openssl.git
6 months agoParam builder: Remove the static size limit.
Pauli [Fri, 27 Mar 2020 00:33:46 +0000 (10:33 +1000)]
Param builder: Remove the static size limit.

Prior to this, the param builder had a statically sized array internally.
This changes it so that it uses a stack instead.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11390)

6 months agoParam build: make structures opaque.
Pauli [Wed, 25 Mar 2020 23:28:01 +0000 (09:28 +1000)]
Param build: make structures opaque.

Since this is public, it is best to make the underlying structure opaque.
This means converting from stack allocation to dynamic allocation for all
usages.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11390)

6 months agoNEWS: note OSSL_PARAM_BLD API as public.
Pauli [Tue, 24 Mar 2020 05:08:00 +0000 (15:08 +1000)]
NEWS: note OSSL_PARAM_BLD API as public.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11390)

6 months agoParam builder: make the OSSL_PARAM_BLD APIs public.
Pauli [Tue, 24 Mar 2020 04:58:57 +0000 (14:58 +1000)]
Param builder: make the OSSL_PARAM_BLD APIs public.

The catalyst for this is the difficult of passing BNs through the other
OSSL_PARAM APIs.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11390)

6 months agos_server: Properly indicate ALPN protocol mismatch
Tomas Mraz [Thu, 26 Mar 2020 14:59:00 +0000 (15:59 +0100)]
s_server: Properly indicate ALPN protocol mismatch

Return SSL_TLSEXT_ERR_ALERT_FATAL from alpn_select_cb so that
an alert is sent to the client on ALPN protocol mismatch.

Fixes: #2708

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11415)

6 months agoPROV: Fix EC_KEY exporters to allow domain parameter keys
Richard Levitte [Tue, 24 Mar 2020 15:31:43 +0000 (16:31 +0100)]
PROV: Fix EC_KEY exporters to allow domain parameter keys

The provider key export functions for EC_KEY assumed that a public key
is always present, and would fail if not.  This blocks any attempt to
export a key structure with only domain parameters.

This is similar to earlier work done in EVP_PKEY_ASN1_METHODs.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11394)

6 months agoDocument various SRP related APIs
Matt Caswell [Wed, 25 Mar 2020 17:43:50 +0000 (17:43 +0000)]
Document various SRP related APIs

This includes the newly added *_ex() variants that take a libctx/property
query string.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11410)

6 months agoUse the new library context aware SRP functions in sslapitest
Matt Caswell [Fri, 20 Mar 2020 17:24:51 +0000 (17:24 +0000)]
Use the new library context aware SRP functions in sslapitest

For the moment this still just uses the default library context, but a
future version of sslapitest will specify a non-default library context.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11410)

6 months agoUpdate libssl to use the new library context aware SRP functions
Matt Caswell [Fri, 20 Mar 2020 17:24:24 +0000 (17:24 +0000)]
Update libssl to use the new library context aware SRP functions

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11410)

6 months agoMake SRP library context aware
Matt Caswell [Fri, 20 Mar 2020 17:23:25 +0000 (17:23 +0000)]
Make SRP library context aware

In order for the TLS SRP tests to pass when using a non-default library
context the underlying SRP calls need to be library context aware.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11410)

6 months agoUse the new OCSP functions in sslapitest.c
Matt Caswell [Wed, 25 Mar 2020 15:01:36 +0000 (15:01 +0000)]
Use the new OCSP functions in sslapitest.c

At the moment we just use the default libctx - but a future PR will add
support for running sslapitest with a non-default libctx.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11407)

6 months agoAdd OCSP_RESPID_set_by_key_ex() and OCSP_RESPID_match_ex()
Matt Caswell [Fri, 20 Mar 2020 14:54:55 +0000 (14:54 +0000)]
Add OCSP_RESPID_set_by_key_ex() and OCSP_RESPID_match_ex()

OCSP_RESPID_set_by_key() calculates a SHA1 hash of the supplied
certificate. We need to be able to specify which libctx and property
query string is used to fetch that algorithm so we introduce
OCSP_RESPID_set_by_key_ex() which does the same thing but enables you to
speicfy the library context and propery query string explicitly.

OCSP_RESPID_match() matches with certificates based on the SHA1 hash.
Therefore for the same reason we introduce OCSP_RESPID_match_ex().

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11407)

6 months agoIgnore some fetch failures
Matt Caswell [Fri, 20 Mar 2020 12:00:12 +0000 (12:00 +0000)]
Ignore some fetch failures

Some fetch failurs are ok and should be ignored.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11405)

6 months agoPut an error on the stack in the event of a fetch failure
Matt Caswell [Wed, 25 Mar 2020 12:12:59 +0000 (12:12 +0000)]
Put an error on the stack in the event of a fetch failure

Fetch failures are a common problem and it is useful to have detailed
information about what was requested in the event of a failure.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11405)

6 months agoUse a fetched cipher for the TLSv1.3 early secret
Matt Caswell [Fri, 20 Mar 2020 12:37:20 +0000 (12:37 +0000)]
Use a fetched cipher for the TLSv1.3 early secret

We should use an explicitly fetched cipher to ensure that we are using
the correct libctx and property query.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11402)

6 months agoUse a fetched cipher when decrypting a ticket in libssl
Matt Caswell [Thu, 19 Mar 2020 18:23:58 +0000 (18:23 +0000)]
Use a fetched cipher when decrypting a ticket in libssl

We need to make sure we are using the correct libctx and property query.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11402)

