summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2020-11-10openssl.pod: Improve doc of -verify_email, -verify_hostname, and -verify_ipDr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12932)
2020-11-10openssl-*.pod.in: Prevent newlines on empty engine_synopsis causing layout ↵Dr. David von Oheimb
errors Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12932)
2020-11-10openssl-cmp.pod.in: Align order of options with apps/cmp.c; improve ↵Dr. David von Oheimb
structuring of SYNOPSIS Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12932)
2020-11-10apps/cmp.c: Improve order of -path option: just after -serverDr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12932)
2020-11-10PEM: Always use PEM_def_callback() when cb == NULL in pem_read_bio_key()Richard Levitte
Too many other functions depend on this being done. Fixes #13340 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13346)
2020-11-10UI: Use OPENSSL_zalloc() in general_allocate_prompt()Richard Levitte
This is to ensure that fields we don't set explicitly are always zero. Fixes #13340 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13346)
2020-11-10Fix REF_PRINT_COUNT argument in ecx_key_freeDaniel Bevenius
Currently, when configuring OpenSSL using -DREF_PRINT the following compilation error is generated: In file included from include/crypto/ecx.h:21, from crypto/ec/ecx_key.c:11: crypto/ec/ecx_key.c: In function 'ecx_key_free': crypto/ec/ecx_key.c:65:32: error: 'r' undeclared (first use in this function) 65 | REF_PRINT_COUNT("ECX_KEY", r); | ^ include/internal/refcount.h:169:40: note: in definition of macro 'REF_PRINT_COUNT' 169 | fprintf(stderr, "%p:%4d:%s\n", b, b->references, a) | ^ crypto/ec/ecx_key.c:65:32: note: each undeclared identifier is reported only once for each function it appears in 65 | REF_PRINT_COUNT("ECX_KEY", r); | ^ include/internal/refcount.h:169:40: note: in definition of macro 'REF_PRINT_COUNT' 169 | fprintf(stderr, "%p:%4d:%s\n", b, b->references, a) | ^ make[1]: *** [Makefile:14929: crypto/ec/libcrypto-lib-ecx_key.o] Error 1 This commit updates the argument passed in to be the ECX_KEY* key. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13298)
2020-11-09Remove test that breaks on AIX.Shane Lontis
The offending test checks that fopen("anydir/") fails. This looks fairly platform specific. For the test involved this creates a file called "anydir" on an AIX test machine. This change was introduced on (Sept 24) https://github.com/openssl/openssl/commit/29844ea5b3d2b7240d99b043a0d82cb177f0762d Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13309)
2020-11-08This should fix a lock-order-inversionBernd Edlinger
Calling OPENSSL_init_crypto before acquiring the ossl_property_read_lock in ossl_method_store_fetch makes the second call to OPENSSL_init_crypto from ossl_ctx_global_properties unnecessary. Fixes #12869 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/13321)
2020-11-07test/evp_extra_test.c: Modify to reflect provider support in test_EVP_PKEY_checkRichard Levitte
With our providers, RSA now supports public key check and key parameter check. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13334)
2020-11-07EVP: Have all EVP_PKEY check functions export to provider if possibleRichard Levitte
Fixes #13322 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13334)
2020-11-07Fix test/recipes/80-test_ca.t to skip_all properly in a subtestRichard Levitte
It's perfectlt ok to 'plan skip_all' in a subtest, but in that case, it must really be inside the subtest. Fixes #13330 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13331)
2020-11-06Correct system guessing for solaris64-x86_64-* targetsMatt Caswell
Previously the system guessing script was choosing a target that did not exist for these platforms. Fixes #13323 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13327)
2020-11-06Don't complain about uninitialized values when running ConfigureMatt Caswell
If a system understands `uname -X` then the Configure script will attempt to use uninitialized values. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13327)
2020-11-06Don't clear the whole error stack when loading enginesMatt Caswell
Loading the various built-in engines was unconditionally clearing the whole error stack. During config file processing processing a .include directive which fails results in errors being added to the stack - but we carry on anyway. These errors were then later being removed by the engine loading code, meaning that problems with the .include directive never get shown. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13311)
2020-11-06Don't clear errors on failure in CONF_modules_load_file_ex()Matt Caswell
