summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2020-11-18Adapt ssltest_old to not use deprecated DH APIsMatt Caswell
There are non-deprecated replacements so we should use those instead. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Extend the auto DH testing to check DH sizesMatt Caswell
Check that the size of the DH parameters we select changes according to the size of the certificate key or symmetric cipher (if no certificate). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Add some additional test certificates/keysMatt Caswell
Add certs with 1024, 3072, 4096 and 8192 bit RSA keys Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Add a CHANGES.md entry for the "tmp_dh" functions/macrosMatt Caswell
Describe the tmp_dh deprecations, and what applications should do instead. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Add a test for the various ways of setting temporary DH paramsMatt Caswell
We support a number of different ways of setting temporary DH params. We should test that they all work correctly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Document some SSL DH related functions/macrosMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Return sensible values for some SSL ctrlsMatt Caswell
Some ctrls were always returning 0 even if they were successful. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Only disabled what we need to in a no-dh buildMatt Caswell
no-dh disables the low level API for DH. However, since we're now using the high level EVP API in most places we don't need to disable quite so much. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Implement a replacement for SSL_set_tmp_dh()Matt Caswell
The old function took a DH as a parameter. In the new version we pass an EVP_PKEY instead. Similarly for the SSL_CTX version of this function. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Remove deprecated functionality from s_serverMatt Caswell
This will be added back in by a later commit Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Disable the DHParameters config option in a no-deprecated buildMatt Caswell
This option calls SSL_set_tmp_dh() which does not exist in a no-deprecated build. We need to implement an alternative. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Remove DH usage from tls_process_cke_dheMatt Caswell
We instead set the encoded public key directly in the EVP_PKEY object. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Remove DH usage in tls_construct_server_key_exchange()Matt Caswell
We get DH related parameters directly from the EVP_PKEY instead of downgrading to a DH object first. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Avoid the use of a DH object in tls_construct_cke_dhe()Matt Caswell
There is no need for us to downgrade the EVP_PKEY into a DH object for this function so we rewrite things to avoid it. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Deprecate SSL_CTRL_SET_TMP_DH and other related ctrlsMatt Caswell
These ctrls pass around a DH object which is now deprecated, so we deprecate the ctrls themselves. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Convert TLS ServerKeyExchange processing to use an EVP_PKEYMatt Caswell
Previously we were constructing a DH object and then assigning it to an EVP_PKEY. Instead we construct an EVP_PKEY directly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Convert TLS auto DH parameters to use EVP_PKEYMatt Caswell
Previously a DH object was constructed and then assigned to an EVP_PKEY. Instead we now construct the EVP_PKEY directly instead. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18DOC: Rewrite the section on reporting errors in doc/man3/ERR_put_error.podRichard Levitte
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13320)
2020-11-18CONF: Convert one last CONFerr() to ERR_raise()Richard Levitte
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13320)
2020-11-18Simplify util/err-to-raiseRichard Levitte
There's no need to enumerate the possible {NAME}err, as they have a consistent pattern. Also, this script should not be used on the engines, as they have already converted appropriately. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13320)
2020-11-18Really deprecate the old NAMEerr() macrosRichard Levitte
