aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* APPS: Reduce deprecation warning suppression - ENGINERichard Levitte2020-10-046-102/+162
| | | | | | | | | | | | | | | Some of our apps turn off deprecation warnings solely for the sake of ENGINE, and thereby shadowing other deprecations that we should take better care of. To solve this, all apps ENGINE functionality is move to one file, where deprecation warning suppression is activate, and the same suppression can then easily be removed in at least some of the apps. Any remaining suppression that we still need to deal with should happen as separate efforts. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13044)
* DECODER: Allow precise result type for OSSL_DECODER_CTX_new_by_EVP_PKEY()Richard Levitte2020-10-047-16/+30
| | | | | | | | | | | | | | There is some data that is very difficult to guess. For example, DSA parameters and X9.42 DH parameters look exactly the same, a SEQUENCE of 3 INTEGER. Therefore, callers may need the possibility to select the exact keytype that they expect to get. This will also allow use to translate d2i_TYPEPrivateKey(), d2i_TYPEPublicKey() and d2i_TYPEParams() into OSSL_DECODER terms much more smoothly. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13061)
* DECODER: Handle abstract object data typeRichard Levitte2020-10-042-6/+69
| | | | | | | | | | | | The PEM->DER decoder passes the data type of its contents, something that decoder_process() ignored. On the other hand, the PEM->DER decoder passed nonsense. Both issues are fixed here. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13060)
* Configuration: add initial NonStop values in OpenSSL::configRichard Levitte2020-10-031-0/+19
| | | | | | | | | | This makes Configure work it's automatic config detection, at least for the simple straightforward cases. Fixes #12972 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12973)
* Ensure that _GNU_SOURCE is defined for NI_MAXHOST and NI_MAXSERVdrgler2020-10-031-0/+4
| | | | | | | | | | | | | | | Since glibc 2.8, these defines like `NI_MAXHOST` are exposed only if suitable feature test macros are defined, namely: _GNU_SOURCE, _DEFAULT_SOURCE (since glibc 2.19), or _BSD_SOURCE or _SVID_SOURCE (before glibc 2.19), see GETNAMEINFO(3). CLA: trivial Fixes #13049 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/13054)
* Fix segfault on missing provider_query_operation()Nicola Tuveri2020-10-031-1/+2
| | | | | | | | | | A provider without `provider_query_operation()` is admittedly quite useless, yet technically the base provider functions are not mandatory according to our documentation. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13058)
* TLS AEAD ciphers: more bytes for key_block than neededMaxim Masiutin2020-10-021-9/+15
| | | | | | | | | | | | | | | | | | | | | | Fixes #12007 The key_block length was not written to trace, thus it was not obvious that extra key_bytes were generated for TLS AEAD. The problem was that EVP_CIPHER_iv_length was called even for AEAD ciphers to figure out how many bytes from the key_block were needed for the IV. The correct way was to take cipher mode (GCM, CCM, etc) into consideration rather than simply callin the general function EVP_CIPHER_iv_length. The new function tls_iv_length_within_key_block takes this into consideration. Besides that, the order of addendums was counter-intuitive MAC length was second, but it have to be first to correspond the order given in the RFC. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13035)
* EVP: use evp_pkey_ctx_is_legacy() to find what implementation to useRichard Levitte2020-10-015-4/+20
| | | | | | | | | | | We've had explicit checks for when to fall back to legacy code for operations that use an EVP_PKEY. Unfortunately, the checks were radically different in different spots, so we refactor that into a macro that gets used everywhere. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13043)
* Fix memory leak in req_cb() of x_req.c - handle distinguishing_id also with ↵Dr. David von Oheimb2020-10-011-2/+0
| | | | | | | | | NO_SM2 Was detected via test_req_distinguishing_id() with config having no-ec but not no-sm2 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13021)
* Fix some things the rename script didn't quite get rightMatt Caswell2020-10-0118-75/+74
| | | | | | | | | The previous commit ran an automated rename throughout the codebase. There are a small number of things it didn't quite get right so we fix those in this commit. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12970)
