aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* FIPS module checksums: add scripts and Makefile ruleRichard Levitte2021-05-046-0/+751
| | | | | | | | | | | | | | | | | | | | | This adds the following scripts: util/lang-compress.pl: Compress source code, which language is determined by the first argument. For the moment, we know 'perl' (perlasm source code), 'C' (C source code) and 'S' (Assembler with C preprocessor directives). This removes comments and empty lines, and compresses series of horizontal spaces to one single space in the languages where that's appropriate. util/fips-checksums.sh: Takes source file names as arguments, pushes them through util/lang-compress.pl and unifdef with FIPS_MODE defined, and calculates the checksum on the result. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
* Unix build file: Add a target to create providers/fips.module.sourcesRichard Levitte2021-05-042-0/+503
| | | | | | | This file will be the basis for the FIPS module checksum calculation Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
* Add OpenSSL::Config::Query and use it in configdata.pmRichard Levitte2021-05-042-2/+201
| | | | | | | | | OpenSSL::Config::Query is a configuration querying tool that's meant to make it easier to query the diverse configuration data for info. That's much easier than to dig through all the parts of %unified_info. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
* Windows build file: add forgotten quotes on POD->html command lineRichard Levitte2021-05-041-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15084)
* OpenSSL::Test: When prefixing command with $^X on Windows, fix it up!Richard Levitte2021-05-041-1/+1
| | | | | | | | | | | | The perl interpreter name itself might contain spaces and need quoting. __fixup_prg() does this for us. Fixes #14256 Co-authored-by: Tomáš Mráz <tomas@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15084)
* acvp-test: disable the ACVP testing code by defaultPauli2021-05-022-2/+3
| | | | | | | It's only useful for the FIPS lab and shouldn't be in production. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15092)
* ssl: fix possible ref counting fields use before init.FdaSilvaYY2021-05-011-7/+9
| | | | | | | | | `strdup(propq)` failure is doing a `goto err;` from where `SSL_CTX_free` is called. The possible call is made before reference and lock fields setup. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15052)
* man: s_server: fix text repetition in -alpn descriptionHubert Kario2021-05-011-1/+1
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15099)
* APPS: Document the core of the opt_ APIRich Salz2021-05-014-7/+306
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/14995)
* Use OCSP-specific error code for clarityDmitry Belyavskiy2021-05-014-1/+6
| | | | | | | | Fixes #12735 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/xxxxx)
* Simplify AppVeyor configurationTomas Mraz2021-05-011-15/+4
| | | | | | | | Adjust the stuff we are building and testing in various configurations to trim the run time a little bit. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15087)
* Add -latomic to threads enabled 32bit linux buildsTomas Mraz2021-05-011-2/+8
| | | | | | | | | | | | | | It might not be necessary with the most recent toolchain versions but apparently many 32bit linux architectures and commonly used toolchain versions require this. It is also harmless to include even on architectures that do not need it. Fixes #14083 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15086)
* Fix no-fips-securitychecks test failureShane Lontis2021-05-011-0/+1
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15091)
* apps/ca,req,x509: Switch to EVP_DigestSignInit_exPetr Gotthard2021-04-305-66/+58
| | | | | | | | | | | | Switch lib/apps.c do_sign_init() to use EVP_DigestSignInit_ex, so it works with external providers. Since EVP_DigestSignInit_ex requires a digest name instead of an EVP_MD pointer, the apps using do_sign_init() had to be modified to pass char* instead of EVP_MD*. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15014)
* Fix typo in OSSL_DECODER_CTX_set_input_structureDaniel Bevenius2021-04-301-2/+2
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15085)
* STORE: Fix the repeated prompting of passphraseRichard Levitte2021-04-301-1/+5
| | | | | | | | | OSSL_STORE's loading function could prompt repeatedly for the same passphrase. It turns out that OSSL_STORE_load() wasn't caching the passphrase properly. Fixed in this change. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15064)
* SM2 signatures work correctly only with SM3 digestsTomas Mraz2021-04-301-0/+1
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15074)
* sm2: Cleanup handling of DIGEST and DIGEST_SIZE parametersTomas Mraz2021-04-301-43/+47
| | | | | | | Fixes #14873 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15074)
* CORE: Rework the pre-population of the namemapRichard Levitte2021-04-301-40/+31
| | | | | | | The pre-population of names has become more thorough. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15066)
* STORE: Use the 'expect' param to limit the amount of decoders usedRichard Levitte2021-04-301-4/+10
| | | | | | | | | | | | | | | | In the provider file: scheme loader implementation, the OSSL_DECODER_CTX was set up with all sorts of implementations, even if the caller has declared a limited expectation on what should be loaded, which means that even though a certificate is expected, all the diverse decoders to produce an EVP_PKEY are added to the decoding change. This optimization looks more closely at the expected type, and only adds the EVP_PKEY related decoder implementations to the chain if there is no expectation, or if the expectation is one of OSSL_STORE_INFO_PARAMS, OSSL_STORE_INFO_PUBKEY, OSSL_STORE_INFO_PKEY. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15066)
