openssl.git
4 months agoAdd SSL_new_session_ticket() API
Benjamin Kaduk [Mon, 16 Mar 2020 18:25:58 +0000 (11:25 -0700)]
Add SSL_new_session_ticket() API

This API requests that the TLS stack generate a (TLS 1.3)
NewSessionTicket message the next time it is safe to do so (i.e., we do
not have other data pending write, which could be mid-record).  For
efficiency, defer actually generating/writing the ticket until there
is other data to write, to avoid producing server-to-client traffic when
not needed.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11416)

4 months agoFix whitespace nit in ossl_statem_server_pre_work
Benjamin Kaduk [Mon, 16 Mar 2020 18:25:12 +0000 (11:25 -0700)]
Fix whitespace nit in ossl_statem_server_pre_work

An 'if' clause was nestled against a previous closing brace as it if was
an 'else if', but should properly stand on its own line.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11416)

4 months agoAdd a test for EVP_PKEY_*_check functions for "DSA" keys
Mat Berchtold [Wed, 22 Apr 2020 00:30:40 +0000 (19:30 -0500)]
Add a test for EVP_PKEY_*_check functions for "DSA" keys

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11598)

4 months agoWhen a private key is validated and there is no private key, return early.
Mat Berchtold [Tue, 21 Apr 2020 19:13:16 +0000 (14:13 -0500)]
When a private key is validated and there is no private key, return early.

Affected functions:

dsa_validate_public
dsa_validate_private
dh_validate_public
dh_validate_private

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11598)

4 months agocoverity 1462581 Dereference after null check
Pauli [Sun, 26 Apr 2020 23:32:14 +0000 (09:32 +1000)]
coverity 1462581 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462580 Improper use of negative value
Pauli [Sun, 26 Apr 2020 23:28:55 +0000 (09:28 +1000)]
coverity 1462580 Improper use of negative value

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462578 Resource leak
Pauli [Sun, 26 Apr 2020 23:26:48 +0000 (09:26 +1000)]
coverity 1462578 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462576 Resource leak
Pauli [Sun, 26 Apr 2020 23:25:42 +0000 (09:25 +1000)]
coverity 1462576 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462567: Null pointer dereferences
Pauli [Sun, 26 Apr 2020 21:48:32 +0000 (07:48 +1000)]
coverity 1462567: Null pointer dereferences

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462574 Resource leak
Pauli [Sun, 26 Apr 2020 23:19:11 +0000 (09:19 +1000)]
coverity 1462574 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462573 Dereference after null check
Pauli [Sun, 26 Apr 2020 23:17:48 +0000 (09:17 +1000)]
coverity 1462573 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462572 Dereference after null check
Pauli [Sun, 26 Apr 2020 23:16:04 +0000 (09:16 +1000)]
coverity 1462572 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462571 Dereference after null check
Pauli [Sun, 26 Apr 2020 23:13:46 +0000 (09:13 +1000)]
coverity 1462571 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462570 Resource leak
Pauli [Sun, 26 Apr 2020 23:10:15 +0000 (09:10 +1000)]
coverity 1462570 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462566 Resource leak
Pauli [Sun, 26 Apr 2020 23:06:14 +0000 (09:06 +1000)]
coverity 1462566 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462564 Improper use of negative value
Pauli [Sun, 26 Apr 2020 23:04:05 +0000 (09:04 +1000)]
coverity 1462564 Improper use of negative value

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462562 Dereference before null check
Pauli [Sun, 26 Apr 2020 22:58:59 +0000 (08:58 +1000)]
coverity 1462562 Dereference before null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462561 Uninitialized scalar variable
Pauli [Sun, 26 Apr 2020 22:57:38 +0000 (08:57 +1000)]
coverity 1462561 Uninitialized scalar variable

