- 28 1月, 2022 6 次提交
-
-
由 yangyangtiantianlonglong 提交于
The option SSL_OP_NO_EXTENDED_MASTER_SECRET was added in #3910. And it is valid for versions below (D)TLS 1.2. Reviewed-by: NDmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17597)
-
由 Philip Prindeville 提交于
Allow dhparam to run quietly in scripts, etc. For other commands that took a -verbose flag already, also support -quiet. For genpkey which only supported -quiet, add the -verbose flag. Signed-off-by: NPhilip Prindeville <philipp@redfish-solutions.com> Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17336)
-
由 Philip Prindeville 提交于
Signed-off-by: NPhilip Prindeville <philipp@redfish-solutions.com> Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17336)
-
由 Zhou Qingyang 提交于
CLA: trivial Signed-off-by: NZhou Qingyang <zhou1615@umn.edu> Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17578)
-
由 Jiasheng Jiang 提交于
The get_globals could return NULL, for example, CRYPTO_THREAD_read_lock() failed. Therefore, just checking the member of 'bcgbl' is not enough. We need to check 'bcgbl' itself too in order to avoid the dereference of the NULL pointer. And the caller of ossl_bio_init_core(), OSSL_LIB_CTX_new_from_dispatch() in `crypto/context.c`, has already checked return value and dealed with the situation if it returns 0. Signed-off-by: NJiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17581)
-
由 Matt Caswell 提交于
Any propquery passed via the -propquery option to the ciphers command was being ignored. Reviewed-by: NTomas Mraz <tomas@openssl.org> Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17595)
-
- 27 1月, 2022 11 次提交
-
-
由 Matt Caswell 提交于
In particular: X509_STORE_CTX_set_purpose() X509_STORE_CTX_set_trust(); X509_STORE_CTX_purpose_inherit(); Reviewed-by: NBen Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/17382)
-
由 Matt Caswell 提交于
This function was previously incorrectly failing if it is called with X509_PURPOSE_ANY. Add a test to catch this. Reviewed-by: NBen Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/17382)
-
由 Matt Caswell 提交于
The function X509_STORE_CTX_purpose_inherit() can be called with a 0 default purpose. If the main purpose was set to X509_PURPOSE_ANY this would case the function to incorrectly return an error response. Fixes #17367 Reviewed-by: NBen Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/17382)
-
由 Tomas Mraz 提交于
Fixes #17583 Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17589)
-
由 Tomas Mraz 提交于
Fixes #17587 Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17591)
-
由 Richard Levitte 提交于
Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17162)
-
由 Richard Levitte 提交于
Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17162)
-
由 Richard Levitte 提交于
Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17162)
-
由 Jiasheng Jiang 提交于
The OPENSSL_memdup() is not always success, as the potential failure of the allocation. Then the '*pptr'could be NULL pointer but the ui_dup_method_data() will still return 1. In CRYPTO_dup_ex_data(), the 'storage[i]->dup_func' will not fail and 'ptr' will be used in CRYPTO_set_ex_data(). Also, if '*pptr' is NULL, I think it should also return 0 to tell the caller that the duplication fails in order to prevernt using the NULL pointer. Therefore, it should be better to add the check and return 1 only if the duplication succeed. Signed-off-by: NJiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17582)
-
由 Darshan Sen 提交于
Signed-off-by: NDarshan Sen <raisinten@gmail.com> Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17507)
-
由 Darshan Sen 提交于
When `PEM_write_bio_PKCS8PrivateKey()` was passed an empty passphrase string, `OPENSSL_memdup()` was incorrectly getting used for 0 bytes size allocation, which resulted in malloc failures. Fixes: https://github.com/openssl/openssl/issues/17506Signed-off-by: NDarshan Sen <raisinten@gmail.com> Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17507)
-
- 26 1月, 2022 3 次提交
-
-
由 Jiasheng Jiang 提交于
Since we may fail to get the lock, for example there is no lock, the X509_STORE_lock() will return 0. Therefore, we should check it in order to prevent the dirty data. Signed-off-by: NJiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17575)
-
由 Jiasheng Jiang 提交于
As the potential failure of the allocation, the sk_SCT_new_null() could return NULL pointer if fails. And then sk_SCT_push() uses the 'fixture->sct_list' and returns -1 if fails. But the return value of the sk_SCT_push() is not checked. I think it is better to check it just after the allocation. CLA: trivial Signed-off-by: NJiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17571)
-
由 Jiasheng Jiang 提交于
The OPENSSL_zalloc() could return NULL pointer if fails. Add the check for it does make sense, like how digest_test_init() deals with. CLA: trivial Signed-off-by: NJiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17571)
-
- 25 1月, 2022 1 次提交
-
-
由 XiaokangQian 提交于
Increase the block numbers to 8 for every iteration. Increase the hash table capacity. Make use of EOR3 instruction to improve the performance. This can improve performance 25-40% on out-of-order microarchitectures with a large number of fast execution units, such as Neoverse V1. We also see 20-30% performance improvements on other architectures such as the M1. Assembly code reviewd by Tom Cosgrove (ARM). Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15916)
-
- 24 1月, 2022 3 次提交
-
-
由 Danny Tsen 提交于
Assembly code reviewed by Shricharan Srivatsan <ssrivat@us.ibm.com> Reviewed-by: NTomas Mraz <tomas@openssl.org> Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16854)
-
由 Todd Short 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17556) (cherry picked from commit 45036df45048c6498efa49d3572869830d05df45)
-
由 Pauli 提交于
Fixes #17557 Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17562)
-
