summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2019-12-04util/mkerr.pl: don't stop reading conserved symbols from the state fileRichard Levitte
If we don't read them, they will not be conserved. Fixes #10522 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10549)
2019-12-04configdata.pm.in: Don't try to quotify undefined valuesRichard Levitte
Fixes #10503 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10548)
2019-12-03Update NOTES.ANDROID for newer NDK versions + small fixes.zero
Fixes #8941 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10478)
2019-12-03Set argument only after successful dup on CMP APIsraja-ashok
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/10511)
2019-12-01Fix typos in fipsinstall testDr. Matthias St. Pierre
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10506)
2019-11-29util/find-doc-nits: ignore macros ending in _fnsigRichard Levitte
These are helper macros alongside the IMPLEMENT_ and DECLARE_ macros. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29util/find-doc-nits: limit the prototype checkRichard Levitte
The prototype checks shouldn't be performed on SYNOPSIS lines that aren't function prototypes. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29Add NEWS and CHANGES entries about OSSL_SERIALIZERRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29TEST: add tests of text and PEM printout of a provider made keyRichard Levitte
This renames test/evp_fromdata_test.c to test/evp_pkey_provided_test.c, to encourage additional testing of provider made keys. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29PROV SERIALIZER: add support for writing DSA keys and parametersRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29PROV SERIALIZER: add support for writing DH keys and parametersRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29PROV SERIALIZER: add support for writing RSA keysRichard Levitte
This also adds the missing accessor RSA_get0_pss_params(), so those parameters can be included in the PKCS#8 data structure without needing to know the inside of the RSA structure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29PROV SERIALIZER: add common functionality to serialize keysRichard Levitte
To support generic output of public keys wrapped in a X509_PUBKEY, additional PEM and i2d/d2i routines are added for that type. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29PROV BIO: add a BIO_vprintf() upcall, and a provider BIO libraryRichard Levitte
The BIO_vprintf() will allow the provider to print any text, given a BIO supplied by libcrypto. Additionally, we add a provider library with functions to collect all the currently supplied BIO upcalls, as well as wrappers around those upcalls. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29SERIALIZER: add hooks in EVP_PKEY_print_ routinesRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29SERIALIZER: add hooks in PEM_write_bio_ and PEM_write_fp_ routinesRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29SERIALIZER: add support for serializing EVP_PKEYsRichard Levitte
The following public functions is added: - OSSL_SERIALIZER_CTX_new_by_EVP_PKEY() - OSSL_SERIALIZER_CTX_set_cipher() - OSSL_SERIALIZER_CTX_set_passphrase() - OSSL_SERIALIZER_CTX_set_passphrase_cb() - OSSL_SERIALIZER_CTX_set_passphrase_ui() OSSL_SERIALIZER_CTX_new_by_EVP_PKEY() selects a suitable serializer for the given EVP_PKEY, and sets up the OSSL_SERIALIZER_CTX to function together with OSSL_SERIALIZER_to_bio() and OSSL_SERIALIZER_to_fp(). OSSL_SERIALIZER_CTX_set_cipher() indicates what cipher should be used to produce an encrypted serialization of the EVP_PKEY. This is passed directly to the provider using OSSL_SERIALIZER_CTX_set_params(). OSSL_SERIALIZER_CTX_set_passphrase() can be used to set a pass phrase to be used for the encryption. This is passed directly to the provider using OSSL_SERIALIZER_CTX_set_params(). OSSL_SERIALIZER_CTX_set_passphrase_cb() and OSSL_SERIALIZER_CTX_set_passphrase_ui() sets up a callback to be used to prompt for a passphrase. This is stored in the context, and is called via an internal intermediary at the time of serialization. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29CORE: expose the property parsers and checker to the rest of the librariesRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29SERIALIZER: add functions for serialization to fileRichard Levitte
These functions are added: - OSSL_SERIALIZER_to_bio() - OSSL_SERIALIZER_to_fp() (unless 'no-stdio') OSSL_SERIALIZER_to_bio() and OSSL_SERIALIZER_to_fp() work as wrapper functions, and call an internal "do_output" function with the given serializer context and a BIO to output the serialized result to. The internal "do_output" function must have intimate knowledge of the object being output. This will defined independently with context creators for specific OpenSSL types. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29SERIALIZER: New API for serialization of objects through providersRichard Levitte
