summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2019-11-12Add a tester of OpenSSL config files and test the current .pragmaRichard Levitte
test/confdump.c reads an OpenSSL config file and prints out the processed result. This can be used to check that a config file is processed correctly. We add a test recipe and the necessary data to test the dollarid pragma. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8882)
2019-11-12Add a .pragma directive for configuration filesRichard Levitte
Currently added pragma: .pragma dollarid:on This allows dollar signs to be a keyword character unless it's followed by a opening brace or parenthesis. Fixes #8207 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8882)
2019-11-12Make sure KDF reason codes are conserved in their current stateRichard Levitte
Because KDF errors are deprecated and only conserved for backward compatibilty, we must make sure that they remain untouched. A simple way to signal that is by modifying crypto/err/openssl.ec and replace the main header file (include/openssl/kdf.h in this case) with 'NONE', while retaining the error table file (crypto/kdf/kdf_err.c). util/mkerr.pl is modified to silently ignore anything surrounding a conserved lib when such a .ec line is found. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10368)
2019-11-12Deprecate ERR_load_KDF_strings()Richard Levitte
Not only deprecate, but also remove the reason strings and make ERR_load_KDF_strings() do nothing. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10368)
2019-11-12util/perl/OpenSSL/ParseC.pm: Fix 'extern "C" DEPRECATEDIN_x_y(...)'Richard Levitte
The parser expected an 'extern "C"' followed by a single declaration to always end with a semicolon. Then came along something like this: extern "C" DEPRECATEDIN_3_0(int ERR_load_KDF_strings(void)) This change adjusts the detector of 'extern "C"' to also take in accound a declaration that ends with a parenthesis. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10368)
2019-11-12Reinstate the KDF error macrosRichard Levitte
For minimum breakage with existing applications that might use them. This reverts commit fe6ec26b204a056aee2a24b79df09a45b2308603 and 37ed62107112d95f7b7c9bf75602a6ac40883a89. Fixes #10340 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10368)
2019-11-11Fix cut'n'paste typos in the provider-digest podDmitry Belyavskiy
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10398)
2019-11-11Fix misspelled resumption_label for CHARSET_EBCDICIdo Ben-Natan
The resumption_label variable when CHARSET_EBCDIC was enabled, was misspelled. Instead of evaluating to 'res binder' as expected, it evaluated to 'red binder'. CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10396)
2019-11-11Fix no-dsaMatt Caswell
Make sure we don't try and load a DSA key in the tests if DSA has been disabled. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10375)
2019-11-11Add rc4_hmac_md5 cipher to default providerShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10179)
2019-11-10Fix L<xxx(1)> links to be L<openssl-xxx(1)>Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10328)
2019-11-10Workaround for Windows-based GOST implementationsDmitry Belyavskiy
Many Windows-based GOST TLS implementations are unable to extend the list of supported SignatureAlgorithms because of lack of the necessary callback in Windows. So for TLS 1.2 it makes sense to imply the support of GOST algorithms in case when the GOST ciphersuites are present. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10377)
2019-11-10Rename providers/common/provlib.c to nid_to_name.cRichard Levitte
It contains only one function, which should only get added to non-FIPS providers. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10389)
2019-11-10Final cleanup after move to leaner EVP_PKEY methodsRichard Levitte
Now that KEYMGMT method pointers have moved away from the diverse methods that are used with EVP_PKEY_CTX, we no longer need to pass special argument to evp_generic_fetch() and evp_generic_do_all(). Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10309)
2019-11-10Configuration: make Solaris builds with gcc recognise GNU ldRichard Levitte
The solaris config targets assumed that GNU cc used Sun ld at all times. However, there are setups where GNU ld is used instead, so we adapt the Solaris gcc config targets to use the mechanism introduced with Configurations/shared_info.pl to try to detect what ld flavor is being used and set the diverse ld flags accordingly. Fixes #8547 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8548)
2019-11-10bss_dgram.c: fix unaligned accessPatrick Steuer
char (alignment 1) casted to union sctp_notification (alignment > 1). Fixes: #9538 Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10336)
2019-11-09RSA generation: Use more bits of 1/sqrt(2)Kurt Roeckx
The old version always sets the top 2 bits, so the most significate byte of the primes was always >= 0xC0. We now use 256 bits to represent 1/sqrt(2) = 0x0.B504F333F9DE64845... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #10246
2019-11-09Fix a -Warray-bounds gcc warning in OPENSSL_DIR_readBernd Edlinger
'__builtin_strncpy' offset [275, 4095] from the object at 'direntry' is out of the bounds of referenced subobject 'd_name' with type 'char[256]' at offset 19 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10343)