6 months agoEVP: Limit the diverse key parameter functions to domain params only
Richard Levitte [Mon, 23 Mar 2020 05:03:16 +0000 (06:03 +0100)]
EVP: Limit the diverse key parameter functions to domain params only

Provider KEYMGMT functions can handle domain parameters as well as
"other" parameters (the cofactor mode flag in ECC keys is one of
those).  The public EVP functions EVP_PKEY_copy_parameters(),
EVP_PKEY_missing_parameters(), EVP_PKEY_cmp_parameters() and
EVP_PKEY_cmp() tried to handle all parameters, but looking back at
EVP_PKEY_ASN1_METHOD code (especially crypto/ec/ec_ameth.c), it turns
out that they only need to concern themselves with domain parameters.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11375)

6 months agoEVP: Implement support for key downgrading in backends
Richard Levitte [Mon, 23 Mar 2020 04:40:47 +0000 (05:40 +0100)]
EVP: Implement support for key downgrading in backends

Downgrading EVP_PKEYs from containing provider side internal keys to
containing legacy keys demands support in the EVP_PKEY_ASN1_METHOD.

This became a bit elaborate because the code would be almost exactly
the same as the import functions int EVP_KEYMGMT.  Therefore, we end
up moving most of the code to common backend support files that can be
used both by legacy backend code and by our providers.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11375)

6 months agotest/evp_pkey_provided_test.c: Add test of EVP_PKEY_copy_parameters()
Richard Levitte [Sat, 21 Mar 2020 05:26:41 +0000 (06:26 +0100)]
test/evp_pkey_provided_test.c: Add test of EVP_PKEY_copy_parameters()

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11375)

6 months agoEVP: Downgrade keys rather than upgrade
Richard Levitte [Sat, 21 Mar 2020 05:21:26 +0000 (06:21 +0100)]
EVP: Downgrade keys rather than upgrade

Upgrading EVP_PKEYs from containing legacy keys to containing provider
side keys proved to be risky, with a number of unpleasant corner
cases, and with functions like EVP_PKEY_get0_DSA() failing
unexpectedly.

We therefore change course, and instead of upgrading legacy internal
keys to provider side internal keys, we downgrade provider side
internal keys to legacy ones.  To be able to do this, we add
|import_from| and make it a callback function designed for
evp_keymgmt_export().

This means that evp_pkey_upgrade_to_provider() is replaced with
evp_pkey_downgrade().

EVP_PKEY_copy_parameters() is the most deeply affected function of
this change.

Fixes #11366

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11375)

6 months agoEVP: Add EVP_PKEY_set_type_by_keymgmt() and use it
Richard Levitte [Sat, 21 Mar 2020 05:14:25 +0000 (06:14 +0100)]
EVP: Add EVP_PKEY_set_type_by_keymgmt() and use it

This function intialises an EVP_PKEY to contain a provider side internal
key.

We take the opportunity to also document the older EVP_PKEY_set_type()
and EVP_PKEY_set_type_str().

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11375)

6 months agoEVP: Clarify the states of an EVP_PKEY
Richard Levitte [Sat, 21 Mar 2020 05:03:39 +0000 (06:03 +0100)]
EVP: Clarify the states of an EVP_PKEY

EVP_PKEY is rather complex, even before provider side keys entered the
stage.
You could have untyped / unassigned keys (pk->type == EVP_PKEY_NONE),
keys that had been assigned a type but no data (pk->pkey.ptr == NULL),
and fully assigned keys (pk->type != EVP_PKEY_NONE && pk->pkey.ptr != NULL).

For provider side keys, the corresponding states weren't well defined,
and the code didn't quite account for all the possibilities.

We also guard most of the legacy fields in EVP_PKEY with FIPS_MODE, so
they don't exist at all in the FIPS module.

Most of all, code needs to adapt to the case where an EVP_PKEY's
|keymgmt| is non-NULL, but its |keydata| is NULL.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11375)

6 months agoEC: Refactor ec_curve_name2nid() to accept NIST curve names
Richard Levitte [Tue, 24 Mar 2020 10:18:50 +0000 (11:18 +0100)]
EC: Refactor ec_curve_name2nid() to accept NIST curve names

We can find no reason why everyone should have to call both
EC_curve_nist2nid() and ec_curve_name2nid() to find the NID for a
name, and it's too easy to forget EC_curve_nist2nid(), so we make life
simpler.

One could argue that FIPS only allows a limited set of names, but that
now gets handled internally, and those who really want to be really
sure to only get the NIST names can still do so with EC_curve_nist2nid()

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11391)

6 months agoChunk 9 of CMP contribution to OpenSSL: CMP client and related tests
Dr. David von Oheimb [Tue, 10 Mar 2020 16:32:57 +0000 (17:32 +0100)]
Chunk 9 of CMP contribution to OpenSSL: CMP client and related tests

Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL
Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712).
Adds the CMP and CRMF API to libcrypto and the "cmp" app to the CLI.
Adds extensive documentation and tests.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11300)

6 months agoFix bug in strncpy() use of sk_ASN1_UTF8STRING2text() in asn1_lib.c
Dr. David von Oheimb [Fri, 20 Mar 2020 14:15:34 +0000 (15:15 +0100)]
Fix bug in strncpy() use of sk_ASN1_UTF8STRING2text() in asn1_lib.c

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11300)

6 months agoFix whitespace nit in OSSL_SELF_TEST_new.pod which caused doc-nits warning
Dr. David von Oheimb [Thu, 12 Mar 2020 08:51:55 +0000 (09:51 +0100)]
Fix whitespace nit in OSSL_SELF_TEST_new.pod which caused doc-nits warning

