summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add OSSL_CMP_MSG_write(), use it in apps/cmp.cDr. David von Oheimb2020-07-305-11/+29
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12421)
* Export ossl_cmp_msg_load() as OSSL_CMP_MSG_read(), use it in apps/cmp.cDr. David von Oheimb2020-07-308-17/+16
| | | | | | | Fixes #12403 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12421)
* apps/cmp.c: Improve documentation of -recipient optionDr. David von Oheimb2020-07-302-3/+4
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12421)
* deserialisation: add deserialisation to the base providerPauli2020-07-305-9/+122
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12104)
* serialisation: Add a built-in base provider.Pauli2020-07-3010-151/+460
| | | | | | | | | | | | | | | Move the libcrypto serialisation functionality into a place where it can be provided at some point. The serialisation still remains native in the default provider. Add additional code to the list command to display what kind of serialisation each entry is capable of. Having the FIPS provider auto load the base provider is a future (but necessary) enhancement. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12104)
* unify spelling of serializePauli2020-07-308-10/+10
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12104)
* Fix test_cmp_cli for extended testsMatt Caswell2020-07-301-0/+2
| | | | | | | | | | | The test_cmp_cli was failing in the extended tests on cross-compiled mingw builds. This was due to the test not using wine when it should do. The simplest solution is to just skip the test in this case. [extended tests] Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12555)
* Don't fallback to legacy in DigestSignInit/DigestVerifyInit too easilyMatt Caswell2020-07-301-3/+15
| | | | | | | | | | | | | | | | | | The only reason we should fallback to legacy codepaths in DigestSignInit/ DigestVerifyInit, is if we have an engine, or we have a legacy algorithm that does not (yet) have a provider based equivalent (e.g. SM2, HMAC, etc). Currently we were falling back even if we have a suitable key manager but the export of the key fails. This might be for legitimate reasons (e.g. we only have the FIPS provider, but we're trying to export a brainpool key). In those circumstances we don't want to fallback to the legacy code. Therefore we tighten then checks for falling back to legacy. Eventually this particular fallback can be removed entirely (once all legacy algorithms have provider based key managers). Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12550)
* Export crm_new() of cmp_msg.c under the name OSSL_CMP_CTX_setup_CRM()Dr. David von Oheimb2020-07-304-12/+25
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12431)
* Streamline the CMP request session API, adding the generalized ↵Dr. David von Oheimb2020-07-3022-125/+140
| | | | | | | | | OSSL_CMP_exec_certreq() Fixes #12395 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12431)
* [test][ectest] Minor touches to custom_generator_testNicola Tuveri2020-07-291-4/+2
| | | | | | | | | | | | Minor changes to `custom_generator_test`: - this is to align to the 1.1.1 version of the test (simplify the code as there is no need to use `EC_GROUP_get_field_type()`) - add comment to explain how the buffer size is computed Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12507)
* [test] Vertically test explicit EC params API patternsNicola Tuveri2020-07-291-1/+280
| | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds a new test (run on all the built-in curves) to create `EC_GROUP` with **unknown** *explicit parameters*: from a built-in group we create an alternative group from scratch that differs in the generator used. At the `EC_GROUP` layer we perform a basic math check to ensure that the math on the alternative group still makes sense, using comparable results from the origin group. We then create two `EC_KEY` objects on top of this alternative group and run key generation from the `EC_KEY` layer. Then we promote these two `EC_KEY`s to `EVP_PKEY` objects and try to run the derive operation at the highest abstraction layer, comparing results in both directions. Finally, we create provider-native keys using `EVP_PKEY_fromdata` and data derived from the previous objects, we compute an equivalent shared secret from these provider keys, and compare it to the result obtained from the previous steps. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12507)
* namemap: fix threading issuePauli2020-07-291-35/+52
| | | | | | | | | The locking was too fine grained when adding entries to a namemap. Refactored the working code into unlocked functions and call these with appropriate locking. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12545)
* Fix a test_verify failureMatt Caswell2020-07-282-17/+18
| | | | | | | | | A recently added certificate in test/certs expired causing test_verify to fail. This add a replacement certificate with a long expiry date. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12549)
* Deprecate -nodes in favor of -noenc in pkcs12 and req appDr. David von Oheimb2020-07-288-25/+41
| | | | | | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12495)
* TEST: Add RSA-PSS cases in test/serdes_test.cRichard Levitte2020-07-271-21/+97
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12492)
* PROV: Add a DER to RSA-PSS deserializer implementationRichard Levitte2020-07-279-8/+105
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12492)
* EVP, PROV: Add misc missing bits for RSA-PSSRichard Levitte2020-07-273-0/+4
