1119 Commits

Author	SHA1	Message	Date
Matt Caswell	610cc1e7ad	Fail immediately if we have no key shares to send ... If we are configured in such a way that we have no valid key shares to send in the ClientHello we should immediately abort the connection. Fixes #28281 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28283) (cherry picked from commit 47b0f172aa)	2025-08-20 09:49:57 +01:00
noctuelles	cd329b8795	fix: msg callback in dtls1_do_write that incorrectly shows message (like a certificate) that spans over multiple fragments. ... Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27811) (cherry picked from commit de5a619aa0)	2025-06-30 11:25:21 +01:00
Sergey Kandaurov	45bd3c3798	Preserve connection custom extensions in SSL_set_SSL_CTX() ... The SSL_set_SSL_CTX() function is used to switch SSL contexts for the given SSL object. If contexts differ, this includes updating a cert structure with custom extensions from the new context. This however overwrites connection custom extensions previously set on top of inherited from the old context. The fix is to preserve connection custom extensions using a newly introduced flag SSL_EXT_FLAG_CONN in custom_ext_copy_conn(). Similar to custom_ext_copy(), it is a no-op if there are no custom extensions to copy. The only such consumer is ossl_quic_tls_configure() used to set the "quic_transport_parameters" extension. Before this change, context switch resulted in transport parameters not being sent due to the missing extension. Initially reported at https://github.com/nginx/nginx/issues/711 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27706) (cherry picked from commit 403ba31a02)	2025-06-20 15:56:58 +01:00
Sergey Kandaurov	be4e3977b1	Add a helper function to copy custom extensions with old style arguments ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27706) (cherry picked from commit f7b10004dc)	2025-06-20 15:56:58 +01:00
yexiaochuan	6e250f9573	fix: add parsing check in TLS compress_certificate extension handler ... The tls_parse_compress_certificate function was missing validation for trailing bytes after parsing the algorithm list, violating RFC8446 section 4.2 which requires sending a decode_error alert for unparseable messages. This commit adds a check for remaining bytes in the packet after the while loop and sends SSL_AD_DECODE_ERROR if any trailing bytes are found. Fixes #27717 CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27733) (cherry picked from commit 8e787b1028)	2025-06-10 19:39:52 +02:00
Matt Caswell	1312091fc9	Ensure client read app data secret change occurs after write for QUIC ... We don't want read secrets to be issue before write for QUIC, because we want to avoid the situation where we want to ack something we've read but we don't have the write secret yet. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27732) (cherry picked from commit 098cfd216b)	2025-06-03 17:08:40 +01:00
Matt Caswell	2d21ae4868	Implement explicit storing of the server_finished_hash ... tls13_change_cipher_state was storing the server_finished_hash as a side effect of its operation. This decision is better made by the state machine which actually knows what state we are in. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27732) (cherry picked from commit c7f9c4d7d1)	2025-06-03 17:08:40 +01:00
Matt Caswell	8d188688af	Ensure client read handshake secret change occurs after write for QUIC ... We don't want read secrets to be issue before write for QUIC, because we want to avoid the situation where we want to ack something we've read but we don't have the write secret yet. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27732) (cherry picked from commit 86e7579262)	2025-06-03 17:08:40 +01:00
Matt Caswell	b1479d02b7	Implement explicit storing of the handshake_traffic_hash ... tls13_change_cipher_state was storing the handshake_traffic_hash as a side effect of its operation. This decision is better made by the state machine which actually knows what state we are in. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27732) (cherry picked from commit 4579a18cf5)	2025-06-03 17:08:40 +01:00
Anton Tieleman	66e8a0ad8c	Test+fix handling "wrong" downgrade signals ... This accounts for cases that can only occur when een non-compliant server sends the wrong downgrade signal. (TLS1.1 signal when negotiating TLS1.2 or TLS1.2 signal when negotiating TLS1.0/TLS1.1). According to the TLS1.3 RFC these cases should be rejected: RFC8446, section 4.1.3: TLS 1.3 clients receiving a ServerHello indicating TLS 1.2 or below MUST check that the last 8 bytes are not equal to either of these values. TLS 1.2 clients SHOULD also check that the last 8 bytes are not equal to the second value if the ServerHello indicates TLS 1.1 or below. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27518) (cherry picked from commit 290fd4a0c8)	2025-04-29 19:32:07 +02:00
