openssl.git
2 months agoGenerate error queue entry on FFC_CHECK_BAD_LN_PAIR for DH and DSA
Dr. David von Oheimb [Fri, 5 Jun 2020 19:27:34 +0000 (21:27 +0200)]
Generate error queue entry on FFC_CHECK_BAD_LN_PAIR for DH and DSA

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12062)

2 months agoSilence gcc false positive warning on refdatalen in test/tls13encryptiontest.c
Dr. David von Oheimb [Fri, 5 Jun 2020 14:42:39 +0000 (16:42 +0200)]
Silence gcc false positive warning on refdatalen in test/tls13encryptiontest.c

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12042)

2 months agoSilence gcc false positive warning on alpn_protos_len in test/handshake_helper.c
Dr. David von Oheimb [Thu, 4 Jun 2020 10:37:50 +0000 (12:37 +0200)]
Silence gcc false positive warning on alpn_protos_len in test/handshake_helper.c

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12042)

2 months agoUpdate RSA keygen to use sp800-56b by default
Shane Lontis [Tue, 9 Jun 2020 22:59:56 +0000 (08:59 +1000)]
Update RSA keygen to use sp800-56b by default

Fixes #11742
Fixes #11764

The newer RSA sp800-56b algorithm is being used for the normal case of a non multiprime key of at least length 2048.
Insecure key lengths and mutltiprime RSA will use the old method.

Bad public exponents are no longer allowed (i.e values less than 65537 or even). Values such as 2 that would cause a infinite loop now result in an error. The value of 3 has been marked as deprecated but is still allowed for legacy purposes.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11765)

2 months agoAdd a test for renegotiation with EXTMS dropped
Tomas Mraz [Fri, 5 Jun 2020 08:50:25 +0000 (10:50 +0200)]
Add a test for renegotiation with EXTMS dropped

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12045)

2 months agoDo not allow dropping Extended Master Secret extension on renegotiaton
Tomas Mraz [Thu, 4 Jun 2020 09:40:29 +0000 (11:40 +0200)]
Do not allow dropping Extended Master Secret extension on renegotiaton

Abort renegotiation if server receives client hello with Extended Master
Secret extension dropped in comparison to the initial session.

Fixes #9754

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12045)

2 months agouse safe primes in ssl_get_auto_dh()
Hubert Kario [Fri, 5 Jun 2020 18:21:55 +0000 (20:21 +0200)]
use safe primes in ssl_get_auto_dh()

DH_get_1024_160() and DH_get_2048_224() return parameters from
RFC5114. Those parameters include primes with known small subgroups,
making them unsafe. Change the code to use parameters from
RFC 2409 and RFC 3526 instead (group 2 and 14 respectively).

This patch also adds automatic selection of 4096 bit params for 4096 bit
RSA keys

Signed-off-by: Hubert Kario <hkario@redhat.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12061)

2 months agoAPPS: Fix 'openssl dhparam'
Richard Levitte [Fri, 5 Jun 2020 21:40:49 +0000 (23:40 +0200)]
APPS: Fix 'openssl dhparam'

'dhparam' can't be completely rewritten in terms of EVP_PKEY functions
yet, because we lack X9.42 support.  However, we do when generating,
but forgot to extract a DH pointer with EVP_PKEY_get0_DH().

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/12048)

2 months agoAPPS: Fix 'openssl dsaparam -genkey'
Richard Levitte [Thu, 4 Jun 2020 20:34:09 +0000 (22:34 +0200)]
APPS: Fix 'openssl dsaparam -genkey'

Using a parameter EVP_PKEY for key generation with EVP_PKEY routines
works a little differently than the raw DSA routines that were used
before.

While fixing that, clean away all remaining use of the DSA type, which
simplifies the code a bit more.

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/12048)

2 months agoEVP: Let EVP_PKEY_gen() initialize ctx->keygen_info
Richard Levitte [Thu, 4 Jun 2020 18:05:26 +0000 (20:05 +0200)]
EVP: Let EVP_PKEY_gen() initialize ctx->keygen_info

In EVP_PKEY_METHOD code, the backend initializes ctx->keygen_info.
With provider side code, it's not possible to reach back into the
EVP_PKEY_CTX in the same manner, so we need to make that
initialization in the central generation function, EVP_PKEY_gen().

This isn't quite compatible with the idea that keygen_info could have
an arbitrary amount of elements, but since all our legacy backends use
exactly two elements, that's what we go for.

