summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-05-05Note that dhparam does support X9.42Rich Salz
Fix other wording, too. Fixes: #13151 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15038)
2021-05-05cleanup where purpose is not needed in 25-test_verify.tDr. David von Oheimb
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14413)
2021-05-05test/certs/setup.sh: Fix two glitchesDr. David von Oheimb
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14413)
2021-05-05update test/certs/ee-pathlen.pem to contain SKID and AKIDDr. David von Oheimb
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14413)
2021-05-05test/certs/setup.sh: structural cleanupDr. David von Oheimb
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14413)
2021-05-05Fetch cipher-wrap after loading providers.Rich Salz
Use official (first) names for wrapping algorithms. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14182)
2021-05-05Fix KMAC bounds checks.Shane Lontis
Setting an output length higher than 8191 was causing a buffer overflow. This was reported by Acumen (FIPS lab). The max output size has increased to ~2M and it now checks this during set_parameters. The encoder related functions now pass in the maximum size of the output buffer so they can correctly check their size. kmac_bytepad_encode_key() calls bytepad twice in order to calculate and check the length before encoding. Note that right_encode() is currently only used in one place but this may change if other algorithms are supported (such as TupleHash). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15106)
2021-05-05Bump HMAC_MAX_MD_CBLOCK to 200 due to SHA-3Tomas Mraz
The maximum (theoretical) block size of SHA3 is 200 bytes. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15125)
2021-05-05DOCS: Mention that libcrypto has helper functions for OSSL_PARAMsRichard Levitte
Fixes #11165 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15073)
2021-05-04HTTP client: Correct the use of optional proxy URL and its documentationDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15104)
2021-05-04testutil/load.c: Add checks for file(name) == NULLDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15120)
2021-05-04BIO_eof() and OSSL_STORE_eof(): Make sure to return 1 on error; improve ↵Dr. David von Oheimb
related doc Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04OSSL_DECODER_from_bio() Prevent spurious decoding error at EOFDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04APPS load_key_certs_crls(): Correct the 'expect' arg calculation for ↵Dr. David von Oheimb
OSSL_STORE_expect() Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04OSSL_STORE_expect(): Improve error handling and documentationDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04OCSP: Minor improvements of documentation and header fileDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15103)
2021-05-04fips-checksums: The define for fips module is FIPS_MODULETomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15132)
2021-05-04Document the new core BIO public API supportMatt Caswell
Fixes #14409 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15072)
2021-05-04Add a test for the public core bio APIMatt Caswell
Check that reading/writing to a core bio via BIO_new_from_core_bio() works as expected. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15072)
2021-05-04Create libcrypto support for BIO_new_from_core_bio()Matt Caswell
Previously the concept of wrapping an OSSL_CORE_BIO in a real BIO was an internal only concept for our own providers. Since this is likely to be generally useful, we make it a part of the public API. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15072)
2021-05-04Run coveralls daily and not exactly at midnightTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15121)
2021-05-04coveralls: Enable fips as it is disabled by defaultTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15121)
2021-05-04apps: Switch to X509_REQ_verify_exPetr Gotthard
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15118)
2021-05-04test: fix failure with FIPS and no-des configured.Pauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15105)
2021-05-04APPS: Add passphrase handling in the "rsa" and "dsa" commandsRichard Levitte
They completely ignored any passphrase related setting. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15119)
2021-05-04APPS: Set a default passphrase UI for the "ec" commandRichard Levitte
Fixes #15114 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15119)
2021-05-04[TEMPORARY] make 'make update' verbose in ci.ymlRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
2021-05-04GitHub CI: ensure that unifdef is installedRichard Levitte
This is required for 'make update' and fips checksums Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
2021-05-04FIPS module checksums: add scripts and Makefile ruleRichard Levitte
This adds the following scripts: util/lang-compress.pl: Compress source code, which language is determined by the first argument. For the moment, we know 'perl' (perlasm source code), 'C' (C source code) and 'S' (Assembler with C preprocessor directives). This removes comments and empty lines, and compresses series of horizontal spaces to one single space in the languages where that's appropriate. util/fips-checksums.sh: Takes source file names as arguments, pushes them through util/lang-compress.pl and unifdef with FIPS_MODE defined, and calculates the checksum on the result. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
