openssl.git
3 months agocoverity 1462548 Resource leak
Pauli [Sun, 26 Apr 2020 22:30:49 +0000 (08:30 +1000)]
coverity 1462548 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

3 months agocoverity 1462546 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:26:39 +0000 (08:26 +1000)]
coverity 1462546 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

3 months agocoverity 1462545 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:25:33 +0000 (08:25 +1000)]
coverity 1462545 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

3 months agocoverity: 1462544 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:21:06 +0000 (08:21 +1000)]
coverity: 1462544 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

3 months agocoverity 1462543 Logically dead code
Pauli [Sun, 26 Apr 2020 22:05:23 +0000 (08:05 +1000)]
coverity 1462543 Logically dead code

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

3 months agocoverity 1462541 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:01:28 +0000 (08:01 +1000)]
coverity 1462541 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

3 months agocoverity 1462550 Resource leak
Pauli [Sun, 26 Apr 2020 21:59:02 +0000 (07:59 +1000)]
coverity 1462550 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

3 months agocoverity 1462565: Null pointer dereferences
Pauli [Sun, 26 Apr 2020 21:51:16 +0000 (07:51 +1000)]
coverity 1462565: Null pointer dereferences

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

3 months agocoverity 1462577: Incorrect expression
Pauli [Sun, 26 Apr 2020 21:40:17 +0000 (07:40 +1000)]
coverity 1462577: Incorrect expression

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

3 months agoparam bld: avoid freeing the param builder structure on error paths.
Pauli [Sun, 26 Apr 2020 21:32:43 +0000 (07:32 +1000)]
param bld: avoid freeing the param builder structure on error paths.

The param builder was recently modified so that it doesn't free the passed in
param builder structure.  Some of the error paths didn't get synced up with this
change and resulted in double frees.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

3 months agoFix snprintf missing for windows build
Shane Lontis [Wed, 29 Apr 2020 06:19:16 +0000 (16:19 +1000)]
Fix snprintf missing for windows build

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11675)

3 months agoUndeprecate DH, DSA and RSA _bits() functions.
Pauli [Tue, 28 Apr 2020 09:03:05 +0000 (19:03 +1000)]
Undeprecate DH, DSA and RSA _bits() functions.

These were deemed information and useful and that they should not be
deprecated.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11669)

3 months agoEVP: Fix evp_keymgmt_util_copy() for to->keymgmt == NULL
Richard Levitte [Tue, 28 Apr 2020 06:41:20 +0000 (08:41 +0200)]
EVP: Fix evp_keymgmt_util_copy() for to->keymgmt == NULL

evp_keymgmt_util_copy() didn't treat the case to->keymgmt correctly.
The proper change is to use from->keymgmt when to->keymgmt is NULL.

Fixes coverity #1462553

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11668)

3 months agoAmend references to "OpenSSL license"
Shourya Shukla [Mon, 27 Apr 2020 04:59:50 +0000 (10:29 +0530)]
Amend references to "OpenSSL license"

A small number of files contain references to the "OpenSSL license"
which has been deprecated and replaced by the "Apache License 2.0".
Amend the occurences.

Fixes #11649

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11663)

3 months agoUpdate EVP_PKEY_fromdata.pod
opensignature [Mon, 27 Apr 2020 09:47:44 +0000 (11:47 +0200)]
Update EVP_PKEY_fromdata.pod

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11660)

3 months agoinclude/openssl/ts.h: clean away a misplaced EVP_MD stack definition
Richard Levitte [Mon, 27 Apr 2020 09:59:17 +0000 (11:59 +0200)]
include/openssl/ts.h: clean away a misplaced EVP_MD stack definition

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11655)

3 months agoinclude/openssl/x509v3.h: restore previous stack definition arrangement
Richard Levitte [Mon, 27 Apr 2020 06:36:53 +0000 (08:36 +0200)]
include/openssl/x509v3.h: restore previous stack definition arrangement

It turned out that configuration options may affect the definition and
use of diverse stacks and how they relate to the underlying types.
For example, the configuration option 'no-rfc3779' results in a build
error around STACK_OF(IPAddressFamily) and related stacks.

Previously, STACK_OF definitions were located near the definition of
the underlying type, which are also affected by configuration options,
which made this easier to maintain.  We relocate the new stack
definitions back to those locations for that reason.

