Pauli [Fri, 11 Jun 2021 05:13:02 +0000 (15:13 +1000)]
ci: run the on pull request CIs on push to master
This will help catch problems caused by merging.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15711)
Dr. David von Oheimb [Thu, 10 Jun 2021 17:36:35 +0000 (19:36 +0200)]
d2i_X509: revert calling X509v3_cache_extensions()
Fixes #13754
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15705)
Richard Levitte [Fri, 11 Jun 2021 02:30:22 +0000 (04:30 +0200)]
Windows GitHub CI: Introduce --strict-warnings
This involves making a more comprehensive matrix for the different
architectures we build for.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15709)
Richard Levitte [Fri, 11 Jun 2021 01:58:49 +0000 (03:58 +0200)]
Windows Github CI: test in Windows 2016 as well
This brings an older version of MSVC, which may bring some "interesting"
failures.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15709)
Richard Levitte [Fri, 11 Jun 2021 15:22:44 +0000 (17:22 +0200)]
Building: Add necessary dependencies for linker scripts and .rc files
These files depend on the data from configdata.pm, so need a dependency
on that one to always be properly updated. The same goes for .rc files.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15717)
Richard Levitte [Thu, 10 Jun 2021 07:15:58 +0000 (09:15 +0200)]
Configure: Allow spaces around '=' in all build.info statements
This was allowed already for some statements, but not consistently for all.
Fixes #15684
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15691)
Dr. David von Oheimb [Wed, 9 Jun 2021 07:40:48 +0000 (09:40 +0200)]
Rename OSSL_HTTP_set_request() to OSSL_HTTP_set1_request() for clarity
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15697)
Dr. David von Oheimb [Wed, 9 Jun 2021 07:35:32 +0000 (09:35 +0200)]
HTTP client: Fix GET request handling when rctx is reused (keep-alive)
This also updates the documentation of OSSL_HTTP_REQ_CTX_set1_req().
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15697)
William Edmisten [Mon, 1 Mar 2021 23:33:29 +0000 (18:33 -0500)]
Add support for ISO 8601 datetime format
Fixes #5430
Added the configuration file option "date_opt" to the openssl applications ca,
crl and x509.
Added ASN1_TIME_print_ex which supports the new datetime format using the
flag ASN1_DTFLGS_ISO8601
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14384)
Robbie Harwood [Mon, 24 May 2021 21:11:53 +0000 (17:11 -0400)]
Update krb5 module and re-enable pkinit tests
pkinit tests were disabled in
cd0aca532091de4dfadf2f12b18dd99e9cba7615
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15444)
Tomas Mraz [Thu, 10 Jun 2021 07:58:43 +0000 (09:58 +0200)]
Do not depend on the exact exit failure value of dgst app
On most platforms the EXIT_FAILURE is 1 but on NonStop platform
the EXIT_FAILURE is -1 truncated to 255.
Fixes #15633
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15694)
Richard Levitte [Thu, 10 Jun 2021 07:41:22 +0000 (09:41 +0200)]
Clean away remaining Travis related files
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15692)
Tomas Mraz [Thu, 10 Jun 2021 14:55:37 +0000 (16:55 +0200)]
fuzz/asn1parse: Use BIO_s_mem() as fallback output
/dev/null is not available everywhere.
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15672)
Tomas Mraz [Wed, 9 Jun 2021 11:48:21 +0000 (13:48 +0200)]
BIO_write_ex: No error only on 0 bytes to write
Fixes #15682
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15672)
Tomas Mraz [Wed, 9 Jun 2021 10:27:51 +0000 (12:27 +0200)]
Windows CI: Enable fuzz test in plain build
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15672)
Richard Levitte [Fri, 11 Jun 2021 02:55:03 +0000 (04:55 +0200)]
apps/lib/s_socket.c: Alias getpid with _getpid for _WIN32
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15710)
Todd Short [Wed, 9 Jun 2021 14:03:10 +0000 (10:03 -0400)]
Fix FIPS provider value in docs
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15676)
Richard Levitte [Thu, 10 Jun 2021 05:25:56 +0000 (07:25 +0200)]
STORE: Make OSSL_STORE_LOADER_fetch() consistent with all other fetch functions
The argument order was different on this one.