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11300)

6 months agoIssuer Sign Tool extention support
Nikolay Morozov [Mon, 2 Mar 2020 07:17:30 +0000 (10:17 +0300)]
Issuer Sign Tool extention support

Issuer Sign Tool (1.2.643.100.112) The name of the tool used to signs the subject (ASN1_SEQUENCE)
This extention is required to obtain the status of a qualified certificate at Russian Federation.
RFC-style description is available here: https://tools.ietf.org/html/draft-deremin-rfc4491-bis-04#section-5
Russian Federal Law 63 "Digital Sign" is available here:  http://www.consultant.ru/document/cons_doc_LAW_112701/

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11216)

6 months agoFix EVP_PKEY_new_mac_key()
Matt Caswell [Wed, 18 Mar 2020 14:46:33 +0000 (14:46 +0000)]
Fix EVP_PKEY_new_mac_key()

EVP_PKEY_new_mac_key() was failing if the specified MAC was not available
in the default provider - even though that MAC is never actually needed
to successfully complete the function. The resulting EVP_PKEY can then
be used in some non-default libctx which *does* have the MAC loaded.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11360)

6 months agoutil/wrap.pl: Correct exit code when signalled
Richard Levitte [Sun, 22 Mar 2020 03:15:14 +0000 (04:15 +0100)]
util/wrap.pl: Correct exit code when signalled

On Unix, a caught signal that exits the process does so with an exit
code that is 'signal | 128'.  This modifies util/wrap.pl to mimic
that.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11379)

6 months agoUse ctx2 instead ctx.
Richard Könning [Fri, 20 Mar 2020 19:17:50 +0000 (20:17 +0100)]
Use ctx2 instead ctx.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/11372)

6 months agoMake sure we use a fetched cipher when encrypting stateless tickets
Matt Caswell [Fri, 13 Mar 2020 23:51:28 +0000 (23:51 +0000)]
Make sure we use a fetched cipher when encrypting stateless tickets

We use AES-256-CBC to encrypt stateless session tickets. We should
ensure that the implementation is fetched from the appropriate provider.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11356)

6 months agoUse a fetched version of SHA256 in tls_process_new_session_ticket()
Matt Caswell [Fri, 13 Mar 2020 23:54:07 +0000 (23:54 +0000)]
Use a fetched version of SHA256 in tls_process_new_session_ticket()

We use the SHA256 digest of the ticket as a "fake" session id. We should
ensure that the SHA256 implementation is fetched from the appropriate
provider.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11356)

6 months agoUse correct libctx when fetching the TLS1 PRF in libssl
Matt Caswell [Thu, 12 Mar 2020 14:50:37 +0000 (14:50 +0000)]
Use correct libctx when fetching the TLS1 PRF in libssl

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11357)

6 months agoUse the libctx and properties when constructing an EVP_PKEY_CTX
Matt Caswell [Wed, 18 Mar 2020 12:57:48 +0000 (12:57 +0000)]
Use the libctx and properties when constructing an EVP_PKEY_CTX

When constructing an RSA ClientKeyExchange make sure we construct our
EVP_PKEY_CTX using the correct libctx and properties

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11357)

6 months agoUpdate CA.pl podpage, and script
Rich Salz [Mon, 16 Mar 2020 19:53:00 +0000 (15:53 -0400)]
Update CA.pl podpage, and script

Merge the NOTES section into the relevant parts of the manpage.
Add the $EXTRA parameter in consistent places (the end) to call
commands.  Document that multiple -extra-XXX might be needed.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11338)

6 months agoHandle mdname in legacy EVP_DigestSignInit_ex codepaths
Matt Caswell [Mon, 16 Mar 2020 16:04:12 +0000 (16:04 +0000)]
Handle mdname in legacy EVP_DigestSignInit_ex codepaths

Even though an application callS the new EVP_DigestSignInit_ex()
function to pass an mdname by string rather than EVP_MD, we may still end
up in legacy codepaths, and therefore we need to handle either mdname or
EVP_MD, in both legacy and non-legacy codepaths.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11353)

6 months agoMake it possible to easily specify a libctx for EVP_DigestSign*
Matt Caswell [Thu, 12 Mar 2020 14:39:47 +0000 (14:39 +0000)]
Make it possible to easily specify a libctx for EVP_DigestSign*

EVP_DigestSignInit_ex and EVP_DigestVerifyInit_ex did not provide the
capability to specify an explicit OPENSSL_CTX parameter. It is still
possible by explicitly setting an EVP_PKEY_CTX - but in most cases it
would be much simpler to just specify it in the Init call. We add the
capability to do that.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11353)

6 months agoDH, DSA, EC_KEY: Fix exporters to allow domain parameter keys
Richard Levitte [Thu, 19 Mar 2020 21:29:10 +0000 (22:29 +0100)]
DH, DSA, EC_KEY: Fix exporters to allow domain parameter keys

The export-to-provider functions for DH, DSA and EC_KEY assumed that a
public key is always present, and would fail if not.  This blocks any
attempt to export a key structure with only domain parameters.

