summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-05-13Compute the FIPS checksums in $(BLDDIR) and remove it from update targetTomas Mraz
Add also update-fips-checksums to update the checksums in the $(SRCDIR) if the $(SRCDIR) and $(BLDDIR) is different. The fips-checksums and generate_fips_sources targets are always produced (regardless of enable-fips) as nothing else depends on them and they are developer targets. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15229)
2021-05-13x509: fix a dangling pointerPauli
If object was pointer was passed and an error occured the object was freed & the pointer returned. Fix this to NULL out the caller's pointer before returning. Fixes #15115 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15238)
2021-05-13e_loader_attic: fix a use after free issuePauli
Fixes #15116 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15238)
2021-05-13test: fix thread test config file problemPauli
Force the thread test to use the configuration file via a command line arg. Use the test library support for libctx creation. Fixes #15243 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15256)
2021-05-13EVP_PKEY-X25519.pod: Correct EVP_PKEY_Q_keygen function name in exampleDr. David von Oheimb
fixup for #14695: Add convenience functions and macros for asymmetric key generation Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15226)
2021-05-13Add $AESDEF in libdefault.a to fix aes regressionXiaofei Bai
We recently noticed AES algorithms(like aes-xxx-ctr, aes-xxx-gcm,.etc) have significant performance regression on x86_64 platform, and it is because of the missing AES_ASM macro. This PR is to fix it by applying $AESDEF to libdefault.a. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15225)
2021-05-13Fix cut/paste (?) error.Rich Salz
Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15232)
2021-05-13Export/import flags for FFC params changed to seperate fields.Shane Lontis
An extra field got added to the ffc flags related to FIPS-186-2 key validation, but this field was not handled by the export/import since the flags were done as string combinations. To keep this consistent with other object flags they are now passed as seperate OSSL_PARAM fields. Fixes 'no-cached-fetch' build which uses export/import. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15210)
2021-05-12apps: improve hygeine for SET_EXPECT macroBenjamin Kaduk
Wrap all parameters in parentheses in the expansion, make explicit the use of the 'expect' input, wrap the whole expression in parentheses, and remove duplicate semicolon. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15203)
2021-05-12Update expected results for tls13kexmodes testsBenjamin Kaduk
One of the scenarios constructed in these tests was erroneously producing successful handshakes until the previous commits, but should have been failing. Update our expected behavior to match the specification requirements, and adjust the commentary slightly for a test case relevant for the other preceding commit. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14749)
2021-05-12Don't send key_share for PSK-only key exchangeBenjamin Kaduk
TLS 1.3 allows for the "psk_ke" and "psk_dhe_ke" key-exchange modes. Only the latter mode introduces a new ephemeral (Diffie-Hellman) key exchange, with the PSK being the only key material used in the former case. It's a compliance requirement of RFC 8446 that the server MUST NOT send a KeyShareEntry when using the "psk_ke" mode, but prior to this commit we would send a key-share based solely on whether the client sent one. This bug goes unnoticed in our internal test suite since openssl communicating with openssl can never negotiate the PSK-only key-exchange mode. However, we should still be compliant with the spec, so check whether the DHE mode was offered and don't send a key-share if it wasn't. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14749)
2021-05-12make updateBenjamin Kaduk
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14749)
2021-05-12Improve RFC 8446 PSK key exchange mode complianceBenjamin Kaduk
It's a MUST-level requirement that if the client sends a pre_shared_key extension not accompanied by a psk_key_exchange_modes extension, the server must abort the handshake. Prior to this commit the server would continue on. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14749)
2021-05-12HTTP client: Minimal changes that include the improved APIDr. David von Oheimb
This is a minimal version of pull request #15053 including all the proposed improvements to the HTTP client API and its documentation but only those code adaptations strictly needed for it. The proposed new features include * support for persistent connections (keep-alive), * generalization to arbitrary request and response types, and * support for streaming BIOs for request and response data. The related API changes include: * Split the monolithic OSSL_HTTP_transfer() into OSSL_HTTP_open(), OSSL_HTTP_set_request(), a lean OSSL_HTTP_transfer(), and OSSL_HTTP_close(). * Split the timeout functionality accordingly and improve default behavior. * Extract part of OSSL_HTTP_REQ_CTX_new() to OSSL_HTTP_REQ_CTX_set_expected(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15147)
2021-05-12Add ASN1_item_i2d_mem_bio(); document and improve also ASN1_item_d2i_bio()Dr. David von Oheimb
ASN1_item_d2i_bio(): Do not report errors in queue on BIO input being NULL Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15147)
2021-05-12A few cleanups of the provider build.infosTomas Mraz
Remove a TODO that is no longer relevant and drop some more non-fips sources from the fips checksums. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15191)
2021-05-12Allow arbitrary digests with ECDSA and DSATomas Mraz
Unless the FIPS security check is enabled we allow arbitrary digests with ECDSA and DSA. Fixes #14696 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15220)
2021-05-12apps: make list -help not continue with listingPauli
All the commands return after printing their help. List doesn't. This brings them in line. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15211)
