summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2018-04-02Use the private RNG for data that is not publicKurt Roeckx
Reviewed-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Fixes: #4641 GH: #4665
2018-04-02Documentation typo fix in EVP_EncryptInit.podAlexandre Perrin
Remove duplicate declaration of `EVP_CIPHER_key_length` in the synopsis. CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5792)
2018-04-02fix typo in x509 documentationIllya Gerasymchuk
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5829)
2018-04-01Remove import/use of File::Spec::FunctionDaniel Bevenius
It looks like the usage of these functions were removed in in commit 0a4edb931b883b9973721ae012e60c028387dd50 ("Unified - adapt the generation of cpuid, uplink and buildinf to use GENERATE"). This commit removes the import/use of File::Spec::Functions module as it is no longer needed by crypto/build.info. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5832)
2018-04-01Windows builds: remove over-quotation of LIBZ macroRichard Levitte
The LIBZ macro definition was already quoted in BASE_windows, then got quotified once more in windows-makefile.tmpl. That's a bit too much quotations, ending up with the compiler being asked to define the macro |"LIBZ=\"ZLIB1\""| (no, not the macro LIBZ with the value "ZLIB1"). This is solved by removing the extra quoting in BASE_windows. Along with this, change the quotation of macro definitions and include file specification, so we end up with things like -I"QuotedPath" and -D"Macro=\"some weird value\"" rather than "-IQuotedPath" and "-DMacro=\"some weird value\"". Fixes #5827 Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5833)
2018-04-01Make sure we use a nonce when a nonce is requiredKurt Roeckx
If a nonce is required and the get_nonce callback is NULL, request 50% more entropy following NIST SP800-90Ar1 section 9.1. Reviewed-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> GH: #5503
2018-04-01Update documentation on how to close a connectionKurt Roeckx
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> GH: #5823
2018-03-31Fix minor typo in comment in ConfigureDaniel Bevenius
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5825)
2018-03-31Remove -Wmisleading-indentation from gcc devteam warning optionsBernd Edlinger
because this one is enabled by default anyways Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5817)
2018-03-31Fix a gcc-8 warning -Wcast-function-typeBernd Edlinger
Casting to the generic function type "void (*)(void)" prevents the warning. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/5816)
2018-03-31Refuse to run test_cipherlist unless shared library matches buildRichard Levitte
test/cipherlist_test.c is an internal consistency check, and therefore requires that the shared library it runs against matches what it was built for. test/recipes/test_cipherlist.t is made to refuse running unless library version and build version match. This adds a helper program test/versions.c, that simply displays the library and the build version. Partially fixes #5751 Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5753) (cherry picked from commit cde87deafa7486f26bdf954867a6d72ca4ea06e7)
2018-03-31Fix a possible crash in BN_from_montgomery_wordBernd Edlinger
Thanks to Darovskikh Andrei for for reporting this issue. Fixes: #5785 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5793)
2018-03-30Revert commit 4a56d9a2Matt Caswell
We have been unable to trace the contributor of that code to gain their agreement for the licence change so the code has to be removed. This commit reverts that contribution. The contribution had no functional impact so the original way of doing things is still valid. However the surrounding code has changed significantly so that the exact code as it was orignally cannot be used. This commit uses the original code as a basis, but rewrites it to use the PACKET API. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5808)
2018-03-30GOST MAC algorithms don't support EVP_PKEY_new_raw_private_key()Matt Caswell
We should use the old EVP_PKEY_new_mac_key() instead. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5808)
2018-03-30Update trace code to know about GOST ciphersuitesMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5808)
2018-03-30Remove some codeRich Salz
This commit removes the contribution of a user that we cannot trace to gain their consent for the licence change. I also cleaned up the return/error-return flow a bit. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5811)
2018-03-30Add documentation for the RAND_DRBG APIDr. Matthias St. Pierre
The RAND_DRBG API was added in PR #5462 and modified by PR #5547. This commit adds the corresponding documention. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5461)
2018-03-29EVP,KDF: Add more error code along some return 0 in ...FdaSilvaYY
methods : - EVP_PBE_scrypt - EVP_PKEY_meth_add0 - EVP_PKEY_meth_new - EVP_PKEY_CTX_dup Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5783)
2018-03-29BIO_s_accept.pod: add documentation for the new macrosVitezslav Cizek
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/5007)
2018-03-29Document BIO_{get,set}_conn_ip_family macros.Vitezslav Cizek
Add BIO_get_conn_ip_family and BIO_set_conn_ip_family macros to util/private.num and document them in BIO_s_connect.pod. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/5007)
2018-03-29Update the BIO_s_connect documentation after the BIO refactoring.Vitezslav Cizek
The BIO was refactored in 417be660e1cd21a2ee085569ff98b0c4249b5416, but the manual wasn't fully updated to reflect some of the changes. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/5007)
2018-03-29Document RAND_DRBG fork-safety locking modelBenjamin Kaduk
Add some more exposition on why unlocked access to the global rand_fork_count is safe, and provide a comment for the struct rand_drbg_st fork_count field. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/4110)
2018-03-29Configurations/10-main.conf: fix VC-noCE-common template.Andy Polyakov
picker() is type agnostic, but its output consumer is not. Or rather it doesn't work if picker() picks nothing when consumer expects array. So ensure array is returned when array is expected. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5770)
2018-03-29Configure: harmonize syntax.Andy Polyakov
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5770)
2018-03-29Fix setbuf use for VMS CRichard Levitte
