summaryrefslogtreecommitdiffstats
path: root/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Always call endservent_r() after getservbyport_r().eric2020-12-212-13/+17
| | | | | | Fix a memory leak when no entry is matched. ok florian
* Remove two reduntat memset calls.tb2020-12-162-5/+2
| | | | pointed out by jsing
* Avoid potential use of uninitialized in ASN1_time_parsetb2020-12-161-4/+3
| | | | | | | | | | | When parsing an UTCTime into a struct tm that wasn't cleared by the caller, the years would be added to the already present value, which could give an incorrect result. This is an issue in ASN1_UTCTIME_cmp_time_t(), which is practically unused. Fix this by always zeroing the passed struct tm. Issue reported by Olivier Taïbi, thanks! ok jsing
* Fix some KNF issuestb2020-12-161-7/+8
|
* Use natural sizes for S3I(s)->tmp's *_md arraystb2020-12-151-6/+4
| | | | | | | | | | | | | | | | | | | | It is a historical artifact that cert_verify_md[], finish_md[] and peer_finish_md[] are twice as large as they need to be. This is confusing, especially for finish_md[] and peer_finish_md[] which are copied to to previous_client_finished[] and previous_server_finished[] which are only half as large. It is easy to check that they will never get more than EVP_MAX_MD_SIZE data written to them. In 1998, EVP_MAX_MD_SIZE was 20 bytes long (for SHA-1). This got bumped to 16+20 for the SSLv3-specific md5+sha1. Apparently under the impression that EVP_MAX_MD_SIZE was still 20 bytes, someone else doubled finish_md[]'s size to EVP_MAX_MD_SIZE*2 and added /* actually only needs to be 16+20 */. A bit later finish_md[] was split up, and still a bit later the comment was amended for TLSv1. Shortly thereafter SHA-512 required a bump of EVP_MAX_MD_SIZE to 64 by a third person and we have been carrying 192 bytes of untouched memory in each of our SSLs ever since. ok inoguchi jsing (jsing had the same diff)
* typo fix from aisha tammy; ok nicmjmc2020-12-151-3/+3
|
* Fix return value variable type in tls_keypair_load_certinoguchi2020-12-151-2/+2
| | | | | | | ERR_peek_error() returns unsigned long. Reported by github issue by @rozhuk-im. ok bcook@ jsing@
* switch over ncurses to --enable-constnaddy2020-12-143-11/+11
| | | | | | | | | | ncurses has a configure option that adds a few more consts to its headers by way of the NCURSES_CONST define. Starting with version 6.0, this has become the default. OpenBSD is still on ncurses 5.7, but FreeBSD and Linux have moved on. Enable the additional consts to eliminate compiler warnings when sharing code with other platforms. ok deraadt@ millert@
* Fix SSL_get{,_peer}_finished() with TLSv1.3tb2020-12-142-2/+28
| | | | | | | | | | As reported by Steffen Ullrich and bluhm, the Finished tests in p5-Net-SSLeay's t/local/43_misc_functions.t broke with with TLSv1.3. The reason for this is that we don't copy the MDs over to the SSL, so the API functions can't retrieve them. This commit fixes this part of the test (one unrelated test still fails). ok inoguchi jsing
* Switch finish{,_peer}_md_len from int to size_ttb2020-12-141-3/+3
| | | | | | | This is the natural type for these and it simplifies an upcoming commit. The few consumers have been carefully checked to be fine with this. ok inoguchi jsing
* Geode CPU does not support SSE, so MXCSR does not exists there. Asbluhm2020-12-133-9/+3
| | | | | | | | our i386 compiler does not generate SSE instructions by default, it is not strictly necessary to save MXCSR content between setjmp(3) and longjmp(3). We do not want to end supporting such old processors now. Remove the stmxcsr and ldmxcsr instructions from libc. reported by Johan Huldtgren; OK jsg@ kettenis@
* LibreSSL 3.3.1bcook2020-12-081-3/+3
|
* Fix a NULL dereference in GENERAL_NAME_cmp()tb2020-12-086-11/+94
| | | | | | | | | | | | Comparing two GENERAL_NAME structures containing an EDIPARTYNAME can lead to a crash. This enables a denial of service attack for an attacker who can control both sides of the comparison. Issue reported to OpenSSL on Nov 9 by David Benjamin. OpenSSL shared the information with us on Dec 1st. Fix from Matt Caswell (OpenSSL) with a few small tweaks. ok jsing
* Convert the per-process thread list into a SMR_TAILQ.mpi2020-12-071-5/+6
| | | | | | | Currently all iterations are done under KERNEL_LOCK() and therefor use the *_LOCKED() variant. From and ok claudio@
* On i386 setjmp(3) should store the FPU state and longjmp(3) restorebluhm2020-12-063-3/+15
| | | | | | it. There is enough space in jmp_buf to save MXCSR and CW register. Idea taken from amd64. This fixes regress/lib/libc/setjmp-fpu . OK kettenis@
* Introduce constants to access the setjmp(3) jmp_buf fields frombluhm2020-12-063-76/+79
| | | | | | | i386 libc. The assembler code is more readable than with magic numbers. This brings i386 in line with amd64. No change in object file. OK kettenis@
* Mark bitmask_{start,end}_values[] and g_probable_mtu[] const.tb2020-12-051-4/+4
| | | | ok jsing kn
* Mark nid_list[] const. This moves 116 bytes to .rodata.tb2020-12-051-2/+2
