summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-09-07Prepare for release of 3.0.0openssl-3.0.0Richard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-09-07make updateRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-09-07dev/release.sh: Adjust release branch names to votesRichard Levitte
The OTC voted today that the release branch for OpenSSL 3.0 should be openssl-3.0 rather than openssl-3.0.x. The release script is changed accordingly. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16481) (cherry picked from commit 8e706c8ae5d6abf69b1b0aa0c4ab3517607522d0)
2021-09-07Update copyright yearRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16534)
2021-09-07Last minute NEWS and CHANGES entries for the 3.0 releaseTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16533) (cherry picked from commit 95a444c9adcad04035704ab3b5d749a185ef0960)
2021-09-07Mention the concept of providers in NEWS.md and CHANGES.mdRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16528)
2021-09-07fix documentation error caused by commit ↵PW Hu
6882652e65d39310c98ba506ceb55a87c702d419 CLA:trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16502) (cherry picked from commit 6d55d27b2da7a84c9f4b872060be979b5f64af2c)
2021-09-07 fix documentation error caused by commit ↵PW Hu
9067cf6ccdce0a73922f06937e54c2fce2752038 CLA:trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16502) (cherry picked from commit 48b3ad05680ba3e3668bcb6491bf4447033464ed)
2021-09-07 imporve documentationPW Hu
CLA:trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16502) (cherry picked from commit b9f96f30eea550650a8d9f8000cea940c6ee8150)
2021-09-07Added a NEWS entry about the enhanced 'openssl list'Richard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16522)
2021-09-07Add missing OSSL_DECODER entry in NEWS.md and CHANGES.mdRichard Levitte
The text in CHANGES.md got fleshed out a bit more as well. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16522)
2021-09-07Correct the "Out of memory" EVP testsRichard Levitte
This affects test/recipes/30-test_evp_data/evpkdf_scrypt.txt and test/recipes/30-test_evp_data/evppkey_kdf_scrypt.txt, where the "Out of memory" stanza weren't up to the task, as they didn't hit the default scrypt memory limit like they did in OpenSSL 1.1.1. We solve this by setting the |n| value to the next power of two, and correcting the expected result. Fixes #16519 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16521)
2021-09-06Fix a few tests that fail on VMSRichard Levitte
In one spot, files aren't properly closed, so the sub-process program that's supposed to read them can't, because it's locked out. In another spot, srctop_file() was used where srctop_dir() should be used to properly format a directory specification. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16518)
2021-09-06Configuration: support building for OpenVMS for x86_64Richard Levitte
OpenVMS for x86_64 is currently out on a field test. Building programs for it is currently done with cross compilation on Itanium. The cross compilation tools are made available by running a script, which makes cross-compilation variants of most commands available, and adds the cross-compilation C compiler XCC. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16498) (cherry picked from commit 6929c8fb5b46c9c2a383a7c212ee052e0dcef021)
2021-09-05test/recipes/25-test_verify.t: Add a couple of tests of mixed PEM filesRichard Levitte
Fixes #16224 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466) (cherry picked from commit d4458e59f62b0d102069e53da41f1d5305a66912)
2021-09-05ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo outputRichard Levitte
Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466) (cherry picked from commit 0195cdd28fde7d0897e368fdcd4e92509425faad)
2021-09-05Adjust test/endecoder_test.cRichard Levitte
The protected tests need to specify the structure EncryptedPrivateKeyInfo rather than PrivateKeyInfo, since that's the outermost structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466) (cherry picked from commit 602bfb8b98125f6745cd40dbc5fce9614ae5e418)
2021-09-05OSSL_STORE 'file:' scheme: Set input structure for certificates and CRLsRichard Levitte
When the user expects to load a certificate or a CRL through the OSSL_STORE loading function, the 'file:' implementation sets the corresponding structure names in the internal decoder context. This is especially geared for PEM files, which often contain a mix of objects, and password prompting should be avoided for objects that need them, but aren't what the caller is looking for. Fixes #16224 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466) (cherry picked from commit 821b3956ec698927281a5b29c55cd87eb7b2793d)
