summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2023-10-13cmp: add null pointer check in tear_down test functionPauli
problem reported by: 2ourc3 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22355)
2023-10-13Fix parenthesis, use a colonJames Muir
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22356)
2023-10-13Update unix Makefile template to handle paths with spacesJames Muir
Fixes #4668 (on unix-like platforms) Testing: rm -rf "$HOME/tmp/beforespace afterspace" ./Configure -Werror --strict-warnings --prefix="$HOME/tmp/beforespace afterspace" make -j6 update make -j6 make install make test Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21821)
2023-10-13trace_api_test.c: Separate tracing statementsTomas Mraz
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22347)
2023-10-13Windows: use srand() instead of srandom()Tomas Mraz
This is used for memory allocation failure debugging only Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22347)
2023-10-13Windows CI: Add some non-default options to check they are workingTomas Mraz
Some of the non-default options that enable more code to be built need to be enabled in one of the Windows builds to avoid regressions. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22347)
2023-10-11DH_check_pub_key() should not fail when setting result codeTomas Mraz
The semantics of ossl_ffc_validate_public_key() and ossl_ffc_validate_public_key_partial() needs to be changed to not return error on non-fatal problems. Fixes #22287 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22291)
2023-10-11test/recipes/05-test_rand.t: replace 'and' with '&&'Richard Levitte
The lower priority 'and' seems to have some "interesting" interactions with function argument parsing in some perl versions (presumably because 'and' is lower priority than the comma). For the lines that are changed here, perl v5.20.1 says this: Useless use of string eq in void context at [.test.recipes]05-test_rand.t line 33. Useless use of numeric eq (==) in void context at [.test.recipes]05-test_rand.t line 39. Replacing 'and' with '&&' in these two cases fixes the problem. Replacing Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22331)
2023-10-11Ensure struct timeval is defined when including ssl.hHugo Landau
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22323)
2023-10-11Improve Malloc Failure TestBernd Edlinger
Allow 2 digits after the comma in percentage in OPENSSL_MALLOC_FAILURES. Add OPENSSL_MALLOC_SEED to allow for some randomization. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22127)
2023-10-10CMP: fix OSSL_CMP_MSG_http_perform() by adding option OSSL_CMP_OPT_USE_TLSDr. David von Oheimb
Fixes #21120 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21176)
2023-10-10OSSL_CMP_CTX_new.pod: remove overlap with OSSL_HTTP_transfer.pod; improve ↵Dr. David von Oheimb
the latter Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21176)
2023-10-10apps/cmp.c: -tls_used may be implied by -server https:...; improve related ↵Dr. David von Oheimb
checks and doc Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21176)
2023-10-10Added check for the return value of the RAND_bytes() functionKlavishnik
Call app_bail_out if RAND_bytes() fails. Also changed the output parameter of RAND_bytes() to inp as writing to encrypted output buffer does not make sense. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21706)
2023-10-10ECDSA with SHA3 verification does not depend on FIPS provider versionTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22322)
2023-10-10provider-compatibility.yml: Correct the directory where opensslwrap.sh is ↵Tomas Mraz
being run Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22322)
2023-10-10* Enable extra Arm64 optimization on Windows for GHASH, RAND and AESEvgeny Karpov
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21673)
2023-10-10When calling ossl_crypto_condvar_wait_timeout() we must use real timeMatt Caswell
Although many of the QUIC tests use fake time, the time we pass to the ossl_crypto_condvar_wait_timeout() must be a real time. Passing fake time was causing the QUIC tserver test to hang because ossl_crypto_convar_wait_timeout() always timed out immediately and never relinquished the CPU. If using fake time we adjust the time to real time just before using it. Fixes #22020 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22301)
2023-10-09Avoid divide-by-zero in kmac_prov.c's bytepad()Klavishnik
This would happen if EVP_MD_get_block_size() returned 0 so we return an error instead. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21698)
2023-10-09Fix the BIO_addr testMatt Caswell
