summaryrefslogtreecommitdiff
path: root/include/openssl
Commit message (Collapse)AuthorAgeFilesLines
* Only disabled what we need to in a no-dh buildMatt Caswell2020-11-181-2/+0
| | | | | | | | | no-dh disables the low level API for DH. However, since we're now using the high level EVP API in most places we don't need to disable quite so much. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
* Implement a replacement for SSL_set_tmp_dh()Matt Caswell2020-11-181-0/+3
| | | | | | | | The old function took a DH as a parameter. In the new version we pass an EVP_PKEY instead. Similarly for the SSL_CTX version of this function. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
* Deprecate SSL_CTRL_SET_TMP_DH and other related ctrlsMatt Caswell2020-11-181-4/+16
| | | | | | | | These ctrls pass around a DH object which is now deprecated, so we deprecate the ctrls themselves. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
* Really deprecate the old NAMEerr() macrosRichard Levitte2020-11-181-1/+1
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13320)
* Remove unused helper functions EVP_str2ctrl() & EVP_hex2ctrl().Shane Lontis2020-11-131-9/+0
| | | | | | | | | These were added when the EVP_MAC work was being done. I dont think these lightweight wrappers are required, and it seems better to remove them, rather than adding documentation. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13372)
* ENCODER: Add tracingRichard Levitte2020-11-111-1/+2
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
* ENCODER: Add output structure support for EVP_PKEY encodingRichard Levitte2020-11-111-1/+2
| | | | | | | | | | | | | | | | | | | | | OSSL_ENCODER_CTX_new_by_EVP_PKEY() takes one more argument to express the desired outermost structure for the output. This also adds OSSL_ENCODER_CTX_prune_encoders(), which is used to reduce the stack of encoders found according to criteria formed from the combination of desired selection, output type and output structure. squash! ENCODER: Add output structure support for EVP_PKEY encoding Replace the paragraph talking about OSSL_ENCODER_CTX_prune_encoders() with: The encoding processor encoder_process() is enhanced with better analysis of the stack of encoder implementations. To avoid having to keep an on the side array of information, it uses recursion. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
* ENCODER: Add support for OSSL_FUNC_encoder_does_selection()Richard Levitte2020-11-111-5/+4
| | | | | | | | | | | OSSL_FUNC_encoder_does_selection() is a dispatchable encoder implementation function that should return 1 if the given |selection| is supported by an encoder implementation and 0 if not. This can be used by libcrypto functionality to figure out if an encoder implementation should be considered or not. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
* ENCODER: Add support for specifying the outermost output structureRichard Levitte2020-11-112-5/+10
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
* CORE: Add support for specifying the outermost object structureRichard Levitte2020-11-111-5/+6
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
* DECODER: Add tracingRichard Levitte2020-11-111-1/+2
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
* DECODER: Add input structure support for EVP_PKEY decodingRichard Levitte2020-11-111-1/+3
| | | | | | | | OSSL_DECODER_CTX_new_by_EVP_PKEY() takes one more argument to express the desired outermost structure for the input. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
* DECODER: Add support for OSSL_FUNC_decoder_does_selection()Richard Levitte2020-11-111-3/+6
| | | | | | | | | | | OSSL_FUNC_decoder_does_selection() is a dispatchable decoder implementation function that should return 1 if the given |selection| is supported by an decoder implementation and 0 if not. This can be used by libcrypto functionality to figure out if an encoder implementation should be considered or not. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
* DECODER: Add support for specifying the outermost input structureRichard Levitte2020-11-112-2/+9
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
* Add support for making all of KBKDF FixedInput fields optional.Shane Lontis2020-11-111-0/+2