Andrey Tsygunka	5554ef6f1d	Fix potential NULL pointer dereference in final_maxfragmentlen() ... In the final_maxfragmentlen() function, s->session is checked for NULL after it was dereferenced earlier. So move this NULL check to the top of the function. CLA: trivial Fixes: fa49560451 (Fix handling of max_fragment_length extension for PSK) Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/27272) (cherry picked from commit 28de1f5004)	2025-04-14 15:54:36 +01:00
Benjamin Kaduk	d48c2cb6ec	statem: always save sigalgs during PHA ... We use the same extension-parsing function on server and client for convenience, but while the server might worry about tracking what was previously received and not overwriting it, on the client receiving a request for post-handshake authentication, we always want to use the values from the current extension (and should always have a new session object that we are free to mutate). It is somewhat unclear whether the server also needs the check for a resumed connection; it appears to have been added back in 2015 in commit 062178678f as part of a broad pass to handle extensions on resumption, but without specific documentation of each extension's handling. Fixes: #10370 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24651) (cherry picked from commit ddd99d52d3)	2025-04-01 15:11:47 +02:00
Viktor Dukhovni	a7f3550855	Fix sigalg corner cases ... - Tolerate RSA PKCS#1 *certificate* signatures when the peer sigals include RSA PSS with the same digest. Now that we're more strict about not sending sigalgs that are out of protocol range, when the client supports TLS 1.3 only, we might refuse to return an RSA PKCS#1-signed cert. - Don't send TLS 1.3 sigalgs when requesting client certs from a TLS 1.2 client. Fixes: #1144 Fixes: #25277 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27166) (cherry picked from commit a5f98e6da5)	2025-03-31 14:08:12 +02:00
Matt Caswell	fb55383c65	Move the Handshake read secret change earlier in the process for QUIC 0-RTT ... On the server side we were changing the handshake rx secret a little late. This meant the application was forced to call SSL_do_handshake() again even if there was nothing to read in order to get the secret. We move it a little earlier int the process to avoid this. Fixes the issue described in: https://github.com/ngtcp2/ngtcp2/pull/1582#issuecomment-2735950083 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27101) (cherry picked from commit 95051052b3)	2025-03-20 20:22:53 +01:00
openssl-machine	0c679f5566	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-03-12 13:35:59 +00:00
Tomas Mraz	0b40fac3fb	tls_construct_ctos_key_share(): Fix handling of HRR without key share request ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26801)	2025-02-25 15:34:24 +01:00
Cheng Zhang	1b3f27f920	Add the SSL_NO_EOED internal macro ... The TLS EndOfEarlyData message is not applicable in some scenarios (e.g., QUIC). This adds a macro to handle this message. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26552)	2025-02-19 17:27:04 +01:00
Neil Horman	84694d2baa	Relax checking of supported-groups/keyshare ordering ... quic interop testing showed that interop with the mvfst client was failing, due to detecting mis ordering of supported groups and keyshare extensions This is strictly a mvfst problem to fix, but RFC 8446 indicates that we MAY check the ordering but don't strictly have to. We've opened an issue with the client to fix this, but in the interests of client compatibility relax the ordering check so that, instead of issuing a fatal alert, we just log a trace message indicating the discrepancy Fixes openssl/project#1106 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26818)	2025-02-19 17:08:53 +01:00
Frederik Wedel-Heinen	00fbc96988	Adds missing checks of return from XXX_up_ref(). ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26294)	2025-02-18 16:32:59 +01:00
Hugo Landau	bf55326752	libssl: Move SSL object unwrapping macros to separate header ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23334)	2025-02-17 11:27:32 -05:00
Viktor Dukhovni	739c4b2e92	Use ERR marks also when verifying server X.509 certs ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org>	2025-02-11 08:26:51 -05:00