| | | | | | | | | | - EVP_PKEY_is_a() didn't recognise "RSA-PSS" for legacy keys. - The RSA-PSS keymgmt didn't have a OSSL_FUNC_keymgmt_match() function. - ossl_prov_prepare_rsa_params() didn't return 1 for unrestricted RSA-PSS params. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12492)
* Fix no-ec2mMatt Caswell2020-07-271-1/+4
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12526)
* DER to RSA deserializer: fix inclusionRichard Levitte2020-07-261-1/+1
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12535)
* Fix no-dh and no-dsaMatt Caswell2020-07-261-3/+8
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12525)
* Update EVP_EncodeInit.podRead Hughes2020-07-241-2/+2
| | | | | | | | | | Fix EVP_EncodeBlock description using incorrect parameter name for encoding length CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12518)
* EVP: Fix key type check logic in evp_pkey_cmp_any()Richard Levitte2020-07-241-8/+7
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* TEST: Update the serialization/deserialization test with legacy PEM encryptionRichard Levitte2020-07-241-26/+135
| | | | | | | | This adds legacy PEM variants of already existing tests. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* PROV: Update the PEM to DER deserializer to handle encrypted legacy PEMRichard Levitte2020-07-241-14/+93
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* TEST: Update the serialization/deserialization test with encryptionRichard Levitte2020-07-241-20/+89
| | | | | | | | | This adds variants of already existing tests, but where the object is encrypted / decrypted along the way as well. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* PROV: Update the DER to RSA deserializer to handle encrypted PKCS#8Richard Levitte2020-07-243-23/+129
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* DESERIALIZER: Implement decryption of password protected objectsRichard Levitte2020-07-247-107/+261
| | | | | | | | | | | | | | | | | | This implements these functions: OSSL_DESERIALIZER_CTX_set_cipher() OSSL_DESERIALIZER_CTX_set_passphrase() OSSL_DESERIALIZER_CTX_set_passphrase_ui() OSSL_DESERIALIZER_CTX_set_passphrase_cb() To be able to deal with multiple deserializers trying to work on the same byte array and wanting to decrypt it while doing so, the deserializer caches the passphrase. This cache is cleared at the end of OSSL_DESERIALIZER_from_bio(). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* SERIALIZER: No enc argument for OSSL_SERIALIZER_CTX_set_passphrase_cb()Richard Levitte2020-07-246-8/+7
| | | | | | | | | | | | Serialization will only encrypt, so there's no point telling OSSL_SERIALIZER_CTX_set_passphrase_cb() that's going to happen. We fix the declaration of OSSL_DESERIALIZER_CTX_set_passphrase_cb() the same way. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* TEST: Add new serializer and deserializer testRichard Levitte2020-07-244-1/+221
| | | | | | | | | | | | | | | | | | | | | | This test revolves around a central function that will first serialize an EVP_PKEY, then deserialize the result into a new EVP_PKEY and compare the two. The following tests are currently implemented: 1. EVP_PKEY (RSA) -> DER, then DER -> EVP_PKEY (RSA). 2. EVP_PKEY (RSA) -> PEM, then PEM -> EVP_PKEY (RSA). This one exercises deserializer chains, as we know that there is a PEM -> DER and a DER -> EVP_PKEY (RSA) deserializer, but no direct PEM -> EVP_PKEY (RSA) deserializer. Additionally, a small fix in test_fail_string_common(), as strcmp() could run past a buffer if one of the strings isn't terminated with a null byte within the given length. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* PROV: Implement PEM to DER deserializerRichard Levitte2020-07-246-1/+142
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* PROV: Implement DER to RSA deserializerRichard Levitte2020-07-249-1/+261
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* CORE: Add upcalls for BIO_gets() and BIO_puts()Richard Levitte2020-07-244-6/+35
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* SERIALIZER: Add functions to deserialize into an EVP_PKEYRichard Levitte2020-07-245-1/+419
| | | | | | | | | | | | | | EVP_PKEY is the fundamental type for provider side code, so we implement specific support for it, in form of a special context constructor. This constructor looks up and collects all available KEYMGMT implementations, and then uses those names to collect deserializer implementations, as described in the previous commit. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* DESERIALIZER: Add foundation for deserializersRichard Levitte2020-07-2424-32/+1803
| | | | | | | | | | | | | | | | | | | | | This adds a method OSSL_DESERIALIZER, a deserializer context and basic support to use a set of serializers to get a desired type of data, as well as deserializer chains. The idea is that the caller can call OSSL_DESERIALIZER_CTX_add_serializer() to set up the set of desired results, and to add possible chains, call OSSL_DESERIALIZER_CTX_add_extra(). All these deserializers are pushed on an internal stack. The actual deserialization is then performed using functions like OSSL_DESERIALIZER_from_bio(). When performing deserialization, the inernal stack is walked backwards, keeping track of the deserialized data and its type along the way, until the data kan be processed into the desired type of data. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* KEYMGMT: Add key loading function OSSL_FUNC_keymgmt_load()Richard Levitte2020-07-245-7/+42
