SM2 Decryption Buffer Overflow

These options specify alternative sections to include certificate -extensions (if the B<-x509> option is present) or certificate -request extensions. This allows several different sections to +extensions (if B<-x509> is in use) or certificate request extensions. +This allows several different sections to be used in the same configuration file to specify requests for a variety of purposes. @@ -399,7 +401,8 @@ The options available are described in detail below. =over 4 -=item B +=item B +=item B The passwords for the input private key file (if present) and the output private key file (if one will be created). The @@ -479,8 +482,8 @@ extension section format. =item B This specifies the configuration file section containing a list of -extensions to add to certificate generated when the B<-x509> switch -is used. It can be overridden by the B<-extensions> command line switch. +extensions to add to certificate generated when B<-x509> is in use. +It can be overridden by the B<-extensions> command line switch. =item B From openssl at openssl.org Thu Aug 26 22:58:54 2021 From: openssl at openssl.org (OpenSSL run-checker) Date: Thu, 26 Aug 2021 22:58:54 +0000 Subject: Still FAILED build of OpenSSL branch master with options enable-fuzz-afl no-shared no-module Message-ID: <1630018734.088228.344118.nullmailer@run.openssl.org> Platform and configuration command: $ uname -a Linux run 5.4.0-74-generic #83-Ubuntu SMP Sat May 8 02:35:39 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux $ CC=afl-clang-fast ../openssl/config enable-fuzz-afl no-shared no-module Commit log since last time: 4fdb0d2535 APPS/req: Fix AKID generation in case -CA option is used f2b6edcfdd APPS/req: Fix misconceptions on -CA, -CAkey, and -key options. -CA now implies -x509 b4fec69b2a APPS/x509: fix -extfile option, which was ignored with -x509toreq 78539b250b EVP_DigestSign/VerifyFinal: Duplicate the pctx to allow multiple calls 62bae84d45 ts: fix memleaks caused by TS_VERIFY_CTX_set_imprint a291cfdfde doc: document the rsa_oaep_md: pkeyopt 9698a56e82 aes-wrap: improve error handling 31656f2785 Add invalid input length error Build log ended with (last 100 lines): # SSL_accept() failed -1, 1 # 40E72202447F0000:error:068C0100:asn1 encoding routines:ASN1_STRING_set:malloc failure:../openssl/crypto/asn1/asn1_lib.c:311: # 40E72202447F0000:error:068C0100:asn1 encoding routines:asn1_ex_c2i:malloc failure:../openssl/crypto/asn1/tasn_dec.c:944: # 40E72202447F0000:error:0688010A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../openssl/crypto/asn1/tasn_dec.c:685:Field=session_id, Type=SSL_SESSION_ASN1 # 40E72202447F0000:error:0A0C0103:SSL routines:construct_stateless_ticket:internal error:../openssl/ssl/statem/statem_srvr.c:3706: # INFO: @ ../openssl/test/helpers/ssltestlib.c:957 # SSL_connect() failed -1, 1 # 40E72202447F0000:error:0A000438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error:../openssl/ssl/record/rec_layer_s3.c:1584:SSL alert number 80 # ERROR: (bool) 'create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE) == true' failed @ ../openssl/test/sslapitest.c:9260 # false # OPENSSL_TEST_RAND_ORDER=1630016453 not ok 372 - iteration 7 # ------------------------------------------------------------------------------ # OPENSSL_TEST_RAND_ORDER=1630016453 not ok 74 - test_dh_auto # ------------------------------------------------------------------------------ # INFO: @ ../openssl/test/helpers/ssltestlib.c:975 # SSL_accept() failed -1, 1 # 40E72202447F0000:error:068C0100:asn1 encoding routines:ASN1_STRING_set:malloc failure:../openssl/crypto/asn1/asn1_lib.c:311: # 40E72202447F0000:error:068C0100:asn1 encoding routines:asn1_ex_c2i:malloc failure:../openssl/crypto/asn1/tasn_dec.c:944: # 40E72202447F0000:error:0688010A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../openssl/crypto/asn1/tasn_dec.c:685: # 40E72202447F0000:error:0688010A:asn1 encoding routines:asn1_template_ex_d2i:nested asn1 error:../openssl/crypto/asn1/tasn_dec.c:537:Field=session_id_context, Type=SSL_SESSION_ASN1 # 40E72202447F0000:error:0A0C0103:SSL routines:construct_stateless_ticket:internal error:../openssl/ssl/statem/statem_srvr.c:3706: # INFO: @ ../openssl/test/helpers/ssltestlib.c:1004 # No progress made # ERROR: (bool) 'create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE) == true' failed @ ../openssl/test/sslapitest.c:9315 # false # OPENSSL_TEST_RAND_ORDER=1630016453 not ok 75 - test_sni_tls13 # ------------------------------------------------------------------------------ ../../util/wrap.pl ../../test/sslapitest ../../../openssl/test/certs ../../../openssl/test/recipes/90-test_sslapi_data/passwd.txt /tmp/8E9rTQ5kmR default ../../../openssl/test/default.cnf => 1 not ok 1 - running sslapitest # ------------------------------------------------------------------------------ # Failed test 'running sslapitest' # at ../openssl/test/recipes/90-test_sslapi.t line 32. # Looks like you failed 1 test of 1.90-test_sslapi.t ................... Dubious, test returned 1 (wstat 256, 0x100) Failed 1/1 subtests Test Summary Report ------------------- 80-test_ssl_new.t (Wstat: 7168 Tests: 30 Failed: 28) Failed tests: 1-21, 23-28, 30 Non-zero exit status: 28 20-test_spkac.t (Wstat: 512 Tests: 4 Failed: 2) Failed tests: 2, 4 Non-zero exit status: 2 25-test_crl.t (Wstat: 256 Tests: 10 Failed: 1) Failed test: 3 Non-zero exit status: 1 25-test_sid.t (Wstat: 256 Tests: 2 Failed: 1) Failed test: 2 Non-zero exit status: 1 65-test_cmp_ctx.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_asyncio.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_clienthello.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_recordlen.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_servername.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_ca.t (Wstat: 256 Tests: 15 Failed: 1) Failed test: 5 Non-zero exit status: 1 80-test_dtls_mtu.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_dtls.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_pkcs12.t (Wstat: 768 Tests: 13 Failed: 3) Failed tests: 1-3 Non-zero exit status: 3 80-test_sslcorrupt.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 90-test_sslbuffers.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 90-test_v3name.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_ssl_old.t (Wstat: 1024 Tests: 6 Failed: 4) Failed tests: 3-6 Non-zero exit status: 4 90-test_sslapi.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 Files=240, Tests=2835, 259 wallclock secs (14.47 usr 1.76 sys + 897.39 cusr 67.76 csys = 981.38 CPU) Result: FAIL make[1]: *** [Makefile:2579: run_tests] Error 1 make[1]: Leaving directory '/home/openssl/run-checker/enable-fuzz-afl' make: *** [Makefile:2575: tests] Error 2 From pauli at openssl.org Fri Aug 27 00:15:30 2021 From: pauli at openssl.org (Dr. Paul Dale) Date: Fri, 27 Aug 2021 00:15:30 +0000 Subject: [openssl] master update Message-ID: <1630023330.051669.23171.nullmailer@dev.openssl.org> The branch master has been updated via 194fcc9ae09ea7cbe0b3b60c67061e51bb24de79 (commit) via f38af1258561eb0213b344c607037a528136099f (commit) via 6f25d3c47995c6e4948212950566dfbe541904df (commit) from 4fdb0d2535323373650bd68e7a659f9320828857 (commit) - Log ----------------------------------------------------------------- commit 194fcc9ae09ea7cbe0b3b60c67061e51bb24de79 Author: Matt Caswell Date: Wed Aug 25 14:39:29 2021 +0100 Add a test for running the config twice Make sure there are no leaks from running the config file twice. Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16425) commit f38af1258561eb0213b344c607037a528136099f Author: Matt Caswell Date: Tue Aug 24 17:41:39 2021 +0100 Add locking for the provider_conf.c Avoid races where 2 threads attempt to configure activation of providers at the same time. E.g. via an explicit and an implict load of the config file at the same time. Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16425) commit 6f25d3c47995c6e4948212950566dfbe541904df Author: Matt Caswell Date: Tue Aug 17 10:32:49 2021 +0100 When activating providers via config check we've not already activated them We skip the activation if we already configured them. Fixes #16250 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16425) ----------------------------------------------------------------------- Summary of changes: crypto/provider_conf.c | 106 +++++++++++++++++++++++++------------ test/build.info | 6 ++- test/prov_config_test.c | 61 +++++++++++++++++++++ test/recipes/30-test_prov_config.t | 32 +++++++++++ 4 files changed, 170 insertions(+), 35 deletions(-) create mode 100644 test/prov_config_test.c create mode 100644 test/recipes/30-test_prov_config.t diff --git a/crypto/provider_conf.c b/crypto/provider_conf.c index fe66e1158e..da3796d914 100644 --- a/crypto/provider_conf.c +++ b/crypto/provider_conf.c @@ -12,6 +12,7 @@ #include #include #include +#include #include "internal/provider.h" #include "internal/cryptlib.h" #include "provider_local.h" @@ -21,6 +22,7 @@ DEFINE_STACK_OF(OSSL_PROVIDER) /* PROVIDER config module */ typedef struct { + CRYPTO_RWLOCK *lock; STACK_OF(OSSL_PROVIDER) *activated_providers; } PROVIDER_CONF_GLOBAL; @@ -31,6 +33,12 @@ static void *prov_conf_ossl_ctx_new(OSSL_LIB_CTX *libctx) if (pcgbl == NULL) return NULL; + pcgbl->lock = CRYPTO_THREAD_lock_new(); + if (pcgbl->lock == NULL) { + OPENSSL_free(pcgbl); + return NULL; + } + return pcgbl; } @@ -42,6 +50,7 @@ static void prov_conf_ossl_ctx_free(void *vpcgbl) ossl_provider_free); OSSL_TRACE(CONF, "Cleaned up providers\n"); + CRYPTO_THREAD_lock_free(pcgbl->lock); OPENSSL_free(pcgbl); } @@ -107,6 +116,26 @@ static int provider_conf_params(OSSL_PROVIDER *prov, return ok; } +static int prov_already_activated(const char *name, + STACK_OF(OSSL_PROVIDER) *activated) +{ + int i, max; + + if (activated == NULL) + return 0; + + max = sk_OSSL_PROVIDER_num(activated); + for (i = 0; i < max; i++) { + OSSL_PROVIDER *tstprov = sk_OSSL_PROVIDER_value(activated, i); + + if (strcmp(OSSL_PROVIDER_get0_name(tstprov), name) == 0) { + return 1; + } + } + + return 0; +} + static int provider_conf_load(OSSL_LIB_CTX *libctx, const char *name, const char *value, const CONF *cnf) { @@ -156,46 +185,55 @@ static int provider_conf_load(OSSL_LIB_CTX *libctx, const char *name, } if (activate) { - /* - * There is an attempt to activate a provider, so we should disable - * loading of fallbacks. Otherwise a misconfiguration could mean the - * intended provider does not get loaded. Subsequent fetches could then - * fallback to the default provider - which may be the wrong thing. - */ - if (!ossl_provider_disable_fallback_loading(libctx)) { + if (!CRYPTO_THREAD_write_lock(pcgbl->lock)) { ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR); return 0; } - prov = ossl_provider_find(libctx, name, 1); - if (prov == NULL) - prov = ossl_provider_new(libctx, name, NULL, 1); - if (prov == NULL) { - if (soft) - ERR_clear_error(); - return 0; - } - - if (path != NULL) - ossl_provider_set_module_path(prov, path); - - ok = provider_conf_params(prov, NULL, NULL, value, cnf); + if (!prov_already_activated(name, pcgbl->activated_providers)) { + /* + * There is an attempt to activate a provider, so we should disable + * loading of fallbacks. Otherwise a misconfiguration could mean the + * intended provider does not get loaded. Subsequent fetches could + * then fallback to the default provider - which may be the wrong + * thing. + */ + if (!ossl_provider_disable_fallback_loading(libctx)) { + CRYPTO_THREAD_unlock(pcgbl->lock); + ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR); + return 0; + } + prov = ossl_provider_find(libctx, name, 1); + if (prov == NULL) + prov = ossl_provider_new(libctx, name, NULL, 1); + if (prov == NULL) { + CRYPTO_THREAD_unlock(pcgbl->lock); + if (soft) + ERR_clear_error(); + return 0; + } - if (ok) { - if (!ossl_provider_activate(prov, 1, 0)) { - ok = 0; - } else if (!ossl_provider_add_to_store(prov, &actual, 0)) { - ossl_provider_deactivate(prov); - ok = 0; - } else { - if (pcgbl->activated_providers == NULL) - pcgbl->activated_providers = sk_OSSL_PROVIDER_new_null(); - sk_OSSL_PROVIDER_push(pcgbl->activated_providers, actual); - ok = 1; + if (path != NULL) + ossl_provider_set_module_path(prov, path); + + ok = provider_conf_params(prov, NULL, NULL, value, cnf); + + if (ok) { + if (!ossl_provider_activate(prov, 1, 0)) { + ok = 0; + } else if (!ossl_provider_add_to_store(prov, &actual, 0)) { + ossl_provider_deactivate(prov); + ok = 0; + } else { + if (pcgbl->activated_providers == NULL) + pcgbl->activated_providers = sk_OSSL_PROVIDER_new_null(); + sk_OSSL_PROVIDER_push(pcgbl->activated_providers, actual); + ok = 1; + } } + if (!ok) + ossl_provider_free(prov); } - - if (!ok) - ossl_provider_free(prov); + CRYPTO_THREAD_unlock(pcgbl->lock); } else { OSSL_PROVIDER_INFO entry; diff --git a/test/build.info b/test/build.info index af21e03255..dab5af4ebe 100644 --- a/test/build.info +++ b/test/build.info @@ -57,7 +57,7 @@ IF[{- !$disabled{tests} -}] context_internal_test aesgcmtest params_test evp_pkey_dparams_test \ keymgmt_internal_test hexstr_test provider_status_test defltfips_test \ bio_readbuffer_test user_property_test pkcs7_test upcallstest \ - provfetchtest + provfetchtest prov_config_test IF[{- !$disabled{'deprecated-3.0'} -}] PROGRAMS{noinst}=enginetest @@ -176,6 +176,10 @@ IF[{- !