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462560 Resource leak
Pauli [Sun, 26 Apr 2020 22:54:28 +0000 (08:54 +1000)]
coverity 1462560 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462556 Resource leak
Pauli [Sun, 26 Apr 2020 22:45:04 +0000 (08:45 +1000)]
coverity 1462556 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462554 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:42:20 +0000 (08:42 +1000)]
coverity 1462554 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462549 Dereference before null check
Pauli [Sun, 26 Apr 2020 22:33:27 +0000 (08:33 +1000)]
coverity 1462549 Dereference before null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462548 Resource leak
Pauli [Sun, 26 Apr 2020 22:30:49 +0000 (08:30 +1000)]
coverity 1462548 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462546 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:26:39 +0000 (08:26 +1000)]
coverity 1462546 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462545 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:25:33 +0000 (08:25 +1000)]
coverity 1462545 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity: 1462544 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:21:06 +0000 (08:21 +1000)]
coverity: 1462544 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462543 Logically dead code
Pauli [Sun, 26 Apr 2020 22:05:23 +0000 (08:05 +1000)]
coverity 1462543 Logically dead code

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462541 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:01:28 +0000 (08:01 +1000)]
coverity 1462541 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462550 Resource leak
Pauli [Sun, 26 Apr 2020 21:59:02 +0000 (07:59 +1000)]
coverity 1462550 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462565: Null pointer dereferences
Pauli [Sun, 26 Apr 2020 21:51:16 +0000 (07:51 +1000)]
coverity 1462565: Null pointer dereferences

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agocoverity 1462577: Incorrect expression
Pauli [Sun, 26 Apr 2020 21:40:17 +0000 (07:40 +1000)]
coverity 1462577: Incorrect expression

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agoparam bld: avoid freeing the param builder structure on error paths.
Pauli [Sun, 26 Apr 2020 21:32:43 +0000 (07:32 +1000)]
param bld: avoid freeing the param builder structure on error paths.

The param builder was recently modified so that it doesn't free the passed in
param builder structure.  Some of the error paths didn't get synced up with this
change and resulted in double frees.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 months agoFix snprintf missing for windows build
Shane Lontis [Wed, 29 Apr 2020 06:19:16 +0000 (16:19 +1000)]
Fix snprintf missing for windows build

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11675)

4 months agoUndeprecate DH, DSA and RSA _bits() functions.
Pauli [Tue, 28 Apr 2020 09:03:05 +0000 (19:03 +1000)]
Undeprecate DH, DSA and RSA _bits() functions.

These were deemed information and useful and that they should not be
deprecated.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11669)

5 months agoEVP: Fix evp_keymgmt_util_copy() for to->keymgmt == NULL
Richard Levitte [Tue, 28 Apr 2020 06:41:20 +0000 (08:41 +0200)]
EVP: Fix evp_keymgmt_util_copy() for to->keymgmt == NULL

evp_keymgmt_util_copy() didn't treat the case to->keymgmt correctly.
The proper change is to use from->keymgmt when to->keymgmt is NULL.

Fixes coverity #1462553

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11668)

5 months agoAmend references to "OpenSSL license"
Shourya Shukla [Mon, 27 Apr 2020 04:59:50 +0000 (10:29 +0530)]
Amend references to "OpenSSL license"

A small number of files contain references to the "OpenSSL license"
which has been deprecated and replaced by the "Apache License 2.0".
Amend the occurences.

Fixes #11649

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11663)

5 months agoUpdate EVP_PKEY_fromdata.pod
opensignature [Mon, 27 Apr 2020 09:47:44 +0000 (11:47 +0200)]
Update EVP_PKEY_fromdata.pod

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11660)

5 months agoinclude/openssl/ts.h: clean away a misplaced EVP_MD stack definition
Richard Levitte [Mon, 27 Apr 2020 09:59:17 +0000 (11:59 +0200)]
include/openssl/ts.h: clean away a misplaced EVP_MD stack definition

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11655)

5 months agoinclude/openssl/x509v3.h: restore previous stack definition arrangement
Richard Levitte [Mon, 27 Apr 2020 06:36:53 +0000 (08:36 +0200)]
include/openssl/x509v3.h: restore previous stack definition arrangement

It turned out that configuration options may affect the definition and
use of diverse stacks and how they relate to the underlying types.
For example, the configuration option 'no-rfc3779' results in a build
error around STACK_OF(IPAddressFamily) and related stacks.

Previously, STACK_OF definitions were located near the definition of
the underlying type, which are also affected by configuration options,
which made this easier to maintain.  We relocate the new stack
definitions back to those locations for that reason.

We apply the same type of relocation in other header files as well, following
the general rule that it's better to use DEFINE_OR_DECLARE_STACK_OF after the
type it defines a stack for has been defined.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11655)

5 months agoUpdate README.ssltests.md
Matt Caswell [Mon, 27 Apr 2020 09:36:35 +0000 (10:36 +0100)]
Update README.ssltests.md

The ssltest docs were out of date because gneerate_ssl_tests now needs
a provider to be specified on the command line.

