summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2020-03-10DOCS: Move implementation specific docs away from provider-digest(7)Richard Levitte
The provider- manuals are meant to describe the general interface for their respective operation. This is not the place to describe implementation specific details. This change creates a number of doc/man7/EVP_MD manuals, one for each algorithm or set of algorithms, as well as doc/man7/EVP_MD-common.pod to describe what's common to them all. While we're at it, correct the SHA3 settable context params array to match what's actually settable. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11270)
2020-03-10DOCS: Start restructuring our provider and implementation documentationRichard Levitte
This adds doc/man7/OSSL_PROVIDER-default.pod and OSSL_PROVIDER-legacy.pod, and fills in currently implemented operations and algorithms in them, as well as in doc/man7/OSSL_PROVIDER-FIPS.pod, with links to documentation to come. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11270)
2020-03-09Renew and extend the tool for checking adherence to C coding style rulesDr. David von Oheimb
aims at checking most of https://www.openssl.org/policies/codingstyle.html and various requirements not yet explicitly stated there - see also #10725 add util/check-format.pl and its self-tests in util/check-format-test-{positives,negatives}.c remove util/openssl-format-source Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10363)
2020-03-09DH: add internal dh_get_method()Richard Levitte
This should have been publically present a long time ago, to be consistent with the RSA, DSA and EC_KEY APIs. However, since we've now deprecated that kind of function for the other key types, there's no point in adding a public function, but we still need it internally. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11193)
2020-03-09EVP: Check that key methods aren't foreign when exportingRichard Levitte
The EVP_PKEY_ASN1_METHOD function export_to() must check that the key we're trying to export has a known libcrypto method, i.e. is a built in RSA_METHOD, DSA_METHOD, etc. Otherwise, the method may be defined by the calling application, by an engine, by another library, and we simply cannot know all the quirks hidden behind that method, if we have access to the key data, or much anything. Such keys are simply deemed impossible to export to provider keys, i.e. have export_to() return 0. This cascades back to functions like evp_pkey_export_to_provider() and evp_pkey_upgrade_to_provider() and their callers. In most cases, this is fine, but if these get mixed in with provider side keys in any function, that function will fail. Fixes #11179 Fixes #9915 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11193)
2020-03-09DOCS: Fix documentation on asymmetric keydata typesRichard Levitte
Some type specs didn't correspond to actual use. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11275)
2020-03-09docs: fix typo in SSL functionsJames Peach
CLA: trivial Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11253)
2020-03-09util/wrap.pl: do not look at EXE_SHELLRichard Levitte
Acting on EXE_SHELL was a bit over the top, especially in light of instructions like this (from NOTES.VALGRIND): EXE_SHELL="`/bin/pwd`/util/wrap.pl valgrind --error-exitcode=1 --leak-check=full -q" Fixes #11255 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11258)
2020-03-09Remove double fetch of "OSSL_EX_DATA_GLOBAL" for global lockDavide Galassi
Fetch once and just pass the global ex_data to the "get_and_lock" static function. Removed a redundant null pointer check within the "get_and_lock" static function (control already performed by the caller). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11152)
2020-03-09spkac: Check return values of NETSCAPE_SPKI functionsVladimir Panteleev
Fixes silently producing an invalid SPKAC with non-RSA keys. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11224)
2020-03-09Document the new DigestSign provider functionsMatt Caswell
As well as the newly added "one shot" functions, we also document a number of the other other digestsign functions which were missing documentation in provider-signature.pod. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11261)
2020-03-09Implement provider support for Ed25519 annd Ed448Matt Caswell
At the moment we only provider support for these algorithms in the default provider. These algorithms only support "one shot" EVP_DigestSign() and EVP_DigestVerify() as per the existing libcrypto versions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11261)
2020-03-09Add provider awareness of EVP_DigestSign() and EVP_DigestVerify()Matt Caswell
These "one-shot" functions are the only ones supported by Ed25519 and Ed448, so we need to ensure that libcrypto can handle provider based implementations of these functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11261)
2020-03-09Add Key Management support for EdDSA keysMatt Caswell
