2 years agoAdd doc/ to build the documentation
Richard Levitte [Wed, 31 Aug 2016 20:56:02 +0000 (22:56 +0200)]
Add doc/ to build the documentation

This is entirely generated when configuring

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoAdd the possibility to generate documentation at build time
Richard Levitte [Wed, 31 Aug 2016 20:54:39 +0000 (22:54 +0200)]
Add the possibility to generate documentation at build time

Reviewed-by: Matt Caswell <>
(Merged from

2 years, util/ load 'platform' unconditionally
Richard Levitte [Mon, 25 Nov 2019 11:53:19 +0000 (12:53 +0100)], util/ load 'platform' unconditionally

The 'platform' module handles defaults fine, there's no need to add
extra conditions on it being loaded.

Fixes #10513

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoapps/ocsp.c: sock_timeout -> socket_timeout
Richard Levitte [Mon, 25 Nov 2019 12:27:33 +0000 (13:27 +0100)]
apps/ocsp.c: sock_timeout -> socket_timeout

It appears that 'sock_timeout' is defined at least with DJGPP, so we
rename our symbol and hope the new name isn't taken.

Reviewed-by: Tim Hudson <>
(Merged from

2 years agoFix L<EVP_MD_CTX_set_pkey_ctx> links
moehuster [Tue, 12 Nov 2019 11:28:51 +0000 (19:28 +0800)]
Fix L<EVP_MD_CTX_set_pkey_ctx> links

Reviewed-by: Matt Caswell <>
Reviewed-by: Richard Levitte <>
(Merged from

(cherry picked from commit ca7c982821cd6d7546f92623da61a6f43ee32d0a)

2 years agochacha/asm/ preserve FP registers d8 and d9 correctly
Ard Biesheuvel [Thu, 21 Nov 2019 17:13:41 +0000 (18:13 +0100)]
chacha/asm/ preserve FP registers d8 and d9 correctly

Depending on the size of the input, we may take different paths through
the accelerated arm64 ChaCha20 routines, each of which use a different
subset of the FP registers, some of which need to be preserved and
restored, as required by the AArch64 calling convention (AAPCS64)

In some cases, (e.g., when the input size is 640 bytes), we call the 512
byte NEON path followed directly by the scalar path, and in this case,
we preserve and restore d8 and d9, only to clobber them again
immediately before handing over to the scalar path which does not touch
the FP registers at all, and hence does not restore them either.

Fix this by moving the restoration of d8 and d9 to a later stage in the
512 byte routine, either before calling the scalar path, or when exiting
the function.

Fixes #10470
CLA: trivial

Reviewed-by: Paul Dale <>
Reviewed-by: Matt Caswell <>
(Merged from

2 years agoUse option/parameter consistently.
Rich Salz [Thu, 21 Nov 2019 23:14:12 +0000 (18:14 -0500)]
Use option/parameter consistently.

Reviewed-by: Richard Levitte <>
Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoDocument more env var stuff, fix some typo's
Rich Salz [Wed, 9 Oct 2019 19:45:12 +0000 (15:45 -0400)]
Document more env var stuff, fix some typo's

Add openssl-env.pod
Also fix up many other environment page formatting nits.

Reviewed-by: Richard Levitte <>
Reviewed-by: Tomas Mraz <>
(Merged from

2 years agotest/cipher_overhead_test.c: build unconditionally
Richard Levitte [Mon, 25 Nov 2019 15:30:51 +0000 (16:30 +0100)]
test/cipher_overhead_test.c: build unconditionally

Build it against static libraries always, since that's the only way it
can work as intended.

Reviewed-by: Paul Dale <>
(Merged from

2 years agoutil/find-doc-nits: Better parsing of links
Richard Levitte [Sat, 23 Nov 2019 20:41:35 +0000 (21:41 +0100)]
util/find-doc-nits: Better parsing of links

When checking links, we need to peal away stuff that aren't part of
the link proper first.  That makes it easier to check the link

Reviewed-by: Paul Dale <>
(Merged from

2 years agodoc/man7/proxy-certificates.pod: New guide for proxy certificates
Richard Levitte [Sat, 23 Nov 2019 09:36:16 +0000 (10:36 +0100)]
doc/man7/proxy-certificates.pod: New guide for proxy certificates

This replaces doc/HOWTO/proxy_certificates.txt

Reviewed-by: Paul Dale <>
(Merged from

2 years agoProperty: fix memory leak.
Pauli [Sun, 24 Nov 2019 08:15:15 +0000 (18:15 +1000)]
Property: fix memory leak.

Coverity 1456008.

Reviewed-by: Matthias St. Pierre <>
(Merged from

2 years agoCache constants for fetched EVP_cipher
Shane Lontis [Mon, 18 Nov 2019 00:32:36 +0000 (10:32 +1000)]
Cache constants for fetched EVP_cipher

Reviewed-by: Tomas Mraz <>
Reviewed-by: Paul Dale <>
Reviewed-by: Patrick Steuer <>
(Merged from

2 years agoSupport ciphersuites using a SHA2 384 digest in FreeBSD KTLS.
John Baldwin [Thu, 31 Oct 2019 23:51:08 +0000 (16:51 -0700)]
Support ciphersuites using a SHA2 384 digest in FreeBSD KTLS.

