summaryrefslogtreecommitdiffstats
path: root/krb5 (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-05-06Update copyright yearMatt Caswell80-80/+80
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15181)
2021-05-06Update the FIPS checksumsMatt Caswell2-2/+2
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15177)
2021-05-06Add some tests for -inform/keyform enforcementTomas Mraz4-8/+40
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15100)
2021-05-06Document the behavior of the -inform and related optionsTomas Mraz21-112/+79
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15100)
2021-05-06provider-storemgmt: Document the input-type and properties parameters.Tomas Mraz1-0/+10
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15100)
2021-05-06Update gost-engine to make it compatible with the added paramsTomas Mraz1-0/+0
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15100)
2021-05-06Make the -inform option to be respected if possibleTomas Mraz38-143/+212
Add OSSL_STORE_PARAM_INPUT_TYPE and make it possible to be set when OSSL_STORE_open_ex() or OSSL_STORE_attach() is called. The input type format is enforced only in case the file type file store is used. By default we use FORMAT_UNDEF meaning the input type is not enforced. Fixes #14569 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15100)
2021-05-06try to document changes in salt handling for the 'enc' commandEasySec1-3/+7
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4486)
2021-05-06change salt handling, way 1EasySec1-33/+41
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4486)
2021-05-06coverity: fix 1478169: dereference after NULL checkPauli1-3/+11
The code path shouldn't occur in our code but could in an application. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15128)
2021-05-06Remove all trace of FIPS_mode functionsRich Salz11-28/+3
Removed error codes, and the mention of the functions. This removal is already documented in the CHANGES doc. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15140)
2021-05-05Deprecate X509{,_CRL}_http_nbio() and simplify their definitionDr. David von Oheimb4-8/+19
This is done by making use of OCSP_REQ_CTX_nbio_d2i(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15131)
2021-05-05APPS: Replace 'OPT_ERR = -1, OPT_EOF = 0, OPT_HELP' by OPT_COMMON macroDr. David von Oheimb53-57/+68
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15111)
2021-05-05APPS: Slightly extend and improve documentation of the opt_ APIDr. David von Oheimb7-78/+98
Also remove redundant opt_name() and make names of opt_{i,u}ntmax() consistent. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15111)
2021-05-05adapt tests to SSL_OP_LEGACY_SERVER_CONNECT changeBenjamin Kaduk2-1/+3
The "bad DTLS" tests run into trouble due to the special behavior for that "bad" version, and the SSL record tests need to set the -legacy_server_connect flag to allow an SSLv2 ClientHello to work against any TLS server (since SSLv2 ClientHello messages cannot carry extensions as would be needed in order to negotiate the use of the renegitiation_info extension). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15127)
2021-05-05Correct ssl_conf logic for "legacy_server_connect"Benjamin Kaduk3-2/+2
This option is only useful for the client, but it was previously marked as only being applicable for servers. Correct the entry to properly mark it as client-only, and update the s_server/s_client manuals accordingly. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15127)
2021-05-05Enforce secure renegotiation support by defaultBenjamin Kaduk5-20/+14
Previously we would set SSL_OP_LEGACY_SERVER_CONNECT by default in SSL_CTX_new(), to allow connections to legacy servers that did not implement RFC 5746. It has been more than a decade since RFC 5746 was published, so there has been plenty of time for implmentation support to roll out. Change the default behavior to be to require peers to support secure renegotiation. Existing applications that already cleared SSL_OP_LEGACY_SERVER_CONNECT will see no behavior change, as re-clearing the flag is just a little bit of redundant work. The old behavior is still available by explicitly setting the flag in the application. Also remove SSL_OP_LEGACY_SERVER_CONNECT from SSL_OP_ALL, for similar reasons. Document the behavior change in CHANGES.md, and update the SSL_CTX_set_options() and SSL_CONF_cmd manuals to reflect the change in default behavior. Fixes: 14848 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15127)
2021-05-05Fix missing symbols in no-cms and no-ts buildTomas Mraz1-7/+1
Fixes #15137 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15138)
2021-05-05mac: add EVP_MAC_finalXOF() functionPauli6-10/+50
Fixes #14140 Fixes #13232 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15061)
2021-05-05mac: allow XOF MACs to be specified either via control or via the dedicated ↵Pauli2-15/+92
function Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15061)
2021-05-05mac: update life-cycle description and diagrams to include finalXOFPauli4-5/+15
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15061)
2021-05-05doc: document EVP_MAC_finalXOF()Pauli1-3/+7
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15061)
2021-05-05Add .includedir pragmaRich Salz7-15/+45
Also add a negative test, and fix typo's. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15090)