Support added for Ed25519 and Ed448 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11261)
2020-03-09Refactor CRMF_poposigningkey_init() to work with provider keysRichard Levitte
The code in this function was almost entirely a copy of the functionality in ASN1_item_sign(), so it gets refactored to actually call ASN1_item_sign(), and thereby automatically gets support for EVP_PKEYs with only provider side keys. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11126)
2020-03-08doc: slightly reformulate 'openssl(1)/Random State Options' sectionDr. Matthias St. Pierre
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11252)
2020-03-08Improve small block cipher performanceKurt Roeckx
Avoid function calls we don't need to do. In 1.1.1 we have: aes-128-cbc 572267.80k 681197.08k 715430.74k 720508.59k 722359.64k 723004.07k Current master: aes-128-cbc 460663.70k 631125.66k 701283.58k 719794.52k 724732.59k 726668.63k new: aes-128-cbc 582057.64k 684288.62k 715721.90k 724856.15k 717578.24k 727176.53k Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11102)
2020-03-07Add -section option to 'req' commandRich Salz
This removes "req" as the hardwired section for the req command. Doing this will let us merge some test configs. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11249)
2020-03-07cmdline app: add provider commandline options.Pauli
Add a -provider option to allow providers to be loaded. This option can be specified multiple times. Add a -provider_path option to allow the path to providers to be specified. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11167)
2020-03-07man1: make all openssl command line tool documentation generated.Pauli
With the introduction of provider command line options which are applicable to almost all of the command line tools, it seemed reasonable to make them all generated. This simplifes the .gitignore and avoids having to keep two lists in sync. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11167)
2020-03-07Change DH_get_nid() to set the value of q if it is not already setShane Lontis
Fixes #11108. It only sets q if a valid named group is found. The function signature was recently changed to pass a non const DH pointer in order to allow the nid to be cached internally. As an extension of this the value of q can now also be set as q is always known for named groups. The length field is also set if q is set. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11114)
2020-03-06Clarify the usage of EVP_PKEY_get_raw_[private|public]_key()Matt Caswell
EVP_PKEY_get_raw_private_key() and EVP_PKEY_get_raw_public_key() expect the size of the key buffer to be populated in the |*len| parameter on entry - but the docs made no mention of this. Fixes #11245 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11254)
2020-03-06Use .cnf for config files, not .confRich Salz
The default is openssl.cnf The project seems to prefer xxx.conf these days, but we should use the default convention. Rename all foo.conf (except for Configurations) to foo.cnf Fixes #11174 Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11176)
2020-03-06Remove unused filesRich Salz
Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11176)
2020-03-05fix a minor bug of s_clientRoger Ning
CLA: trivial -CAstore's option should be OPT_CASTORE, instead of OPT_CAFILE correct also -no-CAstore option from OPT_NOCAPATH to OPT_NOCASTORE Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11215)
2020-03-05Add CIFuzz actionLeo Neat
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11140)
2020-03-05crypto/ec/curve448/eddsa.c: fix EBCDIC platformsPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11229)
2020-03-05aes-s390x.pl: fix stg offset caused by typo in perlasmPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11234)
2020-03-05.github/PULL_REQUEST_TEMPLATE.md: Fix link to contributors guideVladimir Panteleev
The file was converted to Markdown and renamed appropriately in 2e07506a12e126894cd820304465162bc0e732b4. CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11223)
2020-03-05Add DSA Key validation to default providerShane Lontis
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10912)
2020-03-05Add DH key validation to default providerShane Lontis
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10911)
2020-03-04config, Configure: move the check of removed crypto/ sub-systemsRichard Levitte
The 'config' script checked for a bunch of crypto/ sub-system directories, and added 'no-' options if they weren't there. We move it to 'Configure' in an effort to simplify 'config' for further work. Note: this is pretty much a historical thing. In modern OpenSSL, it's much simpler to edit the SUBDIRS statement in crypto/build.info. However, it's been claimed the there are those who still remove some of these sub-system sources. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11217)
2020-03-04.travis.yml: where it matters, have build and source nesting levels differRichard Levitte
