summaryrefslogtreecommitdiff
path: root/CHANGES
Commit message (Collapse)AuthorAgeFilesLines
* doc: convert standard project docs to markdownDr. Matthias St. Pierre2020-02-261-13926/+0
| | | | | | | | | In the first step, we just add the .md extension and move some files around, without changing any content. These changes will occur in the following commits. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10545)
* DH: add CHANGES entry listing the deprecated DH functions.Pauli2020-02-201-0/+23
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11024)
* Deprecate the low level RSA functions.Pauli2020-02-201-0/+39
| | | | | | | | Use of the low level RSA functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11063)
* Deprecate EC command line apps.Pauli2020-02-181-0/+4
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11106)
* TEST: Create test specific output directoriesRichard Levitte2020-02-181-0/+5
| | | | | | | | | | | | | | | | | | | | | We had all tests run with test/test-runs/ as working directory, and tests cleaned up after themselves... which is well and good, until you want to have a look at what went wrong when a complex test fails, and you have to recreate everything it does manually. To remedy this, we have OpenSSL::Test create the result directory dynamically (and cleaning it up first if it's already there) and let the test recipe have that as working directory. Test recipes are now encouraged to name their diverse output files uniquely, and not to clean them up, to allow a developer to have a look at the files that were produced. With continuous integration that allows this, the result directories could also be archived and be left as a build artifact. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11080)
* Deprecate the low level DSA functions.Pauli2020-02-121-0/+26
| | | | | | | | Use of the low level DSA functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
* Fix misspelling errors and typos reported by codespellDr. Matthias St. Pierre2020-02-061-9/+9
| | | | | | | Fixes #10998 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11000)
* Add cmd-nits to travis buildRich Salz2020-02-061-9/+11
| | | | | | | | | | Update CHANGES to have a complete and uniform description. Fixes #9730 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10972)
* Stop accepting certificates signed using SHA1 at security level 1Kurt Roeckx2020-02-051-0/+12
| | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> GH: #10786
* Deprecate the ECDSA and EV_KEY_METHOD functions.Pauli2020-02-041-17/+42
| | | | | | | | Use of the low level ECDSA and EC_KEY_METHOD functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10960)
* CHANGES: Add note about the refactoring of SM2 EVP_PKEYsRichard Levitte2020-02-021-0/+13
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10942)
* Deprecate the low level HMAC functionsPauli2020-01-291-0/+14
| | | | | | | | | | | Use of the low level HMAC functions has been informally discouraged for a long time. We now formally deprecate them. Applications should instead use EVP_MAC_CTX_new(3), EVP_MAC_CTX_free(3), EVP_MAC_init(3), EVP_MAC_update(3) and EVP_MAC_final(3). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10836)
* Deprecate the low level CMAC functionsPauli2020-01-291-0/+10
| | | | | | | | | | | Use of the low level CMAC functions has been informally discouraged for a long time. We now formally deprecate them. Applications should instead use EVP_MAC_CTX_new(3), EVP_MAC_CTX_free(3), EVP_MAC_init(3), EVP_MAC_update(3) and EVP_MAC_final(3). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10836)
* EVP: Adapt EVP_PKEY Seal and Open for provider keysRichard Levitte2020-01-251-0/+6
| | | | | | | | | | | This affects the following function, which can now deal with provider side keys: - EVP_SealInit() - EVP_OpenInit() Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10808)
* Add CHANGES entry regarding the documentation of EVP_PKEY_size() et alRichard Levitte2020-01-171-0/+6
| | | | | Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10778)
* changes: combined CHANGES entry for deprecated low level cipher functions.Pauli2020-01-171-33/+32
| | | | | | | [skip ci] Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10820)
* Digest function deprecation CHANGES.Pauli2020-01-171-0/+19
| | | | | | | | | | | Add a changes entry to cover the deprecation of the low level digest functions: MD2, MD4, MD5, MDC2, RIPEMD160, SHA1, SHA224, SHA256, SHA384, SHA512 and Whirlpool [skip ci] Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10802)
* Change returned -2 to 0 in EVP_Digest{Sign,Verify}Init()Richard Levitte2020-01-151-0/+9
