summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-03-05CI: add job with external testsTomas Mraz
Update gost-engine submodule. Update pyca-cryptography submodule. Fix condition for skipping krb5 test. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14416)
2021-03-04DOCS: Document OSSL_STORE_INFO_PUBKEY in doc/man3/OSSL_STORE_INFO.podRichard Levitte
Fixes #14414 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14415)
2021-03-04Make provider provider_init thread safe, and flag checking/setting tooRichard Levitte
provider_init() makes changes in the provider structure, and needs a bit of protection to ensure that doesn't happen concurrently with race conditions. This also demands a bit of protection of the flags, since they are bits and presumably occupy the same byte in memory. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14354)
2021-03-04Make ossl_provider_disable_fallback_loading() thread safeRichard Levitte
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14354)
2021-03-04test/threadstest.c: Add a test to load providers concurrentlyRichard Levitte
If we don't synchronize properly in the core provider code, and build with a thread sanitizer, this should cause a crash. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14354)
2021-03-04ecx_set_priv_key: Try to obtain libctx from the pkey's keymgmtTomas Mraz
We can try to do that although for legacy keys the keymgmt will not be set. This function will disappear with legacy support removed. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14404)
2021-03-04bn_ctx.c: Remove TODO 3.0 related to tracing in FIPS moduleTomas Mraz
We do not want tracing in the FIPS module. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14404)
2021-03-04ecx_set_priv_key: Remove TODO 3.0 related to setting libctxTomas Mraz
This function is used only for legacy keys so the TODO is not relevant. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14404)
2021-03-04do_sigver_init: Remove fallback for missing provider implementations.Tomas Mraz
We now have everything implemented in providers. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14404)
2021-03-04Remove some of the TODO 3.0 in crypto/evp related to legacy support.Tomas Mraz
The legacy support stays in 3.0. The TODOs are dropped. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14404)
2021-03-04crypto/param_build_set.c: Remove irrelevant TODO 3.0Tomas Mraz
The OSSL_PARAM_set_BN() pads to data_size so there is no need for OSSL_PARAM_set_BN_pad(). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14404)
2021-03-04crypto/ppccap.c: Remove useless TODO 3.0Tomas Mraz
The chacha and poly1305 algorithms are not FIPS approved so they should stay out of FIPS module. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14404)
2021-03-04include/crypto: Remove TODOs that are irrelevant for 3.0Tomas Mraz
The legacy support will not be removed in 3.0. Remove the related TODO 3.0 marks. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14404)
2021-03-04include/internal: Remove TODOs that are irrelevant for 3.0Tomas Mraz
The sha3 and sm3 legacy support requires these headers. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14404)
2021-03-04test/x509: Test for issuer being overwritten when printing.Tomas Mraz
The regression from commit 05458fd was fixed, but there is no test for that regression. This adds it simply by having a certificate that we compare for -text output having a different subject and issuer. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14353)
2021-03-04OSSL_STORE: restore diagnostics on decrypt error; provide password hintsDr. David von Oheimb
Fixes #13493 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13525)
2021-03-04crypto: rename error flags in internal structuresTobias Nießen
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14405)
2021-03-03Add a new test recipe to verify the generated test fipsmodule.cnfRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14320)
2021-03-03Fix the perl code to get FIPSMODULENAMERichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14320)
2021-03-03TEST: Remove the build of fipsmodule.cnf from test recipesRichard Levitte
The exception is the test recipe that tests 'openssl fipsinstall'. However, that one uses a different output file name, so it's safe. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14320)
2021-03-03APPS: Modify 'fipsinstall' to output all notifications on stderrRichard Levitte
The actual output of the 'fipsinstall' is the config file it outputs. It should be possible to output that to standard output, and diverse notification messages shouldn't be mixed in. Therefore, we output them to standard error instead. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14320)
2021-03-03Make 'tests' depend on a generated 'providers/fipsmodule.cnf'Richard Levitte
providers/fipsmodule.cnf is generated using 'openssl fipsinstall' with the openssl program in the build directory. Fixes #14315 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14320)
2021-03-03build.info: Make it possible to use compiled programs as generatorsRichard Levitte
Our goal is to be able to produce fipsmodule.cnf with the help of 'openssl fipsinstall', using the openssl program that we build. This refactors the generatesrc code in all the build file templates to replace $generator and $generator_incs with $gen0, $gen_args and $gen_incs, which makes it easier and more consistent to manipulate different bits of the generator command, and also keeps the variable names consistent while not overly long. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14320)
2021-03-03build.info: Add the possibility to add dependencies on raw targetsRichard Levitte