Fixes #11639

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11659)

5 months agoRename FIPS_MODE to FIPS_MODULE
Richard Levitte [Mon, 13 Apr 2020 20:34:56 +0000 (22:34 +0200)]
Rename FIPS_MODE to FIPS_MODULE

This macro is used to determine if certain pieces of code should
become part of the FIPS module or not.  The old name was confusing.

Fixes #11538

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11539)

5 months agoConfigurations: Identify the shell variables around MANSUFFIX
Sebastian Andrzej Siewior [Sat, 25 Apr 2020 18:29:48 +0000 (20:29 +0200)]
Configurations: Identify the shell variables around MANSUFFIX

With MANSUFFIX=A the statement '$$fn$(MANSUFFIX)' is reaplaces with
'$fnA' and left empty because the `fnA' variables is not recognized
within the shell.

With {} around fn it is then bocomes ${fn}A and works as expected.
While here, add the MANSUFFIX to the ECHO line so it is properly printed
during build.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11643)

5 months agoFix GOST curve sec bits
Nikolay Morozov [Wed, 22 Apr 2020 09:09:38 +0000 (12:09 +0300)]
Fix GOST curve sec bits

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11637)

5 months agoConfigure: change all references to INSTALL to INSTALL.md
Richard Levitte [Mon, 27 Apr 2020 07:08:36 +0000 (09:08 +0200)]
Configure: change all references to INSTALL to INSTALL.md

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11657)

5 months agoConfigurations/unix-Makefile.tmpl: fix typo
Richard Levitte [Mon, 27 Apr 2020 06:11:52 +0000 (08:11 +0200)]
Configurations/unix-Makefile.tmpl: fix typo

PROCESSSOR => PROCESSOR

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11654)

5 months agosslapitest: only compile test when it will be used
Benjamin Kaduk [Wed, 1 Apr 2020 20:51:40 +0000 (13:51 -0700)]
sslapitest: only compile test when it will be used

The test_ccs_change_cipher() test routine is used only when TLS 1.2
is enabled; to fix the strict-warnings build we should not try to
compile it when TLS 1.2 is disabled, either.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11458)

5 months agodoc: Random spellchecking
Sebastian Andrzej Siewior [Sat, 25 Apr 2020 21:57:00 +0000 (23:57 +0200)]
doc: Random spellchecking

A little spell checking.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/11644)

5 months agofuzz/asn1.c: Add missing #include
Richard Levitte [Sat, 25 Apr 2020 02:11:09 +0000 (04:11 +0200)]
fuzz/asn1.c: Add missing #include

<openssl/dsa.h> gets included via ts.h...  except when 'no-ts' has been
configured.

Fixes #11597

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11640)

5 months agoi2b_PVK_bio: don't set PEM_R_BIO_WRITE_FAILURE in case of success
Christian Hohnstaedt [Sun, 22 Mar 2020 08:41:30 +0000 (09:41 +0100)]
i2b_PVK_bio: don't set PEM_R_BIO_WRITE_FAILURE in case of success

but in case of an error

CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11380)

5 months agoFix type cast in SSL_CTX_set1_groups macro
Arne Schwabe [Thu, 23 Apr 2020 10:42:51 +0000 (12:42 +0200)]
Fix type cast in SSL_CTX_set1_groups macro

The macro casts the glist parameter to char*
instead of (int *) like the documentation of the function suggest.

Also the function tls1_set_groups that is called from SSL_CTX_ctrl
takes an int * argument. This looks like a copy&paste error from
SSL_CTX_set1_groups_list function.

