summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-05-19fips: remove unnecessary commas to get CI workingPauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15337)
2021-05-19Avoid failing label removal if label is not thereTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15309)
2021-05-19Separate FIPS checksum and labelling into different workflowsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15309)
2021-05-19Remove "openssl ifdef" handlingRich Salz
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15311)
2021-05-19Remove '=for openssl ifdef'Rich Salz
No longer needed after rewrite of cmd-nits Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15311)
2021-05-18Better error messages if there are no encoders/decoders/store loadersMatt Caswell
If you don't have the base or default providers loaded and therefore there are no encoders/decoders or store loaders then the error messages can be cryptic. We provide better hints about how to fix the problem. Fixes #13798 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15306)
2021-05-18Move ossl_sleep() to e_os.h and use it in appsDr. David von Oheimb
Fixes #15304 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15308)
2021-05-18DOC: Fix nits found by improved find-doc-nits -cDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15298)
2021-05-18ci.yml: Add cmd-nits to the doc-nits CI runDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15298)
2021-05-18openssl-dsa.pod.in: Fix glitch: pvk-string -> pvk-strongDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15298)
2021-05-18find-doc-nits: Make -c option (cmd-nits) independent of app build and executionDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15298)
2021-05-18apps/s_server: Add -proxy and -no_proxy optionsDr. David von Oheimb
Strongly related to feature request #6965 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15245)
2021-05-18apps/ocsp: Add -proxy and -no_proxy optionsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15245)
2021-05-18Add -quiet flag to genpkeyRich Salz
Picking up late suggestions to PR #6909 by Philip Prindeville <philipp@redfish-solutions.com>. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15249)
2021-05-18apps: use else if when checking for headers in the http server codePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15300)
2021-05-18seal: make EVP_SealInit() library context awarePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15300)
2021-05-18hmac: fix coverity 1484888 negative integer to size_t conversionPauli
More theoretical than real but easy and cheap to check for. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15300)
2021-05-18keymgmt: fix coverity 1484886 unchecked return valuePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15300)
2021-05-18evp: fix coverity 1484885 negative integer to size_t conversionPauli
Theoretically, the IV length can come back negative which would explode. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15300)
2021-05-18provider: fix coverity 1484884: uninitialised lock usePauli
This actually fixes a more subtle problem that wasn't detected which could cause memory leaks. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15300)
2021-05-18apps: clean up the http server codePauli
Clean up some of the null checking in the http server code. This also "fixes" the false positive from coverity CID 1484883. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15300)
2021-05-18test: conditionally exclude unused code for no-tls1.2 buildPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15301)
2021-05-17Fix a use-after-free in the child provider codeMatt Caswell
If the child provider context data gets cleaned up before all usage of providers has finished then a use-after-free can occur. We change the priority of this data so that it gets freed later. Fixes #15284 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15286)
2021-05-17Add SSL_OP_ALLOW_CLIENT_RENEGOTIATIONRich Salz
Add -client_renegotiation flag support. The -client_renegotiation flag is equivalent to SSL_OP_ALLOW_CLIENT_RENEGOTIATION. Add support to the app, the config code, and the documentation. Add SSL_OP_ALLOW_CLIENT_RENEGOTIATION to the SSL tests. We don't need to always enable it, but there are so many tests so this is the easiest thing to do. Add a test where client tries to renegotiate and it fails as expected. Add a test where server tries to renegotiate and it succeeds. The second test is supported by a new flag, -immediate_renegotiation, which is ignored on the client. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15184)
2021-05-17Fix pointer passed to provider_unquery_operationPetr Gotthard
Walking through the `map` modifies the pointer passed to the `unquery` operation. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15295)
2021-05-17Add a CHANGES entry for fully pluggable groupsMatt Caswell
Fixes #12283 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15282)
2021-05-17Add doc for ERR_clear_last_mark().Shane Lontis
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15258)
2021-05-17Fix OSSL_DECODER_new_for_pkey() selection parameter documentationShane Lontis
Fixes #14518 EVP_PKEY_fromdata() already defines this value so we link to this documentation, 0 is also added as a possible input value. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15260)
2021-05-17Fix compiler error when using config option 'enable-acvp-tests'Shane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15264)
2021-05-16Adapt 80-test_cmp_http.t and its data for random accept portsRichard Levitte
Fixes #14694 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15281)