The call to CONF_modules_load() in CONF_modules_load_file_ex() can return a negative number to indicate failure. This was incorrectly being interpreted as "success" and therefore errors were being cleared incorrectly. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13311)
2020-11-06x509_vfy.c: Call verification callback individually per strict check in ↵David von Oheimb
check_chain() Fixes #13283 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13312)
2020-11-06x509_vfy.c: Introduce CHECK_CB macro simplifying use of cert verification cb ↵David von Oheimb
function Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13312)
2020-11-06CHANGES.md: Mention (strict) checks recently added to X509_verify_cert()David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13312)
2020-11-06Improve doc of X509_verify_cert(), also in openssl.podDavid von Oheimb
in particular regarding the checks due to X509_V_FLAG_X509_STRICT/-x509_strict Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13312)
2020-11-05Check the configuration file by defaultDmitry Belyavskiy
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13310)
2020-11-05Prepare for 3.0 alpha 9Matt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
2020-11-05Prepare for release of 3.0 alpha 8openssl-3.0.0-alpha8Matt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
2020-11-05Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13324)
2020-11-05defltprov: remove duplicate algorithm names.Pauli
Ed25519 and Ed448 contained aliases that were the same as the primary name. This removes the aliases leaving ED25519 and ED448 as the canonical names. Matching is case insensitive, so no functionality is lost. The FIPS provider didn't include the duplicates. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13308)
2020-11-04Moved OPENSSL_fork_prepare,_parent,_child from init.c to threads_pthread.c.Randall S. Becker
These methods should ultimately be deprecated. The move is to insulate non-UNIX platforms from these undefined symbols. CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #13273 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13276)
2020-11-04Do not export the submodules gost-engineHu Keping
Remove gost-engine from the distribution tarball. Signed-off-by: Hu Keping <hukeping@huawei.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13301)
2020-11-03fix typo in READMEIchinose Shogo
CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/13289)
2020-11-02Add more diagnostics to ossl_shimBenjamin Kaduk
We had several cases where the connection failed but we did not have an error message to differentiate which failure condition had been triggered. Add some more messages to help clarify what is going wrong. [extended tests] Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13251)
2020-11-02Adjust error reason for ssl_get_min_max_version() failureBenjamin Kaduk
Use SSL_R_NO_PROTOCOLS_AVAILABLE instead of ERR_R_INTERNAL_ERROR, to match what the BoringSSL tests expect for this case. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13251)
2020-11-02Clear error queue entries from bad DLTS recordsBenjamin Kaduk
DTLS by design ignores records/packets with bad MAC or failed AEAD tag validation. However, recent changes to have provided cipher implementations caused tls1_enc() to leave an entry on the error queue for invalid GCM tags, e.g.: 800BEAEF487F0000:error::Provider routines:gcm_stream_update:cipher operation failed:providers/implementations/ciphers/ciphercommon_gcm.c:306 The BoringSSL tests check for entries on the error queue with SSL_get_error() and so we were seeing spurious test failures due to the additional item on the error queue. To avoid leaving such spurious entries on the error queue, set a mark before calling the ssl3_enc 'enc' method, and pop to that mark before ignoring invalid packets. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13251)
2020-11-02Prevent potential UAF in init_thread_deregister()jwalch
I discovered the potential for use-after-free on glob_tevent_reg & its members in this function as a consequence of some static (de-)initialization fiasco in C++ client code. Long story short, an EVP_PKEY_free() was happening after OPENSSL_cleanup(). Aside from being freed the EVP_PKEY object wasn't actually being used after cleanup, it was basically just an ordering issue. Obviously the application behavior here is somewhat suspect, but IMO is basically benign. Crashing (most typical outcome of a UAF) doesn't seem the optimal response. At any rate, the issue can be avoided (at least with regard to this function) by simply updating the pointer to NULL rather than leaving it pointing to the freed memory, as is the typical practice. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13267)
