summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2020-09-10apps_ui.c: Correct handling of empty password from -passinDr. David von Oheimb
This is done in analogy to commit ca3245a61989009a99931748723d12e30d0a66b2 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12493)
2020-09-10apps_ui.c: Improve error handling and return value of setup_ui_method()Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12493)
2020-09-11Fix fipsinstall module pathShane Lontis
If a path is specified with the -module option it will use this path to load the library when the provider is activated, instead of also having to set the environment variable OPENSSL_MODULES. Added a platform specific opt_path_end() function that uses existing functionality used by opt_progname(). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12761)
2020-09-10STORE: Fix OSSL_STORE_attach() to check |ui_method| before useRichard Levitte
ossl_pw_set_ui_method() demands that the passed |ui_method| be non-NULL, and OSSL_STORE_attach() didn't check it beforehand. While we're at it, we remove the passphrase caching that's set at the library level, and trust the implementations to deal with that on their own as needed. Fixes #12830 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12831)
2020-09-10Add/harmonize multi-valued RDN support and doc of ca, cmp, req, storeutl, ↵Dr. David von Oheimb
and x509 apps Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12769)
2020-09-10X509_NAME_cmp(): Clearly document its semantics, referencing relevant RFCsDr. David von Oheimb
Fixes #12765 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12769)
2020-09-10X509_NAME_add_entry_by_txt.pod: Improve documentation w.r.t. multi-valued ↵Dr. David von Oheimb
RDNs (containing sets of AVAs) Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12769)
2020-09-10X509_NAME_cmp: restrict normal return values to {-1,0,1} to avoid confusion ↵Dr. David von Oheimb
with -2 for error Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12769)
2020-09-10X509_NAME_oneline(): Fix output of multi-valued RDNs, escaping '/' and '+' ↵Dr. David von Oheimb
in values Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12769)
2020-09-10X509_NAME_print_ex.pod: re-format lines to fit within 80 chars limitDr. David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12769)
2020-09-10app_load_config_bio(): fix crash on errorDr. David von Oheimb
It turns out that the CONF_modules_load(conf, NULL, 0) call is just wrong. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12817)
2020-09-10Fix an EVP_MD_CTX leakMatt Caswell
If we initialise an EVP_MD_CTX with a legacy MD, and then reuse the same EVP_MD_CTX with a provided MD then we end up leaking the md_data. We need to ensure we free the md_data if we change to a provided MD. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12779)
2020-09-10Diverse build.info: Adjust pathsRichard Levitte
Fixes #12815 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12816)
2020-09-10bugfix in apps/cmp.c and cmp_client.c: inconsistencies on retrieving ↵Dr. David von Oheimb
extraCerts in code and doc Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12822)
2020-09-10bugfix in ossl_cmp_msg_protect(): set senderKID and extend extraCerts also ↵Dr. David von Oheimb
for unprotected CMP requests Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12822)
2020-09-10bugfix in ossl_cmp_msg_add_extraCerts(): should include cert chain when ↵Dr. David von Oheimb
using PBM Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12822)
2020-09-10test/cmp_{client,msg}_test.c: minor code cleanupDr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12655)
2020-09-10test/recipes/81-test_cmp_cli_data/Mock/server.cnf: minor cleanupDr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12655)
2020-09-1081-test_cmp_cli: Make test output files all different according to #11080Dr. David von Oheimb
Also some minor improvements mostly of test cases regarding PKCS#10 CSR input Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12655)
2020-09-1081-test_cmp_cli.t: Stop unlinking test output files according to #11080Dr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12655)
2020-09-10apps.c: Fix mem leaks on error in load_certs() and load_crls()Dr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12823)
2020-09-10apps/cmp.c: clear leftover errors on loading libengines.so etc.Dr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12824)
2020-09-10apps.c: Fix diagnostics and return value of load_key_certs_crls() on errorDr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12824)
2020-09-10Replace all wrong usages of 'B<...>' (typically by 'I<...>') in ↵Dr. David von Oheimb
OSSL_CMP_CTX_new.pod Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12741)
2020-09-10Clean up CMP chain building for CMP signer, TLS client, and newly enrolled certsDr. David von Oheimb
* Use strenghtened cert chain building, verifying chain using optional trust store while making sure that no certificate status (e.g., CRL) checks are done * Use OSSL_CMP_certConf_cb() by default and move its doc to OSSL_CMP_CTX_new.pod * Simplify certificate and cert store loading in apps/cmp.c Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12741)
2020-09-10Fix markdown nits in NOTES-Windows.txtRich Salz
And add a comment that this file is in markdown, but has a .txt extension on purpose. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12805)
2020-09-09Support writing RSA keys using the traditional format againKurt Roeckx
Fixes: #6855 Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #8743
2020-09-09ENCODER: Refactor provider implementations, and some cleanupRichard Levitte
The encoder implementations were implemented by unnecessarily copying code into numerous topical source files, making them hard to maintain. This changes merges all those into two source files, one that encodes into DER and PEM, the other to text. Diverse small cleanups are included. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12803)
