summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-11-22Fix the return check of OBJ_obj2txtPW Hu
Also update OBJ_nid2obj.pod to document the possible return values. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17005) (cherry picked from commit 2349d7ba57c9327290df6f7bc18b7f0c3976ca9e)
2021-11-22d2i_PublicKey: Make it work with EC parameters in a provided keyTomas Mraz
Fixes #16989 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17065) (cherry picked from commit 615a9b8798e6ec58f1b2e1ec08a0f6b3c8cb7f60)
2021-11-18perlasm/ppc-xlate.pl: Fix build on OS XMartin Schwenke
vsr2vr1() fails on OS X because the main loop doesn't strip the non-numeric register prefixes for OS X. Strip any non-numeric prefix (likely just "v") from registers before doing numeric calculation, then put the prefix back on the result. Fixes: #16995 Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17026) (cherry picked from commit e67edf60f2e9be6e5f5465b52d01aa26bf715280)
2021-11-1780-test_cmp_http: Make server diagnostics more verbose to aid debuggingDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16051)
2021-11-17cmp_server.c: Log received request type before checking detailsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16051)
2021-11-17Fix verbosity of CMP client diagnosticsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16051)
2021-11-17Add documentation for some of the missing environment variables.Pauli
Where document already exists, it has been linked to. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/17044) (cherry picked from commit 7f6496275157f8e40f544f75a223c2c0dc6b389e)
2021-11-16BIO_read_filename: fix return checkPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17033) (cherry picked from commit e3f0362407f6f40e413d6dcb35888514dbaed6f8)
2021-11-16EVP_PKEY_keygen_init: fix return checkPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17031) (cherry picked from commit bf4ceeded1497c79e72fba4f9ff15febae58108d)
2021-11-16EVP_PKEY_paramgen_init: fix return checkPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17030) (cherry picked from commit 6e0b05f3008a3f22105fd2bed9314b0bfa381f93)
2021-11-16EVP_DigestVerifyFinal: fix test function and invocationPeiwei Hu
Signed-off-by: Peiwei Hu <jlu.hpw@foxmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17029) (cherry picked from commit e2e5e72d5aec4d8d633cc5e9930f762da7973ab6)
2021-11-16EVP_Cipher: fix the incomplete return checkPeiwei Hu
Signed-off-by: Peiwei Hu <jlu.hpw@foxmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17027) (cherry picked from commit 6d774732517f1d63b7999c5691fc0bf046023faf)
2021-11-16Add a test for creating ECX private keys that are too shortMatt Caswell
We expect attempting to create such short keys to fail Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17041) (cherry picked from commit 8c08c8b37cab0eb66ca74fc65a40af3ccec77c00)
2021-11-16Don't create an ECX key with short keysMatt Caswell
If an ECX key is created and the private key is too short, a fromdata call would create the key, and then later detect the error and report it after freeing the key. However freeing the key was calling OPENSSL_secure_clear_free() and assuming that the private key was of the correct length. If it was actually too short this will write over memory that it shouldn't. Fixes #17017 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17041) (cherry picked from commit 50938aec35fd57fb3bec707ead2eee381fcfaf04)
2021-11-16RAND_bytes_ex: fix return checkPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17032) (cherry picked from commit c9007bda79291179ed2df31b3dfd9f1311102847)
2021-11-15Clarify the PEM docsMatt Caswell
Make it clear how the existing PEM functions can be used to create an X509, X509_REQ or X509_CRL object with an associated libctx/propq. Fixes #16966 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17012) (cherry picked from commit e48fe798409eb22f067f635c62b9a72e18cd4347)
2021-11-15Reset the rwstate before calling ASYNC_start_job()Matt Caswell
If an async job pauses while processing a TLS connection then the rwstate gets set to SSL_ASYNC_PAUSED. When resuming the job we should reset the rwstate back to SSL_NOTHING. In fact we can do this unconditionally since if we're about to call ASYNC_start_job() then either we are about to start the async job for the first time (in which case the rwstate should already by SSL_NOTHING), or we are restarting it after a pause (in which case reseting it to SSL_NOTHING is the correct action). Fixes #16809 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17013) (cherry picked from commit 07f620e3acf0dd76a3a03ada9911c544aa483aa7)
2021-11-15Extend the test_multi_load() testMatt Caswell