| | | | | | | | | Added settable integer parameters OSSL_KDF_PARAM_KBKDF_USE_L, OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR. This is required for CAVS tests that only use a combined blob of inputdata. A test showing this use case has been added. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13258)
* Moved OPENSSL_fork_prepare,_parent,_child from init.c to threads_pthread.c.Randall S. Becker2020-11-041-3/+5
| | | | | | | | | | | | | | | | These methods should ultimately be deprecated. The move is to insulate non-UNIX platforms from these undefined symbols. CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #13273 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13276)
* Add AES KW inverse ciphers to the EVP layerShane Lontis2020-11-021-0/+1
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13272)
* Allow empty deprecation macros to be passed as macro argumentsMatt Caswell2020-10-301-3/+6
| | | | | | | | | | | | | The OSSL_DEPRECATEDIN_3_0 macro introduced in PR #13074 is intended to be passed as a parameter to the various PEM declaration macros. However, in some cases OSSL_DEPRECATEDIN_3_0 is defined to be empty, and it is not allowed to pass empty macro arguments in C90. Therefore we ensure these macros are always defined. In the case where they were empty previously we use a no-op value instead. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13227)
* Fix some missed usage of DEFINE_LHASH_OF()Matt Caswell2020-10-301-15/+8
| | | | | | | | | | PR#12860 fixed issues with the Lhash code. It replaced usage of DEFINE_LHASH_OF() in the public headers. Unfortunately it missed a couple of instances. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13274)
* Add easy to digest selector macros for EVP_PKEYsRichard Levitte2020-10-301-0/+8
| | | | | | | | | | | These are meant to be used with functions like OSSL_ENCODER_CTX_new_by_EVP_PKEY() The OSSL_ENCODER_CTX_new_by_EVP_PKEY() manual is also expanded on the topics of output types and selections. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13189)
* Add parentheses to fix PCLINT Info:773Kan2020-10-261-1/+1
| | | | | | | | | | Fixes #7930 CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12927)
* Constify OSSL_FUNC_keymgmt_validate()Nicola Tuveri2020-10-231-1/+1
| | | | | | | The keydata argument of OSSL_FUNC_keymgmt_validate() should be read-only. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13201)
* Remove EVP_aes_(128|192|256)_siv functionsPauli2020-10-221-5/+0
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13195)
* Rename EVP_KDF_size() to EVP_KDF_CTX_get_kdf_size().Shane Lontis2020-10-221-2/+2
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13116)
* Rename EVP_MAC_size() to EVP_MAC_CTX_get_mac_size().Shane Lontis2020-10-221-1/+1
| | | | | | | Fixes #11320 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13116)
* Constify OSSL_FUNC_keymgmt_has()Nicola Tuveri2020-10-221-1/+1
| | | | | | | | The keydata argument of OSSL_FUNC_keymgmt_has() should be read-only. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13200)
* Deprecate EVP_PKEY_set1_tls_encodedpoint()Matt Caswell2020-10-201-4/+8
| | | | | | | | | | Also deprecate EVP_PKEY_get1_tls_encodedpoint(). The preferred alternative is EVP_PKEY_set1_encoded_public_key() and EVP_PKEY_get1_encoded_public_key(). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13105)
* Rename EVP_PKEY_set1_tls_encodedpoint to EVP_PKEY_set1_encoded_public_keyMatt Caswell2020-10-202-4/+19
| | | | | | | | | We do the same thing for the "get1" version. In reality this has broader use than just TLS (it can also be used in CMS), and "encodedpoint" only makes sense when you are talking about EC based algorithms. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13105)
* Update copyright yearMatt Caswell2020-10-151-1/+1
| | | | | Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13144)
* Changing X509at_get0_data_by_OBJ to expect const stack of X509_ATTRIBUTEAkshit Akhoury2020-10-151-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13062)
* Rename some occurrences of 'library_context' and 'lib_ctx' to 'libctx'Dr. Matthias St. Pierre2020-10-151-2/+2
| | | | | | | | | This change makes the naming more consistent, because three different terms were used for the same thing. (The term libctx was used by far most often.) Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12621)