* acvp: fix the no-acvp_test buildPauli2021-04-304-5/+7
| | | | | | | | A pair of the disabled string checks were incorrect. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15082)
* Update OSSL_STORE_attach() documentation to indicate it increases the ↵Shane Lontis2021-04-301-2/+3
| | | | | | | | ref_count of the passed in bio Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15058)
* Fix memory leak in load_key_certs_crls() when using stdin.Shane Lontis2021-04-301-1/+3
| | | | | | | | | | | | | | | | | | A newly created BIO object within this function calls OSSL_STORE_attach() which increases the ref count to 2. OSSL_STORE_close() then decrements the ref count by 1, so the BIO still remains. The following new test was picking up this leak using.. > valgrind openssl crl -hash -noout < test/testcrl.pem Not quite sure why the existing tests were not picking this up since they appear to run through a similiar path.. such as > valgrind openssl pkey < test-runs/test_rsa/rsa-pkcs8-ff.dd Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15058)
* Fix CRL app so that stdin works.Shane Lontis2021-04-306-11/+26
| | | | | | | | | | Fixes #15031 The maybe_stdin needed to be passed to load_key_certs_crls(). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15058)
* Document the API breaking constification changesTomas Mraz2021-04-303-3/+21
| | | | | | | | | | The EVP_PKEY_asn1_set_public and EVP_PKEY_meth_set_copy have some API breaking constification changes in 3.0. Fixes #9296 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15068)
* Remove dated term and fixed typo antherEric Curtin2021-04-301-2/+2
| | | | | | | | | | Just something I noticed while reading this code. This was probably committed a very long time ago. Fixed typo anther -> another. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15078)
* remove end of line whitespacePauli2021-04-308-16/+16
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14434)
* Add library context and property query support into the PKCS12 APIJon Spillett2021-04-3050-341/+2305
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14434)
* Adjust ssl_test_new for SHA1 security levelMatt Caswell2021-04-295-28/+68
| | | | | | | | | | | | | | SHA1 is now in security level 0. SHA1 is required for DTLSv1.1. Therefore ssl_test_new needed some adjustments in the event that DTLSv1.2 is disabled. There are also adjustments required if using the FIPS module and DTLSv1.2 is disabled. The only DTLS version supported by the FIPS module is DTLSv1.2. Fixes #14956 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15047)
* Adjust sslapitest for SHA1 security levelMatt Caswell2021-04-291-0/+55
| | | | | | | | SHA1 is now in security level 0. SHA1 is required for DTLSv1.1. Therefore sslapitest needed some adjustments in the event that DTLSv1.2 is disabled. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15047)
* Adjust dtlstest for SHA1 security levelMatt Caswell2021-04-291-0/+32
| | | | | | | | SHA1 is now in security level 0. SHA1 is required for DTLSv1.1. Therefore dtlstest needed some adjustments in the event that DTLSv1.2 is disabled. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15047)
* asn1_lib.c: ASN1_put_object: Remove comment about "class 0".Scott McPeak2021-04-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | ASN1_put_object() was preceded by the nonsensical comment: /* * class 0 is constructed constructed == 2 for indefinite length constructed */ This is the result of concatenating two sentences in 0f113f3ee4d by automated reformatting. The first sentence, "class 0 is constructed", goes back to d02b48c63a, the import of SSLeay 0.8.1b. Even in that context, it made little sense; class 0 means "universal", not constructed, and there is no special significance to class 0 in this function in any case. Therefore I have simply removed that first sentence. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14998)
* Add test case for openssl crl -noout -hash outputTomas Mraz2021-04-291-1/+4
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15044)
* crl: noout is not an output itemTomas Mraz2021-04-291-1/+1
| | | | | | | | Fixes #15034 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15044)
* CHANGES: document the FIPS provider configuration and installationDr. Matthias St. Pierre2021-04-291-0/+16
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13684)
* README-FIPS: document the installation of the FIPS providerDr. Matthias St. Pierre2021-04-292-19/+42
| | | | | | | | | | | | | | | Note that configuration and installation procedure has changed: - The FIPS provider is now disabled by default and needs to be enabled by configuring with `enable-fips`. - If the FIPS provider is enabled, it gets installed automatically. There is no extra installation step required anymore. This is more natural and coincides with the expectation of the user, namely "what's configured, gets installed". Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13684)
* Configure: disable fips mode by defaultDr. Matthias St. Pierre2021-04-291-0/+1
| | | | | | | | | Building the fips provider in addition to the default provider effectively doubles the build time. Since many users will not need fips support, it is now disabled by default. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13684)
* Configure: sort the disablables alphabeticallyDr. Matthias St. Pierre2021-04-291-6/+6
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13684)
* build.info: add the Perl wrapper to build generator programs on WindowsDr. Matthias St. Pierre2021-04-291-2/+2