While fixing this, we also modify the selection declaration to
evp_keymgmt_import() to be more adaptive, the diverse selection bits
are now added when the corresponding data is added to the OSSL_PARAM
array.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11374)

6 months agoConstify various mostly X509-related parameter types in crypto/ and apps/
Dr. David von Oheimb [Mon, 23 Mar 2020 07:30:37 +0000 (08:30 +0100)]
Constify various mostly X509-related parameter types in crypto/ and apps/

in particular X509_NAME*, X509_STORE{,_CTX}*, and ASN1_INTEGER *,
also some result types of new functions, which does not break compatibility

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/10504)

6 months agoFix error handling in x509v3_cache_extensions and related functions
Bernd Edlinger [Sat, 4 Jan 2020 14:54:53 +0000 (15:54 +0100)]
Fix error handling in x509v3_cache_extensions and related functions

Basically we use EXFLAG_INVALID for all kinds of out of memory and
all kinds of parse errors in x509v3_cache_extensions.

[extended tests]

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10755)

6 months agoevp_test: the tests using MDC2 need the legacy provider
Richard Levitte [Tue, 17 Mar 2020 13:41:59 +0000 (14:41 +0100)]
evp_test: the tests using MDC2 need the legacy provider

This was always a potential, we just haven't seen this need before now.

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/11343)

6 months agoEVP: fetch the EVP_KEYMGMT earlier
Richard Levitte [Tue, 17 Mar 2020 13:37:47 +0000 (14:37 +0100)]
EVP: fetch the EVP_KEYMGMT earlier

Instead of fetching the EVP_KEYMGMT in the init for every different
operation, do it when creating the EVP_PKEY_CTX.

This allows certain control functions to be called between the
creation of the EVP_PKEY_CTX and the call of the operation's init
function.

Use case: EVP_PKEY_CTX_set1_id(), which is allowed to be called very
early with the legacy implementation, this should still be allowed
with provider implementations.

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/11343)

6 months agos_server: warn about NO PSK identity hint in TLSv1.3
EasySec [Thu, 12 Mar 2020 13:38:38 +0000 (14:38 +0100)]
s_server: warn about NO PSK identity hint in TLSv1.3

There is NO PSK identity hint in TLSv1.3 so output a warning message
when inconsistent PSK / TLS options are mixed.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11322)

6 months agoAdd support for passing the libctx to the config loader
Shane Lontis [Fri, 20 Mar 2020 10:25:39 +0000 (20:25 +1000)]
Add support for passing the libctx to the config loader

The self tests for the fips module are triggered on startup and they need to know the
core's libctx in order to function correctly. As the provider can be autoloaded via configuration
it then needs to propagate the callers libctx down to the provider via the config load.

Note that OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, ..) is still called, but will only load the default
configuration if the OPENSSL_CONF environment variable is set.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11240)

6 months agoUse RAND_bytes_ex in crypto/rsa
Matt Caswell [Thu, 12 Mar 2020 14:41:45 +0000 (14:41 +0000)]
Use RAND_bytes_ex in crypto/rsa

At various points in crypto/rsa we need to get random numbers. We should
ensure that we use the correct libctx when doing so.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11355)

6 months agoMake sure we use the libctx when fetching a MAC
Matt Caswell [Thu, 12 Mar 2020 14:40:18 +0000 (14:40 +0000)]
Make sure we use the libctx when fetching a MAC

We were doing an EVP_MAC_fetch without using the correct libctx.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11354)

6 months agoHandle the case where there is no digest in an EVP_MD_CTX
Matt Caswell [Thu, 12 Mar 2020 10:55:51 +0000 (10:55 +0000)]
Handle the case where there is no digest in an EVP_MD_CTX

EVP_MD_CTX_ctrl assumes that a digest has always been set. However in a
non-legacy EVP_DigestSign* operation this is not the case because the
digest is handled entirely by the underlying signature implementation.

This fixes one of the travis failures on the master branch.

[extended tests]

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11317)

6 months agoUpdate CHANGES and NEWS for 1.1.1e release
Dr. Matthias St. Pierre [Tue, 17 Mar 2020 16:25:51 +0000 (17:25 +0100)]
Update CHANGES and NEWS for 1.1.1e release

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11346)

6 months agomake err() message strings of find-doc-nits consistently start with uppercase letters
David von Oheimb [Thu, 13 Feb 2020 20:35:38 +0000 (21:35 +0100)]
make err() message strings of find-doc-nits consistently start with uppercase letters

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11092)

6 months agoadd line and file info to 'Malformed line' error msg on *.num files in make-doc-nits
David von Oheimb [Thu, 13 Feb 2020 20:37:04 +0000 (21:37 +0100)]
add line and file info to 'Malformed line' error msg on *.num files in make-doc-nits

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11092)

6 months agoRename OSSL_{d2i,i2d}_CMP_MSG_bio to {d2i,id2}_OSSL_CMP_MSG_bio
Dr. David von Oheimb [Wed, 11 Mar 2020 12:42:49 +0000 (13:42 +0100)]
Rename OSSL_{d2i,i2d}_CMP_MSG_bio to {d2i,id2}_OSSL_CMP_MSG_bio

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11307)

6 months agofix false positive of check-format.pl regarding '#if' on preceding line; extend negat...
Dr. David von Oheimb [Tue, 10 Mar 2020 07:12:57 +0000 (08:12 +0100)]
fix false positive of check-format.pl regarding '#if' on preceding line; extend negative tests

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11285)

6 months agomake util/check-format.pl script executable
Dr. David von Oheimb [Mon, 9 Mar 2020 13:48:14 +0000 (14:48 +0100)]
make util/check-format.pl script executable

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11285)

6 months agofix false positive of check-format.pl reporting '{1 stmt}' after multi-line 'if(expr)'
Dr. David von Oheimb [Mon, 9 Mar 2020 13:42:40 +0000 (14:42 +0100)]
fix false positive of check-format.pl reporting '{1 stmt}' after multi-line 'if(expr)'