- 21 1月, 2022 12 次提交
-
-
由 Philip Prindeville 提交于
Signed-off-by: NPhilip Prindeville <philipp@redfish-solutions.com> Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17359)
-
由 Richard Levitte 提交于
This involves the following functions: ERR_new(), ERR_set_debug(), ERR_set_error(), ERR_vset_error(), ERR_set_mark(), ERR_clear_last_mark(), ERR_pop_to_mark(void) Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17474)
-
由 Richard Levitte 提交于
Move them to their own source file, so they end up in a separate object file. This allows providers to override their implementation to use the corresponding OSSL_FUNC upcalls without having to reimplement everything from crypto/err/err.c. Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17474)
-
由 Gerd Hoffmann 提交于
Using floating point is not supported in UEFI and can cause build problems, for example due to SSE being disabled and x64 calling convention passing floats in SSE registers. Avoid those problems by not compiling the formating code for floating point numbers. Signed-off-by: NGerd Hoffmann <kraxel@redhat.com> Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17547)
-
由 Gerd Hoffmann 提交于
This reverts commit 328bf5ad. Turned out it isn't that simple, the fix is incomplete. So revert and try again with another approach. Signed-off-by: NGerd Hoffmann <kraxel@redhat.com> Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17547)
-
由 yangyangtiantianlonglong 提交于
Also add comment to the public header to avoid making another conflict in future. Fixes #17545 Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17546)
-
由 Richard Levitte 提交于
Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17139)
-
由 Richard Levitte 提交于
This adds the functions BN_signed_bin2bn(), BN_signed_bn2bin(), BN_signed_lebin2bn(), BN_signed_bn2lebin(), BN_signed_native2bn(), and BN_signed_bn2native(), all essentially doing the same job as BN_bin2bn(), BN_bn2binpad(), BN_lebin2bn(), BN_bn2lebinpad(), BN_native2bn(), and BN_bn2nativepad(), except that the 'signed' ones operate on signed number bins in 2's complement form. Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17139)
-
由 Richard Levitte 提交于
This will make it easier to introduce the possibility for signed input numbers. We also refactor the inner loop to simplify the calculation of each bignum chunk. Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17139)
-
由 Richard Levitte 提交于
Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17139)
-
由 Richard Levitte 提交于
Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17139)
-
由 Richard Levitte 提交于
BN_lebin2bn() is a block copy of BN_bin2bn() with just a couple of very minute details changed. For better maintainability, we collapse them into the internal function bn2bin(), and change BN_bin2bn() and BN_lebin2bn() to become simple wrappers. Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17139)
-
- 20 1月, 2022 4 次提交
-
-
由 Tobias Nießen 提交于
Because no supported flag affects the behavior of X509_check_ip, the flags argument currently has no effect. Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17536)
-
由 Hubert Kario 提交于
as the code uses BIO_gets, and it always null terminates the strings it reads, when it reads a record 2^14 byte long, it actually returns 2^14-1 bytes to the calling application, in general it returns size-1 bytes to the caller This makes the code sub-optimal (as every 2^14 record will need two BIO_gets() calls) and makes it impossible to use -rev option to test all plaintext lengths (like in openssl#15706) Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17538)
-
由 James Muir 提交于
Description: Mark Wooden and Franck Rondepierre noted that the square-root-mod-p operations used in the EdDSA RFC (RFC 8032) can be simplified. For Ed25519, instead of computing u*v^3 * (u * v^7)^((p-5)/8), we can compute u * (u*v)^((p-5)/8). This saves 3 multiplications and 2 squarings. For more details (including a proof), see the following message from the CFRG mailing list: https://mailarchive.ietf.org/arch/msg/cfrg/qlKpMBqxXZYmDpXXIx6LO3Oznv4/ Note that the Ed448 implementation (see ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio() in ./crypto/ec/curve448/curve448.c) appears to already use this simpler method (i.e. it does not follow the method suggested in RFC 8032). Testing: Build and then run the test suite: ./Configure -Werror --strict-warnings make update make make test Numerical testing of the square-root computation can be done using the following sage script: def legendre(x,p): return kronecker(x,p) # Ed25519 p = 2**255-19 # -1 is a square if legendre(-1,p)==1: print("-1 is a square") # suppose u/v is a square. # to compute one of its square roots, find x such that # x**4 == (u/v)**2 . # this implies # x**2 == u/v, or # x**2 == -(u/v) , # which implies either x or i*x is a square-root of u/v (where i is a square root of -1). # we can take x equal to u * (u*v)**((p-5)/8). # 2 is a generator # this can be checked by factoring p-1 # and then showing 2**((p-1)/q) != 1 (mod p) # for all primes q dividing p-1. g = 2 s = p>>2 # s = (p-1)/4 i = power_mod(g, s, p) t = p>>3 # t = (p-5)/8 COUNT = 1<<18 while COUNT > 0: COUNT -= 1 r = randint(0,p-1) # r = u/v v = randint(1,p-1) u = mod(r*v,p) # compute x = u * (u*v)**((p-5)/8) w = mod(u*v,p) x = mod(u*power_mod(w, t, p), p) # check that x**2 == r, or (i*x)**2 == r, or r is not a square rr = power_mod(x, 2, p) if rr==r: continue rr = power_mod(mod(i*x,p), 2, p) if rr==r: continue if legendre(r,p) != 1: continue print("failure!") exit() print("passed!") Reviewed-by: NPaul Dale <pauli@openssl.org> Reviewed-by: NTomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17544)
-
由 fangming.fang 提交于
Reviewed-by: NTomas Mraz <tomas@openssl.org> Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NPaul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17542)
-