Run more threads and load the legacy provider (which uses a child lib ctx) in order to hit more possible thread failures. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Hold the flag_lock when calling child callbacksMatt Caswell
Not holding the flag lock when creating/removing child providers can confuse the activation counts if the parent provider is loaded/unloaded at the same time. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Use a write lock during ossl_provider_find()Matt Caswell
A "find" operation on a stack can end up sorting the underlying stack. In this case it is necessary to use a "write" lock to synchronise access to the stack across multiple threads. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Correctly activate the provider in OSSL_PROVIDER_try_loadMatt Caswell
If during OSSL_PROVIDER_try_load() we attempt to load a provider, but adding to the store gives back a different provider, then we need to ensure this different provider has its activation count increased. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Stop receiving child callbacks in a child libctx when appropriateMatt Caswell
We should stop receiving child callbacks if we're about to free up the child libctx. Otherwise we can get callbacks when the libctx is half freed up. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Don't bail out during provider deactivation if we don't have storeMatt Caswell
A provider may have been activated, but failed when being added to the store. At this point we still need to deactivate it. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Don't try and do ossl_provider_find in ossl_provider_newMatt Caswell
We leave it to the caller to confirm that the provider does not exist in the store. If it does exist then later adding it to the store will fail. It is possible that the provider could be added to the store in between the caller checking, and the caller calling ossl_provider_new. We leave it to the caller to properly handle the failure when it attempts to add the provider to the store. This is simpler than having ossl_provider_new try to handle it. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Remove the isinited variable from child_prov_globalsMatt Caswell
This variable might have made sense at some point but it not longer does so. It was being used to check whether we are still initing or not. If we are still initing then the assumption was that we already hold the lock. That assumption was untrue. We need to always take the lock. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Avoid a race in init_thread_stop()Matt Caswell
init_thread_stop() is called when a thread is stopping. It calls all the callbacks that need to know about the demise of this thread. However, the list of callbacks is also available globally and may be updated by other threads so we need to make sure we use the right lock. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Don't attempt to deactive child providers if we don't need toMatt Caswell
If a provider doesn't have any child providers then there is no need to attempt to remove them - so we should not do so. This removes some potentialy thread races. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Don't write to the globals ossl_property_true and ossl_property_falseMatt Caswell
These global variables were previously overwritten with the same value every time we created a new OSSL_LIB_CTX. Instead we preinitialise them with the correct values, and then confirm that settings for each OSSL_LIB_CTX agree with the preinitialised values. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Add null digest implementation to the default providerTomas Mraz
This is necessary to keep compatibility with 1.1.1. Fixes #16660 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17016) (cherry picked from commit bef9b48e5071cdd2b41a4f486d1bcb5e14b2a5c3)
2021-11-12doc: Document outcome of multiple digestsign/digestverify callsTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16964) (cherry picked from commit 3641f04fb06e9679a67da113bab65e5f1bb5e9ba)
2021-11-12evp_extra_test: Add SIPHASH MAC digestsign test with reinitializationTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16964) (cherry picked from commit 8cbfc4f67b4e97d423ab4784dbbb54d454c6342a)
2021-11-12providers: Allow possible reinitialization in all signature algorithmsTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16964) (cherry picked from commit 3ffd23e9529d725903bc97fd45489a77b831876f)
2021-11-12test: Add testing of reinitialization via EVP_DigestSignInit()Tomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16964) (cherry picked from commit 816f72d08834ee35ba2615f624b4a29f2717d1c7)
2021-11-12do_sigver_init: Allow reinitialization of an existing operation.Tomas Mraz