2021-05-16APPS: Make the cmp Mock server output the accept address and portRichard Levitte
Fixes #14694 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15281)
2021-05-16ci: remove the checksum CI scriptPauli
This script introduces a security vulnerability where the OpenSSL github repository can be modified which opens a window for an attacker. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reported-by: Nikita Stupin
2021-05-15Add extensive test coverage for SSL_get_negotiated_group()Benjamin Kaduk
This is nearly comprehensive, but we cannot exercise the functionality for PSK-only TLS 1.3 resumption, since openssl talking to openssl will always negotiate psk_dhe_ke. Exercise both the TLS 1.3 and 1.2 cases, for initial handshakes and resumptions, and for ECDHE and FFDHE. Since RFC 7919 named groups (for FFDHE) are only supported for TLS 1.3, the TLS 1.2 versions of those scenarios expect to get NID_undef since the key exchange was not performed using a named group. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14750)
2021-05-15move group lists out of test_key_exchange() in preparation for reuseBenjamin Kaduk
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14750)
2021-05-15Extend SSL_get_negotiated_group() tests for TLS 1.2Benjamin Kaduk
We don't implement RFC 7919 named groups for TLS 1.2, so we can only test the ECDHE case for non-TLS-1.3. Interestingly, though the test_key_exchange() routine claimed to be exercising ffdhe2048 with TLS 1.2, the configured ciphers were incompatible with DHE key exchange, so we ended up just using RSA key transport and not doing an ephemeral key exchange at all. Reconfigure the tests to actually exercise ephemeral key exchange for both the EC and FF cases (even though we don't use the named group information for the finite-field case). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14750)
2021-05-15Regenerate testsid.pemBenjamin Kaduk
Convert this file to the new format, that includes the kex_group integer value. This is needed in order for the round-trip conversion test to return the same value as the initial input. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14750)
2021-05-15Promote SSL_get_negotiated_group() for non-TLSv1.3Benjamin Kaduk
It can be useful to know what group was used for the handshake's key exchange process even on non-TLS 1.3 connections. Allow this API, new in OpenSSL 3.0.0, to be used on other TLS versions as well. Since pre-TLS-1.3 key exchange occurs only on full handshakes, this necessitates adding a field to the SSL_SESSION object to carry the group information across resumptions. The key exchange group in the SSL_SESSION can also be relevant in TLS 1.3 when the resumption handshake uses the "psk_ke" key-exchange mode, so also track whether a fresh key exchange was done for TLS 1.3. Since the new field is optional in the ASN.1 sense, there is no need to increment SSL_SESSION_ASN1_VERSION (which incurs strong incompatibility churn). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14750)
2021-05-15ASN1: Fix i2d_provided() return valueRichard Levitte
i2d_provided() - which is the internal provider data function for i2d_KeyParams(), i2d_PrivateKey(), i2d_PublicKey() - didn't treat the returned length from OSSL_ENCODER_to_data() quite as well as it should have. A simple added flag that records the state of |*pp| before calling OSSL_ENCODER_to_data() fixes the problem. Fixes #14655 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/15277)
2021-05-15Load the default provider into the p_test provider laterMatt Caswell
Loading it earlier causes some of the later testing to pass when it should fail and masked a bug. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15270)
2021-05-15Init the child providers immediately on creation of the child libctxMatt Caswell
We were deferring the initial creation of the child providers until the first fetch. This is a carry over from an earlier iteration of the child lib ctx development and is no longer necessary. In fact we need to init the child providers immediately otherwise not all providers quite init correctly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15270)
2021-05-15Add make update-fips-checksums to release.sh scriptTomas Mraz
Fixes #15223 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15271)
2021-05-15doc: document all functions in provider-base(7)Pauli
Fixes #13358 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15259)
2021-05-15Fix a memleak on an error path in the pkcs12 test helpersMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15269)
2021-05-14Add OSSL_ prefix to HTTP_DEFAULT_MAX_{LINE_LENGTH,RESP_LEN}Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14http_client.c: Rename internal fields and functions for consistencyDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP client: Allow streaming of response data (with possibly indefinite length)Dr. David von Oheimb
Also clean up max_resp_len and add OSSL_HTTP_REQ_CTX_get_resp_len(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP client: Allow streaming of request data (for POST method)Dr. David von Oheimb
Also clean up OSSL_HTTP_REQ_CTX_nbio() states and make it more efficient. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP client API: Generalize to arbitrary request and response contentsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14OSSL_HTTP_transfer(): Fix error reporting in case rctx->server is NULLDr. David von Oheimb
Also improve doc of OSSL_parse_url() and OSSL_HTTP_parse_url(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14OSSL_HTTP_get(): Do not close connection if redirect to same serverDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-22 15:51:08 +0000