Reviewed-by: Kurt Roeckx <>
Reviewed-by: Richard Levitte <>
GH: #10372

2 years agoProperty: fix intermittent test failure.
Pauli [Fri, 22 Nov 2019 22:04:38 +0000 (08:04 +1000)]
Property: fix intermittent test failure.

The reduction in the cache flush threshold in #10408 caused the stochastic test
to fail with noticeable probability.  Revert that part of the change.

Also add a comment to help avoid this in future.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoRemove RANDFILE settings from configuration files
Dr. Matthias St. Pierre [Wed, 13 Nov 2019 15:02:09 +0000 (16:02 +0100)]
Remove RANDFILE settings from configuration files

OpenSSL 1.1.1 introduced a new CSPRNG with an improved seeding
mechanism, which makes it dispensable to define a RANDFILE for
saving and restoring randomness. This commit removes the RANDFILE
declarations from our own configuration files and adds documentation
that this option is not needed anymore and retained mainly for
compatibility reasons.

Fixes #10433

Reviewed-by: Paul Dale <>
(Merged from

2 years agoRemove deadlock that was caused by calling pthread_rwlock_wrlock() on same thread...
Matus Kysel [Fri, 22 Nov 2019 09:44:02 +0000 (10:44 +0100)]
Remove deadlock that was caused by calling pthread_rwlock_wrlock() on same thread twice. This can be reproduce only with musl.

CLA: trivial

Signed-off-by: Matus Kysel <>
Reviewed-by: Richard Levitte <>
Reviewed-by: Paul Dale <>
(Merged from

2 years agoProcess GOST ClientKeyExchange message in SSL_trace
Daniil Zotkin [Tue, 24 Sep 2019 09:47:26 +0000 (12:47 +0300)]
Process GOST ClientKeyExchange message in SSL_trace

Use ssl_print_hex to print message in case of GOST key exchange algorithm.

CLA: trivial

Reviewed-by: Paul Dale <>
Reviewed-by: Dmitry Belyavskiy <>
(Merged from

2 years agoUI_UTIL_wrap_read_pem_callback(): when |cb| is NULL, use PEM_def_callback
Richard Levitte [Thu, 14 Nov 2019 11:09:42 +0000 (12:09 +0100)]
UI_UTIL_wrap_read_pem_callback(): when |cb| is NULL, use PEM_def_callback

Fixes #10444

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoThread: Avoid a NULL dereference after failed initialisation.
Pauli [Thu, 21 Nov 2019 03:15:21 +0000 (13:15 +1000)]
Thread: Avoid a NULL dereference after failed initialisation.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agomain: avoid a NULL dereference on initialisation.
Pauli [Thu, 21 Nov 2019 03:50:03 +0000 (13:50 +1000)]
main: avoid a NULL dereference on initialisation.

Reviewed-by: Tim Hudson <>
(Merged from

2 years agoPROV: Avoid NULL dereference in SHA3 dup call.
Pauli [Wed, 20 Nov 2019 22:41:42 +0000 (08:41 +1000)]
PROV: Avoid NULL dereference in SHA3 dup call.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoPROV: check for memory allocation failure in digest _dupctx.
Pauli [Wed, 20 Nov 2019 20:47:57 +0000 (06:47 +1000)]
PROV: check for memory allocation failure in digest _dupctx.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agokdfs: make free calls check for NULL.
Pauli [Thu, 21 Nov 2019 04:19:50 +0000 (14:19 +1000)]
kdfs: make free calls check for NULL.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoFix a race condition in SNI handling
Benjamin Kaduk [Wed, 13 Nov 2019 17:42:19 +0000 (09:42 -0800)]
Fix a race condition in SNI handling

As was done for ciphers, supported groups, and EC point formats in, only write the negotiated
SNI hostname value to the session object when not resuming, even for
TLS 1.3 resumptions.  Otherwise, when using a stateful session cache
(as is done by default when 0-RTT data is enabled), we can have multiple
SSLs active using the same in-memory session object, which leads to
double-frees and similar race conditions in the SNI handler prior
to this commit.

Fortunately, since draft-ietf-tls-tls13-22, there is no requirement
that the SNI hostname be preserved across TLS 1.3 resumption, and thus
not a need to continually update the session object with the "current"
value (to be used when producing session tickets, so that the subsequent
resumption can be checked against the current value).  So we can just
relax the logic and only write to the session object for initial handshakes.
This still leaves us in a somewhat inconsistent state, since if the SNI value
does change across handshakes, the session object will continue to record
the initial handshake's value, even if that bears no relation to the
current handshake.  The current SSL_get_servername() implementation
prefers the value from the session if s->hit, but a more complete fix
for that and related issues is underway in; there is no need to wait
for the complete fix for SNI name handling in order to close the
race condition and avoid runtime crashes.