* Run the withlibctx.pl scriptMatt Caswell2020-10-01162-1240/+1091
| | | | | | | | Automatically rename all instances of _with_libctx() to _ex() as per our coding style. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12970)
* Perl util to do with_libctx renamingMatt Caswell2020-10-011-0/+141
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12970)
* der: _ossl prefix der_oid_ and der_aid_ functionsPauli2020-10-0111-66/+69
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13038)
* der: _ossl prefix DER functionsPauli2020-10-0133-191/+199
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13038)
* rsa_mp_coeff_names should only have one entry in it for fips mode.Shane Lontis2020-10-011-1/+1
| | | | | | | | Reported by Tim Hudson Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13011)
* prov: prefix all exposed 'cipher' symbols with ossl_Pauli2020-10-0144-370/+382
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13030)
* prov: prefix aes-cbc-cts functions with ossl_Pauli2020-10-013-10/+10
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13030)
* check-format.pl: Allow nested indentation of labels (not only at line pos 1)Dr. David von Oheimb2020-09-303-2/+10
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13019)
* check-format.pl: Extend exceptions for no SPC after trailing ';' in 'for (...;)'Dr. David von Oheimb2020-09-302-1/+9
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13019)
* check-format.pl: Document how to run positive and negative self-testsDr. David von Oheimb2020-09-301-0/+4
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13019)
* EC_GROUP_new_by_curve_name_with_libctx(): Add name of unknown group to error ↵Dr. David von Oheimb2020-09-301-0/+4
| | | | | | | output Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13023)
* Prune low-level ASN.1 parse errors from error queue in der2key_decode() etc.Dr. David von Oheimb2020-09-308-32/+109
| | | | | | | Also adds error output tests on loading key files with unsupported algorithms to 30-test_evp.t Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13023)
* 25-test_x509.t: Add test for suitable error report loading unsupported sm2 certDr. David von Oheimb2020-09-301-4/+11
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13023)
* Configure: handle undefined shared_target.Richard Levitte2020-09-292-8/+2
| | | | | | | | | | | | | | Some very basic config targets don't defined the 'shared_target' attribute at all. This wasn't handled well enough in Configure. This also cleans away an explicit reference to the ossltest engine in Configurations/unix-Makefile.tmpl, which isn't necessary since the build.info attributes were added. Fixes openssl/web#197 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13031)
* prov: prefix provider internal functions with ossl_Pauli2020-09-2987-235/+248
| | | | | | | Also convert the names to lower case. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13014)
* prov: prefix all OSSL_DISPATCH tables names with ossl_Pauli2020-09-2995-896/+918
| | | | | | | | This stops them leaking into other namespaces in a static build. They remain internal. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13013)
* 30-test_evp.t: On no-dh, no-dsa, no-ec, no-sm2, and no-gost configurations ↵Dr. David von Oheimb2020-09-281-9/+16
| | | | | | | disable respective tests Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13022)
* appveyor.yml: Clean up minimal configuration, adding no-ec and pruning ↵Dr. David von Oheimb2020-09-281-1/+1
| | | | | | | cascaded no-* Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13022)
* rand: declare get_hardware_random_value() before use.Pauli2020-09-281-1/+2
| | | | | | | | | Introduced by #12923 Fixes #13004 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13005)
* Remove TODO comment from sskdf.cShane Lontis2020-09-281-5/+0
| | | | | | | | | Fixes #12993 The implementation follows the standards/recommendations specified by https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12999)
* todo: remove fork protection todo comment, it isn't relevant to the FIPS ↵Pauli2020-09-281-2/+0
| | | | | | | | | provider Fixes #12984 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12997)
* optimise ssl3_get_cipher_by_std_name()hklaas2020-09-271-2/+1
| | | | | | | | | | Return immediately on matched cipher. Without this patch the code only breaks out of the inner for loop, meaning for a matched TLS13 cipher the code will still loop through 160ish SSL3 ciphers. CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13000)