We apply the same type of relocation in other header files as well, following
the general rule that it's better to use DEFINE_OR_DECLARE_STACK_OF after the
type it defines a stack for has been defined.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11655)

3 months agoUpdate README.ssltests.md
Matt Caswell [Mon, 27 Apr 2020 09:36:35 +0000 (10:36 +0100)]
Update README.ssltests.md

The ssltest docs were out of date because gneerate_ssl_tests now needs
a provider to be specified on the command line.

Fixes #11639

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11659)

3 months agoRename FIPS_MODE to FIPS_MODULE
Richard Levitte [Mon, 13 Apr 2020 20:34:56 +0000 (22:34 +0200)]
Rename FIPS_MODE to FIPS_MODULE

This macro is used to determine if certain pieces of code should
become part of the FIPS module or not.  The old name was confusing.

Fixes #11538

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11539)

3 months agoConfigurations: Identify the shell variables around MANSUFFIX
Sebastian Andrzej Siewior [Sat, 25 Apr 2020 18:29:48 +0000 (20:29 +0200)]
Configurations: Identify the shell variables around MANSUFFIX

With MANSUFFIX=A the statement '$$fn$(MANSUFFIX)' is reaplaces with
'$fnA' and left empty because the `fnA' variables is not recognized
within the shell.

With {} around fn it is then bocomes ${fn}A and works as expected.
While here, add the MANSUFFIX to the ECHO line so it is properly printed
during build.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11643)

3 months agoFix GOST curve sec bits
Nikolay Morozov [Wed, 22 Apr 2020 09:09:38 +0000 (12:09 +0300)]
Fix GOST curve sec bits

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11637)

3 months agoConfigure: change all references to INSTALL to INSTALL.md
Richard Levitte [Mon, 27 Apr 2020 07:08:36 +0000 (09:08 +0200)]
Configure: change all references to INSTALL to INSTALL.md

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11657)

3 months agoConfigurations/unix-Makefile.tmpl: fix typo
Richard Levitte [Mon, 27 Apr 2020 06:11:52 +0000 (08:11 +0200)]
Configurations/unix-Makefile.tmpl: fix typo

PROCESSSOR => PROCESSOR

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11654)

3 months agosslapitest: only compile test when it will be used
Benjamin Kaduk [Wed, 1 Apr 2020 20:51:40 +0000 (13:51 -0700)]
sslapitest: only compile test when it will be used

The test_ccs_change_cipher() test routine is used only when TLS 1.2
is enabled; to fix the strict-warnings build we should not try to
compile it when TLS 1.2 is disabled, either.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11458)

3 months agodoc: Random spellchecking
Sebastian Andrzej Siewior [Sat, 25 Apr 2020 21:57:00 +0000 (23:57 +0200)]
doc: Random spellchecking

A little spell checking.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/11644)

3 months agofuzz/asn1.c: Add missing #include
Richard Levitte [Sat, 25 Apr 2020 02:11:09 +0000 (04:11 +0200)]
fuzz/asn1.c: Add missing #include

<openssl/dsa.h> gets included via ts.h...  except when 'no-ts' has been
configured.

Fixes #11597

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11640)

3 months agoi2b_PVK_bio: don't set PEM_R_BIO_WRITE_FAILURE in case of success
Christian Hohnstaedt [Sun, 22 Mar 2020 08:41:30 +0000 (09:41 +0100)]
i2b_PVK_bio: don't set PEM_R_BIO_WRITE_FAILURE in case of success

but in case of an error

CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11380)

3 months agoFix type cast in SSL_CTX_set1_groups macro
Arne Schwabe [Thu, 23 Apr 2020 10:42:51 +0000 (12:42 +0200)]
Fix type cast in SSL_CTX_set1_groups macro

The macro casts the glist parameter to char*
instead of (int *) like the documentation of the function suggest.

Also the function tls1_set_groups that is called from SSL_CTX_ctrl
takes an int * argument. This looks like a copy&paste error from
SSL_CTX_set1_groups_list function.