Fixes #15688
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15689)
Tomas Mraz [Wed, 9 Jun 2021 15:04:12 +0000 (17:04 +0200)]
Document that provider name can be a full path
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15680)
Tomas Mraz [Wed, 9 Jun 2021 14:42:35 +0000 (16:42 +0200)]
dl_name_converter: Avoid unnecessary overallocation
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15680)
Tomas Mraz [Wed, 9 Jun 2021 14:27:05 +0000 (16:27 +0200)]
ossl_provider_set_module_path: Prevent potential UAF
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15680)
Richard Levitte [Thu, 10 Jun 2021 14:43:27 +0000 (16:43 +0200)]
OpenSSL::Test: If __cwd() is to create the directory, do it early
This is to ensure that abs_path() has an existing directory to look at.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15701)
Shane Lontis [Wed, 9 Jun 2021 07:34:55 +0000 (17:34 +1000)]
Fix s_server app to not report an error when using a non DH certificate.
Fixes #15071
It always tries loading the cert as DH which previously did not produce
an error. The errors are not suppressed for these operations.
The output now matches previous versions of OpenSSL.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15670)
Richard Levitte [Thu, 10 Jun 2021 11:00:54 +0000 (13:00 +0200)]
OpenSSL::Test: Treat SRCDATA directory specially, as it might not exist
Not all tests come with a SRCDATA directory. if it doesn't exist, we
simply drop it from the internal table of directories.
OpenSSL::Test::srcdata_dir() and OpenSSL::Test::srcdata_file() may
return undef in that case. However, recipes shouldn't try to refer to
a non-existing data directory, so if that happens, it's a programming
error and must be corrected.
Fixes #15679
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15700)
Petr Gotthard [Tue, 8 Jun 2021 17:57:48 +0000 (19:57 +0200)]
doc: fix OSSL_PARAM_BLD pointers in the example
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15663)
Tomas Mraz [Tue, 8 Jun 2021 16:25:09 +0000 (18:25 +0200)]
store: Avoid spurious error from decoding at EOF
Fixes #15596
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15661)
Arran Cudbard-Bell [Tue, 8 Jun 2021 21:45:38 +0000 (16:45 -0500)]
Enable ssl-trace by default
There doesn't appear to be a good reason to omit protocol message tracing by default.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15665)
Todd Short [Fri, 5 Apr 2019 18:17:22 +0000 (14:17 -0400)]
Optimize session cache flushing
Sort SSL_SESSION structures by timeout in the linked list.
Iterate over the linked list for timeout, stopping when no more
session can be flushed.
Do SSL_SESSION_free() outside of SSL_CTX lock
Update timeout upon use
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/8687)
Tomas Mraz [Mon, 7 Jun 2021 14:56:20 +0000 (16:56 +0200)]
Fix use after free in OSSL_HTTP_REQ_CTX_set1_req()
Fixes #15647
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15648)
Pauli [Wed, 9 Jun 2021 01:58:48 +0000 (11:58 +1000)]
err: clear flags better when clearing errors.
An attempt to clear an error with malloced data didn't clear the flags.
Now it clears all flags except the malloced flag.
Fixes #12530
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15667)
Richard Levitte [Tue, 8 Jun 2021 10:22:31 +0000 (12:22 +0200)]
APPS: Restore the possibility to combine -pubout with -text
This applies to the 'openssl pkey' command.
Fixes #15645
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15658)
Pauli [Wed, 9 Jun 2021 03:40:54 +0000 (13:40 +1000)]
util: convert SHA* one shots back to being functions
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/15668)
Pauli [Wed, 9 Jun 2021 03:40:27 +0000 (13:40 +1000)]
changes: fix woring that mentions SHA* one shot functions are deprecated
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/15668)
Pauli [Wed, 9 Jun 2021 03:38:30 +0000 (13:38 +1000)]
sha: convert SHA one shot macros back to being functions
Fixes #15655
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/15668)
Richard Levitte [Thu, 27 May 2021 10:51:04 +0000 (12:51 +0200)]
DECODER & ENCODER: Add better tracing
Now that we have functions to get the name and properties of the
diverse implementations, we can as well display them for clarity.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15498)
Richard Levitte [Thu, 27 May 2021 10:44:19 +0000 (12:44 +0200)]
DECODER: Adapt addition of extra decoder implementations
The new PKCS#8 decoder implementation decodes from DER to DER.
OSSL_DECODER_CTX_add_extra() wasn't suited for this case; we had to
modify it to walk through all existing decoder implementations, and
filter out those that aren't suitable.