The BIO_addr test is failing on non-stop. The length of the data is larger than the size we have allocated for it. We dynamically allocate instead. Fixes #22218 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22294)
2023-10-09test_provider_ex(): Add missing call failure checksTomas Mraz
Fixes Coverity 1542440 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21913)
2023-10-06Timeout in the tserver test using real timeMatt Caswell
When running the tserver test we bail out if a timeout expires. We shouldn't use fake time for that timeout, because fake time might never actually get incremented. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22284)
2023-10-06Don't wait in the tesrver idle testing every time around the loopMatt Caswell
If we wait for 100ms 600 times - then the test takes a minute to complete which is far too long. The purpose of the wait is to give the assistance thread a chance to catch up. We only do that if the event timeout has actually expired - otherwise we are waiting for no reason. Fixes #22156 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22284)
2023-10-06Windows CI: Continue on error during cpuinfoTomas Mraz
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22293)
2023-10-06Always back off on the first packet noise from client to serverTomas Mraz
The test server cannot really cope with modifications Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22267)
2023-10-06Add testing of bitflips in packet headersTomas Mraz
A new type of noise is introduced in the noisy dgram bio filter. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22267)
2023-10-05avoid sun as variable nameVladimir Kotal
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22281)
2023-10-05d2i_X509.pod: Better document using the reuse capability for libctx setupTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22265)
2023-10-05embed bio_dgram_data inside bio_dgram_sctp_dataNeil Horman
the sctp BIO implementation uses the generic BIO dgram implementation under the covers for some operations. However, the private data for each bio is incongruous, leading to segfaults when doing things like passing a dgram_sctp_ctrl operation to the underlying dgram_ctrl method. Fix this by removing the common fields between the two strcutres and embedding a bio_dgram_data as the first member of the bio_dgram_sctp_data struct. This allows implicit casting when that call path is taken, avoiding any memory mis-use Fixes #20643 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22278)
2023-10-05Fix coverity alert on use of uninitialised dataMatt Caswell
The function `ossl_blake2b_param_init` should initialise only, and not read the data it is initialising Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22282)
2023-10-05BN_gcd(): Avoid shifts of negative valuesTomas Mraz
Fixes #22216 Thanks to Leland Mills for investigation and testing. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22272)
2023-10-05DH_check: Emphasize the importance of return value checkTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22262)
2023-10-05[design] Make it possible to use explicitly fetched signature implementationRichard Levitte
This design is to allow the use of explicitly fetched EVP_SIGNATURE implementations. Ref: openssl/project#171 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22129)
2023-10-05[design] Make it possible to pass AlgorithmIdentifier parameter dataRichard Levitte
This design is to allow passing AlgorithmIdentifier parameter data to and from any cryptograpfic operation, with convenience functions for them all, not just for symmetric ciphers. This is crucial to support CMS, among others. Ref: openssl/project#172 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22162)
2023-10-05ossl_property_list_to_string: handle quoted stringsPauli
ossl_property_list_to_string() didn't quote strings correctly which could result in a generated property string being unparsable. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22182)
2023-10-04Bump suisei-cn/actions-download-file from 1.3.0 to 1.4.0dependabot[bot]
Bumps [suisei-cn/actions-download-file](https://github.com/suisei-cn/actions-download-file) from 1.3.0 to 1.4.0. - [Release notes](https://github.com/suisei-cn/actions-download-file/releases) - [Commits](https://github.com/suisei-cn/actions-download-file/compare/v1.3.0...v1.4.0) --- updated-dependencies: - dependency-name: suisei-cn/actions-download-file dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22268)
2023-10-04d2i_PKCS8PrivateKey_bio.pod: evp.h include is unnecessaryTomas Mraz
It is also not allowed by doc nits check to have multiple includes. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22276)