2019-11-09conf_def.c: Avoid calling strlen() in a loopraniervf
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10361)
2019-11-08Cleanup include/openssl/opensslv.h.inRichard Levitte
Now that we generate include/openssl/opensslv.h, there's no point keeping some macross around, we can just set a simpler set to their respective value and be done with it. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10218)
2019-11-08Add ssl_ctx_test to test suite.Rich Salz
Also fix the test as min version > max version is allowed because the API calls to set min and max versions are separate and there can be legitimately a temporary situation when the condition is true even with correctly working application. The failure in this condition will be detected only during a handshake attempt. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10337)
2019-11-08Add AES SIV ciphers to default providerShane Lontis
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10120)
2019-11-07Refactor PEM_read_bio_{PrivateKey,Parameters,DHparams}Richard Levitte
They now go through internal STORE routines to do their job. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2746)
2019-11-08Add "sections" to -help outputRich Salz
Remove "Valid options" label, since all commands have sections (and [almost] always the first one is "General options"). Have "list --options" ignore section headers Reformat ts's additional help Add output section Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9953)
2019-11-07Add a test for EVP_PKEY_keymake() and EVP_PKEY_make()Richard Levitte
This test is a bit lame, but will either be completed as functionality is added in the default provider, or the new functions may start getting used in evp_test.c and this program will disappear. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10187)
2019-11-07Add EVP functionality to create domain params and keys by user dataRichard Levitte
This is the EVP operation that corresponds to creating direct RSA, DH and DSA keys and set their numbers, to then assign them to an EVP_PKEY, but done entirely using an algorithm agnostic EVP interface. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10187)
2019-11-07Update INSTALL to document the changed '--api' and 'no-deprecated'Richard Levitte
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-07include/openssl/asn1.h: Remove version dependent inclusion of <openssl/bn.h>Richard Levitte
It's unclear if this dependency was because ASN1 functions that use BIGNUM didn't exist before 1.1.0, or if it was a mistaken attempt at deprecation. Since there exist ASN1 functions using BIGNUM now, it seems pointless to keep that check, and unnecessarily including <openssl/bn.h> should be harmless either way. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-07Update the check surround the BN_zero() implementationRichard Levitte
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-07Update some inclusions of <openssl/macros.h>Richard Levitte
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-07include/openssl/opensslconf.h.in: remove spurious HEADER_FILE_H definitionRichard Levitte
This macro was never defined in existing releases, there's no reason for us to create a macro that we immediately deprecate. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-07Update source files for pre-3.0 deprecationRichard Levitte
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-07Update source files for deprecation at 3.0Richard Levitte
Previous macros suggested that from 3.0, we're only allowed to deprecate things at a major version. However, there's no policy stating this, but there is for removal, saying that to remove something, it must have been deprecated for 5 years, and that removal can only happen at a major version. Meanwhile, the semantic versioning rule is that deprecation should trigger a MINOR version update, which is reflected in the macro names as of this change. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-07Change the logic and behaviour surrounding '--api' and 'no-deprecated'Richard Levitte
At some point in time, there was a 'no-deprecated' configuration option, which had the effect of hiding all declarations of deprecated stuff, i.e. make the public API look like they were all removed. At some point in time, there was a '--api' configuration option, which had the effect of having the public API look like it did in the version given as value, on a best effort basis. In practice, this was used to get different implementations of BN_zero(), depending on the desired API compatibility level. At some later point in time, '--api' was changed to mean the same as 'no-deprecated', but only for the deprecations up to and including the desired API compatibility level. BN_zero() has been set to the pre-1.0.0 implementation ever since, unless 'no-deprecation' has been given. This change turns these options back to their original meaning, but with the slight twist that when combined, i.e. both '--api' and 'no-deprecated' is given, the declarations that are marked deprecated up to an including the desired API compatibility level are hidden, simulating that they have been removed. If no desired API compatibility level has been given, then configuration sets the current OpenSSL version by default. Furthermore, the macro OPENSSL_API_LEVEL is now used exclusively to check what API compatibility level is desired. For checking in code if `no-deprecated` has been configured for the desired API compatibility level, macros for each supported level is generated, such as OPENSSL_NO_DEPRECATED_1_1_1, corresponding to the use of DEPRECATEDIN_ macros, such as DEPRECATEDIN_1_1_1(). Just like before, to set an API compatibility level when building an application, define OPENSSL_API_COMPAT with an appropriate value. If it's desirable to hide deprecated functions up to and including that level, additionally define OPENSSL_NO_DEPRECATED (the value is ignored). Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-06Strip much out of ssl.podRich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10208)
