Richard Levitte [Mon, 17 May 2021 19:40:24 +0000 (21:40 +0200)]
Configurations/descrip.mms.tmpl: Add another inclusion hack
crypto/ec/curve448/ has a series of inclusions that throws VMS C
off, so we compensate for it the same way as we have done before.
Fixes #14247
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15317)
Richard Levitte [Mon, 17 May 2021 14:56:28 +0000 (16:56 +0200)]
Configurations/descrip.mms.tmpl: Change strategy for include directories
Instead of what we used to do, put all include directories in a number
of DCL variables and generate the /INCLUDE qualifier value on the
command line, we instead generate VMS C specific header files with
include directory pragmas, to be used with the VMS C's /FIRST_INCLUDE
qualifier. This also shortens the command line, the size of which is
limited.
VMS C needs to have those include directories specified in a Unix
form, to be able to safely merge #include paths with them when
searching through them.
Fixes #14247
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15317)
Richard Levitte [Mon, 17 May 2021 16:21:45 +0000 (18:21 +0200)]
Thrown away all special descrip.mms variables
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15317)
Richard Levitte [Mon, 17 May 2021 15:20:58 +0000 (17:20 +0200)]
Fix configdata.pm.in's "use lib" for VMS
`use lib` needs Unix formatted paths. For VMS, it means that we must
make sure to convert paths, and we may as well generalise it.
In this case, we need to adapt the functions sourcedir() and sourcefile()
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15317)
Richard Levitte [Mon, 17 May 2021 13:13:41 +0000 (15:13 +0200)]
Fix The VMS variant of platform->staticname()
It was looking in the wrong place in %unified_info to determine if the
library would be installed or not.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15317)
Richard Levitte [Mon, 17 May 2021 13:04:42 +0000 (15:04 +0200)]
Fix OpenSSL::fallback for VMS
VMS unpackers will typically convert any period ('.') in directory
names to underscores, since the period is a path separator on VMS,
just like '/' is a path separator on Unix. Our fallback mechanism
needs to account for that.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15317)
Richard Levitte [Mon, 17 May 2021 12:53:48 +0000 (14:53 +0200)]
Configurations/descrip.mms.tmpl: Diverse updates
Get it back in sync with the other templates, and correct a few syntax
errors that have crept in.
Fixes #14247
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15317)
Richard Levitte [Mon, 17 May 2021 12:44:01 +0000 (14:44 +0200)]
Turn off VMS C's info about unsupported pragmas
VMS C can be notoriously informative about certain things, such as
unsupported pragmas. The case here is that it doesn't support
"#pragma once", and since we use those quite a lot, that's a lot of
repeated information. We simply turn that warning off.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15317)
Richard Levitte [Mon, 17 May 2021 12:33:16 +0000 (14:33 +0200)]
Rework how a build file (Makefile, ...) is produced
The memory footprint of how we produced the Makefile was quite...
important, because we have all the processing in one perl snippet, and
generate the details of the build file by appending to the "magic"
variable $OUT. The result is that this variable gets to hold the
majority of the build file text, and depending on memory reallocation
strategies for strings, the heap may hold multiple (possibly not just
a few) copies of this string, almost all of them "freed" but still
taking up space. This has resulted in memory exhaustion.
We therefore change strategy, and generate the build file in two
phases, where the first phase generates the full template using small
perl snippets for each detail, and the second phase processes this
template. This is much kinder to process memory.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15310)
Richard Levitte [Mon, 17 May 2021 12:25:12 +0000 (14:25 +0200)]
Move some OpenSSL perl utility functions to OpenSSL::Util
quotify1() and quotify_l() were in OpenSSL::Template, but should be
more widely usable.
configdata.pm.in's out_item() is also more widely useful and is
therefore moved to OpenSSL::Util as well, and renamed to dump_data().