Fixes #12047

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/12048)

2 months agoTLSv1.3: additional checks in SSL_set_record_padding_callback
Vadim Fedorenko [Mon, 4 May 2020 10:46:04 +0000 (13:46 +0300)]
TLSv1.3: additional checks in SSL_set_record_padding_callback

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11589)

2 months agotest: TLS1.3 and new ciphers for kTLS
Vadim Fedorenko [Sat, 25 Jan 2020 18:49:41 +0000 (21:49 +0300)]
test: TLS1.3 and new ciphers for kTLS

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11589)

2 months agoTLSv13: add kTLS support
Vadim Fedorenko [Sat, 25 Jan 2020 18:49:08 +0000 (21:49 +0300)]
TLSv13: add kTLS support

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11589)

2 months agokTLS: add support for AES_CCM128 and AES_GCM256
Vadim Fedorenko [Fri, 24 Jan 2020 13:57:56 +0000 (16:57 +0300)]
kTLS: add support for AES_CCM128 and AES_GCM256

The support of new algos is added by converting code to use
helper functions found in ktls.h.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11589)

2 months agokTLS: add Linux-specific kTLS helpers
Vadim Fedorenko [Fri, 1 May 2020 20:56:48 +0000 (23:56 +0300)]
kTLS: add Linux-specific kTLS helpers

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11589)

2 months agokTLS: add new algo definitions
Vadim Fedorenko [Fri, 24 Jan 2020 13:08:02 +0000 (16:08 +0300)]
kTLS: add new algo definitions

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11589)

2 months agokTLS: make ktls_start type independed
Vadim Fedorenko [Fri, 24 Jan 2020 13:11:02 +0000 (16:11 +0300)]
kTLS: make ktls_start type independed

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11589)

2 months agofix doc typo in bn_dh.c
Hubert Kario [Sat, 6 Jun 2020 20:23:17 +0000 (22:23 +0200)]
fix doc typo in bn_dh.c

while RFC 2312 refers to S/MIME it doesn't actually declare any groups,
RFC 2412 actually talks about DH extensively and the group
defined in the code below is defined on page 47 of it

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/12076)

2 months agoFix 90-test_store.t for latest config, limits, providers, and disabled algos
Dr. David von Oheimb [Tue, 5 May 2020 12:04:30 +0000 (14:04 +0200)]
Fix 90-test_store.t for latest config, limits, providers, and disabled algos

Also make sure that the test do not 'pass' if their initialization fails.
Leave out the expensive parts of DSA key gen and RSA keygen for efficiency.
Fix use of the new CA configuration file test/ca-and-certs.cnf.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11733)

2 months agoFix documentation of OSSL_STORE
Dr. David von Oheimb [Wed, 6 May 2020 11:08:45 +0000 (13:08 +0200)]
Fix documentation of OSSL_STORE

Among others, make clear that OSSL_STORE_close() meanwhile does nothing on NULL.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11733)

2 months agoFix mem leaks and allow missing pkey and/or cert in try_decode_PKCS12()
Dr. David von Oheimb [Tue, 5 May 2020 09:31:05 +0000 (11:31 +0200)]
Fix mem leaks and allow missing pkey and/or cert in try_decode_PKCS12()

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11733)

2 months agoAdd chain to PKCS#12 test file generation in 90-test_store.t
Dr. David von Oheimb [Tue, 5 May 2020 12:18:46 +0000 (14:18 +0200)]
Add chain to PKCS#12 test file generation in 90-test_store.t

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11733)

2 months agoFix code layout in crypto/store/loader_file.c satisfying check-format.pl -l
Dr. David von Oheimb [Tue, 5 May 2020 09:24:49 +0000 (11:24 +0200)]
Fix code layout in crypto/store/loader_file.c satisfying check-format.pl -l

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11733)

2 months agoTEST: Adjust test/bioprinttest.c to behave like the testutil routines
Richard Levitte [Fri, 5 Jun 2020 15:05:07 +0000 (17:05 +0200)]
TEST: Adjust test/bioprinttest.c to behave like the testutil routines

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12057)

2 months agoTESTUTIL: Adjust the rest of testutil
Richard Levitte [Fri, 5 Jun 2020 15:04:33 +0000 (17:04 +0200)]
TESTUTIL: Adjust the rest of testutil

Fixes #12054

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12057)

2 months agoTESTUTIL: Separate TAP output and other output by BIO filter
Richard Levitte [Fri, 5 Jun 2020 14:55:42 +0000 (16:55 +0200)]
TESTUTIL: Separate TAP output and other output by BIO filter

Output that's supposed to be understood by a TAP parser gets its own
BIOs (|tap_out| and |tap_err|), and is only used internally within
testutils.  |bio_out| and |bio_err| is now only used for output that
shouldn't be parsed by the TAP parser, and all output written to those
BIOs are therefore always made to look like comments (it gets prefixed
with "# ").

Indentation and prefixing with "# " is reworked to use BIO_f_prefix(),
which allows us to throw away the internal BIO_f_tap().