| | | | | | | | | | The returned -2 was to mark when these operations are unsupported. However, that breaks away from the previous API and expectations, and there's not enough justification for that not being zero. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10815)
* Deprecate the Low Level CAST APIsMatt Caswell2020-01-131-0/+9
| | | | | | | | Applications should instead use the higher level EVP APIs, e.g. EVP_Encrypt*() and EVP_Decrypt*(). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10742)
* Deprecate Low Level Camellia APIsMatt Caswell2020-01-131-0/+10
| | | | | | | | Applications should instead use the higher level EVP APIs, e.g. EVP_Encrypt*() and EVP_Decrypt*(). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10741)
* Deprecate Low Level Blowfish APIsMatt Caswell2020-01-081-0/+9
| | | | | | | | | Applications should instead use the higher level EVP APIs, e.g. EVP_Encrypt*() and EVP_Decrypt*(). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10740)
* Deprecate the low level AES functionsMatt Caswell2020-01-061-1/+11
| | | | | | | | | | | | Use of the low level AES functions has been informally discouraged for a long time. We now formally deprecate them. Applications should instead use the EVP APIs, e.g. EVP_EncryptInit_ex, EVP_EncryptUpdate, EVP_EncryptFinal_ex, and the equivalently named decrypt functions. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10580)
* Use a function to generate do-not-edit commentRich Salz2019-12-191-0/+4
| | | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10316)
* Deprecate most of debug-memoryRich Salz2019-12-141-0/+4
| | | | | | | | | | | | | | | | | | | | | Fixes #8322 The leak-checking (and backtrace option, on some platforms) provided by crypto-mdebug and crypto-mdebug-backtrace have been mostly neutered; only the "make malloc fail" capability remains. OpenSSL recommends using the compiler's leak-detection instead. The OPENSSL_DEBUG_MEMORY environment variable is no longer used. CRYPTO_mem_ctrl(), CRYPTO_set_mem_debug(), CRYPTO_mem_leaks(), CRYPTO_mem_leaks_fp() and CRYPTO_mem_leaks_cb() return a failure code. CRYPTO_mem_debug_{malloc,realloc,free}() have been removed. All of the above are now deprecated. Merge (now really small) mem_dbg.c into mem.c Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10572)
* Add better support for using deprecated symbols internallyRichard Levitte2019-12-131-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OPENSSL_SUPPRESS_DEPRECATED only does half the job, in telling the deprecation macros not to add the warning attribute. However, with 'no-deprecated', the symbols are still removed entirely, while we might still want to use them internally. The solution is to permit <openssl/opensslconf.h> macros to be modified internally, such as undefining OPENSSL_NO_DEPRECATED in this case. However, with the way <openssl/opensslconf.h> includes <openssl/macros.h>, that's easier said than done. That's solved by generating <openssl/configuration.h> instead, and add a new <openssl/opensslconf.h> that includes <openssl/configuration.h> as well as <openssl/macros.h>, thus allowing to replace an inclusion of <openssl/opensslconf.h> with this: #include <openssl/configuration.h> #undef OPENSSL_NO_DEPRECATED #define OPENSSL_SUPPRESS_DEPRECATED #include <openssl/macros.h> Or simply add the following prior to any other openssl inclusion: #include <openssl/configuration.h> #undef OPENSSL_NO_DEPRECATED #define OPENSSL_SUPPRESS_DEPRECATED Note that undefining OPENSSL_NO_DEPRECATED must never be done by applications, since the symbols must still be exported by the library. Internal test programs are excempt of this rule, though. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10608)
* Add a CHANGES entry for CVE-2019-1551Bernd Edlinger2019-12-061-0/+12
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10574)
* Add NEWS and CHANGES entries about OSSL_SERIALIZERRichard Levitte2019-11-291-0/+18
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
* Add a .pragma directive for configuration filesRichard Levitte2019-11-121-0/+12
| | | | | | | | | | | | | | Currently added pragma: .pragma dollarid:on This allows dollar signs to be a keyword character unless it's followed by a opening brace or parenthesis. Fixes #8207 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8882)
* Add EVP functionality to create domain params and keys by user dataRichard Levitte2019-11-071-0/+7
| | | | | | | | | This is the EVP operation that corresponds to creating direct RSA, DH and DSA keys and set their numbers, to then assign them to an EVP_PKEY, but done entirely using an algorithm agnostic EVP interface. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10187)