* Rename OPENSSL_CTX prefix to OSSL_LIB_CTXDr. Matthias St. Pierre2020-10-1525-142/+143
| | | | | | | | | | | | Many of the new types introduced by OpenSSL 3.0 have an OSSL_ prefix, e.g., OSSL_CALLBACK, OSSL_PARAM, OSSL_ALGORITHM, OSSL_SERIALIZER. The OPENSSL_CTX type stands out a little by using a different prefix. For consistency reasons, this type is renamed to OSSL_LIB_CTX. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12621)
* Make evp_pkey_ctx_get0_libctx/propq public APIMatt Caswell2020-10-151-0/+3
| | | | | | | | These were previously added as an internal API. But since the CMS code needs them, other code might do too. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13088)
* Move CMS enveloping code out of the algorithms and into CMSMatt Caswell2020-10-152-0/+9
| | | | | | | | | | | | | There is quite a large amount of algorithm specific CMS code sitting in the algorithm directories. However, this seems to break layering. Algorithms really have no business knowing anything about CMS. Really it should be the other way around. Where there is algorithm specific CMS code it is the CMS layer that should know how to handle different algorithms. Therefore we move this code into the CMS layer. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13088)
* [ssl] Support ssl_encapsulate on server sideNicola Tuveri2020-10-141-0/+1
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
* [ssl] Support ssl_decapsulate on client sideNicola Tuveri2020-10-141-0/+1
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
* Define OSSL_CAPABILITY_TLS_GROUP_IS_KEMNicola Tuveri2020-10-141-0/+1
| | | | | | | | Note that with this commit the optional parameter is introduced, but libssl still ignores it. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
* Add PEM declaration macros that take attributesRichard Levitte2020-10-121-42/+80
| | | | | | | | This makes it possible to easily deprecated selections of PEM functions. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
* Add ASN1 declaration macros that take attributesRichard Levitte2020-10-121-39/+72
| | | | | | | | This makes it possible to easily deprecated selections of ASN1 functions. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
* Add convenience macros OSSL_DEPRECATEDIN_{major}_{minor}Richard Levitte2020-10-121-26/+60
| | | | | | | | | | | | As opposed to DEPRECATEDIN_{major}_{minor}(), any use of these macros must be guarded with a corresponding OPENSSL_NO_DEPRECATED_{major}_{minor}: #ifndef OPENSSL_NO_DEPRECATED_3_0 OSSL_DEPRECATEDIN_3_0 int RSA_size(const RSA *rsa); #endif Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
* Add definitions of OSSL_DEPRECATED[_FOR] for Microsoft VCRichard Levitte2020-10-121-1/+15
| | | | | | | | | It turns out that they have __declspec(deprecated) that correspond pretty much to GCC's __attribute__((deprecated)), including for messages. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
* Change OSSL_DEPRECATED to take a version argumentRichard Levitte2020-10-121-13/+26
| | | | | | | | | | | | | | | The macro value is changed to use deprecation messages where whose are supported. We also add the macro OSSL_DEPRECATED_FOR(), to be used whenever an additional message text is desirable, for example to tell the user what the deprecated is replaced with. Example: OSSL_DEPRECATED_FOR(3.0,"use EVP_PKEY and EVP_PKEY_size() instead") int RSA_size(const RSA *rsa); Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
* Add a macro OSSL_DEPRECATED for compiler dependent deprecation attributesRichard Levitte2020-10-121-17/+20
| | | | | | | The diverse DEPRECATEDIN_x_y_z macros are rewritten in terms of this macro. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13074)
* ENCODER / DECODER: Add functions to encode/decode to/from a bufferRichard Levitte2020-10-102-0/+4
| | | | | | | | | This adds OSSL_ENCODER_to_data() and OSSL_DECODER_from_data(). These functions allow fairly simple rewrites of type-specific i2d and d2i calls. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13094)