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13320)
2020-11-17util/find-doc-nits: check podchecker() return valueRichard Levitte
From the Pod::Checker manual: > RETURN VALUE > podchecker returns the number of POD syntax errors found or > -1 if there were no POD commands at all found in the file. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13416)
2020-11-17util/mkrc.pl: Make sure FILEVERSION and PRODUCTVERSION have four numbersRichard Levitte
Partially fixes #13414 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13415)
2020-11-17NetBSD build fix.David Carlier
getentropy shows up wrongly as weak symbol whereas there is no support. However NetBSD 10.0 will support getrandom. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13408)
2020-11-16DOC: Fixup the description of the -x509_strict optionRichard Levitte
POD commands must always be surrounded by blank lines POD transformers read everything in paragraph mode. The following lines become *one* command, where the second line becomes part of the text of the first, including the command itself. In other words, this: =item something =item something else Translates to this in a man-page: something =item something else Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13412)
2020-11-16Fix dsa securitycheck for fips.Shane Lontis
Fixes #12627 Changed security check for DSA verification to match SP800-131Ar2 when the security strength is < 112. Fixed compilation error when using config opt 'no-fips-securitychecks' Removed TODO's from 20-test_cli_fips.t - there is no longer an TODO error. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13387)
2020-11-16Add documentation for EVP_PKEY2PKCS8/EVP_PKCS82PKEYShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13388)
2020-11-16Fixup EVP-MAC-KMAC documentationShane Lontis
Fixes #13232 Added example that shows setup of XOF. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13385)
2020-11-16REF_PRINT: cast pointer to void to avoid warningsDaniel Bevenius
Currently, when configuring OpenSSL and specifying the --strict-warnings option there are failures like the following one: crypto/bio/bio_lib.c: In function 'BIO_up_ref': include/internal/refcount.h:169:25: error: format '%p' expects argument of type 'void *', but argument 3 has type 'BIO *' {aka 'struct bio_st *'} [-Werror=format=] 169 | fprintf(stderr, "%p:%4d:%s\n", b, b->references, a) | ^~~~~~~~~~~~~ crypto/bio/bio_lib.c:185:5: note: in expansion of macro'REF_PRINT_COUNT' 185 | REF_PRINT_COUNT("BIO", a); | ^~~~~~~~~~~~~~~ include/internal/refcount.h:169:27: note: format string is defined here 169 | fprintf(stderr, "%p:%4d:%s\n", b, b->references, a) | ~^ | | | void * cc1: all warnings being treated as errors This commit adds casts to avoid the warnings. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13389)
2020-11-16Document the provider KDF API.Pauli
Fixes #11351 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13376)
2020-11-15test/endecoder_legacy_test.c: new test for legacy comparisonRichard Levitte
It checks that all of these functions have a corresponding OSSL_ENCODER implementation, and that the output is the same: - i2d_{TYPE}PrivateKey - i2d_{TYPE}PublicKey - i2d_{TYPE}params - i2d_{TYPE}_PUBKEY - PEM_write_bio_{TYPE}PrivateKey - PEM_write_bio_{TYPE}PublicKey - PEM_write_bio_{TYPE}Parameters - PEM_write_bio_{TYPE}_PUBKEY It also checks that all of these functions have a corresponding OSSL_DECODER implementation, and that the decoding result matches: - d2i_{TYPE}PrivateKey() - d2i_{TYPE}PublicKey(), - d2i_{TYPE}params(), - d2i_{TYPE}_PUBKEY(), - PEM_read_bio_{TYPE}PrivateKey() - PEM_read_bio_{TYPE}PublicKey() - PEM_read_bio_{TYPE}params() - PEM_read_bio_{TYPE}_PUBKEY() Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13262)
2020-11-14Fix SUPPORT.md for better readabilityRichard Levitte
Most of the text was duplicated, and the second copy had better section titles that made the intent more prominent. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/13398)
2020-11-14Fix a few github file referencesRichard Levitte
https://github.com/openssl/openssl/blob/master/.github/SUPPORT.md -> https://github.com/openssl/openssl/blob/master/SUPPORT.md Fixes #13396 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13397)
