aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* TS ESS: Invert the search logic of ts_check_signing_certs() to correctly ↵Dr. David von Oheimb2021-03-1812-65/+304
| | | | | | | | | cover cert ID list Fixes #14190 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14503)
* apps.c: Fix missing newline in warn_cert_msg() outputDr. David von Oheimb2021-03-181-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14503)
* Add tests for the limited Unicode code point rangeBeat Bolli2021-03-181-0/+41
| | | | | | | | Signed-off-by: Beat Bolli <dev@drbeat.li> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14185)
* ASN1: check the Unicode code point range in ASN1_mbstring_copy()Beat Bolli2021-03-181-3/+13
| | | | | | | | Signed-off-by: Beat Bolli <dev@drbeat.li> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14185)
* ASN1: limit the Unicode code point range in UTF8_getc() and UTF8_putc()Beat Bolli2021-03-181-63/+12
| | | | | | | | | | | | Since the Unicode 4.0.0 standard, the valid code point range is U+0000 to U+10FFFF. Make code points outside this range invalid when converting from/to UTF-8. Signed-off-by: Beat Bolli <dev@drbeat.li> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14185)
* ASN1: add an internal header to validate Unicode rangesBeat Bolli2021-03-181-0/+31
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14185)
* ci: add a no-legacy buildPauli2021-03-181-0/+11
| | | | | | | | Fixes #12091 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14563)
* Make EVP_PKEY_missing_parameters work properly on provided RSA keysTomas Mraz2021-03-178-103/+107
| | | | | | | | | | | | | | | | This requires changing semantics of the keymgmt_has() function a little in the sense that it now returns 1 if the selection has no meaning for the key type. It was already doing so for ECX keys for example. The keymgmt_validate function semantics is changed similarly to allow passing validation on the same selection that the key returns 1 for. Fixes #14509 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14511)
* evp_keymgmt_util_copy: Fix possible leak on copy failureTomas Mraz2021-03-171-4/+4
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14511)
* apps/crl: Print just the hash value if printing just hashTomas Mraz2021-03-171-4/+8
| | | | | | | | | | | This partially reverts the output format change for openssl crl -hash output. Fixes #14546 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14553)
* Convert some TODO(3.0) comments in init.c to normal commentsMatt Caswell2021-03-171-4/+4
| | | | | | | | | | | There is no need to make the suggested changes in the 3.0 timescale. These are just suggested improvements for the future. Fixes #14375 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14556)
* Remove a TODO(3.0) from EVP_PKEY_derive_set_peer()Matt Caswell2021-03-174-13/+23
| | | | | | | | | | | | | | | | | | | | | The TODO described a case where a legacy derive operation is called, but the peer key is provider based. In practice this will almost never be a problem. We should never end up in our own legacy EVP_PKEY_METHOD implementations if no ENGINE has been configured. If an ENGINE has been configured then we we will be using a third party EVP_PKEY_METHOD implementation and public APIs will be used to obtain the key data from the peer key so there will be no "reaching inside" the pkey. There is a theoretical case where a third party ENGINE wraps our own internal EVP_PKEY_METHODs using EVP_PKEY_meth_find() or EVP_PKEY_meth_get0(). For these cases we just ensure all our EVP_PKEY_METHODs never reach "inside" the implementation of a peer key. We can never assume that it is a legacy key. Fixes #14399 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14555)
* Fix up issues found when running evp_extra_test with a non-default library ↵Jon Spillett2021-03-173-7/+8
| | | | | | | | context Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14478)
* Add testing for non-default library context into evp_extra_testJon Spillett2021-03-172-54/+149
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14478)
* EVP_KDF-KB man page: fixup ABI/API changeArthur Gautier2021-03-171-3/+1
| | | | | | | | | | | | | | | fixup 7c75f2daf8b50c92bfb5c17fa62136e61f6eb515 https://github.com/openssl/openssl/pull/14310 Previous commit changes the api, one code sample was left with previous API. CLA: trivial Signed-off-by: Arthur Gautier <baloo@superbaloo.net> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14551)
* Remove TODOs from digest.cPauli2021-03-171-10/+0
| | | | | | | | | | | | They aren't relevant: . Digest Sign isn't supported in the FIPS provider. . Remove legacy NID use. Fixes #14394 Fixes #14395 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14565)
* params: clean up TODOPauli2021-03-171-2/+2
| | | | | | | | | The TODO being reworked to just be a comment. Fixes #14374 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14565)