$disabled{tests} -}] INCLUDE[provfetchtest]=../include ../apps/include DEPEND[provfetchtest]=../libcrypto.a libtestutil.a + SOURCE[prov_config_test]=prov_config_test.c + INCLUDE[prov_config_test]=../include ../apps/include + DEPEND[prov_config_test]=../libcrypto.a libtestutil.a + SOURCE[evp_pkey_provided_test]=evp_pkey_provided_test.c INCLUDE[evp_pkey_provided_test]=../include ../apps/include DEPEND[evp_pkey_provided_test]=../libcrypto.a libtestutil.a diff --git a/test/prov_config_test.c b/test/prov_config_test.c new file mode 100644 index 0000000000..4b04211fa4 --- /dev/null +++ b/test/prov_config_test.c @@ -0,0 +1,61 @@ +/* + * Copyright 2021 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include "testutil.h" + +static char *configfile = NULL; + +/* + * Test to make sure there are no leaks or failures from loading the config + * file twice. + */ +static int test_double_config(void) +{ + OSSL_LIB_CTX *ctx = OSSL_LIB_CTX_new(); + int testresult = 0; + EVP_MD *sha256 = NULL; + + if (!TEST_ptr(configfile)) + return 0; + if (!TEST_ptr(ctx)) + return 0; + + if (!TEST_true(OSSL_LIB_CTX_load_config(ctx, configfile))) + return 0; + if (!TEST_true(OSSL_LIB_CTX_load_config(ctx, configfile))) + return 0; + + /* Check we can actually fetch something */ + sha256 = EVP_MD_fetch(ctx, "SHA2-256", NULL); + if (!TEST_ptr(sha256)) + goto err; + + testresult = 1; + err: + EVP_MD_free(sha256); + OSSL_LIB_CTX_free(ctx); + return testresult; +} + +OPT_TEST_DECLARE_USAGE("configfile\n") + +int setup_tests(void) +{ + if (!test_skip_common_options()) { + TEST_error("Error parsing test options\n"); + return 0; + } + + if (!TEST_ptr(configfile = test_get_argument(0))) + return 0; + + ADD_TEST(test_double_config); + return 1; +} diff --git a/test/recipes/30-test_prov_config.t b/test/recipes/30-test_prov_config.t new file mode 100644 index 0000000000..f97a26dbe9 --- /dev/null +++ b/test/recipes/30-test_prov_config.t @@ -0,0 +1,32 @@ +#! /usr/bin/env perl +# Copyright 2021 The OpenSSL Project Authors. All Rights Reserved. +# +# Licensed under the Apache License 2.0 (the "License"). You may not use +# this file except in compliance with the License. You can obtain a copy +# in the file LICENSE in the source distribution or at +# https://www.openssl.org/source/license.html + + +use OpenSSL::Test::Simple; +use OpenSSL::Test qw/:DEFAULT srctop_file srctop_dir bldtop_dir/; +use OpenSSL::Test::Utils; + +BEGIN { +setup("test_prov_config"); +} + +use lib srctop_dir('Configurations'); +use lib bldtop_dir('.'); + +my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0); + +plan tests => 2; + +ok(run(test(["prov_config_test", srctop_file("test", "default.cnf")])), + "running prov_config_test default.cnf"); +SKIP: { + skip "Skipping FIPS test in this build", 1 if $no_fips; + + ok(run(test(["prov_config_test", srctop_file("test", "fips.cnf")])), + "running prov_config_test fips.cnf"); +} From pauli at openssl.org Fri Aug 27 00:20:28 2021 From: pauli at openssl.org (Dr. Paul Dale) Date: Fri, 27 Aug 2021 00:20:28 +0000 Subject: [openssl] master update Message-ID: <1630023628.240161.26110.nullmailer@dev.openssl.org> The branch master has been updated via 6f242d224cd1f5d9f4d9b3a1722cca93b92d25b0 (commit) from 194fcc9ae09ea7cbe0b3b60c67061e51bb24de79 (commit) - Log ----------------------------------------------------------------- commit 6f242d224cd1f5d9f4d9b3a1722cca93b92d25b0 Author: Tomas Mraz Date: Wed Aug 25 17:06:47 2021 +0200 doc: Add note about operation parameters validation Fixes #16394 Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16424) ----------------------------------------------------------------------- Summary of changes: CHANGES.md | 11 +++++++++++ doc/man7/migration_guide.pod | 12 ++++++++++++ 2 files changed, 23 insertions(+) diff --git a/CHANGES.md b/CHANGES.md index ac10632734..5b16e34dd5 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -30,6 +30,17 @@ breaking changes, and mappings for the large list of deprecated functions. ### Changes between 1.1.1 and 3.0 [xx XXX xxxx] + * Due to move of the implementation of cryptographic operations + to the providers, validation of various operation parameters can + be postponed until the actual operation is executed where previously + it happened immediately when an operation parameter was set. + + For example when setting an unsupported curve with + EVP_PKEY_CTX_set_ec_paramgen_curve_nid() this function call will not + fail but later keygen operations with the EVP_PKEY_CTX will fail. + + *OpenSSL team members and many third party contributors* + * On build targets where the multilib postfix is set in the build configuration the libdir directory was changing based on whether the lib directory with the multilib postfix exists on the system diff --git a/doc/man7/migration_guide.pod b/doc/man7/migration_guide.pod index 7e0bbf465d..02d2327ee2 100644 --- a/doc/man7/migration_guide.pod +++ b/doc/man7/migration_guide.pod @@ -440,6 +440,18 @@ If using a cipher from a provider the B flag can only be set B the cipher has been assigned to the cipher context. See L for more information. +=head4 Validation of operation context parameters + +Due to move of the implementation of cryptographic operations to the +providers, validation of various operation parameters can be postponed until +the actual operation is executed where previously it happened immediately +when an operation parameter was set. + +For example when setting an unsupported curve with +EVP_PKEY_CTX_set_ec_paramgen_curve_nid() this function call will not fail +but later keygen operations with the EVP_PKEY_CTX will fail. + + =head2 Installation and Compilation Please refer to the INSTALL.md file in the top of the distribution for From tomas at openssl.org Fri Aug 27 06:51:45 2021 From: tomas at openssl.org (tomas at openssl.org) Date: Fri, 27 Aug 2021 06:51:45 +0000 Subject: [openssl] master update Message-ID: <1630047105.282923.19925.nullmailer@dev.openssl.org> The branch master has been updated via c023d98dcf2ba1cc30f545ae54d0e037e80a8794 (commit) from 6f242d224cd1f5d9f4d9b3a1722cca93b92d25b0 (commit) - Log ----------------------------------------------------------------- commit c023d98dcf2ba1cc30f545ae54d0e037e80a8794 Author: David Carlier Date: Wed Aug 25 08:54:38 2021 +0100 Darwin platform allows to build on releases before Yosemite/ios 8. backport #16409 Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16418) ----------------------------------------------------------------------- Summary of changes: include/crypto/rand.h | 10 ++++++++++ providers/implementations/rands/seeding/rand_unix.c | 6 +----- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/include/crypto/rand.h b/include/crypto/rand.h index d9432b241d..ac41a9f62b 100644 --- a/include/crypto/rand.h +++ b/include/crypto/rand.h @@ -22,6 +22,16 @@ # include # include "crypto/rand_pool.h" +# if defined(__APPLE__) && !defined(OPENSSL_NO_APPLE_CRYPTO_RANDOM) +# include +# if (defined(__MAC_OS_X_VERSION_MIN_REQUIRED) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101000) || \ + (defined(__IPHONE_OS_VERSION_MIN_REQUIRED) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 80000) +# define OPENSSL_APPLE_CRYPTO_RANDOM 1 +# include +# include +# endif +# endif + /* * Defines related to seed sources */ diff --git a/providers/implementations/rands/seeding/rand_unix.c b/providers/implementations/rands/seeding/rand_unix.c index 5048383077..750afca58e 100644 --- a/providers/implementations/rands/seeding/rand_unix.c +++ b/providers/implementations/rands/seeding/rand_unix.c @@ -40,10 +40,6 @@ # include # include #endif -#if defined(__APPLE__) -# include -# include -#endif #if (defined(OPENSSL_SYS_UNIX) && !defined(OPENSSL_SYS_VXWORKS)) \ || defined(__DJGPP__) @@ -370,7 +366,7 @@ static ssize_t syscall_random(void *buf, size_t buflen) if (errno != ENOSYS) return -1; } -# elif defined(__APPLE__) +# elif defined(OPENSSL_APPLE_CRYPTO_RANDOM) if (CCRandomGenerateBytes(buf, buflen) == kCCSuccess) return (ssize_t)buflen; From tomas at openssl.org Fri Aug 27 06:53:23 2021 From: tomas at openssl.org (tomas at openssl.org) Date: Fri, 27 Aug 2021 06:53:23 +0000 Subject: [openssl] OpenSSL_1_1_1-stable update Message-ID: <1630047203.092428.22275.nullmailer@dev.openssl.org> The branch OpenSSL_1_1_1-stable has been updated via 96ac8f13f4d0ee96baf5724d9f96c44c34b8606c (commit) from 15d1ddde5de9d28b671d3f6fe8757f4b87e67821 (commit) - Log ----------------------------------------------------------------- commit 96ac8f13f4d0ee96baf5724d9f96c44c34b8606c Author: David Carlier Date: Tue Aug 24 22:40:14 2021 +0100 Darwin platform allows to build on releases before Yosemite/ios 8. issue #16407 #16408 Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16409) ----------------------------------------------------------------------- Summary of changes: crypto/rand/rand_unix.c | 5 +---- include/crypto/rand.h | 10 ++++++++++ 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/crypto/rand/rand_unix.c b/crypto/rand/rand_unix.c index 43f1069d15..0f4525106a 100644 --- a/crypto/rand/rand_unix.c +++ b/crypto/rand/rand_unix.c @@ -34,9 +34,6 @@ #if defined(__OpenBSD__) # include #endif -#if defined(__APPLE__) -# include -#endif #if defined(OPENSSL_SYS_UNIX) || defined(__DJGPP__) # include @@ -381,7 +378,7 @@ static ssize_t syscall_random(void *buf, size_t buflen) if (errno != ENOSYS) return -1; } -# elif defined(__APPLE__) +# elif defined(OPENSSL_APPLE_CRYPTO_RANDOM) if (CCRandomGenerateBytes(buf, buflen) == kCCSuccess) return (ssize_t)buflen; diff --git a/include/crypto/rand.h b/include/crypto/rand.h index 5350d3a931..674f840fd1 100644 --- a/include/crypto/rand.h +++ b/include/crypto/rand.h @@ -20,6 +20,16 @@ # include +# if defined(__APPLE__) && !defined(OPENSSL_NO_APPLE_CRYPTO_RANDOM) +# include +# if (defined(__MAC_OS_X_VERSION_MIN_REQUIRED) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101000) || \ + (defined(__IPHONE_OS_VERSION_MIN_REQUIRED) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 80000) +# define OPENSSL_APPLE_CRYPTO_RANDOM 1 +# include +# include +# endif +# endif + /* forward declaration */ typedef struct rand_pool_st RAND_POOL; From tomas at openssl.org Fri Aug 27 07:21:39 2021 From: tomas at openssl.org (tomas at openssl.org) Date: Fri, 27 Aug 2021 07:21:39 +0000 Subject: [openssl] master update Message-ID: <1630048899.547147.3912.nullmailer@dev.openssl.org> The branch master has been updated via 597d24e2ab395991cb2048529714ea534c173591 (commit) from c023d98dcf2ba1cc30f545ae54d0e037e80a8794 (commit) - Log ----------------------------------------------------------------- commit 597d24e2ab395991cb2048529714ea534c173591 Author: Xiaofei Bai Date: Wed Aug 18 07:57:26 2021 +0000 Fix libdir path on darwin In current Configure script, libdir can be specified either an absolute path or relative, while in Configurations/shared-info.pl, on darwin system "-install_name" only accepts relative libdir path, and the program fails when receiving absolute libdir path. This PR is to fix this and match requirements of scripts. Reviewed-by: Paul Dale Reviewed-by: Richard Levitte Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16393) ----------------------------------------------------------------------- Summary of changes: Configurations/shared-info.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Configurations/shared-info.pl b/Configurations/shared-info.pl index 2b236b4b9b..abf2d98dcc 100644 --- a/Configurations/shared-info.pl +++ b/Configurations/shared-info.pl @@ -43,7 +43,7 @@ my %shared_info; 'darwin-shared' => { module_ldflags => '-bundle', shared_ldflag => '-dynamiclib -current_version $(SHLIB_VERSION_NUMBER) -compatibility_version $(SHLIB_VERSION_NUMBER)', - shared_sonameflag => '-install_name $(INSTALLTOP)/$(LIBDIR)/', + shared_sonameflag => '-install_name $(libdir)/', }, 'cygwin-shared' => { shared_ldflag => '-shared -Wl,--enable-auto-image-base', From tomas at openssl.org Fri Aug 27 07:24:59 2021 From: tomas at openssl.org (tomas at openssl.org) Date: Fri, 27 Aug 2021 07:24:59 +0000 Subject: [openssl] OpenSSL_1_1_1-stable update Message-ID: <1630049099.824105.7220.nullmailer@dev.openssl.org> The branch OpenSSL_1_1_1-stable has been updated via 58e1e397c6774be11b903c0f88e85bd2b8c4206f (commit) from 96ac8f13f4d0ee96baf5724d9f96c44c34b8606c (commit) - Log ----------------------------------------------------------------- commit 58e1e397c6774be11b903c0f88e85bd2b8c4206f Author: zhaozg Date: Tue Aug 24 22:43:18 2021 +0800 cms: fix memleaks in cms_env.c CLA: trivial Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16403) ----------------------------------------------------------------------- Summary of changes: crypto/cms/cms_env.c | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c index 04940146fd..fe078f1a7f 100644 --- a/crypto/cms/cms_env.c +++ b/crypto/cms/cms_env.c @@ -737,6 +737,7 @@ static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms, goto err; } + OPENSSL_clear_free(ec->key, ec->keylen); ec->key = ukey; ec->keylen = ukeylen; From tomas at openssl.org Fri Aug 27 07:26:21 2021 From: tomas at openssl.org (tomas at openssl.org) Date: Fri, 27 Aug 2021 07:26:21 +0000 Subject: [openssl] master update Message-ID: <1630049181.628948.8220.nullmailer@dev.openssl.org> The branch master has been updated via 5327da81f0c70e35bdd8860af9af351313ca4ae2 (commit) from 597d24e2ab395991cb2048529714ea534c173591 (commit) - Log ----------------------------------------------------------------- commit 5327da81f0c70e35bdd8860af9af351313ca4ae2 Author: zhaozg Date: Tue Aug 24 22:43:18 2021 +0800 cms: fix memleaks in cms_env.c CLA: trivial Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16403) (cherry picked from commit 58e1e397c6774be11b903c0f88e85bd2b8c4206f) ----------------------------------------------------------------------- Summary of changes: crypto/cms/cms_env.c | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c index 673880f6d9..51a1d7df84 100644 --- a/crypto/cms/cms_env.c +++ b/crypto/cms/cms_env.c @@ -951,6 +951,7 @@ static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms, } ukeylen += outlen; + OPENSSL_clear_free(ec->key, ec->keylen); ec->key = ukey; ec->keylen = ukeylen; From scan-admin at coverity.com Fri Aug 27 07:49:13 2021 From: scan-admin at coverity.com (scan-admin at coverity.com) Date: Fri, 27 Aug 2021 07:49:13 +0000 (UTC) Subject: Coverity Scan: Analysis completed for openssl/openssl Message-ID: <612898f92ad5e_33c8552b0a45dc19a8275@prd-scan-dashboard-0.mail> Your request for analysis of openssl/openssl has been completed successfully. The results are available at https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7HlekBtV1P4YRtWclMVkCdvAA-3D-3Ds0hW_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeFw9hoc7L3MPZ0s-2F9YLI8t7jESA4FaBdvaFi-2B95Ops6bokcGqTHh5oXKFYacrbjpPGYrkgp-2B17k4-2FD9Iy7W3dnCUwWWm7q8hvptYJ3Rtvh1pPK4PmsnaQcZ1tBqN0EFyYeTjdz-2BWxD7ZbhHEw1je6tHWthzYtOlm11C7vVBXDNG78A2WugNhkqCOaq0YP-2BCeGc-3D Build ID: 404476 Analysis Summary: New defects found: 0 Defects eliminated: 0 From scan-admin at coverity.com Fri Aug 27 07:54:02 2021 From: scan-admin at coverity.com (scan-admin at coverity.com) Date: Fri, 27 Aug 2021 07:54:02 +0000 (UTC) Subject: Coverity Scan: Analysis completed for OpenSSL-1.0.2 Message-ID: <61289a1968c02_33c9ee2b0a45dc19a82e2@prd-scan-dashboard-0.mail> Your request for analysis of OpenSSL-1.0.2 has been completed successfully. The results are available at https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7Hlun-2FGpeF2rhqKLKnzox0Gkw-3D-3DeB4-_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeGHWcqansoMnY0DK6-2FNqpICvGh9uMQ5h1a-2FE9Q7XEbhxwVUHEP-2BfZpjlKWVop-2FTXzAVnNi95Xc3NmLbGbx2keAkbjmSdQcBA6SDnA8p8A6VsYvHfiF8W5SPSaobFE4TOwdf-2BTBA1PSsavnF9gcP59dpoI8KYO3LfJZzNv-2FTW-2FSWLmM-2FKvn2Fuh2uciWpUu0qTY-3D Build ID: 404480 Analysis Summary: New defects found: 0 Defects eliminated: 0 From matt at openssl.org Fri Aug 27 08:38:58 2021 From: matt at openssl.org (Matt Caswell) Date: Fri, 27 Aug 2021 08:38:58 +0000 Subject: [web] master update Message-ID: <1630053538.441902.12977.nullmailer@dev.openssl.org> The branch master has been updated via 0374f7e7bd8802894fee0c15c474bd20e04f5731 (commit) from bac471c10fd4ed7b906de2a525ccd14e88bb15fb (commit) - Log ----------------------------------------------------------------- commit 0374f7e7bd8802894fee0c15c474bd20e04f5731 Author: Oleg Pekar Date: Fri Aug 27 00:15:52 2021 +0300 Update vulnerabilities.xml CLA: trivial Reviewed-by: Paul Dale Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/web/pull/253) ----------------------------------------------------------------------- Summary of changes: news/vulnerabilities.