* Fix diverse ERR code conflictsRichard Levitte2020-10-091-54/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There was a number of potential range conflicts between reason codes from different places. Library specific reason codes are allowed to start at 100, so it means that anything "global" is limited to the range 1..99. At the same time, we have the ERR_R_LIB_xxx reason codes, which have the same numbers as ERR_LIB_xxx, potential range 1..255. And then we have the common ERR_R_ reason codes, potential range in OpenSSL 1.1.1 is 1..99, where fatal reasons occupy 64..99. For OpenSSL 3.0-dev, the range for the common reason codes was pushed up to 64..99 in an attempt to reduce the conflicts with the ERR_R_LIB_xxx reason codes. Currently existing conflicts in OpenSSL 1.1.1: ERR_R_BUF_LIB and ERR_R_PASSED_INVALID_ARGUMENT have the same code. There are currently no existing conflicts in OpenSSL 3.0-dev, but considering that ERR_LIB_HTTP is 61, a few more modules and associated ERR_R_LIB_xxx are going to sniff awfully close to 64, where the common ERR_R_ codes currently start. To avoid these range conflicts, the strategy to recognise common reason codes is change to depend on a reason flag, ERR_RFLAG_COMMON, and the common error codes themselves have moved start at 256, giving them the potential range 256..2^18-1, and thus allowing ERR_R_LIB_xxx the full range of library codes, 1..255. The dual purpose ERR_R_FATAL is also handled in this change, by allowing the rflags and reason codes to overlap by 1 bit, and make both ERR_R_FATAL and ERR_RFLAG_FATAL have the same value, 2^18. With this change, there's no need to worry about reason code conflicts any more, every library specific range as well as the common range is 1..2^18-1. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13093)
* Correct and simplify use of ERR_clear_error() etc. for loading DSO libsDr. David von Oheimb2020-10-081-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13045)
* Expose PKCS7_get_octet_string and PKCS7_type_is_otherJordan Montgomery2020-10-081-0/+2
| | | | | | | | | Add PKCS7_get_octet_string() and PKCS7_type_is_other() to the public interface. Fixes #11139 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13059)
* ocsp.h: Fix backward compatibility declaration of OCSP_parse_url()Dr. David von Oheimb2020-10-071-1/+2
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13077)
* rsa: add ossl_ prefix to internal rsa_ calls.Pauli2020-10-071-5/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The functions being: rsa_check_crt_components, rsa_check_key, rsa_check_pminusq_diff, rsa_check_prime_factor, rsa_check_prime_factor_range, rsa_check_private_exponent, rsa_check_public_exponent, rsa_digestinfo_encoding, rsa_fips186_4_gen_prob_primes, rsa_fromdata, rsa_get0_all_params, rsa_get0_libctx, rsa_get0_pss_params_30, rsa_get_lcm, rsa_mgf_nid2name, rsa_mp_coeff_names, rsa_mp_exp_names, rsa_mp_factor_names, rsa_new_with_ctx, rsa_oaeppss_md2nid, rsa_oaeppss_nid2name, rsa_padding_add_PKCS1_OAEP_mgf1_with_libctx, rsa_padding_add_PKCS1_type_2_with_libctx, rsa_padding_add_SSLv23_with_libctx, rsa_padding_check_PKCS1_type_2_TLS, rsa_pkey_method, rsa_pss_params_30_copy, rsa_pss_params_30_fromdata, rsa_pss_params_30_hashalg, rsa_pss_params_30_is_unrestricted, rsa_pss_params_30_maskgenalg, rsa_pss_params_30_maskgenhashalg, rsa_pss_params_30_saltlen, rsa_pss_params_30_set_defaults, rsa_pss_params_30_set_hashalg, rsa_pss_params_30_set_maskgenalg, rsa_pss_params_30_set_maskgenhashalg, rsa_pss_params_30_set_saltlen, rsa_pss_params_30_set_trailerfield, rsa_pss_params_30_todata, rsa_pss_params_30_trailerfield, rsa_pss_pkey_method, rsa_set0_all_params, rsa_sp800_56b_check_keypair, rsa_sp800_56b_check_private, rsa_sp800_56b_check_public, rsa_sp800_56b_derive_params_from_pq, rsa_sp800_56b_generate_key, rsa_sp800_56b_pairwise_test, rsa_sp800_56b_validate_strength, rsa_todata, rsa_validate_pairwise, rsa_validate_private and rsa_validate_public. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13040)
* Some OIDs used in Russian X.509 certificates.Dmitry Belyavskiy2020-10-051-0/+40
| | | | | | | | | | | | OBJ_OGRNIP denotes a specific legal status of the certificate owner. OBJ_classSignTool* denotes a level of certification of the software created the certificate. http://www.garant.ru/products/ipo/prime/doc/70033464/ is the relevant link (in Russian). Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8309)
View Lorry Controller Status