openssl.git
2 years agoutil/mknum.pl: Really allow unset ordinals in development
Richard Levitte [Wed, 2 Jun 2021 04:20:05 +0000 (06:20 +0200)]
util/mknum.pl: Really allow unset ordinals in development

Any pre-release tag that includes '-dev' is development.  The ordinals
don't need to be finalized before '-dev' is removed (i.e. a release is
made).

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15578)

2 years agoFix errors found by parfait static analyser.
Shane Lontis [Wed, 2 Jun 2021 04:42:56 +0000 (14:42 +1000)]
Fix errors found by parfait static analyser.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15579)

2 years agorsa: make the maximum key strength check FIPS only.
Pauli [Tue, 1 Jun 2021 08:35:15 +0000 (18:35 +1000)]
rsa: make the maximum key strength check FIPS only.

To be reverted once key generation checks are added everywhere and a way to
disable them implemented.

Fixes #15502

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15560)

2 years agoAdd an EVP demo for signatures using EC
yuechen-chen [Mon, 24 May 2021 06:33:55 +0000 (23:33 -0700)]
Add an EVP demo for signatures using EC

Fixes #14115

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15429)

2 years agoupdate checksums
Pauli [Wed, 2 Jun 2021 00:54:56 +0000 (10:54 +1000)]
update checksums

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15574)

2 years agoutil: update FIPS checksumming script to be more aggressive with whitespace
Pauli [Wed, 2 Jun 2021 00:37:10 +0000 (10:37 +1000)]
util: update FIPS checksumming script to be more aggressive with whitespace

Fixes #15562

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15574)

2 years agoAdd enable-fips to CI configuration
Jon Spillett [Mon, 31 May 2021 03:50:02 +0000 (13:50 +1000)]
Add enable-fips to CI configuration

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15537)

2 years agoDisable tracing within the FIPS module
Jon Spillett [Mon, 31 May 2021 03:14:24 +0000 (13:14 +1000)]
Disable tracing within the FIPS module

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15537)

2 years agoed25519 and ed448: fix incorrect OSSL_PKEY_PARAM_MAX_SIZE
Tomas Mraz [Tue, 1 Jun 2021 12:54:43 +0000 (14:54 +0200)]
ed25519 and ed448: fix incorrect OSSL_PKEY_PARAM_MAX_SIZE

Fixes #15552

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15566)

2 years ago80-test_cms.t: Replace use of ee-self-signed.pem by more suitable smrsa1.pem
Dr. David von Oheimb [Thu, 27 May 2021 13:11:31 +0000 (15:11 +0200)]
80-test_cms.t: Replace use of ee-self-signed.pem by more suitable smrsa1.pem

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15499)

2 years agoee-self-signed.pem: Restore original version, adding -attime to 25-test_verify.t
Dr. David von Oheimb [Thu, 27 May 2021 12:10:58 +0000 (14:10 +0200)]
ee-self-signed.pem: Restore original version, adding -attime to 25-test_verify.t

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15499)

2 years agolist: update to not use XXX_get_number() calls
Pauli [Tue, 1 Jun 2021 11:48:29 +0000 (21:48 +1000)]
list: update to not use XXX_get_number() calls

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15564)

2 years agostore: include internal header
Pauli [Tue, 1 Jun 2021 11:48:11 +0000 (21:48 +1000)]
store: include internal header

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15564)

2 years agodoc: fix OSSL_(EN|DE)CODER_get0_name function names
Pauli [Tue, 1 Jun 2021 11:19:39 +0000 (21:19 +1000)]
doc: fix OSSL_(EN|DE)CODER_get0_name function names

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15564)

2 years agolibcrypto: make XXX_get_number() internal
Pauli [Tue, 1 Jun 2021 11:18:04 +0000 (21:18 +1000)]
libcrypto: make XXX_get_number() internal

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15564)

2 years agodoc: make XXX_get_number() internal
Pauli [Tue, 1 Jun 2021 11:17:47 +0000 (21:17 +1000)]
doc: make XXX_get_number() internal

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15564)

2 years agoAdd internal get_number functions to internal headers
Pauli [Tue, 1 Jun 2021 02:53:31 +0000 (12:53 +1000)]
Add internal get_number functions to internal headers

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15564)

2 years agoadd internal get_number functons to crypto/evp.h
Pauli [Tue, 1 Jun 2021 02:51:45 +0000 (12:51 +1000)]
add internal get_number functons to crypto/evp.h

