summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-05-15Add make update-fips-checksums to release.sh scriptTomas Mraz
Fixes #15223 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15271)
2021-05-15doc: document all functions in provider-base(7)Pauli
Fixes #13358 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15259)
2021-05-15Fix a memleak on an error path in the pkcs12 test helpersMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15269)
2021-05-14Add OSSL_ prefix to HTTP_DEFAULT_MAX_{LINE_LENGTH,RESP_LEN}Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14http_client.c: Rename internal fields and functions for consistencyDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP client: Allow streaming of response data (with possibly indefinite length)Dr. David von Oheimb
Also clean up max_resp_len and add OSSL_HTTP_REQ_CTX_get_resp_len(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP client: Allow streaming of request data (for POST method)Dr. David von Oheimb
Also clean up OSSL_HTTP_REQ_CTX_nbio() states and make it more efficient. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP client API: Generalize to arbitrary request and response contentsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14OSSL_HTTP_transfer(): Fix error reporting in case rctx->server is NULLDr. David von Oheimb
Also improve doc of OSSL_parse_url() and OSSL_HTTP_parse_url(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14OSSL_HTTP_get(): Do not close connection if redirect to same serverDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP: Implement persistent connections (keep-alive)Dr. David von Oheimb
Both at API and at CLI level (for the CMP app only, so far) there is a new parameter/option: keep_alive. * 0 means HTTP connections are not kept open after receiving a response, which is the default behavior for HTTP 1.0. * 1 means that persistent connections are requested. * 2 means that persistent connections are required, i.e., in case the server does not grant them an error occurs. For the CMP app the default value is 1, which means preferring to keep the connection open. For all other internal uses of the HTTP client (fetching an OCSP response, a cert, or a CRL) it does not matter because these operations just take one round trip. If the client application requested or required a persistent connection and this was granted by the server, it can keep the OSSL_HTTP_REQ_CTX * as long as it wants to send further requests and OSSL_HTTP_is_alive() returns nonzero, else it should call OSSL_HTTP_REQ_CTX_free() or OSSL_HTTP_close(). In case the client application keeps the OSSL_HTTP_REQ_CTX * but the connection then dies for any reason at the server side, it will notice this obtaining an I/O error when trying to send the next request. This requires extending the HTTP header parsing and rearranging the high-level HTTP client API. In particular: * Split the monolithic OSSL_HTTP_transfer() into OSSL_HTTP_open(), OSSL_HTTP_set_request(), a lean OSSL_HTTP_transfer(), and OSSL_HTTP_close(). * Split the timeout functionality accordingly and improve default behavior. * Extract part of OSSL_HTTP_REQ_CTX_new() to OSSL_HTTP_REQ_CTX_set_expected(). * Extend struct ossl_http_req_ctx_st accordingly. Use the new feature for the CMP client, which requires extending related transaction management of CMP client and test server. Update the documentation and extend the tests accordingly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14OSSL_HTTP_REQ_CTX_add1_headers(): Fix use with host == NULL (relative URLs)Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14CMP test server: Extend error reporting on cert rejected for revocationDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP test server: Improve connection management and loggingDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14cmp_server.c: Improve transaction management and loggingDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14OSSL_CMP_SRV_process_request(): Log any error queue entries on responseDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP client: Rename 'maxline' parameter to 'buf_size' for clarityDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14mac: improve MAC documentation (Poly 1305 key reuse, nomenclature)Pauli
Fixes #12441 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15237)
2021-05-14Slightly reformat ssl.h.inRich Salz
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15230)
2021-05-14Convert SSL_{CTX}_[gs]et_options to 64Rich Salz
Less tersely: converted SSL_get_options, SSL_set_options, SSL_CTX_get_options and SSL_CTX_get_options to take and return uint64_t since we were running out of 32 bits. Fixes: 15145 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15230)
2021-05-14Fix provider library build wrt. AESJuergen Christ
Commit c7978e506b2d1300accd9e696656f9cc94196e6d ("Fix missing $CPUIDDEF in libdefault.a") revealed another problem in the build system on s390. The build of the provider libraries includes the AES system without the proper defines. This causes a build error on s390 now since the CPUIDDEF is present but the prototypes for various AES functions implemented in assembler are missing due to missing preprocessor defines. Fix this by adding the missing defines to all provider libraries. Signed-off-by: Juergen Christ <jchrist@linux.ibm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15244)
2021-05-14Add --banner config optionRich Salz
