summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-02-05Remove OPENSSL_NO_EC guards from libsslMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05Make sure we don't use sigalgs that are not availableMatt Caswell
We may have compiled in sigalg values that we can't support at runtime. Make sure we only use sigalgs that are actually enabled. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05Add the nist group names as aliases for the normal TLS group namesMatt Caswell
By recognising the nist group names directly we can avoid having to call EC_curve_nist2nid in libssl, which is not available in a no-ec build. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05Remove compile time guard checking from ssl3_get_req_cert_typeMatt Caswell
With 3.0 we need to know whether algs are available at run time not at compile time. Actually the code as written is sufficient to do this, so we can simply remove the guards. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05Check for availability of ciphersuites at run timeMatt Caswell
In 1.1.1 and below we would check for the availability of certain algorithms based on compile time guards. However with 3.0 this is no longer sufficient. Some algorithms that are unavailable at compile time may become available later if 3rd party providers are loaded. Similarly, algorithms that exist in our built-in providers at compile time may not be available at run time if those providers are not loaded. Fixes #13184 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05Stop disabling TLSv1.3 if ec and dh are disabledMatt Caswell
Even if EC and DH are disabled then we may still be able to use TLSv1.3 if we have groups that have been plugged in by an external provider. Fixes #13767 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05Make supported_groups code independent of EC and DHMatt Caswell
The supported groups code was checking the OPENSSL_NO_EC and OPENSSL_NO_DH guards in order to work, and the list of default groups was based on those guards. However we now need it to work even in a no-ec and no-dh build, because new groups might be added from providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05Ensure default supported groups works even with no-ec and no-dhMatt Caswell
The default supported groups code was disabled in the event of a build with no-ec and no-dh. However now that providers can add there own groups (which might not fit into either of these categories), this is no longer appropriate. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05Remove OPENSSL_NO_DH guards from libsslMatt Caswell
This removes man unnecessary OPENSSL_NO_DH guards from libssl. Now that libssl is entirely using the EVP APIs and implementations can be plugged in via providers it is no longer needed to disable DH at compile time in libssl. Instead it should detect at runtime whether DH is available from the loaded providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05Makefile template: Allow separate generation of .pod.in -> .podRichard Levitte
We do this by adding the attribute 'pod' to all .pod.in -> .pod generations, like this: DEPEND[NAME.pod]{pod}=NAME.pod.in, ... and selecting out the target files for those dependencies into a dedicated target 'build_generated_pods', which the 'doc-nits' and 'cmd-nits' make targets are made to depend on. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14067)
2021-02-05DOCS: Remove the "global" dependency on writing .pod files from .pod.inRichard Levitte
The dependency was made in such a way that .pod.in -> .pod generation would always be done, no matter what. This changes the procedure so that the generation is made "on demand", i.e. when the resulting .pod files are needed. This turned out to be duplicated dependencies, as the .pod -> .pod.in dependencies were already in place. Just removing the duplicate fixes the situation. 'make build_all_generated' still works, for those who do want to have all file generations performed. (as a reminder, this is suitable to generate the files a fast system and then copy the result to a slower system, or system where there's no perl) Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14067)
2021-02-05TEST: Add an algorithm ID tester for libcrypto vs providerRichard Levitte
Providers produce algorithm IDs of their own, and we need to compare them against the same thing produced by libcrypto's ASN.1 code and with legacy keys. This tester can compare algorithm IDs for signatures and for keys, given certificates that hold such data. To verify key algorithm IDs, only one certificate is necessary, and its public key is used. To verify certificate algorithm IDs, we need to launch the signature operation that would verify a certificate against the public key of its signing CA, so that test needs two files. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14049)
2021-02-05EVP: use evp_pkey_copy_downgraded() in EVP_PKEY_copy_parameters()Richard Levitte
We used evp_pkey_downgrade() on 'from', which permanently converts 'from' to have a legacy internal key. Now that we have evp_pkey_copy_downgraded(), it's better to use that (and thereby restore the constness contract). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13341)