2021-09-05PEM to DER decoder: Specify object type and data structure more consistentlyRichard Levitte
The data structure wasn't given for recognised certificates or CRLs. It's better, though, to specify it for those objects as well, so they can be used to filter what actually gets decoded, which will be helpful for our OSSL_STORE 'file:' scheme implementation. Fixes #16224 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466) (cherry picked from commit 98408852c167d895a662dcda824fd5170cad3f7d)
2021-09-05DECODER: check the first decoded structure name against user given structureRichard Levitte
In a chain of decoders, the first that specifies an input structure gets it compared with the structure specified by the user, if there is one. If they aren't the same, that decoder is skipped. Because the first structure can appear anywhere along a chain of decoders, not just the decoders associated with the resulting OpenSSL type, the code that checked the structure name when building up the chain of decoders is removed. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466) (cherry picked from commit 73dd5d67c506cfeb9bf6183f0c19832c7d3f174d)
2021-09-03Add KEM dupctx testslontis
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16495) (cherry picked from commit d7b5f06ede163851d39f5a8b507bd0670deeaa21)
2021-09-03Fix dh dupctx refcount errorslontis
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16495) (cherry picked from commit 21a0d9f3edda78d27d12cd7704de9e32976393ba)
2021-09-03Fix double free in EVP_PKEY_CTX_dup()slontis
If the internal operations dupctx() fails then a free is done (e.g. EVP_KEYEXCH_free()). If this is not set to NULL the EVP_PKEY_CTX_free() will do a double free. This was found by testing kdf_dupctx() in kdf_exch.c (Note this always fails since the internal KDF's do not have a dup method). Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16495) (cherry picked from commit 85407b77543a2d4330dbb40f6b8520ea0894a716)
2021-09-03EVP_PKEY_gettable_params.pod: Update argument namesPW Hu
CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16494) (cherry picked from commit 6f2f59944826b5b7e033af438f5831493d0362c9)
2021-09-03VMS: Compensate for x86_64 cross compiler type incompatibilityRichard Levitte
The x86_64 cross compiler says that 'unsigned long long' isn't the same as 'unsigned __int64'. Sure, and considering that providers/implementations/rands/seeding/rand_vms.c is specific VMS only code, it's easy to just change the type to the exact same as what's specified in the system headers. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16497)
2021-09-03Fix indentation of tls13_hkdf_expand parametersDaniel Bevenius
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16489) (cherry picked from commit 1b9e467887d7852d79270c73cb88383c50460b0a)
2021-09-02CI: add last run-checker fuzzing CIs to ActionsPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16438) (cherry picked from commit f92bfddc1d4c4957c57337d7f4192c586cc09a5c)
2021-09-02always use the same perl in $PATHa1346054
Different tests may use unexpectedly different versions of perl, depending on whether they hardcode the path to the perl executable or if they resolve the path from the environment. This fixes it so that the same perl is always used. Fix some trailing whitespace and spelling mistakes as well. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16362) (cherry picked from commit 473664aafdff1f60db99929bdd43c2a9b26d14cd)
2021-09-02Openssl fails to compile on Debian with kfreebsd kernelsMattias Ellert
(kfreebsd-amd64, kfreebsd-i386). The error reported by the compiler is: ../crypto/uid.c: In function 'OPENSSL_issetugid': ../crypto/uid.c:50:22: error: 'AT_SECURE' undeclared (first use in this function) 50 | return getauxval(AT_SECURE) != 0; | ^~~~~~~~~ This commit changes the code to use the freebsd code in this case. This fixes the compilation. CLA: trivial Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16477) (cherry picked from commit 3a1fa0116a92235ba200228e4bb60d6a3a7f4113)
2021-08-31Add a test for verifying an email with a bad othername typeMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16443)
2021-08-31Ensure that we check the ASN.1 type of an "otherName" before using itMatt Caswell
We should not assume that the type of an ASN.1 value is UTF8String as expected. We must actually check it, otherwise we could get a NULL ptr deref, or worse memory errors. Reported by David Benjamin. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16443)
2021-08-31Add the self test type OSSL_SELF_TEST_TYPE_PCT_SIGNATUREslontis