CLA: trivial
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11614)

3 months agocrypto/x509/v3_alt.c: make 'othername' a bit bigger
Richard Levitte [Mon, 27 Apr 2020 06:43:18 +0000 (08:43 +0200)]
crypto/x509/v3_alt.c: make 'othername' a bit bigger

We want to fill 'othername' with the contents of 'oline' (256 bytes)
plus some additional text.  We need to ensure that 'othername' is
large enough to contain this.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11656)

3 months agoFix links in CONTRIBUTING.md
Nicola Tuveri [Fri, 24 Apr 2020 16:25:56 +0000 (19:25 +0300)]
Fix links in CONTRIBUTING.md

CHANGES and NEWS were renamed into CHANGES.md and NEWS.md; this commit
updates the references inside CONTRIBUTING.md to fix broken links.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/11634)

3 months agoConfigurations/windows-makefile.tmpl: Fix template code for INSTALL_MODULES
Richard Levitte [Fri, 24 Apr 2020 08:08:42 +0000 (10:08 +0200)]
Configurations/windows-makefile.tmpl: Fix template code for INSTALL_MODULES

Fixes #11623

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11629)

3 months agoAdd support for unusal 'othername' subjectAltNames
Dirk-Willem van Gulik [Tue, 21 Apr 2020 21:06:38 +0000 (23:06 +0200)]
Add support for unusal 'othername' subjectAltNames

Increasingly certificates seem to have special things in the subjectAltName that have arbitrary strings in them.

E.g. some (now) common in EU export certificates and, for a few years now, certificates issued to medical doctors (in for example the netherlands, the full spec is https://www.uziregister.nl/Media/Default/PDF/20200325%20CA%20model%20pasmodel%20certificaatprofielen%20v10_0.pdf, section 4.8, page 16 for an example of one country).

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11599)

3 months agotravis: remove GENERATE=yes from some non no-deprecated builds
Pauli [Wed, 22 Apr 2020 11:38:19 +0000 (21:38 +1000)]
travis: remove GENERATE=yes from some non no-deprecated builds

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11607)

3 months agotravis: add GENERATE=yes no-makedepend to the ARM64 build.
Pauli [Wed, 22 Apr 2020 10:01:30 +0000 (20:01 +1000)]
travis: add GENERATE=yes no-makedepend to the ARM64 build.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11607)

3 months agokeymgmt: convert to use the params modification detection.
Pauli [Thu, 23 Apr 2020 10:31:12 +0000 (20:31 +1000)]
keymgmt: convert to use the params modification detection.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

3 months agoparams: change OSSL_PARAM_set_unmodified() to operate on a params array
Pauli [Thu, 23 Apr 2020 10:23:48 +0000 (20:23 +1000)]
params: change OSSL_PARAM_set_unmodified() to operate on a params array

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

3 months agoevp: convert existing code to use the new modified sentinel for params.
Pauli [Wed, 22 Apr 2020 04:20:11 +0000 (14:20 +1000)]
evp: convert existing code to use the new modified sentinel for params.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

3 months agoparams: handle the modified sentinel.
Pauli [Wed, 22 Apr 2020 04:10:24 +0000 (14:10 +1000)]
params: handle the modified sentinel.

The param builder and the params from text helpers also need to be modified
aware.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

3 months agoConfigure: Allow quoted values in VERSION
Richard Levitte [Thu, 23 Apr 2020 16:59:10 +0000 (18:59 +0200)]
Configure: Allow quoted values in VERSION

Fixes #11618

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11624)

3 months agoFix dev/release-aux-openssl-announce-pre-release.tmpl
Richard Levitte [Thu, 23 Apr 2020 14:38:40 +0000 (16:38 +0200)]
Fix dev/release-aux-openssl-announce-pre-release.tmpl

$LABEL -> $label

Removed link to release notes, as we don't produce them for master.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11617)

3 months agoCode cleanup in X509v3 String Extentions
Nikolay Morozov [Wed, 22 Apr 2020 08:45:16 +0000 (11:45 +0300)]
Code cleanup in X509v3 String Extentions

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11604)

3 months agoClean up the use of ERR_print_errors() in apps.c and in four apps
Dr. David von Oheimb [Wed, 22 Apr 2020 12:58:41 +0000 (14:58 +0200)]
Clean up the use of ERR_print_errors() in apps.c and in four apps

Also make sure that all error messages in apps.c consistently begin upper-case.
Changed files: apps/lib/apps.c and apps/{req.c,s_client.c,s_server.c,x509.c}

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

3 months agoRemove a bad 'goto end' and a few superfluous ones in apps/lib/apps.c
David von Oheimb [Tue, 26 Dec 2017 18:33:04 +0000 (19:33 +0100)]
Remove a bad 'goto end' and a few superfluous ones in apps/lib/apps.c

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

3 months agoImprove feedback on wrong format with new print_format_error() in apps/lib/opt.c
David von Oheimb [Fri, 22 Dec 2017 18:50:17 +0000 (19:50 +0100)]
Improve feedback on wrong format with new print_format_error() in apps/lib/opt.c