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/news/vulnerabilities.xml b/news/vulnerabilities.xml index bc380b1..a4211ca 100644 --- a/news/vulnerabilities.xml +++ b/news/vulnerabilities.xml @@ -94,7 +94,7 @@ heap allocated. - + From nic.tuv at gmail.com Fri Aug 27 11:55:50 2021 From: nic.tuv at gmail.com (nic.tuv at gmail.com) Date: Fri, 27 Aug 2021 11:55:50 +0000 Subject: [openssl] OpenSSL_1_1_1-stable update Message-ID: <1630065350.665879.3779.nullmailer@dev.openssl.org> The branch OpenSSL_1_1_1-stable has been updated via e93a82da60f52e6fc799323b99499ee51e8c7215 (commit) from 58e1e397c6774be11b903c0f88e85bd2b8c4206f (commit) - Log ----------------------------------------------------------------- commit e93a82da60f52e6fc799323b99499ee51e8c7215 Author: Bernd Edlinger Date: Wed Aug 25 14:30:12 2021 +0200 Fix instances of pointer addition with the NULL pointer ubsan found undefined pointer addtions in crypto/bio/bss_mem.c (mem_ctrl), crypto/pem/pem_lib.c (PEM_read_bio_ex), test/testutil/format_output.c (test_fail_string_common, test_fail_memory_common). Mostly a straight back-port-of: a07dc81 Additionally enable the ubsan run-checker, to prevent regressions. Reviewed-by: Tomas Mraz Reviewed-by: Nicola Tuveri (Merged from https://github.com/openssl/openssl/pull/16423) ----------------------------------------------------------------------- Summary of changes: .github/workflows/run-checker-merge.yml | 3 +-- crypto/bio/bss_mem.c | 2 +- crypto/pem/pem_lib.c | 23 +++++++++++++---------- test/testutil/format_output.c | 12 ++++++++---- 4 files changed, 23 insertions(+), 17 deletions(-) diff --git a/.github/workflows/run-checker-merge.yml b/.github/workflows/run-checker-merge.yml index 29419a2396..ff2d666b6d 100644 --- a/.github/workflows/run-checker-merge.yml +++ b/.github/workflows/run-checker-merge.yml @@ -16,8 +16,7 @@ jobs: no-engine no-shared, no-err, no-filenames, -# ubsan build is temporarily disabled, due to failures to be investigated separately -# enable-ubsan no-asm -DPEDANTIC -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=alignment, + enable-ubsan no-asm -DPEDANTIC -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=alignment, no-unit-test, enable-weak-ssl-ciphers, enable-zlib, diff --git a/crypto/bio/bss_mem.c b/crypto/bio/bss_mem.c index 7cb4a57813..14bfd00173 100644 --- a/crypto/bio/bss_mem.c +++ b/crypto/bio/bss_mem.c @@ -280,7 +280,7 @@ static long mem_ctrl(BIO *b, int cmd, long num, void *ptr) ret = (long)bm->length; if (ptr != NULL) { pptr = (char **)ptr; - *pptr = (char *)&(bm->data[0]); + *pptr = (char *)bm->data; } break; case BIO_C_SET_BUF_MEM: diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c index a26322119a..92dcd90a7f 100644 --- a/crypto/pem/pem_lib.c +++ b/crypto/pem/pem_lib.c @@ -899,18 +899,13 @@ err: int PEM_read_bio_ex(BIO *bp, char **name_out, char **header, unsigned char **data, long *len_out, unsigned int flags) { - EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new(); + EVP_ENCODE_CTX *ctx = NULL; const BIO_METHOD *bmeth; BIO *headerB = NULL, *dataB = NULL; char *name = NULL; int len, taillen, headerlen, ret = 0; BUF_MEM * buf_mem; - if (ctx == NULL) { - PEMerr(PEM_F_PEM_READ_BIO_EX, ERR_R_MALLOC_FAILURE); - return 0; - } - *len_out = 0; *name_out = *header = NULL; *data = NULL; @@ -933,9 +928,20 @@ int PEM_read_bio_ex(BIO *bp, char **name_out, char **header, if (!get_header_and_data(bp, &headerB, &dataB, name, flags)) goto end; - EVP_DecodeInit(ctx); BIO_get_mem_ptr(dataB, &buf_mem); len = buf_mem->length; + + /* There was no data in the PEM file */ + if (len == 0) + goto end; + + ctx = EVP_ENCODE_CTX_new(); + if (ctx == NULL) { + PEMerr(PEM_F_PEM_READ_BIO_EX, ERR_R_MALLOC_FAILURE); + goto end; + } + + EVP_DecodeInit(ctx); if (EVP_DecodeUpdate(ctx, (unsigned char*)buf_mem->data, &len, (unsigned char*)buf_mem->data, len) < 0 || EVP_DecodeFinal(ctx, (unsigned char*)&(buf_mem->data[len]), @@ -946,9 +952,6 @@ int PEM_read_bio_ex(BIO *bp, char **name_out, char **header, len += taillen; buf_mem->length = len; - /* There was no data in the PEM file; avoid malloc(0). */ - if (len == 0) - goto end; headerlen = BIO_get_mem_data(headerB, NULL); *header = pem_malloc(headerlen + 1, flags); *data = pem_malloc(len, flags); diff --git a/test/testutil/format_output.c b/test/testutil/format_output.c index 6ee2a1d266..f42141fd8d 100644 --- a/test/testutil/format_output.c +++ b/test/testutil/format_output.c @@ -107,8 +107,10 @@ static void test_fail_string_common(const char *prefix, const char *file, if (diff && i > 0) test_printf_stderr("% 4s %s\n", "", bdiff); } - m1 += n1; - m2 += n2; + if (m1 != NULL) + m1 += n1; + if (m2 != NULL) + m2 += n2; l1 -= n1; l2 -= n2; cnt += width; @@ -495,8 +497,10 @@ static void test_fail_memory_common(const char *prefix, const char *file, if (diff && i > 0) test_printf_stderr("% 4s %s\n", "", bdiff); } - m1 += n1; - m2 += n2; + if (m1 != NULL) + m1 += n1; + if (m2 != NULL) + m2 += n2; l1 -= n1; l2 -= n2; cnt += bytes; From bernd.edlinger at hotmail.de Sat Aug 28 05:23:24 2021 From: bernd.edlinger at hotmail.de (bernd.edlinger at hotmail.de) Date: Sat, 28 Aug 2021 05:23:24 +0000 Subject: [openssl] OpenSSL_1_1_1-stable update Message-ID: <1630128204.390148.12078.nullmailer@dev.openssl.org> The branch OpenSSL_1_1_1-stable has been updated via 876b7e97b848ba179c1dbe4a4a265dfffae0eba6 (commit) from e93a82da60f52e6fc799323b99499ee51e8c7215 (commit) - Log ----------------------------------------------------------------- commit 876b7e97b848ba179c1dbe4a4a265dfffae0eba6 Author: Bernd Edlinger Date: Thu Aug 26 20:10:16 2021 +0200 Fix enable-asan with C++ buildtest the following config: ./config no-shared enable-asan enable-buildtest-c++ enable-external-tests fails to build with unresolved asan symbols when linking test/ossl_shim/ossl_shim Fixed by passing all sanitizer-flags to cxxflags. Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16434) ----------------------------------------------------------------------- Summary of changes: Configure | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Configure b/Configure index b286dd0678..faf57b155a 100755 --- a/Configure +++ b/Configure @@ -1304,16 +1304,19 @@ if ($disabled{"dynamic-engine"}) { unless ($disabled{asan}) { push @{$config{cflags}}, "-fsanitize=address"; + push @{$config{cxxflags}}, "-fsanitize=address" if $config{CXX}; } unless ($disabled{ubsan}) { # -DPEDANTIC or -fnosanitize=alignment may also be required on some # platforms. push @{$config{cflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all"; + push @{$config{cxxflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all" if $config{CXX}; } unless ($disabled{msan}) { push @{$config{cflags}}, "-fsanitize=memory"; + push @{$config{cxxflags}}, "-fsanitize=memory" if $config{CXX}; } unless ($disabled{"fuzz-libfuzzer"} && $disabled{"fuzz-afl"} From scan-admin at coverity.com Sat Aug 28 07:52:40 2021 From: scan-admin at coverity.com (scan-admin at coverity.com) Date: Sat, 28 Aug 2021 07:52:40 +0000 (UTC) Subject: Coverity Scan: Analysis completed for openssl/openssl Message-ID: <6129eb47a7d94_3580792aba18061998489ec@prd-scan-dashboard-0.mail> Your request for analysis of openssl/openssl has been completed successfully. The results are available at https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7HlekBtV1P4YRtWclMVkCdvAA-3D-3DpZvS_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeFP9ueB6lSO4tGU1yxYpTB5EZV2ogrqk2D-2BM-2FQOluNeEQ8XZSSNWQ71fPawDVWxPjJBQygpLn0XIYwFP62zOi624zX-2B4lUNb1I8gxUieg3IG7VukTKsTfXF5bM7mY4bhTYrIrSrUpTtPNuLxHhTxbDpS9RCupgr4FuEbUU2lC4ZwerjtAtqiHRraJNR3Lunyv0-3D Build ID: 404632 Analysis Summary: New defects found: 0 Defects eliminated: 0 From scan-admin at coverity.com Sat Aug 28 07:53:01 2021 From: scan-admin at coverity.com (scan-admin at coverity.com) Date: Sat, 28 Aug 2021 07:53:01 +0000 (UTC) Subject: Coverity Scan: Analysis completed for OpenSSL-1.0.2 Message-ID: <6129eb5d3dd31_3580af2aba1806199848922@prd-scan-dashboard-0.mail> Your request for analysis of OpenSSL-1.0.2 has been completed successfully. The results are available at https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7Hlun-2FGpeF2rhqKLKnzox0Gkw-3D-3DC4pq_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeGlaE244uFVxusbb36c6-2FD9Azng4wP6l2mYCFO6g9f6Hbup-2BsZztOy3ozTNYjjygtgeNf7JJmulRbzclkR0NNYIt-2FVDlCvFcaL0Ccnq-2FJNw6Irilo1NqnAThfHgZTI-2FqgHG2C7mqKitQfgO4w7moQDBqhpF-2BB94NPgxhNDk7f-2FfChM9smfiyvOFBCSanxOFzTU-3D Build ID: 404633 Analysis Summary: New defects found: 0 Defects eliminated: 0 From beldmit at gmail.com Sat Aug 28 09:13:09 2021 From: beldmit at gmail.com (beldmit at gmail.com) Date: Sat, 28 Aug 2021 09:13:09 +0000 Subject: [openssl] master update Message-ID: <1630141989.664360.6234.nullmailer@dev.openssl.org> The branch master has been updated via 20b39175b59b5ae83223bbb9f743c73ae822d681 (commit) from 5327da81f0c70e35bdd8860af9af351313ca4ae2 (commit) - Log ----------------------------------------------------------------- commit 20b39175b59b5ae83223bbb9f743c73ae822d681 Author: Rich Salz Date: Thu Aug 26 16:03:15 2021 -0400 Yet another doc-nits fix Reviewed-by: Richard Levitte Reviewed-by: Paul Dale Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/16436) ----------------------------------------------------------------------- Summary of changes: doc/man1/openssl-req.pod.in | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/doc/man1/openssl-req.pod.in b/doc/man1/openssl-req.pod.in index 9926901571..e78b04c65b 100644 --- a/doc/man1/openssl-req.pod.in +++ b/doc/man1/openssl-req.pod.in @@ -401,8 +401,7 @@ The options available are described in detail below. =over 4 -=item B -=item B +=item B, B The passwords for the input private key file (if present) and the output private key file (if one will be created). The From bernd.edlinger at hotmail.de Sat Aug 28 14:46:58 2021 From: bernd.edlinger at hotmail.de (bernd.edlinger at hotmail.de) Date: Sat, 28 Aug 2021 14:46:58 +0000 Subject: [openssl] master update Message-ID: <1630162018.652510.8996.nullmailer@dev.openssl.org> The branch master has been updated via cce935b23ce2f7942e2ef4368dd93b60e21d3d83 (commit) from 20b39175b59b5ae83223bbb9f743c73ae822d681 (commit) - Log ----------------------------------------------------------------- commit cce935b23ce2f7942e2ef4368dd93b60e21d3d83 Author: Bernd Edlinger Date: Fri Aug 27 13:11:39 2021 +0200 Fix the "Out of memory" EVP KDF scrypt test This test did not really execute, since usually the OPENSSL_malloc(0) will fail and prevent the execution of the KDF. Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16444) ----------------------------------------------------------------------- Summary of changes: test/evp_test.c | 4 ++-- test/recipes/30-test_evp_data/evpkdf_scrypt.txt | 2 +- test/recipes/30-test_evp_data/evppkey_kdf_scrypt.txt | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/test/evp_test.c b/test/evp_test.c index 0009cae442..075abc5ad9 100644 --- a/test/evp_test.c +++ b/test/evp_test.c @@ -2664,7 +2664,7 @@ static int kdf_test_run(EVP_TEST *t) t->err = "KDF_CTRL_ERROR"; return 1; } - if (!TEST_ptr(got = OPENSSL_malloc(got_len))) { + if (!TEST_ptr(got = OPENSSL_malloc(got_len == 0 ? 1 : got_len))) { t->err = "INTERNAL_ERROR"; goto err; } @@ -2760,7 +2760,7 @@ static int pkey_kdf_test_run(EVP_TEST *t) unsigned char *got = NULL; size_t got_len = expected->output_len; - if (!TEST_ptr(got = OPENSSL_malloc(got_len))) { + if (!TEST_ptr(got = OPENSSL_malloc(got_len == 0 ? 1 : got_len))) { t->err = "INTERNAL_ERROR"; goto err; } diff --git a/test/recipes/30-test_evp_data/evpkdf_scrypt.txt b/test/recipes/30-test_evp_data/evpkdf_scrypt.txt index 7aba716246..64176091fc 100644 --- a/test/recipes/30-test_evp_data/evpkdf_scrypt.txt +++ b/test/recipes/30-test_evp_data/evpkdf_scrypt.txt @@ -60,4 +60,4 @@ Ctrl.salt = salt:SodiumChloride Ctrl.N = n:1048576 Ctrl.r = r:8 Ctrl.p = p:1 -Result = INTERNAL_ERROR +Result = KDF_MISMATCH diff --git a/test/recipes/30-test_evp_data/evppkey_kdf_scrypt.txt b/test/recipes/30-test_evp_data/evppkey_kdf_scrypt.txt index 086451a44c..1f7c06c6d4 100644 --- a/test/recipes/30-test_evp_data/evppkey_kdf_scrypt.txt +++ b/test/recipes/30-test_evp_data/evppkey_kdf_scrypt.txt @@ -60,4 +60,4 @@ Ctrl.salt = salt:SodiumChloride Ctrl.N = N:1048576 Ctrl.r = r:8 Ctrl.p = p:1 -Result = INTERNAL_ERROR +Result = KDF_MISMATCH From bernd.edlinger at hotmail.de Sat Aug 28 14:50:01 2021 From: bernd.edlinger at hotmail.de (bernd.edlinger at hotmail.de) Date: Sat, 28 Aug 2021 14:50:01 +0000 Subject: [openssl] OpenSSL_1_1_1-stable update Message-ID: <1630162201.176586.10230.nullmailer@dev.openssl.org> The branch OpenSSL_1_1_1-stable has been updated via dc3520b1ad3e1d70b899210bacc002318ebe276a (commit) from 876b7e97b848ba179c1dbe4a4a265dfffae0eba6 (commit) - Log ----------------------------------------------------------------- commit dc3520b1ad3e1d70b899210bacc002318ebe276a Author: Bernd Edlinger Date: Fri Aug 27 13:11:39 2021 +0200 Fix the "Out of memory" EVP KDF scrypt test This test did not really execute, since usually the OPENSSL_malloc(0) will fail and prevent the execution of the KDF. Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16446) ----------------------------------------------------------------------- Summary of changes: test/evp_test.c | 2 +- test/recipes/30-test_evp_data/evpkdf.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/test/evp_test.c b/test/evp_test.c index abb51384e8..d4cca6dbcb 100644 --- a/test/evp_test.c +++ b/test/evp_test.c @@ -1777,7 +1777,7 @@ static int kdf_test_run(EVP_TEST *t) unsigned char *got = NULL; size_t got_len = expected->output_len; - if (!TEST_ptr(got = OPENSSL_malloc(got_len))) { + if (!TEST_ptr(got = OPENSSL_malloc(got_len == 0 ? 1 : got_len))) { t->err = "INTERNAL_ERROR"; goto err; } diff --git a/test/recipes/30-test_evp_data/evpkdf.txt b/test/recipes/30-test_evp_data/evpkdf.txt index 9a6cc28385..8fe0df3972 100644 --- a/test/recipes/30-test_evp_data/evpkdf.txt +++ b/test/recipes/30-test_evp_data/evpkdf.txt @@ -301,5 +301,5 @@ Ctrl.salt = salt:SodiumChloride Ctrl.N = N:1048576 Ctrl.r = r:8 Ctrl.p = p:1 -Result = INTERNAL_ERROR +Result = KDF_MISMATCH From beldmit at gmail.com Sat Aug 28 19:33:28 2021 From: beldmit at gmail.com (beldmit at gmail.com) Date: Sat, 28 Aug 2021 19:33:28 +0000 Subject: [openssl] master update Message-ID: <1630179208.618766.12929.nullmailer@dev.openssl.org> The branch master has been updated via d15506874bff1b128b36ceb847d24ac4b8cd4958 (commit) from cce935b23ce2f7942e2ef4368dd93b60e21d3d83 (commit) - Log ----------------------------------------------------------------- commit d15506874bff1b128b36ceb847d24ac4b8cd4958 Author: Dmitry Belyavskiy Date: Fri Aug 27 18:03:15 2021 +0200 Adjust the list of default provider's algorithms Reviewed-by: Matt Caswell Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16448) ----------------------------------------------------------------------- Summary of changes: doc/man7/OSSL_PROVIDER-default.pod | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/doc/man7/OSSL_PROVIDER-default.pod b/doc/man7/OSSL_PROVIDER-default.pod index 88ae3fec9d..14d590cbde 100644 --- a/doc/man7/OSSL_PROVIDER-default.pod +++ b/doc/man7/OSSL_PROVIDER-default.pod @@ -81,24 +81,12 @@ The OpenSSL default provider supports these operations and algorithms: =item CAMELLIA, see L -=item DES, see L - -=item BF, see L - -=item IDEA, see L - -=item CAST5, see L +=item 3DES, see L =item SEED, see L =item SM4, see L -=item RC2, see L - -=item RC4, see L - -=item RC5, see L - =item ChaCha20, see L =item ChaCha20-Poly1305, see L From scan-admin at coverity.com Sun Aug 29 07:49:46 2021 From: scan-admin at coverity.com (scan-admin at coverity.com) Date: Sun, 29 Aug 2021 07:49:46 +0000 (UTC) Subject: Coverity Scan: Analysis completed for openssl/openssl Message-ID: <612b3c1996711_3738992b1c3dd079902438@prd-scan-dashboard-0.mail> Your request for analysis of openssl/openssl has been completed successfully. The results are available at https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7HlekBtV1P4YRtWclMVkCdvAA-3D-3DHoSa_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeGhBLrhkAfFpJWKILw4BeuUuTPvgRKTfKJ65QDME5tlCI9FrLPu9BZ1-2BEbrRtZL6LkqLJUmYkofMpVe07b3IDgEaRDIlpv3KxF20g-2F8RbeOfnO26CnJGpc8MYI7AaRJ2vNqmbDCEZtDKAC1AOlosL-2FH-2BPdRINlx-2BnlTK5bwSIFgStv6gW2e2MEee56FteM4uLw-3D Build ID: 404789 Analysis Summary: New defects found: 0 Defects eliminated: 0 From scan-admin at coverity.com Sun Aug 29 07:52:49 2021 From: scan-admin at coverity.com (scan-admin at coverity.com) Date: Sun, 29 Aug 2021 07:52:49 +0000 (UTC) Subject: Coverity Scan: Analysis completed for OpenSSL-1.0.2 Message-ID: <612b3cd151274_3739922b1c3dd079902489@prd-scan-dashboard-0.mail> Your request for analysis of OpenSSL-1.0.2 has been completed successfully. The results are available at https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7Hlun-2FGpeF2rhqKLKnzox0Gkw-3D-3D92Uz_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeHm1Ctd-2FBYyQXQEEqHZ-2Bj-2BkH9-2BubA8P8Cu8sd0bUfYHgqhxORrch1Z-2B34JkTiApPJhjxtCNu6DnkJQOpXTVoz3TZPti2d0RvNSpaE6r43n4OzVkHFKPxdBepIXcyRrRphij9qpoISkexBh3x3kFvrPGAZLvAzWObbOgO2Rhkb3tTNpVUBfeePSoFT-2BQqdQ-2FwPg-3D Build ID: 404790 Analysis Summary: New defects found: 0 Defects eliminated: 0 From beldmit at gmail.com Sun Aug 29 16:55:26 2021 From: beldmit at gmail.com (beldmit at gmail.com) Date: Sun, 29 Aug 2021 16:55:26 +0000 Subject: [openssl] master update Message-ID: <1630256126.750783.8918.nullmailer@dev.openssl.org> The branch master has been updated via e8e1f6d1a9e599d575431f559200018b8f822e0f (commit) from d15506874bff1b128b36ceb847d24ac4b8cd4958 (commit) - Log ----------------------------------------------------------------- commit e8e1f6d1a9e599d575431f559200018b8f822e0f Author: Daniel Kr?gler Date: Fri Aug 27 18:32:20 2021 +0200 Ensure that _GNU_SOURCE is defined for bss_dgram.c This fixes the following error with gcc10 under strict ANSI conditions: .../crypto/bio/bss_dgram.c:373:20: error: 'const struct in6_addr' has no member named 's6_addr32' CLA: trivial Fixes #16449 Reviewed-by: Bernd Edlinger Reviewed-by: Paul Dale Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/16451) ----------------------------------------------------------------------- Summary of changes: crypto/bio/bss_dgram.