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15310)
Dr. David von Oheimb [Mon, 3 May 2021 19:58:02 +0000 (21:58 +0200)]
CMS_get0_SignerInfos(): Prevent spurious error on cms_get0_signed() failure
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12959)
Dr. David von Oheimb [Mon, 28 Sep 2020 06:29:59 +0000 (08:29 +0200)]
apps/cms.c: Simplify make_receipt_request() and load_content_info(()
Also improve adherence to code formatting rules.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12959)
Dr. David von Oheimb [Wed, 23 Sep 2020 08:19:50 +0000 (10:19 +0200)]
apps/cms.c: Make -sign and -verify handle binary input
Fixes #8940
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12959)
Dr. David von Oheimb [Wed, 23 Sep 2020 08:17:58 +0000 (10:17 +0200)]
Make SMIME_read_CMS_ex() and SMIME_read_ASN1_ex() support binary input
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12959)
Dr. David von Oheimb [Wed, 23 Sep 2020 08:11:53 +0000 (10:11 +0200)]
bio_lib: Add BIO_get_line, correct doc of BIO_gets
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12959)
Pauli [Wed, 19 May 2021 03:15:14 +0000 (13:15 +1000)]
fips: remove unnecessary commas to get CI working
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15337)
Tomas Mraz [Mon, 17 May 2021 17:00:13 +0000 (19:00 +0200)]
Avoid failing label removal if label is not there
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15309)
Tomas Mraz [Mon, 17 May 2021 10:20:54 +0000 (12:20 +0200)]
Separate FIPS checksum and labelling into different workflows
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15309)
Rich Salz [Mon, 17 May 2021 16:03:19 +0000 (12:03 -0400)]
Remove "openssl ifdef" handling
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15311)
Rich Salz [Mon, 17 May 2021 15:46:58 +0000 (11:46 -0400)]
Remove '=for openssl ifdef'
No longer needed after rewrite of cmd-nits
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15311)
Matt Caswell [Sat, 15 May 2021 09:27:09 +0000 (10:27 +0100)]
Better error messages if there are no encoders/decoders/store loaders
If you don't have the base or default providers loaded and therefore there
are no encoders/decoders or store loaders then the error messages can be
cryptic. We provide better hints about how to fix the problem.
Fixes #13798
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15306)
Dr. David von Oheimb [Mon, 17 May 2021 11:24:20 +0000 (13:24 +0200)]
Move ossl_sleep() to e_os.h and use it in apps
Fixes #15304
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15308)
Dr. David von Oheimb [Mon, 17 May 2021 09:38:01 +0000 (11:38 +0200)]
DOC: Fix nits found by improved find-doc-nits -c
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15298)
Dr. David von Oheimb [Mon, 17 May 2021 06:48:55 +0000 (08:48 +0200)]
ci.yml: Add cmd-nits to the doc-nits CI run
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15298)
Dr. David von Oheimb [Mon, 17 May 2021 06:31:50 +0000 (08:31 +0200)]
openssl-dsa.pod.in: Fix glitch: pvk-string -> pvk-strong
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15298)
Dr. David von Oheimb [Sun, 16 May 2021 17:03:50 +0000 (19:03 +0200)]
find-doc-nits: Make -c option (cmd-nits) independent of app build and execution
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15298)
Dr. David von Oheimb [Wed, 12 May 2021 12:15:31 +0000 (14:15 +0200)]
apps/s_server: Add -proxy and -no_proxy options
Strongly related to feature request #6965
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15245)
Dr. David von Oheimb [Wed, 12 May 2021 11:58:52 +0000 (13:58 +0200)]
apps/ocsp: Add -proxy and -no_proxy options
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15245)
Rich Salz [Wed, 12 May 2021 15:45:37 +0000 (11:45 -0400)]
Add -quiet flag to genpkey
Picking up late suggestions to PR #6909 by Philip Prindeville
<philipp@redfish-solutions.com>.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15249)
Pauli [Mon, 17 May 2021 08:16:28 +0000 (18:16 +1000)]
apps: use else if when checking for headers in the http server code
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15300)
Pauli [Mon, 17 May 2021 02:18:53 +0000 (12:18 +1000)]
seal: make EVP_SealInit() library context aware
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15300)
Pauli [Sun, 16 May 2021 23:45:33 +0000 (09:45 +1000)]
hmac: fix coverity
1484888 negative integer to size_t conversion