Fixes #16457 The ECDSA and DSA signature tests use Pairwise tests instead of KATS. Note there is a seperate type used by the keygen for conditional Pairwise Tests. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16461)
2021-08-31Add a warning about locking in the child provider callback docsMatt Caswell
The child provider callbacks can hold the store lock. In order to avoid deadlocks we require that the callback implementations don't themselves call functions that may aquire those locks. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16469)
2021-08-31Add additional test to thread sanitizer buildPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16469)
2021-08-31Refactor provider_core.c to adhere to the locking rulesMatt Caswell
The previous commit provided some guidelines and some rules for using locking in order to avoid deadlocks. This commit refactors the code in order to adhere to those guidelines and rules. Fixes #16312 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16469)
2021-08-31Add commentary about lock usage in provider_core.cMatt Caswell
Provide some guidelines, as well as some rules for using the locks in provider_core.c, in order to avoid the introduction of deadlocks. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16469)
2021-08-31CI: add builds covering a number of different compiler versionsPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16463)
2021-08-31apps/pkcs12: Do not assume null termination of ASN1_UTF8STRINGTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/16433)
2021-08-31ci: Add -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to asan buildTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/16433)
2021-08-31Make the -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION pass testsTomas Mraz
Fixes #16428 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/16433)
2021-08-31Document that EVP_get_cipherbyname() does not work for some new algorithm names.slontis
These algorithms were added to providers but have no const EVP_CIPHER* mapping. Ciphers for SIV and CTS were previously only available via low level function calls that are deprecated. Reported by @reaperhulk. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16414)
2021-08-30Typo correction.Jaime Hablutzel
CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16470)
2021-08-30Use applink to fix windows testsNicola Tuveri
(readapted from 5c69c66a6972f84d56160c9ea4b30bab8fc2d3d4 by @bernd-edlinger) Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16355)
2021-08-30[ec] Do not default to OPENSSL_EC_NAMED_CURVE for curves without OIDNicola Tuveri
Some curves don't have an associated OID: for those we should not default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`. This is a follow-up to https://github.com/openssl/openssl/pull/12312 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16355)
2021-08-30Fix d2i_ECPKParameters_fp and i2d_ECPKParameters_fp macrosNicola Tuveri
These functions are part of the public API but we don't have tests covering their usage. They are actually implemented as macros and the absence of tests has caused them to fall out-of-sync with the latest changes to ASN1 related functions and cause compilation warnings. This commit fixes the public headers to reflect these changes. Fixes #12443 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16355)
2021-08-30Add tests for i2d_TYPE_fp and d2i_TYPE_fpNicola Tuveri
These functions are part of the public API but we don't have tests covering their usage. They are actually implemented as macros and the absence of tests has caused them to fall out-of-sync with the latest changes to ASN1 related functions and cause compilation warnings. @@ Note: This commit limits to ECPKParameters as a type. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16355)
2021-08-29Ensure that _GNU_SOURCE is defined for bss_dgram.cDaniel Krügler
This fixes the following error with gcc10 under strict ANSI conditions: .../crypto/bio/bss_dgram.c:373:20: error: 'const struct in6_addr' has no member named 's6_addr32' CLA: trivial Fixes #16449 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16451)
2021-08-28Adjust the list of default provider's algorithmsDmitry Belyavskiy
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16448)
2021-08-28Fix the "Out of memory" EVP KDF scrypt testBernd Edlinger
This test did not really execute, since usually the OPENSSL_malloc(0) will fail and prevent the execution of the KDF. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16444)
2021-08-28Yet another doc-nits fixRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16436)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-05 19:11:41 +0000