5 months agoCORE: Fix a couple of bugs in algorithm_do_this()
Richard Levitte [Fri, 15 May 2020 05:50:43 +0000 (07:50 +0200)]
CORE: Fix a couple of bugs in algorithm_do_this()

The call of ossl_provider_query_operation() used |data->operation_id|,
when |cur_operation| should be used.

If any ossl_provider_query_operation() call returned NULL, the loop
was stopped, when it should just continue on to the next operation.

Reviewed-by: Matt Caswell <>
(Merged from

5 months agoTest TLSv1.3 out-of-band PSK with all 5 ciphersuites
raja-ashok [Sun, 10 May 2020 17:17:00 +0000 (22:47 +0530)]
Test TLSv1.3 out-of-band PSK with all 5 ciphersuites

Reviewed-by: Tomas Mraz <>
Reviewed-by: Matt Caswell <>
Reviewed-by: Ben Kaduk <>
(Merged from

5 months agoFix crash in early data send with out-of-band PSK using AES CCM
raja-ashok [Fri, 8 May 2020 13:47:21 +0000 (19:17 +0530)]
Fix crash in early data send with out-of-band PSK using AES CCM

Reviewed-by: Tomas Mraz <>
Reviewed-by: Matt Caswell <>
Reviewed-by: Ben Kaduk <>
(Merged from

5 months agoFix all MD036 (emphasis used instead of heading)
Rich Salz [Wed, 13 May 2020 15:16:50 +0000 (11:16 -0400)]
Fix all MD036 (emphasis used instead of heading)

The main fixes were errors in itemized lists "*)" instead of "*"

Reviewed-by: Tomas Mraz <>
Reviewed-by: Matthias St. Pierre <>
(Merged from

5 months agoAdd "md-nits" make target
Rich Salz [Fri, 8 May 2020 14:34:22 +0000 (10:34 -0400)]
Add "md-nits" make target

Also fix a nit in recent update.

Reviewed-by: Tomas Mraz <>
Reviewed-by: Matthias St. Pierre <>
(Merged from

5 months agoAdd 'methods' parameter to setup_engine() in apps.c for individual method defaults
David von Oheimb [Mon, 28 Aug 2017 17:14:47 +0000 (19:14 +0200)]
Add 'methods' parameter to setup_engine() in apps.c for individual method defaults

Reviewed-by: Richard Levitte <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoClean up macro definitions of openssl_fdset() in apps.h and sockets.h
Dr. David von Oheimb [Tue, 21 Apr 2020 12:08:49 +0000 (14:08 +0200)]
Clean up macro definitions of openssl_fdset() in apps.h and sockets.h

Reviewed-by: Richard Levitte <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoUse OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.c
Dr. David von Oheimb [Wed, 6 May 2020 11:51:50 +0000 (13:51 +0200)]
Use OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.c

This also adds the more flexible and general load_key_cert_crl()
as well as helper functions get_passwd(), cleanse(), and clear_free()
to be used also in apps/cmp.c etc.

Reviewed-by: Richard Levitte <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoNit-fix: remove whitespace in doc/man3/EVP_PKEY_fromdata.pod causing warning
Dr. David von Oheimb [Fri, 8 May 2020 08:56:14 +0000 (10:56 +0200)]
Nit-fix: remove whitespace in doc/man3/EVP_PKEY_fromdata.pod causing warning

Reviewed-by: Richard Levitte <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoGuard use of struct tms with #ifdef __TMS like done earlier in apps/lib/apps.c
Dr. David von Oheimb [Thu, 7 May 2020 19:37:28 +0000 (21:37 +0200)]
Guard use of struct tms with #ifdef __TMS like done earlier in apps/lib/apps.c

Reviewed-by: Richard Levitte <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoBuild: make apps/progs.c depend on
Richard Levitte [Thu, 14 May 2020 10:33:09 +0000 (12:33 +0200)]
Build: make apps/progs.c depend on

Reviewed-by: Tomas Mraz <>
(Merged from

5 months agoSSL: refactor ssl_cert_lookup_by_pkey() to work with provider side keys
Richard Levitte [Thu, 14 May 2020 12:04:41 +0000 (14:04 +0200)]
SSL: refactor ssl_cert_lookup_by_pkey() to work with provider side keys

Fixes #11720

Reviewed-by: Matt Caswell <>
(Merged from

5 months agoIgnore some auto-generated DER files
Matt Caswell [Thu, 14 May 2020 13:21:40 +0000 (14:21 +0100)]
Ignore some auto-generated DER files

Reviewed-by: Dmitry Belyavskiy <>
Reviewed-by: Richard Levitte <>
(Merged from

5 months agoPrepare for 3.0 alpha 3
Matt Caswell [Fri, 15 May 2020 13:35:04 +0000 (14:35 +0100)]
Prepare for 3.0 alpha 3

Reviewed-by: Richard Levitte <>
5 months agoPrepare for release of 3.0 alpha 2 openssl-3.0.0-alpha2
Matt Caswell [Fri, 15 May 2020 13:33:29 +0000 (14:33 +0100)]
Prepare for release of 3.0 alpha 2

Reviewed-by: Richard Levitte <>
5 months agoUpdate copyright year
Matt Caswell [Fri, 15 May 2020 13:09:49 +0000 (14:09 +0100)]
Update copyright year

Reviewed-by: Richard Levitte <>
(Merged from

5 months agoIf SOURCE_DATE_EPOCH is defined, use it for copyright year
Nicolas Vigier [Thu, 5 Mar 2020 19:39:05 +0000 (20:39 +0100)]
If SOURCE_DATE_EPOCH is defined, use it for copyright year

Using the date from SOURCE_DATE_EPOCH instead of the current date makes
it possible to reproduce a build that was built on a different year:

This is fixing an issue we had while building Tor Browser:

CLA: trivial

Reviewed-by: Paul Dale <>
Reviewed-by: Ben Kaduk <>
(Merged from

5 months agoCorrect alignment calculation in ssl3_setup_write
Matt Caswell [Fri, 8 May 2020 10:12:10 +0000 (11:12 +0100)]
Correct alignment calculation in ssl3_setup_write

The alignment calculation in ssl3_setup_write incorrectly results in an
alignment allowance of
(-SSL3_RT_HEADER_LENGTH) & (SSL3_ALIGN_PAYLOAD - 1) bytes. This equals 3
in almost all cases. The maximum alignment actually used in do_ssl3_write
is (SSL3_ALIGN_PAYLOAD - 1). This equals 7 bytes in almost all cases. So
there is a potential to overrun the buffer by up to 4 bytes.

Fortunately, the encryption overhead allowed for is 80 bytes which
consists of 16 bytes for the cipher block size and 64 bytes for the MAC
output. However the biggest MAC that we ever produce is HMAC-384 which is
48 bytes - so we have a headroom of 16 bytes (i.e. more than the 4 bytes
of potential overrun).

Thanks to Nagesh Hegde for reporting this.

