aboutsummaryrefslogtreecommitdiffstats
path: root/util
Commit message (Collapse)AuthorAgeFilesLines
* Improve ossl_cmp_build_cert_chain(); publish it as X509_build_chain()Dr. David von Oheimb2021-04-201-0/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14128)
* Add the function OSSL_LIB_CTX_get0_global_default()Matt Caswell2021-04-191-0/+1
| | | | | | | | | An API function for obtaining the global default lib ctx. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14890)
* Link with .def filesTanzinul Islam2021-04-191-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | MSVC's `link.exe` automatically finds `__cdecl` C functions (which are decorated with a leading underscore by the compiler) when they are mentioned in a `.def` file without the leading underscore. This is an [under-documented feature][1] of MSVC's `link.exe`. C++Builder's `ilink32.exe` doesn't do this, and thus needs the name-translation in the `.def` file. Then `implib.exe` needs to be told to re-add it. (The Clang-based `bcc32c.exe` doesn't implement the [`-vu` or `-u-`][2] options to skip adding the leading underscore to `__cdecl` C function names, so this is the only way to have things work with non-underscored export names in the DLLs.) [1]: https://github.com/MicrosoftDocs/cpp-docs/issues/2653 [2]: http://docwiki.embarcadero.com/RADStudio/Sydney/en/Options_Not_Supported_by_Clang-enhanced_C%2B%2B_Compilers#BCC32_Options_that_Are_Not_Supported_by_Clang-enhanced_C.2B.2B_Compilers Also silence linker warnings on duplicate symbols and ensure that error- case cleanup in link rules work in C++Builder's `make.exe`. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13540)
* Generate dependency informationTanzinul Islam2021-04-191-5/+14
| | | | | | | | | | | | | | | | The Clang-based `bcc32c.exe` doesn't implement the `-Hp` option, so we have to use [`cpp32.exe`][1] instead. Therefore, change the dependency- emitting command to use `$(CPP)` instead of `$(CC)`, which which also uncovered the [existing bug of `2>&1` before `> $dep`][2]. Also C++Builder's `make.exe` doesn't implement `2>&1` in its command runner, so wrap the whole line in a `cmd /C`. [1]: http://docwiki.embarcadero.com/RADStudio/Sydney/en/CPP32.EXE,_the_C_Compiler_Preprocessor [2]: https://ss64.com/nt/syntax-redirection.html Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13540)
* Add "origin" field to EVP_CIPHER, EVP_MDRich Salz2021-04-181-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a "where did this EVP_{CIPHER,MD} come from" flag: global, via fetch, or via EVP_{CIPHER,MD}_meth_new. Update EVP_{CIPHER,MD}_free to handle all three origins. The flag is deliberately right before some function pointers, so that compile-time failures (int/pointer) will occur, as opposed to taking a bit in the existing "flags" field. The "global variable" flag is non-zero, so the default case of using OPENSSL_zalloc (for provider ciphers), will do the right thing. Ref-counting is a no-op for Make up_ref no-op for global MD and CIPHER objects Deprecate EVP_MD_CTX_md(). Added EVP_MD_CTX_get0_md() (same semantics as the deprecated function) and EVP_MD_CTX_get1_md(). Likewise, deprecate EVP_CIPHER_CTX_cipher() in favor of EVP_CIPHER_CTX_get0_cipher(), and add EVP_CIPHER_CTX_get1_CIPHER(). Refactor EVP_MD_free() and EVP_MD_meth_free() to call new common evp_md_free_int() function. Refactor EVP_CIPHER_free() and EVP_CIPHER_meth_free() to call new common evp_cipher_free_int() function. Also change some flags tests to explicit test == or != zero. E.g., if (flags & x) --> if ((flags & x) != 0) if (!(flags & x)) --> if ((flags & x) == 0) Only done for those lines where "get0_cipher" calls were made. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14193)
* Fix naming for EVP_RAND_CTX_gettable functions.Pauli2021-04-171-2/+2
| | | | | | | | | | | | | | | Change: EVP_RAND_gettable_ctx_params -> EVP_RAND_CTX_gettable_params EVP_RAND_settable_ctx_params -> EVP_RAND_CTX_settable_params Which brings them in line with the other similar functions for other algorithm types. Fixes #14880 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14893)
* Add EVP_PKEY_todata() and EVP_PKEY_export() functions.Shane Lontis2021-04-151-0/+2
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14800)
* Rename EVP_PKEY_get0_first_alg_name to EVP_PKEY_get0_type_nameTomas Mraz2021-04-151-2/+2
| | | | | | | | | | | | | | | We use type elsewhere and documenting the 'first' in the name of the call is a little bit superfluous making the name too mouthful. Also rename EVP_PKEY_typenames_do_all to EVP_PKEY_type_names_do_all to keep the words separated by underscore. Fixes #14701 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14868)
