summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* improve CMP logging according to comments on CMP chunk 7 previewDr. David von Oheimb2020-02-179-169/+289
| | | | | | | | | | | | | in particular: consolidate documentation of CMP logging and error reporting functions fix compilation problem with clang on some platforms rename OSSL_CMP_log etc. to ossl_cmp_log etc. since these macros are CMP-internal move chopping of trailing separator to ossl_cmp_add_error_txt(), also fix handling of leading separator internalize X509_print_ex_brief() as x509_print_ex_brief() Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/10620)
* add internal doc files actually belonging to CMP contribution chunk 6Dr. David von Oheimb2020-02-174-1/+327
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/10620)
* Also check for errors in x86_64-xlate.pl.David Benjamin2020-02-17163-163/+163
| | | | | | | | | | | | | | In https://github.com/openssl/openssl/pull/10883, I'd meant to exclude the perlasm drivers since they aren't opening pipes and do not particularly need it, but I only noticed x86_64-xlate.pl, so arm-xlate.pl and ppc-xlate.pl got the change. That seems to have been fine, so be consistent and also apply the change to x86_64-xlate.pl. Checking for errors is generally a good idea. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David Benjamin <davidben@google.com> (Merged from https://github.com/openssl/openssl/pull/10930)
* Add $debug variable and use itRich Salz2020-02-171-1/+2
| | | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10852)
* Fix a bug for aarch64 BigEndiansimplelins2020-02-172-3/+14
| | | | | | | | | | | | FIXES #10692 #10638 a bug for aarch64 bigendian with instructions 'st1' and 'ld1' on AES-GCM mode. CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10751)
* crypto/bn: fix debug buildWataru Ashihara2020-02-171-0/+1
| | | | | | | | | | | | | | | | | | | | | Fixes: gcc -I. -Iinclude -Iproviders/common/include -Iproviders/implementations/include -Icrypto/include -DSTATIC_LEGACY -DBN_DEBUG -DREF_DEBUG -DCONF_DEBUG -DBN_CTX_DEBUG -DOPENSSL_NO_ASM -ggdb -g2 -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror -DOPENSSL_BUILDING_OPENSSL -DOPENSSLDIR="\"/home/wsh/opt/openssl/ssl\"" -DENGINESDIR="\"/home/wsh/opt/openssl/lib/engines-3\"" -DMODULESDIR="\"/home/wsh/opt/openssl/lib/ossl-modules\"" -MMD -MF crypto/bn/libcrypto-lib-bn_conv.d.tmp -MT crypto/bn/libcrypto-lib-bn_conv.o -c -o crypto/bn/libcrypto-lib-bn_conv.o crypto/bn/bn_conv.c In file included from crypto/bn/bn_conv.c:12: crypto/bn/bn_conv.c: In function 'BN_hex2bn': crypto/bn/bn_local.h:178:31: error: implicit declaration of function 'ossl_assert'; did you mean 'ossl_ssize_t'? [-Werror=implicit-function-declaration] (void)ossl_assert((_top == 0 && !_bnum2->neg) || \ ^~~~~~~~~~~ crypto/bn/bn_conv.c:188:5: note: in expansion of macro 'bn_check_top' bn_check_top(ret); ^~~~~~~~~~~~ CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10993)
* Add FFC param/key validationShane Lontis2020-02-1628-221/+1300
| | | | | | | Embed libctx in dsa and dh objects and cleanup internal methods to not pass libctx (This makes it consistent with the rsa changes) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10910)
* x86_64: Add endbranch at function entries for Intel CETH.J. Lu2020-02-159-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | To support Intel CET, all indirect branch targets must start with endbranch. Here is a patch to add endbranch to function entries in x86_64 assembly codes which are indirect branch targets as discovered by running openssl testsuite on Intel CET machine and visual inspection. Verified with $ CC="gcc -Wl,-z,cet-report=error" ./Configure shared linux-x86_64 -fcf-protection $ make $ make test and $ CC="gcc -mx32 -Wl,-z,cet-report=error" ./Configure shared linux-x32 -fcf-protection $ make $ make test # <<< passed with https://github.com/openssl/openssl/pull/10988 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10982)
* include/openssl/whrlpool.h: correct unbalanced deprecation guardsRichard Levitte2020-02-151-3/+1
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11087)
* DOC: document in more detail what a BIO_read_ex() via BIO_f_buffer() doesRichard Levitte2020-02-151-4/+14
| | | | | | | | | | | The BIO_f_buffer() documentation tells in enough detail how it affects BIO_gets(), but not how it affects BIO_read_ex(). This change remedies that. Fixes #10859 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10890)
* Document OSSL_SERIALIZER_PUBKEY_TO_DER_PQ and friendsRichard Levitte2020-02-152-1/+14
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11071)
* PROV: Build the main FIPS module code with FIPS_MODE definedRichard Levitte2020-02-141-0/+1
| | | | | | | | | Without that, its main source wasn't compiled correctly. Fixes #11089 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11090)
* apps x509: passing PKCS#11 URL as -signkeyBastian Germann2020-02-142-4/+5
| | | | | | | | | | | | | | OpenSSL 1.1.0 has extended option checking, and rejects passing a PKCS#11 engine URL to "-signkey" option. The actual code is ready to take it. Change the option parsing to allow an engine URL to be passed and modify the manpage accordingly. CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11086)