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

3 months agoAdd function load_csr(file,format,desc) to apps/lib/apps.c
David von Oheimb [Fri, 15 Dec 2017 19:50:37 +0000 (20:50 +0100)]
Add function load_csr(file,format,desc) to apps/lib/apps.c

Make use of new load_csr() in 'ca', 'req', and 'x509' app
Add '-inform' and '-certform' option to 'ca' app
Add 'desc' parameter to load_crl() function defined in apps/lib/apps.c
Allow 'desc' parameter to be NULL (gives option to suppress error output)

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

3 months agoIn OpenSSL builds, declare STACK for datatypes ...
Rich Salz [Thu, 19 Dec 2019 22:30:24 +0000 (17:30 -0500)]
In OpenSSL builds, declare STACK for datatypes ...

... and only *define* them in the source files that need them.
Use DEFINE_OR_DECLARE which is set appropriately for internal builds
and not non-deprecated builds.

Deprecate stack-of-block

Better documentation

Move some ASN1 struct typedefs to types.h

Update ParseC to handle this.  Most of all, ParseC needed to be more
consistent.  The handlers are "recursive", in so far that they are called
again and again until they terminate, which depends entirely on what the
"massager" returns.  There's a comment at the beginning of ParseC that
explains how that works. {Richard Levtte}

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10669)

3 months agoFix typo from #10631
Nicola Tuveri [Tue, 21 Apr 2020 15:34:17 +0000 (18:34 +0300)]
Fix typo from #10631

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11595)

3 months agoRewrite man5/config.pod and related conf code cleanup
Rich Salz [Sat, 28 Mar 2020 16:51:05 +0000 (12:51 -0400)]
Rewrite man5/config.pod and related conf code cleanup

The manpage is basically rewritten.  Use consistent name/value
terminology. Use consistent phraseology to refer to section pointers
and lists of section pointers. Add more cross-references.

Also found a bunch of trivial style things in conf_api.c while
investigating how config works.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11431)

3 months agoSSL_CTX_config.pod: Remove needless "NOTE" heading
Rich Salz [Sat, 28 Mar 2020 16:50:49 +0000 (12:50 -0400)]
SSL_CTX_config.pod: Remove needless "NOTE" heading

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11431)

3 months agoRename fipsinstall.cnf->fipsmodule.cnf
Rich Salz [Tue, 21 Apr 2020 17:55:12 +0000 (13:55 -0400)]
Rename fipsinstall.cnf->fipsmodule.cnf

Introduced by rebasing

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11177)

3 months agoUpdate some nits around the FIPS module
Rich Salz [Tue, 25 Feb 2020 21:27:24 +0000 (16:27 -0500)]
Update some nits around the FIPS module

- Changed the generated FIPS signature file to be "fipsmodule.conf"
since it contains information about the FIPS module/file.
- Add -q option to fipsinstall command, to stop chatty verbose status
messages.
- Document env var OPENSSL_CONF_INCLUDE

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11177)

3 months agoPrepare for 3.0 alpha 2
Matt Caswell [Thu, 23 Apr 2020 13:10:38 +0000 (14:10 +0100)]
Prepare for 3.0 alpha 2

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 months agoPrepare for release of 3.0 alpha 1 openssl-3.0.0-alpha1
Matt Caswell [Thu, 23 Apr 2020 13:08:36 +0000 (14:08 +0100)]
Prepare for release of 3.0 alpha 1

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 months agoUpdate copyright year
Matt Caswell [Thu, 23 Apr 2020 12:55:52 +0000 (13:55 +0100)]
Update copyright year

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11616)

3 months agoAdd info on the CMP implementation and HTTP client to NEWS.md and CHANGES.md
Dr. David von Oheimb [Wed, 22 Apr 2020 11:12:45 +0000 (13:12 +0200)]
Add info on the CMP implementation and HTTP client to NEWS.md and CHANGES.md

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11608)

3 months agoFix a typo in the makefile templates
Matt Caswell [Thu, 23 Apr 2020 10:50:20 +0000 (11:50 +0100)]
Fix a typo in the makefile templates

The fips.so and legacy.so providers were not being installed because of
a typo in the makefile templates.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11615)

3 months agoMention the 3.0 wiki page in the release announcement emails
Matt Caswell [Tue, 21 Apr 2020 14:13:30 +0000 (15:13 +0100)]
Mention the 3.0 wiki page in the release announcement emails

