Pauli [Sun, 13 Sep 2020 21:40:58 +0000 (07:40 +1000)]
PKCS#8: free data on error path in newpass_bag
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/12870)
Pauli [Sun, 13 Sep 2020 21:36:02 +0000 (07:36 +1000)]
DTLS: free allocated memory on error paths
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/12870)
Dr. Matthias St. Pierre [Sat, 12 Sep 2020 22:47:28 +0000 (00:47 +0200)]
prov/drbg: cleanup some RAND_DRBG leftovers
These are leftovers from the RAND_DRBG removal (#12509).
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12866)
Dr. Matthias St. Pierre [Sat, 12 Sep 2020 22:17:35 +0000 (00:17 +0200)]
prov/drbg: fix misspelling of '#ifdef FIPS_MODULE'
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12866)
Richard Levitte [Sat, 29 Aug 2020 07:46:24 +0000 (09:46 +0200)]
EVP: Centralise fetching error reporting
Instead of sometimes, and sometimes not reporting an error in the
caller of EVP_XXX_fetch(), where the error may or may not be very
accurate, it's now centralised to the inner EVP fetch functionality.
It's made in such a way that it can determine if an error occured
because the algorithm in question is not there, or if something else
went wrong, and will report EVP_R_UNSUPPORTED_ALGORITHM for the
former, and EVP_R_FETCH_FAILED for the latter.
This helps our own test/evp_test.c when it tries to figure out why an
EVP_PKEY it tried to load failed to do so.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12857)
Matt Caswell [Thu, 10 Sep 2020 15:34:17 +0000 (16:34 +0100)]
Ignore unused return values from some sk_*() macros
Some compilers are very picky about unused return values.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Fri, 4 Sep 2020 16:00:58 +0000 (17:00 +0100)]
Don't complain about stack related macros
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Richard Levitte [Fri, 4 Sep 2020 06:53:11 +0000 (08:53 +0200)]
Make 'make errors' work again
util/mkerr.pl detects if a header is now a '.in' template, and adjusts
the header file it reads accordingly.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12781)
Richard Levitte [Fri, 4 Sep 2020 06:51:37 +0000 (08:51 +0200)]
Make 'make ordinals' work again
'make ordinals' assumed that all headers reside in the source tree,
which is no longer true, now that we generate a number of them. This
needed some refactoring.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12781)
Richard Levitte [Fri, 4 Sep 2020 06:48:13 +0000 (08:48 +0200)]
util/mknum.pl: Fix file opening
'or' has lower priority than '||' in perl, which affects evaluation order.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 16:35:41 +0000 (17:35 +0100)]
Streamline the safestack generated code
The safestack code generation was generating a little too much. Some of
it could be done with a normal macro.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 16:22:30 +0000 (17:22 +0100)]
Add a CHANGES entry for the safestack updates
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 16:09:18 +0000 (17:09 +0100)]
Remove some safestack things that are no longer needed
... and add SKM_DEFINE_STACK_OF_INTERNAL
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 15:39:36 +0000 (16:39 +0100)]
Fix safestack issues in ui.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 15:35:20 +0000 (16:35 +0100)]
Fix safestack issues in pkcs12.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 15:24:47 +0000 (16:24 +0100)]
Fix safestack issues in crypto.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 15:14:28 +0000 (16:14 +0100)]
Fix safestack issues in conf.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 15:06:16 +0000 (16:06 +0100)]
Fix safestack issues in bio.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 15:01:51 +0000 (16:01 +0100)]
Fix safestack issues in ess.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 14:56:05 +0000 (15:56 +0100)]
Fix safestack issues in asn1t.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 14:50:09 +0000 (15:50 +0100)]
Fix safestack issues in ct.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 14:45:01 +0000 (15:45 +0100)]
Fix safestack issues in crmf.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 14:37:45 +0000 (15:37 +0100)]
Fix safestack issues in x509_vfy.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 14:31:44 +0000 (15:31 +0100)]
Fix safestack issues in srp.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 14:20:03 +0000 (15:20 +0100)]
Fix safestack issues in pkcs7.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 14:05:30 +0000 (15:05 +0100)]
Fix safestack issues in ocsp.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 13:55:08 +0000 (14:55 +0100)]
Fix safestack issues in cms.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 13:45:54 +0000 (14:45 +0100)]
Fix safestack issues in cmp.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 13:35:41 +0000 (14:35 +0100)]
Fix safestack issues in asn1.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 13:10:41 +0000 (14:10 +0100)]
Fix stacks of OPENSSL_STRING, OPENSSL_CSTRING and OPENSSL_BLOCK
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 11:46:08 +0000 (12:46 +0100)]
Fix safestack issues in x509v3.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Thu, 3 Sep 2020 09:23:44 +0000 (10:23 +0100)]
Fix safestack issues in x509.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Matt Caswell [Wed, 2 Sep 2020 15:15:06 +0000 (16:15 +0100)]
Fix safestack issues in ssl.h
We fix 3 problems with safestack:
- Including an openssl header file without linking against libcrypto
can cause compilation failures (even if the app does not otherwise need
to link against libcrypto). See issue #8102
- Recent changes means that applications in no-deprecated builds will need
to include additional macro calls in the source code for all stacks that
they need to use - which is an API break. This changes avoids that
necessity.
