aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Don't use legacy provider if not available in test_ssl_oldMatt Caswell2020-12-111-2/+7
| | | | | | | | If we've been configured with no-legacy then we should not attempt to load the legacy provider. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
* Fix sslapitest.c if built with no-legacyMatt Caswell2020-12-111-1/+10
| | | | | | | | | We skip a test that uses the no-legacy option. Unfortuantely there is no OPENSSL_NO_LEGACY to test, so we just check whether we were successful in loading the legacy provider - and if not we skip the test. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
* Skip evp_test cases where we need the legacy prov and its not availableMatt Caswell2020-12-1112-0/+306
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
* Don't use no-asm in the Github CIsMatt Caswell2020-12-111-3/+3
| | | | | | | | | no-asm has proven to be too slow, therefore we don't use it in the Github CI builds and instead rely on it being covered by run-checker. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13607)
* Add fips self tests for all included kdfShane Lontis2020-12-114-2/+238
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13480)
* Add validate method to ECX keymanagerShane Lontis2020-12-112-20/+152
| | | | | | | Fixes #11619 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13459)
* apps/{ca,req,x509}.c: Improve diag and doc mostly on X.509 extensions, fix ↵Dr. David von Oheimb2020-12-105-57/+70
| | | | | | | | | | | | | | | | | multiple instances This includes a general correction in the code (now using the X509V3_CTX_REPLACE flag) and adding a prominent clarification in the documentation: If multiple entries are processed for the same extension name, later entries override earlier ones with the same name. This is due to an RFC 5280 requirement - the intro of its section 4.2 says: A certificate MUST NOT include more than one instance of a particular extension. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
* openssl_hexstr2buf_sep(): Prevent misleading 'malloc failure' errors on ↵Dr. David von Oheimb2020-12-105-2/+11
| | | | | | | short input Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
* v2i_AUTHORITY_KEYID(): Correct out-of-memory behavior and avoid mem leaksDr. David von Oheimb2020-12-101-8/+9
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
* X509V3_EXT_add_nconf_sk(): Improve description and use of 'sk' arg, which ↵Dr. David von Oheimb2020-12-101-3/+3
| | | | | | | may be NULL Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
* openssl-ca.pod.in: Clarify the -extensions/-crlexts options vs. ↵Dr. David von Oheimb2020-12-101-6/+6
| | | | | | | x509_extensions/crl_extensions Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
* apps/x509.c: Factor out common aspects of X509 signingDr. David von Oheimb2020-12-101-38/+18
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
* apps/{req,x509,ca}.c: Cleanup: move shared X509{,_REQ,_CRL} code to ↵Dr. David von Oheimb2020-12-102-144/+146
| | | | | | | apps/lib/apps.c Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
* apps/{req,x509,ca}.c: Clean up code setting X.509 cert version v3Dr. David von Oheimb2020-12-103-24/+17
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
* x509v3_config.pod: Clarify semantics of subjectKeyIdentifier and ↵Dr. David von Oheimb2020-12-102-15/+21
| | | | | | | authorityKeyIdentifier Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
* apps/req.c: Improve diagnostics on multiple/overriding X.509 extensions ↵Dr. David von Oheimb2020-12-101-11/+13
| | | | | | | defined via -reqext option Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
* Use adapted test_get_libctx() for simpler test setup and better error reportingDr. David von Oheimb2020-12-1014-96/+57
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13001)
* Read MIDR_EL1 system register on aarch64Fangming.Fang2020-12-093-0/+62
| | | | | | | | | | | | | | MIDR_EL1 system register exposes microarchitecture information so that people can make micro-arch related optimization such as exposing as much instruction level parallelism as possible. MIDR_EL1 register can be read only if HWCAP_CPUID feature is supported. Change-Id: Iabb8a36c5d31b184dba6399f378598058d394d4e Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11744)
* Test that we can negotiate TLSv1.3 if we have an SNI callbackMatt Caswell2020-12-091-0/+59
| | | | | | | | | | If an SNI callback has been set then we may have no certificuates suitable for TLSv1.3 use configured for the current SSL_CTX. This should not prevent us from negotiating TLSv1.3, since we may change the SSL_CTX by the time we need a suitable certificate. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13304)
* Modify is_tls13_capable() to take account of the servername cbMatt Caswell2020-12-091-2/+13
| | | | | | | | | | | A servername cb may change the available certificates, so if we have one set then we cannot rely on the configured certificates to determine if we are capable of negotiating TLSv1.3 or not. Fixes #13291 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13304)
* v3nametest: Make the gennames structure staticTomas Mraz2020-12-091-1/+1
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13635)
* Fix typo in OPENSSL_malloc.podNan Xiao2020-12-091-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13632)
* rand: allow seed-src to be missingPauli2020-12-091-1/+4
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13640)
* rand: don't leak memoryPauli2020-12-091-1/+1
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13640)
* rand seed: include lock and unlock functions.Pauli2020-12-091-0/+13
| | | | | | | | This satisfies EVP's RAND layer. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13640)
* Fix error clash in buildPauli2020-12-092-2/+2
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13640)
* rand: add a provider side seed source.Pauli2020-12-0910-3/+348
| | | | | | | | | This allows the operating system sources that OpenSSL supports to be used directly as RNGs. It also allows DRBG seeding to be explicitly specified rather than being left to a fall back case. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13455)
* TLS: Use EVP_PKEY_get_group_name() to get the group nameRichard Levitte2020-12-083-18/+18
| | | | | | | | | | For the moment, we translate the result to a NID, because that's still used in several locations in libssl. Future development should change all the internals to be name based instead. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13436)
