summaryrefslogtreecommitdiff
path: root/lib/libcrypto
AgeCommit message (Collapse)Author
2021-04-20Fix indent of EC_METHODs as requested by jsing.Theo Buehler
While there zap trailing whitespace from a KNF approximation gone wrong.
2021-04-20Compare pointer against NULL and fix a KNF issue.Theo Buehler
ok jsing
2021-04-20Prepare to provide EC_POINT_set_compressed_coordinatesTheo Buehler
ok jsing
2021-04-20Compare function pointers against NULL, not 0.Theo Buehler
ok jsing
2021-04-20Provide EC_POINT_{g,s}et_Jprojective_coordinates for internal useTheo Buehler
ok jsing
2021-04-20Simplify code after adding EC_POINT_{s,g}et_affine_coordinates()Theo Buehler
ok jsing
2021-04-20Compare function pointers against NULL, not 0.Theo Buehler
ok jsing
2021-04-20Prepare to provide EC_POINT_{g,s}et_affine_coordinatesTheo Buehler
Similar to part of OpenSSL commit 8e3cced75fb5fee5da59ebef9605d403a999391b ok jsing
2021-04-20Simplify after EC_POINT_get_curve() additionTheo Buehler
ok jsing
2021-04-20Compare function pointers against NULL, not 0.Theo Buehler
ok jsing
2021-04-20Prepare to provide EC_GROUP_{get,set}_curve(3)Theo Buehler
There are numerous functions in ec/ that exist with _GF2m and _GFp variants for no good reason. The code of both variants is the same. The EC_METHODs contain a pointer to the appropriate version. This commit hides the _GF2m and _GFp variants from internal use and provides versions that work for both curve types. These will be made public in an upcoming library bump. Similar to part of OpenSSL commit 8e3cced75fb5fee5da59ebef9605d403a999391b ok jsing
2021-04-19Avoid division by zero in hybrid point encodingTheo Buehler
In hybrid and compressed point encodings, the form octet contains a bit of information allowing to calculate y from x. For a point on a binary curve, this bit is zero if x is zero, otherwise it must match the rightmost bit of of the field element y / x. The existing code only considers the second possibility. It could thus fail with a division by zero error as found by Guido Vranken's cryptofuzz. This commit adds a few explanatory comments to oct2point and fixes some KNF issues. The only actual code change is in the last hunk which adds a BN_is_zero(x) check to avoid the division by zero. ok jsing
2021-04-15Switch back to the legacy verifier for the release.Theo Buehler
This is disappointing as a lot of work was put into the new verifier during this cycle. However, there are still too many known bugs and incompatibilities. It is better to be faced with known broken behavior than with new broken behavior and to switch now rather than via errata. This way we have another cycle to iron out the kinks and to fix some of the remaining bugs. ok jsing
2021-04-05Don't leak param->name in x509_verify_param_zero()Theo Buehler
For dynamically allocated verify parameters, param->name is only ever set in X509_VERIFY_set1_name() where the old one is freed and the new one is assigned via strdup(). Setting it to NULL without freeing it beforehand is a leak. looks correct to millert, ok inoguchi
2021-03-31Bump minors after symbol additionTheo Buehler
2021-03-31Expose various DTLSv1.2 specific functions and definesTheo Buehler
ok bcook inoguchi jsing
2021-03-31Provide missing prototype for d2i_DSAPrivateKey_fp(3)Theo Buehler
ok bcook inoguchi jsing
2021-03-31Document EVP_PKEY_new_CMAC_key(3)Theo Buehler
ok bcook inoguchi jsing
2021-03-31Provide EVP_PKEY_new_CMAC_key(3)Theo Buehler
ok bcook inoguchi jsing
2021-03-29Prepare documenting EVP_PKEY_new_CMAC_key(3)Theo Buehler
Based on some text in OpenSSL 1.1.1's EVP_PKEY_new.pod.