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11593)

3 months agoPROV: Ensure that EC keys have a default digest
Richard Levitte [Mon, 20 Apr 2020 19:35:03 +0000 (21:35 +0200)]
PROV: Ensure that EC keys have a default digest

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

3 months agoPROV: Ensure that ED25519 & ED448 keys have a mandatory digest
Richard Levitte [Mon, 20 Apr 2020 07:29:47 +0000 (09:29 +0200)]
PROV: Ensure that ED25519 & ED448 keys have a mandatory digest

This adds handling of the parameter "mandatory-digest" and responds
with an empty string, meaning that no digest may be used.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

3 months agoEVP: Fix EVP_Digest{Sign,Verify}Init() to handle no default digest
Richard Levitte [Mon, 20 Apr 2020 07:29:16 +0000 (09:29 +0200)]
EVP: Fix EVP_Digest{Sign,Verify}Init() to handle no default digest

EVP_DigestSignInit() and EVP_DigestVerifyInit() would detect if there
is no default digest when using legacy (EVP_PKEY_ASN1_METHOD)
implementations.  However, it doesn't do that when provider side keys
are used.

Furthermore, because EVP_PKEY_get_default_digest_name() was used in
the portion of the code that uses the provider implementation, the
EVP_PKEY_ASN1_METHOD would be used if the key has one attached.  This
is now changed to use evp_keymgmt_util_get_deflt_digest_name()
instead.

Finally, we make sure to detect if the provider implementation
supports the digest name parameters (default or mandatory), and
returns with error if not.  This is what the legacy portion of the
code does.

Fixes #11571

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

3 months agoEVP: add internal evp_keymgmt_util_get_deflt_digest_name() and use it
Richard Levitte [Mon, 20 Apr 2020 07:14:59 +0000 (09:14 +0200)]
EVP: add internal evp_keymgmt_util_get_deflt_digest_name() and use it

evp_keymgmt_util_get_deflt_digest_name() is a refactor of the provider
side key part of EVP_PKEY_get_default_digest_name(), that takes
EVP_KEYMGMT and provider keydata pointers instead of an EVP_PKEY
pointer.

We also ensure that it uses SN_undef as the default name if the
provider implementation gave us an empty string, since this is what
EVP_PKEY_get_default_digest_name() responds when getting the digest
name via a EVP_PKEY_ASN1_METHOD ctrl call that returns NID_undef.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

3 months agoFIPS: remove algorithms that are not being validated.
Pauli [Wed, 22 Apr 2020 07:08:30 +0000 (17:08 +1000)]
FIPS: remove algorithms that are not being validated.

Several MACs and one KDF are included in the FIPS provider with the property
"fips=yes" set but are not listed as being part of the OpenSSL validation.

This removes them from the FIPS provider.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11602)

3 months agoFix no-err
Matt Caswell [Mon, 20 Apr 2020 14:04:35 +0000 (15:04 +0100)]
Fix no-err

This fixes an assertion failure that can occur in the CMP code in the
event of a no-err build. The "improve_location_name" function assumed
that the fallback argument was always populated with something. However
in a no-err build this is not the case.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11584)

3 months agoSkip a no-dsa test in the fipsinstall test
Matt Caswell [Mon, 20 Apr 2020 13:18:36 +0000 (14:18 +0100)]
Skip a no-dsa test in the fipsinstall test

In a similar way to the previous commit we also skip a fipsinstall test
if DSA has been disabled.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11582)

3 months agoSkip a test in a no-dh build
Matt Caswell [Mon, 20 Apr 2020 13:05:47 +0000 (14:05 +0100)]
Skip a test in a no-dh build

One of the sub-tests in the fipsinstall test corrupts a DH test to
confirm that fipsinstall fails. However that is never noticed in a
no-dh build - so we just skip that test in a no-dh build.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11582)

3 months agoFix some build failures with no-dh
Matt Caswell [Mon, 20 Apr 2020 13:05:23 +0000 (14:05 +0100)]
Fix some build failures with no-dh

Add some missing OPENSSL_NO_DH guards.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11582)

3 months agoFix no-ec
Matt Caswell [Mon, 20 Apr 2020 11:27:59 +0000 (12:27 +0100)]
Fix no-ec

This was missed by Travis because, although it has a no-ec build, the test
that failed only runs in a debug build. The Travis job with no-ec is not
a debug build and so the test was skipped.