Where we build out of source, the source directory was _srcdist and the build directory was _build. That gives the same nesting level for both, which doesn't quite exercise all aspects of relative back references from build to source tree. Changing the build tree to be in _build/tree will challenge back references a bit more, and ensure a bit more that we got it right. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11186)
2020-03-04Add some missing env var documentationRich Salz
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11189)
2020-03-04.gitignore: Add /apps/progs.{c,h}Vladimir Panteleev
These files were removed from the source tree in fe909ee4aeb6eb64f6f31a1544c5d3c81c5fe1f1. CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11222)
2020-03-04Add Serializers for ECShane Lontis
Provide EC serializers for text, pem and der. EC parameters use ANS1 'CHOICE' - which means they are more embedded than other parameters used by other KEY types (which normally have a SEQUENCE at the top level). For this reason the ANS1_STRING type that was being passed around has been changed to a void so that the code can still be shared with EC. The EC serializer only supports named curves currently. NOTE the serializer code assumes PKCS8 format - if the older encode methods are needed they will need to be added in another PR. (Probably when deserialization is considered). EVP_PKEY_key_fromdata_init was changed from using a keypair selection to all bits of a key. A side effect of this was that the very restrictive checks in the ecx code needed to be relaxed as it was assuming all selection flags were non optional. As this is not the case for any other key the code has been modified. Fixed a bug in legacy_ctrl_str_to_params() - "ecdh_cofactor_mode" was being incorrectly converted to the wrong keyname. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11107)
2020-03-03Correct two small documentation issuesTomas Mraz
The find-doc-nits complains about non-zero word and about missing line before =head1 which causes build failure. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11231)
2020-03-03Documenting newly added CMS modificationDmitry Belyavskiy
Documented CMS-related API functions. Documented flags added to openssl-cms command Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10904)
2020-03-03Implementation of Russian GOST CMSDmitry Belyavskiy
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10904)
2020-03-03doc: document that 'openssl rand' is cryptographically secureDr. Matthias St. Pierre
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11213)
2020-03-03Fix build with clang assemblerPhilippe Antoine
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11219)
2020-03-03Add pairwise consistency self tests to asym keygeneratorsShane Lontis
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10952)
2020-03-02.travis.yml: Remove NOUPDATE supportRichard Levitte
It was a temporary measure to deal with the fact that util/progs.pl didn't work right at all times, but that has now been fixed. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11185)
2020-03-02Remove apps/progs.c and apps/progs.hRichard Levitte
Since they are generated in build time, there's not need to keep them in the source tree. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11185)
2020-03-02Configure: Diverse cleanupsRichard Levitte
There were some remaining old code and comments that don't serve a purpose any longer. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11185)
2020-03-02Build: Generate apps/progs.c and apps/progs.h in build timeRichard Levitte
util/progs.pl depends on the build tree (on configdata.pm, specifically), so it needs to be run from the build tree. But why stop there? We might as well generate apps/progs.c and apps/progs.h when building. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11185)
2020-03-02build.info: Implement simply substitutions in variable valuesRichard Levitte
Use case: having a variable with multiple source files in its value, and wanting to refer to the corresponding object file. $SRCS=foo.c bar.c SOURCE[program]=$SRCS DEPEND[${SRCS/.c/.o}]=prog.h GENERATE[prog.h]=... Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11185)
2020-03-02build.info: Make it possible to have more than one item in KEYWORD[]Richard Levitte
So far, the "index" part of KEYWORD[whatever] could only handle one item. There are cases, however, where we want to add the exact same value to multiple items. This is especially helpful if a variable that may have multi-item values are used in the "index" part. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11185)
2020-03-02PROV: Add a OP_keymgmt_match() function to our DH, DSA, RSA and EC_KEY implRichard Levitte
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11158)
2020-03-02EVP: Add support for copying provided EVP_PKEYsRichard Levitte
This adds evp_keymgmt_util_copy() and affects EVP_PKEY_copy_parameters() Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11158)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-04 01:52:57 +0000