2021-02-05dev/release.sh: Fix typoRichard Levitte
tagley -> tagkey Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/14061)
2021-02-05Remove the old DEPRECATEDIN macrosRichard Levitte
They serve no purpose any more Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13461)
2021-02-05ERR: Rebuild all generated error headers and source filesRichard Levitte
This is the result of 'make errors ERROR_REBUILD=-rebuild' Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13392)
2021-02-05ERR: clean away everything related to _F_ macros from util/mkerr.plRichard Levitte
Instead, we preserve all the pre-3.0 _F_ macros in the backward compatibility headers include/openssl/cryptoerr_legacy.h and include/openssl/sslerr_legacy.h Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13392)
2021-02-05RSA: properly generate algorithm identifier for RSA-PSS signaturesTomas Mraz
Fixes #13969 - properly handle the mandatory RSA-PSS key parameters - improve parameter checking when setting the parameters - compute the algorithm id at the time it is requested so it reflects the actual parameters set - when generating keys do not override previously set parameters with defaults - tests added to the test_req recipe that should cover the PSS signature handling Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13988)
2021-02-05provider-signature.pod: Fix formatting.Tomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13988)
2021-02-05Don't make pthreads mutexes recursive.Rich Salz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13924)
2021-02-05Switch to BIO_snprintf to avoid missing symbol problems on WindowsJon Spillett
Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14063)
2021-02-05EVP: Adapt EVP_PKEY_{set1,get1}_encoded_public_key()Richard Levitte
These functions are modified to use EVP_PKEY_set_octet_string_param() and EVP_PKEY_get_octet_string_param() instead of evp_keymgmt_set_params() and evp_keymgmt_get_params(). To accomplish this fully, EVP_PKEY_get_octet_string_param() is changed slightly to populate |*out_sz| with the return size, even if getting the params resulted in an error. We also modify EVP_PKEY_get_utf8_string_param() to match EVP_PKEY_get_octet_string_param() Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05EVP: Modify the checks in EVP_PKEY_{set,get}_xxx_param() functionsRichard Levitte
The checks of the type of EVP_PKEY were from before we had the macro evp_pkey_is_provided(). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05EVP: Adapt the other EVP_PKEY_set_xxx_param() functionsRichard Levitte
They were calling evp_keymgmt_set_params() directly. Those calls are changed to go through EVP_PKEY_set_params(). We take the opportunity to constify these functions. They have to unconstify internally for the compiler to stop complaining when placing those pointers in an OSSL_PARAM element, but that's still better than forcing the callers to do that cast. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05EVP: Make EVP_PKEY_set_params() increment the dirty countRichard Levitte
When the internal key is changed, we must count it as muted, so that next time the affected key is considered for an operation, it gets re-exported to the signing provider. In other words, this will clear the EVP_PKEY export cache when the next export attempt occurs. This also updates evp_keymgmt_util_export_to_provider() to actually look at the dirty count for provider native origin keys, and act appropriately. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05apps/openssl: add -propquery command line optionPetr Gotthard
Fixes #13656. Right now all openssl commands use a NULL propq. This patch adds a possibility to specify a custom propq. The implementation follows the example of set_nameopt/get_nameopt. Various tools had to be modified to call app_get0_propq after it has been populated. Otherwise the -propquery has no effect. The tests then verify the -propquery affects the tool behaviour by requesting a non-existing property. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13707)
2021-02-04x509_vfy.c: Improve coding style and comments all over the fileDr. David von Oheimb
No changes in semantics. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13070)
2021-02-04Remove a DSA related TODOMatt Caswell
There are no instances of the macros that this comment is referring to being used anywhere within current master. All of the macros were deprecated by commit f41ac0e. Therefore this TODO should just be removed. Fixes #13020 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14038)
2021-02-04Remove some TODO(OpenSSL1.2) referencesMatt Caswell
We had a couple of stray references to OpenSSL1.2 in libssl. We just reword the comments to remove those references without changing any behaviour. The first one in t1_lib.c is a technical non-compliance in the TLSv1.3 spec where, under some circumstances, we offer DSA sigalgs even in a ClientHello that eventually negotiates TLSv1.3. We explicitly chose to accept this behaviour in 1.1.1 and we're not planning to change it for 3.0. The second one in s3_lib.c is regarnding the behaviour of SSL_set_tlsext_host_name(). Technically you shouldn't be able to call this from a server - but we allow it and just ignore it rather than raising an error. The TODO suggest we consider raising an error instead. However, with 3.0 we are trying to minimise breaking changes so I suggest not making this change now. Fixes #13161 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/14037)