2021-05-04Unix build file: Add a target to create providers/fips.module.sourcesRichard Levitte
This file will be the basis for the FIPS module checksum calculation Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
2021-05-04Add OpenSSL::Config::Query and use it in configdata.pmRichard Levitte
OpenSSL::Config::Query is a configuration querying tool that's meant to make it easier to query the diverse configuration data for info. That's much easier than to dig through all the parts of %unified_info. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8871)
2021-05-04Windows build file: add forgotten quotes on POD->html command lineRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15084)
2021-05-04OpenSSL::Test: When prefixing command with $^X on Windows, fix it up!Richard Levitte
The perl interpreter name itself might contain spaces and need quoting. __fixup_prg() does this for us. Fixes #14256 Co-authored-by: Tomáš Mráz <tomas@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15084)
2021-05-02acvp-test: disable the ACVP testing code by defaultPauli
It's only useful for the FIPS lab and shouldn't be in production. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15092)
2021-05-01ssl: fix possible ref counting fields use before init.FdaSilvaYY
`strdup(propq)` failure is doing a `goto err;` from where `SSL_CTX_free` is called. The possible call is made before reference and lock fields setup. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15052)
2021-05-01man: s_server: fix text repetition in -alpn descriptionHubert Kario
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15099)
2021-05-01APPS: Document the core of the opt_ APIRich Salz
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/14995)
2021-05-01Use OCSP-specific error code for clarityDmitry Belyavskiy
Fixes #12735 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/xxxxx)
2021-05-01Simplify AppVeyor configurationTomas Mraz
Adjust the stuff we are building and testing in various configurations to trim the run time a little bit. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15087)
2021-05-01Add -latomic to threads enabled 32bit linux buildsTomas Mraz
It might not be necessary with the most recent toolchain versions but apparently many 32bit linux architectures and commonly used toolchain versions require this. It is also harmless to include even on architectures that do not need it. Fixes #14083 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15086)
2021-05-01Fix no-fips-securitychecks test failureShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15091)
2021-04-30apps/ca,req,x509: Switch to EVP_DigestSignInit_exPetr Gotthard
Switch lib/apps.c do_sign_init() to use EVP_DigestSignInit_ex, so it works with external providers. Since EVP_DigestSignInit_ex requires a digest name instead of an EVP_MD pointer, the apps using do_sign_init() had to be modified to pass char* instead of EVP_MD*. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15014)
2021-04-30Fix typo in OSSL_DECODER_CTX_set_input_structureDaniel Bevenius
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15085)
2021-04-30STORE: Fix the repeated prompting of passphraseRichard Levitte
OSSL_STORE's loading function could prompt repeatedly for the same passphrase. It turns out that OSSL_STORE_load() wasn't caching the passphrase properly. Fixed in this change. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15064)
2021-04-30SM2 signatures work correctly only with SM3 digestsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15074)
2021-04-30sm2: Cleanup handling of DIGEST and DIGEST_SIZE parametersTomas Mraz
Fixes #14873 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15074)
2021-04-30CORE: Rework the pre-population of the namemapRichard Levitte
The pre-population of names has become more thorough. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15066)
2021-04-30STORE: Use the 'expect' param to limit the amount of decoders usedRichard Levitte
In the provider file: scheme loader implementation, the OSSL_DECODER_CTX was set up with all sorts of implementations, even if the caller has declared a limited expectation on what should be loaded, which means that even though a certificate is expected, all the diverse decoders to produce an EVP_PKEY are added to the decoding change. This optimization looks more closely at the expected type, and only adds the EVP_PKEY related decoder implementations to the chain if there is no expectation, or if the expectation is one of OSSL_STORE_INFO_PARAMS, OSSL_STORE_INFO_PUBKEY, OSSL_STORE_INFO_PKEY. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15066)
2021-04-30acvp: fix the no-acvp_test buildPauli
A pair of the disabled string checks were incorrect. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15082)
2021-04-30Update OSSL_STORE_attach() documentation to indicate it increases the ↵Shane Lontis
ref_count of the passed in bio Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15058)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-30 23:53:56 +0000