summaryrefslogtreecommitdiffstats
path: root/os-dep (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-10-15Update copyright yearMatt Caswell134-134/+134
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13144)
2020-10-15Changing X509at_get0_data_by_OBJ to expect const stack of X509_ATTRIBUTEAkshit Akhoury2-2/+2
CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13062)
2020-10-15Rename some occurrences of 'library_context' and 'lib_ctx' to 'libctx'Dr. Matthias St. Pierre70-137/+136
This change makes the naming more consistent, because three different terms were used for the same thing. (The term libctx was used by far most often.) Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12621)
2020-10-15Rename OPENSSL_CTX prefix to OSSL_LIB_CTXDr. Matthias St. Pierre377-1395/+1417
Many of the new types introduced by OpenSSL 3.0 have an OSSL_ prefix, e.g., OSSL_CALLBACK, OSSL_PARAM, OSSL_ALGORITHM, OSSL_SERIALIZER. The OPENSSL_CTX type stands out a little by using a different prefix. For consistency reasons, this type is renamed to OSSL_LIB_CTX. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12621)
2020-10-15Make evp_pkey_ctx_get0_libctx/propq public APIMatt Caswell6-7/+54
These were previously added as an internal API. But since the CMS code needs them, other code might do too. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13088)
2020-10-15Remove some more CMS key downgradesMatt Caswell1-14/+0
Fixes #12983 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13088)
2020-10-15Remove CMS recipient info information out of the algorithm implementationsMatt Caswell5-26/+14
Low level algorithm implementations have no business knowing about details of the higher level CMS concept. This knowledge is therefore moved into the CMS layer. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13088)
2020-10-15Move CMS signing code out of the algorithms and into CMSMatt Caswell13-156/+175
There is a large amount of CMS sepcific code in the algorithms. This is in the wrong place and breaks layering. This code should be in the CMS layer. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13088)
2020-10-15Move CMS enveloping code out of the algorithms and into CMSMatt Caswell18-898/+1040
There is quite a large amount of algorithm specific CMS code sitting in the algorithm directories. However, this seems to break layering. Algorithms really have no business knowing anything about CMS. Really it should be the other way around. Where there is algorithm specific CMS code it is the CMS layer that should know how to handle different algorithms. Therefore we move this code into the CMS layer. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13088)
2020-10-15Remove a CMS key downgradeMatt Caswell1-46/+0
We were downgrading a key in the CMS code. This is no longer necessary. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13088)
2020-10-14[test][tls-provider] Implement KEM algorithmNicola Tuveri1-22/+181
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-14[ssl] Support ssl_encapsulate on server sideNicola Tuveri5-26/+151
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-14[ssl] Support ssl_decapsulate on client sideNicola Tuveri5-34/+125
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-14Define OSSL_CAPABILITY_TLS_GROUP_IS_KEMNicola Tuveri5-9/+51
Note that with this commit the optional parameter is introduced, but libssl still ignores it. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-14[test][tls-provider] Add 2nd pluggable tls group for KEMNicola Tuveri1-3/+47
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-14[test][sslapitest] Add test for pluggable KEM groupNicola Tuveri1-6/+7
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-14[test][tls-provider] Group xor_group properties in a structNicola Tuveri1-26/+52
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-14Use __BYTE_ORDER__ to test the endianness when availableKurt Roeckx1-3/+31
Reviewed-by: Paul Dale <paul.dale@oracle.com> GH: #13085
2020-10-14syscall_random(): don't fail if the getentropy() function is a dummyYury Is1-2/+9
Several embedded toolchains may provide dummy implemented getentropy() function which always returns -1 and sets errno to the ENOSYS. As a result the function SSL_CTX_new() fails to create a new context. Fixes #13002 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/13114)
2020-10-14Reconciled c99 and loader arguments for float on NonStop TNS/E and TNS/X.Randall S. Becker1-12/+36
The default settings are now IEEE float. CLA: Permission is granted by the author to the ITUGLIB team to use these modifications. Fixes #12919 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13108)
2020-10-13EVP: Take care of locks when downgrading an EVP_PKEYRichard Levitte1-13/+48
The temporary copy that's made didn't have a lock, which could end up with a crash. We now handle locks a bit better, and take extra care to lock it and keep track of which lock is used where and which lock is thrown away. Fixes #12876 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12978)
2020-10-13Fixed typo in ssl_lib.cIkko Ashimine1-1/+1
orignal -> original CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/13111)
2020-10-12Make TAP::Harness and TAP::Parser optional.Rainer Jung1-2/+4