2021-02-04DH/DHX parameter check using pkeyparamDmitry Belyavskiy
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13930)
2021-02-04Allow NULL arg to OPENSSL_sk_{dup,deep_copy} returning empty stackDr. David von Oheimb
This simplifies many usages Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14040)
2021-02-04run_tests.pl: Improve diagnostics on the use of HARNESS_JOBSDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13551)
2021-02-04test/recipes: split 81_test_cmp_cli.t, add test using -engine loader_atticDr. David von Oheimb
The HTTP-based tests are now in 80_test_cmp_http.t, to start a little earlier. This should decrease total test run time due to better parallelization. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13551)
2021-02-04apps/cmp.c: check and exit on engine load errorDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13551)
2021-02-04openssl.pod: Add documentation for using the loader_attic engineDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13551)
2021-02-04Fix a use after free issue when a provider context is being used and isn't ↵Pauli
cached Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14053)
2021-02-03EC: Reverse the default asn1_flag in a new EC_GROUPRichard Levitte
The default was OPENSSL_EC_NAMED_CURVE, but that's not true until a curve name has been set, so we change the initial value to OPENSSL_EC_EXPLICIT_CURVE and let EC_GROUP_set_curve_name() change it to OPENSSL_EC_NAMED_CURVE. Submitted by Matt Caswell Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13973)
2021-02-03EVP: Fix evp_pkey_ctx_store_cached_data() to handle provider backed EVP_PKEY_CTXRichard Levitte
It assumed there would always be a non-NULL ctx->pmeth, leading to a crash when that isn't the case. Since it needs to check 'keytype' when that one isn't -1, we also add a corresponding check for the provider backed EVP_PKEY_CTX case. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13973)
2021-02-03EVP: Don't find standard EVP_PKEY_METHODs automaticallyRichard Levitte
EVP_PKEY_meth_find() got called automatically any time a new EVP_PKEY_CTX allocator was called with some sort of key type data. Since we have now moved all our standard algorithms to our providers, this is no longer necessary. We do retain looking up EVP_PKEY_METHODs that are added by the calling application. Fixes #11424 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13973)
2021-02-03CORE & PROV: clean away OSSL_FUNC_mac_size()Richard Levitte
There was a remaining function signature declaration, but no OSSL_DISPATCH number for it nor any way it's ever used. It did exist once, but was replaced with an OSSL_PARAM item to retrieve. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14048)
2021-02-03apps/ecparam: Avoid crash when parameters fail to loadTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14043)
2021-02-03apps/ca: Properly handle certificate expiration times in do_updatedbArmin Fuerst
Fixes #13944 + changed ASN1_UTCTIME to ASN1_TIME + removed all Y2K code from do_updatedb + changed compare to ASN1_TIME_compare Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14026) (cherry picked from commit dabea5447dc487983a50a40856f731db0db17a8e)
2021-02-03Deprecate EVP_MD_CTX_{set_}update_fn()Rich Salz
They are still used internally in legacy code. Also fixed up some minor things in EVP_DigestInit.pod Fixes: #14003 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14008)
2021-02-03Add diacritics to my name in CHANGES.mdTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14044)
2021-02-02dh_cms_set_peerkey: Pad the public key to p sizeTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13958)
2021-02-02Add some missing committers to the AUTHORS listDr. Matthias St. Pierre
Fixes #13815 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14029)
2021-02-02Add a CI job to run the threads test with threads sanitizer onMatt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13987)
2021-02-02Ensure the EVP_PKEY operation_cache is appropriately lockedMatt Caswell
The EVP_PKEY operation_cache caches references to provider side key objects that have previously been exported for this EVP_PKEY, and their associated key managers. The cache may be updated from time to time as the EVP_PKEY is exported to more providers. Since an EVP_PKEY may be shared by multiple threads simultaneously we must be careful to ensure the cache updates are locked. Fixes #13818 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13987)
2021-02-02Ensure access to FIPS_state and rate_limit is appropriately lockedMatt Caswell
These variables can be accessed concurrently from multiple threads so we ensure that we properly lock them before read or write. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13987)
2021-02-02Always ensure we hold ctx->lock when calling CRYPTO_get_ex_data()Matt Caswell
Otherwise we can get data races. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13987)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-23 15:33:08 +0000