summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Update NEWS.md before alpha11 releaseRichard Levitte2021-01-281-1/+5
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13996)
* APPS: Restore inclusionsRichard Levitte2021-01-282-0/+2
| | | | | | | | | | | An '#include <string.h>' was mistakenly removed from apps/ec.c and apps/ecparam.c Fixes #13986 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13989)
* Fix running mingw dhparam test under wineMatt Caswell2021-01-271-1/+3
| | | | | | | | | | The dhparam test was failing to properly handle line endings when running a mingw configured build under wine. Fixes #13557 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13923)
* Fix typo in thread_once commentsDaniel Bevenius2021-01-271-3/+3
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13964)
* Fix OSSL_PARAM_allocate_from_text() for EBCDICRichard Levitte2021-01-272-2/+9
| | | | | | | | | | | | | | | | | OSSL_PARAM_allocate_from_text() converted text values to UTF-8 OSSL_PARAMs with a simple strncpy(). However, if the text is EBCDIC, that won't become UTF-8. Therefore, it's made to convert from EBCDIC to ASCII on platforms where the native character encoding is the former. One might argue that the conversion should be the responsibility of the application. However, this is a helper function, and the calling application can't easily know what sort of OSSL_PARAM the input values are going to be used for. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13961)
* TLS client: allow cert verify callback return -1 for SSL_ERROR_WANT_RETRY_VERIFYDr. David von Oheimb2021-01-2614-111/+295
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The client-side cert verification callback function may not only return as usual for success or 0 for failure, but also -1, typically on failure verifying the server certificate. This makes the handshake suspend and return control to the calling application with SSL_ERROR_WANT_RETRY_VERIFY. The app can for instance fetch further certificates or cert status information needed for the verification. Calling SSL_connect() again resumes the connection attempt by retrying the server certificate verification step. This process may even be repeated if need be. The core implementation of the feature is in ssl/statem/statem_clnt.c, splitting tls_process_server_certificate() into a preparation step that just copies the certificates received from the server to s->session->peer_chain (rather than having them in a local variable at first) and returns to the state machine, and a post-processing step in tls_post_process_server_certificate() that can be repeated: Try verifying the current contents of s->session->peer_chain basically as before, but give the verification callback function the chance to pause connecting and make the TLS state machine later call tls_post_process_server_certificate() again. Otherwise processing continues as usual. The documentation of the new feature is added to SSL_CTX_set_cert_verify_callback.pod and SSL_want.pod. This adds two tests: * A generic test in test/helpers/handshake.c on the usability of the new server cert verification retry feature. It is triggered via test/ssl-tests/03-custom_verify.cnf.in (while the bulky auto- generated changes to test/ssl-tests/03-custom_verify.cnf can be basically ignored). * A test in test/sslapitest.c that demonstrates the effectiveness of the approach for augmenting the cert chain provided by the server in between SSL_connect() calls. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13906)
* params: OSSL_PARAM_utf8_ptr: don't automatically reference `address`Daiki Ueno2021-01-263-11/+11
| | | | | | | | | | | Since the pointer can be later be modified, the caller should have the responsibility to supply the address of that. Signed-off-by: Daiki Ueno <dueno@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13951)
* DOC: Fix a few minor issues in OSSL_ENCODER / OSSL_DECODER docsRichard Levitte2021-01-262-5/+5
| | | | | | | Partially fixes #13949 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13954)
* Clean away unnecessary length related OSSL_PARAM key namesRichard Levitte2021-01-269-38/+13
| | | | | | | This cleans away old misunderstandings of what can be done with OSSL_PARAM. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13946)
* Check that the ecparam and pkeyparam do not mangle the parametersTomas Mraz2021-01-2631-22/+76
| | | | | | | | | | Just comparison of the original parameter file with the -out output. Some test files have non-canonical encoding, so they are moved to a different directory. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* Add checks for NULL return from EC_KEY_get0_group()Tomas Mraz2021-01-262-2/+9
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* ec: Document that -conv_form and -no_public are not supported with engineTomas Mraz2021-01-261-0/+3