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15564)

2 years agodoc: move XXX_get_number() documentation to internal
Pauli [Tue, 1 Jun 2021 02:44:26 +0000 (12:44 +1000)]
doc: move XXX_get_number() documentation to internal

These functions are effectively useless for users outside of libcrypto.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15564)

2 years agoutils: remove TODO
Pauli [Mon, 31 May 2021 04:37:37 +0000 (14:37 +1000)]
utils: remove TODO

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agocrypto: remove TODOs
Pauli [Mon, 31 May 2021 04:30:07 +0000 (14:30 +1000)]
crypto: remove TODOs

Fixes #15451

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agohttp: remove TODOs
Pauli [Mon, 31 May 2021 04:29:55 +0000 (14:29 +1000)]
http: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agoevp: remove TODOs
Pauli [Mon, 31 May 2021 04:29:55 +0000 (14:29 +1000)]
evp: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agoerr: remove TODOs
Pauli [Mon, 31 May 2021 04:29:55 +0000 (14:29 +1000)]
err: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agoec: remove TODOs
Pauli [Mon, 31 May 2021 04:29:55 +0000 (14:29 +1000)]
ec: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agodso: remove TODOs
Pauli [Mon, 31 May 2021 04:29:55 +0000 (14:29 +1000)]
dso: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agobn: remove TODOs
Pauli [Mon, 31 May 2021 04:29:55 +0000 (14:29 +1000)]
bn: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agorsa: remove TODOs
Pauli [Mon, 31 May 2021 04:29:34 +0000 (14:29 +1000)]
rsa: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agostore: remove TODOs
Pauli [Mon, 31 May 2021 04:29:34 +0000 (14:29 +1000)]
store: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agopem: remove TODOs
Pauli [Mon, 31 May 2021 04:29:34 +0000 (14:29 +1000)]
pem: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agoocsp: remove TODOs
Pauli [Mon, 31 May 2021 04:29:34 +0000 (14:29 +1000)]
ocsp: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agoct: remove TODOs
Pauli [Mon, 31 May 2021 04:29:33 +0000 (14:29 +1000)]
ct: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agocrmf: remove TODOs
Pauli [Mon, 31 May 2021 04:29:33 +0000 (14:29 +1000)]
crmf: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agocomp: remove TODOs
Pauli [Mon, 31 May 2021 04:29:33 +0000 (14:29 +1000)]
comp: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agocms: remove TODOs
Pauli [Mon, 31 May 2021 04:29:33 +0000 (14:29 +1000)]
cms: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agocmp: remove TODOs
Pauli [Mon, 31 May 2021 04:29:33 +0000 (14:29 +1000)]
cmp: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agox509: remove TODOs
Pauli [Mon, 31 May 2021 04:28:45 +0000 (14:28 +1000)]
x509: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agobio: remove TODOs
Pauli [Mon, 31 May 2021 04:28:32 +0000 (14:28 +1000)]
bio: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agoasn.1: remove TODOs
Pauli [Mon, 31 May 2021 04:28:15 +0000 (14:28 +1000)]
asn.1: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agoproviders: remove TODOs
Pauli [Mon, 31 May 2021 04:27:58 +0000 (14:27 +1000)]
providers: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agotls: remove TODOs
Pauli [Mon, 31 May 2021 04:27:48 +0000 (14:27 +1000)]
tls: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agotest: remove TODOs
Pauli [Mon, 31 May 2021 04:27:31 +0000 (14:27 +1000)]
test: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agofuzz: remove TODOs
Pauli [Mon, 31 May 2021 04:27:18 +0000 (14:27 +1000)]
fuzz: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agoapps: remove TODOs
Pauli [Mon, 31 May 2021 04:27:04 +0000 (14:27 +1000)]
apps: remove TODOs

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15539)

2 years agoproviders/common/der/build.info: make a variable for ../include/prov
Richard Levitte [Tue, 1 Jun 2021 05:49:56 +0000 (07:49 +0200)]
providers/common/der/build.info: make a variable for ../include/prov

This is a proof of concept for GENERATE variable expansion.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15554)

2 years agoConfigure: variable expand GENERATE values too
Richard Levitte [Tue, 1 Jun 2021 05:45:54 +0000 (07:45 +0200)]
Configure: variable expand GENERATE values too

Internal documentation doesn't allow for any exception...  Therefore,
even GENERATE values should be variable expanded.