2020-11-02EVP: Fix typo in EVP_PKEY_gen commentDaniel Bevenius
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13282)
2020-11-02Initialize outl in evp_enc.c to 0, protect against NULLjwalch
Fixes #12734 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13268)
2020-11-02Add AES KW inverse ciphers to the EVP layerShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13272)
2020-11-01Remove FLOSS from all OSS builds on NonStop except for SPT threading.Randall S. Becker
The Standard POSIX Threads (SPT) implementation hangs in some test cases if FLOSS is not used. CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #13277 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13279)
2020-11-01test/recipes/90-test_shlibload.t: Skip when address sanitizer enabledRichard Levitte
Because this test loads the shared libraries dynamically, there are cases where that results in errors because the ASAN library wasn't loaded first. That makes this test unsuitable in an ASAN build. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13281)
2020-11-01util/find-doc-nits: ignore OSSL_DEPRECATED*, alongside other reserved symbolsRichard Levitte
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13240)
2020-11-01Simplify and clarify doc/internal/man7/deprecation.podRichard Levitte
doc/internal/man7/deprecation.pod was unclear in some areas, and included general documentation that has no place there. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13240)
2020-10-30Patch leak in EVP_PKEY2PKCS8() error pathjwalch
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13278)
2020-10-30Allow empty deprecation macros to be passed as macro argumentsMatt Caswell
The OSSL_DEPRECATEDIN_3_0 macro introduced in PR #13074 is intended to be passed as a parameter to the various PEM declaration macros. However, in some cases OSSL_DEPRECATEDIN_3_0 is defined to be empty, and it is not allowed to pass empty macro arguments in C90. Therefore we ensure these macros are always defined. In the case where they were empty previously we use a no-op value instead. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13227)
2020-10-30Fix some missed usage of DEFINE_LHASH_OF()Matt Caswell
PR#12860 fixed issues with the Lhash code. It replaced usage of DEFINE_LHASH_OF() in the public headers. Unfortunately it missed a couple of instances. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13274)
2020-10-30Add easy to digest selector macros for EVP_PKEYsRichard Levitte
These are meant to be used with functions like OSSL_ENCODER_CTX_new_by_EVP_PKEY() The OSSL_ENCODER_CTX_new_by_EVP_PKEY() manual is also expanded on the topics of output types and selections. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13189)
2020-10-30test/recipes/15-test_gendh.t: don't try DER paramsRichard Levitte
There is no option to output DH params in DER form. -outform doesn't apply to -genparam with 'openssl genpkey', and it shouldn't. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13266)
2020-10-29Unify ssl3_get_cipher_by_std_name() implementationBenjamin Kaduk
The handling for the SCSVs was the same as for regular ciphers; just merge them into the same table-driven handler. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13010)
2020-10-29crypto/poly1305/asm: fix armv8 pointer authenticationArd Biesheuvel
PAC pointer authentication signs the return address against the value of the stack pointer, to prevent stack overrun exploits from corrupting the control flow. However, this requires that the AUTIASP is issued with SP holding the same value as it held when the PAC value was generated. The Poly1305 armv8 code got this wrong, resulting in crashes on PAC capable hardware. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13256)
2020-10-29afalg: add a NULL pointer checkPauli
Fixes #13260 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13261)
2020-10-28Rewrite the HPE NonStop Notes file in Markdown with more explanations.Randall S. Becker
CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #13237 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13238)
2020-10-27DH: stop setting the private key length arbitrarilyRichard Levitte
The private key length is supposed to be a user settable parameter. We do check if it's set or not, and if not, we do apply defaults. Fixes #12071 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13140)
2020-10-27configdata.pm.in, util/dofile.pl: Make a HERE document stricter.Richard Levitte
Fixes #13221 Fixes #12743 Fixes #12078 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13225)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-28 15:39:03 +0000