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoCore: allow NULL argument to stored_namemap_free().
Pauli [Wed, 20 Nov 2019 20:55:50 +0000 (06:55 +1000)]
Core: allow NULL argument to stored_namemap_free().

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoDocumentation updates due to naming tweaks
Matt Caswell [Fri, 4 Oct 2019 11:46:33 +0000 (12:46 +0100)]
Documentation updates due to naming tweaks

Also documents our new canonical naming.

Reviewed-by: Paul Dale <>
(Merged from

2 years agoTweak some algorithm naming inconsistencies
Matt Caswell [Fri, 4 Oct 2019 10:50:49 +0000 (11:50 +0100)]
Tweak some algorithm naming inconsistencies

Make some algorithms names better match our "canonical" style.

Reviewed-by: Paul Dale <>
(Merged from

2 years agoEVP p_lib: Add NULL check to EVP_PKEY_missing_parameters.
Pauli [Wed, 20 Nov 2019 03:14:39 +0000 (13:14 +1000)]
EVP p_lib: Add NULL check to EVP_PKEY_missing_parameters.

Check for NULL and return error if so.
This can possibly be called from apps/ca.c with a NULL argument.

Reviewed-by: Paul Yang <>
(Merged from

2 years agoEngine: Add NULL check.
Pauli [Wed, 20 Nov 2019 03:07:04 +0000 (13:07 +1000)]
Engine: Add NULL check.

Add NULL check for return from pkey_asn1_meths.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoECDSA: don't clear free memory after verify.
Pauli [Wed, 20 Nov 2019 03:20:01 +0000 (13:20 +1000)]
ECDSA: don't clear free memory after verify.

Verifications are public, there is no need to clear the used storage before
freeing it.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoReplumbing: pre-populate the EVP namemap with commonly known names
Richard Levitte [Thu, 23 May 2019 01:27:37 +0000 (03:27 +0200)]
Replumbing: pre-populate the EVP namemap with commonly known names

This adds ossl_namemap_empty(), to detect if a namemap is empty and
can thereby be pre-populated.

This also affects the way legacy NIDs are looked up in
evp_cipher_from_dispatch() and evp_md_from_dispatch().  Instead of
trying to find the NID directly, look up the legacy method structure
and grab the NID from there.  The reason is that NIDs can be aliases
for other NIDs, which looks like a clash even if wasn't really one.

Reviewed-by: Paul Dale <>
(Merged from

2 years agoFix sha512_block_data_order_avx2 backtrace info
Bernd Edlinger [Sat, 17 Aug 2019 23:54:41 +0000 (01:54 +0200)]
Fix sha512_block_data_order_avx2 backtrace info

We store a secondary frame pointer info for the debugger
in the red zone.

Fixes #8853

[extended tests]

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoAllow specifying the tag after AAD in CCM mode (2)
Patrick Steuer [Fri, 1 Nov 2019 23:02:47 +0000 (00:02 +0100)]
Allow specifying the tag after AAD in CCM mode (2)

In addition to 67c81ec3 which introduced this behavior in CCM mode
docs but only implemented it for AES-CCM.

Signed-off-by: Patrick Steuer <>
Reviewed-by: Paul Dale <>
(Merged from

2 years agoDont pass zero length input to asm modules for ciphers
Patrick Steuer [Fri, 1 Nov 2019 13:58:36 +0000 (14:58 +0100)]
Dont pass zero length input to asm modules for ciphers

The asm modules may assume an input length > 0.

Fixes: #9262

Signed-off-by: Patrick Steuer <>
Reviewed-by: Paul Dale <>
(Merged from

2 years agoDocument command parameters.
Rich Salz [Fri, 20 Sep 2019 01:33:17 +0000 (21:33 -0400)]
Document command parameters.

Add documentation for all commands that have parameters.
Fix a couple of minor doc and programming bugs, too.

Fixes #10313

Reviewed-by: Paul Dale <>
Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoAdd test for non-default sized keys in variable key size ciphers
Matt Caswell [Fri, 15 Nov 2019 14:15:09 +0000 (14:15 +0000)]
Add test for non-default sized keys in variable key size ciphers

Various ciphers have the ability to support varaible length keys.
This adds some test cases for algorithms where we did not test a key
length other than the default size.

Reviewed-by: Shane Lontis <>
(Merged from

2 years agoEVP_CIPHER_CTX_set_keylen should not succeed if a bad keylen is passed
Matt Caswell [Thu, 14 Nov 2019 16:05:19 +0000 (16:05 +0000)]
EVP_CIPHER_CTX_set_keylen should not succeed if a bad keylen is passed

EVP_CIPHER_CTX_set_keylen() was succeeding even though a bad key length
is passed to it. This is because the set_ctx_params() were all accepting
this parameter and blindly changing the keylen even though the cipher did
not accept a variable key length. Even removing this didn't entirely
resolve the issue because set_ctx_params() functions succeed even if
passed a parameter they do not recognise.

This should fix various issues found by OSSfuzz/Cryptofuzz.