Fixes #11766

Reviewed-by: Ben Kaduk <>
(Merged from

5 months agoConfigure: Avoid SIXTY_FOUR_BIT for linux-mips64
Orgad Shaneh [Mon, 24 Feb 2020 07:02:31 +0000 (09:02 +0200)]
Configure: Avoid SIXTY_FOUR_BIT for linux-mips64

This is a 32-bit ABI build (as opposed to linux64-mips64).
Setting SIXTY_FOUR_BIT breaks hardware optimizations, at least on
octeon processors.

Reviewed-by: Richard Levitte <>
Reviewed-by: Matt Caswell <>
(Merged from

5 months agodev/ Add --reviewer to set reviewers
Richard Levitte [Fri, 24 Apr 2020 09:03:28 +0000 (11:03 +0200)]
dev/ Add --reviewer to set reviewers

Doing this is kind of contrary to how we normally do things, as this
constitutes a kind of pre-approval.  However, without this, the normal
review process will modify the reviewed commits, and render the
annotated release tag invalid, which forces the person doing the
release to re-tag manually.

Reviewed-by: Matt Caswell <>
(Merged from

5 months agoPass "-z defs" to the linker via "-Wl,-z,defs" rather than with gcc's -z
Thomas Dwyer III [Wed, 13 May 2020 17:32:47 +0000 (10:32 -0700)]
Pass "-z defs" to the linker via "-Wl,-z,defs" rather than with gcc's -z
flag (which is not supported by older compilers).

CLA: trivial

Reviewed-by: Richard Levitte <>
Reviewed-by: Matt Caswell <>
(Merged from

5 months agotest/evp_extra_test.c: Add OPENSSL_NO_CMAC around CMAC test
Richard Levitte [Thu, 14 May 2020 15:15:05 +0000 (17:15 +0200)]
test/evp_extra_test.c: Add OPENSSL_NO_CMAC around CMAC test

Reviewed-by: Matt Caswell <>
Reviewed-by: Tomas Mraz <>
(Merged from

5 months agoPROV: make some DER AID arrays non-static, to avoid clang complaints
Richard Levitte [Tue, 12 May 2020 08:27:46 +0000 (10:27 +0200)]
PROV: make some DER AID arrays non-static, to avoid clang complaints

The problem encountered is that some arrays were deemed unnecessary by
clang, for example:

    providers/common/der/der_rsa.c:424:28: error: variable 'der_aid_sha224Identifier' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
    static const unsigned char der_aid_sha224Identifier[] = {

However, these arrays are used in sizeof() expressions in other parts
of the code that's actually used, making that warning-turned-error a
practical problem.  We solve this by making the array non-static,
which guarantees that the arrays will be emitted, even though
unnecessarily.  Fortunately, they are very small.

Reviewed-by: Shane Lontis <>
(Merged from

5 months ago.travis.yml: never use -Werror, use --strict-warnings instead
Richard Levitte [Tue, 12 May 2020 07:54:04 +0000 (09:54 +0200)]
.travis.yml: never use -Werror, use --strict-warnings instead

There are a few things in the OpenSSL code that are known to give
warnings that we know are harmless.  We test our builds accordingly.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agotest/recipes/15-test_rsapss.t: Add test with unrestricted signature
Richard Levitte [Mon, 11 May 2020 16:27:04 +0000 (18:27 +0200)]
test/recipes/15-test_rsapss.t: Add test with unrestricted signature

Reviewed-by: Shane Lontis <>
(Merged from

5 months agotest/ssl-tests/ Re-enable RSA-PSS related tests
Richard Levitte [Fri, 8 May 2020 17:39:44 +0000 (19:39 +0200)]
test/ssl-tests/ Re-enable RSA-PSS related tests

There were a few RSA-PSS related tests that were disabled for non-default
library contexts.  We now re-enable them.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agotest/evp_pkey_provided_test.c: Display first, compare after
Richard Levitte [Thu, 7 May 2020 07:56:52 +0000 (09:56 +0200)]
test/evp_pkey_provided_test.c: Display first, compare after

To make it easier to check the generated key manually, display it
before comparing diverse other serializations.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoPROV & ASYM_CIPHER: Adapt the RSA asymmetric cipher code for PSS-parameters
Richard Levitte [Wed, 6 May 2020 19:52:12 +0000 (21:52 +0200)]
PROV & ASYM_CIPHER: Adapt the RSA asymmetric cipher code for PSS-parameters

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoEVP: Refactor the RSA-PSS key generation controls for providers
Richard Levitte [Tue, 5 May 2020 08:29:34 +0000 (10:29 +0200)]
EVP: Refactor the RSA-PSS key generation controls for providers

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoPROV & SIGNATURE: Adapt the RSA signature code for PSS-parameters
Richard Levitte [Sun, 3 May 2020 04:02:52 +0000 (06:02 +0200)]
PROV & SIGNATURE: Adapt the RSA signature code for PSS-parameters

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoEVP: For SIGNATURE operations, pass the propquery early
Richard Levitte [Wed, 6 May 2020 19:44:58 +0000 (21:44 +0200)]
EVP: For SIGNATURE operations, pass the propquery early

Instead of passing it with signature->digest_verify_init() and
signature->digest_sign_init(), we pass it with signature->newctx().
This allows the digests that are indicated by RSA PSS parameters
to have a useful propquery.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoPROV & SERIALIZER: Adapt the RSA serializers for PSS-parameters
Richard Levitte [Sat, 2 May 2020 11:39:40 +0000 (13:39 +0200)]
PROV & SERIALIZER: Adapt the RSA serializers for PSS-parameters

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoPROV & KEYMGMT: Add PSS-parameter support in the RSA KEYMGMT implementation
Richard Levitte [Sat, 2 May 2020 11:31:47 +0000 (13:31 +0200)]
PROV & KEYMGMT: Add PSS-parameter support in the RSA KEYMGMT implementation

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoPROV: Refactor the RSA SIGNATURE implementation for better param control
Richard Levitte [Thu, 7 May 2020 06:51:09 +0000 (08:51 +0200)]
PROV: Refactor the RSA SIGNATURE implementation for better param control

We want to catch errors in passed parameters early, which requires
kowledge of the ongoing operation.  Fortunately, that's possible by
re-using the EVP_PKEY_OP macros in specific init functions.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoPROV: Refactor the RSA DER support
Richard Levitte [Sat, 2 May 2020 11:25:52 +0000 (13:25 +0200)]
PROV: Refactor the RSA DER support

We separate out the NIST arc OIDs to a separate file, so it can be
re-used, and also the DIGEST OIDs.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoDER writer: Add the possibility to abandon empty SEQUENCEs
Richard Levitte [Sat, 2 May 2020 11:33:24 +0000 (13:33 +0200)]
DER writer: Add the possibility to abandon empty SEQUENCEs

In some cases, a SEQUENCE that contains only optional fields may end
up empty.  In some cases, this may be represented by dropping the
SEQUENCE entirely from the encoded DER.