- It is not possible to write code using stacks that works in both a
no-deprecated and a normal build of OpenSSL. See issue #12707.
Fixes #12707
Contains a partial fix for #8102. A similar PR will be needed for hash to
fully fix.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12781)
Randall S. Becker [Sun, 6 Sep 2020 21:37:47 +0000 (16:37 -0500)]
NonStop port updates for 3.0.0.
HPE NonStop Port Changes for 3.0.0 Includes unthreaded, PUT, and SPT for OSS.
The port changes include wrapping where necessary for FLOSS and
appropriate configuration changes to support that. Two tests
are excluded as being inappropriate for the platform.
The changes are:
* Added /usr/local/include to nonstop-nsx_spt_floss to load floss.h
* Added SPT Floss variant for NonStop
* Wrapped FLOSS definitions in OPENSSL_TANDEM_FLOSS to allow selective enablement.
* SPT build configuration for NonStop
* Skip tests not relevant for NonStop
* PUT configuration changes required for NonStop platforms
* Configurations/50-nonstop.conf: updates for TNS/X platform.
* FLOSS instrumentation for HPE NonStop TNS/X and TNS/E platforms.
* Configurations/50-nonstop.conf: modifications for non-PUT TNS/E platform b
* Fix use of DELAY in ssltestlib.c for HPNS.
* Fixed commit merge issues and added floss to http_server.c
CLA: Permission is granted by the author to the OpenSSL team to use these modifications.
Fixes #5087.
Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12800)
Richard Levitte [Fri, 11 Sep 2020 06:36:54 +0000 (08:36 +0200)]
TEST: Add a test of EC key generation with encoding spec
The primary function of this test is to exercise
EVP_PKEY_CTX_set_ec_param_enc().
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12853)
Richard Levitte [Fri, 11 Sep 2020 06:35:26 +0000 (08:35 +0200)]
EVP: Add the internal convenience function evp_keymgmt_util_export()
This is purely to allow exporting without having to repeatedly specify
the keymgmt and keydata from the EVP_PKEY.
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12853)
Shane Lontis [Fri, 11 Sep 2020 04:38:22 +0000 (14:38 +1000)]
Fix EVP_PKEY_CTX_ctrl() documentation
Remove references to 'macro' from EVP_PKEY_CTX_ctrl() as they are all
functions now, and update the HISTORY section.
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12853)
Shane Lontis [Fri, 11 Sep 2020 00:53:30 +0000 (10:53 +1000)]
Update doc for EVP_PKEY_CTX_set_ec_param_enc()
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12853)
Richard Levitte [Thu, 10 Sep 2020 20:06:46 +0000 (22:06 +0200)]
EC: Reimplement EVP_PKEY_CTX_set_ec_param_enc() to support providers
Fixes #12852
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12853)
Richard Levitte [Sun, 9 Aug 2020 12:22:09 +0000 (14:22 +0200)]
dev/release.sh: Rework to be smoother
It now creates all the necessary feature branches for github in your
repository, making the cloned sub-directory unnecessary for post-release
purposes.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12614)
Shane Lontis [Thu, 10 Sep 2020 04:01:30 +0000 (14:01 +1000)]
keygen: add FIPS error state management to conditional self tests
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Wed, 9 Sep 2020 21:09:16 +0000 (07:09 +1000)]
CRNGT: enter FIPS error state if the test fails
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Wed, 9 Sep 2020 21:08:57 +0000 (07:08 +1000)]
FIPS: error mode is set from failed self tests and produced a limited number of errors when algorithm accesses are attempted
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Tue, 8 Sep 2020 02:56:34 +0000 (12:56 +1000)]
ciphers: add FIPS error state handling
The functions that check for the provider being runnable are: new, init, final
and dupctx.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Mon, 7 Sep 2020 22:23:46 +0000 (08:23 +1000)]
keymgmt: add FIPS error state handling
The functions that check for the provider being runnable are: new, gen_init,
gen, gen_set_template, load, has, match, validate, import and export.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Mon, 7 Sep 2020 03:44:17 +0000 (13:44 +1000)]
signature: add FIPS error state handling
The functions that check for the provider being runnable are: newctx, dupctx,