Reviewed-by: Shane Lontis <>
(Merged from

2 years agofix s390 compile error due to missing comma.
Shane Lontis [Mon, 18 Nov 2019 22:38:19 +0000 (08:38 +1000)]
fix s390 compile error due to missing comma.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoFix the issue that aes-xxx-siv algorithms failed in OpenSSL speed test
Xiaokang Qian [Tue, 12 Nov 2019 08:48:27 +0000 (08:48 +0000)]
Fix the issue that aes-xxx-siv algorithms failed in OpenSSL speed test

Speed test, aes-siv related cases fail on both x86 and arm.
The return value of siv_init() causes this problem, remove
the iv check to fix it.
Verify it locally, the result is pass.

Fixes #10416

Change-Id: If1a18599f3d0f56f22a1ce4f8f114b8db0f68cca

Reviewed-by: Richard Levitte <>
Reviewed-by: Shane Lontis <>
(Merged from

2 years agoProperties: make query cache reference count aware.
Pauli [Mon, 11 Nov 2019 01:17:32 +0000 (11:17 +1000)]
Properties: make query cache reference count aware.

The property query cache was not reference count aware and this could cause
problems if the property store removes an algorithm while it is being returned
from an asynchronous query.  This change makes the cache reference count aware
and avoids disappearing algorithms.

A side effect of this change is that the reference counts are now owned by the
cache and store.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoFix Use after free when copying cipher ctx
Shane Lontis [Mon, 18 Nov 2019 03:13:05 +0000 (13:13 +1000)]
Fix Use after free when copying cipher ctx

Fixes #10438
issue found by clusterfuzz/ossfuzz

The dest was getting a copy of the src structure which contained a pointer that should point to an offset inside itself - because of the copy it was pointing to the original structure.

The setup for a ctx is mainly done by the initkey method in the PROV_CIPHER_HW structure. Because of this it makes sense that the structure should also contain a copyctx method that is use to resolve any pointers that need to be setup.

A dup_ctx has been added to the cipher_enc tests in evp_test. It does a dup after setup and then frees the original ctx. This detects any floating pointers in the duplicated context that were pointing back to the freed ctx.

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoPEM: constify PEM_write_ routines
Richard Levitte [Fri, 15 Nov 2019 07:54:17 +0000 (08:54 +0100)]
PEM: constify PEM_write_ routines

There's no reason why the object to be written, or the key string
given by the caller should be non-const.

This makes the IMPLEMENT_PEM_..._const and  DECLARE_PEM_..._const
macros superfluous, so we keep them around but mark them deprecated.

In all places where IMPLEMENT_PEM_..._const and  DECLARE_PEM_..._const
are used, they are replaced with the corresponding macros without

Reviewed-by: Matt Caswell <>
(Merged from

2 years agos390x assembly pack: fix bn_mul_comba4
Patrick Steuer [Fri, 15 Nov 2019 09:52:03 +0000 (10:52 +0100)]
s390x assembly pack: fix bn_mul_comba4

Signed-off-by: Patrick Steuer <>
Reviewed-by: Paul Dale <>
(Merged from

2 years agoAdd missing EVP_PKEY_METHOD accessors for digestsign and digestverify
Anthony Hu [Fri, 8 Nov 2019 02:47:53 +0000 (21:47 -0500)]
Add missing EVP_PKEY_METHOD accessors for digestsign and digestverify

Reviewed-by: Paul Dale <>
Reviewed-by: Matthias St. Pierre <>
(Merged from

2 years agocommit a6efbe123af3d98b4d10d4fcdfe68dc5303212f8
raniervf [Fri, 15 Nov 2019 22:28:00 +0000 (08:28 +1000)]
commit a6efbe123af3d98b4d10d4fcdfe68dc5303212f8
Author: raniervf <>
Date:   Thu Nov 7 18:59:11 2019 -0300

Avoid calling strlen repeatedly in loops.

Reviewed-by: Paul Yang <>
Reviewed-by: Paul Dale <>
(Merged from

2 years agoFix some broken doc links
Rich Salz [Thu, 22 Aug 2019 05:21:25 +0000 (10:51 +0530)]
Fix some broken doc links

Replace L<> link to header-file with a C<> reference.
Change some broken L<provider(3)> links to L<provider(7)>.
For consistency, rename four cipher pages to have a specific mode.
Fix up all references to any "generic" names to point to specific names.

Reviewed-by: Richard Levitte <>
Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoMake sure we free the CONF structure allocated by confdump
Matt Caswell [Tue, 12 Nov 2019 17:37:11 +0000 (17:37 +0000)]
Make sure we free the CONF structure allocated by confdump

A travis build was failing because of a memory leak in confdump due to
us not freeing an allocated CONF structure.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agotravis.yml: add arch s390x target
Patrick Steuer [Thu, 14 Nov 2019 09:34:02 +0000 (10:34 +0100)]
travis.yml: add arch s390x target

Signed-off-by: Patrick Steuer <>
Reviewed-by: Richard Levitte <>
(Merged from

2 years agotestutil/init.c rename to testutil/testutil_init.c
Patrick Steuer [Wed, 13 Nov 2019 17:39:51 +0000 (18:39 +0100)]
testutil/init.c rename to testutil/testutil_init.c

Avoid conflicts with some linkers.