* util/wrap.pl: use the apps/openssl.cnf from the source treeDr. Matthias St. Pierre2021-04-131-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The `make install_fips` target failed msp@debian:~/src/openssl$ make install_fips *** Installing FIPS module install providers/fips.so -> /opt/openssl-dev/lib/ossl-modules/fips.so *** Installing FIPS module configuration fipsinstall /opt/openssl-dev/ssl/fipsmodule.cnf FATAL: Startup failure (dev note: apps_startup()) for ./apps/openssl ... No such file or directory:crypto/conf/conf_def.c:771:calling stat(fipsmodule.cnf) ... make: *** [Makefile:3341: install_fips] Error 1 because the `openssl fipsinstall` command was loading a previously installed configuration file instead of the copy shipped with the source tree. msp@debian:~/src/openssl$ strace -f make install_fips |& grep openssl.cnf [pid 128683] openat(AT_FDCWD, "/opt/openssl-dev/ssl/openssl.cnf", O_RDONLY) = 3 This issue reveiled a more general problem, which applies to the tests as well: unless openssl is installed, the openssl app must not use any preinstalled configuration file. This holds in particular when the preinstalled configuration file load providers, which caused the above failure. The most consistent way to achieve this behaviour is to set the OPENSSL_CONF environment variable to the correct location in the util/wrap.pl perl wrapper. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14136)
* Remove the function EVP_PKEY_set_alias_typeMatt Caswell2021-04-121-1/+1
| | | | | | | | | | | | | | | | OTC recently voted that EVP_PKEY types will be immutable in 3.0. This means that EVP_PKEY_set_alias_type can no longer work and should be removed entirely (applications will need to be rewritten not to use it). It was primarily used for SM2 which no longer needs this call. Applications should generate SM2 keys directly (without going via an EC key first), or otherwise when loading keys they should automatically be detected as SM2 keys. Fixes #14379 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14803)
* Replace OSSL_PARAM_BLD_free_params() with OSSL_PARAM_free().Shane Lontis2021-04-121-1/+0
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14785)
* Add OSSL_PARAM_dup() and OSSL_PARAM_merge().Shane Lontis2021-04-121-0/+3
| | | | | | | | | | | | These functions are prerequisites for implementing EVP_PKEY_todata(). OSSL_PARAM_dup() is required to make a deep copy of the exported params (since the provider export() uses a OSSL_PARAM_BLD which throws away the data after the call), and then use OSSL_PARAM_merge() to add some additional params that can be passed to the EVP_PKEY_todata(). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14785)
* Update copyright yearMatt Caswell2021-04-082-2/+2
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14801)
* Fix more certificate related lib_ctx settings.Shane Lontis2021-04-081-0/+1
| | | | | | | | | | | | Fixes #13732 Fix a few places that were not using the '_ex' variants of ASN1_item_sign/verify. Added X509_CRL_new_ex(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14752)
* EVP: Add EVP_<TYPE>_description()Richard Levitte2021-04-021-0/+11
| | | | | | | | | | | | | | | | | | The following operation types are covered: EVP_MD, EVP_CIPHER, EVP_MAC, EVP_RAND, EVP_KEYMGMT, EVP_SIGNATURE, EVP_ASYM_CIPHER, EVP_KEM, EVP_KEYEXCH, EVP_KDF. Also EVP_PKEY. For EVP_MD and EVP_CIPHER, OBJ_nid2ln() is used as a fallback for legacy implementations. For EVP_PKEY, the info field of the EVP_PKEY_ASN1_METHOD is used as a fallback for legacy implementations. Fixes #14514 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14656)
* Add OSSL_STORE_LOADER_description()Richard Levitte2021-04-021-0/+1
| | | | | | | Fixes #14514 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14656)
* Add OSSL_DECODER_description() and OSSL_ENCODER_description()Richard Levitte2021-04-021-0/+2
| | | | | | | Fixes #14514 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14656)
* Add a range check (from SP800-56Ar3) to DH key derivation.Shane Lontis2021-04-011-0/+1
| | | | | | | | | | | | | | Fixes #14401 Note that this moves the public key check out of DH compute_key() since key validation does not belong inside this primitive.. The check has been moved to the EVP_PKEY_derive_set_peer() function so that it generally applies to all exchange operations.. Use EVP_PKEY_derive_set_peer_ex() to disable this behaviour. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14717)