sign init, sign, verify init, verify, verify recover init, verify recover,
digest sign init, digest sign final, digest verify init and digest verify final.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Mon, 7 Sep 2020 03:26:20 +0000 (13:26 +1000)]
exchange: add FIPS error state handling
The functions that check for the provider being runnable are: newctx, dupctx,
init, derive and set peer.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Mon, 7 Sep 2020 03:13:10 +0000 (13:13 +1000)]
kdf: add FIPS error state handling
Check for provider being disabled on new and derive.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Mon, 7 Sep 2020 03:03:07 +0000 (13:03 +1000)]
mac: add FIPS error state handling
Check for provider being runnable in new, dup, init and final calls.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Mon, 7 Sep 2020 02:50:57 +0000 (12:50 +1000)]
rand: add FIPS error state handling
Check for provider being runnable in instantiate, reseed, generate and new calls.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Mon, 7 Sep 2020 02:44:59 +0000 (12:44 +1000)]
asymciphers: add FIPS error state handling
Check for provider being runnable in newctx, init, encrypt and decrypt.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Mon, 7 Sep 2020 02:41:00 +0000 (12:41 +1000)]
digests: add FIPS error state handling
Check for providering being runnable in init, final, newctx and dupctx.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Mon, 7 Sep 2020 01:58:48 +0000 (11:58 +1000)]
FIPS: rename the status call to is_running.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Pauli [Mon, 7 Sep 2020 01:58:03 +0000 (11:58 +1000)]
provider: add an 'is_running' call to all providers.
It can be accessed (read only) via the status parameter.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12801)
Shane Lontis [Thu, 10 Sep 2020 08:45:39 +0000 (18:45 +1000)]
Fix coverity issue: CID
1466479 - Resource leak in apps/pkcs12.c
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12847)
Shane Lontis [Thu, 10 Sep 2020 08:21:46 +0000 (18:21 +1000)]
Fix coverity issue: CID
1466482 - Resource leak in OSSL_STORE_SEARCH_by_key_fingerprint()
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12847)
Shane Lontis [Thu, 10 Sep 2020 08:19:13 +0000 (18:19 +1000)]
Fix coverity issue: CID
1466483 - Improper use of Negative value in dh_ctrl.c
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12847)
Shane Lontis [Thu, 10 Sep 2020 07:30:02 +0000 (17:30 +1000)]
Fix coverity issue: CID
1466484 - Remove dead code in PKCS7_dataInit()
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12847)
Shane Lontis [Thu, 10 Sep 2020 07:22:40 +0000 (17:22 +1000)]
Fix coverity issue: CID
1466485 - Explicit NULL dereference in OSSL_STORE_find()
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12847)
Shane Lontis [Thu, 10 Sep 2020 06:40:24 +0000 (16:40 +1000)]
Fix coverity issue: CID
1466486 - Resource leak in OSSL_STORE
Note that although this is a false positive currently, it could become possible if any of the methods called
change behaviour - so it is safer to add the fix than to ignore it. Added a simple test so that I could prove this was the case.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12847)
Richard Levitte [Thu, 10 Sep 2020 11:50:54 +0000 (13:50 +0200)]
OSSL_DECODER 'decode' function must never be NULL.
The conditions for a valid implementation allowed the 'decode'
function to be NULL or the 'export_object' was NULL. That condition
is changed so that 'decode' is checked to be non-NULL by itself.
Fixes #12819
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12849)
Richard Levitte [Sun, 6 Sep 2020 06:51:32 +0000 (08:51 +0200)]
TEST: skip POSIX errcode zero in tesst/recipes/02-test_errstr.t
On most systems, there is no E macro for errcode zero in <errno.h>,
which means that it seldom comes up here. However, reports indicate
that some platforms do have an E macro for errcode zero.
With perl, errcode zero is a bit special. Perl consistently gives
the empty string for that one, while the C strerror() may give back
something else. The easiest way to deal with that possible mismatch
is to skip this errcode.