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11285)

6 months agoExtend Travis build time-out
Rich Salz [Wed, 11 Mar 2020 18:17:00 +0000 (14:17 -0400)]
Extend Travis build time-out

- Add travis_wait to the build command
- And travis_retry to some apt-get commands.
- Use `make _tests` instead of `make test`

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/11319)

6 months agoImplement serializers for ED25519 and ED448
Matt Caswell [Tue, 17 Mar 2020 22:40:33 +0000 (08:40 +1000)]
Implement serializers for ED25519 and ED448

This is largely based on the existing X25519 and X448 serializers - but
a few adjustments were necessary so that we can identify what type of key
we are using. Previously we used the keylen for this but X25519 and
ED25519 have the same keylen.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11272)

6 months agosslapitest: don't leak the SSL_CTX pair
Ben Kaduk [Mon, 16 Mar 2020 18:02:14 +0000 (11:02 -0700)]
sslapitest: don't leak the SSL_CTX pair

We have no need for a new set of SSL_CTXs in test_ccs_change_cipher(), so
just keep using the original ones.  Also, fix a typo in a comment.

[extended tests]

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11336)

6 months agoFix the compile error once enabled Werror
Xiaokang Qian [Wed, 11 Mar 2020 05:37:24 +0000 (05:37 +0000)]
Fix the compile error once enabled Werror

On 32 bit operating system,size_t is defined as unsigned int,
this is the return type of strlen(), but it isn't aligned with the %ld,
when compiling, warning will be reported.
Change the type to %zu to avoid the warning.

Change-Id: I2943d0dfba88ef42892f14230242008473d6263b

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11325)

6 months agoUse a flag in SSL3_BUFFER to track when an application buffer is reused.
John Baldwin [Wed, 20 Nov 2019 21:40:12 +0000 (13:40 -0800)]
Use a flag in SSL3_BUFFER to track when an application buffer is reused.

With KTLS, writes to an SSL connection store the application buffer
pointer directly in the 'buf' member instead of allocating a separate
buffer to hold the encrypted data.  As a result,
ssl3_release_write_buffer() has to avoid freeing these 'buf' pointers.

Previously, ssl3_release_write_buffer() checked for KTLS being enabled
on the write BIO to determine if a buffer should be freed.  However, a
buffer can outlive a BIO.  For example, 'openssl s_time' creates new
write BIOs when reusing sessions.  Since the new BIO did not have KTLS
enabled at the start of a connection, ssl3_release_write_buffer()
would incorrectly try to free the 'buf' pointer from the previous KTLS
connection.  To fix, track the state of 'buf' explicitly in
SSL3_BUFFER to determine if the 'buf' should be freed or simply
cleared.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10489)

6 months agoSupport KTLS on connections using BIO_TYPE_CONNECT.
John Baldwin [Tue, 19 Nov 2019 22:12:56 +0000 (14:12 -0800)]
Support KTLS on connections using BIO_TYPE_CONNECT.

This requires duplicating the KTLS changes from bss_sock.c in
bss_conn.c.  One difference from BIO_TYPE_SOCKET is that the call to
ktls_enable is performed after the socket is created in BIO_socket
rather than BIO_new_connect.

Some applications such as 'openssl s_time' use connect BIOs instead of
socket BIOs.  Note that the new connections created for accept BIOs
use BIO_TYPE_SOCKET via BIO_new_socket, so bss_acpt.c does not require
changes.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10489)

6 months agoTEST: Adapt all applicable tests to the new distinguishing ID
Richard Levitte [Tue, 10 Mar 2020 22:10:29 +0000 (23:10 +0100)]
TEST: Adapt all applicable tests to the new distinguishing ID

Fixes #11293

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/11302)

6 months agoAPPS: Remove all traces of special SM2 treatment.
Richard Levitte [Tue, 10 Mar 2020 22:08:59 +0000 (23:08 +0100)]
APPS: Remove all traces of special SM2 treatment.

SM2 IDs are now passed entirely as '-pkeyopt', '-sigopt' or '-vfyopt'
values, just like any other valid option.

Fixes #11293

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/11302)

6 months agoAPPS: Add ctrl_str()-like functionality for X509 and X509_REQ
Richard Levitte [Tue, 10 Mar 2020 22:05:09 +0000 (23:05 +0100)]
APPS: Add ctrl_str()-like functionality for X509 and X509_REQ

This should really be part of libcrypto, but since this looks like
added legacy support, it's preferable to keep it in apps for now.

This allows to build functions that add user given verification
options to X509 and X509_REQ structures.

Fixes #11293

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/11302)

6 months agoSM2: Make the EVP_PKEY_METHOD ctrl_str function listen to distid
Richard Levitte [Tue, 10 Mar 2020 22:00:45 +0000 (23:00 +0100)]
SM2: Make the EVP_PKEY_METHOD ctrl_str function listen to distid

Because we start using Distinguished ID, we also define the key name
"distid", possibly prefixed with "hex", but keep "sm2_id" and
"sm2_hex_id" for compatibility with GmSSL.

Fixes #11293

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/11302)

6 months agoX509: Rename X509_set0_sm2_id() and friends
Richard Levitte [Tue, 10 Mar 2020 21:50:22 +0000 (22:50 +0100)]
X509: Rename X509_set0_sm2_id() and friends

- X509_set0_sm2_id() -> X509_set0_distinguishing_id()
- X509_get0_sm2_id() -> X509_get0_distinguishing_id()
- X509_REQ_set0_sm2_id -> X509_REQ_set0_distinguishing_id()
- X509_REQ_get0_sm2_id -> X509_REQ_get0_distinguishing_id()

The reason for this rename is that the SM2 ID isn't really a unique
SM2 data item, but rather a re-use of the Distinguished that is
defined in ISO/IEC 15946-3 as well as in FIPS 196, with no special
attribution toward any algorithm in particular.