(there are historical reasons why GENERATE was excepted from variable
expansion, that aren't applicable any more)

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15554)

2 years agoFix up bad libcrypto.num
Jon Spillett [Wed, 2 Jun 2021 03:04:04 +0000 (13:04 +1000)]
Fix up bad libcrypto.num

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15576)

2 years agoAdd NCONF_get_section_names()
Tomas Mraz [Thu, 27 May 2021 09:00:35 +0000 (11:00 +0200)]
Add NCONF_get_section_names()

And a few additional fixups to make the no-deprecated configuration
to build.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15466)

2 years agoAdd NCONF_get0_libctx()
Rich Salz [Tue, 25 May 2021 18:48:41 +0000 (14:48 -0400)]
Add NCONF_get0_libctx()

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15466)

2 years agoMake conf_method_st and conf_st deprecated
Rich Salz [Tue, 25 May 2021 16:57:06 +0000 (12:57 -0400)]
Make conf_method_st and conf_st deprecated

So they can be made opaque in a future release.

Fixes #15101

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15466)

2 years agoModify ssl_handshake_hash to call SSLfatal
Trev Larock [Fri, 28 May 2021 12:54:44 +0000 (12:54 +0000)]
Modify ssl_handshake_hash to call SSLfatal

When EVP_MD_CTX_new fails call SSLfatal before the goto err.
This resolves a state machine issue on the out of memory condition.

Fixes #15491.
CLA: trivial

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15520)

2 years agoMake the 00-prep_*.t recipe truly mandatory
Tomas Mraz [Mon, 31 May 2021 15:00:38 +0000 (17:00 +0200)]
Make the 00-prep_*.t recipe truly mandatory

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15550)

2 years agoWindows CI: enable fips on shared 64 bit build
Tomas Mraz [Mon, 31 May 2021 12:22:35 +0000 (14:22 +0200)]
Windows CI: enable fips on shared 64 bit build

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15550)

2 years agoFix enable-fips builds on Windows
Tomas Mraz [Mon, 31 May 2021 12:18:56 +0000 (14:18 +0200)]
Fix enable-fips builds on Windows

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15550)

2 years agoAdd documentation of the old names kept as alias macros
Tomas Mraz [Fri, 28 May 2021 15:36:16 +0000 (17:36 +0200)]
Add documentation of the old names kept as alias macros

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15405)

2 years agoRename also the OSSL_PROVIDER_name() function
Tomas Mraz [Fri, 28 May 2021 14:57:22 +0000 (16:57 +0200)]
Rename also the OSSL_PROVIDER_name() function

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15405)

2 years agoRename all getters to use get/get0 in name
Tomas Mraz [Fri, 21 May 2021 14:58:08 +0000 (16:58 +0200)]
Rename all getters to use get/get0 in name

For functions that exist in 1.1.1 provide a simple aliases via #define.

Fixes #15236

Functions with OSSL_DECODER_, OSSL_ENCODER_, OSSL_STORE_LOADER_,
EVP_KEYEXCH_, EVP_KEM_, EVP_ASYM_CIPHER_, EVP_SIGNATURE_,
EVP_KEYMGMT_, EVP_RAND_, EVP_MAC_, EVP_KDF_, EVP_PKEY_,
EVP_MD_, and EVP_CIPHER_ prefixes are renamed.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15405)

2 years agoPass library context and property query into private key decoders
Jon Spillett [Tue, 18 May 2021 03:37:35 +0000 (13:37 +1000)]
Pass library context and property query into private key decoders

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14587)

2 years agoFix up encoder/decoder issues caused by not passing a library context to the PKCS8...
Jon Spillett [Thu, 6 May 2021 01:55:42 +0000 (11:55 +1000)]
Fix up encoder/decoder issues caused by not passing a library context to the PKCS8 encrypt/decrypt

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14587)

2 years agoEnhance the encoder/decoder tests to allow testing with a non-default library context...
Jon Spillett [Mon, 15 Mar 2021 04:26:09 +0000 (14:26 +1000)]
Enhance the encoder/decoder tests to allow testing with a non-default library context and configurable providers

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14587)

2 years agoreq: fix Coverity 1485137 Explicit null dereference
Pauli [Sun, 30 May 2021 23:26:05 +0000 (09:26 +1000)]
req: fix Coverity 1485137 Explicit null dereference