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11581)

3 months agoAdd a link to wiki 3.0 upgrade notes
Matt Caswell [Mon, 20 Apr 2020 18:39:32 +0000 (19:39 +0100)]
Add a link to wiki 3.0 upgrade notes

Provide a link to the 3.0 upgrade notes so that users of the alpha/beta/
final releases can understand the differences between this version and
previous versions.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11587)

3 months agoGOST2012 TLS Supported Groups Identifiers Support
Nikolay Morozov [Sat, 18 Apr 2020 20:59:45 +0000 (23:59 +0300)]
GOST2012 TLS Supported Groups Identifiers Support

For GOST2012-GOST8912-GOST8912 IANA introduce TLS Supported Groups Identifiers
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11568)

3 months agoevptest: set the DESX provider to be the legacy provider.
Pauli [Mon, 20 Apr 2020 02:43:49 +0000 (12:43 +1000)]
evptest: set the DESX provider to be the legacy provider.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11573)

3 months agoparams: add functionality to test if an OSSL_PARAM has been set.
Pauli [Tue, 21 Apr 2020 00:49:19 +0000 (10:49 +1000)]
params: add functionality to test if an OSSL_PARAM has been set.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11588)

3 months ago[crypto/ec] deprecate Jprojective_coordinates_GFp functions
Billy Brumley [Sun, 12 Apr 2020 15:17:19 +0000 (18:17 +0300)]
[crypto/ec] deprecate Jprojective_coordinates_GFp functions

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11527)

3 months agoAdd setter equivalents to X509_REQ_get0_signature
Dirk-Willem van Gulik [Fri, 10 Jan 2020 17:35:49 +0000 (18:35 +0100)]
Add setter equivalents to X509_REQ_get0_signature

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10563)

3 months agoFix no-deprecated tests where the GOST engine is present
Matt Caswell [Mon, 20 Apr 2020 13:32:21 +0000 (14:32 +0100)]
Fix no-deprecated tests where the GOST engine is present

The GOST test only runs if it detects that the GOST engine is present.
This is the case for the run-checker environment. The GOST engine uses
some deprecated functions, so we disable that test in a no-deprecated
build.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11583)

3 months agoFix no-des
Matt Caswell [Mon, 20 Apr 2020 10:23:34 +0000 (11:23 +0100)]
Fix no-des

Disable a recently added CMS test in the case of no-des.

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/11578)

3 months agoFix an ssl_test_old test failure
Matt Caswell [Mon, 20 Apr 2020 16:06:40 +0000 (17:06 +0100)]
Fix an ssl_test_old test failure

In builds where SSLv3 is enabled ssl_test_old was failing. We need to
make sure we disable SSLv3 related tests when using the FIPS provider.

[extended tests]

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11586)

3 months agoFix test_ssl_new test failure
Matt Caswell [Mon, 20 Apr 2020 16:04:57 +0000 (17:04 +0100)]
Fix test_ssl_new test failure

A couple of fetches of the MD5 and SHA1 digests were not using the
libctx in libssl and causing test_ssl_new to fail in travis. This
only occurs on builds with SSLv3 enabled (its disabled by default).

[extended tests]

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11586)

3 months agoRevert "TEST: make and use a fipsinstall script"
Richard Levitte [Tue, 21 Apr 2020 10:24:44 +0000 (12:24 +0200)]
Revert "TEST: make and use a fipsinstall script"

Unfortunately, this won't work on MacOS because of system integrity
measures on that platform, which clears DYLD_LIBRARY_PATH before
starting a sub-process executable.

Ref: https://developer.apple.com/library/archive/documentation/Security/Conceptual/System_Integrity_Protection_Guide/RuntimeProtections/RuntimeProtections.html

This reverts commit ae6b654b669638882a6ddce012ff55adc7cf6a82.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11592)

3 months agoFix NULL dereference in SSL_check_chain() for TLS 1.3
Benjamin Kaduk [Fri, 10 Apr 2020 19:27:28 +0000 (12:27 -0700)]
Fix NULL dereference in SSL_check_chain() for TLS 1.3

In the tls1_check_sig_alg() helper function, we loop through the list of
"signature_algorithms_cert" values received from the client and attempt
to look up each one in turn in our internal table that maps wire
codepoint to string-form name, digest and/or signature NID, etc., in
order to compare the signature scheme from the peer's list against what
is used to sign the certificates in the certificate chain we're
checking.  Unfortunately, when the peer sends a value that we don't
support, the lookup returns NULL, but we unconditionally dereference the
lookup result for the comparison, leading to an application crash
triggerable by an unauthenticated client.

