summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-05-08apps/mac: avoid need for two ^D when using stdin from a terminalPauli
Fixes #13246 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15189)
2021-05-08apps: remove initial newline from mac outputPauli
Fixes #13247 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15189)
2021-05-08apps: add mac, cipher and digest arguments to the kdf applet.Pauli
This adds -digest, -mac and -cipher which correspond to -kdfopt digest: and -kdfopt mac: and -kdfopt cipher: respectively. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15190)
2021-05-08Remove unused code from the fips moduleShane Lontis
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15167)
2021-05-08bn: Add fixed length (n=6), unrolled PPC Montgomery MultiplicationMartin Schwenke
Overall improvement for p384 of ~18% on Power 9, compared to existing Power assembling code. See comment in code for more details. Multiple unrolled versions could be generated for values other than 6. However, for TLS 1.3 the only other ECC algorithms that might use Montgomery Multiplication are p256 and p521, but these have custom algorithms that don't use Montgomery Multiplication. Non-ECC algorithms are likely to use larger key lengths that won't fit into the n <= 10 length limitation of this code. Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Signed-off-by: Alastair D'Silva <alastair@d-silva.org> Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15175)
2021-05-08BIO_printf.pod: Clarify that output is always null terminated.Scott McPeak
The original text was ambiguous about termination for errors other than insufficient space. See issue #14772. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15000)
2021-05-07FIPS checksum updatePauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15042)
2021-05-07provider: use a read lock when looking for a providerPauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15042)
2021-05-07doc: document the new ossl_provider_clear_all_operation_bits() functionPauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15042)
2021-05-07test: add a provider load/unload cache flush test.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15042)
2021-05-07provider: flush the store cache when providers are loaded/unloaded.Pauli
When the providers change, the method cache needs to be flushed. This also impacts the cache is full partial flushes and the algorithm flushing by ID. A new function is introduced to clear all of the operation bits in all providers in a library context. Fixes #15032 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15042)
2021-05-07Updated gost-engine to latest commit from master branchTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15180)
2021-05-07Unify parameter types in documentationTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15178)
2021-05-07Fixes #14662. Return all EC parameters even for named curvesJon Spillett
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15060)
2021-05-07Fixes #15070. Allow custom algorithm ID ASN.1 encoding for provided ciphersJon Spillett
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15130)
2021-05-07make updateRichard Levitte
The impact on the FIPS checksum files is pretty significant Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15171)
2021-05-07Drop libimplementations.aRichard Levitte
libimplementations.a was a nice idea, but had a few flaws: 1. The idea to have common code in libimplementations.a and FIPS sensitive helper functions in libfips.a / libnonfips.a didn't catch on, and we saw full implementation ending up in them instead and not appearing in libimplementations.a at all. 2. Because more or less ALL algorithm implementations were included in libimplementations.a (the idea being that the appropriate objects from it would be selected automatically by the linker when building the shared libraries), it's very hard to find only the implementation source that should go into the FIPS module, with the result that the FIPS checksum mechanism include source files that it shouldn't To mitigate, we drop libimplementations.a, but retain the idea of collecting implementations in static libraries. With that, we not have: libfips.a Includes all implementations that should become part of the FIPS provider. liblegacy.a Includes all implementations that should become part of the legacy provider. libdefault.a Includes all implementations that should become part of the default and base providers. With this, libnonfips.a becomes irrelevant and is dropped. libcommon.a is retained to include common provider code that can be used uniformly by all providers. Fixes #15157 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15171)
2021-05-07Rename files in providers/implementations/signaturesRichard Levitte
It was discovered that eddsa.c exist in two places, here and in crypto/ec/curve448/, which would result in a file name clash if they ever end up in the same library. To mitigate, we rename the copy in providers/implementations/signatures to have '_sig' in the file name, and do the same with all other source files in this directory, for consistency. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15171)
2021-05-07changes: add note about application output formatting differences.Pauli
Fixes #13220 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15168)
2021-05-06Avoid sending alerts after shutdownDmitry Belyavskiy
Fixes #11388 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15159)
2021-05-06Fix NULL dereference when ENCODER does not implement IMPORT_OBJECTPetr Gotthard
External ENCODER may not implement OSSL_FUNC_ENCODER_IMPORT_OBJECT, so a check for NULL is needed. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14919)
2021-05-06evp_extra_test: Avoid potential double free of paramsTomas Mraz
Fixes #14916 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15135)
2021-05-06Clarify where dispatch functions/ids are definedDaniel Bevenius