More theoretical than real but easy and cheap to check for.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15300)
Pauli [Sun, 16 May 2021 23:42:42 +0000 (09:42 +1000)]
keymgmt: fix coverity
1484886 unchecked return value
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15300)
Pauli [Sun, 16 May 2021 23:38:29 +0000 (09:38 +1000)]
evp: fix coverity
1484885 negative integer to size_t conversion
Theoretically, the IV length can come back negative which would explode.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15300)
Pauli [Sun, 16 May 2021 23:33:10 +0000 (09:33 +1000)]
provider: fix coverity
1484884: uninitialised lock use
This actually fixes a more subtle problem that wasn't detected which could
cause memory leaks.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15300)
Pauli [Sun, 16 May 2021 23:26:48 +0000 (09:26 +1000)]
apps: clean up the http server code
Clean up some of the null checking in the http server code.
This also "fixes" the false positive from coverity CID
1484883.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15300)
Pauli [Mon, 17 May 2021 00:08:13 +0000 (10:08 +1000)]
test: conditionally exclude unused code for no-tls1.2 build
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15301)
Matt Caswell [Fri, 14 May 2021 14:33:40 +0000 (15:33 +0100)]
Fix a use-after-free in the child provider code
If the child provider context data gets cleaned up before all usage of
providers has finished then a use-after-free can occur. We change the
priority of this data so that it gets freed later.
Fixes #15284
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15286)
Rich Salz [Thu, 6 May 2021 16:56:35 +0000 (12:56 -0400)]
Add SSL_OP_ALLOW_CLIENT_RENEGOTIATION
Add -client_renegotiation flag support. The -client_renegotiation flag is
equivalent to SSL_OP_ALLOW_CLIENT_RENEGOTIATION. Add support to the app,
the config code, and the documentation.
Add SSL_OP_ALLOW_CLIENT_RENEGOTIATION to the SSL tests. We don't need to
always enable it, but there are so many tests so this is the easiest thing
to do.
Add a test where client tries to renegotiate and it fails as expected. Add
a test where server tries to renegotiate and it succeeds. The second test
is supported by a new flag, -immediate_renegotiation, which is ignored on
the client.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15184)
Petr Gotthard [Sat, 15 May 2021 21:29:34 +0000 (23:29 +0200)]
Fix pointer passed to provider_unquery_operation
Walking through the `map` modifies the pointer passed to the `unquery`
operation.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15295)
Matt Caswell [Fri, 14 May 2021 13:00:22 +0000 (14:00 +0100)]
Add a CHANGES entry for fully pluggable groups
Fixes #12283
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15282)
Shane Lontis [Thu, 13 May 2021 03:02:38 +0000 (13:02 +1000)]
Add doc for ERR_clear_last_mark().
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15258)
Shane Lontis [Thu, 13 May 2021 08:03:42 +0000 (18:03 +1000)]
Fix OSSL_DECODER_new_for_pkey() selection parameter documentation
Fixes #14518
EVP_PKEY_fromdata() already defines this value so we link to this
documentation, 0 is also added as a possible input value.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15260)
Shane Lontis [Thu, 13 May 2021 08:49:52 +0000 (18:49 +1000)]
Fix compiler error when using config option 'enable-acvp-tests'
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15264)
Richard Levitte [Fri, 14 May 2021 10:26:21 +0000 (12:26 +0200)]
Adapt 80-test_cmp_http.t and its data for random accept ports
Fixes #14694
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/15281)
Richard Levitte [Fri, 14 May 2021 10:25:11 +0000 (12:25 +0200)]
APPS: Make the cmp Mock server output the accept address and port
Fixes #14694
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/15281)
Pauli [Sun, 16 May 2021 00:23:54 +0000 (10:23 +1000)]
ci: remove the checksum CI script
This script introduces a security vulnerability where the OpenSSL github
repository can be modified which opens a window for an attacker.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reported-by: Nikita Stupin
Benjamin Kaduk [Wed, 17 Mar 2021 05:03:36 +0000 (22:03 -0700)]
Add extensive test coverage for SSL_get_negotiated_group()
This is nearly comprehensive, but we cannot exercise the functionality
for PSK-only TLS 1.3 resumption, since openssl talking to openssl will
always negotiate psk_dhe_ke.