To do this, we detect the case where WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH
is used, and adapt accordingly.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoRSA: Add PSS-parameter processing in EVP_PKEY_ASN1_METHOD functions
Richard Levitte [Sat, 2 May 2020 11:14:04 +0000 (13:14 +0200)]
RSA: Add PSS-parameter processing in EVP_PKEY_ASN1_METHOD functions

The import and export functions are affected.  We also refactor them
to assign the RSA key type more carefully.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoRSA: Add a less loaded PSS-parameter structure
Richard Levitte [Sat, 2 May 2020 10:46:55 +0000 (12:46 +0200)]
RSA: Add a less loaded PSS-parameter structure

RSA_PSS_PARAMS carries with it a lot of baggage in form of X509_ALGOR
and ASN1_INTEGER, which we would rather avoid in our providers.
Therefore, we create a parallell structure - RSA_PSS_PARAMS_30 - that
contains the same information, but uses numeric identities (*) and C
integers (**).  This makes it simpler to handle.

Note that neither this structure nor its contents are passed between
libcrypto and the providers.  Instead, the numeric identities are
translated to and from names, which are then passed over that

For future considerations, we might consider dropping RSA_PSS_PARAMS
entirely.  For now, it's still reserved for EVP_PKEY_ASN1_METHOD code,
which RSA_PSS_PARAMS_30 is (almost entirely) reserved for use in our

(*) We use NIDs in this case, because we already have them and because
only algorithms that libcrypto knows about are permitted in PSS
restrictions.  We could use any number series we want, as long as we
know for sure what they represent.

(**) That's for saltlen and for trailerfield, which are never expect
to surpass the set of numbers that fit in a regular 'int'.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoRSA: Add rsa_schemes.c, to store scheme data and translator functions
Richard Levitte [Sat, 2 May 2020 10:41:39 +0000 (12:41 +0200)]
RSA: Add rsa_schemes.c, to store scheme data and translator functions

The scheme currently added is OAEP-PSSDigestAlgorithms codified.
The translator functions translate an EVP_MD into a NID, and a NID
into a name, to support the creation and parsing of OSSL_PARAM items.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoRSA: Extract much of the rsa_pkey_export_to() code to a separate function
Richard Levitte [Sat, 2 May 2020 11:02:29 +0000 (13:02 +0200)]
RSA: Extract much of the rsa_pkey_export_to() code to a separate function

The resulting function, rsa_todata(), is designed to be usable by
providers as well.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoRSA: Add RSA key types
Richard Levitte [Sat, 2 May 2020 09:22:23 +0000 (11:22 +0200)]
RSA: Add RSA key types

The support of restricted RSA key types (OAEP and PSS) was lacking, or
dependent on the presence of restriction parameters.  For example,
this means that even though an RSA-PSS key may have been generated, it
may appear as a plain unrestricted RSA key if parameters weren't
present (which is the case when default restriction parameters are

To make it clearer what an RSA key is intended for, and avoid
depending in an EVP_PKEY, we introduce RSA key types.  This is done by
reserving a section of the RSA flags (4 bits, which allows a total of
16 different types).

This isn't terribly important for EVP_PKEY_ASN1_METHOD code, as that
has access to the wrapping EVP_PKEY.  This is very important for
provider code, which has no access to the wrapping EVP_PKEY.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agotest/evp_extra_test.c: Add test for CMAC keygen with a NULL engine
Richard Levitte [Tue, 12 May 2020 13:27:32 +0000 (15:27 +0200)]
test/evp_extra_test.c: Add test for CMAC keygen with a NULL engine

Verifies that #11671 is fixed

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoEVP: Only use the engine when one is defined, in pkey_mac_ctrl()
Richard Levitte [Wed, 29 Apr 2020 04:55:40 +0000 (06:55 +0200)]
EVP: Only use the engine when one is defined, in pkey_mac_ctrl()

Fixes #11671

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoAdd documentation for ASN1_INTEGER_new() and ASN1_INTEGER_free()
Nikolay Morozov [Mon, 11 May 2020 17:51:31 +0000 (20:51 +0300)]
Add documentation for ASN1_INTEGER_new() and ASN1_INTEGER_free()

Reviewed-by: Shane Lontis <>
Reviewed-by: Dmitry Belyavskiy <>
(Merged from

5 months agoRename OSSL_CMP_CTX_set1_clCert() to OSSL_CMP_CTX_set1_cert()
Dr. David von Oheimb [Fri, 8 May 2020 11:30:44 +0000 (13:30 +0200)]
Rename OSSL_CMP_CTX_set1_clCert() to OSSL_CMP_CTX_set1_cert()

Also update documentation and example code in

Reviewed-by: Matt Caswell <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoAdd -reqin_new_tid option to apps/cmp.c and OSSL_CMP_MSG_update_transactionID()
Dr. David von Oheimb [Wed, 29 Apr 2020 16:06:43 +0000 (18:06 +0200)]
Add -reqin_new_tid option to apps/cmp.c and OSSL_CMP_MSG_update_transactionID()

Reviewed-by: Matt Caswell <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoImprove CMP documentation regarding use of untrusted certs
Dr. David von Oheimb [Thu, 30 Apr 2020 17:38:58 +0000 (19:38 +0200)]
Improve CMP documentation regarding use of untrusted certs

Reviewed-by: Matt Caswell <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoChunk 11 of CMP contribution to OpenSSL: CMP command-line interface
Dr. David von Oheimb [Fri, 3 Apr 2020 08:43:58 +0000 (10:43 +0200)]
Chunk 11 of CMP contribution to OpenSSL: CMP command-line interface

Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL
Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712).
Adds the CMP and CRMF API to libcrypto and the "cmp" app to the CLI.
Adds extensive documentation and tests.

Reviewed-by: Matt Caswell <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoPreliminary fix of memory leak in try_decode_PKCS12() - full fix is in #11733
Dr. David von Oheimb [Tue, 12 May 2020 08:14:00 +0000 (10:14 +0200)]
Preliminary fix of memory leak in try_decode_PKCS12() - full fix is in #11733

Reviewed-by: Matt Caswell <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoImprove description of algorithm NIDs in doc/man3/OSSL_CMP_CTX_new.pod
Dr. David von Oheimb [Tue, 28 Apr 2020 09:00:07 +0000 (11:00 +0200)]
Improve description of algorithm NIDs in doc/man3/OSSL_CMP_CTX_new.pod

Reviewed-by: Matt Caswell <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoReflect constifications of 62dcd2aa in doc/man3/OSSL_CRMF_MSG_get0_tmpl.pod
Dr. David von Oheimb [Fri, 3 Apr 2020 17:54:45 +0000 (19:54 +0200)]
Reflect constifications of 62dcd2aa in doc/man3/OSSL_CRMF_MSG_get0_tmpl.pod

Reviewed-by: Matt Caswell <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoOSSL_STORE: Make the 'file' scheme loader handle MSBLOB and PVK files
Richard Levitte [Fri, 12 Oct 2018 14:56:44 +0000 (16:56 +0200)]
OSSL_STORE: Make the 'file' scheme loader handle MSBLOB and PVK files

This involves exposing two pvkfmt.c functions, but only internally.