The VMS C RTL has setbuf() working for short pointers only, probably the FILE pointer will always be in P0 (the lower 4GB). Fortunately, this only generates a warning about possible data loss (doesn't apply in this case) that we can simply turn off. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5789)
2018-03-29.travis.yml: with fast fuzz testing, there is no point avoiding itRichard Levitte
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5776)
2018-03-29Faster fuzz test: teach the fuzz test programs to handle directoriesRichard Levitte
Instead of invoking the fuzz test programs once for every corpora file, we invoke them once for each directory of corpora files. This dramatically reduces the number of program invikations, as well as the time 99-test_fuzz.t takes to complete. fuzz/test-corpus.c was enhanced to handle directories as well as regular files. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5776)
2018-03-29Revert "util/dofile.pl: only quote stuff that actually needs quoting"Richard Levitte
This wasn't a good solution, too many things depend on the quotes being there consistently. This reverts commit 49cd47eaababc8c57871b929080fc1357e2ad7b8. Fixes #5772 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5773)
2018-03-28crypto/e_aes.c: use S390X_AES_FC macroPatrick Steuer
... to compute s390x aes function code from keylength. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5250)
2018-03-28crypto/evp/e_aes.c: add size_t casts to increase readabilityPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5250)
2018-03-28s390x assembly pack: add KMF code path for aes-cfb/cfb8Patrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5250)
2018-03-28s390x assembly pack: add KMO code path for aes-ofbPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5250)
2018-03-28s390x assembly pack: add KM code path for aes-ecbPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5250)
2018-03-28Rewrite the X509->alert mapping codeRich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5780)
2018-03-28Remove some codeMatt Caswell
This commit removes the contribution of a user that we cannot trace to gain their consent for the licence change. After this commit the various IS_*() macros in the auto-generated file conf_def.h may incorrectly return true if the supplied character has its most significant bit set. The IS_*() macros should be able to correctly handle 8-bit characters. Note that UTF-8 support is not a requirement. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5767)
2018-03-28Tolerate a Certificate using a non-supported group on server sideMatt Caswell
If a server has been configured to use an ECDSA certificate, we should allow it regardless of whether the server's own supported groups list includes the certificate's group. Fixes #2033 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5601)
2018-03-28Revert "Temporarily disable some tests that hang"Matt Caswell
This reverts commit 37a385956461ab526ecea2739a8a40364a8db259. These tests should now be fixed by commit e6e9170d6. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/5765)
2018-03-27Allow NULL for some _free routines.Rich Salz
Based on the description in https://github.com/openssl/openssl/pull/5757, this re-implements the "allow NULL to be passed" behavior of a number of xxx_free routines. I also fixed up some egregious formatting errors that were nearby. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5761)
2018-03-27o_time.c: use gmtime_s with MSVCMiroslav Suk
ts/ts_rsp_sign.c: change to OPENSSL_gmtime. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5720)
2018-03-27doc/man1/x509.pod: corrected "S/MIME signing" requirementsKonstantin Shemyak
When the "certificate purpose" is checked and KeyUsage extension is present, either 'digitalSignature' or 'nonRepudiation' is accepted. Manual page corrected to reflect the above. Signed-off-by: Konstantin Shemyak <konstantin@shemyak.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5727)
2018-03-27statem/statem_clnt.c: omit redundant check in tls_construct_client_hello.Philippe Antoine
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5729)
2018-03-27rand/randfile.c: permit non-regular files in RAND_load_file.Andy Polyakov
Apparently applications rely on RAND_load_file's ability to work with non-regular files, customarily with /dev/urandom, so that the ban was not exactly appropriate. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5737)
2018-03-27Configure: make LIST command work with dynamic 15-android.conf.Andy Polyakov
This is quick-n-dirty ad-hoc solution, the problem asks for more elegant one... Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5755)
2018-03-27Temporarily disable some tests that hangMatt Caswell
The previous commit causes some tests to hang so we temporarily disable them. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5757)
2018-03-27Remove some code for a contributor that we cannot findMatt Caswell
This removes some code because we cannot trace the original contributor to get their agreement for the licence change (original commit e03ddfae). After this change there will be numerous failures in the test cases until someone rewrites the missing code. All *_free functions should accept a NULL parameter. After this change the following *_free functions will fail if a NULL parameter is passed: BIO_ACCEPT_free() BIO_CONNECT_free() BN_BLINDING_free() BN_CTX_free() BN_MONT_CTX_free() BN_RECP_CTX_free() BUF_MEM_free() COMP_CTX_free() ERR_STATE_free() TXT_DB_free() X509_STORE_free() ssl3_free() ssl_cert_free() SSL_SESSION_free() SSL_free() [skip ci] Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5757)
2018-03-27Assert that alpn_selected is NULL before we assign itMatt Caswell
The alpn_selected value in the session should be NULL before we first populate it if this is a new session. We assert to make sure it is. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5715)
2018-03-27Don't write out a bad OIDMatt Caswell
If we don't have OID data for an object then we should fail if we are asked to encode the ASN.1 for that OID. Fixes #5723 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5725)
2018-03-27Update CHANGES and NEWS for the new releaseMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2018-03-27test/test_test.c: add CRYPTO_memcmp regression test.Andy Polyakov
Reviewed-by: Matt Caswell <matt@openssl.org>
2018-03-27pariscid.pl: fix nasty typo in CRYPTO_memcmp.Andy Polyakov
Comparison was effectively reduced to least significant bits. CVE-2018-0733 Reviewed-by: Matt Caswell <matt@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-27 19:10:23 +0000