| | | | ok jsing kn
* Move point-on-curve check to set_affine_coordinatestb2020-12-044-18/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bad API design makes it possible to set an EC_KEY public key to a point not on the curve. As a consequence, it was possible to have bogus ECDSA signatures validated. In practice, all software uses either EC_POINT_oct2point*() to unmarshal public keys or issues a call to EC_KEY_check_key() after setting it. This way, a point on curve check is performed and the problem is mitigated. In OpenSSL commit 1e2012b7ff4a5f12273446b281775faa5c8a1858, Emilia Kasper moved the point-on-curve check from EC_POINT_oct2point to EC_POINT_set_affine_coordinates_*, which results in more checking. In addition to this commit, we also check in the currently unused codepath of a user set callback for setting compressed coordinates, just in case this will be used at some point in the future. The documentation of EC_KEY_check_key() is very vague on what it checks and when checks are needed. It could certainly be improved a lot. It's also strange that EC_KEY_set_key() performs no checks, while EC_KEY_set_public_key_affine_coordinates() implicitly calls EC_KEY_check_key(). It's a mess. Issue found and reported by Guido Vranken who also tested an earlier version of this fix. ok jsing
* grammar fixes from Varik "The Genuine Article!!!" Valefor;jmc2020-12-036-17/+17
|
* There are special rules regarding the memory passed to pthread_attr_setstack().otto2020-12-031-7/+8
| | | | ok semarie@
* Set type to DB_RECNO in __rec_open() for consistency with other db types.millert2020-12-011-1/+2
| | | | From Boudewijn Dijkstra
* Bring back *_client_method() structstb2020-12-013-11/+200
| | | | | | | | | | | | | | | | | | | | | | | | | | The method unification broke an API promise of SSL_is_server(). According to the documentation, calling SSL_is_server() on SSL objects constructed from generic and server methods would result in 1 even before any call to SSL_set_accept_state(). This means the information needs to be available when SSL_new() is called, so must come from the method itself. Prior to the method unification, s->server would be set to 0 or 1 in SSL_new() depending on whether the accept method was undefined or not. Instead, introduce a flag to the internal structs to distinguish client methods from server and generic methods and copy that flag to s->server in SSL_new(). This problem was reported to otto due to breakage of DoH in net/dnsdist. The reason for this is that www/h2o relies on SSL_is_server() to decide whether to call SSL_accept() or SSL_connect(). Thus, the h2o server would end up responding to a ClientHello with another ClientHello, which results in a handshake failure. The bandaid applied to www/h2o can be removed once this fix has made it into snaps. No other breakage is known. This commit brings back only about half of the duplication removed in the method unification, so is preferable to a full revert. ok jsing
* Clarify what sio_start() does exactlyratchov2020-11-291-13/+13
| | | | | Suggested by Erico Nogueira <ericonr@disroot.org>, help from and ok jmc@, schwarze@
* Add retguard to macppc kernel locore.S, ofwreal.S, setjmp.Sgkoehler2020-11-287-24/+24
| | | | | | | | | This changes RETGUARD_SETUP(ffs) to RETGUARD_SETUP(ffs, %r11, %r12) and RETGUARD_CHECK(ffs) to RETGUARD_CHECK(ffs, %r11, %r12) to show that r11 and r12 are in use between setup and check, and to pick registers other than r11 and r12 in some kernel functions. ok mortimer@ deraadt@
* Avoid undefined behavior due to memcpy(NULL, NULL, 0)tb2020-11-251-4/+6
| | | | | | | | | This happens if name->der_len == 0. Since we already have a length check, we can malloc and memcpy inside the conditional. This also makes the code easier to read. agreement from millert ok jsing
* mapalign() only handles allocations >= a page; problem found by and ok semarie@otto2020-11-231-1/+3
|
* * Make .Nd more specific.schwarze2020-11-201-44/+57
| | | | | | | | * Avoid lots of short non-standard .Sh sections. * Describe server and raw descriptors separately. * Move examples to the EXAMPLES section. * Mention that "default" is used even when *not* specified. tweak and OK ratchov@
* * Add SIO_BPS() to NAME and SYNOPSIS where it is missing.schwarze2020-11-201-6/+15
| | | | | | | | * Use .Fn rather than .Dv for macros taking arguments. * Actually say what SIO_LE_NATIVE means. * Add closely related APIs to SEE ALSO. * Add missing HISTORY and AUTHORS sections. OK ratchov@
* fix another misleading line break and indenttb2020-11-201-3/+4
|
* fix confusing line break and indenttb2020-11-201-3/+4
|
* Allow specific devices to be used for play-only and rec-only modes.ratchov2020-11-192-8/+25
| | | | | | | | | | | | Introduce new AUDIO{PLAY,REC}DEVICE environment variables that override AUDIODEVICE in cases play-only and rec-only mode is requested. This allows using different devices for playback and recording in programs requesting twice the default device (one in play-only mode and one in rec-only mode). Based on diffs from Peter J Philipp, semarie, and solene ok solene, sthen
