summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2020-09-12NonStop port updates for 3.0.0.Randall S. Becker
HPE NonStop Port Changes for 3.0.0 Includes unthreaded, PUT, and SPT for OSS. The port changes include wrapping where necessary for FLOSS and appropriate configuration changes to support that. Two tests are excluded as being inappropriate for the platform. The changes are: * Added /usr/local/include to nonstop-nsx_spt_floss to load floss.h * Added SPT Floss variant for NonStop * Wrapped FLOSS definitions in OPENSSL_TANDEM_FLOSS to allow selective enablement. * SPT build configuration for NonStop * Skip tests not relevant for NonStop * PUT configuration changes required for NonStop platforms * Configurations/50-nonstop.conf: updates for TNS/X platform. * FLOSS instrumentation for HPE NonStop TNS/X and TNS/E platforms. * Configurations/50-nonstop.conf: modifications for non-PUT TNS/E platform b * Fix use of DELAY in ssltestlib.c for HPNS. * Fixed commit merge issues and added floss to http_server.c CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #5087. Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12800)
2020-09-12EVP: Add the internal convenience function evp_keymgmt_util_export()Richard Levitte
This is purely to allow exporting without having to repeatedly specify the keymgmt and keydata from the EVP_PKEY. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12853)
2020-09-12EC: Reimplement EVP_PKEY_CTX_set_ec_param_enc() to support providersRichard Levitte
Fixes #12852 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12853)
2020-09-12keygen: add FIPS error state management to conditional self testsShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12801)
2020-09-12FIPS: error mode is set from failed self tests and produced a limited number ↵Pauli
of errors when algorithm accesses are attempted Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12801)
2020-09-12Fix coverity issue: CID 1466482 - Resource leak in ↵Shane Lontis
OSSL_STORE_SEARCH_by_key_fingerprint() Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12847)
2020-09-12Fix coverity issue: CID 1466483 - Improper use of Negative value in dh_ctrl.cShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12847)
2020-09-12Fix coverity issue: CID 1466484 - Remove dead code in PKCS7_dataInit()Shane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12847)
2020-09-12Fix coverity issue: CID 1466485 - Explicit NULL dereference in OSSL_STORE_find()Shane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12847)
2020-09-12Fix coverity issue: CID 1466486 - Resource leak in OSSL_STOREShane Lontis
Note that although this is a false positive currently, it could become possible if any of the methods called change behaviour - so it is safer to add the fix than to ignore it. Added a simple test so that I could prove this was the case. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12847)
2020-09-12OSSL_DECODER 'decode' function must never be NULL.Richard Levitte
The conditions for a valid implementation allowed the 'decode' function to be NULL or the 'export_object' was NULL. That condition is changed so that 'decode' is checked to be non-NULL by itself. Fixes #12819 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12849)
2020-09-11check_chain_extensions(): Require X.509 v3 if extensions are presentDr. David von Oheimb
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12478)
2020-09-11check_chain_extensions(): Change exclusion condition w.r.t. RFC 6818 section 2Dr. David von Oheimb
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12478)
2020-09-11x509_vfy.c: Make sure that strict checks are not done for self-issued EE certsDr. David von Oheimb
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12478)
2020-09-11check_chain_extensions(): Add check that CA cert includes key usage extensionDr. David von Oheimb
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12478)
2020-09-11check_chain_extensions(): Add check that on empty Subject the SAN must be ↵Dr. David von Oheimb
marked critical Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12478)
2020-09-11check_chain_extensions(): Add check that AKID and SKID are not marked criticalDr. David von Oheimb
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12478)
2020-09-11check_chain_extensions(): Add check that Basic Constraints of CA cert are ↵Dr. David von Oheimb
marked critical Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12478)
2020-09-11Extend X509 cert checks and error reporting in v3_{purp,crld}.c and ↵Dr. David von Oheimb