The indentation level is now adjusted via a special function.

Fixes #12054

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12057)

2 months agoConsolidate doc of BIO_do_connect() and its alias BIO_do_handshake()
Dr. David von Oheimb [Tue, 2 Jun 2020 11:02:42 +0000 (13:02 +0200)]
Consolidate doc of BIO_do_connect() and its alias BIO_do_handshake()

Also documents that they meanwhile try all IP addresses resolved for a given domain name

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12017)

2 months agoAPPS: Remove unnecessary NULL check of uri in load_cert_pass()
Richard Levitte [Fri, 22 May 2020 17:09:45 +0000 (19:09 +0200)]
APPS: Remove unnecessary NULL check of uri in load_cert_pass()

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11873)

2 months agoAPPS: Make it possible to load_cert() from stdin again
Richard Levitte [Tue, 19 May 2020 13:56:18 +0000 (15:56 +0200)]
APPS: Make it possible to load_cert() from stdin again

Fixes #11871

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11873)

2 months agoFix a typo in SSL_CTX_set_session_ticket_cb.pod
Benjamin Kaduk [Thu, 28 May 2020 21:34:10 +0000 (14:34 -0700)]
Fix a typo in SSL_CTX_set_session_ticket_cb.pod

"SSL" takes two esses, not three.

[skip ci]

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12038)

2 months agoDon't downgrade keys in libssl
Matt Caswell [Tue, 2 Jun 2020 07:57:26 +0000 (08:57 +0100)]
Don't downgrade keys in libssl

We were downgrading to legacy keys at various points in libssl in
order to get or set an encoded point. Now that the encoded point
functions work with provided keys this is no longer necessary.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11898)

2 months agoWhen asked if an ECX key has parameters we should answer "true"
Matt Caswell [Thu, 21 May 2020 10:36:21 +0000 (11:36 +0100)]
When asked if an ECX key has parameters we should answer "true"

An ECX key doesn't have any parameters associated with it. Therefore it
always has all the parameters it needs, and the "has" function should
return 1 if asked about parameters. Without this
EVP_PKEY_missing_parameters() fails for ECX keys.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11898)

2 months agoAlways create a key when importing
Matt Caswell [Thu, 21 May 2020 10:33:53 +0000 (11:33 +0100)]
Always create a key when importing

Even if there is no data to import we should still create an empty key.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11898)

2 months agoMake EVP_PKEY_[get1|set1]_tls_encodedpoint work with provided keys
Matt Caswell [Wed, 20 May 2020 15:20:27 +0000 (16:20 +0100)]
Make EVP_PKEY_[get1|set1]_tls_encodedpoint work with provided keys

EVP_PKEY_[get1|set1]_tls_encodedpoint() only worked if an ameth was present
which isn't the case for provided keys. Support has been added to dh,
ec and ecx keys.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11898)

2 months agoFix error path in int create_ssl_ctx_pair()
Matt Caswell [Wed, 13 May 2020 13:45:36 +0000 (14:45 +0100)]
Fix error path in int create_ssl_ctx_pair()

If we hit the error path and create_ssl_ctx_pair has been passed a
pre-created SSL_CTX then we could end up with a double free.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11834)

2 months agoImplement a test for sigalgs not being present
Matt Caswell [Fri, 8 May 2020 15:43:14 +0000 (16:43 +0100)]
Implement a test for sigalgs not being present

If sigalgs are not present we should not offer or accept them. We should
test that we handle this correctly.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11834)

2 months agoImplement a Filtering Provider
Matt Caswell [Mon, 4 May 2020 15:26:07 +0000 (16:26 +0100)]
Implement a Filtering Provider

The filtering provider can be used to place a filter in front of the
default provider. Initially to filter out certain algorithms from being
available for test purposes.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11834)

2 months agoImplement OSSL_PROVIDER_get0_provider_ctx()
Matt Caswell [Fri, 8 May 2020 15:44:02 +0000 (16:44 +0100)]
Implement OSSL_PROVIDER_get0_provider_ctx()

Implement a function which enables us to get hold of the provider ctx
for a loaded provider.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11834)

2 months agoEnable applications to directly call a provider's query operation
Matt Caswell [Mon, 4 May 2020 14:28:15 +0000 (15:28 +0100)]
Enable applications to directly call a provider's query operation

This is useful to get hold of the low-level dispatch tables. This could
be used to create a new provider based on an existing one.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11834)

2 months agoCheck that Signature Algorithms are available before using them
Matt Caswell [Fri, 1 May 2020 16:41:25 +0000 (17:41 +0100)]
Check that Signature Algorithms are available before using them

We should confirm that Signature Algorithms are actually available
through the loaded providers before we offer or select them.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11834)

2 months agoAPPS: Drop interactive mode in the 'openssl' program
Richard Levitte [Wed, 3 Jun 2020 08:49:50 +0000 (10:49 +0200)]
APPS: Drop interactive mode in the 'openssl' program

This mode is severely untested and unmaintained, is seems not to be
used very much.