Exercise both the TLS 1.3 and 1.2 cases, for initial handshakes
and resumptions, and for ECDHE and FFDHE.
Since RFC 7919 named groups (for FFDHE) are only supported for TLS 1.3,
the TLS 1.2 versions of those scenarios expect to get NID_undef since
the key exchange was not performed using a named group.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14750)
Benjamin Kaduk [Wed, 17 Mar 2021 03:13:47 +0000 (20:13 -0700)]
move group lists out of test_key_exchange() in preparation for reuse
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14750)
Benjamin Kaduk [Tue, 16 Mar 2021 23:10:04 +0000 (16:10 -0700)]
Extend SSL_get_negotiated_group() tests for TLS 1.2
We don't implement RFC 7919 named groups for TLS 1.2, so we can
only test the ECDHE case for non-TLS-1.3.
Interestingly, though the test_key_exchange() routine claimed to
be exercising ffdhe2048 with TLS 1.2, the configured ciphers were
incompatible with DHE key exchange, so we ended up just using RSA
key transport and not doing an ephemeral key exchange at all.
Reconfigure the tests to actually exercise ephemeral key exchange
for both the EC and FF cases (even though we don't use the named
group information for the finite-field case).
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14750)
Benjamin Kaduk [Tue, 16 Mar 2021 20:42:00 +0000 (13:42 -0700)]
Regenerate testsid.pem
Convert this file to the new format, that includes the kex_group
integer value. This is needed in order for the round-trip conversion
test to return the same value as the initial input.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14750)
Benjamin Kaduk [Tue, 16 Mar 2021 14:47:09 +0000 (07:47 -0700)]
Promote SSL_get_negotiated_group() for non-TLSv1.3
It can be useful to know what group was used for the handshake's
key exchange process even on non-TLS 1.3 connections. Allow this
API, new in OpenSSL 3.0.0, to be used on other TLS versions as well.
Since pre-TLS-1.3 key exchange occurs only on full handshakes, this
necessitates adding a field to the SSL_SESSION object to carry the
group information across resumptions. The key exchange group in the
SSL_SESSION can also be relevant in TLS 1.3 when the resumption handshake
uses the "psk_ke" key-exchange mode, so also track whether a fresh key
exchange was done for TLS 1.3.
Since the new field is optional in the ASN.1 sense, there is no need
to increment SSL_SESSION_ASN1_VERSION (which incurs strong incompatibility
churn).
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14750)
Richard Levitte [Fri, 14 May 2021 05:23:51 +0000 (07:23 +0200)]
ASN1: Fix i2d_provided() return value
i2d_provided() - which is the internal provider data function for
i2d_KeyParams(), i2d_PrivateKey(), i2d_PublicKey() - didn't treat the
returned length from OSSL_ENCODER_to_data() quite as well as it should
have. A simple added flag that records the state of |*pp| before
calling OSSL_ENCODER_to_data() fixes the problem.