| | | | | | | | | | | | | This function is used to create a keydata for a key that libcrypto only has a reference to. This introduces provider references, the contents which only the provider know how to interpret. Outside of the provider, this is just an array of bytes. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* EVP KEYMGMT utils: Make a few more utility functions availableRichard Levitte2020-07-243-33/+66
| | | | | | | | | | | | This makes the following functions available for libcrypto code: evp_keymgmt_util_try_import() - callback function evp_keymgmt_util_assign_pkey() - assigns keymgmt and keydata to an EVP_PKEY evp_keymgmt_util_make_pkey() - creates an EVP_PKEY from keymgmt and keydata Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12410)
* Add X509 related libctx changes.Shane Lontis2020-07-2464-544/+1081
| | | | | | | | | | | | | - In order to not add many X509_XXXX_with_libctx() functions the libctx and propq may be stored in the X509 object via a call to X509_new_with_libctx(). - Loading via PEM_read_bio_X509() or d2i_X509() should pass in a created cert using X509_new_with_libctx(). - Renamed some XXXX_ex() to XXX_with_libctx() for X509 API's. - Removed the extra parameters in check_purpose.. - X509_digest() has been modified so that it expects a const EVP_MD object() and then internally it does the fetch when it needs to (via ASN1_item_digest_with_libctx()). - Added API's that set the libctx when they load such as X509_STORE_new_with_libctx() so that the cert chains can be verified. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12153)
* Test RSA oaep in fips modeShane Lontis2020-07-2311-26/+282
| | | | | | | | | | Added RSA oaep test that uses the pkeyutl application. Added an openssl application option to support loading a (fips) provider via the '-config' option. Added openssl application related environment variable 'OPENSSL_TEST_LIBCTX' (for testing purposes only), that creates a non default library context. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11948)
* Fix: uninstantiation breaks the RAND_DRBG callback mechanismDr. Matthias St. Pierre2020-07-231-0/+13
| | | | | | | | | | | | | | The RAND_DRBG callbacks are wrappers around the EVP_RAND callbacks. During uninstantiation, the EVP_RAND callbacks got lost while the RAND_DRBG callbacks remained, because RAND_DRBG_uninstantiate() calls RAND_DRBG_set(), which recreates the EVP_RAND object. This was causing drbgtest failures. This commit fixes the problem by adding code to RAND_DRBG_set() for saving and restoring the EVP_RAND callbacks. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11195)
* test/drbgtest.c: set the correct counter to trigger reseedingDr. Matthias St. Pierre2020-07-231-2/+9
| | | | | | | | | | It's the generate counter (drbg->reseed_gen_counter), not the reseed counter which needs to be raised above the reseed_interval. This mix-up was partially caused by some recent renamings of DRBG members variables, but that will be dealt with in a separate commit. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11195)
* test/drbgtest.c: Remove error check for large generate requestsDr. Matthias St. Pierre2020-07-231-6/+0
| | | | | | | | | | | | | The behaviour of RAND_DRBG_generate() has changed. Previously, it would fail for requests larger than max_request, now it automatically splits large input into chunks (which was previously done only by RAND_DRBG_bytes() before calling RAND_DRBG_generate()). So this test has not only become obsolete, the fact that it succeeded unexpectedly also caused a buffer overflow that terminated the test. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11195)
* Fix DRBG reseed counter condition.Vitezslav Cizek2020-07-232-3/+3
| | | | | | | | | | | | The reseed counter condition was broken since a93ba40, where the initial value was wrongly changed from one to zero. Commit 8bf3665 fixed the initialization, but also adjusted the check, so the problem remained. This change restores original (OpenSSL-fips-2_0-stable) behavior. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11195)
* test/drbgtest.c: Fix error check testVitezslav Cizek2020-07-231-18/+22
| | | | | | | | | | | The condition in test_error_checks() was inverted, so it succeeded as long as error_check() failed. Incidently, error_check() contained several bugs that assured it always failed, thus giving overall drbg test success. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11195)
* Cleanup fips provider initShane Lontis2020-07-221-154/+59
| | | | | | | | | | Removed dummy evp_test Changed all algorithm properties to use fips=yes (except for RAND_TEST) (This changes the DRBG and ECX settings) Removed unused includes. Added TODO(3.0) for issue(s) that need to be resolved. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12498)
* document the deprecation of the '-public-key-methods' option to listPauli2020-07-221-6/+9
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11082)
* EVP: deprecate the EVP_X_meth_ functions.Pauli2020-07-2219-430/+469
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11082)
* engines: fixed to work with EVP_*_meth calls deprecatedPauli2020-07-224-4/+8
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11082)
* evp_test: use correct deallocation for EVP_CIPHERPauli2020-07-221-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11082)
* evp_test: use correct deallocation for EVP_MDPauli2020-07-221-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11082)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-13 02:05:43 +0100