We need to add something for the 'tests' target to depend on, so a special syntax for those is introduced: DEPEND[|tests|]=fipsmodule.cnf Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14320)
2021-03-03DOCS: Fix provider-mac.pod and the docs of our implementationsRichard Levitte
The idea being that doc/man7/provider-mac.pod is for provider authors, while provider users find the documentation for each implementation in doc/man7/EVP_MAC-*.pod, the documentation of parameters wasn't quite aligned. This change re-arranges the parameter documentation to be more aligned with this idea. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14380)
2021-03-03doc: add a note to the RAND_get0_ calls indicating how to set the DRBG type.Pauli
The type needs to be set before the DRBGs are created. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14386)
2021-03-03ossl_rsa_sp800_56b_check_public: Be more lenient with small keysTomas Mraz
Fixes #13995 For small keys the MR test on the modulus can return BN_PRIMETEST_COMPOSITE_WITH_FACTOR status although the modulus is correct. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14389)
2021-03-03rand: remove FIPS mode conditional code.Pauli
The FIPS provider no longer has seeding sources inside the boundary, the related conditional code can therefore be removed. Fixes #14358 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14382)
2021-03-03EVP_PKEY_CTX_get/settable_params: pass provider operation contextTomas Mraz
This allows making the signature operations return different settable params when the context is initialized with EVP_DigestSign/VerifyInit. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14338)
2021-03-03Fix NULL access in ssl_build_cert_chain() when ctx is NULL.Shane Lontis
Fixes #14294 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14295)
2021-03-03Remove todos in decode_der2key.c and decode_ms2key.cTomas Mraz
Those TODOs do not really apply to 3.0 as the legacy internal keys will stay. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14367)
2021-03-03Improve error reporting in key exchange provider implementationsTomas Mraz
Added some error reporting in dh_exch.c and unified error reporting with it in other key exchange methods. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14367)
2021-03-03Remove unused MAX_TLS_MAC_SIZE defineTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14367)
2021-03-03Remove todos in providers/implementations/include/provTomas Mraz
Those TODOs are not relevant anymore as the headers are now in providers. Also make the header guard defines better reflect the header placement. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14367)
2021-03-03Resolve TODOs in signature implementations.Tomas Mraz
The DER writing errors can be ignored safely. Document that the EVP_MAX_MD_SIZE is a hardcoded limit for digest sizes. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14367)
2021-03-03statem_lib.c: Remove TODOs that are unnecessaryTomas Mraz
If the EVP_MD_CTX_ctrl is deprecated the code will generate deprecation warnings. So there is no point in marking all EVP_MD_CTX_ctrl() calls with TODOs. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14367)
2021-03-03test_ssl_new: X448, X25519, and EdDSA are supported with fipsTomas Mraz
Removed the related TODOs. Also adjusted the DH parameters used for the DH test to be acceptable for FIPS as that now allows only known safe prime parameters. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14367)
2021-03-03evp_extra_test2: Remove TODO 3.0Tomas Mraz
The TODO marks optional cleanup that can be done any time in future. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14367)
2021-03-03evp_extra_test: Remove TODO comment as setting the curve is mandatoryTomas Mraz
Even with the SM2 algorithm the curve is needed for the paramgen. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14367)
2021-03-02Fix a copy&paste error in evp_extra_testMatt Caswell
test_EC_priv_pub fails to test the case where both a private and public key have been supplied. Fixes #14349 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14351)
2021-03-02Fix compiling error on armFangming.Fang
Fixes #14313 Change-Id: I0dc9dd475a1ed1331738355fbbec0c51fbcb37f1 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14346)
2021-03-02openssl-cmp.pod.in: replace the term 'verify' by the more correct 'validate'Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14018)
2021-03-02CMP: On NULL-DN subject or issuer input omit field in cert templateDr. David von Oheimb
Also improve diagnostics on inconsistent cert request input in apps/cmp.c, add trace output for transactionIDs on new sessions, and update the documentation in openssl-cmp.pod.in. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14018)
2021-03-02test: use the new set public and private together callPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14341)
2021-03-02test: add utility function to set the fake random callback on both the ↵Pauli
public and private instances Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14341)
2021-03-02test: update ECDSA and SM2 internal tests in line with the fake_random changePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14341)
2021-03-02test: update test_random to create real contexts instead of sharing onePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14341)
2021-03-01make updateRichard Levitte
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14352)
2021-03-01Fix build of /dev/crypto engine with no-dynamic-engine optionUndefBehavior
CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14329)
2021-03-01Remove RSA SSLv23 padding modeRich Salz
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14248)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-13 01:11:14 +0000