Fixes #14655
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/15277)
Matt Caswell [Thu, 13 May 2021 14:52:19 +0000 (15:52 +0100)]
Load the default provider into the p_test provider later
Loading it earlier causes some of the later testing to pass when it should
fail and masked a bug.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15270)
Matt Caswell [Thu, 13 May 2021 14:35:42 +0000 (15:35 +0100)]
Init the child providers immediately on creation of the child libctx
We were deferring the initial creation of the child providers until the
first fetch. This is a carry over from an earlier iteration of the child
lib ctx development and is no longer necessary. In fact we need to init
the child providers immediately otherwise not all providers quite init
correctly.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15270)
Tomas Mraz [Thu, 13 May 2021 17:41:09 +0000 (19:41 +0200)]
Add make update-fips-checksums to release.sh script
Fixes #15223
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15271)
Pauli [Thu, 13 May 2021 03:29:37 +0000 (13:29 +1000)]
doc: document all functions in provider-base(7)
Fixes #13358
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15259)
Matt Caswell [Thu, 13 May 2021 14:13:22 +0000 (15:13 +0100)]
Fix a memleak on an error path in the pkcs12 test helpers
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15269)
Dr. David von Oheimb [Tue, 11 May 2021 13:45:22 +0000 (15:45 +0200)]
Add OSSL_ prefix to HTTP_DEFAULT_MAX_{LINE_LENGTH,RESP_LEN}
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Tue, 4 May 2021 14:58:59 +0000 (16:58 +0200)]
http_client.c: Rename internal fields and functions for consistency
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Tue, 4 May 2021 14:33:19 +0000 (16:33 +0200)]
HTTP client: Allow streaming of response data (with possibly indefinite length)
Also clean up max_resp_len and add OSSL_HTTP_REQ_CTX_get_resp_len().
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Tue, 4 May 2021 09:15:36 +0000 (11:15 +0200)]
HTTP client: Allow streaming of request data (for POST method)
Also clean up OSSL_HTTP_REQ_CTX_nbio() states and make it more efficient.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Mon, 3 May 2021 14:33:10 +0000 (16:33 +0200)]
HTTP client API: Generalize to arbitrary request and response contents
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Sat, 1 May 2021 20:04:17 +0000 (22:04 +0200)]
OSSL_HTTP_transfer(): Fix error reporting in case rctx->server is NULL
Also improve doc of OSSL_parse_url() and OSSL_HTTP_parse_url().
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Sat, 1 May 2021 17:47:38 +0000 (19:47 +0200)]
OSSL_HTTP_get(): Do not close connection if redirect to same server
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Tue, 27 Apr 2021 22:26:14 +0000 (00:26 +0200)]
HTTP: Implement persistent connections (keep-alive)
Both at API and at CLI level (for the CMP app only, so far)
there is a new parameter/option: keep_alive.
* 0 means HTTP connections are not kept open after
receiving a response, which is the default behavior for HTTP 1.0.
* 1 means that persistent connections are requested.
* 2 means that persistent connections are required, i.e.,
in case the server does not grant them an error occurs.
For the CMP app the default value is 1, which means preferring to keep
the connection open. For all other internal uses of the HTTP client
(fetching an OCSP response, a cert, or a CRL) it does not matter
because these operations just take one round trip.
If the client application requested or required a persistent connection
and this was granted by the server, it can keep the OSSL_HTTP_REQ_CTX *
as long as it wants to send further requests and OSSL_HTTP_is_alive()
returns nonzero,
else it should call OSSL_HTTP_REQ_CTX_free() or OSSL_HTTP_close().
In case the client application keeps the OSSL_HTTP_REQ_CTX *
but the connection then dies for any reason at the server side, it will
notice this obtaining an I/O error when trying to send the next request.
This requires extending the HTTP header parsing and
rearranging the high-level HTTP client API. In particular:
* Split the monolithic OSSL_HTTP_transfer() into OSSL_HTTP_open(),
OSSL_HTTP_set_request(), a lean OSSL_HTTP_transfer(), and OSSL_HTTP_close().
* Split the timeout functionality accordingly and improve default behavior.
* Extract part of OSSL_HTTP_REQ_CTX_new() to OSSL_HTTP_REQ_CTX_set_expected().