* Make secure-memory be a config optionRich Salz2020-02-144-31/+36
| | | | | | | | | | | Adding support for "no-secure-memory" was simple, a one-liner. Fixing all the "ifdef OPENSSL_SECURE_MEMORY" to be "ifndef NO_xxx" was a bit more work. My original goof, for not following the OpenSSL pattern "ifndef NO_" used everywhere else. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11023)
* Adapt i2d_PUBKEY for provider only keysRichard Levitte2020-02-141-11/+42
| | | | | | | It uses EVP_PKEY serializers to get the desired results. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11078)
* Adapt i2d_PrivateKey for provider only keysRichard Levitte2020-02-141-0/+32
| | | | | | | | | | | | | It uses EVP_PKEY serializers to get the desired results. One might think that ddoing this might make things a bit dicy for existing serializers, as they should obviously use i2d functions. However, since our serializers use much more primitive functions such as i2d_ASN1_INTEGER(), or keytype specific ones such as i2d_RSAPrivateKey(), there is no clash. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11056)
* Forgotten GOST2012 support in non-vital placesNikolay Morozov2020-02-142-0/+9
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11072)
* dsatest: fix the non-deprecated version of the test run.Pauli2020-02-131-6/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11081)
* Apps: don't build deprecated DH and DSA apps.Pauli2020-02-135-6/+6
| | | | | | | | This also means that there doesn't need to be any conditional checks in the .c files to avoid deprecated builds. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11067)
* Fix coverity issuesShane Lontis2020-02-133-12/+11
| | | | | | | | | | | CID : 1458169 RESOURCE LEAK ffc_params_generate.c - False positive, but addressed another Leak in adjacent code CID : 1458171 UNCHECKED RET apps/pkeyutl.c CID : 1458173 DEAD CODE ffc_params_generate.c CID : 1458174 RESOURCE LEAK ssl_lib.c Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11048)
* x86_64: Always generate .note.gnu.property section for ELF outputsH.J. Lu2020-02-131-7/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We should always generate .note.gnu.property section in x86_64 assembly codes for ELF outputs to mark Intel CET support since all input files must be marked with Intel CET support in order for linker to mark output with Intel CET support. Also .note.gnu.property section in x32 should be aligned to 4 bytes, not 8 bytes and .p2align should be used consistently. Verified with $ CC="gcc -Wl,-z,cet-report=error" ./Configure shared linux-x86_64 -fcf-protection $ make $ make test and $ CC="gcc -mx32 -Wl,-z,cet-report=error" ./Configure shared linux-x32 -fcf-protection $ make $ make test # <<< 90-test_sslapi.t failed because 8-byte pointer size. Fix #10896 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10985)
* Fix a mem leak in libsslMatt Caswell2020-02-131-2/+12
| | | | | | | | | | Make sure we free up any ENGINE references after we have finished using them. Fixes #11064 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11070)
* Add Asymmetric RSA cipher tests in FIPS providerMatt Caswell2020-02-132-2/+765
| | | | | | | | We also add some DSA tests for code that is already in the FIPS provider. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10881)
* Make the RSA ASYM_CIPHER implementation available inside the FIPS moduleMatt Caswell2020-02-1316-40/+183
| | | | | | | | | RSA ASYM_CIPHER was already available within the default provider. We now make it also available from inside the FIPS module. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10881)
* Add assembly config targets for UEFI buildChristopher J Zurcher2020-02-131-0/+10
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11054)
* Fix no-ec buildMatt Caswell2020-02-122-4/+7
| | | | | | | | Don't attempt to build ecx related source files in a "no-ec" build. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11065)
* Add OSSL_SERIALIZER_PUBKEY_TO_DER_PQ and friendsRichard Levitte2020-02-122-1/+5
| | | | | | | | It's already used internally, there's no reason the DER serializer propqueries shouldn't be present alongside the PEM and TEXT ones. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11055)
* fix build for new HTTP client in case OPENSSL_NO_CMP or OPENSSL_NO_OCSPDr. David von Oheimb2020-02-124-51/+59
| | | | | | | | fix also formatting nits w.r.t. #if indentations in ocsp.h Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11058)
* Remove unused ossl_param_bld_to_param_ex() function.Pauli2020-02-124-168/+3
| | | | | | | | The recently introduced ossl_param_bld_to_param_ex() function is only called by the unit tests. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11053)
* Remove unused OSSL_PARAM_construct_from_text() function.Pauli2020-02-125-51/+4
| | | | | | | This function is recently introduced and never called by the library or tests. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11053)