This also turns out to fix the possibility to have more than one extra
decoder implementation that produces the same type of encoding, for
example several different wrapper formats that all decoder into DER.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15498)
Richard Levitte [Thu, 27 May 2021 10:34:03 +0000 (12:34 +0200)]
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8
This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo",
which is sensible considering we already have "SubjectPublicKeyInfo".
We also add "EncryptedPrivateKeyInfo", and use it for a special decoder
that detects and decrypts an EncryptedPrivateKeyInfo structured DER
blob into a PrivateKeyInfo structured DER blob and passes that on to
the next decoder implementation.
The result of this change is that PKCS#8 decryption should only happen
once per decoding instead of once for every expected key type.
Furthermore, this new decoder implementation sets the data type to the
OID of the algorithmIdentifier field, thus reducing how many decoder
implementations are tentativaly run further down the call chain.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15498)
Dr. David von Oheimb [Tue, 8 Jun 2021 09:54:20 +0000 (11:54 +0200)]
25-test_verify.t: Add test case: accept trusted self-signed EE cert with key usage keyCertSign also when strict
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15656)
Dr. David von Oheimb [Tue, 8 Jun 2021 09:23:34 +0000 (11:23 +0200)]
test/certs/mkcert.sh: Correct description of geneealt parameters
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15656)
Dr. David von Oheimb [Mon, 7 Jun 2021 10:16:25 +0000 (12:16 +0200)]
25-test_verify.t: Prevent expiration of test case 'Name constraints bad othername name constraint'
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15656)
Dr. David von Oheimb [Mon, 7 Jun 2021 09:50:43 +0000 (11:50 +0200)]
80-test_cmp_http.t: Improve the way the test server is launched and killed
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15642)
Dr. David von Oheimb [Mon, 7 Jun 2021 09:44:23 +0000 (11:44 +0200)]
80-test_cmp_http.t: Simplify and prevent hangs on server not launching/behaving correctly
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15642)
Rich Salz [Mon, 7 Jun 2021 16:06:26 +0000 (12:06 -0400)]
Remove I_CAN_LIVE_WITH_LNK4049
Fixes #9332
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15649)
Pauli [Tue, 8 Jun 2021 03:50:38 +0000 (13:50 +1000)]
keymgmt: better detect when a key manager can be reused
Fixes #14159
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15652)
Richard Levitte [Mon, 7 Jun 2021 12:10:17 +0000 (14:10 +0200)]
OpenSSL::Test.pm: Replace all uses of rel2abs() with abs_path()
rel2abs() doesn't clean the path well enough, which may lead to odd
results when calculating new paths. abs_path() works better for this
sort of thing.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15644)
Matt Caswell [Mon, 7 Jun 2021 13:54:24 +0000 (14:54 +0100)]
Correctly detect decode errors when checking if a key is supported
If we have an unsupported key type we may get a decode error and
therefore we should detect that.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15504)
Matt Caswell [Fri, 4 Jun 2021 13:16:42 +0000 (14:16 +0100)]
Simplify error reporting in X509_PUBKEY_get0()
The X509_PUBKEY_get0() was attempting to recreate any errors that might
have occurred from the earlier decode process when obtaining the EVP_PKEY.
This is brittle at best and the approach would only work with legacy keys.
We remove this and just report an error directly.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15504)
Matt Caswell [Fri, 28 May 2021 13:03:25 +0000 (14:03 +0100)]
Use the fips-and-base.cnf config file in CMP tests
Two CMP tests were using the fips.cnf config file. However to
ensure that decoders are available the fips-and-base.cnf config
file needs to be used instead.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15504)
Matt Caswell [Fri, 28 May 2021 12:39:17 +0000 (13:39 +0100)]
Mark some priv/public key paris as only available in the default provider
Now that we actually load public keys from providers we need to mark some
key paris in the evp tests as only available there. Otherwise we get test
failures when only the FIPS Provider is loaded.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15504)
Matt Caswell [Fri, 28 May 2021 10:07:24 +0000 (11:07 +0100)]
Actually use a legacy route in pem_read_bio_key_legacy()
The function pem_read_bio_key_legacy() is a fallback route if we
failed to load a key via a provider. We should be using the legacy
specific d2i functions to force legacy otherwise we end up using a
provider anyway
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15504)
Matt Caswell [Thu, 27 May 2021 17:00:07 +0000 (18:00 +0100)]
Just look for "Unable to load Public Key" if no SM2
The X509 test was looking for some specific errors when printing an SM2
X509 certificate when SM2 is disabled. In fact these errors appear in the
middle of the certificate printing which is quite odd. There is also a
separate error "Unable to load Public Key" which is more cleanly printed.