* EVP: Add EVP_PKEY_get_group_name() to extract the group name of a pkeyRichard Levitte2020-12-089-69/+107
| | | | | | | | This replaces the internal evp_pkey_get_EC_KEY_curve_nid() Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13436)
* EVP: constify the EVP_PKEY_get_*_param() argument |pkey|Richard Levitte2020-12-084-21/+29
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13436)
* Add MAP_CONCEAL from OpenBSD which has similar purpose but on mmapDavid Carlier2020-12-081-1/+4
| | | | | | | | | call level. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13394)
* CRYPTO_secure_malloc_init: Add FreeBSD support for secure-malloc ↵David Carlier2020-12-081-0/+3
| | | | | | | | | dont-dump-region. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13394)
* STORE: clear err after ossl_store_get0_loader_intDaniel Bevenius2020-12-082-1/+42
| | | | | | | | | | | | | | | This commit clears the error that might have been set when ossl_store_get0_loader_int has been called as it will try to retrieve a loader for the scheme on an empty store, which will cause the error OSSL_STORE_R_UNREGISTERED_SCHEME to be set. The motivation for this after returning from ossl_store_get0_loader_int, OSSL_STORE_attach will continue and try to fetch a OSSL_STORE_LOADER from the provider. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12901)
* Fix no-errMatt Caswell2020-12-081-53/+58
| | | | | | | | | | | | The ERR_load_*_strings() functions were not being defined in a no-err build. This is an API break since in 1.1.1 they were still present in a no-err build, but were no-ops. This was also causing a failure in test_symbol_presence. We revert to the way things were done in 1.1.1, i.e. in a no-err build the functions are still present but are no-ops. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13598)
* Fix a compilation failure with no-tls_1_2Matt Caswell2020-12-081-1/+1
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13596)
* Fix a test failure with no-tls1_3Matt Caswell2020-12-081-3/+19
| | | | | | | | | If we're using TLSv1.2 then the test_sigalgs_available test needs to be careful which ciphersuite is selected in order for the test to behave correctly. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13596)
* providers/common/der/build.info: Improve checks of disabled algosRichard Levitte2020-12-081-47/+58
| | | | | | | | This protects us from unwanted GENERATE statements in particular. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13626)
* Update CHANGES and NEWS for new releaseMatt Caswell2020-12-082-2/+16
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add a test for encoding/decoding using an invalid ASN.1 TemplateMatt Caswell2020-12-082-0/+69
| | | | | | | If you have a CHOICE type that it must use explicit tagging - otherwise the template is invalid. We add tests for this. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
* Add a test for GENERAL_NAME_cmpMatt Caswell2020-12-081-0/+344
| | | | | | Based on a boringssl test contributed by David Benjamin Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
* Complain if we are attempting to encode with an invalid ASN.1 templateMatt Caswell2020-12-081-0/+16
| | | | | | | | | | It never makes sense for multi-string or CHOICE types to have implicit tagging. If we have a template that uses the in this way then we should immediately fail. Thanks to David Benjamin from Google for reporting this issue. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
* Check that multi-strings/CHOICE types don't use implicit taggingMatt Caswell2020-12-084-0/+22
| | | | | | | | | | It never makes sense for multi-string or CHOICE types to use implicit tagging since the content would be ambiguous. It is an error in the template if this ever happens. If we detect it we should stop parsing. Thanks to David Benjamin from Google for reporting this issue. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
* Correctly compare EdiPartyName in GENERAL_NAME_cmp()Matt Caswell2020-12-081-3/+42
| | | | | | | | | | | | If a GENERAL_NAME field contained EdiPartyName data then it was incorrectly being handled as type "other". This could lead to a segmentation fault. Many thanks to David Benjamin from Google for reporting this issue. CVE-2020-1971 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
* DirectoryString is a CHOICE type and therefore uses explicit taggingMatt Caswell2020-12-081-2/+3
| | | | | | | | | | | | | | | EDIPartyName has 2 fields that use a DirectoryString. However they were marked as implicit tagging - which is not correct for a CHOICE type. Additionally the partyName field was marked as Optional when, according to RFC5280 it is not. Many thanks to github user @filipnavara for reporting this issue. Also to David Benjamin from Google who independently identified and reported it. Fixes #6859 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
* Deprecate EC_POINT_bn2point and EC_POINT_point2bn.Shane Lontis2020-12-0710-118/+168
| | | | | | | | | | | | | Fixes #10366 The one place that actually used was in the legacy printing of ecparams. This has been replaced by the pointtobuf variant. The ecparam app was using one of these functions - this line has just been removed as another PR will remove all the code generated lines.. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13294)
* Change OPENSSL_hexstr2buf_ex() & OPENSSL_buf2hexstr_ex() to pass the separatorShane Lontis2020-12-075-11/+18
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13294)
* openssl.pod: Carve out Trusted Certificate, Pass Phrase, Name Format, and ↵Ankita Shetty2020-12-0539-428/+531
| | | | | | | | | | Format Options Move detailed doc to specific new files in doc/man1/openssl-*-options.pod Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13315)
* openssl.pod: Move verification doc to new ↵David von Oheimb2020-12-055-355/+404
| | | | | | | doc/man1/openssl-verification-options.pod Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13315)
* find-doc-nits: fix regexp and point out that CA.pl and tsget.pod are specialDr. David von Oheimb2020-12-051-1/+2
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13315)
* PEM: Add a more generic way to implement PEM _ex functions for libctxRichard Levitte2020-12-056-54/+191
| | | | | | | | | | | | This also adds the following functions, for completeness: PEM_write_PrivateKey_ex(), PEM_write_bio_PrivateKey_ex(), PEM_write_PUBKEY_ex, PEM_write_bio_PUBKEY_ex Fixes #13542 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13547)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-19 23:12:11 +0000