Since we will not be able to say anything about algorithms we don't
recognize, treat NULL return from lookup as "does not match".

We currently only apply the "signature_algorithm_cert" checks on TLS 1.3
connections, so previous TLS versions are unaffected.  SSL_check_chain()
is not called directly from libssl, but may be used by the application
inside a callback (e.g., client_hello or cert callback) to verify that a
candidate certificate chain will be acceptable to the client.

CVE-2020-1967

Reviewed-by: Matt Caswell <matt@openssl.org>
3 months agoAdd test for CVE-2020-1967
Benjamin Kaduk [Fri, 10 Apr 2020 19:27:28 +0000 (12:27 -0700)]
Add test for CVE-2020-1967

Add to test_sslsigalgs a TLSProxy test that injects a
"signature_algorithms_cert" extension that contains an unallocated
codepoint.

The test currently fails, since s_server segfaults instead of
ignoring the unrecognized value.

Since "signature_algorithms" and "signature_algorithms_cert" are very
similar, also add the analogous test for "signature_algorithms".

Reviewed-by: Matt Caswell <matt@openssl.org>
3 months agoDeveloper scripts: Release script
Richard Levitte [Mon, 6 Apr 2020 21:58:24 +0000 (23:58 +0200)]
Developer scripts: Release script

The old release script that exists in another repository has aged, and
risks becoming messy beyond maintainability if it's made to deal with
multiple OpenSSL version schemes.

A solution, which has been seen in other projects, is to have the
release script as part of the versioned source tree, and ensure it's
adapted for the ongoing version scheme in that source tree.

This introduces dev/, a directory of OpenSSL developer "stuff".  We
may expand it with other practical scripts to easy development setup
and other similar things that developers may need.  For now, it's the
release script dev/release.sh, with auxilliary files in dev/release-aux/.
The script is self describing, the manual is available by running the
command `./dev/release.sh --manual`.

The dev/ directory shall never appear in a source distribution.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11516)

3 months agoFix test_cmp_vfy failures with FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
Dr. David von Oheimb [Mon, 20 Apr 2020 15:19:50 +0000 (17:19 +0200)]
Fix test_cmp_vfy failures with FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION

[extended tests]

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11585)

3 months agogendsa: remove unnecessary OPENSSL_SUPPRESS_DEPRECATED definition
Pauli [Sun, 19 Apr 2020 23:33:51 +0000 (09:33 +1000)]
gendsa: remove unnecessary OPENSSL_SUPPRESS_DEPRECATED definition

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/11570)

3 months agoTeach ssl_test_old to use the FIPS provider for its tests
Matt Caswell [Mon, 13 Apr 2020 13:32:51 +0000 (14:32 +0100)]
Teach ssl_test_old to use the FIPS provider for its tests

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11534)

3 months agoTeach ssl_test_old how to run tests in a non-default library context
Matt Caswell [Fri, 10 Apr 2020 13:31:19 +0000 (14:31 +0100)]
Teach ssl_test_old how to run tests in a non-default library context

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11534)

3 months agoUse a fetched MD if appropriate in ssl3_cbc_digest_record
Matt Caswell [Sat, 18 Apr 2020 10:54:23 +0000 (11:54 +0100)]
Use a fetched MD if appropriate in ssl3_cbc_digest_record

HMACs used via the legacy EVP_DigestSign interface are strange in
that they use legacy codepath's which eventually (under the covers)
transform the operation into a new style EVP_MAC. This can mean the
digest in use can be a legacy one, so we need to be careful with any
digest we extract from the ctx.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11511)

3 months agoTeach ssl_test_new how to test the FIPS module
Matt Caswell [Tue, 7 Apr 2020 16:03:19 +0000 (17:03 +0100)]
Teach ssl_test_new how to test the FIPS module

We load the FIPS module and make sure it is configured before running
the ssl_test_new tests.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11511)

3 months agoTeach ssl_test_new to have different tests for different loaded providers
Matt Caswell [Tue, 7 Apr 2020 15:22:49 +0000 (16:22 +0100)]
Teach ssl_test_new to have different tests for different loaded providers

We now run the tests twice: Once with no specific providers loaded and
just using the default libctx, and a second time with a non-default libctx
and the default provider.