2021-05-05Allow absolute paths to be setRich Salz7-31/+55
It was a mistake to allow relative paths for include files (just like root shouldn't have "." in its PATH), but we probably can't change it now. Add a new pragma "abspath" that someone can put in the system-wide config file to require absolute paths. Also update the config documentation to better explain how file inclusion works. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15090)
2021-05-05Note that dhparam does support X9.42Rich Salz1-10/+6
Fix other wording, too. Fixes: #13151 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15038)
2021-05-05cleanup where purpose is not needed in 25-test_verify.tDr. David von Oheimb1-67/+67
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14413)
2021-05-05test/certs/setup.sh: Fix two glitchesDr. David von Oheimb3-12/+12
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14413)
2021-05-05update test/certs/ee-pathlen.pem to contain SKID and AKIDDr. David von Oheimb1-9/+10
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14413)
2021-05-05test/certs/setup.sh: structural cleanupDr. David von Oheimb1-41/+32
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14413)
2021-05-05Fetch cipher-wrap after loading providers.Rich Salz2-15/+17
Use official (first) names for wrapping algorithms. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14182)
2021-05-05Fix KMAC bounds checks.Shane Lontis7-39/+66
Setting an output length higher than 8191 was causing a buffer overflow. This was reported by Acumen (FIPS lab). The max output size has increased to ~2M and it now checks this during set_parameters. The encoder related functions now pass in the maximum size of the output buffer so they can correctly check their size. kmac_bytepad_encode_key() calls bytepad twice in order to calculate and check the length before encoding. Note that right_encode() is currently only used in one place but this may change if other algorithms are supported (such as TupleHash). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15106)
2021-05-05Bump HMAC_MAX_MD_CBLOCK to 200 due to SHA-3Tomas Mraz1-1/+1
The maximum (theoretical) block size of SHA3 is 200 bytes. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15125)
2021-05-05DOCS: Mention that libcrypto has helper functions for OSSL_PARAMsRichard Levitte1-0/+6
Fixes #11165 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15073)
2021-05-04HTTP client: Correct the use of optional proxy URL and its documentationDr. David von Oheimb4-50/+48
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15104)
2021-05-04testutil/load.c: Add checks for file(name) == NULLDr. David von Oheimb1-7/+4
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15120)
2021-05-04BIO_eof() and OSSL_STORE_eof(): Make sure to return 1 on error; improve ↵Dr. David von Oheimb3-4/+4
related doc Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04OSSL_DECODER_from_bio() Prevent spurious decoding error at EOFDr. David von Oheimb1-4/+5
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04APPS load_key_certs_crls(): Correct the 'expect' arg calculation for ↵Dr. David von Oheimb1-18/+16
OSSL_STORE_expect() Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04OSSL_STORE_expect(): Improve error handling and documentationDr. David von Oheimb2-4/+11
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15029)
2021-05-04OCSP: Minor improvements of documentation and header fileDr. David von Oheimb4-11/+16
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15103)
2021-05-04fips-checksums: The define for fips module is FIPS_MODULETomas Mraz3-82/+82
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15132)
2021-05-04Document the new core BIO public API supportMatt Caswell4-13/+106
Fixes #14409 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15072)
2021-05-04Add a test for the public core bio APIMatt Caswell3-1/+124
Check that reading/writing to a core bio via BIO_new_from_core_bio() works as expected. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15072)
2021-05-04Create libcrypto support for BIO_new_from_core_bio()Matt Caswell10-6/+211
Previously the concept of wrapping an OSSL_CORE_BIO in a real BIO was an internal only concept for our own providers. Since this is likely to be generally useful, we make it a part of the public API. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15072)
2021-05-04Run coveralls daily and not exactly at midnightTomas Mraz1-1/+1
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15121)
2021-05-04coveralls: Enable fips as it is disabled by defaultTomas Mraz1-1/+1
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15121)
2021-05-04apps: Switch to X509_REQ_verify_exPetr Gotthard1-1/+2
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15118)
2021-05-04test: fix failure with FIPS and no-des configured.Pauli1-2/+2
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15105)
2021-05-04APPS: Add passphrase handling in the "rsa" and "dsa" commandsRichard Levitte2-0/+28
They completely ignored any passphrase related setting. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15119)
2021-05-04APPS: Set a default passphrase UI for the "ec" commandRichard Levitte1-0/+3
Fixes #15114 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15119)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-11 12:12:17 +0100