Fixes #11293

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/11302)

6 months agoEVP: Don't call digest_custom() quite so early
Richard Levitte [Tue, 10 Mar 2020 21:07:10 +0000 (22:07 +0100)]
EVP: Don't call digest_custom() quite so early

A huge problem with calling digest_custom() already in the
initialization of DigestSign, DigestVerify etc, is that it force all
callers to know that certain controls must be performed before Init
and the rest after.  This has lead to quite interesting hacks in our
own openssl app, where the SM2 ID had to get special treatment instead
of just being another sign option or verification option among others.

This change moves the call of digest_custom() to the Update and Final
functions, to be done exactly once, subject to a flag that's set in
the Init function.  Seeing to the process of data, through these
operations, this makes no difference at all.  Seeing to making it
possible to perform all controls after the Init call, this makes a
huge difference.

Fixes #11293

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/11302)

6 months agoAdd ECDSA to providers
Shane Lontis [Sun, 15 Mar 2020 11:34:29 +0000 (21:34 +1000)]
Add ECDSA to providers

Added ECDSA support for OSSL_SIGNATURE_PARAM_ALGORITHM_ID

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10968)

6 months agoFix legacy_ctrl_to_param() to pay better attention to keytype
Richard Levitte [Sat, 14 Mar 2020 04:16:16 +0000 (05:16 +0100)]
Fix legacy_ctrl_to_param() to pay better attention to keytype

The keytype number will only be -1 when control commands are used for
more than one key type.  Sometimes, they share the same underlying
structure, and sometimes not.

Some of the RSA control commands that are using only with the keytype
EVP_PKEY_RSA we misplaced to be handled with the keytype -1.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11329)

6 months agoAdd RSA sign to the fips provider
Shane Lontis [Sun, 15 Mar 2020 07:38:00 +0000 (17:38 +1000)]
Add RSA sign to the fips provider

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11199)

6 months agoDOCS: Fix the description of OSSL_PARAM_allocate_from_text()
Richard Levitte [Sun, 8 Mar 2020 15:37:37 +0000 (16:37 +0100)]
DOCS: Fix the description of OSSL_PARAM_allocate_from_text()

Fixes #11276

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11279)

6 months agoDH: remove DH parameter files that aren't used or installed.
Pauli [Thu, 12 Mar 2020 22:55:04 +0000 (08:55 +1000)]
DH: remove DH parameter files that aren't used or installed.

Old files from the SSLeay 0.8.1b import that aren't used and don't seem to be
installed.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11314)

6 months agoRemove reference to old DH files.
Pauli [Thu, 12 Mar 2020 22:23:27 +0000 (08:23 +1000)]
Remove reference to old DH files.

The files are incorrect for TLS.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11314)

6 months agoRemove old incorrect DH parameter files
Pauli [Thu, 12 Mar 2020 21:46:36 +0000 (07:46 +1000)]
Remove old incorrect DH parameter files

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11314)

6 months agodh: document what the PEM files in apps actually contain.
Pauli [Thu, 12 Mar 2020 03:51:57 +0000 (13:51 +1000)]
dh: document what the PEM files in apps actually contain.

They were claimed to be the SKIP primes but they are really two of the
MODP Diffie-Hellman groups for IKE.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11314)

6 months agoFix RSA structure
Richard Levitte [Thu, 12 Mar 2020 05:26:34 +0000 (06:26 +0100)]
Fix RSA structure

The first field was called 'pad', but not for the reason one might
think.  It was really a padding int that was always zero, and was
placed first on purpose.  This is to pick up programming errors where
an RSA pointer was passed when an EVP_PKEY pointer should have been,
an makes it look like an EVP_PKEY structure with type EVP_PKEY_NONE,
which effectively avoids any further processing (and unintended
corruption of the RSA structure).

This is only relevant for legacy structure and EVP_PKEY_METHODs.  With
providers, EVP_PKEYs aren't passed to the backend anyway.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11315)

6 months agoConfigurations: Fix "android" configuration target
Richard Levitte [Tue, 3 Mar 2020 21:55:09 +0000 (22:55 +0100)]
Configurations: Fix "android" configuration target

This target gave '-pie' as a C flag when it should be a linker flag.
Additionally, we add '-fPIE' as C flag for binaries.

Fixes #11237

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11238)

6 months agoAndoid cross compile: change ANDROID_NDK_HOME to ANDROID_NDK_ROOT
Richard Levitte [Sat, 29 Feb 2020 05:43:26 +0000 (06:43 +0100)]
Andoid cross compile: change ANDROID_NDK_HOME to ANDROID_NDK_ROOT

According to forum discussions with NDK developers, ANDROID_NDK_HOME
is used for something else.