x509_{set,vfy}.c add various checks for malformedness to static check_chain_extensions() in x509_vfc.c improve error reporting of X509v3_cache_extensions() in v3_purp.c add error reporting to x509_init_sig_info() in x509_set.c improve static setup_dp() and related functions in v3_purp.c and v3_crld.c add test case for non-conforming cert from https://tools.ietf.org/html/rfc8410#section-10.2 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12478)
2020-09-10apps_ui.c: Correct password prompt for ui_methodDr. David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12493)
2020-09-10STORE: Fix OSSL_STORE_attach() to check |ui_method| before useRichard Levitte
ossl_pw_set_ui_method() demands that the passed |ui_method| be non-NULL, and OSSL_STORE_attach() didn't check it beforehand. While we're at it, we remove the passphrase caching that's set at the library level, and trust the implementations to deal with that on their own as needed. Fixes #12830 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12831)
2020-09-10X509_NAME_cmp: restrict normal return values to {-1,0,1} to avoid confusion ↵Dr. David von Oheimb
with -2 for error Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12769)
2020-09-10X509_NAME_oneline(): Fix output of multi-valued RDNs, escaping '/' and '+' ↵Dr. David von Oheimb
in values Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12769)
2020-09-10Fix an EVP_MD_CTX leakMatt Caswell
If we initialise an EVP_MD_CTX with a legacy MD, and then reuse the same EVP_MD_CTX with a provided MD then we end up leaking the md_data. We need to ensure we free the md_data if we change to a provided MD. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12779)
2020-09-10Diverse build.info: Adjust pathsRichard Levitte
Fixes #12815 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12816)
2020-09-10bugfix in apps/cmp.c and cmp_client.c: inconsistencies on retrieving ↵Dr. David von Oheimb
extraCerts in code and doc Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12822)
2020-09-10bugfix in ossl_cmp_msg_protect(): set senderKID and extend extraCerts also ↵Dr. David von Oheimb
for unprotected CMP requests Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12822)
2020-09-10bugfix in ossl_cmp_msg_add_extraCerts(): should include cert chain when ↵Dr. David von Oheimb
using PBM Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12822)
2020-09-10Clean up CMP chain building for CMP signer, TLS client, and newly enrolled certsDr. David von Oheimb
* Use strenghtened cert chain building, verifying chain using optional trust store while making sure that no certificate status (e.g., CRL) checks are done * Use OSSL_CMP_certConf_cb() by default and move its doc to OSSL_CMP_CTX_new.pod * Simplify certificate and cert store loading in apps/cmp.c Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12741)
2020-09-09ENCODER: Refactor provider implementations, and some cleanupRichard Levitte
The encoder implementations were implemented by unnecessarily copying code into numerous topical source files, making them hard to maintain. This changes merges all those into two source files, one that encodes into DER and PEM, the other to text. Diverse small cleanups are included. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12803)
2020-09-09In a non-shared build, don't include the md5 object files in legacy providerPauli
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11961)
2020-09-09legacy: include MD5 code in legacy providerPauli
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11961)
2020-09-08Allow unauthenticated CMP server if missing -trusted, -srvcert, and -secret ↵Dr. David von Oheimb
options Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12806)
2020-09-08Add 4 new OIDs for PKIX key purposes and 3 new CMP information typesDr. David von Oheimb
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12807)
2020-09-08PEM: Make PEM_write_bio_PrivateKey_traditional() handle provider-native keysRichard Levitte
PEM_write_bio_PrivateKey_traditional() didn't handle provider-native keys very well. Originally, it would simply use the corresponding encoder, which is likely to output modern PEM (not "traditional"). PEM_write_bio_PrivateKey_traditional() is now changed to try and get a legacy copy of the input EVP_PKEY, and use that copy for traditional output, if it has such support. Internally, evp_pkey_copy_downgraded() is added, to be used when evp_pkey_downgrade() is too intrusive for what it's needed for. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12738)
2020-09-08Add CMS AuthEnvelopedData with AES-GCM supportJakub Zelenka
Add the AuthEnvelopedData as defined in RFC 5083 with AES-GCM parameter as defined in RFC 5084. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8024)
