norbert Pocs	831cbbb5dd	statem_srvr.c: Add check for empty ecdhe encoded key ... The RFC definition about the errors is very vague. The TLSv1.3 RFC is a bit more specific about decode_error (but if this specific case goes for decode_error or illegal parameter is still debatable): ``` decode_error: A message could not be decoded because some field was out of the specified range or the length of the message was incorrect. This alert is used for errors where the message does not conform to the formal protocol syntax. This alert should never be observed in communication between proper implementations, except when messages were corrupted in the network. ``` Thank you @GeorgePantelakis for reporting this issue! Resolves: #27530 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27594)	2025-05-13 14:11:20 +02:00
Matt Caswell	1afcc27f94	Add a test for app data received too early ... Add a test for app data which was received prior to the Finished is read correctly, and that if we continue to read we get the expected result. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/27543)	2025-05-08 14:06:12 -04:00
Matt Caswell	d2a33efd39	Ensure we properly release DTLS buffered app data records ... If we read an app data record before we have read the Finished we buffer it. Once we've read it we need to make sure we've properly released it otherwise we will attempt to read it again (and this time there will be no data in it). Fixes #27316 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/27543)	2025-05-08 14:06:11 -04:00
Matt Caswell	d56f9b4d89	Fix memory management in port_make_channel ... Also make port_new_handshake_layer processing clearer. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27562)	2025-05-07 15:08:21 +02:00
Matt Caswell	a23d5e20f1	Drop empty app data records in DTLS ... App data records with 0 bytes of payload will confuse callers of SSL_read(). This will cause a successful read and return 0 bytes as read. Unfortunately a 0 return from SSL_read() is considered a failure response. A subsequent call to SSL_get_error() will then give the wrong result. Zero length app data records are actually allowed by the spec, but have never been handled correctly by OpenSSL. We already disallow creating such empty app data records. Since the SSL_read() API does not have a good way to handle this type of read, we simply ignore them. Partial fix for #27316 Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27541)	2025-05-07 14:35:47 +02:00
Dr. David von Oheimb	1eee02d3e7	Fix SSL_{set1,add1}_host() handling of host name/IP address and related documentation ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27457)	2025-05-06 15:11:15 +02:00
sashan	0e41862899	ossl_json_f64() seems to be unused, remove it to avoid libm dependency ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27434)	2025-04-29 19:38:27 +02:00
Anton Tieleman	290fd4a0c8	Test+fix handling "wrong" downgrade signals ... This accounts for cases that can only occur when een non-compliant server sends the wrong downgrade signal. (TLS1.1 signal when negotiating TLS1.2 or TLS1.2 signal when negotiating TLS1.0/TLS1.1). According to the TLS1.3 RFC these cases should be rejected: RFC8446, section 4.1.3: TLS 1.3 clients receiving a ServerHello indicating TLS 1.2 or below MUST check that the last 8 bytes are not equal to either of these values. TLS 1.2 clients SHOULD also check that the last 8 bytes are not equal to the second value if the ServerHello indicates TLS 1.1 or below. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27518)	2025-04-29 19:31:51 +02:00
Gerd Hoffmann	04b59c4199	poll builder: add dummy field ... The microsoft compiler does not like the empty struct, so go add a dummy field instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27494)	2025-04-28 17:18:27 +02:00
Matt Caswell	cb5bb8916f	Fix errors on SSL_accept() and SSL_get_error() ... Calling SSL_accept() was raising two errors on the stack if you passed the wrong object type. Similarly SSL_get_error() was adding an error to the stack if the wrong object type was passed and returning the wrong result. We also ensure SSL_set_accept_state() and SSL_set_connect_state() don't raise spurious errors since these are void functions. Fixes #27347 Fixes #27348 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27351)	2025-04-24 20:10:44 +02:00
Yugandhar	de67f90815	Fix duplicate cipher definition in ssl/t1_trce.c ... This commit removes the duplicate definition of cipher 0xC102 in ssl/t1_trce.c, as reported in issue #27303. The first definition (IANA-GOST2012-GOST8912-GOST8912) is kept as the canonical one. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27329)	2025-04-15 15:53:26 +01:00
Gerd Hoffmann	7e53ffa144	rio: add RIO_POLL_METHOD_NONE ... Fixes build on UEFI. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27284)	2025-04-15 15:27:38 +01:00
Andrey Tsygunka	28de1f5004	Fix potential NULL pointer dereference in final_maxfragmentlen() ... In the final_maxfragmentlen() function, s->session is checked for NULL after it was dereferenced earlier. So move this NULL check to the top of the function. CLA: trivial Fixes: fa49560451 (Fix handling of max_fragment_length extension for PSK) Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/27272)	2025-04-14 15:52:53 +01:00
Graham Leggett	7f6cc862c6	ssl/ssl_lib.c: Avoid crash when SSL_CONNECTION is NULL ... Detection for sc == NULL is performed after sc is used. Add the check to the correct place. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27241)	2025-04-14 15:34:24 +01:00