* Add NEWS entry about deprecation of command line public toolsPauli2020-02-111-0/+3
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
* dsa: deprecate applications that depend on the low level DSA functions.Pauli2020-02-1111-68/+120
| | | | | | | | | | speed is updated to not support DSA instead of being removed. The dhparam, dsaparam, dsa and gendsa commands are deprecated but still exist without NO_DEPRECATED defined. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
* app: add a deprecation warning to all deprecated commands.Pauli2020-02-114-181/+210
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
* test/recipes/80-test_ssl_old.t: Replace 'openssl gendsa'Richard Levitte2020-02-111-3/+3
| | | | | | | | Use 'openssl genpkey' instead. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10977)
* test_dsa: fix deprecation logicPauli2020-02-111-2/+1
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
* test/recipes/15-test_dsa.t: Deal with deprecation of 'openssl dsa'Richard Levitte2020-02-111-13/+29
| | | | | | | | | | | | Do not run programs that depend on deprecated APIs when 'no-deprecated' is configured. We still retain the conversion tests that use 'openssl pkey', and add the one that's missing. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10977)
* Deprecate the low level DSA functions.Pauli2020-02-1137-109/+360
| | | | | | | | Use of the low level DSA functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
* dsa.h: fix preprocessor indentationPauli2020-02-111-53/+56
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
* DSA: fix the DSA parameter logic in test.Pauli2020-02-111-4/+7
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
* Add S390 support for provider based X25519/X448Matt Caswell2020-02-114-6/+48
| | | | | | Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10964)
* Add X25519/X448 Key Exchange to the default providerMatt Caswell2020-02-118-1/+262
| | | | | | Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10964)
* Implement Provider side Key Management for X25519 and X448Matt Caswell2020-02-1111-31/+264
| | | | | | Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10964)
* Implement a stricter ECX_KEY typeMatt Caswell2020-02-1110-75/+160
| | | | | | | | | | Add ref counting and control how we allocate storage for the private key. We will need this type in following commits where we move the ecx code to be provider aware. Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10964)
* Check that ed25519 and ed448 are allowed by the security levelKurt Roeckx2020-02-113-50/+146
| | | | | | | | Signature algorithms not using an MD weren't checked that they're allowed by the security level. Reviewed-by: Matt Caswell <matt@openssl.org> GH: #10785
* Generate new Ed488 certificatesKurt Roeckx2020-02-118-21/+40
| | | | | | | | | Create a whole chain of Ed488 certificates so that we can use it at security level 4 (192 bit). We had an 2048 bit RSA (112 bit, level 2) root sign the Ed488 certificate using SHA256 (128 bit, level 3). Reviewed-by: Matt Caswell <matt@openssl.org> GH: #10785
* Add a minimal build target for Travis and AppveyorBernd Edlinger2020-02-112-2/+12
| | | | | | | [extended tests] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9982)
* X509_PUBKEY_set(): Fix memory leakRichard Levitte2020-02-111-0/+16
| | | | | | | | | | | With the provided method of creating the new X509_PUBKEY, an extra EVP_PKEY is created and needs to be properly cleaned away. (note: we could choose to keep it just as well, but there are consequences, explained in a comment in the code) Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11038)
* Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.cDr. David von Oheimb2020-02-1045-1016/+2495
| | | | | | | | | | | | | | | | The new client has become an independent libcrpyto module in crypto/http/ and * can handle any types of requests and responses (ASN.1-encoded and plain) * does not include potentially busy loops when waiting for responses but * makes use of a new timeout mechanism integrated with socket-based BIO * supports the use of HTTP proxies and TLS, including HTTPS over proxies * supports HTTP redirection via codes 301 and 302 for GET requests * returns more useful diagnostics in various error situations Also adapts - and strongly simplifies - hitherto uses of HTTP in crypto/ocsp/, crypto/x509/x_all.c, apps/lib/apps.c, and apps/{ocsp,s_client,s_server}.c Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10667)
* add BIO_socket_wait(), BIO_wait(), and BIO_connect_retry() improving timeout ↵Dr. David von Oheimb2020-02-109-3/+195
| | | | | | | | support Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10667)
* PROV: Ensure the AlgorithmIdentifier registers in DSA signature implRichard Levitte2020-02-101-0/+2
| | | | | | | | | When setting up the hash function for DSA signature, the encoded AlgorithmIdentifier for the DSA+hash combination is queried, but not stored, which leads to problems when signing ASN.1 items in libcrypto. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11037)
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-01 02:53:34 +0100