* Extend struct ossl_http_req_ctx_st accordingly.
Use the new feature for the CMP client, which requires extending
related transaction management of CMP client and test server.
Update the documentation and extend the tests accordingly.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Sat, 1 May 2021 17:26:53 +0000 (19:26 +0200)]
OSSL_HTTP_REQ_CTX_add1_headers(): Fix use with host == NULL (relative URLs)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Mon, 10 May 2021 12:36:20 +0000 (14:36 +0200)]
CMP test server: Extend error reporting on cert rejected for revocation
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Mon, 10 May 2021 07:37:36 +0000 (09:37 +0200)]
HTTP test server: Improve connection management and logging
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Mon, 10 May 2021 07:32:53 +0000 (09:32 +0200)]
cmp_server.c: Improve transaction management and logging
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Mon, 10 May 2021 12:38:36 +0000 (14:38 +0200)]
OSSL_CMP_SRV_process_request(): Log any error queue entries on response
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Dr. David von Oheimb [Wed, 12 May 2021 06:37:54 +0000 (08:37 +0200)]
HTTP client: Rename 'maxline' parameter to 'buf_size' for clarity
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
Pauli [Wed, 12 May 2021 02:26:24 +0000 (12:26 +1000)]
mac: improve MAC documentation (Poly 1305 key reuse, nomenclature)
Fixes #12441
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15237)
Rich Salz [Tue, 11 May 2021 17:09:24 +0000 (13:09 -0400)]
Slightly reformat ssl.h.in
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15230)
Rich Salz [Tue, 11 May 2021 14:51:13 +0000 (10:51 -0400)]
Convert SSL_{CTX}_[gs]et_options to 64
Less tersely: converted SSL_get_options, SSL_set_options,
SSL_CTX_get_options and SSL_CTX_get_options to take and return uint64_t
since we were running out of 32 bits.
Fixes: 15145
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15230)
Juergen Christ [Wed, 12 May 2021 11:54:20 +0000 (13:54 +0200)]
Fix provider library build wrt. AES
Commit
c7978e506b2d1300accd9e696656f9cc94196e6d ("Fix missing $CPUIDDEF in
libdefault.a") revealed another problem in the build system on s390. The
build of the provider libraries includes the AES system without the proper
defines. This causes a build error on s390 now since the CPUIDDEF is present
but the prototypes for various AES functions implemented in assembler are
missing due to missing preprocessor defines. Fix this by adding the missing
defines to all provider libraries.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15244)
Rich Salz [Wed, 12 May 2021 14:42:46 +0000 (10:42 -0400)]
Add --banner config option
Use it in the automated workflows.
Fixes: #15247
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15248)
bonniegong [Mon, 12 Apr 2021 02:43:13 +0000 (10:43 +0800)]
check i2d_ASN1_TYPE return value
add a length check to the return value of function i2d_ASN1_TYPE. Return an error instead of trying to malloc a negative number.
CLA: trivial
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14828)
Dr. David von Oheimb [Wed, 12 May 2021 16:19:07 +0000 (18:19 +0200)]
http_client.c: Fix inconsistency w.r.t. type of max_resp_len
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15251)
Tomas Mraz [Wed, 12 May 2021 17:15:27 +0000 (19:15 +0200)]
Replace some of the ERR_clear_error() calls with mark calls
Fixes #15219
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15253)
Xiaofei Bai [Tue, 11 May 2021 09:37:22 +0000 (09:37 +0000)]
crypto/arm_arch.h: add a variable declaration
Add this variable declaration to prevent
"-Werror,-Wmissing-variable-declarations" error from compiler.
This error currently only happens on clang.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15240)
Ben Avison [Wed, 10 Mar 2021 15:54:44 +0000 (15:54 +0000)]
ARM assembly pack: translate bit-sliced AES implementation to AArch64
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14592)
Pauli [Wed, 12 May 2021 05:19:54 +0000 (15:19 +1000)]
doc: remove references to undepreciated commands being deprecated.