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* ssl_old_test.c: Replace use of deprecated EC functionsTomas Mraz2021-01-261-11/+7
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* EVP_PKEY_get_group_name works with public keys as wellTomas Mraz2021-01-261-1/+1
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* Add manpage for EVP_PKEY_get_field_type and EVP_PKEY_get_point_conv_formTomas Mraz2021-01-261-0/+55
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* Avoid using OSSL_PKEY_PARAM_GROUP_NAME when the key might be legacyTomas Mraz2021-01-265-60/+20
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* Disable the test-ec completely when building with no-ecTomas Mraz2021-01-262-131/+110
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* Add EVP_PKEY functions to get EC conv form and field typeMatt Caswell2021-01-265-27/+105
| | | | | | | | | libssl at the moment downgrades an EVP_PKEY to an EC_KEY object in order to get the conv form and field type. Instead we provide EVP_PKEY level functions to do this. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* Deprecate EC_KEY + Update ec apps to use EVP_PKEYShane Lontis2021-01-2651-950/+1406
| | | | | | | | | Co-author: Richard Levitte <levitte@openssl.org> Co-author: Tomas Mraz <tmraz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* Add functions to set values into an EVP_PKEYShane Lontis2021-01-264-0/+203
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
* krb5kdf: Do not dereference NULL ctx when allocation failsTomas Mraz2021-01-261-1/+3
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13953)
* Drop TravisRichard Levitte2021-01-253-277/+10
| | | | | | | | At this point, we have transitioned completely from Travis to GitHub Actions Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13940)
* Github CI: Add a job for out-of-source build + installRichard Levitte2021-01-251-0/+21
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13935)
* Unix Makefile generator: Fix empty basename callsRichard Levitte2021-01-251-13/+17
| | | | | | | Fixes #13933 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13935)
* bn: Deprecate the X9.31 RSA key generation related functionsTomas Mraz2021-01-257-8/+23
| | | | | | | | | This key generation method is obsolete. Fixes #10111 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13921)
* OCSP HTTP: Restore API of undocumented and recently deprecated functionsDr. David von Oheimb2021-01-236-48/+49
| | | | | | | | | | | Restore parameters of OCSP_REQ_CTX_new(), OCSP_REQ_CTX_http(), OCSP_REQ_CTX_i2d(). Fix a bug (wrong HTTP method selected on req == NULL in OCSP_sendreq_new(). Minor further fixes in OSSL_HTTP_REQ_CTX.pod Fixes #13873 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13898)
* OSSL_HTTP_REQ_CTX.pod: minor addition and remove redundant paragraphDr. David von Oheimb2021-01-231-5/+2
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13898)
* OSSL_HTTP_REQ_CTX_new(): replace method_GET parameter by method_POSTDr. David von Oheimb2021-01-232-24/+26
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13898)
* rename OSSL_HTTP_REQ_CTX_header to OSSL_HTTP_REQ_CTX_set_request_lineDr. David von Oheimb2021-01-236-22/+24
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13898)
* Add check of HTTP method to OSSL_HTTP_REQ_CTX_content()Dr. David von Oheimb2021-01-231-0/+4
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13898)
* Util/Pod.pm: Fix uninitialized $podinfo{lastsecttext} on empty inputDr. David von Oheimb2021-01-231-0/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13898)
* Fix no-dh and no-dsaMatt Caswell2021-01-221-5/+5
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13915)
* Don't copy parameters on setting a key in libsslMatt Caswell2021-01-222-22/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Whenever we set a private key in libssl, we first found the certificate that matched the key algorithm. Then we copied the key parameters from the private key into the public key for the certficate before finally checking that the private key matched the public key in the certificate. This makes no sense! Part of checking the private key is to make sure that the parameters match. It seems that this code has been present since SSLeay. Perhaps at some point it made sense to do this - but it doesn't any more. We remove that piece of code altogether. The previous code also had the undocumented side effect of removing the certificate if the key didn't match. This makes sense if you've just overwritten the parameters in the certificate with bad values - but doesn't seem to otherwise. I've also removed that error logic. Due to issue #13893, the public key associated with the certificate is always a legacy key. EVP_PKEY_copy_parameters will downgrade the "from" key to legacy if the target is legacy, so this means that in libssl all private keys were always downgraded to legacy when they are first set in the SSL/SSL_CTX. Removing the EVP_PKEY_copy_parameters code has the added benefit of removing that downgrade. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13899)