Add a check for a non-existent file name when specifying params via file.
Add a check for a failure to determine key type.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15534)

2 years agocrypto: updates to pass size_t to RAND_bytes_ex()
Pauli [Mon, 31 May 2021 06:31:18 +0000 (16:31 +1000)]
crypto: updates to pass size_t to RAND_bytes_ex()

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15540)

2 years agossl: ass size_t to RAND_bytes_ex()
Pauli [Mon, 31 May 2021 06:31:04 +0000 (16:31 +1000)]
ssl: ass size_t to RAND_bytes_ex()

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15540)

2 years agorand: use size_t for size argument to RAND_bytes_ex()
Pauli [Mon, 31 May 2021 06:30:50 +0000 (16:30 +1000)]
rand: use size_t for size argument to RAND_bytes_ex()

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15540)

2 years agoMove provider der_XXX.h.in files to the include directory.
Shane Lontis [Mon, 31 May 2021 08:45:44 +0000 (18:45 +1000)]
Move provider der_XXX.h.in files to the include directory.

Fixes #15506

The .in and generated .h files are now in the same directory.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15544)

2 years agoFix error stack for some fetch calls.
Shane Lontis [Sat, 29 May 2021 07:16:22 +0000 (17:16 +1000)]
Fix error stack for some fetch calls.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15532)

2 years agoMigration guide updates for flags and controls.
Shane Lontis [Sat, 29 May 2021 02:47:19 +0000 (12:47 +1000)]
Migration guide updates for flags and controls.

Provided a section that links to the ctrl/flags mappings to parameters
for digests and ciphers.

Added "EVP_CIPHER_CTX_set_flags() ordering" to changes section.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15496)

2 years agoDocument Settable EVP_CIPHER_CTX parameter "use-bits"
Shane Lontis [Sat, 29 May 2021 02:41:43 +0000 (12:41 +1000)]
Document Settable EVP_CIPHER_CTX parameter "use-bits"

Added docs for EVP_CIPHER_CTX_set_flags(),
EVP_CIPHER_CTX_clear_flags() and EVP_CIPHER_CTX_test_flags().

Added section for "FLAGS" to show parameter mappings.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15496)

2 years agoFix param indentation in ciphercommon_hw.c
Shane Lontis [Thu, 27 May 2021 08:13:24 +0000 (18:13 +1000)]
Fix param indentation in ciphercommon_hw.c

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15496)

2 years agoFix aes cfb1 so that it can operate in bit mode.
Shane Lontis [Thu, 27 May 2021 08:08:53 +0000 (18:08 +1000)]
Fix aes cfb1 so that it can operate in bit mode.

The code to handle the cipher operation was already in the provider.
It just needed a OSSL_PARAM in order to set this into the algorithm.
EVP_CIPHER_CTX_set_flags() has been modified to pass the OSSL_PARAM.

Issue reported by Mark Powers from Acumen.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15496)

2 years agoadd some cross compilation builds
Pauli [Mon, 31 May 2021 00:29:55 +0000 (10:29 +1000)]
add some cross compilation builds

Add some cross compiling builds to test things aren't broken.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15535)

2 years agosparc: fix cross compile build
Pauli [Mon, 31 May 2021 05:33:22 +0000 (15:33 +1000)]
sparc: fix cross compile build

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15535)

2 years agoppc: fix ambiguous if if else statement
Pauli [Mon, 31 May 2021 05:16:16 +0000 (15:16 +1000)]
ppc: fix ambiguous if if else statement

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15535)

2 years agoAdd .asn1 dependencies for files generated from providers/common/der/*.in
Richard Levitte [Sat, 29 May 2021 09:15:40 +0000 (11:15 +0200)]
Add .asn1 dependencies for files generated from providers/common/der/*.in

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15533)

2 years agoUpdate solaris64-sparcv9-cc build target cflags
Jan Lana [Thu, 27 May 2021 21:27:58 +0000 (23:27 +0200)]
Update solaris64-sparcv9-cc build target cflags

Fixes #15507

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15509)

2 years agoFix cert creation in the store
Matt Caswell [Fri, 21 May 2021 15:45:58 +0000 (16:45 +0100)]
Fix cert creation in the store

When we create a cert in the store, make sure we do so with the libctx
and propq associated.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15523)