* Add a local perl module to get year last changedRich Salz2021-03-311-0/+43
| | | | | | | | | | | This is used for generating a more-correct copyright statement for the "build_generated" targets. Fixes: #13765 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13791)
* Print correct error message in utils/mkdir-p.plAlex Yursha2021-03-301-1/+2
| | | | | | | | | | | | | | | | | | | | | | | Commit 70a56b914772e6b21cda2a5742817ae4bb7290f1 introduced a regression. If utils/mkdir-p.pl fails to create a target dir because of insufficient file system permissions, the subsequent test for dir existence always fails and overwrites the system error. As a result, a user is presented with a misleading error message. E.g. if a user tries to create a dir under /usr/local and does not have permissions for it, the reported error message is "Cannot create directory /usr/local/lib: No such file or directory", whereas the expected error message is "Cannot create directory /usr/local/lib: Permission denied". This commit introduces a fix by declaring an additional local variable to cache the original error message from mkdir. If -d check fails and overwrites the system error, the user is still presented with the original error from mkdir. CLA: Trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14487)
* Add explicit support in util/shlib_wrap.sh.in for NonStop DLL loading.Randall S. Becker2021-03-301-0/+9
| | | | | | | | | | | | | | | | The NonStop platform uses a proprietary mechanism for specifying DLL locations. CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #14666 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14669)
* Implement EVP_PKEY_dup() functionTomas Mraz2021-03-281-0/+2
| | | | | | | Fixes #14501 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14624)
* HTTP: Rename OSSL_HTTP_REQ_CTX_i2d() to OSSL_HTTP_REQ_CTX_set1_req()Dr. David von Oheimb2021-03-261-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14677)
* Teach TLSProxy how to encrypt <= TLSv1.2 ETM recordsMatt Caswell2021-03-251-7/+30
| | | | | | | | | | Previously TLSProxy only knew how to "repack" messages for TLSv1.3. Most of the handshake in <= TLSv1.2 is unencrypted so this hasn't been too much of restriction. However we now want to modify reneg handshakes which are encrypted so we need to add that capability. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
* Fix usages of const EVP_MD.Shane Lontis2021-03-221-0/+2
| | | | | | | | Partially fixes #13837 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14474)
* Dual 1024-bit exponentiation optimization for Intel IceLake CPUAndrey Matyukov2021-03-222-2/+1
| | | | | | | | | | with AVX512_IFMA + AVX512_VL instructions, primarily for RSA CRT private key operations. It uses 256-bit registers to avoid CPU frequency scaling issues. The performance speedup for RSA2k signature on ICL is ~2x. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13750)
* Added functions for printing EVP_PKEYs to FILE *Tomas Mraz2021-03-191-0/+3
| | | | | | | Fixes #14172 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14577)
* core: add params argument to key manager's gen_init callPauli2021-03-121-0/+10
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14383)
* Update copyright yearMatt Caswell2021-03-111-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14512)
* Use BIO_f_readbuffer() in the decoder to support stdin.Shane Lontis2021-03-111-0/+1
| | | | | | | | | | | | Fixes #13185 Fixes #13352 Removed the existing code in file_store that was trying to figure out the input type. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14407)
* Non-const accessor to legacy keysDmitry Belyavskiy2021-03-091-1/+0
| | | | | | | | | Fixes #14466. Reverting the changes of the EVP_PKEY_get0 function. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14468)
* Reword repeated words.Shane Lontis2021-03-091-1/+1
| | | | | | | | | | A trivial PR to remove some commonly repeated words. It looks like this is not the first PR to do this. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14420)
* Ensure the various legacy key EVP_PKEY getters/setters are deprecatedMatt Caswell2021-03-081-10/+10
| | | | | | | | | | | | | Most of these were already deprecated but a few have been missed. This commit corrects that. Fixes #14303 Fixes #14317 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14319)
* Remove RSA SSLv23 padding modeRich Salz2021-03-011-2/+2
| | | | | | Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14248)
* Generalize schmeme parsing of OSSL_HTTP_parse_url() to OSSL_parse_url()Dr. David von Oheimb2021-03-011-0/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14009)