Fixes #12798
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12799)
Biswapriyo Nath [Mon, 10 Aug 2020 21:01:32 +0000 (02:31 +0530)]
fuzz/test-corpus: check if PATH_MAX is already defined
CLA: trivial
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/12620)
Chris Novakovic [Thu, 3 Sep 2020 22:42:56 +0000 (23:42 +0100)]
apps/ca: allow CRL lastUpdate/nextUpdate fields to be specified
When generating a CRL using the "ca" utility, allow values for the
lastUpdate and nextUpdate fields to be specified using the command line
options -crl_lastupdate and -crl_nextupdate respectively.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/12784)
Dr. David von Oheimb [Tue, 8 Sep 2020 21:05:13 +0000 (23:05 +0200)]
Improve robustness and performance of building Unix static libraries
This is a fixup of
385deae79f26dd685339d3141a06d04d6bd753cd, which solved #12116
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12821)
Dr. David von Oheimb [Wed, 9 Sep 2020 08:15:45 +0000 (10:15 +0200)]
apps/cmp.c: Improve example given for -geninfo option (also in man page)
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12825)
Dr. David von Oheimb [Mon, 10 Aug 2020 15:36:41 +0000 (17:36 +0200)]
OSSL_CMP_CTX_new.pod: improve doc of OSSL_CMP_CTX_get1_{extraCertsIn,caPubs}
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12825)
Dr. David von Oheimb [Tue, 11 Aug 2020 05:57:57 +0000 (07:57 +0200)]
openssl-cmp.pod.in: Update Insta Demo CA port number in case needed
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12825)
Dr. David von Oheimb [Fri, 28 Aug 2020 13:03:11 +0000 (15:03 +0200)]
apps/cmp.c: Improve user guidance on missing -subject etc. options
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12825)
Dr. David von Oheimb [Fri, 28 Aug 2020 12:55:38 +0000 (14:55 +0200)]
apps/cmp.c: Improve documentation of -extracerts, -untrusted, and -otherpass
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12825)
Dr. David von Oheimb [Fri, 28 Aug 2020 11:28:24 +0000 (13:28 +0200)]
apps/cmp.c: Improve documentation of -secret, -cert, and -key options
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12825)
Dr. David von Oheimb [Tue, 8 Sep 2020 07:39:33 +0000 (09:39 +0200)]
check_chain_extensions(): Require X.509 v3 if extensions are present
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Dr. David von Oheimb [Mon, 7 Sep 2020 20:38:46 +0000 (22:38 +0200)]
check_chain_extensions(): Change exclusion condition w.r.t. RFC 6818 section 2
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Dr. David von Oheimb [Wed, 26 Aug 2020 07:45:11 +0000 (09:45 +0200)]
x509_vfy.c: Make sure that strict checks are not done for self-issued EE certs
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Dr. David von Oheimb [Tue, 25 Aug 2020 14:58:36 +0000 (16:58 +0200)]
check_chain_extensions(): Add check that CA cert includes key usage extension
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Dr. David von Oheimb [Tue, 25 Aug 2020 14:46:18 +0000 (16:46 +0200)]
check_chain_extensions(): Add check that on empty Subject the SAN must be marked critical
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Dr. David von Oheimb [Tue, 25 Aug 2020 14:13:40 +0000 (16:13 +0200)]
check_chain_extensions(): Add check that AKID and SKID are not marked critical
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Dr. David von Oheimb [Tue, 25 Aug 2020 13:37:46 +0000 (15:37 +0200)]
check_chain_extensions(): Add check that Basic Constraints of CA cert are marked critical
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Dr. David von Oheimb [Sat, 27 Jun 2020 14:16:12 +0000 (16:16 +0200)]
Extend X509 cert checks and error reporting in v3_{purp,crld}.c and x509_{set,vfy}.c
add various checks for malformedness to static check_chain_extensions() in x509_vfc.c
improve error reporting of X509v3_cache_extensions() in v3_purp.c
add error reporting to x509_init_sig_info() in x509_set.c
improve static setup_dp() and related functions in v3_purp.c and v3_crld.c
add test case for non-conforming cert from https://tools.ietf.org/html/rfc8410#section-10.2
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Dr. David von Oheimb [Mon, 7 Sep 2020 17:39:52 +0000 (19:39 +0200)]
apps/cmp.c: Improve safeguard assertion on consistency of cmp_options[] and cmp_vars[]
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12836)
Dr. David von Oheimb [Mon, 11 May 2020 13:31:53 +0000 (15:31 +0200)]
apps_ui.c: Correct password prompt for ui_method
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12493)
Dr. David von Oheimb [Mon, 11 May 2020 13:32:26 +0000 (15:32 +0200)]
apps_ui.c: Correct handling of empty password from -passin
This is done in analogy to commit
ca3245a61989009a99931748723d12e30d0a66b2
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12493)
Dr. David von Oheimb [Tue, 4 Aug 2020 08:11:02 +0000 (10:11 +0200)]
apps_ui.c: Improve error handling and return value of setup_ui_method()
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12493)
Shane Lontis [Thu, 10 Sep 2020 17:50:09 +0000 (03:50 +1000)]
Fix fipsinstall module path
If a path is specified with the -module option it will use this path to load the library when the provider is activated,
instead of also having to set the environment variable OPENSSL_MODULES.
