summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-05-04OSSL_DECODER_from_bio() Prevent spurious decoding error at EOFDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04APPS load_key_certs_crls(): Correct the 'expect' arg calculation for ↵Dr. David von Oheimb
OSSL_STORE_expect() Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04OSSL_STORE_expect(): Improve error handling and documentationDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04OCSP: Minor improvements of documentation and header fileDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15103)
2021-05-04fips-checksums: The define for fips module is FIPS_MODULETomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15132)
2021-05-04Document the new core BIO public API supportMatt Caswell
Fixes #14409 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15072)
2021-05-04Add a test for the public core bio APIMatt Caswell
Check that reading/writing to a core bio via BIO_new_from_core_bio() works as expected. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15072)
2021-05-04Create libcrypto support for BIO_new_from_core_bio()Matt Caswell
Previously the concept of wrapping an OSSL_CORE_BIO in a real BIO was an internal only concept for our own providers. Since this is likely to be generally useful, we make it a part of the public API. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15072)
2021-05-04Run coveralls daily and not exactly at midnightTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15121)
2021-05-04coveralls: Enable fips as it is disabled by defaultTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15121)
2021-05-04apps: Switch to X509_REQ_verify_exPetr Gotthard
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15118)
2021-05-04test: fix failure with FIPS and no-des configured.Pauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15105)
2021-05-04APPS: Add passphrase handling in the "rsa" and "dsa" commandsRichard Levitte
They completely ignored any passphrase related setting. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15119)
2021-05-04APPS: Set a default passphrase UI for the "ec" commandRichard Levitte
Fixes #15114 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15119)
2021-05-04[TEMPORARY] make 'make update' verbose in ci.ymlRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
2021-05-04GitHub CI: ensure that unifdef is installedRichard Levitte
This is required for 'make update' and fips checksums Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
2021-05-04FIPS module checksums: add scripts and Makefile ruleRichard Levitte
This adds the following scripts: util/lang-compress.pl: Compress source code, which language is determined by the first argument. For the moment, we know 'perl' (perlasm source code), 'C' (C source code) and 'S' (Assembler with C preprocessor directives). This removes comments and empty lines, and compresses series of horizontal spaces to one single space in the languages where that's appropriate. util/fips-checksums.sh: Takes source file names as arguments, pushes them through util/lang-compress.pl and unifdef with FIPS_MODE defined, and calculates the checksum on the result. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
2021-05-04Unix build file: Add a target to create providers/fips.module.sourcesRichard Levitte
This file will be the basis for the FIPS module checksum calculation Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
2021-05-04Add OpenSSL::Config::Query and use it in configdata.pmRichard Levitte
OpenSSL::Config::Query is a configuration querying tool that's meant to make it easier to query the diverse configuration data for info. That's much easier than to dig through all the parts of %unified_info. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
2021-05-04Windows build file: add forgotten quotes on POD->html command lineRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15084)
2021-05-04OpenSSL::Test: When prefixing command with $^X on Windows, fix it up!Richard Levitte
The perl interpreter name itself might contain spaces and need quoting. __fixup_prg() does this for us. Fixes #14256 Co-authored-by: Tomáš Mráz <tomas@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15084)
2021-05-02acvp-test: disable the ACVP testing code by defaultPauli
It's only useful for the FIPS lab and shouldn't be in production. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15092)
2021-05-01ssl: fix possible ref counting fields use before init.FdaSilvaYY
`strdup(propq)` failure is doing a `goto err;` from where `SSL_CTX_free` is called. The possible call is made before reference and lock fields setup. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15052)
2021-05-01man: s_server: fix text repetition in -alpn descriptionHubert Kario
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15099)
2021-05-01APPS: Document the core of the opt_ APIRich Salz
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/14995)
2021-05-01Use OCSP-specific error code for clarityDmitry Belyavskiy
Fixes #12735 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/xxxxx)
2021-05-01Simplify AppVeyor configurationTomas Mraz
Adjust the stuff we are building and testing in various configurations to trim the run time a little bit. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15087)
2021-05-01Add -latomic to threads enabled 32bit linux buildsTomas Mraz
It might not be necessary with the most recent toolchain versions but apparently many 32bit linux architectures and commonly used toolchain versions require this. It is also harmless to include even on architectures that do not need it. Fixes #14083 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15086)
2021-05-01Fix no-fips-securitychecks test failureShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15091)
2021-04-30apps/ca,req,x509: Switch to EVP_DigestSignInit_exPetr Gotthard