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c index c79abe8746..8e7daa1998 100644 --- a/crypto/bio/bss_dgram.c +++ b/crypto/bio/bss_dgram.c @@ -7,6 +7,10 @@ * https://www.openssl.org/source/license.html */ +#ifndef _GNU_SOURCE +# define _GNU_SOURCE +#endif + #include #include From beldmit at gmail.com Sun Aug 29 16:56:46 2021 From: beldmit at gmail.com (beldmit at gmail.com) Date: Sun, 29 Aug 2021 16:56:46 +0000 Subject: [openssl] OpenSSL_1_1_1-stable update Message-ID: <1630256206.249837.9979.nullmailer@dev.openssl.org> The branch OpenSSL_1_1_1-stable has been updated via 0888183816636f994a3384cde211c88e0d4d1f6a (commit) from dc3520b1ad3e1d70b899210bacc002318ebe276a (commit) - Log ----------------------------------------------------------------- commit 0888183816636f994a3384cde211c88e0d4d1f6a Author: Daniel Kr?gler Date: Fri Aug 27 18:32:20 2021 +0200 Ensure that _GNU_SOURCE is defined for bss_dgram.c This fixes the following error with gcc10 under strict ANSI conditions: .../crypto/bio/bss_dgram.c:373:20: error: 'const struct in6_addr' has no member named 's6_addr32' CLA: trivial Fixes #16449 Reviewed-by: Bernd Edlinger Reviewed-by: Paul Dale Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/16451) (cherry picked from commit e8e1f6d1a9e599d575431f559200018b8f822e0f) ----------------------------------------------------------------------- Summary of changes: crypto/bio/bss_dgram.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c index 942fd8b514..2b2e4d5f88 100644 --- a/crypto/bio/bss_dgram.c +++ b/crypto/bio/bss_dgram.c @@ -7,6 +7,10 @@ * https://www.openssl.org/source/license.html */ +#ifndef _GNU_SOURCE +# define _GNU_SOURCE +#endif + #include #include From openssl at openssl.org Sun Aug 29 22:59:28 2021 From: openssl at openssl.org (OpenSSL run-checker) Date: Sun, 29 Aug 2021 22:59:28 +0000 Subject: Still FAILED build of OpenSSL branch master with options enable-fuzz-afl no-shared no-module Message-ID: <1630277968.735023.737322.nullmailer@run.openssl.org> Platform and configuration command: $ uname -a Linux run 5.4.0-74-generic #83-Ubuntu SMP Sat May 8 02:35:39 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux $ CC=afl-clang-fast ../openssl/config enable-fuzz-afl no-shared no-module Commit log since last time: e8e1f6d1a9 Ensure that _GNU_SOURCE is defined for bss_dgram.c d15506874b Adjust the list of default provider's algorithms cce935b23c Fix the "Out of memory" EVP KDF scrypt test 20b39175b5 Yet another doc-nits fix 5327da81f0 cms: fix memleaks in cms_env.c 597d24e2ab Fix libdir path on darwin c023d98dcf Darwin platform allows to build on releases before Yosemite/ios 8. 6f242d224c doc: Add note about operation parameters validation 194fcc9ae0 Add a test for running the config twice f38af12585 Add locking for the provider_conf.c 6f25d3c479 When activating providers via config check we've not already activated them Build log ended with (last 100 lines): # SSL_accept() failed -1, 1 # 40C72C5BD57F0000:error:068C0100:asn1 encoding routines:ASN1_STRING_set:malloc failure:../openssl/crypto/asn1/asn1_lib.c:311: # 40C72C5BD57F0000:error:068C0100:asn1 encoding routines:asn1_ex_c2i:malloc failure:../openssl/crypto/asn1/tasn_dec.c:944: # 40C72C5BD57F0000:error:0688010A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../openssl/crypto/asn1/tasn_dec.c:685:Field=session_id, Type=SSL_SESSION_ASN1 # 40C72C5BD57F0000:error:0A0C0103:SSL routines:construct_stateless_ticket:internal error:../openssl/ssl/statem/statem_srvr.c:3706: # INFO: @ ../openssl/test/helpers/ssltestlib.c:957 # SSL_connect() failed -1, 1 # 40C72C5BD57F0000:error:0A000438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error:../openssl/ssl/record/rec_layer_s3.c:1584:SSL alert number 80 # ERROR: (bool) 'create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE) == true' failed @ ../openssl/test/sslapitest.c:9260 # false # OPENSSL_TEST_RAND_ORDER=1630275661 not ok 372 - iteration 7 # ------------------------------------------------------------------------------ # OPENSSL_TEST_RAND_ORDER=1630275661 not ok 74 - test_dh_auto # ------------------------------------------------------------------------------ # INFO: @ ../openssl/test/helpers/ssltestlib.c:975 # SSL_accept() failed -1, 1 # 40C72C5BD57F0000:error:068C0100:asn1 encoding routines:ASN1_STRING_set:malloc failure:../openssl/crypto/asn1/asn1_lib.c:311: # 40C72C5BD57F0000:error:068C0100:asn1 encoding routines:asn1_ex_c2i:malloc failure:../openssl/crypto/asn1/tasn_dec.c:944: # 40C72C5BD57F0000:error:0688010A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../openssl/crypto/asn1/tasn_dec.c:685: # 40C72C5BD57F0000:error:0688010A:asn1 encoding routines:asn1_template_ex_d2i:nested asn1 error:../openssl/crypto/asn1/tasn_dec.c:537:Field=session_id_context, Type=SSL_SESSION_ASN1 # 40C72C5BD57F0000:error:0A0C0103:SSL routines:construct_stateless_ticket:internal error:../openssl/ssl/statem/statem_srvr.c:3706: # INFO: @ ../openssl/test/helpers/ssltestlib.c:1004 # No progress made # ERROR: (bool) 'create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE) == true' failed @ ../openssl/test/sslapitest.c:9315 # false # OPENSSL_TEST_RAND_ORDER=1630275661 not ok 75 - test_sni_tls13 # ------------------------------------------------------------------------------ ../../util/wrap.pl ../../test/sslapitest ../../../openssl/test/certs ../../../openssl/test/recipes/90-test_sslapi_data/passwd.txt /tmp/tUlXl_w_Bz default ../../../openssl/test/default.cnf => 1 not ok 1 - running sslapitest # ------------------------------------------------------------------------------ # Failed test 'running sslapitest' # at ../openssl/test/recipes/90-test_sslapi.t line 32. # Looks like you failed 1 test of 1.90-test_sslapi.t ................... Dubious, test returned 1 (wstat 256, 0x100) Failed 1/1 subtests Test Summary Report ------------------- 80-test_ssl_new.t (Wstat: 7168 Tests: 30 Failed: 28) Failed tests: 1-21, 23-28, 30 Non-zero exit status: 28 20-test_spkac.t (Wstat: 512 Tests: 4 Failed: 2) Failed tests: 2, 4 Non-zero exit status: 2 25-test_crl.t (Wstat: 256 Tests: 10 Failed: 1) Failed test: 3 Non-zero exit status: 1 25-test_sid.t (Wstat: 256 Tests: 2 Failed: 1) Failed test: 2 Non-zero exit status: 1 65-test_cmp_ctx.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_asyncio.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_clienthello.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_recordlen.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_servername.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_ca.t (Wstat: 256 Tests: 15 Failed: 1) Failed test: 5 Non-zero exit status: 1 80-test_dtls_mtu.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_dtls.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_pkcs12.t (Wstat: 768 Tests: 13 Failed: 3) Failed tests: 1-3 Non-zero exit status: 3 80-test_sslcorrupt.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 90-test_sslbuffers.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 90-test_v3name.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_ssl_old.t (Wstat: 1024 Tests: 6 Failed: 4) Failed tests: 3-6 Non-zero exit status: 4 90-test_sslapi.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 Files=241, Tests=2837, 277 wallclock secs (14.91 usr 1.68 sys + 947.48 cusr 73.84 csys = 1037.91 CPU) Result: FAIL make[1]: *** [Makefile:2581: run_tests] Error 1 make[1]: Leaving directory '/home/openssl/run-checker/enable-fuzz-afl' make: *** [Makefile:2577: tests] Error 2 From scan-admin at coverity.com Mon Aug 30 07:54:09 2021 From: scan-admin at coverity.com (scan-admin at coverity.com) Date: Mon, 30 Aug 2021 07:54:09 +0000 (UTC) Subject: Coverity Scan: Analysis completed for OpenSSL-1.0.2 Message-ID: <612c8ea11ed7b_38f4ac2b0d162859a8158fa@prd-scan-dashboard-0.mail> Your request for analysis of OpenSSL-1.0.2 has been completed successfully. The results are available at https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7Hlun-2FGpeF2rhqKLKnzox0Gkw-3D-3DoVbZ_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeF5vr58wLfxqrTl1x7m7FYk52Ox2AyFzQywLd-2B3gsmXhGhvm0WEkX0xHl2e-2BiQPKniAWWb24WRjTMBeaUJ8gC7meiIdToLgnAuxQsRHpHlNGc7nDaboMBQKTjDHRb28mGGY6ASPXZnvKCJsbVRCcpfgmoYHRIewc2FQ8YUlMzaIoh7uN3S-2Bhor5Mr4VhTcD5BU-3D Build ID: 404946 Analysis Summary: New defects found: 0 Defects eliminated: 0 From scan-admin at coverity.com Mon Aug 30 07:54:51 2021 From: scan-admin at coverity.com (scan-admin at coverity.com) Date: Mon, 30 Aug 2021 07:54:51 +0000 (UTC) Subject: Coverity Scan: Analysis completed for openssl/openssl Message-ID: <612c8ecaba8d1_38f4f12b0d162859a815883@prd-scan-dashboard-0.mail> Your request for analysis of openssl/openssl has been completed successfully. The results are available at https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7HlekBtV1P4YRtWclMVkCdvAA-3D-3DoW_d_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeHFvxbnlGGBJWL-2Bz9TxafMCMmdWjIMzyRvZUUG-2FhDDGiXH4TBgo6Pn6xCXzMRu9G6txtn-2BgjxqV8m0ks3ll9GfcS0MX1rsD1U78Dp-2Fv8oxAuzJkwAbDiWDA-2BUD6ENa7PiiFkyXoDV-2FCsfiOXRXBebtRwyFG1eH4rpYwnHWE8IEblfwqup63CpCrLbcyiw5HI8Y-3D Build ID: 404944 Analysis Summary: New defects found: 0 Defects eliminated: 0 From tomas at openssl.org Mon Aug 30 10:28:29 2021 From: tomas at openssl.org (tomas at openssl.org) Date: Mon, 30 Aug 2021 10:28:29 +0000 Subject: [openssl] OpenSSL_1_1_1-stable update Message-ID: <1630319309.208459.3822.nullmailer@dev.openssl.org> The branch OpenSSL_1_1_1-stable has been updated via f661c76a9e27a87f4bbbed135faf89a3fccac75f (commit) from 0888183816636f994a3384cde211c88e0d4d1f6a (commit) - Log ----------------------------------------------------------------- commit f661c76a9e27a87f4bbbed135faf89a3fccac75f Author: Bernd Edlinger Date: Fri Aug 27 21:34:37 2021 +0200 Fix no-tls1_3 tests This recently added test needs DH2048 to work without tls1_3. Fixes: #16335 Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16453) ----------------------------------------------------------------------- Summary of changes: .github/workflows/run-checker-ci.yml | 3 +-- .github/workflows/run-checker-daily.yml | 3 +-- test/recipes/80-test_ssl_old.t | 2 +- test/ssltest_old.c | 41 +++++++++++++++++++++++++++++++++ 4 files changed, 44 insertions(+), 5 deletions(-) diff --git a/.github/workflows/run-checker-ci.yml b/.github/workflows/run-checker-ci.yml index 7a171bff9d..a999492207 100644 --- a/.github/workflows/run-checker-ci.yml +++ b/.github/workflows/run-checker-ci.yml @@ -20,8 +20,7 @@ jobs: no-tests, no-threads, no-tls, -# no-tls1_3 temporarily disabled due to failures to be investigated separately -# no-tls1_3, + no-tls1_3, no-ts, no-ui, ] diff --git a/.github/workflows/run-checker-daily.yml b/.github/workflows/run-checker-daily.yml index c1b0327ae3..e335b87b31 100644 --- a/.github/workflows/run-checker-daily.yml +++ b/.github/workflows/run-checker-daily.yml @@ -50,8 +50,7 @@ jobs: no-egd, no-engine, no-external-tests, -# no-tls1_3 temporarily disabled due to failures to be investigated separately -# no-tls1_3, + no-tls1_3, no-fuzz-afl, no-fuzz-libfuzzer, no-gost, diff --git a/test/recipes/80-test_ssl_old.t b/test/recipes/80-test_ssl_old.t index 6f5fdb7669..9800de0fc8 100644 --- a/test/recipes/80-test_ssl_old.t +++ b/test/recipes/80-test_ssl_old.t @@ -519,7 +519,7 @@ sub testssl { skip "skipping auto PSK tests", 1 if ($no_dh || $no_psk || $no_ec); - ok(run(test(['ssltest_old', '-psk', '0102030405', '-cipher', '@SECLEVEL=2:DHE-PSK-AES128-CCM'])), + ok(run(test(['ssltest_old', '-dhe2048', '-psk', '0102030405', '-cipher', '@SECLEVEL=2:DHE-PSK-AES128-CCM'])), 'test auto DH meets security strength'); } } diff --git a/test/ssltest_old.c b/test/ssltest_old.c index 36e6031f3a..cc98e4f866 100644 --- a/test/ssltest_old.c +++ b/test/ssltest_old.c @@ -95,6 +95,7 @@ struct app_verify_arg { static DH *get_dh512(void); static DH *get_dh1024(void); static DH *get_dh1024dsa(void); +static DH *get_dh2048(void); #endif static char *psk_key = NULL; /* by default PSK is not used */ @@ -641,6 +642,8 @@ static void sv_usage(void) " -dhe1024 - use 1024 bit key (safe prime) for DHE (default, no-op)\n"); fprintf(stderr, " -dhe1024dsa - use 1024 bit key (with 160-bit subprime) for DHE\n"); + fprintf(stderr, + " -dhe2048 - use 2048 bit key (rfc3526 pime) for DHE\n"); fprintf(stderr, " -no_dhe - disable DHE\n"); #endif #ifndef OPENSSL_NO_EC @@ -895,6 +898,7 @@ int main(int argc, char *argv[]) #ifndef OPENSSL_NO_DH DH *dh; int dhe512 = 0, dhe1024dsa = 0; + int dhe2048 = 0; #endif int no_dhe = 0; int no_psk = 0; @@ -989,6 +993,13 @@ int main(int argc, char *argv[]) #else fprintf(stderr, "ignoring -dhe512, since I'm compiled without DH\n"); +#endif + } else if (strcmp(*argv, "-dhe2048") == 0) { +#ifndef OPENSSL_NO_DH + dhe2048 = 1; +#else + fprintf(stderr, + "ignoring -dhe2048, since I'm compiled without DH\n"); #endif } else if (strcmp(*argv, "-dhe1024dsa") == 0) { #ifndef OPENSSL_NO_DH @@ -1482,6 +1493,8 @@ int main(int argc, char *argv[]) dh = get_dh1024dsa(); } else if (dhe512) dh = get_dh512(); + else if (dhe2048) + dh = get_dh2048(); else dh = get_dh1024(); SSL_CTX_set_tmp_dh(s_ctx, dh); @@ -3019,6 +3032,34 @@ static DH *get_dh1024dsa(void) DH_set_length(dh, 160); return dh; } + +static DH *get_dh2048(void) +{ + BIGNUM *p = NULL, *g = NULL; + DH *dh = NULL; + + if ((dh = DH_new()) == NULL) + return NULL; + + g = BN_new(); + if (g == NULL || !BN_set_word(g, 2)) + goto err; + + p = BN_get_rfc3526_prime_2048(NULL); + if (p == NULL) + goto err; + + if (!DH_set0_pqg(dh, p, NULL, g)) + goto err; + + return dh; + + err: + DH_free(dh); + BN_free(p); + BN_free(g); + return NULL; +} #endif #ifndef OPENSSL_NO_PSK From nic.tuv at gmail.com Mon Aug 30 12:24:12 2021 From: nic.tuv at gmail.com (nic.tuv at gmail.com) Date: Mon, 30 Aug 2021 12:24:12 +0000 Subject: [openssl] master update Message-ID: <1630326252.449686.24257.nullmailer@dev.openssl.org> The branch master has been updated via 78082769fa8129e3453ee4cb2255feb259846646 (commit) via 7aa3dfc42104588f65301d20324388ac2c9a6b11 (commit) via cca8a4cedaafe63b0b5729b72133661ece24ff08 (commit) via ea1128e94e36fa9fa25278dc6b3f5b42d8735782 (commit) from e8e1f6d1a9e599d575431f559200018b8f822e0f (commit) - Log ----------------------------------------------------------------- commit 78082769fa8129e3453ee4cb2255feb259846646 Author: Nicola Tuveri Date: Sat Aug 21 04:04:51 2021 +0300 Use applink to fix windows tests (readapted from 5c69c66a6972f84d56160c9ea4b30bab8fc2d3d4 by @bernd-edlinger) Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16355) commit 7aa3dfc42104588f65301d20324388ac2c9a6b11 Author: Nicola Tuveri Date: Thu Jul 16 03:23:26 2020 +0300 [ec] Do not default to OPENSSL_EC_NAMED_CURVE for curves without OID Some curves don't have an associated OID: for those we should not default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`. This is a follow-up to https://github.com/openssl/openssl/pull/12312 Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16355) commit cca8a4cedaafe63b0b5729b72133661ece24ff08 Author: Nicola Tuveri Date: Thu Jul 16 02:02:16 2020 +0300 Fix d2i_ECPKParameters_fp and i2d_ECPKParameters_fp macros These functions are part of the public API but we don't have tests covering their usage. They are actually implemented as macros and the absence of tests has caused them to fall out-of-sync with the latest changes to ASN1 related functions and cause compilation warnings. This commit fixes the public headers to reflect these changes. Fixes #12443 Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16355) commit ea1128e94e36fa9fa25278dc6b3f5b42d8735782 Author: Nicola Tuveri Date: Thu Jul 16 01:57:09 2020 +0300 Add tests for i2d_TYPE_fp and d2i_TYPE_fp These functions are part of the public API but we don't have tests covering their usage. They are actually implemented as macros and the absence of tests has caused them to fall out-of-sync with the latest changes to ASN1 related functions and cause compilation warnings. @@ Note: This commit limits to ECPKParameters as a type. Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16355) ----------------------------------------------------------------------- Summary of changes: crypto/ec/ec_asn1.c | 2 +- crypto/ec/ec_curve.c | 37 +++++++++++++++++++++++++++++++++++++ include/openssl/ec.h | 6 +++--- test/build.info | 7 ++++++- test/ec_internal_test.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 90 insertions(+), 5 deletions(-) diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c index b3a791eb64..31519137c6 100644 --- a/crypto/ec/ec_asn1.c +++ b/crypto/ec/ec_asn1.c @@ -485,7 +485,7 @@ ECPKPARAMETERS *EC_GROUP_get_ecpkparameters(const EC_GROUP *group, ECPARAMETERS_free(ret->value.parameters); } - if (EC_GROUP_get_asn1_flag(group)) { + if (EC_GROUP_get_asn1_flag(group) == OPENSSL_EC_NAMED_CURVE) { /* * use the asn1 OID to describe the elliptic curve parameters */ diff --git a/crypto/ec/ec_curve.c b/crypto/ec/ec_curve.c index 6f1435c69f..b5b2f3342d 100644 --- a/crypto/ec/ec_curve.c +++ b/crypto/ec/ec_curve.c @@ -3223,6 +3223,43 @@ static EC_GROUP *ec_group_new_from_data(OSSL_LIB_CTX *libctx, goto err; } } + +#ifndef FIPS_MODULE + if (EC_GROUP_get_asn1_flag(group) == OPENSSL_EC_NAMED_CURVE) { + /* + * Some curves don't have an associated OID: for those we should not + * default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and + * instead set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`. + * + * Note that `OPENSSL_EC_NAMED_CURVE` is set as the default ASN1 flag on + * `EC_GROUP_new()`, when we don't have enough elements to determine if + * an OID for the curve name actually exists. + * We could implement this check on `EC_GROUP_set_curve_name()` but + * overloading the simple setter with this lookup could have a negative + * performance impact and unexpected consequences. + */ + ASN1_OBJECT *asn1obj = OBJ_nid2obj(curve.nid); + + if (asn1obj == NULL) { + ERR_raise(ERR_LIB_EC, ERR_R_OBJ_LIB); + goto err; + } + if (OBJ_length(asn1obj) == 0) + EC_GROUP_set_asn1_flag(group, OPENSSL_EC_EXPLICIT_CURVE); + + ASN1_OBJECT_free(asn1obj); + } +#else + /* + * Inside the FIPS module we do not support explicit curves anyway + * so the above check is not necessary. + * + * Skipping it is also necessary because `OBJ_length()` and + * `ASN1_OBJECT_free()` are not available within the FIPS module + * boundaries. + */ +#endif + ok = 1; err: if (!ok) { diff --git a/include/openssl/ec.h b/include/openssl/ec.h index 8b1abcebb7..f59b4f9288 100644 --- a/include/openssl/ec.h +++ b/include/openssl/ec.h @@ -915,10 +915,10 @@ int i2d_ECPKParameters(const EC_GROUP *, unsigned char **out); # define i2d_ECPKParameters_bio(bp,x) \ ASN1_i2d_bio_of(EC_GROUP, i2d_ECPKParameters, bp, x) # define d2i_ECPKParameters_fp(fp,x) \ - (EC_GROUP *)ASN1_d2i_fp(NULL, (char *(*)())d2i_ECPKParameters, (fp), \ - (unsigned char **)(x)) + (EC_GROUP *)ASN1_d2i_fp(NULL, (d2i_of_void *)d2i_ECPKParameters, (fp), \ + (void **)(x)) # define i2d_ECPKParameters_fp(fp,x) \ - ASN1_i2d_fp(i2d_ECPKParameters,(fp), (unsigned char *)(x)) + ASN1_i2d_fp((i2d_of_void *)i2d_ECPKParameters, (fp), (void *)(x)) # ifndef OPENSSL_NO_DEPRECATED_3_0 OSSL_DEPRECATEDIN_3_0 int ECPKParameters_print(BIO *bp, const EC_GROUP *x, diff --git a/test/build.info b/test/build.info index dab5af4ebe..2e209b45c7 100644 --- a/test/build.info +++ b/test/build.info @@ -12,6 +12,11 @@ ENDIF IF[{- $config{target} =~ /^vms-/ -}] $AUXLIBAPPSSRC=../apps/lib/vms_term_sock.c ../apps/lib/vms_decc_argv.c ENDIF +# Program init source, that don't have direct linkage with the rest of the +# source, and can therefore not be part of a library. +IF[{- !$disabled{uplink} -}] + $INITSRC=../ms/applink.c +ENDIF $LIBAPPSSRC=../apps/lib/opt.c $AUXLIBAPPSSRC IF[{- !$disabled{tests} -}] @@ -712,7 +717,7 @@ IF[{- !$disabled{tests} -}] INCLUDE[rc5test]=../include ../apps/include DEPEND[rc5test]=../libcrypto.a libtestutil.a - SOURCE[ec_internal_test]=ec_internal_test.c + SOURCE[ec_internal_test]=ec_internal_test.c $INITSRC INCLUDE[ec_internal_test]=../include ../crypto/ec ../apps/include DEPEND[ec_internal_test]=../libcrypto.a libtestutil.a diff --git a/test/ec_internal_test.c b/test/ec_internal_test.c index e0e6a859cb..57092942a1 100644 --- a/test/ec_internal_test.c +++ b/test/ec_internal_test.c @@ -359,6 +359,47 @@ static int decoded_flag_test(void) return testresult; } +static +int ecpkparams_i2d2i_test(int n) +{ + EC_GROUP *g1 = NULL, *g2 = NULL; + FILE *fp = NULL; + int nid = curves[n].nid; + int testresult = 0; + + /* create group */ + if (!TEST_ptr(g1 = EC_GROUP_new_by_curve_name(nid))) + goto end; + + /* encode params to file */ + if (!TEST_ptr(fp = fopen("params.der", "wb")) + || !TEST_true(i2d_ECPKParameters_fp(fp, g1))) + goto end; + + /* flush and close file */ + if (!TEST_int_eq(fclose(fp), 0)) { + fp = NULL; + goto end; + } + fp = NULL; + + /* decode params from file */ + if (!TEST_ptr(fp = fopen("params.der", "rb")) + || !TEST_ptr(g2 = d2i_ECPKParameters_fp(fp, NULL))) + goto end; + + testresult = 1; /* PASS */ + +end: + if (fp != NULL) + fclose(fp); + + EC_GROUP_free(g1); + EC_GROUP_free(g2); + + return testresult; +} + int setup_tests(void) { crv_len = EC_get_builtin_curves(NULL, 0); @@ -376,6 +417,8 @@ int setup_tests(void) ADD_TEST(underflow_test); #endif ADD_TEST(decoded_flag_test); + ADD_ALL_TESTS(ecpkparams_i2d2i_test, crv_len); + return 1; } From openssl at openssl.org Mon Aug 30 22:58:30 2021 From: openssl at openssl.org (OpenSSL run-checker) Date: Mon, 30 Aug 2021 22:58:30 +0000 Subject: Still FAILED build of OpenSSL branch master with options enable-fuzz-afl no-shared no-module Message-ID: <1630364310.552579.932682.nullmailer@run.openssl.org> Platform and configuration command: $ uname -a Linux run 5.4.0-74-generic #83-Ubuntu SMP Sat May 8 02:35:39 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux $ CC=afl-clang-fast ../openssl/config enable-fuzz-afl no-shared no-module Commit log since last time: 78082769fa Use applink to fix windows tests 7aa3dfc421 [ec] Do not default to OPENSSL_EC_NAMED_CURVE for curves without OID cca8a4ceda Fix d2i_ECPKParameters_fp and i2d_ECPKParameters_fp macros ea1128e94e Add tests for i2d_TYPE_fp and d2i_TYPE_fp Build log ended with (last 100 lines): # SSL_accept() failed -1, 1 # 40C7DCFB677F0000:error:068C0100:asn1 encoding routines:ASN1_STRING_set:malloc failure:../openssl/crypto/asn1/asn1_lib.c:311: # 40C7DCFB677F0000:error:068C0100:asn1 encoding routines:asn1_ex_c2i:malloc failure:../openssl/crypto/asn1/tasn_dec.c:944: # 40C7DCFB677F0000:error:0688010A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../openssl/crypto/asn1/tasn_dec.c:685:Field=session_id, Type=SSL_SESSION_ASN1 # 40C7DCFB677F0000:error:0A0C0103:SSL routines:construct_stateless_ticket:internal error:../openssl/ssl/statem/statem_srvr.c:3706: # INFO: @ ../openssl/test/helpers/ssltestlib.c:957 # SSL_connect() failed -1, 1 # 40C7DCFB677F0000:error:0A000438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error:../openssl/ssl/record/rec_layer_s3.c:1584:SSL alert number 80 # ERROR: (bool) 'create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE) == true' failed @ ../openssl/test/sslapitest.c:9260 # false # OPENSSL_TEST_RAND_ORDER=1630362035 not ok 372 - iteration 7 # ------------------------------------------------------------------------------ # OPENSSL_TEST_RAND_ORDER=1630362035 not ok 74 - test_dh_auto # ------------------------------------------------------------------------------ # INFO: @ ../openssl/test/helpers/ssltestlib.c:975 # SSL_accept() failed -1, 1 # 40C7DCFB677F0000:error:068C0100:asn1 encoding routines:ASN1_STRING_set:malloc failure:../openssl/crypto/asn1/asn1_lib.c:311: # 40C7DCFB677F0000:error:068C0100:asn1 encoding routines:asn1_ex_c2i:malloc failure:../openssl/crypto/asn1/tasn_dec.c:944: # 40C7DCFB677F0000:error:0688010A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../openssl/crypto/asn1/tasn_dec.c:685: # 40C7DCFB677F0000:error:0688010A:asn1 encoding routines:asn1_template_ex_d2i:nested asn1 error:../openssl/crypto/asn1/tasn_dec.c:537:Field=session_id_context, Type=SSL_SESSION_ASN1 # 40C7DCFB677F0000:error:0A0C0103:SSL routines:construct_stateless_ticket:internal error:../openssl/ssl/statem/statem_srvr.c:3706: # INFO: @ ../openssl/test/helpers/ssltestlib.c:1004 # No progress made # ERROR: (bool) 'create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE) == true' failed @ ../openssl/test/sslapitest.c:9315 # false # OPENSSL_TEST_RAND_ORDER=1630362035 not ok 75 - test_sni_tls13 # ------------------------------------------------------------------------------ ../../util/wrap.pl ../../test/sslapitest ../../../openssl/test/certs ../../../openssl/test/recipes/90-test_sslapi_data/passwd.txt /tmp/SMS8pjqaWV default ../../../openssl/test/default.cnf => 1 not ok 1 - running sslapitest # ------------------------------------------------------------------------------ # Failed test 'running sslapitest' # at ../openssl/test/recipes/90-test_sslapi.t line 32. # Looks like you failed 1 test of 1.90-test_sslapi.t ................... Dubious, test returned 1 (wstat 256, 0x100) Failed 1/1 subtests Test Summary Report ------------------- 80-test_ssl_new.t (Wstat: 7168 Tests: 30 Failed: 28) Failed tests: 1-21, 23-28, 30 Non-zero exit status: 28 20-test_spkac.t (Wstat: 512 Tests: 4 Failed: 2) Failed tests: 2, 4 Non-zero exit status: 2 25-test_crl.t (Wstat: 256 Tests: 10 Failed: 1) Failed test: 3 Non-zero exit status: 1 25-test_sid.t (Wstat: 256 Tests: 2 Failed: 1) Failed test: 2 Non-zero exit status: 1 65-test_cmp_ctx.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_asyncio.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_clienthello.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_recordlen.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 70-test_servername.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_ca.t (Wstat: 256 Tests: 15 Failed: 1) Failed test: 5 Non-zero exit status: 1 80-test_dtls_mtu.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_dtls.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_pkcs12.t (Wstat: 768 Tests: 13 Failed: 3) Failed tests: 1-3 Non-zero exit status: 3 80-test_sslcorrupt.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 90-test_sslbuffers.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 90-test_v3name.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 80-test_ssl_old.t (Wstat: 1024 Tests: 6 Failed: 4) Failed tests: 3-6 Non-zero exit status: 4 90-test_sslapi.t (Wstat: 256 Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 Files=241, Tests=2837, 263 wallclock secs (13.99 usr 1.78 sys + 909.57 cusr 68.64 csys = 993.98 CPU) Result: FAIL make[1]: *** [Makefile:2566: run_tests] Error 1 make[1]: Leaving directory '/home/openssl/run-checker/enable-fuzz-afl' make: *** [Makefile:2562: tests] Error 2 From scan-admin at coverity.com Tue Aug 31 07:58:27 2021 From: scan-admin at coverity.com (scan-admin at coverity.com) Date: Tue, 31 Aug 2021 07:58:27 +0000 (UTC) Subject: Coverity Scan: Analysis completed for openssl/openssl Message-ID: <612de122e4a1a_3ab8b42ad5f92f59a032558@prd-scan-dashboard-0.mail> Your request for analysis of openssl/openssl has been completed successfully. The results are available at https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7HlekBtV1P4YRtWclMVkCdvAA-3D-3DQ1fU_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeHRIssZ9k0CvbiLobdv0hibavib2cPz2luqS77HtjEomqjOTWX9X3EXM07NZ0cqCVNshIoSxvaQaLo6fGSHaG-2FqPO0BCCTX1tUgTmm-2Br6-2FL2huWmkAHlcetuEgL92E55FAhuMvbDJmls7Tp7-2B0yvMlnbRLSUkrIwGHYYUBFBhA8YuZdSP-2B9r60nfzMVyqrWaCU-3D Build ID: 405110 Analysis Summary: New defects found: 0 Defects eliminated: 0 From scan-admin at coverity.com Tue Aug 31 08:05:51 2021 From: scan-admin at coverity.com (scan-admin at coverity.com) Date: Tue, 31 Aug 2021 08:05:51 +0000 (UTC) Subject: Coverity Scan: Analysis completed for OpenSSL-1.0.2 Message-ID: <612de2de71b30_3abc0b2ad5f92f59a032526@prd-scan-dashboard-0.mail> Your request for analysis of OpenSSL-1.0.2 has been completed successfully. The results are available at https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7Hlun-2FGpeF2rhqKLKnzox0Gkw-3D-3DE7Ne_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeGQYjN-2F1Td3APfUUU5-2FlmzRx4YfZws0ZgFULARhunOHvq7WGTmlzaGyai9cLH8SJsUvlYlmPlsKFacf6-2BABt0Jp5cAkq5qqwAZvGUidaQsoPXT9THllmiDhAiA2U3yIID3MNSk9QgdeoZWf2sjacTslm6N6uo31ACriiRMRTK5Zx7j-2BVyjvipWPfYbkgFdrioY-3D Build ID: 405111 Analysis Summary: New defects found: 0 Defects eliminated: 0 From mark at openssl.org Tue Aug 31 09:57:09 2021 From: mark at openssl.org (Mark J. Cox) Date: Tue, 31 Aug 2021 09:57:09 +0000 Subject: [web] master update Message-ID: <1630403829.315015.7942.nullmailer@dev.openssl.org> The branch master has been updated via 30a512b2e4a02e643216a163af87db97ccbf00d2 (commit) via d3f3bf5b0d8ef336acb45a3e8077436001be82f9 (commit) from 0374f7e7bd8802894fee0c15c474bd20e04f5731 (commit) - Log ----------------------------------------------------------------- commit 30a512b2e4a02e643216a163af87db97ccbf00d2 Merge: 0374f7e d3f3bf5 Author: Mark J. Cox Date: Tue Aug 31 10:55:38 2021 +0100 Merge pull request #254 from iamamoose/20210831sponsors Add CarGurus sponsorship (silver) commit d3f3bf5b0d8ef336acb45a3e8077436001be82f9 Author: Mark J. Cox Date: Tue Aug 31 10:20:05 2021 +0100 Add CarGurus sponsorship (silver) ----------------------------------------------------------------------- Summary of changes: support/acks.html | 1 + 1 file changed, 1 insertion(+) diff --git a/support/acks.html b/support/acks.html index 8a81815..0b70d47 100644 --- a/support/acks.html +++ b/support/acks.html @@ -46,6 +46,7 @@

Silver:

CarGurus

Shiguredo Inc.