Closes #4679
Closes #6292

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12023)

2 months agoAnnounce renamed EVP_PKEY_cmp() and EVP_PKEY_cmp_parameters() in CHANGES.md
Dr. David von Oheimb [Wed, 3 Jun 2020 12:13:01 +0000 (14:13 +0200)]
Announce renamed EVP_PKEY_cmp() and EVP_PKEY_cmp_parameters() in CHANGES.md

This is a follow-up of PR #12013.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/12026)

2 months agofips: add additional algorithms to the FIPS provider.
Pauli [Wed, 3 Jun 2020 00:55:49 +0000 (10:55 +1000)]
fips: add additional algorithms to the FIPS provider.

Discussions are ongoing but the OMC has approved the in-principle addition
of these algorithms to the upcoming FIPS validation.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12020)

2 months agoMinor doc fix for EVP_PKEY_CTX_new_from_pkey
Jaimee Brown [Wed, 3 Jun 2020 04:28:06 +0000 (14:28 +1000)]
Minor doc fix for EVP_PKEY_CTX_new_from_pkey

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12021)

2 months agoAdd github sponsor button
Kurt Roeckx [Wed, 3 Jun 2020 20:01:31 +0000 (22:01 +0200)]
Add github sponsor button

Reviewed-by: Richard Levitte <levitte@openssl.org>
GH: #12035

2 months ago[crypto/ec] Remove unreachable AVX2 code in NISTZ256 implementation
Nicola Tuveri [Tue, 2 Jun 2020 18:06:48 +0000 (21:06 +0300)]
[crypto/ec] Remove unreachable AVX2 code in NISTZ256 implementation

`crypto/ec/ecp_nistz256.c` contained code sections guarded by a
`ECP_NISTZ256_AVX2` define.

The relevant comment read:

> /*
>  * Note that by default ECP_NISTZ256_AVX2 is undefined. While it's great
>  * code processing 4 points in parallel, corresponding serial operation
>  * is several times slower, because it uses 29x29=58-bit multiplication
>  * as opposite to 64x64=128-bit in integer-only scalar case. As result
>  * it doesn't provide *significant* performance improvement. Note that
>  * just defining ECP_NISTZ256_AVX2 is not sufficient to make it work,
>  * you'd need to compile even asm/ecp_nistz256-avx.pl module.
>  */

Without diminishing the quality of the original submission, it's evident
that this code has been basically unreachable without modifications to
the library source code and is under-tested.

This commit removes these sections from the codebase.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/12019)

2 months agoAdd cipher list ciphersuites which using encryption algorithm in mode CBC.
Otto Hollmann [Thu, 28 May 2020 11:39:33 +0000 (13:39 +0200)]
Add cipher list ciphersuites which using encryption algorithm in mode CBC.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11984)

2 months agoCORE: make sure activated fallback providers stay activated
Richard Levitte [Sat, 23 May 2020 14:39:18 +0000 (16:39 +0200)]
CORE: make sure activated fallback providers stay activated

Calling 'OSSL_PROVIDER_available(NULL, "default")' would search for
the "default" provider, and in doing so, activate it if necessary,
thereby detecting that it's available...  and then immediately free
it, which could deactivate that provider, even though it should stay
available.

We solve this by incrementing the refcount for activated fallbacks one
extra time, thereby simulating an explicit OSSL_PROVIDER_load(), and
compensate for it with an extra ossl_provider_free() when emptying the
provider store.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11926)

2 months agoTEST: Add provider_fallback_test, to test aspects of fallback providers
Richard Levitte [Sat, 23 May 2020 14:34:07 +0000 (16:34 +0200)]
TEST: Add provider_fallback_test, to test aspects of fallback providers

There are cases where the fallback providers aren't treated right.
For example, the following calls, in that order, will end up with
a failed EVP_KEYMGMT_fetch(), even thought the default provider
does supply an implementation of the "RSA" keytype.