* Change the logic and behaviour surrounding '--api' and 'no-deprecated'Richard Levitte2019-11-071-9/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At some point in time, there was a 'no-deprecated' configuration option, which had the effect of hiding all declarations of deprecated stuff, i.e. make the public API look like they were all removed. At some point in time, there was a '--api' configuration option, which had the effect of having the public API look like it did in the version given as value, on a best effort basis. In practice, this was used to get different implementations of BN_zero(), depending on the desired API compatibility level. At some later point in time, '--api' was changed to mean the same as 'no-deprecated', but only for the deprecations up to and including the desired API compatibility level. BN_zero() has been set to the pre-1.0.0 implementation ever since, unless 'no-deprecation' has been given. This change turns these options back to their original meaning, but with the slight twist that when combined, i.e. both '--api' and 'no-deprecated' is given, the declarations that are marked deprecated up to an including the desired API compatibility level are hidden, simulating that they have been removed. If no desired API compatibility level has been given, then configuration sets the current OpenSSL version by default. Furthermore, the macro OPENSSL_API_LEVEL is now used exclusively to check what API compatibility level is desired. For checking in code if `no-deprecated` has been configured for the desired API compatibility level, macros for each supported level is generated, such as OPENSSL_NO_DEPRECATED_1_1_1, corresponding to the use of DEPRECATEDIN_ macros, such as DEPRECATEDIN_1_1_1(). Just like before, to set an API compatibility level when building an application, define OPENSSL_API_COMPAT with an appropriate value. If it's desirable to hide deprecated functions up to and including that level, additionally define OPENSSL_NO_DEPRECATED (the value is ignored). Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
* X509_LOOKUP_store: Add CHANGES noteRichard Levitte2019-11-031-0/+24
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8442)
* VMS: Added new method to gather entropy on VMS, based on SYS$GET_ENTROPY.Richard Levitte2019-11-021-0/+4
| | | | | | | | | This system services is based on FreeBSD 12's getentropy(), and is therefore treated the same way as getentropy() with regards to amount of entropy bits per data bit. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8926)
* Add EVP_PKEY_CTX_new_provided()Richard Levitte2019-10-161-0/+8
| | | | | | | | | | | | | | | | | | This works as much as possible EVP_PKEY_CTX_new_id(), except it takes data that's relevant for providers, algorithm name and property query string instead of NID and engine. Additionally, if EVP_PKEY_CTX_new() or EVP_PKEY_CTX_new_id() was called, the algorithm name in the EVP_PKEY context will be set to the short name of the given NID (explicit or the one of the given EVP_PKEY), thereby giving an easier transition from legacy methods to provided methods. The intent is that operations will use this information to fetch provider methods implicitly as needed. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10184)
* Deprecate NCONF_WIN32() functionRich Salz2019-10-061-0/+4
| | | | | | | | Extensive documentation added in HISTORY section in doc/man5/config.pod Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9578)
* Rename "private" file, doc doc changes in CHANGESRich Salz2019-10-031-0/+5
| | | | | | | | | | | | Use err() for find-doc-nits -e output Doing this meant we could remove the -s flag, so we do so; move option/help stuff to top of script. Add a CHANGES entry. Rename missing to other.syms Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10039)
* Update documentationMatt Caswell2019-10-031-0/+6
| | | | | | | | Add documentation for EVP_DigestSignInit_ex() and EVP_DigestVerifyInit_ex(), and add an appropriate CHANGES entry. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10013)
* s390x assembly pack: accelerate X25519, X448, Ed25519 and Ed448Patrick Steuer2019-09-251-0/+4
| | | | | | | | | using PCC and KDSA instructions. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10004)
* apps/pkcs12: print multiple PKCS#12 safeBag attribute values if presentJon Spillett2019-09-171-0/+4
| | | | | | | | | | | Currently the pkcs12 app will only ever print the first value of a multi-value attribute. This is OK for some attributes (e.g. friendlyName, localKeyId) but may miss values for other attributes. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/9751)
* Document the deprecation of ERR_STATE and ERR_get_state()Richard Levitte2019-09-121-0/+5