Use it in the automated workflows. Fixes: #15247 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15248)
2021-05-14check i2d_ASN1_TYPE return valuebonniegong
add a length check to the return value of function i2d_ASN1_TYPE. Return an error instead of trying to malloc a negative number. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14828)
2021-05-13http_client.c: Fix inconsistency w.r.t. type of max_resp_lenDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15251)
2021-05-13Replace some of the ERR_clear_error() calls with mark callsTomas Mraz
Fixes #15219 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15253)
2021-05-14crypto/arm_arch.h: add a variable declarationXiaofei Bai
Add this variable declaration to prevent "-Werror,-Wmissing-variable-declarations" error from compiler. This error currently only happens on clang. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15240)
2021-05-14ARM assembly pack: translate bit-sliced AES implementation to AArch64Ben Avison
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14592)
2021-05-13doc: remove references to undepreciated commands being deprecated.Pauli
The dsa, ec, ecparam, and rsa manual pages refer to themselves are being deprecated which they aren't. Address this and add a note pointing to the pkey command equivalents albeit without recommending it. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15239)
2021-05-13Fallback to legacy pem decoding if OSSL_DECODER failsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15045)
2021-05-13Implement pem_read_key directly through OSSL_DECODERTomas Mraz
Using OSSL_STORE is too heavy and breaks things. There were also needed various fixes mainly for missing proper handling of the SM2 keys in the OSSL_DECODER. Fixes #14788 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15045)
2021-05-13Replace EVP_PKEY_supports_digest_nidTomas Mraz
The EVP_PKEY_supports_digest_nid() is renamed to EVP_PKEY_digestsign_supports_digest() and implemented via EVP_DigestSignInit_ex(). Fixes #14343 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15198)
2021-05-13Drop ASN1_PKEY_CTRL_SUPPORTS_MD_NIDTomas Mraz
This is a legacy ASN1_PKEY_CTRL that was added after 1.1.1 and is not needed. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15198)
2021-05-13update-fips-checksums: Make the dependency on source list workTomas Mraz
Also clean the generated checksums with make clean Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15267)
2021-05-13clarification about the DES statusDmitry Belyavskiy
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15197)
2021-05-13Enumerating the legacy provider's cipher algorithmsDmitry Belyavskiy
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15197)
2021-05-13Ensure the pristine checksums are not recomputedTomas Mraz
When switching between the pristine and PR checkouts we must ensure the pristine checksums are not recomputed. Also ignore errors (such as trying to remove a label that is not set) when setting or removing labels. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15266)
2021-05-13The FIPS Checksums job must be run on pull_request_targetTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15265)
2021-05-13Makefile: Make sure providers/fipsmodule.cnf is re-built also for run_testsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14901)
2021-05-13Makefile: Simplify use of run_testsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14901)
2021-05-13Remove the .new suffix inside the fips.checksum.newTomas Mraz
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15263)
2021-05-13Allow diff-fips-checksums in in-tree buildTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15229)
2021-05-13Remove the severity: fips change label if fips checksum unchangedTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15229)
2021-05-13Set the severity: fips change label if fips checksum changedTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15229)
2021-05-13fipsprov: Missing teardown on fips_get_params_from_core() errorTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15229)
2021-05-13Add checksums github CI actionTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15229)
2021-05-13Add diff-fips-checksums target to compare BLDDIR and SRCDIR checksumsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15229)
2021-05-13Compute the FIPS checksums in $(BLDDIR) and remove it from update targetTomas Mraz
Add also update-fips-checksums to update the checksums in the $(SRCDIR) if the $(SRCDIR) and $(BLDDIR) is different. The fips-checksums and generate_fips_sources targets are always produced (regardless of enable-fips) as nothing else depends on them and they are developer targets. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15229)
2021-05-13x509: fix a dangling pointerPauli
If object was pointer was passed and an error occured the object was freed & the pointer returned. Fix this to NULL out the caller's pointer before returning. Fixes #15115 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15238)
2021-05-13e_loader_attic: fix a use after free issuePauli
Fixes #15116 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15238)
2021-05-13test: fix thread test config file problemPauli
Force the thread test to use the configuration file via a command line arg. Use the test library support for libctx creation. Fixes #15243 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15256)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-07 08:34:43 +0000