    EVP_KEYMGMT *rsameth = NULL;

    OSSL_PROVIDER_available(NULL, "default");
    rsameth = EVP_KEYMGMT_fetch(NULL, "RSA", NULL);

For good measure, this also tests that explicit loading of the default
provider won't fail.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11926)

2 months agoFix missed fields in EVP_PKEY_meth_copy.
Aaron Thompson [Sat, 11 Apr 2020 00:56:15 +0000 (00:56 +0000)]
Fix missed fields in EVP_PKEY_meth_copy.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11514)

2 months agoPrepare for 3.0 alpha 4
Matt Caswell [Thu, 4 Jun 2020 13:58:20 +0000 (14:58 +0100)]
Prepare for 3.0 alpha 4

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
2 months agoPrepare for release of 3.0 alpha 3 openssl-3.0.0-alpha3
Matt Caswell [Thu, 4 Jun 2020 13:56:40 +0000 (14:56 +0100)]
Prepare for release of 3.0 alpha 3

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
2 months agoUpdate copyright year
Matt Caswell [Thu, 4 Jun 2020 13:33:57 +0000 (14:33 +0100)]
Update copyright year

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12043)

2 months agoossl_shim: const cast the param arguments to avoid errors
Pauli [Wed, 3 Jun 2020 08:42:36 +0000 (18:42 +1000)]
ossl_shim: const cast the param arguments to avoid errors

[extended tests]

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12022)

2 months agoFix a buffer overflow in drbg_ctr_generate
Bernd Edlinger [Tue, 2 Jun 2020 09:52:24 +0000 (11:52 +0200)]
Fix a buffer overflow in drbg_ctr_generate

This can happen if the 32-bit counter overflows
and the last block is not a multiple of 16 bytes.

Fixes #12012

[extended tests]

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/12016)

2 months agoUpdate manpage to fix examples, other minor tweaks
Rich Salz [Mon, 27 Apr 2020 16:57:01 +0000 (12:57 -0400)]
Update manpage to fix examples, other minor tweaks

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11347)

2 months agoCleanup cert config files for tests
Rich Salz [Wed, 4 Mar 2020 19:08:31 +0000 (14:08 -0500)]
Cleanup cert config files for tests

Merge test/P[12]ss.cnf into one config file
Merge CAss.cnf and Uss.cnf into ca-and-certs.cnf
Remove Netscape cert extensions, add keyUsage comment from some cnf files

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11347)

2 months agoossl_shim: include core_names.h to resolve undeclared symbols
Pauli [Tue, 2 Jun 2020 13:10:06 +0000 (23:10 +1000)]
ossl_shim: include core_names.h to resolve undeclared symbols

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/12018)

2 months agoTEST: Test i2d_PKCS8PrivateKey_bio() and PEM_write_bio_PKCS8PrivateKey()
Richard Levitte [Mon, 18 May 2020 06:35:29 +0000 (08:35 +0200)]
TEST: Test i2d_PKCS8PrivateKey_bio() and PEM_write_bio_PKCS8PrivateKey()

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11855)

2 months agoPEM: Make PKCS8 serializers aware of OSSL_SERIALIZERs
Richard Levitte [Mon, 18 May 2020 06:32:28 +0000 (08:32 +0200)]
PEM: Make PKCS8 serializers aware of OSSL_SERIALIZERs

PEM_write_bio_PKCS8PrivateKey(), i2d_PKCS8PrivateKey_bio(),
PEM_write_PKCS8PrivateKey(), and i2d_PKCS8PrivateKey_fp() are affected
by this.

Fixes #11845

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11855)

2 months agofix a docs typo
Jack O'Connor [Thu, 28 May 2020 16:42:15 +0000 (12:42 -0400)]
fix a docs typo

Correct "EC_KEY_point2buf" to "EC_POINT_point2buf". The former does not exist.

CLA: trivial

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11988)

2 months agoPrevent extended tests run unexpectedly in appveyor
Bernd Edlinger [Thu, 28 May 2020 09:20:50 +0000 (11:20 +0200)]
Prevent extended tests run unexpectedly in appveyor

Reason turns out that "git log -2" is picking up a merge
commit and a random commit message from the master branch.

Restore the expected behavior by using
git log -1 $env:APPVEYOR_PULL_REQUEST_HEAD_COMMIT

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11981)

2 months agoMove EC_METHOD to internal-only
Billy Brumley [Wed, 27 May 2020 10:30:04 +0000 (13:30 +0300)]
Move EC_METHOD to internal-only

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11928)

2 months agoAPPS: Remove make_config_name, use CONF_get1_default_config_file instead
Richard Levitte [Thu, 28 May 2020 11:53:48 +0000 (13:53 +0200)]
APPS: Remove make_config_name, use CONF_get1_default_config_file instead

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11983)

2 months agoRemove getenv(OPENSSL_FIPS) in openssl command
Bernd Edlinger [Sat, 30 May 2020 07:57:29 +0000 (09:57 +0200)]
Remove getenv(OPENSSL_FIPS) in openssl command

This is left over from the past.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11995)

2 months agoRevert the check for NaN in %f format
Bernd Edlinger [Sun, 31 May 2020 05:51:23 +0000 (07:51 +0200)]
Revert the check for NaN in %f format

Unfortunately -Ofast seems to break that check.