From tomas at openssl.org Tue Aug 31 10:15:40 2021 From: tomas at openssl.org (tomas at openssl.org) Date: Tue, 31 Aug 2021 10:15:40 +0000 Subject: [openssl] master update Message-ID: <1630404940.261374.7896.nullmailer@dev.openssl.org> The branch master has been updated via 028593f546f66d50d399a4f9286364d97c68da78 (commit) from 78082769fa8129e3453ee4cb2255feb259846646 (commit) - Log ----------------------------------------------------------------- commit 028593f546f66d50d399a4f9286364d97c68da78 Author: Jaime Hablutzel Date: Mon Aug 30 13:18:48 2021 -0500 Typo correction. CLA: trivial Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16470) ----------------------------------------------------------------------- Summary of changes: doc/man1/openssl-verification-options.pod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/man1/openssl-verification-options.pod b/doc/man1/openssl-verification-options.pod index 895ee07c60..5fa3907c28 100644 --- a/doc/man1/openssl-verification-options.pod +++ b/doc/man1/openssl-verification-options.pod @@ -21,7 +21,7 @@ It is a complicated process consisting of a number of steps and depending on numerous options. The most important of them are detailed in the following sections. -In a nutshell, a valid chain of certifciates needs to be built up and verified +In a nutshell, a valid chain of certificates needs to be built up and verified starting from the I that is to be verified and ending in a certificate that due to some policy is trusted. Verification is done relative to the given I, which is the intended use From tomas at openssl.org Tue Aug 31 10:18:29 2021 From: tomas at openssl.org (tomas at openssl.org) Date: Tue, 31 Aug 2021 10:18:29 +0000 Subject: [openssl] master update Message-ID: <1630405109.409668.11211.nullmailer@dev.openssl.org> The branch master has been updated via 69222552252c86e7d68dcc24b2ce1aa0793ab3aa (commit) from 028593f546f66d50d399a4f9286364d97c68da78 (commit) - Log ----------------------------------------------------------------- commit 69222552252c86e7d68dcc24b2ce1aa0793ab3aa Author: slontis Date: Wed Aug 25 11:50:20 2021 +1000 Document that EVP_get_cipherbyname() does not work for some new algorithm names. These algorithms were added to providers but have no const EVP_CIPHER* mapping. Ciphers for SIV and CTS were previously only available via low level function calls that are deprecated. Reported by @reaperhulk. Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16414) ----------------------------------------------------------------------- Summary of changes: CHANGES.md | 7 +++++++ doc/man3/EVP_EncryptInit.pod | 5 +++++ 2 files changed, 12 insertions(+) diff --git a/CHANGES.md b/CHANGES.md index 5b16e34dd5..a24b30e651 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -41,6 +41,13 @@ breaking changes, and mappings for the large list of deprecated functions. *OpenSSL team members and many third party contributors* + * The EVP_get_cipherbyname() function will return NULL for algorithms such as + "AES-128-SIV", "AES-128-CBC-CTS" and "CAMELLIA-128-CBC-CTS" which were + previously only accessible via low level interfaces. Use EVP_CIPHER_fetch() + instead to retrieve these algorithms from a provider. + + *Shane Lontis* + * On build targets where the multilib postfix is set in the build configuration the libdir directory was changing based on whether the lib directory with the multilib postfix exists on the system diff --git a/doc/man3/EVP_EncryptInit.pod b/doc/man3/EVP_EncryptInit.pod index cb36629684..62d9047dce 100644 --- a/doc/man3/EVP_EncryptInit.pod +++ b/doc/man3/EVP_EncryptInit.pod @@ -447,6 +447,11 @@ EVP_CipherFinal_ex() instead. Return an EVP_CIPHER structure when passed a cipher name, a NID or an ASN1_OBJECT structure. +EVP_get_cipherbyname() will return NULL for algorithms such as "AES-128-SIV", +"AES-128-CBC-CTS" and "CAMELLIA-128-CBC-CTS" which were previously only +accessible via low level interfaces. Use EVP_CIPHER_fetch() instead to retrieve +these algorithms from a provider. + =item EVP_CIPHER_get_nid() and EVP_CIPHER_CTX_get_nid() Return the NID of a cipher when passed an B or B From tomas at openssl.org Tue Aug 31 10:20:47 2021 From: tomas at openssl.org (tomas at openssl.org) Date: Tue, 31 Aug 2021 10:20:47 +0000 Subject: [openssl] master update Message-ID: <1630405247.480296.31580.nullmailer@dev.openssl.org> The branch master has been updated via 2bdab81198ae366d25547b1441609c7d324b0bb4 (commit) via 3f7ad402b06fd75397f11fd9f0b2ad6778a31f99 (commit) via 72a509f94fc2be80c9903b7512715cd526a82e25 (commit) from 69222552252c86e7d68dcc24b2ce1aa0793ab3aa (commit) - Log ----------------------------------------------------------------- commit 2bdab81198ae366d25547b1441609c7d324b0bb4 Author: Tomas Mraz Date: Tue Aug 31 09:05:59 2021 +0200 apps/pkcs12: Do not assume null termination of ASN1_UTF8STRING Reviewed-by: Paul Dale Reviewed-by: Bernd Edlinger (Merged from https://github.com/openssl/openssl/pull/16433) commit 3f7ad402b06fd75397f11fd9f0b2ad6778a31f99 Author: Tomas Mraz Date: Thu Aug 26 15:13:58 2021 +0200 ci: Add -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to asan build Reviewed-by: Paul Dale Reviewed-by: Bernd Edlinger (Merged from https://github.com/openssl/openssl/pull/16433) commit 72a509f94fc2be80c9903b7512715cd526a82e25 Author: Tomas Mraz Date: Thu Aug 26 15:08:15 2021 +0200 Make the -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION pass tests Fixes #16428 Reviewed-by: Paul Dale Reviewed-by: Bernd Edlinger (Merged from https://github.com/openssl/openssl/pull/16433) ----------------------------------------------------------------------- Summary of changes: .github/workflows/ci.yml | 2 +- apps/pkcs12.c | 3 ++- crypto/asn1/a_print.c | 7 ++++--- crypto/asn1/asn1_lib.c | 11 ++++++++--- ssl/ssl_asn1.c | 2 +- 5 files changed, 16 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bcb5cd5775..2f2a9b9fb2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -130,7 +130,7 @@ jobs: steps: - uses: actions/checkout at v2 - name: config - run: ./config --banner=Configured --debug enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump + run: ./config --banner=Configured --debug enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION && perl configdata.pm --dump - name: make run: make -s -j4 - name: make test diff --git a/apps/pkcs12.c b/apps/pkcs12.c index d745df8494..dcb173f201 100644 --- a/apps/pkcs12.c +++ b/apps/pkcs12.c @@ -1142,7 +1142,8 @@ void print_attribute(BIO *out, const ASN1_TYPE *av) break; case V_ASN1_UTF8STRING: - BIO_printf(out, "%s\n", av->value.utf8string->data); + BIO_printf(out, "%.*s\n", av->value.utf8string->length, + av->value.utf8string->data); break; case V_ASN1_OCTET_STRING: diff --git a/crypto/asn1/a_print.c b/crypto/asn1/a_print.c index 328e0abcc5..e04f9b1f2e 100644 --- a/crypto/asn1/a_print.c +++ b/crypto/asn1/a_print.c @@ -18,12 +18,13 @@ int ASN1_PRINTABLE_type(const unsigned char *s, int len) int ia5 = 0; int t61 = 0; - if (len <= 0) - len = -1; if (s == NULL) return V_ASN1_PRINTABLESTRING; - while ((*s) && (len-- != 0)) { + if (len < 0) + len = strlen((const char *)s); + + while (len-- > 0) { c = *(s++); if (!ossl_isasn1print(c)) ia5 = 1; diff --git a/crypto/asn1/asn1_lib.c b/crypto/asn1/asn1_lib.c index 02c34a4438..5359cbc117 100644 --- a/crypto/asn1/asn1_lib.c +++ b/crypto/asn1/asn1_lib.c @@ -303,7 +303,7 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len_in) c = str->data; #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION /* No NUL terminator in fuzzing builds */ - str->data = OPENSSL_realloc(c, len); + str->data = OPENSSL_realloc(c, len != 0 ? len : 1); #else str->data = OPENSSL_realloc(c, len + 1); #endif @@ -316,7 +316,11 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len_in) str->length = len; if (data != NULL) { memcpy(str->data, data, len); -#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION + /* Set the unused byte to something non NUL and printable. */ + if (len == 0) + str->data[len] = '~'; +#else /* * Add a NUL terminator. This should not be necessary - but we add it as * a safety precaution @@ -384,7 +388,8 @@ int ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b) i = (a->length - b->length); if (i == 0) { - i = memcmp(a->data, b->data, a->length); + if (a->length != 0) + i = memcmp(a->data, b->data, a->length); if (i == 0) return a->type - b->type; else diff --git a/ssl/ssl_asn1.c b/ssl/ssl_asn1.c index 2cbd95fa1b..3503fdc210 100644 --- a/ssl/ssl_asn1.c +++ b/ssl/ssl_asn1.c @@ -229,7 +229,7 @@ static int ssl_session_strndup(char **pdst, ASN1_OCTET_STRING *src) static int ssl_session_memcpy(unsigned char *dst, size_t *pdstlen, ASN1_OCTET_STRING *src, size_t maxlen) { - if (src == NULL) { + if (src == NULL || src->length == 0) { *pdstlen = 0; return 1; } From pauli at openssl.org Tue Aug 31 10:42:22 2021 From: pauli at openssl.org (Dr. Paul Dale) Date: Tue, 31 Aug 2021 10:42:22 +0000 Subject: [openssl] master update Message-ID: <1630406542.888079.3887.nullmailer@dev.openssl.org> The branch master has been updated via c7468c17d7090492c266492ffa4ccf5baf93ffc4 (commit) from 2bdab81198ae366d25547b1441609c7d324b0bb4 (commit) - Log ----------------------------------------------------------------- commit c7468c17d7090492c266492ffa4ccf5baf93ffc4 Author: Pauli Date: Mon Aug 30 16:06:49 2021 +1000 CI: add builds covering a number of different compiler versions Reviewed-by: Tomas Mraz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/16463) ----------------------------------------------------------------------- Summary of changes: .github/workflows/compiler-zoo.yml | 53 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 .github/workflows/compiler-zoo.yml diff --git a/.github/workflows/compiler-zoo.yml b/.github/workflows/compiler-zoo.yml new file mode 100644 index 0000000000..29a9097343 --- /dev/null +++ b/.github/workflows/compiler-zoo.yml @@ -0,0 +1,53 @@ +name: Compiler Zoo CI + +on: [push] + +jobs: + compiler: + strategy: + fail-fast: false + matrix: + zoo: [ + { + cc: gcc-7 + }, { + cc: gcc-8 + }, { + cc: gcc-9 + }, { + cc: gcc-10 + }, { + cc: clang-6.0 + }, { + cc: clang-7 + }, { + cc: clang-8 + }, { + cc: clang-9 + }, { + cc: clang-10 + }, { + cc: clang-11 + }, { + cc: clang-12 + } + ] + runs-on: ubuntu-latest + steps: + - name: install packages + run: | + sudo apt-get update + sudo apt-get -yq --force-yes install ${{ matrix.zoo.cc }} + - uses: actions/checkout at v2 + + - name: config + run: | + CC=${{ matrix.zoo.cc }} ./config --banner=Configured no-shared \ + -Wall -Werror enable-fips --strict-warnings + + - name: config dump + run: ./configdata.pm --dump + - name: make + run: make -s -j4 + - name: make test + run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} From pauli at openssl.org Tue Aug 31 10:45:09 2021 From: pauli at openssl.org (Dr. Paul Dale) Date: Tue, 31 Aug 2021 10:45:09 +0000 Subject: [openssl] master update Message-ID: <1630406709.647667.5930.nullmailer@dev.openssl.org> The branch master has been updated via 9b6d17e423da138ea7fd190ae366580c539dceca (commit) via 4f8e0272c1bde43d97bc1c4471dbaecfc89f7aae (commit) via 2b4a611ef18b0696bff57da889622e0e42ed4521 (commit) via 03c137de971354b7c2e00f0198e85446ead6cfc3 (commit) from c7468c17d7090492c266492ffa4ccf5baf93ffc4 (commit) - Log ----------------------------------------------------------------- commit 9b6d17e423da138ea7fd190ae366580c539dceca Author: Matt Caswell Date: Mon Aug 30 15:54:22 2021 +0100 Add a warning about locking in the child provider callback docs The child provider callbacks can hold the store lock. In order to avoid deadlocks we require that the callback implementations don't themselves call functions that may aquire those locks. Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16469) commit 4f8e0272c1bde43d97bc1c4471dbaecfc89f7aae Author: Pauli Date: Mon Aug 16 12:20:56 2021 +1000 Add additional test to thread sanitizer build Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/16469) commit 2b4a611ef18b0696bff57da889622e0e42ed4521 Author: Matt Caswell Date: Mon Aug 30 13:04:31 2021 +0100 Refactor provider_core.c to adhere to the locking rules The previous commit provided some guidelines and some rules for using locking in order to avoid deadlocks. This commit refactors the code in order to adhere to those guidelines and rules. Fixes #16312 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16469) commit 03c137de971354b7c2e00f0198e85446ead6cfc3 Author: Matt Caswell Date: Mon Aug 30 15:33:07 2021 +0100 Add commentary about lock usage in provider_core.c Provide some guidelines, as well as some rules for using the locks in provider_core.c, in order to avoid the introduction of deadlocks. Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16469) ----------------------------------------------------------------------- Summary of changes: .github/workflows/ci.yml | 2 +- crypto/provider_core.c | 239 +++++++++++++++++++++++++++++++++++---------- doc/man7/provider-base.pod | 6 +- 3 files changed, 190 insertions(+), 57 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2f2a9b9fb2..601ba5f6b1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -157,7 +157,7 @@ jobs: - name: make run: make -s -j4 - name: make test - run: make TESTS=test_threads test HARNESS_JOBS=${HARNESS_JOBS:-4} + run: make V=1 TESTS="test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp" test HARNESS_JOBS=${HARNESS_JOBS:-4} enable_non-default_options: runs-on: ubuntu-latest diff --git a/crypto/provider_core.c b/crypto/provider_core.c index 1f688557c1..e4069eb4f7 100644 --- a/crypto/provider_core.c +++ b/crypto/provider_core.c @@ -28,6 +28,89 @@ # include #endif +/* + * This file defines and uses a number of different structures: + * + * OSSL_PROVIDER (provider_st): Used to represent all information related to a + * single instance of a provider. + * + * provider_store_st: Holds information about the collection of providers that + * are available within the current library context (OSSL_LIB_CTX). It also + * holds configuration information about providers that could be loaded at some + * future point. + * + * OSSL_PROVIDER_CHILD_CB: An instance of this structure holds the callbacks + * that have been registered for a child library context and the associated + * provider that registered those callbacks. + * + * Where a child library context exists then it has its own instance of the + * provider store. Each provider that exists in the parent provider store, has + * an associated child provider in the child library context's provider store. + * As providers get activated or deactivated this needs to be mirrored in the + * associated child providers. + * + * LOCKING + * ======= + * + * There are a number of different locks used in this file and it is important + * to understand how they should be used in order to avoid deadlocks. + * + * Fields within a structure can often be "write once" on creation, and then + * "read many". Creation of a structure is done by a single thread, and + * therefore