In the second run we disable tests which use a PSS cert/key because we
don't yet have support for that.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11511)

3 months agoRun ssl_test_new with a non-default library context
Matt Caswell [Fri, 3 Apr 2020 14:40:00 +0000 (15:40 +0100)]
Run ssl_test_new with a non-default library context

We also prepare the way for a future commit to run ssl_test_new with
just the FIPS provider loaded.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11511)

3 months agoUpdate comment on crls_http_cb() as it does support non-blocking I/O since #10667
Dr. David von Oheimb [Sat, 7 Mar 2020 10:51:42 +0000 (11:51 +0100)]
Update comment on crls_http_cb() as it does support non-blocking I/O since #10667

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11273)

3 months agoFix descriptions of credentials and verification options for various apps
Dr. David von Oheimb [Fri, 6 Mar 2020 20:46:33 +0000 (21:46 +0100)]
Fix descriptions of credentials and verification options for various apps

fix doc of s_client and s_server credentials and verification options
fix doc of verification options also for s_time, x509, crl, req, ts, and verify
correcting and extending texts regarding untrusted and trusted certs,
making the order of options in the docs and help texts more consistent,
etc.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11273)

3 months agoSwap parameters of evp_method_id()
Dr. Matthias St. Pierre [Thu, 16 Apr 2020 17:10:14 +0000 (19:10 +0200)]
Swap parameters of evp_method_id()

The order of the function's parameters `name_id` and `operation_id`
was reverted compared to their order of appearance in the comments
and assertions.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11542)

3 months agoFix an assertion (and a comment) of evp_method_id()
Dr. Matthias St. Pierre [Mon, 13 Apr 2020 22:12:48 +0000 (00:12 +0200)]
Fix an assertion (and a comment) of evp_method_id()

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11542)

3 months agoFix DH_get_nid() so that it does not cache values.
Shane Lontis [Mon, 20 Apr 2020 01:07:38 +0000 (11:07 +1000)]
Fix DH_get_nid() so that it does not cache values.

DH_set0_pqg() is now responsible for caching the nid, q and length.

DH with or without named safe prime groups now default to using the maximum private key length (BN_num_bits(q) - 1)
when generating a DH private key. The code is now shared between fips and non fips mode for DH key generation.

The OSSL_PKEY_PARAM_DH_PRIV_LEN parameter can be used during keygen to override the maximum private key length to be
in the range (2 * strength ... bits(q) - 1). Where the strength depends on the length of p.

Added q = (p - 1) / 2 safe prime BIGNUMS so that the code is data driven (To simplify adding new names).
The BIGNUMS were code generated.

Fix error in documented return value for DH_get_nid

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11562)

3 months agoDOC: Extend EVP_PKEY-DSA(7) / EVP_PKEY_DH(7) with FFC information
Shane Lontis [Thu, 16 Apr 2020 02:07:26 +0000 (12:07 +1000)]
DOC: Extend EVP_PKEY-DSA(7) / EVP_PKEY_DH(7) with FFC information

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11546)

3 months agoDOC: Refactor provider-keymgmt(7) to give the keytypes their own pages
Richard Levitte [Tue, 14 Apr 2020 17:06:12 +0000 (19:06 +0200)]
DOC: Refactor provider-keymgmt(7) to give the keytypes their own pages

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11546)

3 months agoBuild files: add module installation targets
Richard Levitte [Fri, 17 Apr 2020 13:38:45 +0000 (15:38 +0200)]
Build files: add module installation targets

We only installed engines, now we also install other modules.

Fixes #11559

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11566)

3 months agoTEST: make and use a fipsinstall script
Richard Levitte [Sat, 18 Apr 2020 10:14:41 +0000 (12:14 +0200)]
TEST: make and use a fipsinstall script

We have copies of the exact same fipsinstall call in several test
recipes.  This refactors those calls into a single simple script.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11565)

3 months agoUse the libctx for all EVP_PKEY_CTX operations
Matt Caswell [Fri, 10 Apr 2020 15:32:16 +0000 (16:32 +0100)]
Use the libctx for all EVP_PKEY_CTX operations

There were a few places where we were not passing through the libctx
when constructing and EVP_PKEY_CTX.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11508)

3 months agoRe-enable FIPS testing in sslapitest.c
Matt Caswell [Sat, 21 Mar 2020 00:39:27 +0000 (00:39 +0000)]
Re-enable FIPS testing in sslapitest.c

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11508)