Fixes #11994

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12003)

2 months agoundeprecate SSL_CTX_load_verify_locations and X509_STORE_load_locations
Tim Hudson [Mon, 1 Jun 2020 09:52:23 +0000 (19:52 +1000)]
undeprecate SSL_CTX_load_verify_locations and X509_STORE_load_locations

The underlying functions remain and these are widely used.
This undoes the deprecation part of PR8442

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12001)

2 months agoMake BIO_do_connect() and friends handle multiple IP addresses
Dr. David von Oheimb [Wed, 27 May 2020 10:16:53 +0000 (12:16 +0200)]
Make BIO_do_connect() and friends handle multiple IP addresses

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11971)

2 months agoadd FFDH to speed command
Hubert Kario [Sat, 18 Jan 2020 18:13:02 +0000 (19:13 +0100)]
add FFDH to speed command

the openssl speed command could not benchmark FFDH speed, but it could
benchmark ECDH, making comparisons between the two hard

this commit adds this feature

fixes #9475

Signed-off-by: Hubert Kario <hubert@kario.pl>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10887)

2 months agobio printf: Avoid using rounding errors in range check
Bernd Edlinger [Mon, 25 May 2020 18:13:47 +0000 (20:13 +0200)]
bio printf: Avoid using rounding errors in range check

There is a problem casting ULONG_MAX to double which clang-10 is warning about.
ULONG_MAX typically cannot be exactly represented as a double.  ULONG_MAX + 1
can be and this fix uses the latter, however since ULONG_MAX cannot be
represented exactly as a double number we subtract 65535 from this number,
and the result has at most 48 leading one bits, and can therefore be
represented as a double integer without rounding error.  By adding
65536.0 to this number we achive the correct result, which should avoid the
warning.

The addresses a symptom of the underlying problem: we print doubles via an
unsigned long integer.  Doubles have a far greater range and should be printed
better.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11955)

2 months agoDOCS: add openssl-core_names.h(7)
Richard Levitte [Tue, 26 May 2020 12:26:30 +0000 (14:26 +0200)]
DOCS: add openssl-core_names.h(7)

A CAVEATS section is present in this manual.  That section name is
borrowed from OpenBSD, where mdoc(7) explains it like this:

    CAVEATS
    Common misuses and misunderstandings should be explained in this
    section.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11963)

2 months agoDOCS: add openssl-core_numbers.h(7)
Richard Levitte [Tue, 26 May 2020 12:25:44 +0000 (14:25 +0200)]
DOCS: add openssl-core_numbers.h(7)

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11963)

2 months agoEVP_EncryptInit.pod: fix example
Patrick Steuer [Wed, 27 May 2020 14:32:43 +0000 (16:32 +0200)]
EVP_EncryptInit.pod: fix example

Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11976)

2 months agoRSA: Do not set NULL OAEP labels
Benjamin Kaduk [Fri, 22 May 2020 18:13:24 +0000 (11:13 -0700)]
RSA: Do not set NULL OAEP labels

As of the previous commit, when a zero-length (string) parameter
is present in the parameters passed to a provider for a given operation,
we will produce an object corresponding to that zero-length parameter,
indicating to the underlying cryptographic operation that the parameter
was passed.  However, rsa_cms_decrypt() was relying on the previous
behavior, and unconditionally tried to call
EVP_PKEY_CTX_set0_rsa_oaep_label() even when the implicit default label
was used (and thus the relevant local variable was still NULL).
In the new setup that distinguishes present-but-empty and absent
more clearly, it is an error to attempt to set a NULL parameter,
even if it is zero-length.

Exercise more caution when setting parameters, and do not call
EVP_PKEY_CTX_set0_rsa_oaep_label() when there is not actually a
label provided.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11920)

2 months agoparams: do not ignore zero-length strings
Benjamin Kaduk [Thu, 21 May 2020 21:10:50 +0000 (14:10 -0700)]
params: do not ignore zero-length strings

Prior to this commit, if a string (or octet string) parameter
was present but indicated it was zero-length, we would return success
but with a NULL output value.  This can be problematic in cases where
there is a protocol-level distinction between parameter-absent and
parameter-present-but-zero-length, which is uncommon but can happen.