CLA: trivial
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11614)

5 months agocrypto/x509/v3_alt.c: make 'othername' a bit bigger
Richard Levitte [Mon, 27 Apr 2020 06:43:18 +0000 (08:43 +0200)]
crypto/x509/v3_alt.c: make 'othername' a bit bigger

We want to fill 'othername' with the contents of 'oline' (256 bytes)
plus some additional text.  We need to ensure that 'othername' is
large enough to contain this.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11656)

5 months agoFix links in CONTRIBUTING.md
Nicola Tuveri [Fri, 24 Apr 2020 16:25:56 +0000 (19:25 +0300)]
Fix links in CONTRIBUTING.md

CHANGES and NEWS were renamed into CHANGES.md and NEWS.md; this commit
updates the references inside CONTRIBUTING.md to fix broken links.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/11634)

5 months agoConfigurations/windows-makefile.tmpl: Fix template code for INSTALL_MODULES
Richard Levitte [Fri, 24 Apr 2020 08:08:42 +0000 (10:08 +0200)]
Configurations/windows-makefile.tmpl: Fix template code for INSTALL_MODULES

Fixes #11623

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11629)

5 months agoAdd support for unusal 'othername' subjectAltNames
Dirk-Willem van Gulik [Tue, 21 Apr 2020 21:06:38 +0000 (23:06 +0200)]
Add support for unusal 'othername' subjectAltNames

Increasingly certificates seem to have special things in the subjectAltName that have arbitrary strings in them.

E.g. some (now) common in EU export certificates and, for a few years now, certificates issued to medical doctors (in for example the netherlands, the full spec is https://www.uziregister.nl/Media/Default/PDF/20200325%20CA%20model%20pasmodel%20certificaatprofielen%20v10_0.pdf, section 4.8, page 16 for an example of one country).

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11599)

5 months agotravis: remove GENERATE=yes from some non no-deprecated builds
Pauli [Wed, 22 Apr 2020 11:38:19 +0000 (21:38 +1000)]
travis: remove GENERATE=yes from some non no-deprecated builds

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11607)

5 months agotravis: add GENERATE=yes no-makedepend to the ARM64 build.
Pauli [Wed, 22 Apr 2020 10:01:30 +0000 (20:01 +1000)]
travis: add GENERATE=yes no-makedepend to the ARM64 build.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11607)

5 months agokeymgmt: convert to use the params modification detection.
Pauli [Thu, 23 Apr 2020 10:31:12 +0000 (20:31 +1000)]
keymgmt: convert to use the params modification detection.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

5 months agoparams: change OSSL_PARAM_set_unmodified() to operate on a params array
Pauli [Thu, 23 Apr 2020 10:23:48 +0000 (20:23 +1000)]
params: change OSSL_PARAM_set_unmodified() to operate on a params array

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

5 months agoevp: convert existing code to use the new modified sentinel for params.
Pauli [Wed, 22 Apr 2020 04:20:11 +0000 (14:20 +1000)]
evp: convert existing code to use the new modified sentinel for params.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

5 months agoparams: handle the modified sentinel.
Pauli [Wed, 22 Apr 2020 04:10:24 +0000 (14:10 +1000)]
params: handle the modified sentinel.

The param builder and the params from text helpers also need to be modified
aware.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

5 months agoConfigure: Allow quoted values in VERSION
Richard Levitte [Thu, 23 Apr 2020 16:59:10 +0000 (18:59 +0200)]
Configure: Allow quoted values in VERSION

Fixes #11618

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11624)

5 months agoFix dev/release-aux-openssl-announce-pre-release.tmpl
Richard Levitte [Thu, 23 Apr 2020 14:38:40 +0000 (16:38 +0200)]
Fix dev/release-aux-openssl-announce-pre-release.tmpl

$LABEL -> $label

Removed link to release notes, as we don't produce them for master.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11617)

5 months agoCode cleanup in X509v3 String Extentions
Nikolay Morozov [Wed, 22 Apr 2020 08:45:16 +0000 (11:45 +0300)]
Code cleanup in X509v3 String Extentions

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11604)

5 months agoClean up the use of ERR_print_errors() in apps.c and in four apps
Dr. David von Oheimb [Wed, 22 Apr 2020 12:58:41 +0000 (14:58 +0200)]
Clean up the use of ERR_print_errors() in apps.c and in four apps

Also make sure that all error messages in apps.c consistently begin upper-case.
Changed files: apps/lib/apps.c and apps/{req.c,s_client.c,s_server.c,x509.c}

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

5 months agoRemove a bad 'goto end' and a few superfluous ones in apps/lib/apps.c
David von Oheimb [Tue, 26 Dec 2017 18:33:04 +0000 (19:33 +0100)]
Remove a bad 'goto end' and a few superfluous ones in apps/lib/apps.c