Tim Perry	03541d7302	Add SSL_CTX_set_ec_point_formats() and SSL_set_ec_point_formats() ... The internal fields and implementation for configuration of this parameter already existed, but was not exposed. This change adds simple setters to allow configuration of this field. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26990)	2025-04-14 14:56:40 +01:00
Matt Caswell	38bf6f3036	Fix SSL_accept() ... If you have a QUIC server SSL connection object, you should be able to call SSL_accept() on it. Fixes #27282 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27283)	2025-04-14 08:52:18 +01:00
Matt Caswell	4efd1a2682	Prevent SSL_poll from reporting a stream as writeable if it isn't ... The CWM might prevent a stream from being writeable. We should not report a stream as writeable if there is no credit. Fixes #27312 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27319)	2025-04-11 07:57:54 +01:00
Samson S. Kolge	5341e271d9	Fix SSL_new() with QUIC_server_method and improve formatting (Fixes #27255) ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27264)	2025-04-05 09:06:24 -04:00
Benjamin Kaduk	ddd99d52d3	statem: always save sigalgs during PHA ... We use the same extension-parsing function on server and client for convenience, but while the server might worry about tracking what was previously received and not overwriting it, on the client receiving a request for post-handshake authentication, we always want to use the values from the current extension (and should always have a new session object that we are free to mutate). It is somewhat unclear whether the server also needs the check for a resumed connection; it appears to have been added back in 2015 in commit 062178678f as part of a broad pass to handle extensions on resumption, but without specific documentation of each extension's handling. Fixes: #10370 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24651)	2025-04-01 15:10:54 +02:00
Viktor Dukhovni	a5f98e6da5	Fix sigalg corner cases ... - Tolerate RSA PKCS#1 *certificate* signatures when the peer sigals include RSA PSS with the same digest. Now that we're more strict about not sending sigalgs that are out of protocol range, when the client supports TLS 1.3 only, we might refuse to return an RSA PKCS#1-signed cert. - Don't send TLS 1.3 sigalgs when requesting client certs from a TLS 1.2 client. Fixes: #1144 Fixes: #25277 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27166)	2025-03-31 14:07:56 +02:00
Viktor Dukhovni	60f2a71400	Fix goto label indents to match style ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27175)	2025-03-28 11:37:12 +01:00
Andrew Ioanoviciu	50f945117c	port_init(): Security hardening for token key ... Used RAND_priv_bytes_ex instead of RAND_bytes_ex to guarantee higher isolation for cryptographic keys. Replaced OPENSSL_free with OPENSSL_clear_free to wipe sensitive data and free it. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/27029)	2025-03-27 10:44:09 +01:00
jay9827342	e5e4cf41c7	Memory leak fix ktls_meth.c ... The OSSL_RECORD_LAYER needs to be properly freed when return code isnt success. Memory leak fix CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27111)	2025-03-25 20:22:23 +01:00
Bernd Edlinger	9f85a036e3	Try to fix reported qlog issues ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27089)	2025-03-24 20:20:14 +01:00
Tomas Mraz	83b11af017	qlog_event_helpers.c: Fix inverted condition ... We want to skip up to PACKET_remaining() and not "at least" PACKET_remaining() bytes. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27138)	2025-03-24 15:22:56 +01:00
Matt Caswell	95051052b3	Move the Handshake read secret change earlier in the process for QUIC 0-RTT ... On the server side we were changing the handshake rx secret a little late. This meant the application was forced to call SSL_do_handshake() again even if there was nothing to read in order to get the secret. We move it a little earlier int the process to avoid this. Fixes the issue described in: https://github.com/ngtcp2/ngtcp2/pull/1582#issuecomment-2735950083 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27101)	2025-03-20 20:22:39 +01:00
Matt Caswell	207cd5bb97	Fix the use of CCM ciphersuites with QUIC TLS API ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27091)	2025-03-20 11:24:26 +01:00
Matt Caswell	228a26fde4	Always use NULL BIOs when using the QUIC TLS API ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27091)	2025-03-20 11:24:26 +01:00
Matt Caswell	2100cf2ee0	Ensure SSL_get_app_data() continues to work even in SSL_free() ... During SSL_free() we may get a QUIC TLS callback being called to clean up any remaining record data. We should ensure that SSL_get_app_data() continues to work, even in this scenario. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27091)	2025-03-20 11:24:26 +01:00
Matt Caswell	4ad45969b0	Don't decrement the unreleased counter if we failed to release a record ... In a failure situation we may incorrectly decrement the amount of data released. Only decrement the counter if we successfully released. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27091)	2025-03-20 11:24:26 +01:00
openssl-machine	0c679f5566	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-03-12 13:35:59 +00:00
Viktor Dukhovni	91c6e157c6	Make group names case-insensitive ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26991)	2025-03-09 23:31:25 +01:00