2020-11-13Remove -C option from x509 commandRich Salz
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13384)
2020-11-13Remove -C from dhparam,dsaparam,ecparamRich Salz
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13384)
2020-11-13BIO: Undefine UNICODE in b_addr.c to get POSIX declaration of gai_strerror()Richard Levitte
When UNICODE is defined, Windows headers push for WCHAR implementations, which aren't compatible with POSIX declarations. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13318)
2020-11-13crypto/provider_core.c: fix a couple of faulty ERR_raise_data() callsRichard Levitte
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13318)
2020-11-13CRYPTO: refactor ERR_raise()+ERR_add_error_data() to ERR_raise_data()Richard Levitte
This is not done absolutely everywhere, as there are places where the use of ERR_add_error_data() is quite complex, but at least the simple cases are done. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13318)
2020-11-13Convert all {NAME}err() in crypto/ to their corresponding ERR_raise() callRichard Levitte
This includes error reporting for libcrypto sub-libraries in surprising places. This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13318)
2020-11-13EVP: Adapt EVP_PKEY2PKCS8() to better handle provider-native keysRichard Levitte
It doesn't downgread the keys to legacy any more. Instead, it uses OSSL_ENCODER to encode the key to DER, and d2i_PKCS8_PRIV_KEY_INFO() to make a PKCS8_PRIV_KEY_INFO structure from that. Fixes #12990 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12995)
2020-11-13DragonFlyBSD build fix and update.David Carlier
getentropy call is not supported however getrandom since the 5.7.x branch is. current LTS stable is 5.8. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13375)
2020-11-13Remove unused helper functions EVP_str2ctrl() & EVP_hex2ctrl().Shane Lontis
These were added when the EVP_MAC work was being done. I dont think these lightweight wrappers are required, and it seems better to remove them, rather than adding documentation. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13372)
2020-11-12[test/recipes] Split test_fuzz into separate recipesNicola Tuveri
When using `HARNESS_JOBS` to run the tests in parallel, no matter the level of parallelism that can be used, the monolithic `test_fuzz` takes a long time to run, conditioning the duration of the whole build. This commit splits the single `test_fuzz` recipe into separate recipes for each fuzzer. The previous mechanism to select individual fuzz tests using the `FUZZ_TESTS` environment variable is also dropped (and documentation updated). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13307)
2020-11-12Optimize AES-XTS mode in OpenSSL for aarch64XiaokangQian
Aes-xts mode can be optimized by interleaving cipher operation on several blocks and loop unrolling. Interleaving needs one ideal unrolling factor, here we adopt the same factor with aes-cbc, which is described as below: If blocks number > 5, select 5 blocks as one iteration,every loop, decrease the blocks number by 5. If left blocks < 5, treat them as tail blocks. Detailed implementation has a little adjustment for squeezing code space. With this way, for small size such as 16 bytes, the performance is similar as before, but for big size such as 16k bytes, the performance improves a lot, even reaches to 2x uplift, for some arches such as A57, the improvement even reaches more than 2x uplift. We collect many performance datas on different micro-archs such as thunderx2, ampere-emag, a72, a75, a57, a53 and N1, all of which reach 0.5-2x uplift. The following table lists the encryption performance data on aarch64, take a72, a75, a57, a53 and N1 as examples. Performance value takes the unit of cycles per byte, takes the format as comparision of values. List them as below: A72: Before optimization After optimization Improve evp-aes-128-xts@16 8.899913518 5.949087263 49.60% evp-aes-128-xts@64 4.525512668 3.389141845 33.53% evp-aes-128-xts@256 3.502906908 1.633573479 114.43% evp-aes-128-xts@1024 3.174210419 1.155952639 174.60% evp-aes-128-xts@8192 3.053019303 1.028134888 196.95% evp-aes-128-xts@16384 3.025292462 1.02021169 196.54% evp-aes-256-xts@16 9.971105023 6.754233758 