In OpenSSL 1.1.1 the script run_tests.pl has an effectiver workaround to fall back to Test::Harness, if TAP::Harness is not available. That code has substantially changed, but it seems it should still fall back but doesn't. Observed on SuSE Linux Enterprise Server 11 (SLES11). Error messages: Can't locate TAP/Parser.pm in @inc (@inc contains: /path/to/bld/openssl300/test/../util/perl /path/to/local/perl/lib/perl5 /usr/lib/perl5/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/5.10.0 /usr/lib/perl5/site_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.10.0 /usr/lib/perl5/vendor_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.10.0 /usr/lib/perl5/vendor_perl .) at /path/to/local/perl/lib/perl5/parent.pm line 20. BEGIN failed--compilation aborted at /path/to/bld/openssl300/test/run_tests.pl line 131. and Can't locate TAP/Harness.pm in @inc (@inc contains: /path/to/bld/openssl300/test/../util/perl /path/to/local/perl/lib/perl5 /usr/lib/perl5/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/5.10.0 /usr/lib/perl5/site_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.10.0 /usr/lib/perl5/vendor_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.10.0 /usr/lib/perl5/vendor_perl .) at /path/to/local/perl/lib/perl5/parent.pm line 20. BEGIN failed--compilation aborted at /path/to/bld/openssl300/test/run_tests.pl line 215. Concerning the fix: the docs for parent.pm show, that without the "-norequire" it puts the require statement in a BEGIN block which probably runs before the eval, to the loading is no longer encapsulated by the eval. Without the additional require line, the loading doesn't happen at all, so the availability testing fails. Combining the "-norequire" and an explicit "require" worked for me. Tested on the original problem platform SLES 11, but also on SLES 12 and 15, RHEL 6, 7 and 8 plus Solaris 10 Sparc. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12500)
2020-10-12Document how deprecation should be doneRichard Levitte3-1/+238
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
2020-10-12OpenSSL::ParseC: handle OSSL_CORE_MAKE_FUNCRichard Levitte1-0/+14
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
2020-10-12Add PEM declaration macros that take attributesRichard Levitte2-45/+95
This makes it possible to easily deprecated selections of PEM functions. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
2020-10-12Add ASN1 declaration macros that take attributesRichard Levitte2-39/+87
This makes it possible to easily deprecated selections of ASN1 functions. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
2020-10-12Make OpenSSL::ParseC and OpenSSL::Ordinals treat deprecation consistentlyRichard Levitte2-5/+13
The triggering macro that decides if a symbol is to be considered deprecated is OPENSSL_NO_DEPRECATEDIN_x_y[_z]. OpenSSL::ParseC renames any OPENSSL_NO_DEPRECATED_x_y[_z] by inserting "IN". Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
2020-10-12Add convenience macros OSSL_DEPRECATEDIN_{major}_{minor}Richard Levitte1-26/+60
As opposed to DEPRECATEDIN_{major}_{minor}(), any use of these macros must be guarded with a corresponding OPENSSL_NO_DEPRECATED_{major}_{minor}: #ifndef OPENSSL_NO_DEPRECATED_3_0 OSSL_DEPRECATEDIN_3_0 int RSA_size(const RSA *rsa); #endif Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
2020-10-12Add definitions of OSSL_DEPRECATED[_FOR] for Microsoft VCRichard Levitte1-1/+15
It turns out that they have __declspec(deprecated) that correspond pretty much to GCC's __attribute__((deprecated)), including for messages. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
2020-10-12Change OSSL_DEPRECATED to take a version argumentRichard Levitte1-13/+26
The macro value is changed to use deprecation messages where whose are supported. We also add the macro OSSL_DEPRECATED_FOR(), to be used whenever an additional message text is desirable, for example to tell the user what the deprecated is replaced with. Example: OSSL_DEPRECATED_FOR(3.0,"use EVP_PKEY and EVP_PKEY_size() instead") int RSA_size(const RSA *rsa); Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
2020-10-12Add a macro OSSL_DEPRECATED for compiler dependent deprecation attributesRichard Levitte1-17/+20
The diverse DEPRECATEDIN_x_y_z macros are rewritten in terms of this macro. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
2020-10-12coverity 1403324 negative array index: check for finding an unknown value ↵Pauli1-2/+23
and error if so (since it shouldn't happen). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13091)
2020-10-12coverity 1414446 out-of-bounds access: allocate \0 terminator byte to be safePauli1-2/+2
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13091)
2020-10-12vms: move otherwise dead code into the VMS relevant path.Pauli1-2/+5
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13091)
2020-10-10Adapt some code to OSSL_ENCODER_to_data() / OSSL_DECODER_from_data()Richard Levitte3-37/+19
The functions i2d_PrivateKey(), try_key_value() i store_result.c and X509_PUBKEY_set() were all essentially duplicating this functionality to some degree. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13094)
2020-10-10ENCODER / DECODER: Add functions to encode/decode to/from a bufferRichard Levitte7-7/+107