2021-05-12apps: change list command to only list fetchable algorithms.Pauli
The -propquery option will work with this change. By default the output will be the same. Also address some inconsistencies in the code with respects to error checking. Fixes #15196 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15211)
2021-05-12encoder: add a _name() function for encoders and decodersPauli
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15211)
2021-05-12doc: document the encoder and decoder name functionsPauli
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15211)
2021-05-12Checksum updatePauli
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
2021-05-12property: add test case for setting default user properties before fetchingMatt Caswell
Shamelessly culled from #15218. Co-authored-by: Dr Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15222)
2021-05-12property: create property names more eagerly.Pauli
User defined property names were not created before the first fetch. The rationale for this was to only maintain the user names defined by providers. This was intended to prevent malicious memory use attacks. Not being able to specify a default query before the first fetch is wrong. This changes the behaviour of the property query parsing to always create property names. Fixes #15218 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15222)
2021-05-12Run-checker converted to GitHub ActionsPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15129)
2021-05-12coveralls: fix comment to indicate daily not weeklyPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15129)
2021-05-12Add OID for RPKI id-ct-signedChecklistJob Snijders
References: draft-ietf-sidrops-rpki-rsc - Resource Public Key Infrastructure (RPKI) object profile for Signed Checklist (RSC) OID listed under 'SMI Security for S/MIME CMS Content Type (1.2.840.113549.1.9.16.1)' https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#security-smime-1 CLA: Trivial Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15207)
2021-05-12find-doc-nits fix courtesy Rich SalzEasySec
Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11481)
2021-05-12use LHASH_OF(TYPE) macro to make the example consistent with the declaration ↵EasySec
in ssl.h Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11481)
2021-05-12Checksum updatePauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu>
2021-05-12evp: fix return code check.Pauli
The return from evp_do_md_getparams() is 0 for failure and -1 for not being a provided algorithm. The code in evp_md_cache_constants() failed to check the return code properly. In this case it was harmless but better to fix it. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/15208)
2021-05-12coverity: fix 1484542 dereference after null checkPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/15208)
2021-05-12coverity: fix 1484540 resource leakPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/15208)
2021-05-12coverity: fix 1484539 resource leakPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/15208)
2021-05-1180-test_cmp_http.t: Improve fuzzing exclusion pattern - fixup!Dr. David von Oheimb
This now correctly fixes #14966. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15217)
2021-05-11Fix missing $CPUIDDEF in libdefault.aXiaofei Bai
This fixes a build error caused by missing $CPUIDDEF when compiling libdefault.a, and some functions(like armv8_aes_gcm_encrypt) become undefined. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15215)
2021-05-11Update FIPS checksumsMatt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Exclude child provider code from the FIPS moduleMatt Caswell
We don't need the child provider code in the FIPS module so we exclude it. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Update documentation following addition of OSSL_LIB_CTX_new_child()Matt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Add additional testing of child libctx/providersMatt Caswell
Add a case where a provider explicitly loads a provider into a child libctx where it does not already exist. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Don't convert pre-existing providers into childrenMatt Caswell
If a provider explicitly loads another provider into a child libctx where it wasn't previously loaded then we don't start treating it like a child if the parent libctx subsequently loads the same provider. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Add support for child provider to up_ref/free their parentMatt Caswell
If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Add a test to check that child provider callbacks are workingMatt Caswell
Write a test to confirm that if a provider is unloaded/loaded into a libctx then it is similarly unloaded/loaded from any child libctxs. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Register callbacks with core for child provider creation/deletionMatt Caswell
By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Add a test for OSSL_LIB_CTX_new_child()Matt Caswell
Check that we can create such a libctx and usable providers are loaded into it. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Modify the legacy provider to use OSSL_LIB_CTX_new_child()Matt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Add the concept of a child OSSL_LIB_CTXMatt Caswell
Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Add the ability for ex_data to have a priorityMatt Caswell
Where an object has multiple ex_data associated with it, then we free that ex_data in order of priority (high priority first). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Only load the config file into the default libctx if necessaryMatt Caswell
There is no need to load providers from the config file into the default libctx, if the current libctx that we are using isn't the default libctx. This avoids some deadlock situations. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Constify EVP_PKEY_CTX_set_params(), EVP_PKEY_CTX_{set,get}table_params(), etc.Dr. David von Oheimb
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14695)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-23 07:42:51 +0000