When reading the comment for ossl_dispatch_st it seems to indicate that the function_id numbers are defined further down in the same file. But I was not able to find them there, but instead in core_dispatch.h. This commit suggests updating the comment to point to core_dispatch.h Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15156)
2021-05-06Clarify two comments (typos) in fipsprov.cDaniel Bevenius
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15150)
2021-05-06Prepare for 3.0 alpha 17Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-05-06Prepare for release of 3.0 alpha 16openssl-3.0.0-alpha16Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-05-06Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15181)
2021-05-06Update the FIPS checksumsMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15177)
2021-05-06Add some tests for -inform/keyform enforcementTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15100)
2021-05-06Document the behavior of the -inform and related optionsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15100)
2021-05-06provider-storemgmt: Document the input-type and properties parameters.Tomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15100)
2021-05-06Update gost-engine to make it compatible with the added paramsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15100)
2021-05-06Make the -inform option to be respected if possibleTomas Mraz
Add OSSL_STORE_PARAM_INPUT_TYPE and make it possible to be set when OSSL_STORE_open_ex() or OSSL_STORE_attach() is called. The input type format is enforced only in case the file type file store is used. By default we use FORMAT_UNDEF meaning the input type is not enforced. Fixes #14569 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15100)
2021-05-06try to document changes in salt handling for the 'enc' commandEasySec
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4486)
2021-05-06change salt handling, way 1EasySec
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4486)
2021-05-06coverity: fix 1478169: dereference after NULL checkPauli
The code path shouldn't occur in our code but could in an application. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15128)
2021-05-06Remove all trace of FIPS_mode functionsRich Salz
Removed error codes, and the mention of the functions. This removal is already documented in the CHANGES doc. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15140)
2021-05-05Deprecate X509{,_CRL}_http_nbio() and simplify their definitionDr. David von Oheimb
This is done by making use of OCSP_REQ_CTX_nbio_d2i(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15131)
2021-05-05APPS: Replace 'OPT_ERR = -1, OPT_EOF = 0, OPT_HELP' by OPT_COMMON macroDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15111)
2021-05-05APPS: Slightly extend and improve documentation of the opt_ APIDr. David von Oheimb
Also remove redundant opt_name() and make names of opt_{i,u}ntmax() consistent. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15111)
2021-05-05adapt tests to SSL_OP_LEGACY_SERVER_CONNECT changeBenjamin Kaduk
The "bad DTLS" tests run into trouble due to the special behavior for that "bad" version, and the SSL record tests need to set the -legacy_server_connect flag to allow an SSLv2 ClientHello to work against any TLS server (since SSLv2 ClientHello messages cannot carry extensions as would be needed in order to negotiate the use of the renegitiation_info extension). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15127)
2021-05-05Correct ssl_conf logic for "legacy_server_connect"Benjamin Kaduk
This option is only useful for the client, but it was previously marked as only being applicable for servers. Correct the entry to properly mark it as client-only, and update the s_server/s_client manuals accordingly. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15127)
2021-05-05Enforce secure renegotiation support by defaultBenjamin Kaduk
Previously we would set SSL_OP_LEGACY_SERVER_CONNECT by default in SSL_CTX_new(), to allow connections to legacy servers that did not implement RFC 5746. It has been more than a decade since RFC 5746 was published, so there has been plenty of time for implmentation support to roll out. Change the default behavior to be to require peers to support secure renegotiation. Existing applications that already cleared SSL_OP_LEGACY_SERVER_CONNECT will see no behavior change, as re-clearing the flag is just a little bit of redundant work. The old behavior is still available by explicitly setting the flag in the application. Also remove SSL_OP_LEGACY_SERVER_CONNECT from SSL_OP_ALL, for similar reasons. Document the behavior change in CHANGES.md, and update the SSL_CTX_set_options() and SSL_CONF_cmd manuals to reflect the change in default behavior. Fixes: 14848 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15127)
2021-05-05Fix missing symbols in no-cms and no-ts buildTomas Mraz
Fixes #15137 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15138)
2021-05-05mac: add EVP_MAC_finalXOF() functionPauli
Fixes #14140 Fixes #13232 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15061)
2021-05-05mac: allow XOF MACs to be specified either via control or via the dedicated ↵Pauli
function Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15061)
2021-05-05mac: update life-cycle description and diagrams to include finalXOFPauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15061)
2021-05-05doc: document EVP_MAC_finalXOF()Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15061)
2021-05-05Add .includedir pragmaRich Salz
Also add a negative test, and fix typo's. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15090)
2021-05-05Allow absolute paths to be setRich Salz
It was a mistake to allow relative paths for include files (just like root shouldn't have "." in its PATH), but we probably can't change it now. Add a new pragma "abspath" that someone can put in the system-wide config file to require absolute paths. Also update the config documentation to better explain how file inclusion works. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15090)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-11 09:53:07 +0000