Signed-off-by: Patrick Steuer <>
Reviewed-by: Richard Levitte <>
(Merged from

2 years agoA few fixes in the EVP_KDF-KB and EVP_KDF-KRB5KDF manpages
Tomas Mraz [Tue, 12 Nov 2019 15:59:23 +0000 (16:59 +0100)]
A few fixes in the EVP_KDF-KB and EVP_KDF-KRB5KDF manpages

The context and label is info and salt respectively - fix
the example in KB manpage for that.

There are some typos and bug in EVP_KDF_derive call in the
KRB5KDF example.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoDelete recently documented functions from missingcrypto
Tomas Mraz [Wed, 13 Nov 2019 10:10:51 +0000 (11:10 +0100)]
Delete recently documented functions from missingcrypto

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoFix an uninitialised read in conf_def.c
Matt Caswell [Tue, 12 Nov 2019 17:16:14 +0000 (17:16 +0000)]
Fix an uninitialised read in conf_def.c

PR 8882 added a new field to the CONF structure. Unfortunately this
structure was created using OPENSSL_malloc() and the new field was not
explicitly initialised in the "init" function. Therefore when we came to
read it for the first time we got an uninitialised read.

Reviewed-by: Richard Levitte <>
Reviewed-by: Shane Lontis <>
(Merged from

2 years agoFix no-blake2
Matt Caswell [Tue, 12 Nov 2019 16:02:24 +0000 (16:02 +0000)]
Fix no-blake2

We modify the file to exclude the legacy_blake2.c file in
the event that blake2 support has been disabled.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoFix no-engine
Matt Caswell [Tue, 12 Nov 2019 15:26:15 +0000 (15:26 +0000)]
Fix no-engine

Fix a misplaced "#endif" which was disabling a little too much code.

Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoCORE & PROV: make export of key data leaner through callback
Richard Levitte [Fri, 8 Nov 2019 14:24:42 +0000 (15:24 +0100)]
CORE & PROV: make export of key data leaner through callback

Exporting data from a provider owned domainparams or key is quite an
ordeal, with having to figure out what parameter keys an
implementation supports, call the export function a first time to find
out how large each parameter buffer must be, allocate the necessary
space for it, and call the export function again.

So how about letting the export function build up the key data params
and call back with that?  This change implements exactly such a

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoFix no-cmac and no-camellia
Matt Caswell [Tue, 12 Nov 2019 15:51:00 +0000 (15:51 +0000)]
Fix no-cmac and no-camellia

Guard two tests that depend on CMAC and Camellia so that we don't fail
if those algorithms are not available.

Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoAdd confdump to .gitignore
Matt Caswell [Tue, 12 Nov 2019 17:41:29 +0000 (17:41 +0000)]
Add confdump to .gitignore

We added a new executable to the test directory which didn't match the
existing gitignore rules, so we add it explicitly.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoDocument various new/changes EVP_PKEY_CTX_* functions
Matt Caswell [Wed, 6 Nov 2019 13:39:21 +0000 (13:39 +0000)]
Document various new/changes EVP_PKEY_CTX_* functions

We have converted a number of macros to functions and made them work
with providers. We've also added some *_ex() variants that needed

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoDocument the public EVP_ASYM_CIPHER releated functions
Matt Caswell [Wed, 6 Nov 2019 11:03:12 +0000 (11:03 +0000)]
Document the public EVP_ASYM_CIPHER releated functions

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoAdd documentation for the Asymmetric Cipher Operation
Matt Caswell [Tue, 29 Oct 2019 09:24:24 +0000 (09:24 +0000)]
Add documentation for the Asymmetric Cipher Operation

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoMove RSA Asym cipher code to the default provider
Matt Caswell [Mon, 28 Oct 2019 13:40:39 +0000 (13:40 +0000)]
Move RSA Asym cipher code to the default provider

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoIncrease OSSL_PARAM_BLD_MAX for multi-prime RSA
Matt Caswell [Mon, 28 Oct 2019 14:43:42 +0000 (14:43 +0000)]
Increase OSSL_PARAM_BLD_MAX for multi-prime RSA

The old value of 10 for OSSL_PARAM_BLD_MAX is insufficient for multi-prime
RSA. That code has this assert:

        if (!ossl_assert(/* n, e */ 2 + /* d */ 1 + /* numprimes */ 1
                         + numprimes + numexps + numcoeffs
                         <= OSSL_PARAM_BLD_MAX))
            goto err;

So we increase OSSL_PARAM_BLD_MAX which would be enough for 7 primes
(more than you would ever reasonably want).