2019-11-06Add L<ssl(7)> to all SSL pagesRich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10208)
2019-11-06Remove outdated info from man7/sslRich Salz
There were two paragraphs of useful information about SSL_dup, so copy that to the right manpage. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10208)
2019-11-06Test EVP_get_[digest|cipher]byname() use the namemapMatt Caswell
Following on from the previous commit, we test that if an algorithm has a provider supplied alias in the namemap then EVP_get_digestbyname() and EVP_get_cipherbyname() can still find it. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10324)
2019-11-06Ensure EVP_get_digestbyname() and EVP_get_cipherbyname() know all aliasesMatt Caswell
Now that we have an EVP namemap containing all aliases that providers know about for any given algorithm, it is possible that an application attempts to look up a digest or a cipher via EVP_get_digestbyname() or EVP_get_cipherbyname() with an algorithm name that is unknown to the legacy method database. Therefore we extend those functions to additionally check the aliases in the namemap when searching for a method in the event that our initial lookup attempt fails. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10324)
2019-11-05test/recipes/02-test_ordinals.t: Take '?' and '?+' into accountRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10348)
2019-11-05util/mknum.pl: output stats on unassigned symbolsRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10348)
2019-11-05util/mknum.pl: Call OpenSSL::Ordinals::renumber() for real releasesRichard Levitte
When the source isn't in development any more (the version number doesn't the tags 'dev' or 'alpha'), we renumber the unassigned symbols to ensure that we have fixed numbers on all. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10348)
2019-11-05util/mkdef.pl: writer_VMS(): handle symbols with no assigned numberRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10348)
2019-11-05OpenSSL::Ordinals: when validating, collect statistics on unassigned symsRichard Levitte
If a script wants to display how many symbols have assigned numbers and how many don't, this gives them those numbers. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10348)
2019-11-05OpenSSL::Ordinals: add a renumber() function, to assign unassigned symbolsRichard Levitte
This should be used when it's time to assign constant numbers to the unassigned symbols. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10348)
2019-11-05OpenSSL::Ordinals: Handle symbols with unassigned ordinal numbersRichard Levitte
We preserve the number or '?' or '?+', but assign numbers internally on the latter, to ensure we keep the order of the input. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10348)
2019-11-05util/*.num: deassign ordinal numbers from new symbolsRichard Levitte
Symbols that have appeared since 1.1.1 was released are considered unassigned in the development branch. This is marked by having a question mark as its ordinal number. This introduces two new markers to be used instead of ordinal numbers: ? signifying it gets the previous symbol's number plus one ?+ signifying it gets the same number as the previous symbol '?+' should remain rare, but is useful to create aliases when needed (for example when two different symbols clash because they only differ in character case, see include/openssl/symhacks.h) The intention is that a development branch won't have set numbers for new symbols, and that the final numbers will only get allocated when making beta or final releases. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10348)
2019-11-05Minimal adaptation of tests back to how it was beforeRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10303)
2019-11-05EVP: Make the SIGNATURE implementation leanerRichard Levitte
Because the algorithm to use is decided already when creating an EVP_PKEY_CTX regardless of how it was created, it turns out that it's unnecessary to provide the SIGNATURE method explicitly, and rather always have it be fetched implicitly. This means fewer changes for applications that want to use new signature algorithms / implementations. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10303)
2019-11-05EVP: Make the KEYEXCH implementation leanerRichard Levitte
Because the algorithm to use is decided already when creating an EVP_PKEY_CTX regardless of how it was created, it turns out that it's unnecessary to provide the KEYEXCH method explicitly, and rather always have it be fetched implicitly. This means fewer changes for applications that want to use new key exchange algorithms / implementations. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10305)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-06 18:28:36 +0000