* OSSL_HTTP_parse_url(): Handle any userinfo, query, and fragment componentsDr. David von Oheimb2021-03-011-1/+0
| | | | | | | | | | | | | | | | Now handle [http[s]://][userinfo@]host[:port][/path][?query][#frag] by optionally providing any userinfo, query, and frag components. All usages of this function, which are client-only, silently ignore userinfo and frag components, while the query component is taken as part of the path. Update and extend the unit tests and all affected documentation. Document and deprecat OCSP_parse_url(). Fixes an issue that came up when discussing FR #14001. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14009)
* core: support modified gettable/settable ctx calls for ciphersPauli2021-02-261-0/+2
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14240)
* core: core: support modified gettable/settable ctx calls for MACsPauli2021-02-261-0/+2
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14240)
* core: support modified gettable/settable ctx calls for KDFsPauli2021-02-261-0/+2
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14240)
* evp: support modified gettable/settable ctx calls for RNGsPauli2021-02-261-0/+2
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14240)
* provider: add an unquery function to allow providers to clean up.Pauli2021-02-241-0/+1
| | | | | | | | | | | Without this, a provider has no way to know that an application has finished with the array it returned earlier. A non-caching provider requires this information. Fixes #12974 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12974)
* Deprecated EVP_PKEY_CTX_get0_dh_kdf_ukm() and EVP_PKEY_CTX_get0_ecdh_kdf_ukm()Tomas Mraz2021-02-241-2/+2
| | | | | | | | | | | The functions are not needed and require returning octet ptr parameters from providers that would like to support them which complicates provider implementations. Fixes #12985 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14279)
* RAND_METHOD deprecation: code changesPauli2021-02-231-4/+6
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13652)
* EVP: Implement EVP_PKEY_CTX_is_a()Richard Levitte2021-02-231-0/+1
| | | | | | | | | | This does what was previously done by looking at pctx->pmeth->pkey_id, but handles both legacy and provider side contexts, and is supposed to become a replacement for the old way. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13913)
* util/perl/OpenSSL/config.pm: Add VMS specific C compiler settingsRichard Levitte2021-02-231-0/+13
| | | | | | | | | That includes proper compiler version detection. Partially fixes #14247 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14270)
* util/perl/OpenSSL/config.pm: Fix determine_compiler_settings()Richard Levitte2021-02-231-45/+52
| | | | | | | | | | | | | | | | | There may be times when a compiler can't be detected, in which case determine_compiler_settings() bailed out too early, before platform specific fallbacks have a chance to set the record straight. That bail out has been moved to be done after the platform specific fallbacks. Furthermore, the attempt to check for gcc or clang and get their version number was done even if no compiler had been automatically detected or pre-specified via $CC. It now only does this when there is a compiler specified or detected. The platform specific fallbacks check the versions separately. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14270)
* Note that the OSSL_CORE_MAKE_FUNC macro is reservedMatt Caswell2021-02-221-0/+1
| | | | | | | | | | | | | The OSSL_CORE_MAKE_FUNC macro has been added since 1.1.1 and is undocumented. However it is not intended for application use and so we document it as "reserved". Fixes #13192 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14232)
* Document the OSSL_PARAM_DEFN macroMatt Caswell2021-02-221-1/+0
| | | | | | | | | This macro was added since 1.1.1 and was undocumented. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14232)
* Add documentation for the macro OPENSSL_VERSION_PREREQMatt Caswell2021-02-222-1/+1
| | | | | | | | | This macro was added since 1.1.1 but had no associated documentation. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14232)
* Document OPENSSL_LH_flush()Matt Caswell2021-02-221-9/+0
| | | | | | | | | | | The function OPENSSL_LH_flush() was added since 1.1.1 and was undocumented. We also add documentation for some other OPENSSL_LH_*() functions at the same time. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14232)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-19 20:46:24 +0000