Fixes #16936 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16964) (cherry picked from commit ae6b68b761b9c5f30897747487ea943ccfab53ba)
2021-11-12Fix return value checking of BN_check_prime invocationsPW Hu
Negative return value indicates an error so we bail out. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16975) (cherry picked from commit 680827a15f12c3b37a6335fcb992555cf300730e)
2021-11-12Add return value NULL checks that were missingPauli
Issues located by Brian Carpenter of Geeknik's Farm. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17007) (cherry picked from commit ed5b26ce0b34ec00bdd53d15854a22bccbb4d415)
2021-11-09Fix sigsize usage in apps/speed.cXiaofei Bai
In a recent upstream change (43da9a14f0e73f42f28ae34219929b44df5d1a11) the parameter sigsize become a read/write input in EVP_PKEY_sign(), and after signing, sigsize will be overwritten with the actual size and used in the verify step. As the speed program calls EVP_PKEY_sign() on the same context repeatedly, sigsize value is no longer the initial available size, and may fail in later buffer size checks. This fix adds a new buflen member in struct loopargs (which is only used within apps/speed.c), to save available buffer size and to be used as sigsize input in EVP_PKEY_sign() calls. Sigsize still contains the signature size for the verify step. Signed-off-by: Xiaofei Bai <xiaofei.bai@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16991) (cherry picked from commit e7414634a59aa61c7917193a31382ced95d40eeb)
2021-11-09Fix: invoking X509_self_signed improperlyPW Hu
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16976) (cherry picked from commit 64c428c35053a101a452c42d5d0a9a8342493606)
2021-11-09Fix DER encoder implementations for output structures "EC" and "SM2"Richard Levitte
These DER encoder implementations are supposed to be aliases for the "type-specific" output structure, but were made different in so far that they would output a "type specific" public key, which turns out to be garbage (it called i2o_ECPublicKey()). The "type-specific" output structure doesn't support that, and shouldn't. Fixes #16977 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16983)
2021-11-09Fix: invoking x509_name_cannon improperlyPW Hu
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16974) (cherry picked from commit 09235289c377ff998964bb6b074bb2a3ad768fd2)
2021-11-08APPS/x509: Fix generation of AKID via v2i_AUTHORITY_KEYID()Dr. David von Oheimb
Fixes #16300 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16442) (cherry picked from commit 9bf1061c44c81059102cd4749f6078b6ce71da9d)
2021-11-08KTLS: use EVP_CIPHER_is_a instead of nidTianjia Zhang
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/16963)
2021-11-08Fix errors in EVP_PKEY_fromdata examplesMatt Caswell
The EVP_PKEY_fromdata man page has some code examples with various errors in them. This fixes those errors. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16973) (cherry picked from commit 4ce64ed79d301939c7f2844a9e5e5fdd2033605f)
2021-11-08Fix data race setting `default_DSO_meth`Pauli
The global variable `default_DSO_meth` was potentially set multiple times by different threads. It turns out that it could only be set to a single value so the race is harmless but still better avoided. The fix here simply removes the global and accesses the value it was set to via the `DSO_METHOD_openssl()` call. Problem discovered via #16970, but this does not resolve that issue because there are other concerns. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16972) (cherry picked from commit e6a10b074e90f1ce3d8e9ae0ca740a835ff29bb9)
2021-11-08Address Coverity 1493362 resource leakPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16962) (cherry picked from commit 1b4d9967a24154f1dc00f471eb843203ec7bb7d4)
2021-11-08Address coverity 1493382 argument cannot be negativePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16962) (cherry picked from commit fe4125382301201e42a3251544cda429bba0c9d7)
2021-11-08Address Coverity 1493387 Logically dead codePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16962) (cherry picked from commit 182cc644b3a3690bddfecba925486fefa421d6ec)
2021-11-08Fix coverity 1493364 & 1493375: unchecked return valuePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16962) (cherry picked from commit 73a815defe428e42ccc27fdc9d5be507f980278b)
2021-11-08Fix incorrect return check of BN_bn2binpadPW Hu
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16942) (cherry picked from commit 098f2627c8d283a518a6e6e60e7893664c7510e0)
2021-11-07avoid a NULL dereference when getting digestPauli
Fixes #16961 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/16969) (cherry picked from commit ab547fc005307ecf48451638e947cdabca147159)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-21 21:13:37 +0000