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoImplement provider support for Asym Ciphers
Matt Caswell [Tue, 1 Oct 2019 08:40:57 +0000 (09:40 +0100)]
Implement provider support for Asym Ciphers

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoAllow strings in params to be of zero length
Matt Caswell [Thu, 17 Oct 2019 16:19:21 +0000 (17:19 +0100)]
Allow strings in params to be of zero length

Sometimes it is useful to be able to pass NULL/zero length strings

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoAllow setting a NULL pointer in a params structure
Matt Caswell [Fri, 11 Oct 2019 16:42:19 +0000 (17:42 +0100)]
Allow setting a NULL pointer in a params structure

Sometimes it is valid to send a NULL pointer in params.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoCORE: Add a generic callback function type
Richard Levitte [Mon, 11 Nov 2019 17:38:57 +0000 (18:38 +0100)]
CORE: Add a generic callback function type

This offers a very generic way to define a callback as well as calling

Reviewed-by: Matt Caswell <>
(Merged from

2 years agochacha_enc.c: fix for EBCDIC platforms
Joerg Schmidbauer [Tue, 12 Nov 2019 09:26:47 +0000 (10:26 +0100)]
chacha_enc.c: fix for EBCDIC platforms

Signed-off-by: Joerg Schmidbauer <>
Reviewed-by: Patrick Steuer <>
Reviewed-by: Matt Caswell <>
(Merged from

2 years agoExtend docs for EC_POINT conversion functions
Nicola Tuveri [Mon, 11 Nov 2019 22:52:00 +0000 (00:52 +0200)]
Extend docs for EC_POINT conversion functions

Add more explicit documentation about the relation between
EC_POINT_point2oct(), EC_POINT_point2hex(), EC_POINT_point2bn() and
their reverse.

In particular highlight that EC_POINT_point2oct() and
EC_POINT_oct2point() conform to, respectively, Sec. 2.3.3 and Sec. 2.3.4
of the SECG SEC 1 standard (which is the normative reference for the
already mentioned RFC 5480), highlighting with a note how this affect
the encoding/decoding of the point at infinity (which in contrast with
any other valid generic point of a curve is assigned an exceptional
fixed octet string encoding, i.e., 0x00).

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoAdd self-test for EC_POINT_hex2point
Nicola Tuveri [Fri, 1 Nov 2019 20:09:40 +0000 (22:09 +0200)]
Add self-test for EC_POINT_hex2point

Adds tests for each curve to ensure that encodings obtained through
EC_POINT_hex2point() can be fed to EC_POINT_point2hex() yielding a point
identical to the one from which the encoding is generated.

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoFix EC_POINT_bn2point() for BN_zero()
Nicola Tuveri [Fri, 1 Nov 2019 20:38:21 +0000 (22:38 +0200)]
Fix EC_POINT_bn2point() for BN_zero()

EC_POINT_bn2point() rejected BIGNUMs with a zero value.

This behavior indirectly caused failures when converting a point
at infinity through EC_POINT_point2hex() and then back to a point with

With this change such BIGNUMs are treated like any other and exported to
an octet buffer filled with zero.
It is then EC_POINT_oct2point() (either the default implementation or
the custom one in group->meth->oct2point) to determine if such encoding
maps to a valid point (generally the point at infinity is encoded as

Fixes #10258

Reviewed-by: Matt Caswell <>
(Merged from

2 years agolibcrypto.num: remove some unused EVP_MAC symbols
Dr. Matthias St. Pierre [Tue, 12 Nov 2019 11:48:15 +0000 (12:48 +0100)]
libcrypto.num: remove some unused EVP_MAC symbols

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoAdd more tests for apps/req
Nicola Tuveri [Thu, 31 Oct 2019 15:17:31 +0000 (17:17 +0200)]
Add more tests for apps/req
highlighted that existing testing infrastructure is not covering common
usage patterns of the `req` app.

This commit explicitly adds request generations thorugh the CLI using
RSA, DSA and ECDSA (P-256) keys.

Reviewed-by: Richard Levitte <>
(Merged from

2 years agoAdd missing docs for some PKCS12 functions
Jon Spillett [Mon, 2 Sep 2019 04:51:05 +0000 (14:51 +1000)]
Add missing docs for some PKCS12 functions

Reviewed-by: Matt Caswell <>
Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoadd OPENSSL_FUNC.pod documenting OPENSSL_MSTR, OPENSSL_FUNC, and friends
Dr. David von Oheimb [Tue, 5 Nov 2019 10:43:52 +0000 (11:43 +0100)]
add OPENSSL_FUNC.pod documenting OPENSSL_MSTR, OPENSSL_FUNC, and friends

Reviewed-by: Richard Levitte <>
Reviewed-by: Dmitry Belyavskiy <>
(Merged from

2 years agore-add definition of OPENSSL_MSTR deleted from opensslv.h in macros.h
Dr. David von Oheimb [Tue, 22 Oct 2019 11:38:16 +0000 (13:38 +0200)]
re-add definition of OPENSSL_MSTR deleted from opensslv.h in macros.h

Reviewed-by: Richard Levitte <>
Reviewed-by: Dmitry Belyavskiy <>
(Merged from

2 years agoSSL: Document SSL_add_{file,dir,store}_cert_subjects_to_stack()
Richard Levitte [Sun, 10 Nov 2019 14:36:24 +0000 (15:36 +0100)]
SSL: Document SSL_add_{file,dir,store}_cert_subjects_to_stack()

This also removes the incorrect documentation comments by those
functions, and fixes a bug in SSL_add_store_cert_subjects_to_stack(),
where the condition for recursive addition was 'depth == 0' when it
should be 'depth > 0'.

Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoAdd a tester of OpenSSL config files and test the current .pragma
Richard Levitte [Mon, 19 Aug 2019 04:35:54 +0000 (06:35 +0200)]
Add a tester of OpenSSL config files and test the current .pragma

test/confdump.c reads an OpenSSL config file and prints out the
processed result.  This can be used to check that a config file is
processed correctly.

We add a test recipe and the necessary data to test the dollarid

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoAdd a .pragma directive for configuration files
Richard Levitte [Mon, 6 May 2019 08:50:35 +0000 (10:50 +0200)]
Add a .pragma directive for configuration files

Currently added pragma:

.pragma dollarid:on

This allows dollar signs to be a keyword character unless it's
followed by a opening brace or parenthesis.

Fixes #8207

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoMake sure KDF reason codes are conserved in their current state
Richard Levitte [Sun, 10 Nov 2019 12:07:46 +0000 (13:07 +0100)]
Make sure KDF reason codes are conserved in their current state

Because KDF errors are deprecated and only conserved for backward
compatibilty, we must make sure that they remain untouched.  A simple
way to signal that is by modifying crypto/err/ and replace
the main header file (include/openssl/kdf.h in this case) with 'NONE',
while retaining the error table file (crypto/kdf/kdf_err.c).

util/ is modified to silently ignore anything surrounding a
conserved lib when such a .ec line is found.

Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoDeprecate ERR_load_KDF_strings()
Richard Levitte [Sun, 10 Nov 2019 12:06:48 +0000 (13:06 +0100)]
Deprecate ERR_load_KDF_strings()

Not only deprecate, but also remove the reason strings and make
ERR_load_KDF_strings() do nothing.

Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoutil/perl/OpenSSL/ Fix 'extern "C" DEPRECATEDIN_x_y(...)'
Richard Levitte [Sun, 10 Nov 2019 12:03:15 +0000 (13:03 +0100)]
util/perl/OpenSSL/ Fix 'extern "C" DEPRECATEDIN_x_y(...)'

The parser expected an 'extern "C"' followed by a single declaration
to always end with a semicolon.  Then came along something like this:

    extern "C" DEPRECATEDIN_3_0(int ERR_load_KDF_strings(void))

This change adjusts the detector of 'extern "C"' to also take in
accound a declaration that ends with a parenthesis.

Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoReinstate the KDF error macros
Richard Levitte [Sun, 10 Nov 2019 04:16:36 +0000 (05:16 +0100)]
Reinstate the KDF error macros

For minimum breakage with existing applications that might use them.

This reverts commit fe6ec26b204a056aee2a24b79df09a45b2308603 and

Fixes #10340

Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoFix cut'n'paste typos in the provider-digest pod
Dmitry Belyavskiy [Sat, 9 Nov 2019 20:25:32 +0000 (23:25 +0300)]
Fix cut'n'paste typos in the provider-digest pod

Reviewed-by: Richard Levitte <>
Reviewed-by: Matt Caswell <>
(Merged from

2 years agoFix misspelled resumption_label for CHARSET_EBCDIC
Ido Ben-Natan [Sat, 9 Nov 2019 13:04:39 +0000 (15:04 +0200)]
Fix misspelled resumption_label for CHARSET_EBCDIC

The resumption_label variable when CHARSET_EBCDIC was enabled, was misspelled.
Instead of evaluating to 'res binder' as expected, it evaluated to 'red binder'.

CLA: trivial

Reviewed-by: Kurt Roeckx <>
Reviewed-by: Matthias St. Pierre <>
(Merged from

2 years agoFix no-dsa
Matt Caswell [Thu, 7 Nov 2019 09:24:18 +0000 (09:24 +0000)]
Fix no-dsa

Make sure we don't try and load a DSA key in the tests if DSA has been

Reviewed-by: Shane Lontis <>
Reviewed-by: Richard Levitte <>
(Merged from

2 years agoAdd rc4_hmac_md5 cipher to default provider
Shane Lontis [Thu, 10 Oct 2019 06:42:20 +0000 (16:42 +1000)]
Add rc4_hmac_md5 cipher to default provider

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoFix L<xxx(1)> links to be L<openssl-xxx(1)>
Rich Salz [Fri, 1 Nov 2019 20:26:05 +0000 (16:26 -0400)]
Fix L<xxx(1)> links to be L<openssl-xxx(1)>

Reviewed-by: Richard Levitte <>
Reviewed-by: Matthias St. Pierre <>
(Merged from

2 years agoWorkaround for Windows-based GOST implementations
Dmitry Belyavskiy [Thu, 7 Nov 2019 14:58:15 +0000 (17:58 +0300)]
Workaround for Windows-based GOST implementations

Many Windows-based GOST TLS implementations are unable to extend the
list of supported SignatureAlgorithms because of lack of the necessary
callback in Windows. So for TLS 1.2 it makes sense to imply the support
of GOST algorithms in case when the GOST ciphersuites are present.