* STORE: Clear a couple of TODOs that were there for the sake of SM2Richard Levitte2020-09-271-27/+0
| | | | | | | | | | We now have decoder support for SM2, so the cheats that were in place for the sake of lacking decoders aren't needed any more. Fixes #12982 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12986)
* Implement treatment of id-pkix-ocsp-no-check extension for OCSP_basic_verify()Dr. David von Oheimb2020-09-268-7/+94
| | | | | | | Fixes #7761 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12947)
* Generate a certificate with critical id-pkix-ocsp-nocheck extensionTomas Mraz2020-09-262-1/+38
| | | | | Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/12947)
* OCSP_resp_find_status.pod: Slightly improve the documentation of various flagsDr. David von Oheimb2020-09-261-10/+11
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12947)
* OCSP_resp_find_status.pod: Replace function arg references B<...> by I<...>Dr. David von Oheimb2020-09-261-51/+51
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12947)
* Fix bug in EDDSA speed testShane Lontis2020-09-261-0/+1
| | | | | | | | | | | | | | | | The pkey created in one loop was being fed into the keygen of the next loop - since it was not set to NULL after the free. This meant that the 2 EVP_MD_CTX objects that still had ref counts to this key were getting confused. All other tests clear the key after freeing the key if they loop (some do this by declaring/initing the pkey inside the loop). The offending code is a recent addition to the speed app. This was found using the -async_jobs option. Similar code was tried for an RSA key using 111 which resulted in the same issue. Found while trying to test issue #128867 (It is not known if this will fix that issue yet). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12975)
* en EVP_PKEY_CTX_set_rsa_keygen_pubexp() BIGNUM managementjwalch2020-09-2610-16/+72
| | | | | | | | | | | | Fixes #12635 As discussed in the issue, supporting the set0-like semantics long-term is not necessarily desirable, although necessary for short-term compatibility concerns. So I've deprecated the original method and added an equivalent that is explicitly labelled as set1. I tried to audit existing usages of the (now-deprecated) API and update them to use set1 if that appeared to align with their expectations. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12917)
* Remove openssl provider appShane Lontis2020-09-268-537/+6
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12943)
* Update openssl list to support new provider objects.Shane Lontis2020-09-263-80/+484
| | | | | | | | Added Keymanager, signatures, kem, asymciphers and keyexchange. Added -select option so that specific algorithms are easier to view when using -verbose Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12943)
* Add EVP_ASYM_CIPHER_gettable_ctx_params() and ↵Shane Lontis2020-09-263-1/+35
| | | | | | | EVP_ASYM_CIPHER_settable_ctx_params() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12943)
* Add EVP_KEM_gettable_ctx_params() and EVP_KEM_settable_ctx_params()Shane Lontis2020-09-263-2/+36
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12943)
* Modified rand_cpu_x86.c to support builtin hardware randomizer on HPE NonStop.Randall S. Becker2020-09-251-11/+55
| | | | | | | | | | | | CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #12903 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12923)
* Document the provider side SM2 Asymmetric Cipher supportMatt Caswell2020-09-254-2/+55
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12913)
* Extend the SM2 asym cipher testMatt Caswell2020-09-251-18/+50
| | | | | | | Ensure we test getting and setting ctx params Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12913)
* Remove some dead SM2 codeMatt Caswell2020-09-254-398/+1
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12913)
* Clean up some SM2 related TODOs in the testsMatt Caswell2020-09-253-28/+7
| | | | | | | Now that we have full SM2 support, we can remove some TODOs from the tests. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12913)
* Move SM2 asymmetric encryption to be available in the default providerMatt Caswell2020-09-257-2/+257
| | | | | | | Fixes #12908 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12913)
* Build: Make NonStop shared libraries only export selected symbolsRichard Levitte2020-09-253-10/+23
| | | | | | | We can now re-enable test/recipes/01-test_symbol_presence.t for NonStop. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12962)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-20 18:34:38 +0000