Serialization is needed to be able to take a provider object (such as the provider side key data) and output it in PEM form, DER form, text form (for display), and possibly other future forms (XML? JSON? JWK?) The idea is that a serializer should be able to handle objects it has intimate knowledge of, as well as object data in OSSL_PARAM form. The latter will allow libcrypto to serialize some object with a different provider than the one holding the data, if exporting of that data is allowed and there is a serializer that can handle it. We will provide serializers for the types of objects we know about, which should be useful together with any other provider that provides implementations of the same type of object. Serializers are selected by method name and a couple of additional properties: - format used to tell what format the output should be in. Possibilities could include "format=text", "format=pem", "format=der", "format=pem-pkcs1" (traditional), "format=der-pkcs1" (traditional) - type used to tell exactly what type of data should be output, for example "type=public" (the public part of a key), "type=private" (the private part of a key), "type=domainparams" (domain parameters). This also adds a passphrase callback function type, OSSL_PASSPHRASE_CALLBACK, which is a bit like OSSL_CALLBACK, but it takes a few extra arguments to place the result in. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29CORE: pass the full algorithm definition to the method constructorRichard Levitte
So far, the API level method constructors that are called by ossl_method_construct_this() were passed the algorithm name string and the dispatch table and had no access to anything else. This change gives them access to the full OSSL_ALGORITHM item, thereby giving them access to the property definition. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29CORE: ossl_namemap_add_names(): new function to add multiple namesRichard Levitte
This was originally the private add_names_to_namemap() in crypto/evp/evp_fetch.c, but made more generally useful. To make for more consistent function naming, ossl_namemap_add() and ossl_namemap_add_n() are renamed to ossl_namemap_add_name() and ossl_namemap_add_name_n(). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29Disable mem leak checking for the self test lockMatt Caswell
The fips self test lock is deallocated in platform specific ways that may occur after we do mem leak checking. If we don't know how to free it for a particular platform then we just leak it deliberately. So we temporarily disable the mem leak checking while we allocate the lock. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9939)
2019-11-29Make sure we only run the self tests onceMatt Caswell
Fixes #9909 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9939)
2019-11-29Check the return from OPENSSL_buf2hexstr()Matt Caswell
The function OPENSSL_buf2hexstr() can return NULL if it fails to allocate memory so the callers should check its return value. Fixes #10525 Reported-by: Ziyang Li (@Liby99) Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10526)
2019-11-29Check that OPENSSL_zalloc was successful when creating EVP typesMatt Caswell
We were missing a NULL check in a few very similar places following an OPENSSL_zalloc() call. Reported-by: Ziyang Li (@Liby99) Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10526)
2019-11-29Add a test for NULL chunks in encrypt/decryptMatt Caswell
Issue #8675 describes a problem where calling EVP_DecryptUpdate() with an empty chunk causes the result to be different compared to if you do not use an empty chunk. This adds a test for that case. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10530)
2019-11-29Make sure we handle input NULL with length 0Matt Caswell
If we call EVP_EncryptUpdate/EVP_DecryptUpdate with length 0 we should be able to handle it. Most importantly we shouldn't get different results if we do this compared to if we don't! An exception is made for CCM mode which has special handling for this in the low level cipher function. Fixes #8675 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10530)
2019-11-29Configure: make it possible to have generated generatorsRichard Levitte
This makes it possible to chain GENERATOR statements, which allows constructs like this: GENERATE[something.html]=something.pod GENERATE[something.pod]=something.pod.in Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6236)
2019-11-29Adapt *.tmpl to generate docs at build timeRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6236)
2019-11-29Add doc/build.info to build the documentationRichard Levitte
This build.info is entirely generated when configuring Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6236)