* Ensure legacy_asn1_ctrl_to_param can handle MDs not in the OBJ databaseMatt Caswell2021-01-221-4/+33
| | | | | | | | | | | | | The legacy_asn1_ctrl_to_param implementation of ASN1_PKEY_CTRL_DEFAULT_MD_NID calls EVP_PKEY_get_default_digest_name() which returns an mdname. Previously we were using OBJ_sn2nid/OBJ_ln2nid to lookup that name in the OBJ database. However we might get an md name back that only exists in the namemap, not in the OBJ database. In that case we need to check the various aliases for the name, to see if one of those matches the name we are looking for. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13899)
* Unix Makefile generator: separate "simple" shared libraries from import ↵Richard Levitte2021-01-213-27/+63
| | | | | | | | | | | | | | | | | | | | | libraries For Unix like environments, we may have so called "simple" shared library names (libfoo.so as opposed to libfoo.so.1.2), or we may have "import" library names associated with a DLL (libfoo.dll.a for libfoo.dll on Mingw and derivatives). So far, "import" library names were treated the same as "simple" shared library names, as some kind of normalization for the Unix way of doing things. We now shift to treat them separately, to make it clearer what is what. Fixes #13414, incidently Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13875)
* Check input size before NULL pointer test inside mem_write()zsugabubus2021-01-211-4/+4
| | | | | | | | | | | Checking is performed after the read-only test so it catches such errors earlier. CLA: trivial Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13786)
* dh_cms_set_shared_info: Use explicit fetch to be able to provide libctxTomas Mraz2021-01-212-3/+11
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13869)
* dh_cms_set_peerkey: The peer key is encoded as an ASN.1 integerTomas Mraz2021-01-211-1/+15
| | | | | | | | It must be decoded from the ASN.1 integer before setting to the EVP_PKEY. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13869)
* Make the smdh.pem test certificate usable with fips providerTomas Mraz2021-01-212-31/+44
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13869)
* kdf_exch.c (kdf_derive): Proper handling of NULL secretTomas Mraz2021-01-211-1/+7
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13869)
* Fixes related to broken DH support in CMSTomas Mraz2021-01-214-14/+16
| | | | | | | | | | - DH support should work with both DH and DHX keys - UKM parameter is optional so it can have length 0 Fixes #13810 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13869)
* Pass correct maximum output length to provider derive operationTomas Mraz2021-01-212-9/+9
| | | | | | | And improve error checking in EVP_PKEY_derive* calls. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13869)
* CMP: Allow PKCS#10 input also for ir, cr, kur, and rr messagesDr. David von Oheimb2021-01-2111-133/+195
| | | | | | | | | Also update documentation regarding sources of certs and keys, improve type of OSSL_CMP_exec_RR_ses(), add tests for CSR-based cert revocation Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13841)
* X509_REQ_get_extensions(): Return empty stack if no extensions foundDr. David von Oheimb2021-01-211-1/+3
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13841)
* apps/cmp.c: Check self-signature on CSR input and warn on failureDr. David von Oheimb2021-01-211-0/+8
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13841)
* apps/cmp.c: Improve diagnostics on loading private vs. public key for cert ↵Dr. David von Oheimb2021-01-211-2/+8
| | | | | | | request Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13841)
* CI: Add some legacy stuff that we do not test in GitHub CI yetTomas Mraz2021-01-211-1/+1
| | | | | | | There are some options that seem to belong to the legacy build. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13903)
* fall-back -> fallback find-doc-nit additionMichael Baentsch2021-01-211-0/+1
| | | | | | | | Ensure the same term is used for fallback Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13862)
* Fix typo in crl2pkcs documentationTim Hitchins2021-01-211-1/+1
| | | | | | | | | | | Fixes #13910 CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13911)
* Deprecate EVP_KEY_new_CMAC_key and EVP_PKEY_new_CMAC_key_exRich Salz2021-01-216-39/+46
| | | | | | | | | | | EVP_KEY_new_CMAC_key_ex was in the pre-release 3.0 only, so is safe to remove. Restore 1.1.1 version of EVP_PKEY_new_CMAC_key documentation. Also make testing of EVP_PKEY_new_CMAC_key properly #ifdef'd. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13829)
View Lorry Controller Status