summaryrefslogtreecommitdiff
path: root/crypto
Commit message (Collapse)AuthorAgeFilesLines
...
* Allow OBJ_create() to create an OBJ and NID with a NULL OIDRichard Levitte2022-12-131-5/+17
| | | | | | | | | We already permit this in crypto/objects/objects.txt, but not programatically, although being able to do so programatically would be beneficial. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19876)
* Make error reason for disallowed legacy sigalg more specificTomas Mraz2022-12-131-0/+2
| | | | | | | | | | | The internal error reason is confusing and indicating an error in OpenSSL and not a configuration problem. Fixes #19867 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19875)
* Fix SM4-CBC regression on Armv8fangming.fang2022-12-131-1/+1
| | | | | | | | | | | | | | Fixes #19858 During decryption, the last ciphertext is not fed to next block correctly when the number of input blocks is exactly 4. Fix this and add the corresponding test cases. Thanks xu-yi-zhou for reporting this issue and proposing the fix. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19872)
* crypto/err: expand on error code generationČestmír Kalina2022-12-121-0/+11
| | | | | | | | | Signed-off-by: Čestmír Kalina <ckalina@redhat.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19823)
* smime/pkcs7: disable the Bleichenbacher workaroundHubert Kario2022-12-121-0/+7
| | | | | | | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13817)
* rsa: Add option to disable implicit rejectionHubert Kario2022-12-124-6/+43
| | | | | | | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13817)
* rsa: add implicit rejection in PKCS#1 v1.5Hubert Kario2022-12-122-1/+346
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RSA decryption as implemented before required very careful handling of both the exit code returned by OpenSSL and the potentially returned ciphertext. Looking at the recent security vulnerabilities (CVE-2020-25659 and CVE-2020-25657) it is unlikely that most users of OpenSSL do it correctly. Given that correct code requires side channel secure programming in application code, we can classify the existing RSA decryption methods as CWE-676, which in turn likely causes CWE-208 and CWE-385 in application code. To prevent that, we can use a technique called "implicit rejection". For that we generate a random message to be returned in case the padding check fails. We generate the message based on static secret data (the private exponent) and the provided ciphertext (so that the attacker cannot determine that the returned value is randomly generated instead of result of decryption and de-padding). We return it in case any part of padding check fails. The upshot of this approach is that then not only is the length of the returned message useless as the Bleichenbacher oracle, so are the actual bytes of the returned message. So application code doesn't have to perform any operations on the returned message in side-channel free way to remain secure against Bleichenbacher attacks. Note: this patch implements a specific algorithm, shared with Mozilla NSS, so that the attacker cannot use one library as an oracle against the other in heterogeneous environments. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13817)
* x509: fix double locking problemPauli2022-12-081-4/+0
| | | | | | | | | | | | | This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the redundant flag setting. Fixes #19643 Fixes LOW CVE-2022-3996 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19652)
* signature: Clamp PSS salt len to MD lenClemens Lang2022-12-082-6/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FIPS 186-4 section 5 "The RSA Digital Signature Algorithm", subsection 5.5 "PKCS #1" says: "For RSASSA-PSS […] the length (in bytes) of the salt (sLen) shall satisfy 0 <= sLen <= hLen, where hLen is the length of the hash function output block (in bytes)." Introduce a new option RSA_PSS_SALTLEN_AUTO_DIGEST_MAX and make it the default. The new value will behave like RSA_PSS_SALTLEN_AUTO, but will not use more than the digest length when signing, so that FIPS 186-4 is not violated. This value has two advantages when compared with RSA_PSS_SALTLEN_DIGEST: (1) It will continue to do auto-detection when verifying signatures for maximum compatibility, where RSA_PSS_SALTLEN_DIGEST would fail for other digest sizes. (2) It will work for combinations where the maximum salt length is smaller than the digest size, which typically happens with large digest sizes (e.g., SHA-512) and small RSA keys. J.-S. Coron shows in "Optimal Security Proofs for PSS and Other Signature Schemes. Advances in Cryptology – Eurocrypt 2002, volume 2332 of Lecture Notes in Computer Science, pp. 272 – 287. Springer Verlag, 2002." that longer salts than the output size of modern hash functions do not increase security: "For example,for an application in which at most one billion signatures will be generated, k0 = 30 bits of random salt are actually sufficient to guarantee the same level of security as RSA, and taking a larger salt does not increase the security level." Signed-off-by: Clemens Lang <cllang@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19724)