Since OPENSSL_malloc() returns NULL for zero-length allocation requests,
make a dummy allocation for this case, to give a signal that the string
parameter does exist but has zero length.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11920)

2 months agotest HKDF with empty IKM
Benjamin Kaduk [Thu, 21 May 2020 19:53:59 +0000 (12:53 -0700)]
test HKDF with empty IKM

Add an extra EVP test that provides empty input key material.  It
currently fails, since we lose the information about "key present but
zero length" as we deserialize parameters in the provider.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11920)

2 months agoAdd a test for fetching EVP_PKEY style algs without a provider
Matt Caswell [Thu, 14 May 2020 10:33:01 +0000 (11:33 +0100)]
Add a test for fetching EVP_PKEY style algs without a provider

Following on from the previous commit, add a test to check that we fail
to create an EVP_PKEY_CTX if an algorithm is not available in any provider,
*unless* it is an algorithm that has no provider support.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11826)

2 months agoFail if we fail to fetch the EVP_KEYMGMT
Matt Caswell [Wed, 13 May 2020 16:17:35 +0000 (17:17 +0100)]
Fail if we fail to fetch the EVP_KEYMGMT

If we failed to fetch an EVP_KEYMGMT then we were falling back to legacy.
This is because some algorithms (such as MACs and KDFs used via an old
style EVP_PKEY) have not been transferred to providers.

Unfortunately this means that you cannot stop some algorithms from being
used by not loading the provider.

For example if you wanted to prevent RSA from being used, you might expect
to just not load any providers that make it available. Unfortunately that
doesn't work because we simply fall back to legacy if we fail to fetch
the EVP_KEYMGMT.

Instead we should fail *unless* the key type is one of those legacy key
types that we have not transferred.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11826)

2 months agoUpdate gost-engine commit to match the API changes
Dmitry Belyavskiy [Wed, 27 May 2020 10:03:04 +0000 (13:03 +0300)]
Update gost-engine commit to match the API changes

[extended tests]

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11970)

2 months agoutil/mkpod2html.pl: Fix unbalanced quotes
Richard Levitte [Wed, 27 May 2020 08:09:04 +0000 (10:09 +0200)]
util/mkpod2html.pl: Fix unbalanced quotes

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11969)

2 months agoFix errtest for older compilers
Shane Lontis [Wed, 27 May 2020 02:10:52 +0000 (12:10 +1000)]
Fix errtest for older compilers

Some older compilers use "unknown function" if they dont support __func, so the
test using ERR_PUT_error needed to compensate for this when comparing against the
expected value.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11967)

2 months agoossl_shim: use the correct ticket key call back.
Pauli [Tue, 26 May 2020 21:26:46 +0000 (07:26 +1000)]
ossl_shim: use the correct ticket key call back.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11966)

2 months agofips: add AES OFB mode ciphers to FIPS provider.
Pauli [Sat, 23 May 2020 00:20:46 +0000 (10:20 +1000)]
fips: add AES OFB mode ciphers to FIPS provider.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11908)

2 months agofips: add AES CFB mode ciphers to FIPS provider.
Pauli [Fri, 22 May 2020 09:30:52 +0000 (19:30 +1000)]
fips: add AES CFB mode ciphers to FIPS provider.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11908)

2 months agoAvoid undefined behavior with unaligned accesses
Bernd Edlinger [Tue, 24 Apr 2018 19:10:13 +0000 (21:10 +0200)]
Avoid undefined behavior with unaligned accesses

Fixes: #4983

[extended tests]

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/6074)

2 months agoRename EVP_PKEY_cmp() to EVP_PKEY_eq() and EVP_PKEY_cmp_parameters() to EVP_PKEY_para...
Dr. David von Oheimb [Mon, 25 May 2020 11:17:51 +0000 (13:17 +0200)]
Rename EVP_PKEY_cmp() to EVP_PKEY_eq() and EVP_PKEY_cmp_parameters() to EVP_PKEY_parameters_eq()

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11953)

2 months agocrypto/cms: add CAdES-BES signed attributes validation
FdaSilvaYY [Wed, 12 Jun 2019 17:52:39 +0000 (19:52 +0200)]
crypto/cms: add CAdES-BES signed attributes validation

for signing certificate V2 and signing certificate extensions.

CAdES: lowercase name for now internal methods.

crypto/cms: generated file changes.

Add some CHANGES entries.

[extended tests]

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/8098)

2 months agoPROV: Use rsa_padding_add_PKCS1_OAEP_mgf1_with_libctx() in RSA-OAEP
Richard Levitte [Tue, 26 May 2020 08:05:01 +0000 (10:05 +0200)]
PROV: Use rsa_padding_add_PKCS1_OAEP_mgf1_with_libctx() in RSA-OAEP

Fixes #11904

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11959)

2 months agodoc: fix trace category names
Dr. Matthias St. Pierre [Sun, 10 May 2020 00:42:58 +0000 (02:42 +0200)]
doc: fix trace category names

The `ENGINE_CONF` and `PROVIDER_CONF` trace categories were merged
into a single `CONF` category (see bc362b9b7202 and 71849dff56d6).