Reviewed-by: David von Oheimb <>
(Merged from

5 months agoOSSL_STORE: Better information when prompting for pass phrases
Richard Levitte [Fri, 12 Oct 2018 14:52:15 +0000 (16:52 +0200)]
OSSL_STORE: Better information when prompting for pass phrases

The prompt includes the URI, to make it clear which object needs a
pass phrase.

Reviewed-by: David von Oheimb <>
(Merged from

5 months agoOSSL_STORE: Make it possible to attach an OSSL_STORE to an opened BIO
Richard Levitte [Fri, 12 Oct 2018 14:46:41 +0000 (16:46 +0200)]
OSSL_STORE: Make it possible to attach an OSSL_STORE to an opened BIO

This capability existed internally, and is now made public.

Reviewed-by: David von Oheimb <>
(Merged from

5 months agoPROV: Adapt all our providers to use the new PROV_CTX structure
Richard Levitte [Tue, 12 May 2020 07:02:25 +0000 (09:02 +0200)]
PROV: Adapt all our providers to use the new PROV_CTX structure

Reviewed-by: Matt Caswell <>
(Merged from

5 months agoPROV: Add a proper provider context structure for OpenSSL providers
Richard Levitte [Tue, 12 May 2020 06:46:23 +0000 (08:46 +0200)]
PROV: Add a proper provider context structure for OpenSSL providers

The provider context structure is made to include the following information:

- The core provider handle (first argument to the provider init
  function).  This handle is meant to be used in all upcalls that need

- A library context, used for any libcrypto calls that need it, done in
  the provider itself.

Regarding the library context, that's generally only needed if the
provider makes any libcrypto calls, i.e. is linked with libcrypto.  That
happens to be the case for all OpenSSL providers, but is applicable for
other providers that use libcrypto internally as well.

The normal thing to do for a provider init function is to create its own
library context.  For a provider that's meant to become a dynamically
loadable module, this is what MUST be done.
However, we do not do that in the default provider; it uses the library
context associated with the core provider handle instead.  This is
permissible, although generally discouraged, as long as the provider in
question is guaranteed to be built-in, into libcrypto or into the
application that uses it.

Reviewed-by: Matt Caswell <>
(Merged from

5 months agoRemove explicit dependency on when processing .in files
Richard Levitte [Mon, 11 May 2020 09:40:33 +0000 (11:40 +0200)]
Remove explicit dependency on when processing .in files

For those files, the dependence on is automatic, adding
it explicitly only results in having that dependency twice.

Fixes #11786

Reviewed-by: Tomas Mraz <>
(Merged from

5 months agoFix FreeBSD build with --strict-warnings
Benjamin Kaduk [Mon, 11 May 2020 16:29:24 +0000 (09:29 -0700)]
Fix FreeBSD build with --strict-warnings

apps/lib/http_server.c needs to include string.h in order to get a prototype
for strerror().

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoFix rsa8192.pem
Bernd Edlinger [Sun, 10 May 2020 04:37:12 +0000 (06:37 +0200)]
Fix rsa8192.pem

Q: How did I do that?

A: That's a long story.

Precondition: I used sage 8.1 for the math, it could probably
done with simple python as well but I did not try.

First I extract numbers from rsa8192.pem:

openssl rsa -in rsa8192.pem -noout -text | sed "s/://g; s/ //g;"

cut&paste the numbers into sage:


I used echo `echo "<paste>" ` | sed "s/ //g"
to get everything in one line, put that again
into the clipboard and
then start sage, type N=0x<paste><CR>

sage: N=0x00890d9fd57e81b5ed43283d0ea0204a1229333d6fb9c37a179375b09c4f7b5b1cf2eb025979b6d90b709928a06725e04caf2b0f7fe94afbdf9f3fa566f1ba75c2f6dc488039f410eb5fa8ab152b8cfdb76791bb853059438edfae56bc70a32a9f3e2d883e8b751d083797999dc81a9c4d6bdb3a75362fd1d9c497cf5028dfcdd4cc3eb318e79fc0db45cbeed955da8a447f0872dee565bde4013340e767731441fae4fa5451356bfbc84e1271b39f111f5f8ef3a6c8973765b39addef80306194f4ea89fdfc8e9744866323f6936de89b2fe2741578b8eb3c41676702fabc50ecc376e6b7b6e7f94e7d7b5c1bab3c9f23bb0c8f04d8aca64c309fc063c406553e1c1421cc45060df7f48c49f5c5b459d572e273402d6a3ff008657fe91936714d1823c5cad53d80630b32169bf70feb2ebc1af6a35ee0bf059aed49c4e367d567e130e2846859b271fda8949b182e050819866b8e762ed29ffb3f7ca14cebfc2488662be4b3980fc8d31890a05f38ae9690cc7d9d3efc4808e03da104a8c28bb480bb814995a6e8b8978ab8350d90b3894e3abf7dc4ad0956335752c8d6944b38a1715e7d9950f49e6cdba171fbe651a2ca2665a7c70b6e8cf3a02c2f93dad8aa9506481cdb032d04082a5a6c6a733b6520fa80e2ef57b9cf858ca5ea11e084bc31a386fc6b099f069786207f80d61f2bef294400d59394ad1006431366a54ae09b0ecd3377dcd8af8fde9b94fd559b0b7adc5113ba66fc4b3dc842ee562cfcfd39b4ffc31576635873fc59535b7aa98605772436c251834e234fb2347cc970a49818cac2a9ee95ebb55fa2da66edd53e11245c6732140aae41491288cbf462eef8a807b46d0daffa38d9ccfe8033d2d4a3cf5c5b829df12183f7a05d3650153cd317a017083ac641c2c3ad11305de0a032be45c439bd7bbbe3cb97850f9d2c66f72a4a66e9d434544fc6d294ca3c92627be518bfa44e3017ac8ad9c0a26a227d2e8677da0a4de8edb53ac9530adb6383c72dbf562dc4d0fea4e492f09eb174548381a8686db3aeaaa3a9960cff25e8c64701115da54fa7a1fb2c566afcb4b2a63268d818c3391a62885d1341b3492c4f0167291b3d026a44e68c02f2d4d255d4c0906b92a2ced0c0bbf2bcdceaec1189895af4232dc386c975bf3477e5a70d3ab0ac0e5dc370240e34a276b155d5e290f77416a1986dec47f8c78236ac7df249df9ba21a802e6bd75b4fb1c6ffe0f4cf548761a56a1fcccee156523a718987f3fdaedc7171c9050db89a83f24c5a283695b9c28de6d3b69fc1714b0add335a0ce6fbbdbd0bbdb01e44969d775105bba3d2947dca2f291250f9b851e76f514ddc5a3aa4498e6521314991568860ebff1258d8b4aee9ee4159153684c0c016c60b17537a50b53cd59aad60678bd73f0714ab4ccae7416bab417b490736d59b2e9f