Viktor Dukhovni	6ae8e947d8	With SSL_VERIFY_PEER client RPK should abort on X509 error ... While RPK performs X.509 checks correctly, at the SSL layer the SSL_VERIFY_PEER flag was not honoured and connections were allowed to complete even when the server was not verified. The client can of course determine this by calling SSL_get_verify_result(), but some may not know to do this. Added tests to make sure this does not regress. Fixes CVE-2024-12797 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org>	2025-02-11 08:26:44 -05:00
Dave Kelsey	d69c014608	Add support for multiple key shares ... This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)	2025-02-10 11:43:56 -05:00
cx	0f6caf7409	Reject invalid FFDHE and ECDHE key shares with SSL_AD_ILLEGAL_PARAMETER alert ... This changes the alert according to RFC 8446. Fixes: #25402 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25547)	2025-01-02 14:12:54 +01:00
willmafh	764a876b64	Delete a redundant break ... CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)	2024-12-06 15:25:47 +01:00
Peiwei Hu	1273fae170	Fix multiple wrong checks of EVP_PKEY_set1_encoded_public_key ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25811)	2024-11-22 12:09:38 +01:00
Andrew Dinh	ef39dd058b	Change "a SSL" to "an SSL" ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/25868)	2024-11-13 17:24:40 +01:00
Matt Caswell	dc84829cc5	Make sure we use the correct SSL object when making a callback ... When processing a callback within libssl that applies to TLS the original SSL object may have been created for TLS directly, or for QUIC. When making the callback we must make sure that we use the correct SSL object. In the case of QUIC we must not use the internal only SSL object. Fixes #25788 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25874)	2024-11-07 12:05:34 +01:00
Todd Short	a590a7e3bc	Use correct alerts for some cert comp errors ... Fixes #25471 Signed-off-by: Todd Short <todd.short@me.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25845)	2024-11-04 11:50:46 +01:00
Niels Dossche	b2474b287f	Fix memory leak in tls_parse_ctos_psk() ... `sess` is not NULL at this point, and is freed on the success path, but not on the error path. Fix this by going to the `err` label such that `SSL_SESSION_free(sess)` is called. CLA: trivial Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25643)	2024-10-11 14:54:03 +02:00
FdaSilvaYY	2bb83824bb	ssl: rework "e_os.h" inclusions ... - Remove e_os.h include from "ssl_local.h" - Added e_os.h into the files that need it now. - Move e_os.h to be the very first include Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14344)	2024-09-05 17:02:51 +02:00
Tomas Mraz	7ed6de997f	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2024-09-05 09:35:49 +02:00
Viktor Dukhovni	b4e4bf29ba	Check for excess data in CertificateVerify ... As reported by Alicja Kario, we ignored excess bytes after the signature payload in TLS CertificateVerify Messages. These should not be present. Fixes: #25298 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25302)	2024-08-29 19:32:00 +02:00
erbsland-dev	c026101be0	Correct Alert Handling for Missing Compression Methods ... Fixes #7940: Updated the compression check logic to improve protocol compliance. The code now returns `SSL_AD_DECODE_ERROR` when no compression method is provided in the ClientHello message. It returns `SSL_AD_ILLEGAL_PARAMETER` if the “null” compression method (0x00) is missing. Additionally, refactored the related test code for enhanced readability and maintainability. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25255)	2024-08-29 19:16:38 +02:00
slontis	14c45338e9	EVP_MD_size() updates ... For SHAKE algorithms we now return 0 from EVP_MD_size(). So all the places that check for < 0 needed to change to <= 0 (Otherwise the behaviour will be to digest nothing in most cases). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25285)	2024-08-29 10:29:53 +02:00
Matt Caswell	60358f2c5e	Fix the alert used on a missing key_share ... RFC8446 requires we send an illegal_parameter alert if we don't get a key_share back from the server and our kex_modes require one. We were instead reporting this as missing_extension. Fixes #25040 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25059)	2024-08-21 15:35:51 +02:00
Bhaskar Metiya	02b8b7b836	Return SSL_AD_DECRYPT_ERROR alert on PSK binder validation failure (RFC 8446) ... CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/25176)	2024-08-15 11:21:24 +02:00
Matt Caswell	293d0a0052	Check that a supported_versions extension is present in an HRR ... If an HRR is sent then it MUST contain supported_versions according to the RFC. We were sanity checking any supported_versions extension that was sent but failed to verify that it was actually present. Fixes #25041 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25068)	2024-08-07 19:34:23 +02:00