* Obtain PSS salt length from providerClemens Lang2022-12-082-26/+36
| | | | | | | | | | | | | | | | | | | | | | | Rather than computing the PSS salt length again in core using ossl_rsa_ctx_to_pss_string, which calls rsa_ctx_to_pss and computes the salt length, obtain it from the provider using the OSSL_SIGNATURE_PARAM_ALGORITHM_ID param to handle the case where the interpretation of the magic constants in the provider differs from that of OpenSSL core. Add tests that verify that the rsa_pss_saltlen:max, rsa_pss_saltlen:<integer> and rsa_pss_saltlen:digest options work and put the computed digest length into the CMS_ContentInfo struct when using CMS. Do not add a test for the salt length generated by a provider when no specific rsa_pss_saltlen option is defined, since that number could change between providers and provider versions, and we want to preserve compatibility with older providers. Signed-off-by: Clemens Lang <cllang@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19724)
* prevent HPKE sender setting seq unwiselyStephen Farrell2022-12-081-1/+44
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19840)
* OSSL_CMP_validate_msg(): make sure to reject protection type mismatchDr. David von Oheimb2022-12-083-5/+12
| | | | | | | | | | Do not accept password-based if expected signature-based and no secret is available and do not accept signature-based if expected password-based and no trust anchors available. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19729)
* Compensate for CMP-related TODOs removed by PR #15539Dr. David von Oheimb2022-12-078-2/+26
| | | | | | | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/16006)
* Replace "a RSA" with "an RSA"Daniel Fiala2022-12-071-2/+2
| | | | | | | | | Fixes openssl#19771 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19787)
* Implement OSSL_PROVIDER_get0_default_search_path, add docs and tests.Patrick Mills2022-12-061-0/+13
| | | | | | Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19752)
* Fix the code used to detect aarch64 capabilities when we don't have getauxval()Tom Cosgrove2022-12-061-0/+2
| | | | | | | | | | In addition to a missing prototype there was also a missing closing brace '}'. Fixes #19825. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19833)
* Fix the check of BIO_set_write_buffer_size and BIO_set_read_buffer_sizePeiwei Hu2022-12-052-3/+3
| | | | | | Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19819)
* Fix the check of EVP_PKEY_decrypt_initPeiwei Hu2022-12-051-1/+1
| | | | | | Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19819)
* hpke: fix tests with disabled chacha20 or poly1305Tomas Mraz2022-12-051-4/+2
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/19784)
* Refactoring some operations to avoid repeated callsTomas Mraz2022-12-051-72/+54
| | | | | | | | | | | Fetch the EVP_CIPHER for aead in OSSL_HPKE_CTX_new() to avoid re-fetching on each aead operation. Save kem/kdf/aead_info in OSSL_HPKE_CTX. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/19784)
* hpke_aead_enc/dec(): Refactor to pass in OSSL_HPKE_CTX *Tomas Mraz2022-12-051-36/+18
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/19784)
* ossl_kdf_ctx_create(): Check for NULL KDF being fetchedTomas Mraz2022-12-051-0/+4
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/19784)
* Don't set cancel state/typeMatt Caswell2022-12-011-3/+0
| | | | | | | | | | | | | pthread_cancel() is never called by OpenSSL. Therefore this is no point in setting the cancel state/type. The functions to set the cancel state/type are not supported on Android and result in compilation failures. Therefore we remove these calls completely. Fixes #19559 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19779)
* Implement deterministic ECDSA sign (RFC6979)slontis2022-11-306-30/+301
| | | | | | | | | | | | | | | | | This PR is based off the contributions in PR #9223 by Jemmy1228. It has been modified and reworked to: (1) Work with providers (2) Support ECDSA and DSA (3) Add a KDF HMAC_DRBG implementation that shares code with the RAND HMAC_DRBG. A nonce_type is passed around inside the Signing API's, in order to support any future deterministic algorithms. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18809)
* Remove redundant assignment in felem_mul_ref in p521Rohan McLure2022-11-301-1/+0
| | | | | | | | | | ftmp4 is assigned immediately before receiving the reduced output of the multiplication of ftmp and ftmp3, without being read inbetween these assignments. Remove redundant assignment. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19766)
* providers: Add SM4 XTS implementationXu Yizhou2022-11-292-1/+200
| | | | | | | | Signed-off-by: Xu Yizhou <xuyizhou1@huawei.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19619)
* obj: Add SM4 XTS OIDXu Yizhou2022-11-293-5/+12
| | | | | | | | | | Add the following OID: SM4-XTS: 1.2.156.10197.1.104.10 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19619)