likewise for prime1 (P), prime2 (Q) and
privateExponent (D) and publicExponent (E)

sage: P=0x00c6d6eb9c0f93f8b8de74b2799798c1c1ed47549426a0d76af61f04f0b455184acfeec354c1703709e8727ea0213001738e395b5ca5ed4deec30f8b1ae0e54a516777c5ae897a5562e77dfe378dbba32ee30bcdb275ab7f87f8b9af02712d371a6aa671b44e0f667a6f2d406e5099d942f592ff5c517d452d58cf3f51120062a878fb77066650275b897caf078a5353f1d714963ff90818b6b87c6db438681b4b315c4fd256c1bd383fcf8e67b49a3ee077373a66d77e4c02eebe9350478a51cdfa395d60d905c1189ed7041373f1609075faf9d9f39d3d7b0e7fc8b1d36cb8c5c48731ef5cd87e11f480cdfa4b3ee6cf7eebd3e13f4244647396d52030b82c39d69a3a4075ee90531d1ddb5f1284dc7ab09a3892de5c0ddeed115c7c9ee5fc008658830b0e6f7f366a72f215192498474ade046fc10e92591dfa133e4beff98758e0e92c05f999504a486e3f71c15b73adf7fe0d311f0d0dc1a8e2aff92572475a92e60f970174c80c4948a0cb86635cb438519b18c260ff9f212925e684ef151cc91fa1c4c8dbbc337c9b46f9a93c88cce49e49a670762186e8858051f93ebff7b0b50caadd9b32f93e396b5a6d1cd7f77b2e50e83fae5f3928433268f6cc28810071ce334025a24c7ebf92e631df0d26e99923018946de4ea5e30e868c33ea3d408d8c58815ecf9892fa3afa5f6fbef9a1dfda2da51b6f01f3dae588bdf17b
sage: Q=0x00b073b35a3bba0954b242961630e8e0af8d3ea8aad80d55669e9e79c388983363d96fe471205743001b4798b81de1be3fb06353fd0c9c4fd43f91f9cb2162b00583cc94ff791a615348d01977ca05f4796d5bff41d94dda1cb3ef2433ff4f6500d15ab290a14e651efa91b7df5d5e50f8356188d9842dcdd67c89eb7d40baa78f045969b804f7a985d35a8a8ac32715cb212a34fb89e85e538275e53663fe675944d2b5dba77b7b7abfacd8fbddee4427db6460b728952af882992750c2542d2122247d7f431ec2fe64c0311b0de5290eb619c6ab476308d59f3efff7255d07ebb51fe64ac5967c0b79bae07d36283cf768c8eee2054349cefe90876da66a52e9e0ff20cc00a40fb0c69524e7a01e5c2f07239831a0fa2f56ad405b3a25537907d990e8f5a3e4f3df99dda6afc30d4565aa5881f64adcc6f6be4077893c7e7710623e6158359c3facfef5036779903065fd0d0a2ed8bf2e53a46758dbff06284670bf10bd2e13cba4323ce50fa43df373bd0940011c424f41c5035a10b8095f420ddb67189f6dad62f1257b0f46e353a90eacc145c7db74998a5d0d8772ba1286eb582504465290171e4db87f2e89564214a2317953a7307b1b4c8dad5920866087d7ae80845478813bdf5f6740d0f3b975a344272804b036e4fef09e91d60d1a730fda2f5c222f7636bbe252f9a6caa86d5e8be7e7db2cf912817a0898a4742d
sage: D=0x3b900240c4a416aeb09b123e02f5457bb31023c9249081c5313edaac741686388492020964ce4471a653c9c63c4dc7b74c0188d0ec50bc3a29797da6c9b3616e83dea45ba5d41e6e4cba7eefca6791f45d3c86a491a899a5c42c7e61930a3681d281f34e4b49707e9bba74f68f7a91274c92904b546b5fe6267c5b8ad8d8bb199a523d7fbb5a40748b56dfccf074f3d664e705153dd903b7cd95bac556be3ab59a165d7cbb765e21a4a1d97e34b412baf1caacb57543d2bd8e5ae5cd2a86dc41e256f3f5c0073052859d1c8a12f4973caa88de2e5eb2eef8d6ebdb66fe154d8e383cba74693753affaf4dbc8e2988c08f947b1f8473a7163775656448572c325250ad2cd75c9f5d42721b91ae8fb427773605afa2f4297daf7ab34f5d71144185f3f5cbc94041081fae19fd5d47fc49421080edc5d658b5f223fb1e9b172f4da1a92263fa922225d4c0231e35d94d276fcb0e0999f5f26068528c83f49b0dd79fb157c49fe8b3d80e7cd2b3da76478ebd2ae2c8164583bee2f96591e2f41ad799ae0e2855a5699996fb2c7efb69f86874bca58628e512d579b247e43ee8db04b424e84e44cf753f86e12dd8d2e0ea0b800e6c313317c14658993b8e04c7fb5de1cba0829123dc518957be2a46f76f8ff305fee17b2310bfdd66a93c8b050451f8ceb26c518b7abb72faf08fca0bf6df8a80de511ffc00dc350cd87e52c9cf5771892300e420929da698b6b973da849c89410f089e9b39de79fc1a01a27d2f879ce5cd80ca0a3899d9f480c68d7a5f8c8b3c74936b19f0c7174987df437658046adaffdaddc3540be7fc06a1d2290f58ad9a2992d32e9ecbadf2eed961b4e68c8a89a5709a334082ad297348c4c31c54a3dadccb93afaa9f1786c4167021d4a16dd78afb41131bdd651357bd44f42cfee5d03fdfae087255d18a6a41c03aa6408b6097d8a6848cbbf05a7f20207d5673ea5e6dc849d5d3009c6e8a6c41285cd64f71b536d8345d61f404079278facde0d6e2264cbe655e877468bd3e76380d91f282f26ae17e41a1bac76c148c4c75dd22656816ab259e2c79920e27e6bcfa83732ac6e0a245dcd9cc82f69e45019cf53ac39bebca3ddea0f55ef97b6d8f7b7eadaae792fb1b55c73cf2ed644e651a22c60ed9c0bb063c50fadda6beccbf6c88c41ef1546bab5f21dbe4fbeeb11f3c5c40fa1cc3df2c11bfe7910d1d36a5ec6e66462c7e216481008931039299d23f2be4d838fb010b661a8541a8b7f7bf7d6c8032895e82133e24c835e5a3491249ec69f28e22cf9b0fab9be9ea17026fbadd470eee4676d7ac79976a1c6807e89b5dabab815ffa076caeaeb53f505a31129dac1e9f0b5d919f17aced63574c8524000022b6bc6cb9c8d6a06e44c72e055a1e2706e736af241ab3084fa56cf942aa139440f74e230be31cd8dd4bf0cbdd657f1
sage: E=0x10001

sage: is_pseudoprime(P)
sage: gcd(N,P)
sage: N%P

>> P seems to be a prime, and is indeed a factor of N.

sage: is_pseudoprime(Q)
sage: gcd(N,Q)
sage: ecm(Q)
Found composite factor of 3 digits: 675
Composite cofactor ... has 1231 digits.
Q has a small factor.  The large cofactor
is way too large to be factorized (today).