This adds OSSL_ENCODER_to_data() and OSSL_DECODER_from_data(). These functions allow fairly simple rewrites of type-specific i2d and d2i calls. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13094)
2020-10-09Fix diverse ERR code conflictsRichard Levitte1-54/+72
There was a number of potential range conflicts between reason codes from different places. Library specific reason codes are allowed to start at 100, so it means that anything "global" is limited to the range 1..99. At the same time, we have the ERR_R_LIB_xxx reason codes, which have the same numbers as ERR_LIB_xxx, potential range 1..255. And then we have the common ERR_R_ reason codes, potential range in OpenSSL 1.1.1 is 1..99, where fatal reasons occupy 64..99. For OpenSSL 3.0-dev, the range for the common reason codes was pushed up to 64..99 in an attempt to reduce the conflicts with the ERR_R_LIB_xxx reason codes. Currently existing conflicts in OpenSSL 1.1.1: ERR_R_BUF_LIB and ERR_R_PASSED_INVALID_ARGUMENT have the same code. There are currently no existing conflicts in OpenSSL 3.0-dev, but considering that ERR_LIB_HTTP is 61, a few more modules and associated ERR_R_LIB_xxx are going to sniff awfully close to 64, where the common ERR_R_ codes currently start. To avoid these range conflicts, the strategy to recognise common reason codes is change to depend on a reason flag, ERR_RFLAG_COMMON, and the common error codes themselves have moved start at 256, giving them the potential range 256..2^18-1, and thus allowing ERR_R_LIB_xxx the full range of library codes, 1..255. The dual purpose ERR_R_FATAL is also handled in this change, by allowing the rflags and reason codes to overlap by 1 bit, and make both ERR_R_FATAL and ERR_RFLAG_FATAL have the same value, 2^18. With this change, there's no need to worry about reason code conflicts any more, every library specific range as well as the common range is 1..2^18-1. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13093)
2020-10-09make ordinalsRichard Levitte1-23/+0
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13092)
2020-10-09Modify util/mknum.pl to drop new symbols that don't exist any moreRichard Levitte1-5/+17
This makes use of the writer filters in OpenSSL::Ordinals. Fixes #10395 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13092)
2020-10-09OpenSSL::Ordinals: Add options for the writing functionsRichard Levitte1-3/+18
OpenSSL::Ordinals::rewrite() and OpenSSL::Ordinals::write() now take options, that are simply passed to OpenSSL::Ordinals::items(). The 'sort' option is forbidden, though, since write() already uses it, but that means it's possible to filter the output. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13092)
2020-10-09INSTALL.md: Drop trailing spaces on a lineTomas Mraz1-1/+1
Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/13097)
2020-10-09Disabled symbol_presence test on NonStop due to different nm format.Randall S. Becker1-0/+1
CLA: trivial Fixes #12996 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13036)
2020-10-08Set mark and pop error in d2i_PrivateKey_exDaniel Bevenius2-2/+34
This commit sets the error mark before calling old_priv_decode and if old_priv_decode returns false, and if EVP_PKCS82PKEY is successful, the errors are popped to the previously set mark. The motivation for this is an issue we found when linking Node.js against OpenSSL 3.0. Details can be found in the link below and the test case provided in this commit attempts cover this. Refs: https://github.com/danbev/learning-libcrypto#asn1-wrong-tag-issue Refs: https://github.com/nodejs/node/issues/29817 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13073)
2020-10-08Fix zero-length content verification in S/MIME formatDmitry Belyavskiy2-2/+2
Fixes #13082 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13087)
2020-10-08Tests for processing zero-length content in SMIME formatDmitry Belyavskiy2-0/+17
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13087)
2020-10-08Correct and simplify use of ERR_clear_error() etc. for loading DSO libsDr. David von Oheimb5-20/+40
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13045)
2020-10-08Allow to continue on UNABLE_TO_VERIFY_LEAF_SIGNATUREAndré Klitzing1-3/+9
This unifies the behaviour of a single certificate with an unknown CA certificate with a self-signed certificate. The user callback can mask that error to retrieve additional error information. So the user application can decide to abort the connection instead to be forced by openssl. This change in behaviour is backward compatible as user callbacks who don't want to ignore UNABLE_TO_VERIFY_LEAF_SIGNATURE will still abort the connection by default. CLA: trivial Fixes #11297 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13083)
2020-10-08Fix the decoder start type handlingMatt Caswell1-1/+1
If an explicit decoder start type was provided then it wasn't being handled correctly in all cases. Specifically if a PEM start type was provided then the decoder would fail. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13050)
2020-10-08Add a test for encoding and decoding of parameters filesMatt Caswell1-32/+167
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13050)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 01:18:10 +0100