47.63% evp-aes-256-xts@64 4.931479093 3.786527393 30.24% evp-aes-256-xts@256 3.746788153 1.943975947 92.74% evp-aes-256-xts@1024 3.401743802 1.477394648 130.25% evp-aes-256-xts@8192 3.278769327 1.32950421 146.62% evp-aes-256-xts@16384 3.27093296 1.325276257 146.81% A75: Before optimization After optimization Improve evp-aes-128-xts@16 8.397965173 5.126839098 63.80% evp-aes-128-xts@64 4.176860631 2.59817764 60.76% evp-aes-128-xts@256 3.069126585 1.284561028 138.92% evp-aes-128-xts@1024 2.805962699 0.932754655 200.83% evp-aes-128-xts@8192 2.725820131 0.829820397 228.48% evp-aes-128-xts@16384 2.71521905 0.823251591 229.82% evp-aes-256-xts@16 11.24790935 7.383914448 52.33% evp-aes-256-xts@64 5.294128847 3.048641998 73.66% evp-aes-256-xts@256 3.861649617 1.570359905 145.91% evp-aes-256-xts@1024 3.537646797 1.200493533 194.68% evp-aes-256-xts@8192 3.435353012 1.085345319 216.52% evp-aes-256-xts@16384 3.437952563 1.097963822 213.12% A57: Before optimization After optimization Improve evp-aes-128-xts@16 10.57455446 7.165438012 47.58% evp-aes-128-xts@64 5.418185447 3.721241202 45.60% evp-aes-128-xts@256 3.855184592 1.747145379 120.66% evp-aes-128-xts@1024 3.477199757 1.253049735 177.50% evp-aes-128-xts@8192 3.36768104 1.091943159 208.41% evp-aes-128-xts@16384 3.360373443 1.088942789 208.59% evp-aes-256-xts@16 12.54559459 8.745489036 43.45% evp-aes-256-xts@64 6.542808937 4.326387568 51.23% evp-aes-256-xts@256 4.62668822 2.119908754 118.25% evp-aes-256-xts@1024 4.161716505 1.557335554 167.23% evp-aes-256-xts@8192 4.032462227 1.377749511 192.68% evp-aes-256-xts@16384 4.023293877 1.371558933 193.34% A53: Before optimization After optimization Improve evp-aes-128-xts@16 18.07842135 13.96980808 29.40% evp-aes-128-xts@64 7.933818397 6.07159276 30.70% evp-aes-128-xts@256 5.264604704 2.611155744 101.60% evp-aes-128-xts@1024 4.606660117 1.722713454 167.40% evp-aes-128-xts@8192 4.405160115 1.454379201 202.90% evp-aes-128-xts@16384 4.401592028 1.442279392 205.20% evp-aes-256-xts@16 20.07084054 16.00803726 25.40% evp-aes-256-xts@64 9.192647294 6.883876732 33.50% evp-aes-256-xts@256 6.336143161 3.108140452 103.90% evp-aes-256-xts@1024 5.62502952 2.097960651 168.10% evp-aes-256-xts@8192 5.412085608 1.807294191 199.50% evp-aes-256-xts@16384 5.403062591 1.790135764 201.80% N1: Before optimization After optimization Improve evp-aes-128-xts@16 6.48147613 4.209415473 53.98% evp-aes-128-xts@64 2.847744115 1.950757468 45.98% evp-aes-128-xts@256 2.085711968 1.061903238 96.41% evp-aes-128-xts@1024 1.842014669 0.798486302 130.69% evp-aes-128-xts@8192 1.760449052 0.713853939 146.61% evp-aes-128-xts@16384 1.760763546 0.707702009 148.80% evp-aes-256-xts@16 7.264142817 5.265970454 37.94% evp-aes-256-xts@64 3.251356212 2.41176323 34.81% evp-aes-256-xts@256 2.380488469 1.342095742 77.37% evp-aes-256-xts@1024 2.08853022 1.041718215 100.49% evp-aes-256-xts@8192 2.027432668 0.944571334 114.64% evp-aes-256-xts@16384 2.00740782 0.941991415 113.10% Add more XTS test cases to cover the cipher stealing mode and cases of different number of blocks. CustomizedGitHooks: yes Change-Id: I93ee31b2575e1413764e27b599af62994deb4c96 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11399)
2020-11-12apps/passwd: remove the -crypt option.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13313)
2020-11-12rsa_test: add return value checkPauli
Fixes #13361 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13362)
2020-11-11Do not prepend $OPENSSL_CONF_INCLUDE to absolute include pathsTomas Mraz
Also check for malloc failure and do not add '/' when $OPENSSL_CONF_INCLUDE already ends with directory separator. Fixes #13302 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13306)
2020-11-11Add ossl_is_absolute_path function to detect absolute pathsTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13306)
2020-11-11Avoid duplicate ends_with_dirsep functionsTomas Mraz
Refactor them into inline ossl_ends_with_dirsep function in internal/cryptlib.h. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13306)
2020-11-11test/recipes/30-test_evp_libctx.t: use fips-and-base.cnfRichard Levitte
The FIPS provider module doesn't have any encoders, the base provider is needed for that. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-29 01:44:00 +0000