* doc: remove TODOs about redesigning the AEAD APIPauli2021-03-171-6/+0
| | | | | | | | | The changes would be significant and the benefits not likely to be too great. Fixes #14368 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14565)
* prov: remove todos in rsa_keymgmt.cPauli2021-03-171-4/+0
| | | | | | | | | The TODOs are about OAEP and aren't relevant. Fixes #14361 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14565)
* prov: remove TODO in der_rsa_key.cPauli2021-03-171-1/+2
| | | | | | | Fixes #14365 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14565)
* Add some encoder and decoder code examplesTomas Mraz2021-03-173-14/+144
| | | | | | | Fixes #14373 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14557)
* Fix a TODO(3.0) in the siphash codeMatt Caswell2021-03-175-36/+19
| | | | | | | | | | | | All 3 files that included crypto/siphash.h also included siphash_local.h, and no other files included siphash_local.h independently. They probably should be just one header file. Fixes #14360 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14558)
* p_lib.c: Remove TODO commentsTomas Mraz2021-03-171-7/+5
| | | | | | | | | The comments are either about legacy stuff that is going to be removed in later releases or about a safety check that can be kept. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14554)
* property_test: use property values that are not used elsewhereTomas Mraz2021-03-161-4/+5
| | | | | | | | | In test_property_query_value_create() we depend on the property values to not be created by other test cases. Use such values. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14573)
* core_get_libctx: use assert() instead of ossl_assert()Tomas Mraz2021-03-161-1/+2
| | | | | | | | Using ossl_assert makes the build fail with --strict-warnings because the ossl_assert is declared with warn_unused_result. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14571)
* provider_core: Remove two TODO 3.0Tomas Mraz2021-03-161-4/+10
| | | | | | | | | | | | | | | We need to keep the check for prov == NULL in ossl_provider_libctx but it is not needed in core_get_libctx as there it can happen only when there is a serious coding error in a third party provider and returning NULL as libctx would be seriously wrong as that has a special meaning. The second TODO is valid but not something that is relevant for 3.0. Change it into a normal comment. Fixes #14377 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14535)
* decoder_process: data_structure can be NULLTomas Mraz2021-03-161-1/+1
| | | | | | | | | Check it before dereferencing. Fixes #14530 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14531)
* property: default queries create the property values.Pauli2021-03-165-10/+35
| | | | | | | | | | | Without this, it is necessary to query an algorithm before setting the default property query. With this, the value will be created and the default will work. Fixes #14516 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14542)
* Use --debug with no-caching build as sanitizers need itTomas Mraz2021-03-161-2/+2
| | | | | | | | | | | | The memleak test otherwise fails. Also disable async, dtls, and old tls versions to test some different combination of disableables and speed up tests. Fixes #14337 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14536)
* Add a CHANGES entry for EVP_PKEY_public_check() and EVP_KEY_param_check()Matt Caswell2021-03-151-1/+2
| | | | | | | | | | These functions now work for more key types than they did in 1.1.1 Fixes #14477 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14485)
* Ensure that ECX keys pass EVP_PKEY_param_check()Matt Caswell2021-03-153-7/+44
| | | | | | | | | | | | | RSA keys have no parameters and pass EVP_PKEY_param_check(). Previously, ECX keys had no parammeters and failed EVP_PKEY_param_check(). We should be consistent. It makes more sense to always pass, and therefore this commit implements that behaviour. Fixes #14482 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14485)
* Add a CHANGES entry for the cosmetic differences in textual outputMatt Caswell2021-03-151-0/+13
| | | | | | | | | | | Numerous functions have had their textual output amended. We add a CHANGES entry for this. Fixes #14476 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14485)
* apps: Make load_key_certs_crls to read only what is expectedTomas Mraz2021-03-151-8/+24
| | | | | | | | | The load_key_certs_crls tried to read the whole input stream instead of returning once expected data is obtained. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14449)
* apps: Add maybe_stdin argument to load_certs and set it in pkcs12Tomas Mraz2021-03-1510-19/+19
| | | | | | Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14449)
* Tiny clarification of comment for RSA_signdiv2016bit2021-03-151-1/+1