2 years agoAdd the usual autowarn perl snippet in providers/common/der/*.in
Richard Levitte [Fri, 28 May 2021 16:09:51 +0000 (18:09 +0200)]
Add the usual autowarn perl snippet in providers/common/der/*.in

We have this in all other .in files, so these should have that as well.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15524)

2 years agoTeach EVP_PKEYs to say whether they were decoded from explicit params
Matt Caswell [Mon, 24 May 2021 10:40:34 +0000 (11:40 +0100)]
Teach EVP_PKEYs to say whether they were decoded from explicit params

Currently we explicitly downgrade an EVP_PKEY to an EC_KEY and ask
the EC_KEY directly whether it was decoded from explicit parameters or not.
Instead we teach EVP_PKEYs to respond to a new parameter for this purpose.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15526)

2 years agoUpdate check_sig_alg_match() to work with provided keys
Matt Caswell [Tue, 25 May 2021 13:39:29 +0000 (14:39 +0100)]
Update check_sig_alg_match() to work with provided keys

Use EVP_PKEY_is_a() to check whether an EVP_PKEY is compatible with the
given signature.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15528)

2 years agoSpecial case SM2 when decoding
Matt Caswell [Fri, 21 May 2021 10:55:33 +0000 (11:55 +0100)]
Special case SM2 when decoding

SM2 abuses the EC oid by reusing it - but an EC key is different to an SM2
key. Therefore we have to special case SM2 during decoding. If we encounter
the EC OID then we have to try both algorithms.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15522)

2 years agoFixes #14103 & #14102. Update AES demos with error handling and EVP fetch
Jon Spillett [Thu, 29 Apr 2021 01:08:10 +0000 (11:08 +1000)]
Fixes #14103 & #14102. Update AES demos with error handling and EVP fetch

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/15081)

2 years agoFix PKCS7_verify to not have an error stack if it succeeds.
Shane Lontis [Fri, 28 May 2021 01:42:41 +0000 (11:42 +1000)]
Fix PKCS7_verify to not have an error stack if it succeeds.

Revert a change in behavior to BIO_write(). If a NULL BIO
is passed, no error is raised and the return value is 0. There are
many places where the return code from the write was not checked,
resulting in an error stack with no error status being returned.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15493)

2 years agofips: set the library context and handle later
Pauli [Fri, 28 May 2021 00:25:55 +0000 (10:25 +1000)]
fips: set the library context and handle later

They need to be set once the provider will definitely be loading.  If they
are set earlier, a double free results on a failure.

Fixes #15452

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15492)

2 years agomake update-fips-checksums
Richard Levitte [Sat, 29 May 2021 09:06:44 +0000 (11:06 +0200)]
make update-fips-checksums

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15514)

2 years agoRearrange the check of providers/fips.so dependencies
Richard Levitte [Fri, 28 May 2021 05:54:04 +0000 (07:54 +0200)]
Rearrange the check of providers/fips.so dependencies

The mechanism had special cases to guess when something was generated
from a .in file.  It's better, though, to use the knowledge in
configdata.pm, especially when the generated file is in a different
location than its source.

Cleanups are added, and we change the use of sed to a use of perl
when cleaning up paths with 'something/../' in them, since perl has
more powerful tools for this sort of thing.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15514)

2 years agoMake providers/fips.module.sources.new depend on configdata.pm
Richard Levitte [Fri, 28 May 2021 05:52:37 +0000 (07:52 +0200)]
Make providers/fips.module.sources.new depend on configdata.pm

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15514)

2 years agoconfigdata.pm: Allow extra arguments when --query is given.
Richard Levitte [Fri, 28 May 2021 05:51:05 +0000 (07:51 +0200)]
configdata.pm: Allow extra arguments when --query is given.