Reviewed-by: Paul Dale <>
(Merged from

2 years agoRename providers/common/provlib.c to nid_to_name.c
Richard Levitte [Fri, 8 Nov 2019 09:29:24 +0000 (10:29 +0100)]
Rename providers/common/provlib.c to nid_to_name.c

It contains only one function, which should only get added to non-FIPS

Reviewed-by: Paul Dale <>
(Merged from

2 years agoFinal cleanup after move to leaner EVP_PKEY methods
Richard Levitte [Thu, 31 Oct 2019 11:10:01 +0000 (12:10 +0100)]
Final cleanup after move to leaner EVP_PKEY methods

Now that KEYMGMT method pointers have moved away from the diverse
methods that are used with EVP_PKEY_CTX, we no longer need to pass
special argument to evp_generic_fetch() and evp_generic_do_all().

Reviewed-by: Shane Lontis <>
(Merged from

2 years agoConfiguration: make Solaris builds with gcc recognise GNU ld
Richard Levitte [Thu, 21 Mar 2019 06:51:43 +0000 (07:51 +0100)]
Configuration: make Solaris builds with gcc recognise GNU ld

The solaris config targets assumed that GNU cc used Sun ld at all
times.  However, there are setups where GNU ld is used instead, so we
adapt the Solaris gcc config targets to use the mechanism introduced
with Configurations/ to try to detect what ld flavor is
being used and set the diverse ld flags accordingly.

Fixes #8547

Reviewed-by: Matt Caswell <>
(Merged from

2 years agobss_dgram.c: fix unaligned access
Patrick Steuer [Sat, 2 Nov 2019 15:31:28 +0000 (16:31 +0100)]
bss_dgram.c: fix unaligned access

char (alignment 1) casted to union sctp_notification (alignment > 1).

Fixes: #9538

Signed-off-by: Patrick Steuer <>
Reviewed-by: Matt Caswell <>
(Merged from

2 years agoRSA generation: Use more bits of 1/sqrt(2)
Kurt Roeckx [Wed, 23 Oct 2019 20:10:54 +0000 (22:10 +0200)]
RSA generation: Use more bits of 1/sqrt(2)

The old version always sets the top 2 bits, so the most significate byte
of the primes was always >= 0xC0. We now use 256 bits to represent
1/sqrt(2) = 0x0.B504F333F9DE64845...

Reviewed-by: Shane Lontis <>
Reviewed-by: Richard Levitte <>
GH: #10246

2 years agoFix a -Warray-bounds gcc warning in OPENSSL_DIR_read
Bernd Edlinger [Sun, 3 Nov 2019 16:34:23 +0000 (17:34 +0100)]
Fix a -Warray-bounds gcc warning in OPENSSL_DIR_read

'__builtin_strncpy' offset [275, 4095] from the object at
'direntry' is out of the bounds of referenced subobject 'd_name'
with type 'char[256]' at offset 19

Reviewed-by: Kurt Roeckx <>
Reviewed-by: Richard Levitte <>
(Merged from

2 years agoconf_def.c: Avoid calling strlen() in a loop
raniervf [Tue, 5 Nov 2019 01:32:43 +0000 (22:32 -0300)]
conf_def.c: Avoid calling strlen() in a loop

Reviewed-by: Matt Caswell <>
Reviewed-by: Matthias St. Pierre <>
(Merged from

2 years agoCleanup include/openssl/
Richard Levitte [Thu, 17 Oct 2019 16:40:47 +0000 (18:40 +0200)]
Cleanup include/openssl/

Now that we generate include/openssl/opensslv.h, there's no point
keeping some macross around, we can just set a simpler set to their
respective value and be done with it.

Reviewed-by: Matt Caswell <>
(Merged from

2 years agoAdd ssl_ctx_test to test suite.
Rich Salz [Sat, 2 Nov 2019 17:02:37 +0000 (13:02 -0400)]
Add ssl_ctx_test to test suite.

Also fix the test as min version > max version is allowed because
the API calls to set min and max versions are separate and there
can be legitimately a temporary situation when the condition is
true even with correctly working application.

The failure in this condition will be detected only during
a handshake attempt.

Reviewed-by: Richard Levitte <>
Reviewed-by: Tomas Mraz <>
(Merged from

2 years agoAdd AES SIV ciphers to default provider
Shane Lontis [Fri, 8 Nov 2019 02:14:44 +0000 (12:14 +1000)]
Add AES SIV ciphers to default provider

Reviewed-by: Richard Levitte <>
Reviewed-by: Paul Dale <>
(Merged from

2 years agoRefactor PEM_read_bio_{PrivateKey,Parameters,DHparams}
Richard Levitte [Sat, 25 Feb 2017 22:38:46 +0000 (23:38 +0100)]
Refactor PEM_read_bio_{PrivateKey,Parameters,DHparams}

They now go through internal STORE routines to do their job.

Reviewed-by: Matt Caswell <>
(Merged from