Dimitri Papadopoulos	962431d58b	that open brace { should be on the previous line ... Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22097)	2024-07-22 06:55:35 -04:00
Dimitri Papadopoulos	1cf2f8231e	Remove trailing whitespace ... Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22097)	2024-07-22 06:55:35 -04:00
Gerd Hoffmann	d7af3f7aa7	fix vs2019 warning ... windows vs2019 throws warnings when compiling openssl for edk2: ERROR - Compiler #2220 from [2024-07-15 13:43:34] [build-stdout] d:\a\edk2\edk2\CryptoPkg\Library\OpensslLib\openssl\ssl\statem\statem_clnt.c(1895) : the following warning is treated as an error WARNING - Compiler #4701 from [2024-07-15 13:43:34] [build-stdout] d:\a\edk2\edk2\CryptoPkg\Library\OpensslLib\openssl\ssl\statem\statem_clnt.c(1895) : potentially uninitialized local variable 'peer_rpk' used WARNING - Compiler #4703 from [2024-07-15 13:43:34] [build-stdout] d:\a\edk2\edk2\CryptoPkg\Library\OpensslLib\openssl\ssl\statem\statem_clnt.c(1895) : potentially uninitialized local pointer variable 'peer_rpk' used Explicitly initialize the peer_rpk variable to make the compiler happy. Yes, it's a false positive, but you have to check the tls_process_rpk() body in another source file to see that, which apparently is beyond the compiler's capabilities. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24895)	2024-07-18 16:13:41 +02:00
Matt Caswell	238fa464d6	Add ALPN validation in the client ... The ALPN protocol selected by the server must be one that we originally advertised. We should verify that it is. Follow on from CVE-2024-5535 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24716)	2024-06-27 10:30:51 +01:00
Matt Caswell	e10a3a84bf	Correct return values for tls_construct_stoc_next_proto_neg ... Return EXT_RETURN_NOT_SENT in the event that we don't send the extension, rather than EXT_RETURN_SENT. This actually makes no difference at all to the current control flow since this return value is ignored in this case anyway. But lets make it correct anyway. Follow on from CVE-2024-5535 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24716)	2024-06-27 10:30:51 +01:00
Matt Caswell	c6e1ea2235	More correctly handle a selected_len of 0 when processing NPN ... In the case where the NPN callback returns with SSL_TLEXT_ERR_OK, but the selected_len is 0 we should fail. Previously this would fail with an internal_error alert because calling OPENSSL_malloc(selected_len) will return NULL when selected_len is 0. We make this error detection more explicit and return a handshake failure alert. Follow on from CVE-2024-5535 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24716)	2024-06-27 10:30:51 +01:00
Frederik Wedel-Heinen	fa49560451	Fix handling of max_fragment_length extension for PSK ... A psk session was assumed to be a resumption which failed a check when parsing the max_fragment_length extension hello from the client. Relevant code from PR#18130 which was a suggested fix to the issue was cherry-picked. Fixes #18121 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24513)	2024-06-20 16:49:51 +02:00
sashan	da9342ed5e	Move stack of compression methods from libssl to OSSL_LIB_CTX ... The compression methods are now a global variable in libssl. This change moves it into OSSL library context. It is necessary to eliminate atexit call from libssl. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24414)	2024-05-28 08:56:13 +02:00
irosay	3e9d933882	Release pkey_ctx on initialization failure ... CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24366)	2024-05-14 17:58:34 +02:00
Matt Caswell	91c7ab27ce	Set the server sig algs before calling the session_secret_cb ... Setting the server sig algs sets up the certificate "s3->tmp.valid_flags". These are needed when calling ssl3_choose_cipher() which can happen immediately after calling the session_secret_cb Fixes #24213 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24309)	2024-05-06 10:44:14 +02:00
Jiasheng Jiang	48e3cf25a8	ssl/statem: Replace size_t with int and add the checks ... Replace the type of variables with int to avoid implicit conversion when it is assigned by EVP_MD_get_size(). Moreover, add the checks to avoid integer overflow. Fixes: 6594189 ("Merge early_data_info extension into early_data") Fixes: 9368f86 ("Add TLSv1.3 client side external PSK support") Fixes: 1053a6e ("Implement Server side of PSK extension parsing") Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23937)	2024-04-26 09:28:55 +02:00
Tim Perry	972ee925b1	Use empty renegotiate extension instead of SCSV for TLS > 1.0 ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24161)	2024-04-22 13:23:28 +01:00