Switch lib/apps.c do_sign_init() to use EVP_DigestSignInit_ex, so it works with external providers. Since EVP_DigestSignInit_ex requires a digest name instead of an EVP_MD pointer, the apps using do_sign_init() had to be modified to pass char* instead of EVP_MD*. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15014)
2021-04-30Fix typo in OSSL_DECODER_CTX_set_input_structureDaniel Bevenius
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15085)
2021-04-30STORE: Fix the repeated prompting of passphraseRichard Levitte
OSSL_STORE's loading function could prompt repeatedly for the same passphrase. It turns out that OSSL_STORE_load() wasn't caching the passphrase properly. Fixed in this change. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15064)
2021-04-30SM2 signatures work correctly only with SM3 digestsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15074)
2021-04-30sm2: Cleanup handling of DIGEST and DIGEST_SIZE parametersTomas Mraz
Fixes #14873 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15074)
2021-04-30CORE: Rework the pre-population of the namemapRichard Levitte
The pre-population of names has become more thorough. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15066)
2021-04-30STORE: Use the 'expect' param to limit the amount of decoders usedRichard Levitte
In the provider file: scheme loader implementation, the OSSL_DECODER_CTX was set up with all sorts of implementations, even if the caller has declared a limited expectation on what should be loaded, which means that even though a certificate is expected, all the diverse decoders to produce an EVP_PKEY are added to the decoding change. This optimization looks more closely at the expected type, and only adds the EVP_PKEY related decoder implementations to the chain if there is no expectation, or if the expectation is one of OSSL_STORE_INFO_PARAMS, OSSL_STORE_INFO_PUBKEY, OSSL_STORE_INFO_PKEY. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15066)
2021-04-30acvp: fix the no-acvp_test buildPauli
A pair of the disabled string checks were incorrect. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15082)
2021-04-30Update OSSL_STORE_attach() documentation to indicate it increases the ↵Shane Lontis
ref_count of the passed in bio Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15058)
2021-04-30Fix memory leak in load_key_certs_crls() when using stdin.Shane Lontis
A newly created BIO object within this function calls OSSL_STORE_attach() which increases the ref count to 2. OSSL_STORE_close() then decrements the ref count by 1, so the BIO still remains. The following new test was picking up this leak using.. > valgrind openssl crl -hash -noout < test/testcrl.pem Not quite sure why the existing tests were not picking this up since they appear to run through a similiar path.. such as > valgrind openssl pkey < test-runs/test_rsa/rsa-pkcs8-ff.dd Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15058)
2021-04-30Fix CRL app so that stdin works.Shane Lontis
Fixes #15031 The maybe_stdin needed to be passed to load_key_certs_crls(). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15058)
2021-04-30Document the API breaking constification changesTomas Mraz
The EVP_PKEY_asn1_set_public and EVP_PKEY_meth_set_copy have some API breaking constification changes in 3.0. Fixes #9296 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15068)
2021-04-30Remove dated term and fixed typo antherEric Curtin
Just something I noticed while reading this code. This was probably committed a very long time ago. Fixed typo anther -> another. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15078)
2021-04-30remove end of line whitespacePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14434)
2021-04-30Add library context and property query support into the PKCS12 APIJon Spillett
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14434)
2021-04-29Adjust ssl_test_new for SHA1 security levelMatt Caswell
SHA1 is now in security level 0. SHA1 is required for DTLSv1.1. Therefore ssl_test_new needed some adjustments in the event that DTLSv1.2 is disabled. There are also adjustments required if using the FIPS module and DTLSv1.2 is disabled. The only DTLS version supported by the FIPS module is DTLSv1.2. Fixes #14956 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15047)
2021-04-29Adjust sslapitest for SHA1 security levelMatt Caswell
SHA1 is now in security level 0. SHA1 is required for DTLSv1.1. Therefore sslapitest needed some adjustments in the event that DTLSv1.2 is disabled. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15047)
2021-04-29Adjust dtlstest for SHA1 security levelMatt Caswell
SHA1 is now in security level 0. SHA1 is required for DTLSv1.1. Therefore dtlstest needed some adjustments in the event that DTLSv1.2 is disabled. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15047)
2021-04-29asn1_lib.c: ASN1_put_object: Remove comment about "class 0".Scott McPeak
ASN1_put_object() was preceded by the nonsensical comment: /* * class 0 is constructed constructed == 2 for indefinite length constructed */ This is the result of concatenating two sentences in 0f113f3ee4d by automated reformatting. The first sentence, "class 0 is constructed", goes back to d02b48c63a, the import of SSLeay 0.8.1b. Even in that context, it made little sense; class 0 means "universal", not constructed, and there is no special significance to class 0 in this function in any case. Therefore I have simply removed that first sentence. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14998)
2021-04-29Add test case for openssl crl -noout -hash outputTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15044)
2021-04-29crl: noout is not an output itemTomas Mraz
Fixes #15034 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15044)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-18 12:34:29 +0000