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11806)

2 months agoClean up some doc nits
Rich Salz [Thu, 21 May 2020 21:21:27 +0000 (17:21 -0400)]
Clean up some doc nits

Mostly "No items in =over/=back list"

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11902)

2 months agoFix X509_PUBKEY_cmp(), move to crypto/x509/x_pubkey.c, rename, export, and document it
Dr. David von Oheimb [Thu, 21 May 2020 08:37:22 +0000 (10:37 +0200)]
Fix X509_PUBKEY_cmp(), move to crypto/x509/x_pubkey.c, rename, export, and document it

Fixes #11870

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11894)

2 months agoConstify X509_PUBKEY_get(), X509_PUBKEY_get0(), and X509_PUBKEY_get0_param()
Dr. David von Oheimb [Sun, 24 May 2020 16:28:06 +0000 (18:28 +0200)]
Constify X509_PUBKEY_get(), X509_PUBKEY_get0(), and X509_PUBKEY_get0_param()

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11894)

2 months agoPROV: Fix RSA-OAEP memory leak
Richard Levitte [Sat, 23 May 2020 15:34:07 +0000 (17:34 +0200)]
PROV: Fix RSA-OAEP memory leak

The OAEP label wasn't freed when the operation context was freed.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11927)

2 months agoUpdate core_names.h fields and document most fields.
Shane Lontis [Tue, 26 May 2020 03:53:07 +0000 (13:53 +1000)]
Update core_names.h fields and document most fields.

Renamed some values in core_names i.e Some DH specific names were changed to use DH instead of FFC.
Added some strings values related to RSA keys.
Moved set_params related docs out of EVP_PKEY_CTX_ctrl.pod into its own file.
Updated Keyexchange and signature code and docs.
Moved some common DSA/DH docs into a shared EVP_PKEY-FFC.pod.
Moved Ed25519.pod into EVP_SIGNATURE-ED25519.pod and reworked it.

Added some usage examples. As a result of the usage examples the following change was also made:
ec allows OSSL_PKEY_PARAM_USE_COFACTOR_ECDH as a settable gen parameter.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11610)

2 months agoFix ERR_print_errors so that it matches the documented format in doc/man3/ERR_error_s...
Shane Lontis [Tue, 26 May 2020 02:44:36 +0000 (12:44 +1000)]
Fix ERR_print_errors so that it matches the documented format in doc/man3/ERR_error_string.pod

Fixes #11743

The ouput format had 2 issues that caused it not to match the expected documented format:
(1) At some point the thread id printing was changed to use the OPENSSL_hex2str method which puts ':' between hex bytes.
    An internal function that skips the seperator has been added.
(2) The error code no longer exists. So this was completely removed from the string. It is now replaced by ::

As an example:
  00:77:6E:52:14:7F:00:00:error:asn1 encoding routines:asn1_check_tlen:wrong tag:crypto/asn1/tasn_dec.c:1135:
Is now:
  00776E52147F0000:error::asn1 encoding routines:asn1_check_tlen:wrong tag:crypto/asn1/tasn_dec.c:1135:

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11789)

2 months agoossl_shim: add deprecation guards around the -use-ticket-callback option.
Pauli [Sun, 24 May 2020 22:40:20 +0000 (08:40 +1000)]
ossl_shim: add deprecation guards around the -use-ticket-callback option.

The ticket callback is deprecated in 3.0 and can't be used in a no-deprecated
build.

[extended tests]

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/11944)

2 months agoCoverity 1463830: Resource leaks (RESOURCE_LEAK)
Pauli [Sun, 24 May 2020 21:43:45 +0000 (07:43 +1000)]
Coverity 1463830: Resource leaks (RESOURCE_LEAK)

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/11941)

2 months agoUpdate the gost-engine submodule
Dmitry Belyavskiy [Mon, 25 May 2020 09:45:37 +0000 (12:45 +0300)]
Update the gost-engine submodule

Fixes #11949
[extended tests]

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11951)

2 months agoFix omissions in providers/common/der/build.info
Richard Levitte [Fri, 22 May 2020 08:17:55 +0000 (10:17 +0200)]
Fix omissions in providers/common/der/build.info

Dependencies on generated files must be declared explicitly.  When
refactoring the DER code in providers/common/der, a few of those
dependency declaration were omitted, which may lead to build errors in
a parallel build.

Some cleanup and extensive used of build.info variables is done while
at it, to avoid unnecessary repetition.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11906)

2 months agoDrop special case of time interval calculation for VMS
Tomas Mraz [Fri, 22 May 2020 08:14:04 +0000 (10:14 +0200)]
Drop special case of time interval calculation for VMS

The existing special case code is broken and it is not needed
anymore as times() and _SC_CLK_TCK should be supported
on the supported VMS versions.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11905)