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

5 months agoImprove feedback on wrong format with new print_format_error() in apps/lib/opt.c
David von Oheimb [Fri, 22 Dec 2017 18:50:17 +0000 (19:50 +0100)]
Improve feedback on wrong format with new print_format_error() in apps/lib/opt.c

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

5 months agoAdd function load_csr(file,format,desc) to apps/lib/apps.c
David von Oheimb [Fri, 15 Dec 2017 19:50:37 +0000 (20:50 +0100)]
Add function load_csr(file,format,desc) to apps/lib/apps.c

Make use of new load_csr() in 'ca', 'req', and 'x509' app
Add '-inform' and '-certform' option to 'ca' app
Add 'desc' parameter to load_crl() function defined in apps/lib/apps.c
Allow 'desc' parameter to be NULL (gives option to suppress error output)

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

5 months agoIn OpenSSL builds, declare STACK for datatypes ...
Rich Salz [Thu, 19 Dec 2019 22:30:24 +0000 (17:30 -0500)]
In OpenSSL builds, declare STACK for datatypes ...

... and only *define* them in the source files that need them.
Use DEFINE_OR_DECLARE which is set appropriately for internal builds
and not non-deprecated builds.

Deprecate stack-of-block

Better documentation

Move some ASN1 struct typedefs to types.h

Update ParseC to handle this.  Most of all, ParseC needed to be more
consistent.  The handlers are "recursive", in so far that they are called
again and again until they terminate, which depends entirely on what the
"massager" returns.  There's a comment at the beginning of ParseC that
explains how that works. {Richard Levtte}

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10669)

5 months agoFix typo from #10631
Nicola Tuveri [Tue, 21 Apr 2020 15:34:17 +0000 (18:34 +0300)]
Fix typo from #10631

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11595)

5 months agoRewrite man5/config.pod and related conf code cleanup
Rich Salz [Sat, 28 Mar 2020 16:51:05 +0000 (12:51 -0400)]
Rewrite man5/config.pod and related conf code cleanup

The manpage is basically rewritten.  Use consistent name/value
terminology. Use consistent phraseology to refer to section pointers
and lists of section pointers. Add more cross-references.

Also found a bunch of trivial style things in conf_api.c while
investigating how config works.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11431)

5 months agoSSL_CTX_config.pod: Remove needless "NOTE" heading
Rich Salz [Sat, 28 Mar 2020 16:50:49 +0000 (12:50 -0400)]
SSL_CTX_config.pod: Remove needless "NOTE" heading

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11431)

5 months agoRename fipsinstall.cnf->fipsmodule.cnf
Rich Salz [Tue, 21 Apr 2020 17:55:12 +0000 (13:55 -0400)]
Rename fipsinstall.cnf->fipsmodule.cnf

Introduced by rebasing

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11177)

5 months agoUpdate some nits around the FIPS module
Rich Salz [Tue, 25 Feb 2020 21:27:24 +0000 (16:27 -0500)]
Update some nits around the FIPS module

- Changed the generated FIPS signature file to be "fipsmodule.conf"
since it contains information about the FIPS module/file.
- Add -q option to fipsinstall command, to stop chatty verbose status
messages.
- Document env var OPENSSL_CONF_INCLUDE

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11177)

5 months agoPrepare for 3.0 alpha 2
Matt Caswell [Thu, 23 Apr 2020 13:10:38 +0000 (14:10 +0100)]
Prepare for 3.0 alpha 2

Reviewed-by: Richard Levitte <levitte@openssl.org>
5 months agoPrepare for release of 3.0 alpha 1 openssl-3.0.0-alpha1
Matt Caswell [Thu, 23 Apr 2020 13:08:36 +0000 (14:08 +0100)]
Prepare for release of 3.0 alpha 1

Reviewed-by: Richard Levitte <levitte@openssl.org>
5 months agoUpdate copyright year
Matt Caswell [Thu, 23 Apr 2020 12:55:52 +0000 (13:55 +0100)]
Update copyright year

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11616)

5 months agoAdd info on the CMP implementation and HTTP client to NEWS.md and CHANGES.md
Dr. David von Oheimb [Wed, 22 Apr 2020 11:12:45 +0000 (13:12 +0200)]
Add info on the CMP implementation and HTTP client to NEWS.md and CHANGES.md

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11608)