2021-03-29Prepare to provide EVP_PKEY_new_CMAC_key()Theo Buehler
sebastia ran into this when attempting to update security/hcxtools. This will be tested via wycheproof.go once the symbol is public. ok jsing, tested by sebastia
2021-03-25Avoid mangled output in BIO_debug_callbackTheo Buehler
Instead of blindly skipping 14 characters, we can use the return value of snprintf() to determine how much we should skip. From Martin Vahlensieck with minor tweaks by me
2021-03-19Fix copy-paste error in previousTheo Buehler
Found the hard way by lists y42 org via an OCSP validation failure that in turn caused pkg_add over TLS to fail. Detailed report by sthen. ok sthen
2021-03-13Use EXFLAG_INVALID to handle out of memory and parse errors intobhe
x509v3_cache_extensions(). ok tb@
2021-03-12Zap a useless variable.Theo Buehler
suggested by jsing
2021-03-12Missing void in function definitionTheo Buehler
ok jsing
2021-03-12Fix checks of memory caps of constraints namesTheo Buehler
x509_internal.h defines caps on the number of name constraints and other names (such as subjectAltNames) that we want to allocate per cert chain. These limits are checked too late. In a particularly silly cert that jan found on ugos.ugm.ac.id 443, we ended up allocating six times 2048 x509_constraint_name structures before deciding that these are more than 512. Fix this by adding a names_max member to x509_constraints_names which is set on allocation against which each addition of a name is checked. cluebat/ok jsing ok inoguchi on earlier version
2021-03-12spelling: refenece -> referenceJason McIntyre
2021-03-12spellingJonathan Gray
2021-03-07LibreSSL 3.3.2Brent Cook
2021-02-26Set is_trusted in x509_verify_ctx_add_chain()Theo Buehler
If we're about to add a chain we have a trust path, so we have at least one trusted certificate. This fixes a thinko from r1.31 and fixes the openssl(1) cms verify test. ok jsing (who had the same diff)
2021-02-25Fix two bugs in the legacy verifierTheo Buehler
To integrate the new X.509 verifier, X509_verify_cert() was refactored. The code building chains in the legacy verifier was split into a separate function. The first bug is that its return value was treated as a Boolean although it wasn't. Second, the return alone is not enough to decide whether to carry on the validation or not. Slightly rearrange things to restore the behavior of the legacy verifier prior to this refactoring. Issue found and test case provided by Anton Borowka and jan. ok jan jsing
2021-02-25Rename depth to num_untrusted so it identifies what it actually represents.Joel Sing
ok tb@
2021-02-25Avoid passing last and depth to x509_verify_cert_error() on ENOMEM.Joel Sing
In x509_verify_ctx_set_xsc_chain(), an ENOMEM case is currently passing the last certificate and depth (which is no longer actually depth) to x509_verify_cert_error(). Given we've hit an ENOMEM situation, neither of these are useful so remove both. ok tb@
2021-02-24Fix comment explaining last_untrusted. This should really be calledTheo Buehler
num_untrusted, but unfortunately it's public... ok jsing tobhe
2021-02-24Make the new validator check for EXFLAG_CRITICALTheo Buehler
As should be obvious from the name and the comment in x509_vfy.h int last_untrusted; /* index of last untrusted cert */ last_untrusted actually counts the number of untrusted certs at the bottom of the chain. Unfortunately, an earlier fix introducing x509_verify_set_xsc_chain() assumed that last_untrusted actually meant the index of the last untrusted cert in the chain, resulting in an off-by-one, which in turn led to x509_vfy_check_chain_extension() skipping the check for the EXFLAG_CRITICAL flag. A second bug in x509_verify_set_xsc_chain() assumed that it is always called with a trusted root, which is not necessarily the case anymore. Address this with a temporary fix which will have to be revisited once we will allow chains with more than one trusted cert. Reported with a test case by tobhe. ok jsing tobhe
2021-02-18Pull in fix for EVP_CipherUpdate() overflow from OpenSSL.Theo Buehler
ok inoguchi commit 6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1 Author: Matt Caswell <matt@openssl.org> Date: Tue Feb 2 17:17:23 2021 +0000 Don't overflow the output length in EVP_CipherUpdate calls CVE-2021-23840 Reviewed-by: Paul Dale <pauli@openssl.org>
2021-02-12Sync cert.pem with Mozilla NSS root CAs, except "GeoTrust Global CA", ok tb@Stuart Henderson