With the recent change to using provided keys in certs the old errors are
no longer output. However printing them in the middle of the cert is
probably not right anyway. So we just rely on the "Unable to load Public
Key" message.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15504)
Matt Caswell [Thu, 27 May 2021 15:48:37 +0000 (16:48 +0100)]
Only use the legacy route to decode a public key if we have to
We should use a provider to decode a SubjectPublicKeyInfo structure if
we can. We should only use the legacy route if we are forcing legacy, or
if an ENGINE is in use.
Fixes #15393
Fixes #15327
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15504)
Matt Caswell [Thu, 27 May 2021 15:47:14 +0000 (16:47 +0100)]
Ensure that we consume all the data when decoding an SPKI
If we are decoding a SubjectPublicKeyInfo structure then we must use all
of the data and must not have bytes "left over".
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15504)
Matt Caswell [Thu, 27 May 2021 15:24:00 +0000 (16:24 +0100)]
Use the right class/tag when decoding an embedded key
When a key (SubjectPublicKeyInfo) is embedded in some other structure
it may use an implicit tag. However the decoders can only handle the
universal class and don't know how to interpret the implicit tag.
Therefore we modify the data into a form the decoders can handle.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15504)
Matt Caswell [Tue, 25 May 2021 14:19:56 +0000 (15:19 +0100)]
Fix CTLOG_new_from_base64_ex()
Ensure that the libctx/propq are passed to d2i_PUBKEY_ex()
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15504)
Matt Caswell [Fri, 21 May 2021 16:26:35 +0000 (17:26 +0100)]
Fix the expected output of printing certificates
Now that we are using provided keys when loading a certificate the pretty
printing formatting is cosmetically different. We need to adjust expected
test output accordingly.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15504)
Tomas Mraz [Mon, 7 Jun 2021 09:54:04 +0000 (11:54 +0200)]
EVP_PKEY_new_raw_private_key: Allow zero length keys
Allocate at least one byte to distinguish a zero length key
from an unset key.
Fixes #15632
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15643)
Larkin Nickle [Wed, 2 Jun 2021 18:17:40 +0000 (14:17 -0400)]
Fix compilation on systems with empty _POSIX_TIMERS
Systems such as Tru64 ship with broken headers that
have _POSIX_TIMERS defined but empty.
CLA: trivial
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15598)
Pauli [Mon, 7 Jun 2021 11:07:21 +0000 (21:07 +1000)]
evp: avoid some calls to EVP_CIPHER_CTX_get_iv_length() because it's been called already
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15635)
Pauli [Sun, 6 Jun 2021 23:49:04 +0000 (09:49 +1000)]
evp: fix Coverity
1485670 argument cannot be negative
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15635)
Pauli [Sun, 6 Jun 2021 23:45:40 +0000 (09:45 +1000)]
evp: fix Coverity
1485669 improper use of negative value
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15635)
Pauli [Sun, 6 Jun 2021 23:42:54 +0000 (09:42 +1000)]
evp: fix Coverity
1485668 argument cannot be negative
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15635)
Pauli [Sun, 6 Jun 2021 23:39:55 +0000 (09:39 +1000)]
pkcs12: fix Coverity
1485667 logically dead code
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15635)
Pauli [Sun, 6 Jun 2021 23:36:04 +0000 (09:36 +1000)]
evp: fix coverity
1485666 argument cannot be negative
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15635)
Pauli [Sun, 6 Jun 2021 23:28:49 +0000 (09:28 +1000)]
evp: fix improper use of negative value issues
Coverity issues
1485662,
1485663 &
1485664.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15635)
Pauli [Sun, 6 Jun 2021 23:26:42 +0000 (09:26 +1000)]
afalg: fix coverity
1485661 improper use of negative value
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15635)
Pauli [Sun, 6 Jun 2021 23:23:41 +0000 (09:23 +1000)]
fix coverity
1485660 improper use of negative value
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15635)
Pauli [Sun, 6 Jun 2021 23:20:16 +0000 (09:20 +1000)]
bio: improve error checking fixing coverity
1485659 &
1485665
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15635)
Pauli [Mon, 7 Jun 2021 09:05:54 +0000 (19:05 +1000)]
doc: add PKEY life cycle documentation
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Pauli [Mon, 7 Jun 2021 09:07:30 +0000 (19:07 +1000)]