* Honor OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT as set and default to ↵Nicola Tuveri2022-11-291-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | UNCOMPRESSED Originally the code to im/export the EC pubkey was meant to be consumed only by the im/export functions when crossing the provider boundary. Having our providers exporting to a COMPRESSED format octet string made sense to avoid memory waste, as it wasn't exposed outside the provider API, and providers had all tools available to convert across the three formats. Later on, with #13139 deprecating the `EC_KEY_*` functions, more state was added among the params imported/exported on an EC provider-native key (including `OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT`, although it did not affect the format used to export `OSSL_PKEY_PARAM_PUB_KEY`). Finally, in #14800, `EVP_PKEY_todata()` was introduced and prominently exposed directly to users outside the provider API, and the choice of COMPRESSED over UNCOMPRESSED as the default became less sensible in light of usability, given the latter is more often needed by applications and protocols. This commit fixes it, by using `EC_KEY_get_conv_form()` to get the point format from the internal state (an `EC_KEY` under the hood) of the provider-side object, and using it on `EVP_PKEY_export()`/`EVP_PKEY_todata()` to format `OSSL_PKEY_PARAM_PUB_KEY`. The default for an `EC_KEY` was already UNCOMPRESSED, and it is altered if the user sets `OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT` via `EVP_PKEY_fromdata()`, `EVP_PKEY_set_params()`, or one of the more specialized methods. For symmetry, this commit also alters `ec_pkey_export_to()` in `crypto/ec/ec_ameth.c`, part of the `EVP_PKEY_ASN1_METHOD` for legacy EC keys: it exclusively used COMPRESSED format, and now it honors the conversion format specified in the EC_KEY object being exported to a provider when this function is called. Expand documentation about `OSSL_PKEY_PARAM_PUB_KEY` and mention the 3.1 change in behavior for our providers. Fixes #16595 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19681) (cherry picked from commit 926db476bc669fdcc4c4d2f1cb547060bdbfa153)
* Fix Coverity issues in HPKEslontis2022-11-291-20/+13
| | | | | | | | | | | | | | | | | | | | | | | | | CID 1517043 and 1517038: (Forward NULL) - Removed redundant check that is already done by the caller. It was complaining that it checked for ctlen == NULL and then did a goto that used this *ctlen. CID 1517042 and 1517041: (Forward NULL) - Similar to above for ptlen in hpke_aead_dec() CID 1517040: Remove unneeded logging. This gets rid of the warning related to taking the sizeof(&) CID 1517039: Check returned value of RAND_bytes_ex() in hpke_test CID 1517038: Check return result of KEM_INFO_find() in OSSL_HPKE_get_recomended_ikmelen. Even though this is a false positive, it should not rely on the internals of other function calls. Changed some goto's into returns to match OpenSSL coding guidelines. Removed Raises from calls to _new which fail from malloc calls. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19774)
* Fix occasional assertion failure when storing propertiesTomas Mraz2022-11-293-19/+20
| | | | | | | | | | | | | | Fixes #18631 The store lock does not prevent concurrent access to the property cache, because there are multiple stores. We drop the newly created entry and use the exisiting one if there is one already. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19762)
* Fix accumulated index comments in felem_inv for p521Rohan McLure2022-11-281-2/+2
| | | | | | | | | | | | | | Comments in felem_inv refer to the logarithm with respect to in of the element that has just been computed. The last two such annotations are incorrect. By Fermat's last theorem, we hope to compute in^(p-2) in GF(2^521-1), as such we expect the final index we reach to be 2^521-3. CLA: Trivial Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19765)
* Implements Hybrid Public Key Encryption (HPKE) as per RFC9180.Stephen Farrell2022-11-254-17/+1803
| | | | | | | | | | | | | | | | | | | | | | | This supports all the modes, suites and export mechanisms defined in RFC9180 and should be relatively easily extensible if/as new suites are added. The APIs are based on the pseudo-code from the RFC, e.g. OSS_HPKE_encap() roughly maps to SetupBaseS(). External APIs are defined in include/openssl/hpke.h and documented in doc/man3/OSSL_HPKE_CTX_new.pod. Tests (test/hpke_test.c) include verifying a number of the test vectors from the RFC as well as round-tripping for all the modes and suites. We have demonstrated interoperability with other HPKE implementations via a fork [1] that implements TLS Encrypted ClientHello (ECH) which uses HPKE. @slontis provided huge help in getting this done and this makes extensive use of the KEM handling code from his PR#19068. [1] https://github.com/sftcd/openssl/tree/ECH-draft-13c Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17172)
* When using PEM_read_bio_PrivateKey_ex() the public key is optionalTomas Mraz2022-11-251-4/+13