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9462)
* Add a CHANGES entry for the recent ERR changesRichard Levitte2019-09-121-0/+13
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9756)
* Rework test/run_tests.pl to support selective verbosity and TAP copyRichard Levitte2019-09-121-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | This includes a complete rework of how we use TAP::Harness, by adding a TAP::Parser subclass that allows additional callbacks to be passed to perform what we need. The TAP::Parser callbacks we add are: ALL to print all the TAP output to a file (conditionally) to collect all the TAP output to an array (conditionally) EOF to print all the collected TAP output (if there is any) if any subtest failed To get TAP output to file, the environment variable HARNESS_TAP_COPY must be defined, with a file name as value. That file will be overwritten unconditionally. To get TAP output displayed on failure, the make variable VERBOSE_FAILURE or VF must be defined with a non-emoty value. Additionally, the output of test recipe names has been changed to only display its basename. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9862)
* Fix a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkeyBernd Edlinger2019-09-101-0/+14
| | | | | | | | | | | | | | | | | | | An attack is simple, if the first CMS_recipientInfo is valid but the second CMS_recipientInfo is chosen ciphertext. If the second recipientInfo decodes to PKCS #1 v1.5 form plaintext, the correct encryption key will be replaced by garbage, and the message cannot be decoded, but if the RSA decryption fails, the correct encryption key is used and the recipient will not notice the attack. As a work around for this potential attack the length of the decrypted key must be equal to the cipher default key length, in case the certifiate is not given and all recipientInfo are tried out. The old behaviour can be re-enabled in the CMS code by setting the CMS_DEBUG_DECRYPT flag. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9777)
* [ec] Match built-in curves on EC_GROUP_new_from_ecparametersNicola Tuveri2019-09-091-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Description ----------- Upon `EC_GROUP_new_from_ecparameters()` check if the parameters match any of the built-in curves. If that is the case, return a new `EC_GROUP_new_by_curve_name()` object instead of the explicit parameters `EC_GROUP`. This affects all users of `EC_GROUP_new_from_ecparameters()`: - direct calls to `EC_GROUP_new_from_ecparameters()` - direct calls to `EC_GROUP_new_from_ecpkparameters()` with an explicit parameters argument - ASN.1 parsing of explicit parameters keys (as it eventually ends up calling `EC_GROUP_new_from_ecpkparameters()`) A parsed explicit parameter key will still be marked with the `OPENSSL_EC_EXPLICIT_CURVE` ASN.1 flag on load, so, unless programmatically forced otherwise, if the key is eventually serialized the output will still be encoded with explicit parameters, even if internally it is treated as a named curve `EC_GROUP`. Before this change, creating any `EC_GROUP` object using `EC_GROUP_new_from_ecparameters()`, yielded an object associated with the default generic `EC_METHOD`, but this was never guaranteed in the documentation. After this commit, users of the library that intentionally want to create an `EC_GROUP` object using a specific `EC_METHOD` can still explicitly call `EC_GROUP_new(foo_method)` and then manually set the curve parameters using `EC_GROUP_set_*()`. Motivation ---------- This has obvious performance benefits for the built-in curves with specialized `EC_METHOD`s and subtle but important security benefits: - the specialized methods have better security hardening than the generic implementations - optional fields in the parameter encoding, like the `cofactor`, cannot be leveraged by an attacker to force execution of the less secure code-paths for single point scalar multiplication - in general, this leads to reducing the attack surface Check the manuscript at https://arxiv.org/abs/1909.01785 for an in depth analysis of the issues related to this commit. It should be noted that `libssl` does not allow to negotiate explicit parameters (as per RFC 8422), so it is not directly affected by the consequences of using explicit parameters that this commit fixes. On the other hand, we detected external applications and users in the wild that use explicit parameters by default (and sometimes using 0 as the cofactor value, which is technically not a valid value per the specification, but is tolerated by parsers for wider compatibility given that the field is optional). These external users of `libcrypto` are exposed to these vulnerabilities and their security will benefit from this commit. Related commits --------------- While this commit is beneficial for users using built-in curves and explicit parameters encoding for serialized keys, commit b783beeadf6b80bc431e6f3230b5d5585c87ef87 (and its equivalents for the 1.0.2, 1.1.0 and 1.1.1 stable branches) fixes the consequences of the invalid cofactor values more in general also for other curves (CVE-2019-1547). The following list covers commits in `master` that are related to the vulnerabilities presented in the manuscript motivating this commit: - d2baf88c43 [crypto/rsa] Set the constant-time flag in multi-prime RSA too - 311e903d84 [crypto/asn1] Fix multiple SCA vulnerabilities during RSA key validation. - b783beeadf [crypto/ec] for ECC parameters with NULL or zero cofactor, compute it - 724339ff44 Fix SCA vulnerability when using PVK and MSBLOB key formats Note that the PRs that contributed the listed commits also include other commits providing related testing and documentation, in addition to links to PRs and commits backporting the fixes to the 1.0.2, 1.1.0 and 1.1.1 branches. Responsible Disclosure ---------------------- This and the other issues presented in https://arxiv.org/abs/1909.01785 were reported by Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya and Billy Bob Brumley from the NISEC group at Tampere University, FINLAND. The OpenSSL Security Team evaluated the security risk for this vulnerability as low, and encouraged to propose fixes using public Pull Requests. _______________________________________________________________________________ Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9808)
* CHANGES entry: for ECC parameters with NULL or zero cofactor, compute itBilly Brumley2019-09-071-0/+7
| | | | | | | | | | | | This is a forward port from https://github.com/openssl/openssl/pull/9781 of the CHANGES entry for the functionality added in https://github.com/openssl/openssl/pull/9727 (cherry picked from commit 4b965086cb56c24cb5d2197fc04869b95f209a11) Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9797)
* Fix NITs in comments and CHANGES for DEVRANDOM seeded check.Pauli2019-08-301-2/+2
| | | | | Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/9734)
* Start up DEVRANDOM entropy improvement for older Linux devices.Pauli2019-08-201-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Improve handling of low entropy at start up from /dev/urandom by waiting for a read(2) call on /dev/random to succeed. Once one such call has succeeded, a shared memory segment is created and persisted as an indicator to other processes that /dev/urandom is properly seeded. This does not fully prevent against attacks weakening the entropy source. An attacker who has control of the machine early in its boot sequence could create the shared memory segment preventing detection of low entropy conditions. However, this is no worse than the current situation. An attacker would also be capable of removing the shared memory segment and causing seeding to reoccur resulting in a denial of service attack. This is partially mitigated by keeping the shared memory alive for the duration of the process's existence. Thus, an attacker would not only need to have called call shmctl(2) with the IPC_RMID command but the system must subsequently enter a state where no instances of libcrypto exist in any process. Even one long running process will prevent this attack. The System V shared memory calls used here go back at least as far as Linux kernel 2.0. Linux kernels 4.8 and later, don't have a reliable way to detect that /dev/urandom has been properly seeded, so a failure is raised for this case (i.e. the getentropy(2) call has already failed). Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9595)
* Add a CHANGES entry for BN_generate_prime_exBernd Edlinger2019-08-091-0/+9
| | | | | | | | BN_generate_prime_ex no longer avoids factors 3..17863 in p-1 when not computing safe primes. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9309)
* Correct the Extended Master Secret string for EBCDICMatt Caswell2019-08-061-0/+7
| | | | | | | | | The macro TLS_MD_MASTER_SECRET_CONST is supposed to hold the ascii string "extended master secret". On EBCDIC machines it actually contained the value "extecded master secret" Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9430)
* Replace FUNCerr with ERR_raise_dataRich Salz2019-08-021-4/+0
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9496)
* Add a CHANGES entry about loading the config file by defaultMatt Caswell2019-08-011-0/+6
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9492)
View Lorry Controller Status