doc: build changes for PKEY life cycle documentation
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Pauli [Mon, 7 Jun 2021 05:14:47 +0000 (15:14 +1000)]
doc: add build info for cipher life cycle documentation
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Pauli [Mon, 7 Jun 2021 05:14:25 +0000 (15:14 +1000)]
doc: add references to cipher life cycle documentation
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Pauli [Mon, 7 Jun 2021 05:11:28 +0000 (15:11 +1000)]
doc: add cipher life cycle documentation
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Pauli [Mon, 7 Jun 2021 04:41:27 +0000 (14:41 +1000)]
doc: improve the cipher life cycle diagram
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Pauli [Mon, 7 Jun 2021 02:38:25 +0000 (12:38 +1000)]
doc-nits: support out of source execution
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Pauli [Mon, 7 Jun 2021 02:35:06 +0000 (12:35 +1000)]
doc: remove empty section
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Pauli [Mon, 7 Jun 2021 02:28:29 +0000 (12:28 +1000)]
doc: add references to digest life cycle documentation
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Pauli [Mon, 7 Jun 2021 02:28:02 +0000 (12:28 +1000)]
doc: add digest life cycle documentation
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Pauli [Mon, 7 Jun 2021 02:27:39 +0000 (12:27 +1000)]
doc: add digest lifecycle diagram
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Pauli [Mon, 7 Jun 2021 02:27:17 +0000 (12:27 +1000)]
life-cycles: update digest state table
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15637)
Daniel Bevenius [Mon, 7 Jun 2021 04:01:54 +0000 (06:01 +0200)]
Add aix64-gcc-as architecture and p2align callback
This commit adds an architecture named aix64-gcc-as which can generate
assembler source code compatible with AIX assembler (as) instead of the
GNU Assembler (gas). This architecture name is then used in a callback
for the .p2align directive which is not available in AIX as.
The motivation for this addition came out of an issue we ran into when
working on upgrading OpenSSL in Node.js. We ran into the following
compilation error on one of the CI machines that uses AIX:
05:39:05 Assembler:
05:39:05 crypto/bn/ppc64-mont-fixed.s: line 4: Error In Syntax
This machine is using AIX Version 7.2 and does not have gas installed
and the .p2align directive is causing this error. After asking around if
it would be possible to install GAS on this machine I learned that AIX
GNU utils are not maintained as well as the native AIX ones and we
(Red Hat/IBM) have run into issues with the GNU utils in the past and if
possible it would be preferable to be able to use the AIX native
assembler.
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15638)
Tomas Mraz [Fri, 4 Jun 2021 11:56:41 +0000 (13:56 +0200)]
X509_digest_sig: Handle RSA-PSS and EDDSA certificates
Identify digest from sigalg params for RSA-PSS and fallback
to SHA-256 for EDDSA.
Fixes #15477
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/15618)
Dr. David von Oheimb [Thu, 4 Mar 2021 07:47:51 +0000 (08:47 +0100)]
Move trust-related decls from x509.h.in to x509_vfy.h.in
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13735)
Dr. David von Oheimb [Thu, 4 Mar 2021 06:36:21 +0000 (07:36 +0100)]
x509.h.in: extended 'documenting' comment on X509_TRUST_OK_ANY_EKU
This hopefully alleviates the fact that the name is unclear/misleading.
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13735)
Dr. David von Oheimb [Wed, 23 Dec 2020 22:29:04 +0000 (23:29 +0100)]
Improve the documentation of cert path building and validation
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13735)
Dr. David von Oheimb [Mon, 4 Jan 2021 07:50:42 +0000 (08:50 +0100)]
X509_STORE_CTX_new.pod and x509_vfy.h.in: rename some params for clarity, improve their doc
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13735)
Dr. David von Oheimb [Mon, 4 Jan 2021 07:49:17 +0000 (08:49 +0100)]
x509_vfy.c: Improve a couple of internally documenting comments
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13735)
Dr. David von Oheimb [Mon, 4 Jan 2021 07:48:24 +0000 (08:48 +0100)]
x509_trs.c: rename to x509_trust.c and correct comment in trust_compat()
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13735)
Shane Lontis [Mon, 7 Jun 2021 01:33:28 +0000 (11:33 +1000)]
Fix AIX FIPS DEP.