no lock is required for the "write once/read many" fields. It is + * safe for multiple threads to read these fields without a lock, because they + * will never be changed. + * + * However some fields may be changed after a structure has been created and + * shared between multiple threads. Where this is the case a lock is required. + * + * The locks available are: + * + * The provider flag_lock: Used to control updates to the various provider + * "flags" (flag_initialized, flag_activated, flag_fallback) and associated + * "counts" (activatecnt). + * + * The provider refcnt_lock: Only ever used to control updates to the provider + * refcnt value. + * + * The provider optbits_lock: Used to control access to the provider's + * operation_bits and operation_bits_sz fields. + * + * The store default_path_lock: Used to control access to the provider store's + * default search path value (default_path) + * + * The store lock: Used to control the stack of provider's held within the + * provider store, as well as the stack of registered child provider callbacks. + * + * As a general rule-of-thumb it is best to: + * - keep the scope of the code that is protected by a lock to the absolute + * minimum possible; + * - try to keep the scope of the lock to within a single function (i.e. avoid + * making calls to other functions while holding a lock); + * - try to only ever hold one lock at a time. + * + * Unfortunately, it is not always possible to stick to the above guidelines. + * Where they are not adhered to there is always a danger of inadvertently + * introducing the possibility of deadlock. The following rules MUST be adhered + * to in order to avoid that: + * - Holding multiple locks at the same time is only allowed for the + * provider store lock, the provider flag_lock and the provider refcnt_lock. + * - When holding multiple locks they must be acquired in the following order of + * precedence: + * 1) provider store lock + * 2) provider flag_lock + * 3) provider refcnt_lock + * - When releasing locks they must be released in the reverse order to which + * they were acquired + * - No locks may be held when making an upcall. NOTE: Some common functions + * can make upcalls as part of their normal operation. If you need to call + * some other function while holding a lock make sure you know whether it + * will make any upcalls or not. For example ossl_provider_up_ref() can call + * ossl_provider_up_ref_parent() which can call the c_prov_up_ref() upcall. + * - It is permissible to hold the store lock when calling child provider + * callbacks. No other locks may be held during such callbacks. + */ + static OSSL_PROVIDER *provider_new(const char *name, OSSL_provider_init_fn *init_function, STACK_OF(INFOPAIR) *parameters); @@ -343,11 +426,11 @@ OSSL_PROVIDER *ossl_provider_find(OSSL_LIB_CTX *libctx, const char *name, tmpl.name = (char *)name; if (!CRYPTO_THREAD_read_lock(store->lock)) return NULL; - if ((i = sk_OSSL_PROVIDER_find(store->providers, &tmpl)) == -1 - || (prov = sk_OSSL_PROVIDER_value(store->providers, i)) == NULL - || !ossl_provider_up_ref(prov)) - prov = NULL; + if ((i = sk_OSSL_PROVIDER_find(store->providers, &tmpl)) != -1) + prov = sk_OSSL_PROVIDER_value(store->providers, i); CRYPTO_THREAD_unlock(store->lock); + if (prov != NULL && !ossl_provider_up_ref(prov)) + prov = NULL; } return prov; @@ -532,15 +615,6 @@ int ossl_provider_add_to_store(OSSL_PROVIDER *prov, OSSL_PROVIDER **actualprov, else actualtmp = sk_OSSL_PROVIDER_value(store->providers, idx); - if (actualprov != NULL) { - if (!ossl_provider_up_ref(actualtmp)) { - ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); - actualtmp = NULL; - goto err; - } - *actualprov = actualtmp; - } - if (idx == -1) { if (sk_OSSL_PROVIDER_push(store->providers, prov) == 0) goto err; @@ -555,7 +629,16 @@ int ossl_provider_add_to_store(OSSL_PROVIDER *prov, OSSL_PROVIDER **actualprov, CRYPTO_THREAD_unlock(store->lock); - if (actualtmp != prov) { + if (actualprov != NULL) { + if (!ossl_provider_up_ref(actualtmp)) { + ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); + actualtmp = NULL; + goto err; + } + *actualprov = actualtmp; + } + + if (idx >= 0) { /* * The provider is already in the store. Probably two threads * independently initialised their own provider objects with the same @@ -923,10 +1006,13 @@ static int provider_init(OSSL_PROVIDER *prov) * Deactivate a provider. * Return -1 on failure and the activation count on success */ -static int provider_deactivate(OSSL_PROVIDER *prov) +static int provider_deactivate(OSSL_PROVIDER *prov, int upcalls) { int count; struct provider_store_st *store; +#ifndef FIPS_MODULE + int freeparent = 0, removechildren = 0; +#endif if (!ossl_assert(prov != NULL)) return -1; @@ -943,32 +1029,42 @@ static int provider_deactivate(OSSL_PROVIDER *prov) } #ifndef FIPS_MODULE - if (prov->activatecnt == 2 && prov->ischild) { + if (prov->activatecnt >= 2 && prov->ischild && upcalls) { /* * We have had a direct activation in this child libctx so we need to - * now down the ref count in the parent provider. + * now down the ref count in the parent provider. We do the actual down + * ref outside of the flag_lock, since it could involve getting other + * locks. */ - ossl_provider_free_parent(prov, 1); + freeparent = 1; } #endif if ((count = --prov->activatecnt) < 1) { prov->flag_activated = 0; #ifndef FIPS_MODULE - { - int i, max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); - OSSL_PROVIDER_CHILD_CB *child_cb; - - for (i = 0; i < max; i++) { - child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); - child_cb->remove_cb((OSSL_CORE_HANDLE *)prov, child_cb->cbdata); - } - } + removechildren = 1; #endif } CRYPTO_THREAD_unlock(prov->flag_lock); + +#ifndef FIPS_MODULE + if (removechildren) { + int i, max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); + OSSL_PROVIDER_CHILD_CB *child_cb; + + for (i = 0; i < max; i++) { + child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); + child_cb->remove_cb((OSSL_CORE_HANDLE *)prov, child_cb->cbdata); + } + } +#endif CRYPTO_THREAD_unlock(store->lock); +#ifndef FIPS_MODULE + if (freeparent) + ossl_provider_free_parent(prov, 1); +#endif /* We don't deinit here, that's done in ossl_provider_free() */ return count; @@ -982,7 +1078,7 @@ static int provider_activate(OSSL_PROVIDER *prov, int lock, int upcalls) { int count = -1; struct provider_store_st *store; - int ret = 1; + int ret = 1, createchildren = 0; store = prov->store; /* @@ -995,31 +1091,41 @@ static int provider_activate(OSSL_PROVIDER *prov, int lock, int upcalls) return -1; } - if (lock && !CRYPTO_THREAD_read_lock(store->lock)) +#ifndef FIPS_MODULE + if (prov->ischild && upcalls && !ossl_provider_up_ref_parent(prov, 1)) return -1; +#endif - if (lock && !CRYPTO_THREAD_write_lock(prov->flag_lock)) { - CRYPTO_THREAD_unlock(store->lock); + if (lock && !CRYPTO_THREAD_read_lock(store->lock)) { +#ifndef FIPS_MODULE + if (prov->ischild && upcalls) + ossl_provider_free_parent(prov, 1); +#endif return -1; } + if (lock && !CRYPTO_THREAD_write_lock(prov->flag_lock)) { + CRYPTO_THREAD_unlock(store->lock); #ifndef FIPS_MODULE - if (prov->ischild && upcalls) - ret = ossl_provider_up_ref_parent(prov, 1); + if (prov->ischild && upcalls) + ossl_provider_free_parent(prov, 1); #endif + return -1; + } - if (ret) { - count = ++prov->activatecnt; - prov->flag_activated = 1; + count = ++prov->activatecnt; + prov->flag_activated = 1; - if (prov->activatecnt == 1 && store != NULL) - ret = create_provider_children(prov); - } + if (prov->activatecnt == 1 && store != NULL) + createchildren = 1; - if (lock) { + if (lock) CRYPTO_THREAD_unlock(prov->flag_lock); + if (createchildren) + ret = create_provider_children(prov); + if (lock) CRYPTO_THREAD_unlock(store->lock); - } + if (!ret) return -1; @@ -1068,7 +1174,7 @@ int ossl_provider_deactivate(OSSL_PROVIDER *prov) { int count; - if (prov == NULL || (count = provider_deactivate(prov)) < 0) + if (prov == NULL || (count = provider_deactivate(prov, 1)) < 0) return 0; return count == 0 ? provider_flush_store_cache(prov) : 1; } @@ -1155,7 +1261,7 @@ int ossl_provider_doall_activated(OSSL_LIB_CTX *ctx, void *cbdata), void *cbdata) { - int ret = 0, curr, max; + int ret = 0, curr, max, ref = 0; struct provider_store_st *store = get_provider_store(ctx); STACK_OF(OSSL_PROVIDER) *provs = NULL; @@ -1195,16 +1301,25 @@ int ossl_provider_doall_activated(OSSL_LIB_CTX *ctx, if (!CRYPTO_THREAD_write_lock(prov->flag_lock)) goto err_unlock; if (prov->flag_activated) { - if (!ossl_provider_up_ref(prov)){ + /* + * We call CRYPTO_UP_REF directly rather than ossl_provider_up_ref + * to avoid upping the ref count on the parent provider, which we + * must not do while holding locks. + */ + if (CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock) <= 0) { CRYPTO_THREAD_unlock(prov->flag_lock); goto err_unlock; } /* * It's already activated, but we up the activated count to ensure * it remains activated until after we've called the user callback. + * We do this with no locking (because we already hold the locks) + * and no upcalls (which must not be called when locks are held). In + * theory this could mean the parent provider goes inactive, whilst + * still activated in the child for a short period. That's ok. */ - if (provider_activate(prov, 0, 1) < 0) { - ossl_provider_free(prov); + if (provider_activate(prov, 0, 0) < 0) { + CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock); CRYPTO_THREAD_unlock(prov->flag_lock); goto err_unlock; } @@ -1241,8 +1356,18 @@ int ossl_provider_doall_activated(OSSL_LIB_CTX *ctx, for (curr++; curr < max; curr++) { OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr); - provider_deactivate(prov); - ossl_provider_free(prov); + provider_deactivate(prov, 0); + /* + * As above where we did the up-ref, we don't call ossl_provider_free + * to avoid making upcalls. There should always be at least one ref + * to the provider in the store, so this should never drop to 0. + */ + CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock); + /* + * Not much we can do if this assert ever fails. So we don't use + * ossl_assert here. + */ + assert(ref > 0); } sk_OSSL_PROVIDER_free(provs); return ret; @@ -1562,19 +1687,25 @@ static int ossl_provider_register_child_cb(const OSSL_CORE_HANDLE *handle, } max = sk_OSSL_PROVIDER_num(store->providers); for (i = 0; i < max; i++) { + int activated; + prov = sk_OSSL_PROVIDER_value(store->providers, i); if (!CRYPTO_THREAD_read_lock(prov->flag_lock)) break; + activated = prov->flag_activated; + CRYPTO_THREAD_unlock(prov->flag_lock); /* - * We hold the lock while calling the user callback. This means that the - * user callback must be short and simple and not do anything likely to - * cause a deadlock. + * We hold the store lock while calling the user callback. This means + * that the user callback must be short and simple and not do anything + * likely to cause a deadlock. We don't hold the flag_lock during this + * call. In theory this means that another thread could deactivate it + * while we are calling create. This is ok because the other thread + * will also call remove_cb, but won't be able to do so until we release + * the store lock. */ - if (prov->flag_activated - && !create_cb((OSSL_CORE_HANDLE *)prov, cbdata)) + if (activated && !create_cb((OSSL_CORE_HANDLE *)prov, cbdata)) break; - CRYPTO_THREAD_unlock(prov->flag_lock); } if (i == max) { /* Success */ diff --git a/doc/man7/provider-base.pod b/doc/man7/provider-base.pod index 92c167638b..ac197accca 100644 --- a/doc/man7/provider-base.pod +++ b/doc/man7/provider-base.pod @@ -123,7 +123,7 @@ provider-base All "functions" mentioned here are passed as function pointers between F and the provider in B arrays, in the call of the provider initialization function. See L -for a description of the initialization function. +for a description of the initialization function. They are known as "upcalls". All these "functions" have a corresponding function type definition named B, and a helper function to retrieve the @@ -328,7 +328,9 @@ provider_register_child_cb() registers callbacks for being informed about the loading and unloading of providers in the application's library context. I is this provider's handle and I is this provider's data that will be passed back to the callbacks. It returns 1 on success or 0 -otherwise. +otherwise. These callbacks may be called while holding locks in libcrypto. In +order to avoid deadlocks the callback implementation must not be long running +and must not call other OpenSSL API functions or upcalls. I is a callback that will be called when a new provider is loaded into the application's library context. It is also called for any providers that From pauli at openssl.org Tue Aug 31 10:46:22 2021 From: pauli at openssl.org (Dr. Paul Dale) Date: Tue, 31 Aug 2021 10:46:22 +0000 Subject: [openssl] master update Message-ID: <1630406782.823939.7717.nullmailer@dev.openssl.org> The branch master has been updated via 5595058714832bdff03604c881cf44f91c14b5fc (commit) from 9b6d17e423da138ea7fd190ae366580c539dceca (commit) - Log ----------------------------------------------------------------- commit 5595058714832bdff03604c881cf44f91c14b5fc Author: slontis Date: Mon Aug 30 09:59:54 2021 +1000 Add the self test type OSSL_SELF_TEST_TYPE_PCT_SIGNATURE Fixes #16457 The ECDSA and DSA signature tests use Pairwise tests instead of KATS. Note there is a seperate type used by the keygen for conditional Pairwise Tests. Reviewed-by: Tim Hudson Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16461) ----------------------------------------------------------------------- Summary of changes: doc/man7/OSSL_PROVIDER-FIPS.pod | 6 +++++- include/openssl/self_test.h | 3 ++- providers/fips/self_test_kats.c | 6 +++++- test/recipes/03-test_fipsinstall.t | 2 +- 4 files changed, 13 insertions(+), 4 deletions(-) diff --git a/doc/man7/OSSL_PROVIDER-FIPS.pod b/doc/man7/OSSL_PROVIDER-FIPS.pod index 62e495aef1..0eac85b324 100644 --- a/doc/man7/OSSL_PROVIDER-FIPS.pod +++ b/doc/man7/OSSL_PROVIDER-FIPS.pod @@ -214,6 +214,10 @@ Known answer test for a digest. Known answer test for a signature. +=item "PCT_Signature" (B) + +Pairwise Consistency check for a signature. + =item "KAT_KDF" (B) Known answer test for a key derivation function. @@ -226,7 +230,7 @@ Known answer test for key agreement. Known answer test for a Deterministic Random Bit Generator. -=item "Pairwise_Consistency_Test" (B) +=item "Conditional_PCT" (B) Conditional test that is run during the generation of key pairs. diff --git a/include/openssl/self_test.h b/include/openssl/self_test.h index 564fc95088..77c600a0d1 100644 --- a/include/openssl/self_test.h +++ b/include/openssl/self_test.h @@ -29,11 +29,12 @@ extern "C" { # define OSSL_SELF_TEST_TYPE_MODULE_INTEGRITY "Module_Integrity" # define OSSL_SELF_TEST_TYPE_INSTALL_INTEGRITY "Install_Integrity" # define OSSL_SELF_TEST_TYPE_CRNG "Continuous_RNG_Test" -# define OSSL_SELF_TEST_TYPE_PCT "Pairwise_Consistency_Test" +# define