2020-09-09Fix up issue on AIX caused by broken compiler handling of macro expansionJon Spillett
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12812)
2020-09-09s_time: check return values betterPauli
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/12808)
2020-09-09In a non-shared build, don't include the md5 object files in legacy providerPauli
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11961)
2020-09-09TLS fixes for CBC mode and no-deprecatedPauli
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11961)
2020-09-09TLS: remove legacy code path supporting special CBC modePauli
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11961)
2020-09-09legacy: include MD5 code in legacy providerPauli
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11961)
2020-09-09Deprecate SHA and MD5 again.Pauli
This reverts commit a978dc3bffb63e6bfc40fe6955e8798bdffb4e7e. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11961)
2020-09-08Allow unauthenticated CMP server if missing -trusted, -srvcert, and -secret ↵Dr. David von Oheimb
options Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12806)
2020-09-08Add 4 new OIDs for PKIX key purposes and 3 new CMP information typesDr. David von Oheimb
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12807)
2020-09-08TEST: modify test/endecode_test.c to not use legacy keysRichard Levitte
Now that PEM_write_bio_PrivateKey_traditional() can handle provider-native EVP_PKEYs, we don't need to use explicitly legacy ones. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12738)
2020-09-08PEM: Make PEM_write_bio_PrivateKey_traditional() handle provider-native keysRichard Levitte
PEM_write_bio_PrivateKey_traditional() didn't handle provider-native keys very well. Originally, it would simply use the corresponding encoder, which is likely to output modern PEM (not "traditional"). PEM_write_bio_PrivateKey_traditional() is now changed to try and get a legacy copy of the input EVP_PKEY, and use that copy for traditional output, if it has such support. Internally, evp_pkey_copy_downgraded() is added, to be used when evp_pkey_downgrade() is too intrusive for what it's needed for. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12738)
2020-09-08Add CMS AuthEnvelopedData with AES-GCM supportJakub Zelenka
Add the AuthEnvelopedData as defined in RFC 5083 with AES-GCM parameter as defined in RFC 5084. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8024)
2020-09-08apps/cmp.c: Allow default HTTP path (aka CMP alias) given with -server optionDr. David von Oheimb
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12786)
2020-09-08apps/cmp.c: Use enhanced OSSL_HTTP_parse_url(), removing parse_addr() and ↵Dr. David von Oheimb
atoint() Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12786)
2020-09-08OSSL_HTTP_parse_url(): add optional port number return parameter and ↵Dr. David von Oheimb
strengthen documentation Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12786)
2020-09-08EVP: Move the functions and controls for setting and getting distidRichard Levitte
Those functions were located in the EC files, but is really broader than that, even thought currently only used for SM2. They should therefore be in a more central location, which was also indicated by diverse TODOs. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12789)
2020-09-08EVP: Expand the use of EVP_PKEY_CTX_md()Richard Levitte
Setting a hash function was reserved for signature operations. However, it turns out that SM2 uses a hash function for encryption and decryption as well. Therefore, EVP_PKEY_CTX_md() must be called with an expanded operation type combination that includes EVP_PKEY_OP_TYPE_CRYPT when used in a generic way. For SM2, test/recipes/30-test_evp_data/evppkey_sm2.txt is expanded to test decryption both with an implicit and an explicit digest. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12789)
2020-09-08EVP: Add support for delayed EVP_PKEY operation parametersRichard Levitte
They get called "delayed parameters" because they may make it to the implementation at a later time than when they're given. This currently only covers the distinguished ID, as that's the only EVP_PKEY operation parameter so far that has been possible to give before the operation has been initialized. This includes a re-implementation of EVP_PKEY_CTX_set1_id(), EVP_PKEY_CTX_get1_id(), and EVP_PKEY_CTX_get1_id_len(). Also, the more rigorous controls of keytype and optype are restored. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12789)
2020-09-08New GOST PKCS12 standard supportDmitry Belyavskiy
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12780)
2020-09-08Fix test/evp_extra_test.cRichard Levitte
Because EVP_PKEY_CTX_new_from_name() could return a non-NULL context with no value in it, the lack of legacy implementation when OpenSSL was configured with 'no-ec' went through undetected. This adds the necessary guards to skip a test of SM2 in that case. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/12785)
2020-09-08EVP: Don't shadow EVP_PKEY_CTX_new* error recordsRichard Levitte
There are places that add an ERR_R_MALLOC_FAILURE record when any of EVP_PKEY_CTX_new*() return NULL, which is 1) inaccurate, and 2) shadows the more accurate error record generated when trying to create the EVP_PKEY_CTX. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/12785)
2020-09-08EVP: Preserve the EVP_PKEY id in a few more spotsRichard Levitte
As long as there are internal legacy keys for EVP_PKEY, we need to preserve the EVP_PKEY numeric identity when generating a key, and when creating the EVP_PKEY_CTX. For added consistency, the EVP_PKEY_CTX contructor tries a little harder to find a EVP_PKEY_METHOD. Otherwise, we may run into situations where the EVP_PKEY_CTX ends up having no associated methods at all. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/12785)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-05 23:19:02 +0000