Fixes #11205

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11206)

6 months agoAdd test that changes ciphers on CCS
Benjamin Kaduk [Fri, 6 Mar 2020 21:19:45 +0000 (13:19 -0800)]
Add test that changes ciphers on CCS

The TLS (pre-1.3) ChangeCipherState message is usually used to indicate
the switch from the unencrypted to encrypted part of the handshake.
However, it can also be used in cases where there is an existing
session (such as during resumption handshakes) or when changing from
one cipher to a different one (such as during renegotiation when the
cipher list offered by the client has changed).  This test serves
to exercise such situations, allowing us to detect whether session
objects are being modified in cases when they must remain immutable
for thread-safety purposes.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10943)

6 months agoCode to thread-safety in ChangeCipherState
Benjamin Kaduk [Fri, 24 Jan 2020 21:44:27 +0000 (13:44 -0800)]
Code to thread-safety in ChangeCipherState

The server-side ChangeCipherState processing stores the new cipher
in the SSL_SESSION object, so that the new state can be used if
this session gets resumed.  However, writing to the session is only
thread-safe for initial handshakes, as at other times the session
object may be in a shared cache and in use by another thread at the
same time.  Reflect this invariant in the code by only writing to
s->session->cipher when it is currently NULL (we do not cache sessions
with no cipher).  The code prior to this change would never actually
change the (non-NULL) cipher value in a session object, since our
server enforces that (pre-TLS-1.3) resumptions use the exact same
cipher as the initial connection, and non-abbreviated renegotiations
have produced a new session object before we get to this point.
Regardless, include logic to detect such a condition and abort the
handshake if it occurs, to avoid any risk of inadvertently using
the wrong cipher on a connection.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10943)

6 months agoDon't write to the session when computing TLS 1.3 keys
Benjamin Kaduk [Fri, 24 Jan 2020 21:25:53 +0000 (13:25 -0800)]
Don't write to the session when computing TLS 1.3 keys

TLS 1.3 maintains a separate keys chedule in the SSL object, but
was writing to the 'master_key_length' field in the SSL_SESSION
when generating the per-SSL master_secret.  (The generate_master_secret
SSL3_ENC_METHOD function needs an output variable for the master secret
length, but the TLS 1.3 implementation just uses the output size of
the handshake hash function to get the lengths, so the only natural-looking
thing to use as the output length was the field in the session.
This would potentially involve writing to a SSL_SESSION object that was
in the cache (i.e., resumed) and shared with other threads, though.

The thread-safety impact should be minimal, since TLS 1.3 requires the
hash from the original handshake to be associated with the resumption
PSK and used for the subsequent connection.  This means that (in the
resumption case) the value being written would be the same value that was
previously there, so the only risk would be on architectures that can
produce torn writes/reads for aligned size_t values.

Since the value is essentially ignored anyway, just provide the
address of a local dummy variable to generate_master_secret() instead.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10943)

6 months agoFix whitespace nit in ssl_generate_master_secret()
Benjamin Kaduk [Fri, 24 Jan 2020 21:25:02 +0000 (13:25 -0800)]
Fix whitespace nit in ssl_generate_master_secret()

Use a space after a comma.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10943)

6 months agodoc: fix spelling of TYPE_get_ex_new_index
Benjamin Kaduk [Fri, 17 Jan 2020 19:15:59 +0000 (11:15 -0800)]
doc: fix spelling of TYPE_get_ex_new_index

The generated macros are TYPE_get_ex_new_index() (to match
CRYPTO_get_ex_new_index()), not TYPE_get_new_ex_index(), even though
the latter spelling seems more natural.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10943)

6 months agoAdditional updates to SSL_CTX_sess_set_get_cb.pod
Benjamin Kaduk [Thu, 16 Jan 2020 22:37:44 +0000 (14:37 -0800)]
Additional updates to SSL_CTX_sess_set_get_cb.pod

Generally modernize the language.

Refer to TLS instead of SSL/TLS, and try to have more consistent
usage of commas and that/which.

Reword some descriptions to avoid implying that a list of potential
reasons for behavior is an exhaustive list.

Clarify how get_session_cb() is only called on servers (i.e., in general,
and that it's given the session ID proposed by the client).

Clarify the semantics of the get_cb()'s "copy" argument.
The behavior seems to have changed in commit
8876bc054802b043a3ec95554b6c5873291770be, though the behavior prior
to that commit was not to leave the reference-count unchanged if
*copy was not written to -- instead, libssl seemed to assume that the
callback already had incremented the reference count.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10943)

6 months agodoc: Update the reference from draft to RFC
Jakub Jelen [Tue, 10 Mar 2020 14:15:28 +0000 (15:15 +0100)]
doc: Update the reference from draft to RFC

CLA: trivial

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11299)

6 months agopkcs12 demo: output correct file names on error.
ning [Wed, 11 Mar 2020 07:28:05 +0000 (15:28 +0800)]
pkcs12 demo: output correct file names on error.

CLA: Trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11304)

6 months agotest/recipes/30-test_evp_data/evppkey.txt: Change an expected KeyGen result
Richard Levitte [Tue, 18 Feb 2020 14:37:08 +0000 (15:37 +0100)]
test/recipes/30-test_evp_data/evppkey.txt: Change an expected KeyGen result

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/10289)

6 months agotest/evp_test.c: fix keygen_test_run()
Richard Levitte [Tue, 18 Feb 2020 14:35:24 +0000 (15:35 +0100)]
test/evp_test.c: fix keygen_test_run()

There was a misunderstanding what it should return.  It should return
0 on internal error, but 1 even if the thing it tests fails (the error
is determined by |t->err|).