5 months agoFix a typo in the makefile templates
Matt Caswell [Thu, 23 Apr 2020 10:50:20 +0000 (11:50 +0100)]
Fix a typo in the makefile templates

The fips.so and legacy.so providers were not being installed because of
a typo in the makefile templates.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11615)

5 months agoMention the 3.0 wiki page in the release announcement emails
Matt Caswell [Tue, 21 Apr 2020 14:13:30 +0000 (15:13 +0100)]
Mention the 3.0 wiki page in the release announcement emails

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11593)

5 months agoPROV: Ensure that EC keys have a default digest
Richard Levitte [Mon, 20 Apr 2020 19:35:03 +0000 (21:35 +0200)]
PROV: Ensure that EC keys have a default digest

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

5 months agoPROV: Ensure that ED25519 & ED448 keys have a mandatory digest
Richard Levitte [Mon, 20 Apr 2020 07:29:47 +0000 (09:29 +0200)]
PROV: Ensure that ED25519 & ED448 keys have a mandatory digest

This adds handling of the parameter "mandatory-digest" and responds
with an empty string, meaning that no digest may be used.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

5 months agoEVP: Fix EVP_Digest{Sign,Verify}Init() to handle no default digest
Richard Levitte [Mon, 20 Apr 2020 07:29:16 +0000 (09:29 +0200)]
EVP: Fix EVP_Digest{Sign,Verify}Init() to handle no default digest

EVP_DigestSignInit() and EVP_DigestVerifyInit() would detect if there
is no default digest when using legacy (EVP_PKEY_ASN1_METHOD)
implementations.  However, it doesn't do that when provider side keys
are used.

Furthermore, because EVP_PKEY_get_default_digest_name() was used in
the portion of the code that uses the provider implementation, the
EVP_PKEY_ASN1_METHOD would be used if the key has one attached.  This
is now changed to use evp_keymgmt_util_get_deflt_digest_name()
instead.

Finally, we make sure to detect if the provider implementation
supports the digest name parameters (default or mandatory), and
returns with error if not.  This is what the legacy portion of the
code does.

Fixes #11571

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

5 months agoEVP: add internal evp_keymgmt_util_get_deflt_digest_name() and use it
Richard Levitte [Mon, 20 Apr 2020 07:14:59 +0000 (09:14 +0200)]
EVP: add internal evp_keymgmt_util_get_deflt_digest_name() and use it

evp_keymgmt_util_get_deflt_digest_name() is a refactor of the provider
side key part of EVP_PKEY_get_default_digest_name(), that takes
EVP_KEYMGMT and provider keydata pointers instead of an EVP_PKEY
pointer.

We also ensure that it uses SN_undef as the default name if the
provider implementation gave us an empty string, since this is what
EVP_PKEY_get_default_digest_name() responds when getting the digest
name via a EVP_PKEY_ASN1_METHOD ctrl call that returns NID_undef.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

5 months agoFIPS: remove algorithms that are not being validated.
Pauli [Wed, 22 Apr 2020 07:08:30 +0000 (17:08 +1000)]
FIPS: remove algorithms that are not being validated.

Several MACs and one KDF are included in the FIPS provider with the property
"fips=yes" set but are not listed as being part of the OpenSSL validation.

This removes them from the FIPS provider.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11602)

5 months agoFix no-err
Matt Caswell [Mon, 20 Apr 2020 14:04:35 +0000 (15:04 +0100)]
Fix no-err

This fixes an assertion failure that can occur in the CMP code in the
event of a no-err build. The "improve_location_name" function assumed
that the fallback argument was always populated with something. However
in a no-err build this is not the case.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11584)

5 months agoSkip a no-dsa test in the fipsinstall test
Matt Caswell [Mon, 20 Apr 2020 13:18:36 +0000 (14:18 +0100)]
Skip a no-dsa test in the fipsinstall test

In a similar way to the previous commit we also skip a fipsinstall test
if DSA has been disabled.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11582)

5 months agoSkip a test in a no-dh build
Matt Caswell [Mon, 20 Apr 2020 13:05:47 +0000 (14:05 +0100)]
Skip a test in a no-dh build

One of the sub-tests in the fipsinstall test corrupts a DH test to
confirm that fipsinstall fails. However that is never noticed in a
no-dh build - so we just skip that test in a no-dh build.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11582)

5 months agoFix some build failures with no-dh
Matt Caswell [Mon, 20 Apr 2020 13:05:23 +0000 (14:05 +0100)]
Fix some build failures with no-dh

Add some missing OPENSSL_NO_DH guards.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11582)

5 months agoFix no-ec
Matt Caswell [Mon, 20 Apr 2020 11:27:59 +0000 (12:27 +0100)]
Fix no-ec

This was missed by Travis because, although it has a no-ec build, the test
that failed only runs in a debug build. The Travis job with no-ec is not
a debug build and so the test was skipped.