* Plug leak in x509_verify_chain_dup()tb2020-11-181-2/+2
| | | | | | | | | | | | | | | x509_verify_chain_new() allocates a few members of a certificate chain: an empty stack of certificates, a list of errors encountered while validating the chain, and a list of name constraints. The function to copy a chain would allocate a new chain using x509_verify_chain_new() and then clobber its members by copies of the old chain. Fix this by replacing x509_verify_chain_new() with calloc(). Found by review while investigating the report by Hanno Zysik who found the same leak using valgrind. This is a cleaner version of my initial fix from jsing. ok jsing
* Plug a big memory leak in the new validatortb2020-11-181-1/+6
| | | | | | | | | | | | | | | | | | The legacy validator would only call x509_vfy_check_policy() once at the very end after cobbling together a chain. Therefore it didn't matter that X509_policy_check() always allocates a new tree on top of the one that might have been passed in. This is in stark contrast to other, similar APIs in this code base. The new validator calls this function several times over while building its chains. This adds up to a sizable leak in the new validator. Reported with a reproducer by Hanno Zysik on github, who also bisected this to the commit enabling the new validator. Narrowed down to x509_vfy_check_policy() by jsing. We simultaenously came up with a functionally identical fix. ok jsing
* zap ugly empty line before closing bracetb2020-11-181-2/+1
|
* Move freeing of the verify context to its natural place instead oftb2020-11-181-2/+2
| | | | | | a few lines after. stylistic nit from jsing
* KNF (whitespace)tb2020-11-184-13/+13
|
* bump to 3.3.0bcook2020-11-181-3/+3
|
* typo & punctuation in commenttb2020-11-171-3/+3
|
* Implement exporter for TLSv1.3.jsing2020-11-164-8/+121
| | | | | | | | | This implements the key material exporter for TLSv1.3, as defined in RFC8446 section 7.5. Issue reported by nmathewson on github. ok inoguchi@ tb@
* Use X509_V_OK instead of 0.jsing2020-11-161-4/+3
| | | | ok beck@ tb@
* Add back an X509_STORE_CTX error code assignment.jsing2020-11-161-2/+3
| | | | | | | | This was inadvertently removed in r1.19. Spotted by tb@ ok beck@ tb@
* Return the specific failure for a "self signed certificate" in the chainbeck2020-11-151-1/+14
| | | | | | | | | in order to be compatible with the openssl error craziness in the legacy verifier case. This will fix a regress problem noticed by znc ok tb@
* Constify dktypenames and fstypenames in libc.guenther2020-11-141-3/+3
| | | | | | Adjust variable declaration in disklabel to match. ok millert@ deraadt@
* remove macro instances from arbitrary string width specifiers. for examplejmc2020-11-145-18/+18
| | | | | | | -width ".Dv BOB" -> -width "BOB" although they are not errors, they are misleading and probably should not get pasted around
* EVFILT_EXCEPT operates on sockets (emil engler)jmc2020-11-141-3/+4
| | | | | | or pseudo terminals (visa); ok mpi visa
* Handle additional certificate error cases in new X.509 verifier.jsing2020-11-112-12/+79
| | | | | | | | | | | | | | | | | | | | | | | With the old verifier, the verify callback can always return 1 instructing the verifier to simply continue regardless of a certificate verification failure (e.g. the certificate is expired or revoked). This would result in a chain being built, however the first error encountered would be persisted, which allows the caller to build the chain, have the verification process succeed, yet upon inspecting the error code note that the chain is not valid for some reason. Mimic this behaviour by keeping track of certificate errors while building chains - when we finish verification, find the certificate error closest to the leaf certificate and expose that via the X509_STORE_CTX. There are various corner cases that we also have to handle, like the fact that we keep an certificate error until we find the issuer, at which point we have to clear it. Issue reported by Ilya Shipitcin due to failing haproxy regression tests. With much discussion and input from beck@ and tb@! ok beck@ tb@
* Implement auto chain for the TLSv1.3 server.jsing2020-11-111-1/+23
| | | | | | | | | Apparently OpenLDAP relies on this craziness to provide intermediates, rather than specifying the chain directly like a normal TLS server would. Issue noted by sthen@ and Bernard Spil, who both also tested this diff. ok tb@
* Use size_t for key_block_len.jsing2020-11-112-9/+7
| | | | | | | This allows us to remove a check and will make future changes simpler. Use suitable names for tls1_generate_key_block() arguments while here. ok inoguchi@ tb@
* Update getentropy on Windows to use Cryptography Next Generation (CNG).bcook2020-11-111-18/+9
| | | | | wincrypt is deprecated and no longer works with newer Windows environments, such as in Windows Store apps.
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.