The dsa, ec, ecparam, and rsa manual pages refer to themselves are being
deprecated which they aren't. Address this and add a note pointing to
the pkey command equivalents albeit without recommending it.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15239)
Tomas Mraz [Tue, 27 Apr 2021 16:12:15 +0000 (18:12 +0200)]
Fallback to legacy pem decoding if OSSL_DECODER fails
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15045)
Tomas Mraz [Tue, 27 Apr 2021 14:01:13 +0000 (16:01 +0200)]
Implement pem_read_key directly through OSSL_DECODER
Using OSSL_STORE is too heavy and breaks things.
There were also needed various fixes mainly for missing proper
handling of the SM2 keys in the OSSL_DECODER.
Fixes #14788
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15045)
Tomas Mraz [Fri, 7 May 2021 15:44:26 +0000 (17:44 +0200)]
Replace EVP_PKEY_supports_digest_nid
The EVP_PKEY_supports_digest_nid() is renamed to
EVP_PKEY_digestsign_supports_digest() and implemented
via EVP_DigestSignInit_ex().
Fixes #14343
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15198)
Tomas Mraz [Fri, 7 May 2021 14:56:34 +0000 (16:56 +0200)]
Drop ASN1_PKEY_CTRL_SUPPORTS_MD_NID
This is a legacy ASN1_PKEY_CTRL that was added after
1.1.1 and is not needed.
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15198)
Tomas Mraz [Thu, 13 May 2021 10:51:14 +0000 (12:51 +0200)]
update-fips-checksums: Make the dependency on source list work
Also clean the generated checksums with make clean
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15267)
Dmitry Belyavskiy [Fri, 7 May 2021 15:36:42 +0000 (17:36 +0200)]
clarification about the DES status
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15197)
Dmitry Belyavskiy [Fri, 7 May 2021 15:16:29 +0000 (17:16 +0200)]
Enumerating the legacy provider's cipher algorithms
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15197)
Tomas Mraz [Thu, 13 May 2021 10:05:36 +0000 (12:05 +0200)]
Ensure the pristine checksums are not recomputed
When switching between the pristine and PR checkouts we must
ensure the pristine checksums are not recomputed.
Also ignore errors (such as trying to remove a label that
is not set) when setting or removing labels.
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15266)
Tomas Mraz [Thu, 13 May 2021 09:34:53 +0000 (11:34 +0200)]
The FIPS Checksums job must be run on pull_request_target
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15265)
Dr. David von Oheimb [Fri, 16 Apr 2021 15:52:22 +0000 (17:52 +0200)]
Makefile: Make sure providers/fipsmodule.cnf is re-built also for run_tests
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14901)
Dr. David von Oheimb [Fri, 16 Apr 2021 15:51:55 +0000 (17:51 +0200)]
Makefile: Simplify use of run_tests
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14901)
Tomas Mraz [Thu, 13 May 2021 08:50:14 +0000 (10:50 +0200)]
Remove the .new suffix inside the fips.checksum.new
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15263)
Tomas Mraz [Wed, 12 May 2021 14:14:01 +0000 (16:14 +0200)]
Allow diff-fips-checksums in in-tree build
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15229)
Tomas Mraz [Wed, 12 May 2021 07:04:59 +0000 (09:04 +0200)]
Remove the severity: fips change label if fips checksum unchanged
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15229)
Tomas Mraz [Tue, 11 May 2021 16:15:32 +0000 (18:15 +0200)]
Set the severity: fips change label if fips checksum changed
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15229)
Tomas Mraz [Tue, 11 May 2021 15:50:13 +0000 (17:50 +0200)]
fipsprov: Missing teardown on fips_get_params_from_core() error
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15229)
Tomas Mraz [Tue, 11 May 2021 15:06:57 +0000 (17:06 +0200)]
Add checksums github CI action
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15229)