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11581)

5 months agoAdd a link to wiki 3.0 upgrade notes
Matt Caswell [Mon, 20 Apr 2020 18:39:32 +0000 (19:39 +0100)]
Add a link to wiki 3.0 upgrade notes

Provide a link to the 3.0 upgrade notes so that users of the alpha/beta/
final releases can understand the differences between this version and
previous versions.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11587)

5 months agoGOST2012 TLS Supported Groups Identifiers Support
Nikolay Morozov [Sat, 18 Apr 2020 20:59:45 +0000 (23:59 +0300)]
GOST2012 TLS Supported Groups Identifiers Support

For GOST2012-GOST8912-GOST8912 IANA introduce TLS Supported Groups Identifiers
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11568)

5 months agoevptest: set the DESX provider to be the legacy provider.
Pauli [Mon, 20 Apr 2020 02:43:49 +0000 (12:43 +1000)]
evptest: set the DESX provider to be the legacy provider.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11573)

5 months agoparams: add functionality to test if an OSSL_PARAM has been set.
Pauli [Tue, 21 Apr 2020 00:49:19 +0000 (10:49 +1000)]
params: add functionality to test if an OSSL_PARAM has been set.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11588)

5 months ago[crypto/ec] deprecate Jprojective_coordinates_GFp functions
Billy Brumley [Sun, 12 Apr 2020 15:17:19 +0000 (18:17 +0300)]
[crypto/ec] deprecate Jprojective_coordinates_GFp functions

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11527)

5 months agoAdd setter equivalents to X509_REQ_get0_signature
Dirk-Willem van Gulik [Fri, 10 Jan 2020 17:35:49 +0000 (18:35 +0100)]
Add setter equivalents to X509_REQ_get0_signature

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10563)

5 months agoFix no-deprecated tests where the GOST engine is present
Matt Caswell [Mon, 20 Apr 2020 13:32:21 +0000 (14:32 +0100)]
Fix no-deprecated tests where the GOST engine is present

The GOST test only runs if it detects that the GOST engine is present.
This is the case for the run-checker environment. The GOST engine uses
some deprecated functions, so we disable that test in a no-deprecated
build.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11583)

5 months agoFix no-des
Matt Caswell [Mon, 20 Apr 2020 10:23:34 +0000 (11:23 +0100)]
Fix no-des

Disable a recently added CMS test in the case of no-des.

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/11578)

5 months agoFix an ssl_test_old test failure
Matt Caswell [Mon, 20 Apr 2020 16:06:40 +0000 (17:06 +0100)]
Fix an ssl_test_old test failure

In builds where SSLv3 is enabled ssl_test_old was failing. We need to
make sure we disable SSLv3 related tests when using the FIPS provider.

[extended tests]

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11586)

5 months agoFix test_ssl_new test failure
Matt Caswell [Mon, 20 Apr 2020 16:04:57 +0000 (17:04 +0100)]
Fix test_ssl_new test failure

A couple of fetches of the MD5 and SHA1 digests were not using the
libctx in libssl and causing test_ssl_new to fail in travis. This
only occurs on builds with SSLv3 enabled (its disabled by default).

[extended tests]

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11586)

5 months agoRevert "TEST: make and use a fipsinstall script"
Richard Levitte [Tue, 21 Apr 2020 10:24:44 +0000 (12:24 +0200)]
Revert "TEST: make and use a fipsinstall script"

Unfortunately, this won't work on MacOS because of system integrity
measures on that platform, which clears DYLD_LIBRARY_PATH before
starting a sub-process executable.

Ref: https://developer.apple.com/library/archive/documentation/Security/Conceptual/System_Integrity_Protection_Guide/RuntimeProtections/RuntimeProtections.html

This reverts commit ae6b654b669638882a6ddce012ff55adc7cf6a82.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11592)