summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2020-12-15Check non-option argumentsRich Salz
Make sure all commands check to see if there are any "extra" arguments after the options, and print an error if so. Made all error messages consistent (which is to say, minimal). Fixes: #13527 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13563)
2020-12-15test: document the random test ordering env variablePauli
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13672)
2020-12-15test: print OPENSSL_TEST_RAND_ORDER=x when a randomised test fails.Pauli
The previous message "random seed x" is a lot less descriptive. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13672)
2020-12-15Document OCSP_REQ_CTX_i2d.Rich Salz
Based on comments from David von Oheimb. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13620)
2020-12-15Deprecate OCSP_REQ_CTX_set1_reqRich Salz
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13620)
2020-12-15Skip tests depending on deprecated list -*-commands optionsDmitry Belyavskiy
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13669)
2020-12-15Documenting the options deprecating in CHANGES.mdDmitry Belyavskiy
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13669)
2020-12-15Documenting the options deprecatingDmitry Belyavskiy
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13669)
2020-12-15Skip unavailable digests and ciphers in -*-commandsDmitry Belyavskiy
Fixes #13594 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13669)
2020-12-15Deprecate -cipher-commands and -digest-commands optionsDmitry Belyavskiy
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13669)
2020-12-15OPENSSL_NO_GOST has nothing to do with low-level algosDmitry Belyavskiy
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13669)
2020-12-14Configurations: PowerPC is big endianSebastian Andrzej Siewior
Define B_ENDIAN on PowerPC because it is a big endian architecture. With this change the BN* related tests pass. Fixes: #12199 Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12371)
2020-12-14Change AES-CTS modes CS2 and CS3 to also be inside the fips module.Shane Lontis
The initial thought was that only CS1 mode (the NIST variant) was allowed. The lab has asked if these other modes should be included. The algorithm form indicates that these are able to be validated. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13639)
2020-12-14Fix Segfault in EVP_PKEY_CTX_dup when the ctx has an undefined operation.Shane Lontis
Fixes #12438 Note: This worked in 1.1.1 so just returning an error is not valid. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/13505)
2020-12-14Fix no-threadsMatt Caswell
Make OPENSSL_fork_prepare() et al always available even in a no-threads build. These functions are no-ops anyway so this shouldn't make any difference. This fixes an issue where the symbol_presence test fails in a no-threads build. This is because these functions have not been marked in libcrypto.num as being dependent on thread support. Enclosing the declarations of the functions in the header with an appropriate guard does not help because we never define OPENSSL_NO_THREADS (we define the opposite OPENSSL_THREADS). This confuses the scripts which only consider OPENSSL_NO_* guards. The simplest solution is to just make them always available. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13647)
2020-12-13openssl.pod: Fix openSSL options docAnkita Shetty
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13651)
2020-12-13Remove unnecessary guards around MSBLOB and PVK readers and writersRichard Levitte
The OPENSSL_NO_RC4 guard remain around protected PVK tests in test/endecoder_test.c. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13648)
2020-12-13PEM: Unlock MSBLOB and PVK functions from 'no-dsa' and 'no-rc4'Richard Levitte
All these functions are usable with RSA keys, there's no reason why they should be unaccessible when DSA or RC4 are disabled. When DSA is disabled, it's not possible to use these functions for DSA EVP_PKEYs. That's fine, and supported. When RC4 is disabled, it's not possible to use these functions to write encrypted PVK output. That doesn't even depend on the definition of OPENSSL_NO_RC4, but if the RC4 algorithm is accessible via EVP, something that isn't known when building libcrypto. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13648)
2020-12-13Building: Fix the library file names for MSVC builds to include multilibRichard Levitte
In OpenSSL 1.1.1, VC-WIN64I and VC-WIN64A have a 'multilib' attribute set, which affect the names of the produced libcrypto and libssl DLLs. This restores that for OpenSSL 3.0. Fixes #13659 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13670)
2020-12-13DOCS: Improve documentation of the EVP_PKEY typeRichard Levitte
This type was previously described in a note, which is hard to find unless you already know where to look. This change makes the description more prominent, and allows indexing by adding it in the NAMES section. The EVP_PKEY description is altered to conceptually allow an EVP_PKEY to contain a private key without a corresponding public key. This is related to an OTC vote: https://mta.openssl.org/pipermail/openssl-project/2020-December/002474.html The description of EVP_PKEY for MAC purposes is amended to fit. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13629)
2020-12-12params: add integer conversion test cases.Pauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13663)
2020-12-12params: allow more variations in integer conversions.Pauli
Allow any sized integer to be converted to any other size integer via the helpers. Support for converting reals to/from integers remains restricted. Fixes: #13429 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13663)
2020-12-11DOCS: Update OSSL_DECODER_CTX_new_by_EVP_PKEY.pod to match declarationsRichard Levitte
Fixes #13441 We're also starting on a glossary, doc/man7/openssl-glossary.pod, where terms we use should be explained. There's no need to explain terms as essays, but at least a few quick lines, and possibly a reference to some external documentation. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13581)