>> Q must be wrong.

sage: pow(pow(2,E,N),D,N)
sage: pow(pow(3,E,N),D,N)
sage: pow(pow(5,E,N),D,N)
sage: pow(pow(7,E,N),D,N)
sage: pow(pow(11,E,N),D,N)
sage: pow(pow(1000,E,N),D,N)

>> x^D mod N is indeed the inverse of x^E mod N
>> D seems to be correct.

>> now compute
sage: Qcorrect = N/P
sage: is_prime(Qcorrect)
sage: is_pseudoprime(Qcorrect)

>> surprise, this is a sage artefact.
>> is_prime is supposed to tell if Qcorrect
>> is a provable prime, but these numbers are
>> too large for a proof.

sage: help(Qcorrect)
class Rational

>> oops, it is of course not a rational number.

sage: Qcorrect = Integer(N/P)
class Integer

>> okay now it is an integer.

sage: is_prime(Qcorrect)
>> takes way too long: press CTRL-C
sage: is_pseudoprime(Qcorrect)

>> so the correct Q seems to be a prime.

sage: Q-Qcorrect
sage: hex(Q-Qcorrect)

>> interesting, now figure out the bits that are flipped in Q:

Q         ...20ddb67189f6dad...
Qcorrect  ...20dd9c6149f6dad...

$ openssl rsa -in rsa8192.pem -outform der -out rsa8192.der
writing RSA key
$ xxd -ps < rsa8192.der > rsa8192.hex
$ sed "s/20ddb67189f6dad/20dd9c6149f6dad/" < rsa8192.hex > rsa8192.out
$ diff rsa8192.hex rsa8192.out
< 10b8095f420ddb67189f6dad62f1257b0f46e353a90eacc145c7db74998a
> 10b8095f420dd9c6149f6dad62f1257b0f46e353a90eacc145c7db74998a

>> et voila

$ xxd -ps -r < rsa8192.out > rsa8192.der
$ openssl rsa -inform der -in rsa8192.der -out rsa8192.pem
writing RSA key
$ openssl rsa -check -noout -in rsa8192.pem
RSA key ok
$ git diff
diff --git a/apps/rsa8192.pem b/apps/rsa8192.pem
index 946a6e5..83d962f 100644
--- a/apps/rsa8192.pem
+++ b/apps/rsa8192.pem
@@ -1,5 +1,4 @@
@@ -62,7 +61,7 @@ JH1/Qx7C/mTAMRsN5SkOthnGq0djCNWfPv/3JV0H67Uf5krFlnwLebrgfTYoPPdo
@@ -98,4 +97,3 @@ TwEgE67iOb2iIoUpon/NyP4LesMzvdpsu2JFlfz13PmmQ34mFI7tWvOb3NA5DP3c

>> DONE.

Fixes #11776

Reviewed-by: Paul Dale <>
Reviewed-by: Matthias St. Pierre <>
(Merged from

5 months agoReplace misleading error message when loading PEM
Tomas Mraz [Mon, 11 May 2020 15:15:40 +0000 (17:15 +0200)]
Replace misleading error message when loading PEM

The error message "short header" when the end line
of PEM data cannot be identified is misleading.
Replace it with already existing "bad end line" error.

Fixes #8815

Reviewed-by: Ben Kaduk <>
(Merged from

5 months agoCORE: Attach the provider context to the provider late
Richard Levitte [Mon, 11 May 2020 09:10:41 +0000 (11:10 +0200)]
CORE: Attach the provider context to the provider late

There are concerns that if |prov->provctx| is populated early,
sensitive information may leak from the provider.  Therefore, we use a
temporary variable, and only assign it to |prov->provctx| when the
provider init function has returned successfully.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoFix some misunderstandings in our providers' main modules
Richard Levitte [Sat, 9 May 2020 08:11:14 +0000 (10:11 +0200)]
Fix some misunderstandings in our providers' main modules

This started with adding forward declarations of all provider side
interface functions, and fixing all compiler errors.

Furthermore, diminish the faulty assumption that the provider context
is and always will be just a library context.  That means adding a
teardown function in all providers that aren't necessarily built into

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoCORE: Fix the signature of OSSL_provider_query_operation_fn
Richard Levitte [Sat, 9 May 2020 07:59:05 +0000 (09:59 +0200)]
CORE: Fix the signature of OSSL_provider_query_operation_fn

For some reason, the 'no_cache' parameter was declare 'const', when
it's in fact supposed to be modifiable.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoFix d2i_PrivateKey_ex() to work as documented
Richard Levitte [Mon, 11 May 2020 07:14:11 +0000 (09:14 +0200)]
Fix d2i_PrivateKey_ex() to work as documented

d2i_PrivateKey(), and thereby d2i_PrivateKey_ex(), is documented to
return keys of the type given as first argument |type|, unconditionally.
Most specifically, the manual says this:

> An error occurs if the decoded key does not match type.

However, when faced of a PKCS#8 wrapped key, |type| was ignored, which
may lead to unexpected results.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoFix issues reported by markdownlint
Richard Levitte [Mon, 11 May 2020 07:55:53 +0000 (09:55 +0200)]
Fix issues reported by markdownlint

Reviewed-by: Paul Dale <>
(Merged from

5 months agodoc: fix two invalid <B> tags
Beat Bolli [Thu, 7 May 2020 12:19:22 +0000 (14:19 +0200)]
doc: fix two invalid <B> tags

Signed-off-by: Beat Bolli <>
Reviewed-by: Richard Levitte <>
Reviewed-by: Tomas Mraz <>
Reviewed-by: Ben Kaduk <>
(Merged from

5 months agoExtract HTTP server code from apps/ocsp.c to apps/lib/http_server.c
Dr. David von Oheimb [Mon, 4 May 2020 18:29:25 +0000 (20:29 +0200)]
Extract HTTP server code from apps/ocsp.c to apps/lib/http_server.c

Also adds apps/include/http_server.h.
This is used so far by apps/ocsp.c and is going to be used for apps/cmp.c
and will be helpful also for any future app acting as HTTP server.