| | | | | | | | | | CLA: trivial On line 136, a period is added. I think this is what was intended. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14540)
* Fix DSA EVP_PKEY_param_check() when defaults are used for param generation.Shane Lontis2021-03-155-7/+38
| | | | | | | | | | | | | | | | | | Fixes #14480 An internal flag that is set during param gen was not being tested, so the wrong type was used to select the dsa domain param validation method. In the default provider - if no gen_type is set then by default the fips186_4 gentype will be selected when pbits >=2048 otherwise it selects fips186_2. The fips provider ignores the gen_type and always uses fips186_4. Before this change dsa used fips186_2 by default in the default provider. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14508)
* keymgmt_meth: remove two TODO 3.0Tomas Mraz2021-03-141-4/+3
| | | | | | | | | | | | | | The first TODO 3.0 is not really a TODO, just a comment. The second one is something that is needed for compatibility with existing applications. There is no major reason in trying to change this behavior right now. Fixes #14400 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14534)
* Fix option description for PKCS#12 exportTobias Nießen2021-03-141-1/+1
| | | | | | | | Refs: https://github.com/openssl/openssl/pull/4930 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14520)
* Convert a TODO(3.0) in OPENSSL_thread_stop_ex to a commentMatt Caswell2021-03-141-3/+3
| | | | | | | | | | | | The TODO is describing something that would be nice to fix. In fact the problem exists even in 1.1.1. It would be nice to fix it, but it does not need to be done in the 3.0 timeframe. Fixes #14376 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14533)
* Remove a TODO from async_delete_thread_state()Matt Caswell2021-03-141-1/+0
| | | | | | | | | | | | There is nothing to be done here for the time being. If at some point we make the async code libctx aware then we might need to make a change but there are no plans to do that at the moment. Fixes #14402 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14532)
* Remove TODO in rsa_ameth.cShane Lontis2021-03-143-12/+13
| | | | | | | | | | | | Fixes #14390 The only caller of this function tests EVP_KEYMGMT_is_a() beforehand which will fail if the RSA key types do not match. So the test is not necessary. The assert has been removed when it does the test. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14524)
* Remove TODO in test/acvp_test.c related to setting AES-GCM iv.Shane Lontis2021-03-141-2/+3
| | | | | | | Fixes #14330 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14525)
* Always check CRYPTO_LOCK_{read,write}_lockRich Salz2021-03-1437-139/+286
| | | | | | | | | | | | | | Some functions that lock things are void, so we just return early. Also make ossl_namemap_empty return 0 on error. Updated the docs, and added some code to ossl_namemap_stored() to handle the failure, and updated the tests to allow for failure. Fixes: #14230 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14238)
* apps/ts.c: Allow -untrusted arg to refer to multiple sourcesDr. David von Oheimb2021-03-135-178/+201
| | | | | | | This requires moving generally useful functions from apps/cmp.c to apps/lib/apps.c Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14504)
* TS ESS: Let TS_RESP_verify_signature() make use of untrusted certs also from ↵Dr. David von Oheimb2021-03-133-34/+42
| | | | | | | token response Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14504)
* ssl: fix format specifier for size_t argument to BIO_printfPauli2021-03-131-1/+1
| | | | | | | | Fixes #14519 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14521)
* acvp_test: Do not expect exact number of self testsTomas Mraz2021-03-121-1/+1
| | | | | | | | | There might be more because internal instances of the DRBG might be initialized for the first time and thus self-tested as well. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14497)
* Remove the RAND_get0_public() from fips provider initializationTomas Mraz2021-03-121-3/+0
| | | | | | | | | | It is not needed anymore and it causes leaks because it is called when the FIPS provider libctx is not yet properly set up. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14497)
* Use OPENSSL_init_crypto(OPENSSL_INIT_BASE_ONLY, NULL) in libcryptoTomas Mraz2021-03-127-36/+2
| | | | | | | | | | | | Calling OPENSSL_init_crypto(0, NULL) is a no-op and will not properly initialize thread local handling. Only the calls that are needed to initialize thread locals are kept, the rest of the no-op calls are removed. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14497)
* Update CHANGES with info about AuthEnvelopedData additionJakub Zelenka2021-03-121-0/+7
| | | | | | Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14456)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-19 19:09:38 +0000