2020-09-08OSSL_HTTP_parse_url(): add optional port number return parameter and ↵Dr. David von Oheimb
strengthen documentation Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12786)
2020-09-08EVP: Move the functions and controls for setting and getting distidRichard Levitte
Those functions were located in the EC files, but is really broader than that, even thought currently only used for SM2. They should therefore be in a more central location, which was also indicated by diverse TODOs. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12789)
2020-09-08EVP: Expand the use of EVP_PKEY_CTX_md()Richard Levitte
Setting a hash function was reserved for signature operations. However, it turns out that SM2 uses a hash function for encryption and decryption as well. Therefore, EVP_PKEY_CTX_md() must be called with an expanded operation type combination that includes EVP_PKEY_OP_TYPE_CRYPT when used in a generic way. For SM2, test/recipes/30-test_evp_data/evppkey_sm2.txt is expanded to test decryption both with an implicit and an explicit digest. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12789)
2020-09-08EVP: Add support for delayed EVP_PKEY operation parametersRichard Levitte
They get called "delayed parameters" because they may make it to the implementation at a later time than when they're given. This currently only covers the distinguished ID, as that's the only EVP_PKEY operation parameter so far that has been possible to give before the operation has been initialized. This includes a re-implementation of EVP_PKEY_CTX_set1_id(), EVP_PKEY_CTX_get1_id(), and EVP_PKEY_CTX_get1_id_len(). Also, the more rigorous controls of keytype and optype are restored. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12789)
2020-09-08New GOST PKCS12 standard supportDmitry Belyavskiy
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12780)
2020-09-08EVP: Don't shadow EVP_PKEY_CTX_new* error recordsRichard Levitte
There are places that add an ERR_R_MALLOC_FAILURE record when any of EVP_PKEY_CTX_new*() return NULL, which is 1) inaccurate, and 2) shadows the more accurate error record generated when trying to create the EVP_PKEY_CTX. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/12785)
2020-09-08EVP: Preserve the EVP_PKEY id in a few more spotsRichard Levitte
As long as there are internal legacy keys for EVP_PKEY, we need to preserve the EVP_PKEY numeric identity when generating a key, and when creating the EVP_PKEY_CTX. For added consistency, the EVP_PKEY_CTX contructor tries a little harder to find a EVP_PKEY_METHOD. Otherwise, we may run into situations where the EVP_PKEY_CTX ends up having no associated methods at all. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/12785)
2020-09-07Fix memory leaks in conf_def.cluxinyou
Fixes #12471 CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12533)
2020-09-05Slightly abstract ktls_start() to reduce OS-specific #ifdefs.John Baldwin
Instead of passing the length in from the caller, compute the length to pass to setsockopt() inside of ktls_start(). This isolates the OS-specific behavior to ktls.h and removes it from the socket BIO implementations. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/12782)
2020-09-05Fix the socket BIO control methods to use ktls_crypto_info_t.John Baldwin
This is mostly a cosmetic cleanup I missed when adding the ktls_crypto_info_t type. However, while fixing this I noticed that the changes to extract the size from crypto_info from the wrapper structure for Linux KTLS had not been propagated from bss_sock.c to bss_conn.c, so I've fixed that to use the correct length. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/12782)
2020-09-05X509_STORE_CTX_print_verify_cb(): add AKID and SKID output for (non-)trusted ↵Dr. David von Oheimb
certs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12787)
2020-09-05OSSL_CMP_CTX: rename field and its getter/setter from 'untrusted_certs' to ↵Dr. David von Oheimb
'untrusted Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12788)
2020-09-05Strengthen chain building for CMPDr. David von Oheimb
* Add -own_trusted option to CMP app * Add OSSL_CMP_CTX_build_cert_chain() * Add optional trust store arg to ossl_cmp_build_cert_chain() * Extend the tests in cmp_protect_test.c and the documentation accordingly Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12791)
2020-09-05Add OSSL_CMP_CTX_get1_newChain() and related CLI option -chainoutDr. David von Oheimb
Also simplify certificate saving in apps/cmp.c Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12790)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-02 04:27:01 +0000