Reviewed-by: Matt Caswell <>
Reviewed-by: Viktor Dukhovni <>
(Merged from

5 months agoFix bio_wait() in crypto/bio/bio_lib.c in case OPENSSL_NO_SOCK
Dr. David von Oheimb [Mon, 4 May 2020 18:21:34 +0000 (20:21 +0200)]
Fix bio_wait() in crypto/bio/bio_lib.c in case OPENSSL_NO_SOCK

Reviewed-by: Matt Caswell <>
Reviewed-by: Viktor Dukhovni <>
(Merged from

5 months agoConstify 'req' parameter of OSSL_HTTP_post_asn1()
Dr. David von Oheimb [Mon, 4 May 2020 17:54:43 +0000 (19:54 +0200)]
Constify 'req' parameter of OSSL_HTTP_post_asn1()

Reviewed-by: Matt Caswell <>
Reviewed-by: Viktor Dukhovni <>
(Merged from

5 months agoFix bug in OSSL_CMP_SRV_process_request() on transaction renewal
Dr. David von Oheimb [Mon, 4 May 2020 17:53:09 +0000 (19:53 +0200)]
Fix bug in OSSL_CMP_SRV_process_request() on transaction renewal

Reviewed-by: Matt Caswell <>
Reviewed-by: Viktor Dukhovni <>
(Merged from

5 months agodoc: remove deprecation notes for apps that are staying.
Pauli [Mon, 20 Apr 2020 07:22:41 +0000 (17:22 +1000)]
doc: remove deprecation notes for apps that are staying.

The apps that are staying are: dhparam, dsa, dsaparam, ec, ecparam, gendsa and

The rsautl app remains deprecated.

The -dsaparam option to dhparam also remains deprecated.

Reviewed-by: Matt Caswell <>
(Merged from

5 months agoFix PEM certificate loading that sometimes fails
Maximilian Blenk [Tue, 7 Apr 2020 17:33:39 +0000 (19:33 +0200)]
Fix PEM certificate loading that sometimes fails

As described in, the
loading of PEM certificates sometimes fails if a line of base64
content has the length of a multiple of 254.
The problem is in get_header_and_data(). When such a line with a
length of 254 (or a multiple) has been read, the next read will
only read a newline. Due to this get_header_and_data() expects to be
in the header not in the data area. This commit fixes that by checking
if lines have been read completely or only partially. In case of a
previous partial read, a newline will be ignored.

Reviewed-by: Dmitry Belyavskiy <>
Reviewed-by: Tomas Mraz <>
Reviewed-by: Ben Kaduk <>
(Merged from

5 months agoFix issues reported by markdownlint
Rich Salz [Thu, 7 May 2020 11:44:01 +0000 (13:44 +0200)]
Fix issues reported by markdownlint

Reviewed-by: Tomas Mraz <>
Reviewed-by: Matthias St. Pierre <>
(Merged from

5 months agotravis: enable markdownlint checks
Rich Salz [Thu, 7 May 2020 11:42:14 +0000 (13:42 +0200)]
travis: enable markdownlint checks

Reviewed-by: Tomas Mraz <>
Reviewed-by: Matthias St. Pierre <>
(Merged from

5 months agoEVP: when setting the operation to EVP_PKEY_OP_UNDEFINED, clean up!
Richard Levitte [Wed, 6 May 2020 18:48:25 +0000 (20:48 +0200)]
EVP: when setting the operation to EVP_PKEY_OP_UNDEFINED, clean up!

There were a few instances where we set the EVP_PKEY_CTX operation to
EVP_PKEY_OP_UNDEFINED, but forgot to clean up first.  After the
operation is made undefined, there's no way to know what should be
cleaned away, so that must be done first, in all spots.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoFix use-after-free in BIO_C_SET_SSL callback
Dr. Matthias St. Pierre [Wed, 6 May 2020 15:24:13 +0000 (17:24 +0200)]
Fix use-after-free in BIO_C_SET_SSL callback

Since the BIO_SSL structure was renewed by `ssl_free(b)/ssl_new(b)`,
the `bs` pointer needs to be updated before assigning to `bs->ssl`.

Thanks to @suishixingkong for reporting the issue and providing a fix.

Closes #10539

Reviewed-by: Tomas Mraz <>
(Merged from

5 months agoSSL_OP_DISABLE_TLSEXT_CA_NAMES option implementation
Nikolay Morozov [Sat, 2 May 2020 09:22:43 +0000 (12:22 +0300)]
SSL_OP_DISABLE_TLSEXT_CA_NAMES option implementation

Reviewed-by: Tomas Mraz <>
Reviewed-by: Dmitry Belyavskiy <>
(Merged from

5 months agoAdd documentation for CMS_EnvelopedData_create()
Jakub Zelenka [Sun, 12 Apr 2020 20:29:41 +0000 (21:29 +0100)]
Add documentation for CMS_EnvelopedData_create()

Reviewed-by: Matt Caswell <>
Reviewed-by: Dmitry Belyavskiy <>
(Merged from

5 months agoRemove legacy FIPS_mode functions
Shane Lontis [Thu, 7 May 2020 06:08:18 +0000 (16:08 +1000)]
Remove legacy FIPS_mode functions

Reviewed-by: Richard Levitte <>
Reviewed-by: Matt Caswell <>
(Merged from

5 months agoAdd RSA SHA512 truncated digest support
Shane Lontis [Thu, 30 Apr 2020 03:41:05 +0000 (13:41 +1000)]
Add RSA SHA512 truncated digest support

Partial Fix for #11648.

Some additional work still needs to be done to support RSA-PSS mode.

RSA legacy digests will be addressed in another PR.

Reviewed-by: Richard Levitte <>
(Merged from

5 months agoAdd OIDS for md4 and ripemd160 to der_rsa
Shane Lontis [Fri, 1 May 2020 00:31:27 +0000 (10:31 +1000)]
Add OIDS for md4 and ripemd160 to der_rsa

Reviewed-by: Richard Levitte <>
(Merged from

5 months agoRemove gen_get_params & gen_gettable_params from keygen operation
Shane Lontis [Thu, 7 May 2020 05:31:05 +0000 (15:31 +1000)]
Remove gen_get_params & gen_gettable_params from keygen operation

EVP_PKEY_CTX_gettable_params() was missing code for the keygen operation.
After adding it it was noticed that it is probably not required for this type, so instead
the gen_get_params and gen_gettable_params have been remnoved from the provider interface.
gen_get_params was only implemented for ec to get the curve name. This seems redundant
since normally you would set parameters into the keygen_init() and then generate a key.
Normally you would expect to extract data from the key - not the object that we just set up
to do the keygen.

Added a simple settable and gettable test into a test that does keygen.

Reviewed-by: Richard Levitte <>
(Merged from

5 months agoRemove cipher table lookup from EVP_CipherInit_ex
Shane Lontis [Tue, 5 May 2020 06:51:32 +0000 (16:51 +1000)]
Remove cipher table lookup from EVP_CipherInit_ex

Reviewed-by: Richard Levitte <>
(Merged from

5 months agoConfigure: avoid perl regexp bugs
Richard Levitte [Tue, 5 May 2020 14:53:43 +0000 (16:53 +0200)]
Configure: avoid perl regexp bugs

It seems that in older perl versions '(?P' doesn't interact very well
with '(?|' or '(?:'.

Since we make extensive use of '(?P' in parsing, we avoid
combining that with '(?|' and '(?:' when parsing variables,
and end up parsing variable modifier twice (first generally, and then
parse that result into the modifier components).