Viktor Dukhovni	bcff020c36	Refactor sigalg handling ... - The default sigalg list now puts ML-DSA-65 first, then ML-DSA-87 and then ML-DSA-44. (87 vs. 44 Subject to bikeshedding). - The mintls and maxtls versions are now taken into account for both built-in and provided algorithms. - Some algorithms have a separate TLSv1.2-specific name for future reporting via openssl-list(1). - ML-DSA aside, any new provided algorithms go at the end of the default list (backwards-compatible inclusion). - The built-in algorithms now also have min/max DTLS versions. Though the provider TLS-SIGALG capability was extended to also report the DTLS version range, the minimum supported DTLS is 1.3, which we don't yet have, so it is not yet possible to add DTLS sigalgs via a provider - The TLS 1.3 brainpool sigalgs got their correct IANA names, with the legacy names as purported TLS 1.2 alternatives, but since these are for TLS 1.3 and up those names are for matching only, the reported value will still be the 1.3 name. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26975)	2025-03-09 23:19:37 +01:00
Neil Horman	9a308a89a4	Orphan packets from qrx ... It may occur that the qrx we allocate in port_default_packet handler to do AEAD validation isn't the one the channel ultimately uses (like if we turn off address validation). In that event, we need to ensure that anything we have on that qrx isn't returned to its free list to avoid early freeing when we free the qrx at the end of port_default_packet_handler, while those frames are still pending on the channel qrx Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27004)	2025-03-09 18:44:53 +01:00
Neil Horman	8f74d8cee3	If our server channel creates its own qrx, set its initial secret ... With the addition of larger client hellos, stemming from the use of larger PQC key shares, it may happen that we get a client hello accross multiple datagrams. Normally this is not a problem as port_default_packet_handler allocates a qrx and initializes its initial secret immediately. But if server address validation is disabled, then the channel creates the qrx in port_bind_channel itself, without initial secrets. As a result, we validate the first datagram in port_default_packet_handler, but the subsequent datagrams containing the remaining client hello fragments fail decode. Fix it by ensuring that we add the initial secret in port_bind_channel if we don't give it a preconfigured qrx Fixes openssl/project#1131 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27006)	2025-03-07 21:56:34 -05:00
Neil Horman	c0251d7b0f	Fix build on windows xp ... Windows XP doesn't support setting socket handles to be non-inheritable, but the rio_notifier attempts to do so. WSASocketA will there return an error when the NO_INHERIT flag is set. In that case, just retry the call without the flag. Fixes #26943 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26970)	2025-03-05 17:36:20 +01:00
daum3ns	30fbc68dd4	tls_validate_record_header(): Check for all HTTP methods ... The change checks for all HTTP methods in ssl_record, not only GET, POST, PUT and HEAD. (additionally PATCH, DELETE, OPTIONS and TRACE) CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26968)	2025-03-05 14:58:29 +01:00
Matt Caswell	5eb55ad8a7	Fix a compilation failure in AIX ... AIX (at least for 7.1) defines some macros for "events" and "revents" which interferes with our own use of these names. Fixes #24236 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26933)	2025-03-04 09:02:15 -05:00
Matt Caswell	aaad33c5ac	Move ssl_err.c into libcrypto ... We move ssl_err.c out of libssl and into libcrypto. This file is entirely self contained and is used to load error strings into the libcrypto error tables. By moving this file into libcrypto, libssl can be unloaded safely without having dangling references to this error information. Fixes #26672 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26931)	2025-03-01 14:46:03 -05:00
Andrew Dinh	442f1958e8	QUIC NULL checks ... - Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643029 - Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643030 - Fixes https://scan5.scan.coverity.com/#/project-view/62507/10222?selectedIssue=1643141 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26916)	2025-02-27 10:23:38 -05:00
Neil Horman	2ce46ad8ce	Change cipher suite alert for 0 length cipher_suites ... From RFC 8446: Note: TLS defines two generic alerts (see Section 6) to use upon failure to parse a message. Peers which receive a message which cannot be parsed according to the syntax (e.g., have a length extending beyond the message boundary or contain an out-of-range length) MUST terminate the connection with a "decode_error" alert. Peers which receive a message which is syntactically correct but semantically invalid (e.g., a DHE share of p - 1, or an invalid enum) MUST terminate the connection with an "illegal_parameter" alert. A zero length cipher suite list I think is considered out of range, and so we should return "decode_error" rather than "illegal_parameter" Fixes #25309 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26781)	2025-02-25 15:31:45 -05:00
Alexandr Nedvedicky	395a83a617	Fix read out of buffer bounds when dealing with BIO_ADDR ... This issue was discoevered while I was testing SSL_new_from_listener() using a newly created unit test. It has turned out the QUIC stack at few places contain pattern as follows: foo(QUIC_WHATEVER *q, BIO_ADDR *a) { q->a = *a; } The problem is that derefencning a that way is risky. If the address `a` comes from BIO_lookup_ex() it may actually be shorter than sizeof(BIO_ADDR). Using BIO_ADDR_copy() is the right thing to do here. Fixes #26241 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26252)	2025-02-25 15:55:46 +01:00
Tomas Mraz	be5965acad	add_uris_recursive(): Avoid OSSL_STORE_INFO leak on error ... Fixes #26480 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26511)	2025-02-25 15:50:45 +01:00
Tomas Mraz	87b5aa737d	Rename fnv1a_hash() to ossl_fnv1a_hash() ... It is no longer static. Also add it to libssl only with quic enabled. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26882)	2025-02-25 15:45:42 +01:00