Added a platform specific opt_path_end() function that uses existing functionality used by opt_progname().
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12761)
Richard Levitte [Wed, 9 Sep 2020 03:29:56 +0000 (05:29 +0200)]
STORE: Fix OSSL_STORE_attach() to check |ui_method| before use
ossl_pw_set_ui_method() demands that the passed |ui_method| be
non-NULL, and OSSL_STORE_attach() didn't check it beforehand.
While we're at it, we remove the passphrase caching that's set at the
library level, and trust the implementations to deal with that on
their own as needed.
Fixes #12830
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12831)
Dr. David von Oheimb [Wed, 2 Sep 2020 11:52:23 +0000 (13:52 +0200)]
Add/harmonize multi-valued RDN support and doc of ca, cmp, req, storeutl, and x509 apps
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12769)
Dr. David von Oheimb [Wed, 2 Sep 2020 11:50:04 +0000 (13:50 +0200)]
X509_NAME_cmp(): Clearly document its semantics, referencing relevant RFCs
Fixes #12765
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12769)
Dr. David von Oheimb [Fri, 4 Sep 2020 16:31:46 +0000 (18:31 +0200)]
X509_NAME_add_entry_by_txt.pod: Improve documentation w.r.t. multi-valued RDNs (containing sets of AVAs)
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12769)
Dr. David von Oheimb [Wed, 2 Sep 2020 11:12:22 +0000 (13:12 +0200)]
X509_NAME_cmp: restrict normal return values to {-1,0,1} to avoid confusion with -2 for error
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12769)
Dr. David von Oheimb [Wed, 2 Sep 2020 12:18:34 +0000 (14:18 +0200)]
X509_NAME_oneline(): Fix output of multi-valued RDNs, escaping '/' and '+' in values
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12769)
Dr. David von Oheimb [Wed, 2 Sep 2020 10:56:49 +0000 (12:56 +0200)]
X509_NAME_print_ex.pod: re-format lines to fit within 80 chars limit
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12769)
Dr. David von Oheimb [Tue, 8 Sep 2020 12:31:59 +0000 (14:31 +0200)]
app_load_config_bio(): fix crash on error
It turns out that the CONF_modules_load(conf, NULL, 0) call is just wrong.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12817)
Matt Caswell [Thu, 3 Sep 2020 10:50:30 +0000 (11:50 +0100)]
Fix an EVP_MD_CTX leak
If we initialise an EVP_MD_CTX with a legacy MD, and then reuse the same
EVP_MD_CTX with a provided MD then we end up leaking the md_data.
We need to ensure we free the md_data if we change to a provided MD.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12779)
Richard Levitte [Tue, 8 Sep 2020 11:07:46 +0000 (13:07 +0200)]
Diverse build.info: Adjust paths
Fixes #12815
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/12816)
Dr. David von Oheimb [Tue, 8 Sep 2020 13:30:33 +0000 (15:30 +0200)]
bugfix in apps/cmp.c and cmp_client.c: inconsistencies on retrieving extraCerts in code and doc
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12822)
Dr. David von Oheimb [Fri, 4 Sep 2020 15:09:13 +0000 (17:09 +0200)]
bugfix in ossl_cmp_msg_protect(): set senderKID and extend extraCerts also for unprotected CMP requests
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12822)
Dr. David von Oheimb [Fri, 4 Sep 2020 08:58:26 +0000 (10:58 +0200)]
bugfix in ossl_cmp_msg_add_extraCerts(): should include cert chain when using PBM
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12822)
Dr. David von Oheimb [Fri, 4 Sep 2020 13:10:22 +0000 (15:10 +0200)]
test/cmp_{client,msg}_test.c: minor code cleanup
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12655)
Dr. David von Oheimb [Fri, 4 Sep 2020 13:09:32 +0000 (15:09 +0200)]
test/recipes/81-test_cmp_cli_data/Mock/server.cnf: minor cleanup
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12655)
Dr. David von Oheimb [Sun, 30 Aug 2020 11:22:57 +0000 (13:22 +0200)]
81-test_cmp_cli: Make test output files all different according to #11080
Also some minor improvements mostly of test cases regarding PKCS#10 CSR input
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12655)