That allows operations like this:

    ./configdata.pm --query 'get_sources(@ARGV)' file1 file2 file3

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15514)

2 years agoadd zero strenght arguments to BN and RAND RNG calls
Pauli [Fri, 28 May 2021 04:46:40 +0000 (14:46 +1000)]
add zero strenght arguments to BN and RAND RNG calls

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)

2 years agoprov: add zero strenght arguments to BN and RAND RNG calls
Pauli [Fri, 28 May 2021 04:46:17 +0000 (14:46 +1000)]
prov: add zero strenght arguments to BN and RAND RNG calls

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)

2 years agossl: add zero strenght arguments to BN and RAND RNG calls
Pauli [Fri, 28 May 2021 04:45:57 +0000 (14:45 +1000)]
ssl: add zero strenght arguments to BN and RAND RNG calls

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)

2 years agotest: add zero strenght arguments to BN and RAND RNG calls
Pauli [Fri, 28 May 2021 04:45:43 +0000 (14:45 +1000)]
test: add zero strenght arguments to BN and RAND RNG calls

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)

2 years agorand: add a strength argument to the BN and RAND RNG calls
Pauli [Fri, 28 May 2021 04:45:06 +0000 (14:45 +1000)]
rand: add a strength argument to the BN and RAND RNG calls

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)

2 years agodoc: document the strength arugments to the RNG functions
Pauli [Fri, 28 May 2021 04:44:38 +0000 (14:44 +1000)]
doc: document the strength arugments to the RNG functions

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)

2 years agoMake undef'd counts zero by default.
Rich Salz [Tue, 25 May 2021 17:42:45 +0000 (13:42 -0400)]
Make undef'd counts zero by default.

Fixes #15409

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15467)

2 years agoec: Add PPC64 vector assembly version of p521 field operations
Amitay Isaacs [Tue, 13 Oct 2020 09:11:40 +0000 (05:11 -0400)]
ec: Add PPC64 vector assembly version of p521 field operations

Only field multiplication and squaring (but not reduction) show a
significant improvement.  This is enabled on Power ISA >= 3.0.

On a Power 9 CPU an average 10% performance improvement is seen (ECHDE:
14%, ECDSA sign: 6%, ECDSA verify 10%), compared to existing code.

On an upcoming Power 10 CPU we see an average performance improvement
of 26% (ECHDE: 38%, ECDSA sign: 16%, ECDSA verify 25%), compared to
existing code.

Signed-off-by: Amitay Isaacs <amitay@ozlabs.org>
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15401)

2 years agoec: Add run time code selection for p521 field operations
Martin Schwenke [Wed, 12 May 2021 04:21:58 +0000 (14:21 +1000)]
ec: Add run time code selection for p521 field operations

This is only used if ECP_NISTP521_ASM is defined and this currently
only occurs on PPC64.

This simply chooses the C reference implementation, which will be the
default when custom code is available for certain CPUs.

Only the multiplication and squaring operations are handled, since the
upcoming assembly code only contains those.  This scheme can be easily
extended to handle reduction too.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15401)

2 years agoec: Rename reference p521 field operations and use them via macros
Martin Schwenke [Wed, 12 May 2021 01:47:55 +0000 (11:47 +1000)]
ec: Rename reference p521 field operations and use them via macros

This will allow clean addition of assembly versions of these operations.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15401)

2 years agoperlasm/ppc-xlate.pl: Handle rewriting of vector registers
Martin Schwenke [Wed, 2 Dec 2020 08:05:44 +0000 (19:05 +1100)]
perlasm/ppc-xlate.pl: Handle rewriting of vector registers

Power has 2 numbering systems for vector registers:

* VR: Vector Registers are numbered from 0 to 31
* VSR: Vector-Scalar registers are numbers from 32 to 63

These refer to the same registers.  Some instructions use VR numbering
for their operands, while others use VSR numbering.

When using Perl to provide a meaningful name for a register it makes
sense to use the same variable for both VR and VSR instructions.  This
makes the code more readable.

However, providing a VSR number (i.e. >=32) to an instruction that
expects a VR number will cause an assembler error.

So, for instructions that require VR numbering, map VSR numbers
(i.e. >=32) to VR numbers.  This also allows existing code that uses
VR numbering to remain unchanged.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15401)

2 years agoBIO acpt_state(): Allow retrying addresses (e.g., using IPv6 vs. IPv4) on creating...
Dr. David von Oheimb [Tue, 25 May 2021 06:43:59 +0000 (08:43 +0200)]
BIO acpt_state(): Allow retrying addresses (e.g., using IPv6 vs. IPv4) on creating accept socket

Fixes #15386

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15417)

2 years agoBIO_s_accept.pod: Add missing documentation for BIO_{get,set}_accept_ip_family()
Dr. David von Oheimb [Mon, 24 May 2021 11:02:55 +0000 (13:02 +0200)]
BIO_s_accept.pod: Add missing documentation for BIO_{get,set}_accept_ip_family()

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15417)