Fixes #11694

Reviewed-by: Matt Caswell <>
(Merged from

5 months agos_server normal shutdown
Dmitry Belyavskiy [Tue, 5 May 2020 12:26:32 +0000 (15:26 +0300)]
s_server normal shutdown

Partially fixes #11209

Reviewed-by: Matt Caswell <>
(Merged from

5 months agoExtend test_ssl_get_shared_ciphers
Matt Caswell [Fri, 1 May 2020 11:24:57 +0000 (12:24 +0100)]
Extend test_ssl_get_shared_ciphers

Ensure we test scenarios where a FIPS peer is communication with a
non-FIPS peer. Check that a FIPS client doesn't offer ciphersuites it
doesn't have, and that a FIPS server only chooses ciphersuites it can

Reviewed-by: Tomas Mraz <>
(Merged from

5 months agoDon't offer or accept ciphersuites that we can't support
Matt Caswell [Fri, 1 May 2020 08:17:40 +0000 (09:17 +0100)]
Don't offer or accept ciphersuites that we can't support

We were not correctly detecting whether TLSv1.3 ciphersuites could
actually be supported by the available provider implementations. For
example a FIPS client would still offer CHACHA20-POLY1305 based
ciphersuites even though it couldn't actually use them. Similarly on
the server would try to use CHACHA20-POLY1305 and then fail the

Reviewed-by: Tomas Mraz <>
(Merged from

5 months agoFix a memory leak in CONF .include handling
Matt Caswell [Fri, 1 May 2020 14:15:13 +0000 (15:15 +0100)]
Fix a memory leak in CONF .include handling

If OPENSSL_CONF_INCLUDE has been set then we may leak the "include"

Reviewed-by: Tomas Mraz <>
(Merged from

5 months agoCentralise Environment Variables for the tests
Matt Caswell [Thu, 30 Apr 2020 15:08:57 +0000 (16:08 +0100)]
Centralise Environment Variables for the tests

The test_includes test was failing if OPENSSL_CONF_INCLUDE happened to
be set in the user's environment. To ensure that no tests accidentally
use this or other enviroment variables from the user's environment we
automatically set them centrally for all tests.

Reviewed-by: Tomas Mraz <>
(Merged from

5 months agoThe synthesized OPENSSL_VERSION_NUMBER must be long
Tomas Mraz [Tue, 5 May 2020 07:52:25 +0000 (09:52 +0200)]
The synthesized OPENSSL_VERSION_NUMBER must be long

(to keep API compatibility with older releases)

Fixes #11716

Reviewed-by: Matt Caswell <>
Reviewed-by: Richard Levitte <>
Reviewed-by: Dmitry Belyavskiy <>
(Merged from

5 months agoFix up whitespace nits introduced by PR #11416
Benjamin Kaduk [Mon, 4 May 2020 18:50:25 +0000 (11:50 -0700)]
Fix up whitespace nits introduced by PR #11416

Expand a couple literal tabs, and de-indent the body of a function.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoUse fips=yes consistently in documentation
Christian Heimes [Mon, 4 May 2020 12:26:12 +0000 (14:26 +0200)]
Use fips=yes consistently in documentation

The documentation for ``EVP_default_properties_is_fips_enabled()`` uses
``fips=yes`` in one place and ``fips=true`` in another place. Stick to
``fips=yes`` like everywhere else.

Signed-off-by: Christian Heimes <>
Reviewed-by: Matt Caswell <>
Reviewed-by: Tomas Mraz <>
(Merged from

5 months agoStrengthen X509_STORE_CTX_print_verify_cb() to print expected host etc.
Dr. David von Oheimb [Thu, 30 Apr 2020 17:31:07 +0000 (19:31 +0200)]
Strengthen X509_STORE_CTX_print_verify_cb() to print expected host etc.

Add X509_VERIFY_PARAM_get0_host(), X509_VERIFY_PARAM_get0_email(),
and X509_VERIFY_PARAM_get1_ip_asc() to support this,
as well as the internal helper function ipaddr_to_asc(), which
is used also for simplifying other IP address output functions.

Reviewed-by: Matt Caswell <>
Reviewed-by: David von Oheimb <>
(Merged from

5 months agoImprove SSL_shutdown documentation.
Kurt Roeckx [Mon, 13 Apr 2020 11:01:29 +0000 (13:01 +0200)]
Improve SSL_shutdown documentation.

Reviewed-by: Tomas Mraz <>
(Merged from

5 months agoFix aix compile error in cmp_ctx_test.c
Shane Lontis [Fri, 1 May 2020 07:09:01 +0000 (17:09 +1000)]
Fix aix compile error in cmp_ctx_test.c

Errors were of the form 1506-226 (S) The ":" operator is not allowed between "int" and "char*".
I think it is valid syntax the way it was written, But just rewrote so it compiled.
The aix compiler must be looking at the type of blah() when doing test ? (blah(), NULL) : X.

Reviewed-by: Richard Levitte <>
Reviewed-by: Matt Caswell <>
(Merged from

5 months agoFix incorrect default keysize for CAST ofb and cfb modes.
Shane Lontis [Sat, 2 May 2020 03:51:35 +0000 (13:51 +1000)]
Fix incorrect default keysize for CAST ofb and cfb modes.

Fixes #11459

It was incorrectly using 8 bytes instead of 16 as the default.
This was verified by expanding the macros used in e_cast.c.
The issue occurs if EVP_CIPHER_CTX_set_key_length() is not called.
evp_test.c hides this issue as it always calls EVP_CIPHER_CTX_set_key_length() before
using EVP_CipherInit_ex(...., key, ..).

Reviewed-by: Richard Levitte <>
(Merged from

5 months agoAllow OSSL_PARAM_get_octet_string() to pass a NULL buffer
Matt Caswell [Tue, 28 Apr 2020 16:45:53 +0000 (17:45 +0100)]
Allow OSSL_PARAM_get_octet_string() to pass a NULL buffer

We may just want to know the number of octets so allow passing a NULL

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoAdd some tests for the newly added raw private/public key functions
Matt Caswell [Mon, 27 Apr 2020 16:17:05 +0000 (17:17 +0100)]
Add some tests for the newly added raw private/public key functions

We already had soem tests for the older raw private/public key functions
so we expand those to call the new versions as well and pass in a libctx.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoDocument the new raw private/public key functions
Matt Caswell [Mon, 27 Apr 2020 15:48:18 +0000 (16:48 +0100)]
Document the new raw private/public key functions

Document the newly added EVP_PKEY_new_raw_private_key_with_libctx and
EVP_PKEY_new_raw_public_key_with_libctx functions.

Reviewed-by: Shane Lontis <>
(Merged from

5 months agoImplement key match functionality for ECX keys
Matt Caswell [Mon, 27 Apr 2020 15:14:16 +0000 (16:14 +0100)]
Implement key match functionality for ECX keys

This makes EVP_PKEY_cmp work for provider side ECX keys.

Reviewed-by: Shane Lontis <>
(Merged from