The entry point needs the option 'binitfini', but it was not being
added since the perl code to detect the match did not work.
The entry point for AIX is no longer static - so a wrapper has been
added to call the static version.
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15636)
Dr. David von Oheimb [Thu, 3 Jun 2021 10:56:11 +0000 (12:56 +0200)]
BIO_write-ex(): Improve behavior in corner cases and documentation
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15608)
Shane Lontis [Thu, 3 Jun 2021 09:09:38 +0000 (19:09 +1000)]
Add a gettable for provider ciphers to return the EVP_CIPH_RAND_KEY flag
Fixes #15531
DES and TDES set this flag which could possibly be used by applications.
The gettable cipher param OSSL_CIPHER_PARAM_HAS_RAND_KEY has been added.
Note that EVP_CIPHER_CTX_rand_key() uses this flag.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15606)
Shane Lontis [Thu, 3 Jun 2021 00:54:13 +0000 (10:54 +1000)]
Document missing EC/SM2 params
Fixes #15548
Document OSSL_PKEY_PARAM_EC_PUB_X, OSSL_PKEY_PARAM_EC_PUB_Y and OSSL_PKEY_PARAM_DEFAULT_DIGEST
Added a section related to parameters for SM2.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15601)
Juergen Christ [Wed, 2 Jun 2021 17:33:50 +0000 (19:33 +0200)]
Test EVP_CipherInit sequences and resets
Various EVP_CipherInit sequences including partial inits and initializations
with different "enc" flags caused problems on s390x. Similarly, cipher
reinitialization and especially GCM reinitialization with different tag length
led to wrong results. Add some unit tests to cover these rather exotic use
cases.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15521)
Juergen Christ [Fri, 28 May 2021 13:02:52 +0000 (15:02 +0200)]
Fix CipherInit on s390x.
Various different initialization sequences led to bugs on s390x due to caching
and processing during key setting. Since, e.g., the direction does not
necessarily have to be correct during initialization, this produced bugs in
s390x which were not present on other architectures. Fix this by recomputing
the function codes on the fly during updates and final operations.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15521)
FdaSilvaYY [Thu, 3 Jun 2021 14:28:21 +0000 (16:28 +0200)]
Use rd instead rmdir
to avoid collision with rmdir.exe from cygwin or msys
Original idea by Mladen Turk @mturk
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15610)
Matt Caswell [Fri, 4 Jun 2021 08:39:32 +0000 (09:39 +0100)]
Fix generate_ssl_tests.pl
Fix the generate_ssl_tests.pl script so that it can be run standalone from
the command line according to the instructions in test/README.ssltest.md
Fixes #11430
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15617)
Tomas Mraz [Fri, 4 Jun 2021 15:01:24 +0000 (17:01 +0200)]
Elimination of some sources not needed in the FIPS_MODULE
Unfortunately in terms of fips.sources this does not mean much
given the way how the .h files are added via the dependency
information from the compiler.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15622)
Richard Levitte [Wed, 2 Jun 2021 19:19:18 +0000 (21:19 +0200)]
test/recipes/80-test_cmp_http.t: Don't trust $server_port in start_mock_server()
Even if $server_port isn't touched, it's still a number coming from
configuration. It's therefore not trustable as an indicator that the
ACCEPT line delivered a port number or an error indication.
$accept_msg is used instead to capture the port if there is one, and
be a better indicator of error.
Fixes #15557
Fixes #15571
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/15580)
Richard Levitte [Wed, 2 Jun 2021 06:14:08 +0000 (08:14 +0200)]
test/recipes/80-test_cmp_http.t: Simplify test_cmp_http()
test_cmp_http() made some assumptions about what values that exit_checker
could get that aren't quite right.
Furthermore, the expected result isn't about exit codes, but about
true or false. This is better served by getting the value from
OpenSSL::Test::run(), and checking that value against $expected_result
with Test::More::is().
Fixes #15557
Fixes #15571
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/15580)
Pauli [Fri, 4 Jun 2021 10:14:07 +0000 (20:14 +1000)]
doc: update generated image files
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15616)