| | | | | | | | | | | | | | | | Pull request #14320 introduced the ability to use compiled programs as generators in GENERATE rules of build.info files. Those generator calls were wrapped by the Perl wrapper (wrap.pl) in the Unix makefile template, but not on Windows. This commit adds the missing wrapper for Windows, because for the `fipsmodule.cnf` target it is essential that the `openssl fipsinstall` command does not load any preinstalled openssl configuration file. Fixes #13680 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13684)
* Configure/Makefile: install the fips provider if it was configuredDr. Matthias St. Pierre2021-04-292-2/+19
| | | | | | | | | | | | | | | | | | To follow the principle "what you configure is what you install", the `make install` target now includes the installation of the fips provider (`make install_fips`) if (and only if) OpenSSL was configured with fips support (`enable-fips`). The `make install_fips` target exists as well and can be used to install just the fips provider. It requires `enable-fips` and issues an error message if `no-fips` was configured. The anologue holds for the 'uninstall_fips' target. Fixes #13693 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13684)
* Configure/Makefile: don't generate a fresh fipsmodule.cnf when installing itDr. Matthias St. Pierre2021-04-292-12/+6
| | | | | | | | | | | | | There is already a `providers/fipsmodule.cnf` target which is required by the tests. Instead of creating another fipsmodule.cnf, the `install_fips` target simply copies that configuration file to its final destination. This commit also restores the minimal dependencies to build the `install_fips` target immediately after configuring, which was broken after the removal of the `install_sw` dependency. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13684)
* Configure/Makefile: separate install of the FIPS moduleDr. Matthias St. Pierre2021-04-292-8/+43
| | | | | | | | | Fixes #13693 Co-authored-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13684)
* Configure/Makefile: correct the FIPS module configuration file pathDr. Matthias St. Pierre2021-04-292-7/+5
| | | | | | | | | | | According to the OpenSSL 3.0 Wiki, the file should be located at $(DESTDIR)$(OPENSSLDIR)/fipsmodule.cnf next to the openssl.cnf file. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13684)
* Configure/Makefile: use the correct openssl app for FIPS installationDr. Matthias St. Pierre2021-04-292-6/+8
| | | | | | | | | | | The `openssl` app was previously called without a path, which would generally invoke the system's copy of the openssl application. Currently, that's most likely an openssl version 1.1.1 application, which does not recognize the `fipsinstall` command and terminates with an error message. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13684)
* Configure/Makefile: fix the `-macopt` argument of the fipsinstall commandDr. Matthias St. Pierre2021-04-293-3/+3
| | | | | | | | The FIPS hmac key is provided as a hexadezimal string, which needs to be be prefixed with `hexkey:`, not `key:`. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13684)
* runchecker: fix no-sock build by conditioning clean up on the NO_SOCK symbol.Pauli2021-04-291-0/+2
| | | | | | | Fixes #15054 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15055)
* test: never run fipsinstall if the tests are not enabled.Pauli2021-04-291-5/+7
| | | | | | | | | | | | | Fixes #15056 The dependency for fipsinstall was being added to the makefile regardless of it being used. This means that a subsequent `make test` would fail if the command line application wasn't present. Rather than fix the instance in question, it is better to leave out this part of the makefile if the tests cannot be run. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15057)
* util/add-depends.pl: Adapt to localized /showIncludes outputRichard Levitte2021-04-281-5/+12
| | | | | | | | | | | | It was discovered that MSVC has localized /showIncludes output. Fortunately, it still seems to follow the same generic format, so we can adapt the regular expression to make it language agnostic. Fixes #14994 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/15006)
* Configuration: rework how dependency making is handledRichard Levitte2021-04-289-41/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, we had dependency making pretty much hard coded in the build file templates, with a bit of an exception for Unix family platforms, where we had different cases depending on what dependency making program was found. With the Embarcadero C++ builder, a separate scheme appeared, with a different logic. This change merges the two, and introduces two config target attributes: makedepcmd The program to use, where this is relevant. This replaces the earlier configuration attribute 'makedepprog'. makedep_scheme This is a keyword that can be used by build files templates to produce different sorts of commands, but most importantly, to pass as argument to util/add-depend.pl, which uses this keyword as a "producer" for the dependency lines. If the config target doesn't define the 'makedep_scheme' attribute, Configure tries to figure it out by looking for GCC compatible compilers or for the 'makedepend' command. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/15006)
* Windows bulding: Make dependency generation not quite as talkativeRichard Levitte2021-04-283-3/+6
| | | | | | | | | | | | | | | | | | The modified way to generate .d files had an unfortunate side effect, that it outputs the whole preprocessed file and not just the dependency lines, at least with MSVC's cl. That gave util/add-depends.pl a whole lot more to read through, which impacts greatly on the performance of dependency treatment. We modify the process by adding a config target attribute 'make_depend', which can be any suitable command for generating such lines. All it needs is to also accept C flags and macro definitions. Fixes #14994 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/15006)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-20 07:31:34 +0000