2020-12-11Fix some typos in EVP_PKEY-DH.podMatt Caswell
A missing newline messes up how the code sample is rendered. Also a few miscellaneous typos are fixed. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13643)
2020-12-11Skip cms tests using RC2 if no legacy providerMatt Caswell
Fixes #12510 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
2020-12-11Don't run a legacy specific PKCS12 test if no legacy providerMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
2020-12-11Don't use the legacy provider in test_store if its not availableMatt Caswell
If we don't have the legacy provider then we avoid having to use it. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
2020-12-11Don't load the legacy provider in test_evp_libctx unnecessarilyMatt Caswell
We don't need the legacy provider, so don't load it. This avoids problems in a no-legacy build Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
2020-12-11Don't load the legacy provider if not available in test_enc_moreMatt Caswell
If the legacy provider isn't available then we shouldn't attempt to load or use it. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
2020-12-11Skip testing ciphers in the legacy provider if no legacyMatt Caswell
test_enc should not test ciphers that are not available due to a lack of the legacy provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
2020-12-11Don't load the legacy provider in endecoder_legacy_testMatt Caswell
In spite of the name the endecoder_legacy_test does not need the legacy provider. Therefore we avoid loading it so that no-legacy builds still run the test successfully. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
2020-12-11Don't use legacy provider if not available in test_ssl_oldMatt Caswell
If we've been configured with no-legacy then we should not attempt to load the legacy provider. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
2020-12-11Fix sslapitest.c if built with no-legacyMatt Caswell
We skip a test that uses the no-legacy option. Unfortuantely there is no OPENSSL_NO_LEGACY to test, so we just check whether we were successful in loading the legacy provider - and if not we skip the test. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
2020-12-11Skip evp_test cases where we need the legacy prov and its not availableMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13595)
2020-12-11Don't use no-asm in the Github CIsMatt Caswell
no-asm has proven to be too slow, therefore we don't use it in the Github CI builds and instead rely on it being covered by run-checker. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13607)
2020-12-11Add fips self tests for all included kdfShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13480)
2020-12-11Add validate method to ECX keymanagerShane Lontis
Fixes #11619 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13459)
2020-12-10apps/{ca,req,x509}.c: Improve diag and doc mostly on X.509 extensions, fix ↵Dr. David von Oheimb
multiple instances This includes a general correction in the code (now using the X509V3_CTX_REPLACE flag) and adding a prominent clarification in the documentation: If multiple entries are processed for the same extension name, later entries override earlier ones with the same name. This is due to an RFC 5280 requirement - the intro of its section 4.2 says: A certificate MUST NOT include more than one instance of a particular extension. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
2020-12-10openssl_hexstr2buf_sep(): Prevent misleading 'malloc failure' errors on ↵Dr. David von Oheimb
short input Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
2020-12-10v2i_AUTHORITY_KEYID(): Correct out-of-memory behavior and avoid mem leaksDr. David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
2020-12-10X509V3_EXT_add_nconf_sk(): Improve description and use of 'sk' arg, which ↵Dr. David von Oheimb
may be NULL Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
2020-12-10openssl-ca.pod.in: Clarify the -extensions/-crlexts options vs. ↵Dr. David von Oheimb
x509_extensions/crl_extensions Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
2020-12-10apps/x509.c: Factor out common aspects of X509 signingDr. David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
2020-12-10apps/{req,x509,ca}.c: Cleanup: move shared X509{,_REQ,_CRL} code to ↵Dr. David von Oheimb
apps/lib/apps.c Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
2020-12-10apps/{req,x509,ca}.c: Clean up code setting X.509 cert version v3Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
2020-12-10x509v3_config.pod: Clarify semantics of subjectKeyIdentifier and ↵Dr. David von Oheimb
authorityKeyIdentifier Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
2020-12-10apps/req.c: Improve diagnostics on multiple/overriding X.509 extensions ↵Dr. David von Oheimb
defined via -reqext option Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
2020-12-10Use adapted test_get_libctx() for simpler test setup and better error reportingDr. David von Oheimb
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13001)
2020-12-09Read MIDR_EL1 system register on aarch64Fangming.Fang
MIDR_EL1 system register exposes microarchitecture information so that people can make micro-arch related optimization such as exposing as much instruction level parallelism as possible. MIDR_EL1 register can be read only if HWCAP_CPUID feature is supported. Change-Id: Iabb8a36c5d31b184dba6399f378598058d394d4e Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11744)
2020-12-09Test that we can negotiate TLSv1.3 if we have an SNI callbackMatt Caswell
If an SNI callback has been set then we may have no certificuates suitable for TLSv1.3 use configured for the current SSL_CTX. This should not prevent us from negotiating TLSv1.3, since we may change the SSL_CTX by the time we need a suitable certificate. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13304)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-02 15:47:46 +0000