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/10289)

6 months agoPROV: Add RSA functionality for key generation
Richard Levitte [Sun, 27 Oct 2019 14:28:29 +0000 (15:28 +0100)]
PROV: Add RSA functionality for key generation

This includes added support in legacy controls

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/10289)

6 months agoEVP: Add new domparams and key generation functionality
Richard Levitte [Sun, 27 Oct 2019 14:09:26 +0000 (15:09 +0100)]
EVP: Add new domparams and key generation functionality

The following functions are added:

EVP_PKEY_gen_set_params(), replacing the older EVP_PKEY_CTX_ctrl()
EVP_PKEY_gen(), replacing both EVP_PKEY_keygen() and EVP_PKEY_paramgen()

These functions are made to work together with already existing domparams
and key generation functionality: EVP_PKEY_CTX_new_provided(),
EVP_PKEY_paramgen_init(), EVP_PKEY_keygen_init(), etc.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/10289)

6 months agoCORE: Add the key object generator libcrypto<->provider interface
Richard Levitte [Sat, 26 Oct 2019 11:00:56 +0000 (13:00 +0200)]
CORE: Add the key object generator libcrypto<->provider interface

We introduce these dispatched functions:

-   OP_keymgmt_gen_init() to initialize the key object generation.
-   OP_keymgmt_gen_set_template() to set a template for key object
    generation.  The template is another key object, for example one
    with domain parameters.
-   OP_keymgmt_gen_set_params() to set other key object generation
    parameters.
-   OP_keymgmt_gen_settable_params() to find out what settable
    parameters there are.
-   OP_keymgmt_gen() to perform the key object generation.
-   OP_keymgmt_gen_cleanup() to clean up the key object generation.

Internal function for easy and consistent use of these ddispatched
functions are added.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/10289)

6 months agoAdd ECDH to fips provider
Shane Lontis [Thu, 20 Feb 2020 06:16:21 +0000 (16:16 +1000)]
Add ECDH to fips provider

Note: This PR has not attempted to move the curves into the provider dispatch table.
Mappings between the curve name / nid have been added to the inbuilt curve table.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11133)

6 months agoAdd EC key validation to default provider
Shane Lontis [Thu, 16 Jan 2020 07:18:26 +0000 (17:18 +1000)]
Add EC key validation to default provider

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10861)

6 months agoIf the first serializer we find is the desired one that's ok
Matt Caswell [Fri, 6 Mar 2020 18:05:37 +0000 (18:05 +0000)]
If the first serializer we find is the desired one that's ok

Stop looking for a desired serializer if the first one is desired.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11271)

6 months agoDon't crash if we fail to find a serializer for the current provider
Matt Caswell [Fri, 6 Mar 2020 18:02:46 +0000 (18:02 +0000)]
Don't crash if we fail to find a serializer for the current provider

The code was assuming that a serializer would always be found - but this
may not be the case.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11271)

6 months agoAES CTR-DRGB: add test for 32-bit counter overflow
Patrick Steuer [Sat, 22 Feb 2020 00:34:20 +0000 (01:34 +0100)]
AES CTR-DRGB: add test for 32-bit counter overflow

Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10457)

6 months agoAES CTR-DRGB: performance improvement
Patrick Steuer [Fri, 15 Nov 2019 22:27:09 +0000 (23:27 +0100)]
AES CTR-DRGB: performance improvement

Optimize the the AES-based implementation of the CTR_DRBG
construction, see 10.2.1 in [1].
Due to the optimizations, the code may deviate (more) from the
pseudocode in [1], but it is functional equivalence being decisive
for compliance:

"All DRBG mechanisms and algorithms are described in this document
in pseudocode, which is intended to explain functionality.
The pseudocode is not intended to constrain real-world
implementations." [9 in [1]].

The following optimizations are done:

- Replace multiple plain AES encryptions by a single AES-ECB
  encryption of a corresponding pre-initialized buffer, where
  possible.
  This allows platform-specific AES-ECB support to
  be used and reduces the overhead of multiple EVP calls.

- Replace the generate operation loop (which is a counter
  increment followed by a plain AES encryption) by a
  loop which does a plain AES encryption followed by
  a counter increment. The latter loop is just a description
  of AES-CTR, so we replace it by a single AES-CTR
  encryption.
  This allows for platform-specific AES-CTR support to be used
  and reduces the overhead of multiple EVP calls.
  This change, that is, going from a pre- to a post- counter
  increment, requires the counter in the internal state
  to be kept at "+1" (compared to the pseudocode in [1])
  such that it is in the correct state, when a generate
  operation is called.
  That in turn also requires all other operations to be
  changed from pre- to post-increment to keep functional
  equivalence.

[1] NIST SP 800-90A Revision 1

Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10457)

6 months agoDOCS: Use "command" not "tool" or "utility"
Rich Salz [Tue, 18 Feb 2020 16:52:12 +0000 (11:52 -0500)]
DOCS: Use "command" not "tool" or "utility"

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11123)

6 months agoMove OSSL_CMP_X509_digest() to x_all.c, renaming it to X509_digest_sig()
Dr. David von Oheimb [Thu, 5 Mar 2020 08:16:29 +0000 (09:16 +0100)]
Move OSSL_CMP_X509_digest() to x_all.c, renaming it to X509_digest_sig()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11142)

6 months agoFix handling of CMP msg senderKID and improve doc of related CTX functions
Dr. David von Oheimb [Wed, 26 Feb 2020 20:41:47 +0000 (21:41 +0100)]
Fix handling of CMP msg senderKID and improve doc of related CTX functions

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11142)

6 months agoFix error in case CMP msg POPO is not provided in OSSL_CRMF_MSGS_verify_popo()
Dr. David von Oheimb [Tue, 25 Feb 2020 07:58:39 +0000 (08:58 +0100)]
Fix error in case CMP msg POPO is not provided in OSSL_CRMF_MSGS_verify_popo()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11142)