OSSL_SELF_TEST_TYPE_PCT "Conditional_PCT" # define OSSL_SELF_TEST_TYPE_KAT_CIPHER "KAT_Cipher" # define OSSL_SELF_TEST_TYPE_KAT_ASYM_CIPHER "KAT_AsymmetricCipher" # define OSSL_SELF_TEST_TYPE_KAT_DIGEST "KAT_Digest" # define OSSL_SELF_TEST_TYPE_KAT_SIGNATURE "KAT_Signature" +# define OSSL_SELF_TEST_TYPE_PCT_SIGNATURE "PCT_Signature" # define OSSL_SELF_TEST_TYPE_KAT_KDF "KAT_KDF" # define OSSL_SELF_TEST_TYPE_KAT_KA "KAT_KA" # define OSSL_SELF_TEST_TYPE_DRBG "DRBG" diff --git a/providers/fips/self_test_kats.c b/providers/fips/self_test_kats.c index d411767205..81f7226ba1 100644 --- a/providers/fips/self_test_kats.c +++ b/providers/fips/self_test_kats.c @@ -452,8 +452,12 @@ static int self_test_sign(const ST_KAT_SIGN *t, 0x48, 0xa1, 0xd6, 0x5d, 0xfc, 0x2d, 0x4b, 0x1f, 0xa3, 0xd6, 0x77, 0x28, 0x4a, 0xdd, 0xd2, 0x00, 0x12, 0x6d, 0x90, 0x69 }; + const char *typ = OSSL_SELF_TEST_TYPE_KAT_SIGNATURE; - OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_KAT_SIGNATURE, t->desc); + if (t->sig_expected == NULL) + typ = OSSL_SELF_TEST_TYPE_PCT_SIGNATURE; + + OSSL_SELF_TEST_onbegin(st, typ, t->desc); bnctx = BN_CTX_new_ex(libctx); if (bnctx == NULL) diff --git a/test/recipes/03-test_fipsinstall.t b/test/recipes/03-test_fipsinstall.t index db64362538..d99974e467 100644 --- a/test/recipes/03-test_fipsinstall.t +++ b/test/recipes/03-test_fipsinstall.t @@ -235,7 +235,7 @@ SKIP: { '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey", '-section_name', 'fips_sect', '-corrupt_desc', 'DSA', - '-corrupt_type', 'KAT_Signature'])), + '-corrupt_type', 'PCT_Signature'])), "fipsinstall fails when the signature result is corrupted"); } From pauli at openssl.org Tue Aug 31 10:48:03 2021 From: pauli at openssl.org (Dr. Paul Dale) Date: Tue, 31 Aug 2021 10:48:03 +0000 Subject: [openssl] master update Message-ID: <1630406883.309845.10420.nullmailer@dev.openssl.org> The branch master has been updated via 59f4a51a7f2c53b9fd161b032d0fcb8a85f4f19d (commit) via c7f8edfc1186a48463c14cfdc7f70456cbcb1cda (commit) from 5595058714832bdff03604c881cf44f91c14b5fc (commit) - Log ----------------------------------------------------------------- commit 59f4a51a7f2c53b9fd161b032d0fcb8a85f4f19d Author: Matt Caswell Date: Thu Aug 26 10:03:51 2021 +0100 Add a test for verifying an email with a bad othername type Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16443) commit c7f8edfc1186a48463c14cfdc7f70456cbcb1cda Author: Matt Caswell Date: Thu Aug 26 09:43:50 2021 +0100 Ensure that we check the ASN.1 type of an "otherName" before using it We should not assume that the type of an ASN.1 value is UTF8String as expected. We must actually check it, otherwise we could get a NULL ptr deref, or worse memory errors. Reported by David Benjamin. Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/16443) ----------------------------------------------------------------------- Summary of changes: crypto/x509/v3_utl.c | 17 ++++++++++++----- test/recipes/25-test_eai_data.t | 14 ++++++++++++-- 2 files changed, 24 insertions(+), 7 deletions(-) diff --git a/crypto/x509/v3_utl.c b/crypto/x509/v3_utl.c index 5c63d2d9d8..a70917a39b 100644 --- a/crypto/x509/v3_utl.c +++ b/crypto/x509/v3_utl.c @@ -901,12 +901,19 @@ static int do_x509_check(X509 *x, const char *chk, size_t chklen, if (OBJ_obj2nid(gen->d.otherName->type_id) == NID_id_on_SmtpUTF8Mailbox) { san_present = 1; - cstr = gen->d.otherName->value->value.utf8string; - /* Positive on success, negative on error! */ - if ((rv = do_check_string(cstr, 0, equal, flags, - chk, chklen, peername)) != 0) - break; + /* + * If it is not a UTF8String then that is unexpected and we + * treat it as no match + */ + if (gen->d.otherName->value->type == V_ASN1_UTF8STRING) { + cstr = gen->d.otherName->value->value.utf8string; + + /* Positive on success, negative on error! */ + if ((rv = do_check_string(cstr, 0, equal, flags, + chk, chklen, peername)) != 0) + break; + } } else continue; } else { diff --git a/test/recipes/25-test_eai_data.t b/test/recipes/25-test_eai_data.t index 8aebf5d621..522982ddfb 100644 --- a/test/recipes/25-test_eai_data.t +++ b/test/recipes/25-test_eai_data.t @@ -12,7 +12,7 @@ use warnings; use File::Spec; use OpenSSL::Test::Utils; -use OpenSSL::Test qw/:DEFAULT srctop_file/; +use OpenSSL::Test qw/:DEFAULT srctop_file with/; setup("test_eai_data"); @@ -21,7 +21,7 @@ setup("test_eai_data"); #./util/wrap.pl apps/openssl verify -nameopt utf8 -no_check_time -CAfile test/recipes/25-test_eai_data/utf8_chain.pem test/recipes/25-test_eai_data/ascii_leaf.pem #./util/wrap.pl apps/openssl verify -nameopt utf8 -no_check_time -CAfile test/recipes/25-test_eai_data/ascii_chain.pem test/recipes/25-test_eai_data/utf8_leaf.pem -plan tests => 11; +plan tests => 12; require_ok(srctop_file('test','recipes','tconversion.pl')); my $folder = "test/recipes/25-test_eai_data"; @@ -60,3 +60,13 @@ ok(run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-CAfile" ok(!run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-CAfile", $ascii_chain_pem, $utf8_pem]))); ok(!run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-CAfile", $utf8_chain_pem, $ascii_pem]))); +#Check that we get the expected failure return code +with({ exit_checker => sub { return shift == 2; } }, + sub { + ok(run(app(["openssl", "verify", "-CAfile", + srctop_file("test", "certs", "bad-othername-namec.pem"), + "-partial_chain", "-no_check_time", "-verify_email", + 'foo at example.com', + srctop_file("test", "certs", "bad-othername-namec.pem")]))); + }); + From nic.tuv at gmail.com Tue Aug 31 22:19:09 2021 From: nic.tuv at gmail.com (nic.tuv at gmail.com) Date: Tue, 31 Aug 2021 22:19:09 +0000 Subject: [openssl] OpenSSL_1_1_1-stable update Message-ID: <1630448349.281689.310.nullmailer@dev.openssl.org> The branch OpenSSL_1_1_1-stable has been updated via a9972440d26e482cec9d7a8c4c0063baa20d9eac (commit) via f397efb0b999af6a54bc192ce8551e76c79ff245 (commit) via 45487dba0fb8c36fe390fa8131204403c00c01fc (commit) via 3d97638062595efb23b32f9150c38d60db89de7f (commit) from f661c76a9e27a87f4bbbed135faf89a3fccac75f (commit) - Log ----------------------------------------------------------------- commit a9972440d26e482cec9d7a8c4c0063baa20d9eac Author: Bernd Edlinger Date: Fri Aug 20 20:42:55 2021 +0200 Use applink to fix windows tests (cherry picked from commit ) Reviewed-by: Tomas Mraz Reviewed-by: Nicola Tuveri (Merged from https://github.com/openssl/openssl/pull/12457) commit f397efb0b999af6a54bc192ce8551e76c79ff245 Author: Nicola Tuveri Date: Thu Jul 16 03:23:26 2020 +0300 [ec] Do not default to OPENSSL_EC_NAMED_CURVE for curves without OID Some curves don't have an associated OID: for those we should not default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`. This is a follow-up to https://github.com/openssl/openssl/pull/12312 (cherry picked from commit 7aa3dfc42104588f65301d20324388ac2c9a6b11) Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/12457) commit 45487dba0fb8c36fe390fa8131204403c00c01fc Author: Nicola Tuveri Date: Thu Jul 16 02:02:16 2020 +0300 Fix d2i_ECPKParameters_fp and i2d_ECPKParameters_fp macros These functions are part of the public API but we don't have tests covering their usage. They are actually implemented as macros and the absence of tests has caused them to fall out-of-sync with the latest changes to ASN1 related functions and cause compilation warnings. This commit fixes the public headers to reflect these changes. Fixes #12443 (cherry picked from commit cca8a4cedaafe63b0b5729b72133661ece24ff08) Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/12457) commit 3d97638062595efb23b32f9150c38d60db89de7f Author: Nicola Tuveri Date: Thu Jul 16 01:57:09 2020 +0300 Add tests for i2d_TYPE_fp and d2i_TYPE_fp These functions are part of the public API but we don't have tests covering their usage. They are actually implemented as macros and the absence of tests has caused them to fall out-of-sync with the latest changes to ASN1 related functions and cause compilation warnings. @@ Note: This commit limits to ECPKParameters as a type. (cherry picked from commit ea1128e94e36fa9fa25278dc6b3f5b42d8735782) Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/12457) ----------------------------------------------------------------------- Summary of changes: crypto/ec/ec_asn1.c | 2 +- crypto/ec/ec_curve.c | 27 +++++++++++++++++++++++++++ include/openssl/ec.h | 15 +++++++++------ test/build.info | 4 +++- test/ec_internal_test.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 83 insertions(+), 8 deletions(-) diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c index c8ee1e6f17..4335b3da1a 100644 --- a/crypto/ec/ec_asn1.c +++ b/crypto/ec/ec_asn1.c @@ -548,7 +548,7 @@ ECPKPARAMETERS *EC_GROUP_get_ecpkparameters(const EC_GROUP *group, ECPARAMETERS_free(ret->value.parameters); } - if (EC_GROUP_get_asn1_flag(group)) { + if (EC_GROUP_get_asn1_flag(group) == OPENSSL_EC_NAMED_CURVE) { /* * use the asn1 OID to describe the elliptic curve parameters */ diff --git a/crypto/ec/ec_curve.c b/crypto/ec/ec_curve.c index 8de486cbd7..dfe5263f59 100644 --- a/crypto/ec/ec_curve.c +++ b/crypto/ec/ec_curve.c @@ -12,6 +12,7 @@ #include "ec_local.h" #include #include +#include #include #include "internal/nelem.h" @@ -3097,6 +3098,32 @@ static EC_GROUP *ec_group_new_from_data(const ec_list_element curve) goto err; } } + + if (EC_GROUP_get_asn1_flag(group) == OPENSSL_EC_NAMED_CURVE) { + /* + * Some curves don't have an associated OID: for those we should not + * default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and + * instead set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`. + * + * Note that `OPENSSL_EC_NAMED_CURVE` is set as the default ASN1 flag on + * `EC_GROUP_new()`, when we don't have enough elements to determine if + * an OID for the curve name actually exists. + * We could implement this check on `EC_GROUP_set_curve_name()` but + * overloading the simple setter with this lookup could have a negative + * performance impact and unexpected consequences. + */ + ASN1_OBJECT *asn1obj = OBJ_nid2obj(curve.nid); + + if (asn1obj == NULL) { + ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_OBJ_LIB); + goto err; + } + if (OBJ_length(asn1obj) == 0) + EC_GROUP_set_asn1_flag(group, OPENSSL_EC_EXPLICIT_CURVE); + + ASN1_OBJECT_free(asn1obj); + } + ok = 1; err: if (!ok) { diff --git a/include/openssl/ec.h b/include/openssl/ec.h index 44cc139966..a9f77b245f 100644 --- a/include/openssl/ec.h +++ b/include/openssl/ec.h @@ -793,12 +793,15 @@ int EC_GROUP_get_pentanomial_basis(const EC_GROUP *, unsigned int *k1, EC_GROUP *d2i_ECPKParameters(EC_GROUP **, const unsigned char **in, long len); int i2d_ECPKParameters(const EC_GROUP *, unsigned char **out); -# define d2i_ECPKParameters_bio(bp,x) ASN1_d2i_bio_of(EC_GROUP,NULL,d2i_ECPKParameters,bp,x) -# define i2d_ECPKParameters_bio(bp,x) ASN1_i2d_bio_of_const(EC_GROUP,i2d_ECPKParameters,bp,x) -# define d2i_ECPKParameters_fp(fp,x) (EC_GROUP *)ASN1_d2i_fp(NULL, \ - (char *(*)())d2i_ECPKParameters,(fp),(unsigned char **)(x)) -# define i2d_ECPKParameters_fp(fp,x) ASN1_i2d_fp(i2d_ECPKParameters,(fp), \ - (unsigned char *)(x)) +# define d2i_ECPKParameters_bio(bp,x) \ + ASN1_d2i_bio_of(EC_GROUP, NULL, d2i_ECPKParameters, bp, x) +# define i2d_ECPKParameters_bio(bp,x) \ + ASN1_i2d_bio_of_const(EC_GROUP, i2d_ECPKParameters, bp, x) +# define d2i_ECPKParameters_fp(fp,x) \ + (EC_GROUP *)ASN1_d2i_fp(NULL, (d2i_of_void *)d2i_ECPKParameters, (fp), \ + (void **)(x)) +# define i2d_ECPKParameters_fp(fp,x) \ + ASN1_i2d_fp((i2d_of_void *)i2d_ECPKParameters, (fp), (void *)(x)) int ECPKParameters_print(BIO *bp, const EC_GROUP *x, int off); # ifndef OPENSSL_NO_STDIO diff --git a/test/build.info b/test/build.info index bc3dae81f9..6357a7f2fe 100644 --- a/test/build.info +++ b/test/build.info @@ -515,7 +515,9 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN INCLUDE[sm4_internal_test]=.. ../include DEPEND[sm4_internal_test]=../libcrypto.a libtestutil.a - SOURCE[ec_internal_test]=ec_internal_test.c + SOURCE[ec_internal_test]=ec_internal_test.c \ + {- rebase_files("../apps", + split(/\s+/, $target{apps_init_src})) -} INCLUDE[ec_internal_test]=../include ../crypto/ec DEPEND[ec_internal_test]=../libcrypto.a libtestutil.a diff --git a/test/ec_internal_test.c b/test/ec_internal_test.c index 5b708e201c..7ca408b3c2 100644 --- a/test/ec_internal_test.c +++ b/test/ec_internal_test.c @@ -283,6 +283,47 @@ static int decoded_flag_test(void) return testresult; } +static +int ecpkparams_i2d2i_test(int n) +{ + EC_GROUP *g1 = NULL, *g2 = NULL; + FILE *fp = NULL; + int nid = curves[n].nid; + int testresult = 0; + + /* create group */ + if (!TEST_ptr(g1 = EC_GROUP_new_by_curve_name(nid))) + goto end; + + /* encode params to file */ + if (!TEST_ptr(fp = fopen("params.der", "wb")) + || !TEST_true(i2d_ECPKParameters_fp(fp, g1))) + goto end; + + /* flush and close file */ + if (!TEST_int_eq(fclose(fp), 0)) { + fp = NULL; + goto end; + } + fp = NULL; + + /* decode params from file */ + if (!TEST_ptr(fp = fopen("params.der", "rb")) + || !TEST_ptr(g2 = d2i_ECPKParameters_fp(fp, NULL))) + goto end; + + testresult = 1; /* PASS */ + +end: + if (fp != NULL) + fclose(fp); + + EC_GROUP_free(g1); + EC_GROUP_free(g2); + + return testresult; +} + int setup_tests(void) { crv_len = EC_get_builtin_curves(NULL, 0); @@ -297,6 +338,8 @@ int setup_tests(void) #endif ADD_ALL_TESTS(field_tests_default, crv_len); ADD_TEST(decoded_flag_test); + ADD_ALL_TESTS(ecpkparams_i2d2i_test, crv_len); + return 1; } From openssl at openssl.org Tue Aug 31 22:58:59 2021 From: openssl at openssl.org (OpenSSL run-checker) Date: Tue, 31 Aug 2021 22:58:59 +0000 Subject: SUCCESSFUL build of OpenSSL branch master with options enable-fuzz-afl no-shared no-module Message-ID: <1630450739.595699.1126165.nullmailer@run.openssl.org> Platform and configuration command: $ uname -a Linux run 5.4.0-74-generic #83-Ubuntu SMP Sat May 8 02:35:39 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux $ CC=afl-clang-fast ../openssl/config enable-fuzz-afl no-shared no-module Commit log since last time: 59f4a51a7f Add a test for verifying an email with a bad othername type c7f8edfc11 Ensure that we check the ASN.1 type of an "otherName" before using it 5595058714 Add the self test type OSSL_SELF_TEST_TYPE_PCT_SIGNATURE 9b6d17e423 Add a warning about locking in the child provider callback docs 4f8e0272c1 Add additional test to thread sanitizer build 2b4a611ef1 Refactor provider_core.c to adhere to the locking rules 03c137de97 Add commentary about lock usage in provider_core.c c7468c17d7 CI: add builds covering a number of different compiler versions 2bdab81198 apps/pkcs12: Do not assume null termination of ASN1_UTF8STRING 3f7ad402b0 ci: Add -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to asan build 72a509f94f Make the -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION pass tests 6922255225 Document that EVP_get_cipherbyname() does not work for some new algorithm names. 028593f546 Typo correction.