| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
CTLOG_STORE_load_file() treats a negative CONF_parse_list() return as
success, even when the callback failed to allocate the log name.
Check for non-positive parser returns so internal errors produce the
documented 0 return value, preserving the existing invalid-entry handling.
Add a regression using the existing allocation failure framework and a
configuration referencing a missing log section. Loading must return 0
both normally and when allocations fail. Return -1 from the test on
unexpected success so ADD_MFAIL_NO_CHECK_TEST cannot mask the failure.
Resolves: https://github.com/openssl/openssl/issues/32703
References: 70073f3e3aeb "Treat boolean functions as booleans"
Complements: 68efafc51378 "Add checks on sk_TYPE_push() returned value"
Complements: e57036f2bf81 "Fix some memory error handling in CT"
Assisted-by: Codex:gpt-6-astra
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
Merge-date: Fri Oct 9 20:40:44 2026
Merged-from: https://github.com/openssl/openssl/pull/32704
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The change to a more configuration based approach to enable FIPS mode
operation highlights a shortcoming in the default should do something
approach we've taken for bad configuration files.
Currently, a bad configuration file will be automatically loaded and
once the badness is detected, it will silently stop processing the
configuration and continue normal operations. This is good for remote
servers, allowing changes to be made without bricking things. It's bad
when a user thinks they've configured what they want but got something
wrong and it still appears to work.
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/16171)
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
The default is openssl.cnf The project seems to prefer xxx.conf these
days, but we should use the default convention.
Rename all foo.conf (except for Configurations) to foo.cnf
Fixes #11174
Reviewed-by: Paul Yang <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/11176)
|
| |
|
|
|
|
|
| |
Tests included in future commit, which adds CT policy validation.
Reviewed-by: Ben Laurie <[email protected]>
Reviewed-by: Rich Salz <[email protected]>
|
|
|
Reviewed-by: Ben Laurie <[email protected]>
Reviewed-by: Rich Salz <[email protected]>
|