2019-11-29Add the possibility to generate documentation at build timeRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6236)
2019-11-29configdata.pm.in, util/dofile.pl: load 'platform' unconditionallyRichard Levitte
The 'platform' module handles defaults fine, there's no need to add extra conditions on it being loaded. Fixes #10513 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10514)
2019-11-29apps/ocsp.c: sock_timeout -> socket_timeoutRichard Levitte
It appears that 'sock_timeout' is defined at least with DJGPP, so we rename our symbol and hope the new name isn't taken. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10515)
2019-11-28Fix L<EVP_MD_CTX_set_pkey_ctx> linksmoehuster
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10420) (cherry picked from commit ca7c982821cd6d7546f92623da61a6f43ee32d0a)
2019-11-28chacha/asm/chacha-armv8.pl: preserve FP registers d8 and d9 correctlyArd Biesheuvel
Depending on the size of the input, we may take different paths through the accelerated arm64 ChaCha20 routines, each of which use a different subset of the FP registers, some of which need to be preserved and restored, as required by the AArch64 calling convention (AAPCS64) In some cases, (e.g., when the input size is 640 bytes), we call the 512 byte NEON path followed directly by the scalar path, and in this case, we preserve and restore d8 and d9, only to clobber them again immediately before handing over to the scalar path which does not touch the FP registers at all, and hence does not restore them either. Fix this by moving the restoration of d8 and d9 to a later stage in the 512 byte routine, either before calling the scalar path, or when exiting the function. Fixes #10470 CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10497)
2019-11-28Use option/parameter consistently.Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10135)
2019-11-28Document more env var stuff, fix some typo'sRich Salz
Add openssl-env.pod Also fix up many other environment page formatting nits. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10135)
2019-11-27test/cipher_overhead_test.c: build unconditionallyRichard Levitte
Build it against static libraries always, since that's the only way it can work as intended. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10516)
2019-11-27util/find-doc-nits: Better parsing of linksRichard Levitte
When checking links, we need to peal away stuff that aren't part of the link proper first. That makes it easier to check the link itself. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10507)
2019-11-27doc/man7/proxy-certificates.pod: New guide for proxy certificatesRichard Levitte
This replaces doc/HOWTO/proxy_certificates.txt Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10507)
2019-11-26Property: fix memory leak.Pauli
Coverity 1456008. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10509)
2019-11-25Cache constants for fetched EVP_cipherShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/10461)
2019-11-24Support ciphersuites using a SHA2 384 digest in FreeBSD KTLS.John Baldwin
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #10372
2019-11-24Property: fix intermittent test failure.Pauli
The reduction in the cache flush threshold in #10408 caused the stochastic test to fail with noticeable probability. Revert that part of the change. Also add a comment to help avoid this in future. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10505)
2019-11-24Remove RANDFILE settings from configuration filesDr. Matthias St. Pierre
OpenSSL 1.1.1 introduced a new CSPRNG with an improved seeding mechanism, which makes it dispensable to define a RANDFILE for saving and restoring randomness. This commit removes the RANDFILE declarations from our own configuration files and adds documentation that this option is not needed anymore and retained mainly for compatibility reasons. Fixes #10433 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10436)
2019-11-24Remove deadlock that was caused by calling pthread_rwlock_wrlock() on same ↵Matus Kysel
thread twice. This can be reproduce only with musl. CLA: trivial Signed-off-by: Matus Kysel <mkysel@tachyum.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10501)
2019-11-23Process GOST ClientKeyExchange message in SSL_traceDaniil Zotkin
Use ssl_print_hex to print message in case of GOST key exchange algorithm. CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/9995)
2019-11-22UI_UTIL_wrap_read_pem_callback(): when |cb| is NULL, use PEM_def_callbackRichard Levitte
Fixes #10444 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10447)
2019-11-22Thread: Avoid a NULL dereference after failed initialisation.Pauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10493)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-22 05:54:45 +0000