| | | | | | | | | | | Fixes #19498 However the private key part is not optional which was mishandled by the legacy routine. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19505)
* add missing OSSL_CMP_CTX_reset_geninfo_ITAVs() functionDr. David von Oheimb2022-11-251-0/+11
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19216)
* OSSL_CMP_CTX_reinit(): fix missing reset of ctx->genm_ITAVsDr. David von Oheimb2022-11-251-7/+10
| | | | | | | | | Otherwise, further OSSL_CMP_exec_GENM_ses() calls will go wrong. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19216)
* CMP: fix gen_new() in cmp_msg.c checking wrong ITAVsDr. David von Oheimb2022-11-251-2/+1
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19216)
* CMS_decrypt_set1_*(): remove misleading error queue entry when recipient ↵Dr. David von Oheimb2022-11-251-15/+17
| | | | | | | | | mismatch was not the issue Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19222)
* CMS_decrypt_set1_password(): prevent mem leak on any previously set ↵Dr. David von Oheimb2022-11-251-4/+8
| | | | | | | | | decryption key Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19222)
* CMS_decrypt*(): fix misconceptions and mem leakDr. David von Oheimb2022-11-252-12/+14
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19222)
* Add SM2 support for EVP_PKEY_Q_keygenJiaxun Yang2022-11-241-1/+2
| | | | | | | | | | | | There is no reason preventing this API to support SM2, which gives us a simple method to do SM2 key gen. CLA: trivial Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19736)
* CMP: fix handling of unset or missing failInfo PKI status informationDr. David von Oheimb2022-11-242-11/+6
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19205)
* CMP: fix status held in OSSL_CMP_CTX, in particular for genp messagesDr. David von Oheimb2022-11-245-19/+33
| | | | | | | | | On this occasion, replace magic constants by mnemonic ones; update doc Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19205)
* CMP+CRMF: fix formatting nits in crypto/, include/, and test/Dr. David von Oheimb2022-11-2412-70/+37
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19230)
* Add support for KTLS zerocopy sendfile on LinuxMaxim Mikityanskiy2022-11-242-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TLS device offload allows to perform zerocopy sendfile transmissions. FreeBSD provides this feature by default, and Linux 5.19 introduced it as an opt-in. Zerocopy improves the TX rate significantly, but has a side effect: if the underlying file is changed while being transmitted, and a TCP retransmission happens, the receiver may get a TLS record containing both new and old data, which leads to an authentication failure and termination of connection. This effect is the reason Linux makes a copy on sendfile by default. This commit adds support for TLS zerocopy sendfile on Linux disabled by default to avoid any unlikely backward compatibility issues on Linux, although sacrificing consistency in OpenSSL's behavior on Linux and FreeBSD. A new option called KTLSTxZerocopySendfile is added to enable the new zerocopy behavior on Linux. This option should be used when the the application guarantees that the file is not modified during transmission, or it doesn't care about breaking the connection. The related documentation is also added in this commit. The unit test added doesn't test the actual functionality (it would require specific hardware and a non-local peer), but solely checks that it's possible to set the new option flag. Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Boris Pismenny <borisp@nvidia.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18650)
* Add two new build targets to enable the possibility of using clang-cl asEverton Constantino2022-11-242-2/+34
| | | | | | | | | | an assembler for Windows on Arm builds and also clang-cl as the compiler as well. Make appropriate changes to armcap source and peralsm scripts. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19523)
* Cleanup : directly include of `internal/nelem.h` when required.FdaSilvaYY2022-11-231-0/+1
| | | | | | | | And so clean a few useless includes Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19721)
* CMP: add API functions OSSL_CMP_CTX_get0_libctx() and OSSL_CMP_CTX_get0_propq()Dr. David von Oheimb2022-11-231-0/+3
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19715)
* Improve FIPS RSA keygen performance.slontis2022-11-232-8/+52
| | | | | | | | | Reduce the Miller Rabin counts to the values specified by FIPS 186-5. The old code was using a fixed value of 64. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19579)
* Add functions supporting thread pool only when it is enabledTomas Mraz2022-11-224-25/+8
| | | | | | | | Fixes #19691 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19695)
* Fix coverity issues in X509v3_addrslontis2022-11-211-14/+14
| | | | | | | | | | CID 1516955 : Null pointer deref (REVERSE_INULL) CID 1516954 : Null pointer deref (REVERSE_INULL) CID 1516953 : RESOURCE_LEAK of child Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19700)
View Lorry Controller Status