2023-10-04Added info on change to HISTORY of SSL_CTX_set_msg_callback()Frederik Wedel-Heinen
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22241)
2023-10-04Update documentation on SSL_CTX_set_msg_callback() to match the actual ↵Frederik Wedel-Heinen
functionality. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22241)
2023-10-04Print record version for DTLSv1_listen()Frederik Wedel-Heinen
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22241)
2023-10-04Pass the dtls record version to the record layer msg_callback function.Frederik Wedel-Heinen
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22241)
2023-10-04Don't (re-)initialize the FFC_PARAMs in dh_init and dsa_initMatthias St. Pierre
The initialization was introduced in commit dc8de3e6f1ee and changes the behaviour of the `init` method for DSA and DH between 1.1.1 and 3.0, while the behaviour for RSA and EC_KEY remains unchanged. The initialization is not necessary in 3.x and master imho and breaks the use-case of intercepting the methods of an existing key. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22185)
2023-10-04test: evp_extra: test signing with legacy app method based keysMatthias St. Pierre
This commit adds `test_EVP_PKEY_sign_with_app_method`, a regression test for the bug fix in commit 1acc3e8cc3c6 (pull request #22163). It is analogous to `test_EVP_PKEY_sign`, only with a fake app method based key. (The EC key test case was omitted, because there is no `EC_KEY_METHOD_dup` method.) Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22185)
2023-10-04test: evp_extra: fix indentation errorMatthias St. Pierre
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22185)
2023-10-04Correct documentation for PKCS5_PBKDF2_HMACSumitra Sharma
In OpenSSL 3.x, the documentation for PKCS5_PBKDF2_HMAC incorrectly states that an iter value less than 1 is treated as a single iteration. Upon further investigation in providers/implementations/kdfs/pbkdf2.c, it appears that invalid iter values will result in failure and raise the PROV_R_INVALID_ITERATION_COUNT error. This commit corrects the documentation to accurately reflect the behavior in OpenSSL 3.x. Closes openssl#22168 Signed-off-by: Sumitra Sharma <sumitraartsy@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22252)
2023-10-04Restore the meaning of EVP_PKEY_print_private()Richard Levitte
With pre-3.0 OpenSSL, EVP_PKEY_print_private() calls the EVP_PKEY_ASN1_METHOD function "priv_print", effectively asking the backend to print whatever it regards as private key components. In all backends that were built into libcrypto, this function printed what was included in the private key structure, which usually includes the public key components as well. With OpenSSL 3.0, some of the corresponding key2text encoders got a slightly different behavior, where the presence of the selector OSSL_KEYMGMT_SELECT_PRIVATE_KEY without the presence of the selector OSSL_KEYMGMT_SELECT_PUBLIC_KEY would only get what would intuitively be regarded as private key components printed. This isn't entirely consistent, though, as the RSA key2text encoder will still print the public key components regardless. To compensate for the changed backend behavior, EVP_PKEY_print_private() was made to ask the encoder to print the keypair rather than just the private key, thereby moving the backend semantics to the application API. Unfortunately, this causes confusion for providers where the key2text encoder really should print the private key only. This change restores the built-in 1.1.1 backend behavior in the encoders that OpenSSL provides, and renders EVP_PKEY_print_private() more true to its documented behavior, leaving it to the backend to decide what it regards as "private key components". Fixes #22233 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22237)
2023-10-04Improved detection of engine-provided private "classic" keysDmitry Belyavskiy
Resolves #17092 (?) Resolves #17286 (?) Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19965)
2023-10-04Remove duplicates of EVP_aes_xxx_wrap() from EVP_aes_128_gcm.podFrederik Wedel-Heinen
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22236)
2023-10-04Call post_process_record for dtls recordsFrederik Wedel-Heinen
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22239)
2023-10-04doc/man3: fix misnamed function nameMatthias St. Pierre
Rename `DSA_generate_prime[_ex]` to `DSA_generate_parameters[_ex]`, fixing a copy&paste error from the `BN_generate_prime[_ex]` paragraph in commit b3696a55a5ed. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22242)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-11 20:40:11 +0000