Notably this update removes various old Symantec roots (GeoTrust, thawte, VeriSign) that were set in NSS to be distrusted on 1/1/2021. Nobody should have been using these for years; only certain subCAs signed by these were valid in NSS in that time due to an exemption: https://wiki.mozilla.org/CA/Additional_Trust_Changes#Symantec Notably Apple's "Apple IST CA 2 - G1" which is still in use for some endpoints (it is cross signed by another CA too but these endpoints are publishing the GeoTrust intermediate cert). So for now I have skipped removal of "GeoTrust Global CA" to avoid affecting these sites. Debian ran into this when they updated their cert database and had to back this part out, affected sites are not reachable on Android Firefox and maybe other newer Firefoxes. Some sites that were affected have moved to a different CA in the last few days but others, notably api.push.apple.com, remain (I can only guess that there is a complicated problem involved, possibly cert pinning on old devices - the clock is ticking though as this expires in May 2022 anyway ;) Additions: /C=RO/O=CERTSIGN SA/OU=certSIGN ROOT CA G2 /C=HU/L=Budapest/O=Microsec Ltd./2.5.4.97=VATHU-23584497/CN=e-Szigno Root CA 2017 /C=KR/O=NAVER BUSINESS PLATFORM Corp./CN=NAVER Global Root Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global ECC P256 Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global ECC P384 Certification Authority Removals: /C=US/O=GeoTrust Inc./CN=GeoTrust Primary Certification Authority /C=US/O=GeoTrust Inc./CN=GeoTrust Universal CA /C=US/O=GeoTrust Inc./CN=GeoTrust Universal CA 2 /C=US/O=GeoTrust Inc./OU=(c) 2008 GeoTrust Inc. - For authorized use only/CN=GeoTrust Primary Certification Authority - G3 /C=TW/O=Government Root Certification Authority /C=LU/O=LuxTrust S.A./CN=LuxTrust Global Root 2 /C=US/O=thawte, Inc./OU=(c) 2007 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G2 /C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA /C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2008 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G3 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 1999 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G3 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2007 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G4 /C=CH/O=WISeKey/OU=Copyright (c) 2005/OU=OISTE Foundation Endorsed/CN=OISTE WISeKey Global Root GA CA
2021-02-11KNFTheo Buehler
2021-02-03Add OID for draft-ietf-opsawg-finding-geofeedsjob
https://tools.ietf.org/html/draft-ietf-opsawg-finding-geofeeds describes a mechanism to authenticate RFC 8805 Geofeed data files through the RPKI. OpenSSL counterpart https://github.com/openssl/openssl/pull/14050 OK tb@ jsing@
2021-02-02Add a bunch of RPKI OIDsjob
RFC6482 - A Profile for Route Origin Authorizations (ROAs) RFC6484 - Certificate Policy (CP) for the RPKI RFC6493 - The RPKI Ghostbusters Record RFC8182 - The RPKI Repository Delta Protocol (RRDP) RFC8360 - RPKI Validation Reconsidered draft-ietf-sidrops-rpki-rta - A profile for RTAs Also in OpenSSL: https://github.com/openssl/openssl/commit/d3372c2f35495d0c61ab09daf7fba3ecbbb595aa OK sthen@ tb@ jsing@
2021-01-09Set chain on xsc on chain build failure.Joel Sing
Prior to calling the callback, ensure that the current (invalid and likely incomplete) chain is set on the xsc. Some things (like auto chain) depend on this functionality. ok beck@
2021-01-09Bail out early after finding an single chain if we are have been called fromBob Beck
x509_vfy and have an xsc. There's no point in finding more chains since that API can not return them, and all we do is trigger buggy callbacks in calling software. ok jsing@
2021-01-08search the intermediates only after searching the root certs, clarifyBob Beck
this in the comments. helps avoid annoying situations with the legacy callback ok jsing@
2021-01-05Handle X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE in new verifier.Joel Sing
Yet another mostly meaningless error value... Noted by and ok tb@
2021-01-05Gracefully handle root certificates being both trusted and untrusted.Joel Sing
When a certificate (namely a root) is specified as both a trusted and untrusted certificate, the new verifier will find multiple chains - the first being back to the trusted root certificate and a second via the root that is untrusted, followed by the trusted root certificate. This situation can be triggered by a server that (unnecessarily) includes the root certificate in its certificate list. While this validates correctly (using the first chain), it means that we encounter a failure while building the second chain due to the root certificate already being in the chain. When this occurs we call the verify callback indicating a bad certificate. Some sensitive software (including bacula and icinga), treat this single bad chain callback as terminal, even though we successfully verify the certificate. Avoid this problem by simply dumping the chain if we encounter a situation where the certificate is already in the chain and also a trusted root - we'll have already picked up the trusted root as a shorter path. Issue with icinga2 initially reported by Theodore Wynnychenko. Fix tested by sthen@ for both bacula and icinga2. ok tb@
2021-01-05double word fix; from martin vahlensieckJason McIntyre
2020-12-16Remove two reduntat memset calls.Theo Buehler
pointed out by jsing
2020-12-16Avoid potential use of uninitialized in ASN1_time_parseTheo Buehler
When parsing an UTCTime into a struct tm that wasn't cleared by the caller, the years would be added to the already present value, which could give an incorrect result. This is an issue in ASN1_UTCTIME_cmp_time_t(), which is practically unused. Fix this by always zeroing the passed struct tm. Issue reported by Olivier Taïbi, thanks! ok jsing
2020-12-16Fix some KNF issuesTheo Buehler
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 06:03:53 +0000