oweals/openssl.git
4 years agoFix reason code clash
Richard Levitte [Sat, 2 May 2020 08:48:59 +0000 (10:48 +0200)]
Fix reason code clash

EVP_R_NULL_MAC_PKEY_CTX vs EVP_R_SET_DEFAULT_PROPERTY_FAILURE

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11708)

4 years agoutil/perl/OpenSSL/OID.pm: remove the included unit test
Richard Levitte [Fri, 1 May 2020 17:24:50 +0000 (19:24 +0200)]
util/perl/OpenSSL/OID.pm: remove the included unit test

The unit test uses features that appeared in perl 5.12, and is
therefore a source of trouble when building.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11704)

4 years agoAdd solaris assembler fixes for legacy provider
Shane Lontis [Fri, 1 May 2020 05:15:02 +0000 (15:15 +1000)]
Add solaris assembler fixes for legacy provider

The legacy provider contains assembler references. Most code is automagically pulled in from the libcrypto - but the platform specific assembler functions will not be visible in the symbol table. Copying BNASM and DESASM into liblegacy seems to be a better solution than exposing platform specific function in libcrypto.num.

Added a missing call in the des_cbc code for sparc.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11697)

4 years agoAdd default property API's to enable and test for fips
Shane Lontis [Sat, 2 May 2020 04:17:54 +0000 (14:17 +1000)]
Add default property API's to enable and test for fips

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11239)

4 years agomake update for SSL_new_session_ticket
Benjamin Kaduk [Thu, 2 Apr 2020 00:08:10 +0000 (17:08 -0700)]
make update for SSL_new_session_ticket

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11416)

4 years agoAdd test for SSL_new_session_ticket()
Benjamin Kaduk [Tue, 17 Mar 2020 17:08:11 +0000 (10:08 -0700)]
Add test for SSL_new_session_ticket()

Run a normal handshake and then request some extra tickets,
checking that the new_session_cb is called the expected number of
times.  Since the tickets are generated in the same way as other
tickets, there should not be a need to verify that these specific ones
can be used to resume.

Run the test with both zero and a non-zero number of tickets issued in the
initial handshake.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11416)

4 years agoAdd SSL_new_session_ticket() API
Benjamin Kaduk [Mon, 16 Mar 2020 18:25:58 +0000 (11:25 -0700)]
Add SSL_new_session_ticket() API

This API requests that the TLS stack generate a (TLS 1.3)
NewSessionTicket message the next time it is safe to do so (i.e., we do
not have other data pending write, which could be mid-record).  For
efficiency, defer actually generating/writing the ticket until there
is other data to write, to avoid producing server-to-client traffic when
not needed.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11416)

4 years agoFix whitespace nit in ossl_statem_server_pre_work
Benjamin Kaduk [Mon, 16 Mar 2020 18:25:12 +0000 (11:25 -0700)]
Fix whitespace nit in ossl_statem_server_pre_work

An 'if' clause was nestled against a previous closing brace as it if was
an 'else if', but should properly stand on its own line.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11416)

4 years agoAdd a test for EVP_PKEY_*_check functions for "DSA" keys
Mat Berchtold [Wed, 22 Apr 2020 00:30:40 +0000 (19:30 -0500)]
Add a test for EVP_PKEY_*_check functions for "DSA" keys

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11598)

4 years agoWhen a private key is validated and there is no private key, return early.
Mat Berchtold [Tue, 21 Apr 2020 19:13:16 +0000 (14:13 -0500)]
When a private key is validated and there is no private key, return early.

Affected functions:

dsa_validate_public
dsa_validate_private
dh_validate_public
dh_validate_private

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11598)

4 years agocoverity 1462581 Dereference after null check
Pauli [Sun, 26 Apr 2020 23:32:14 +0000 (09:32 +1000)]
coverity 1462581 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462580 Improper use of negative value
Pauli [Sun, 26 Apr 2020 23:28:55 +0000 (09:28 +1000)]
coverity 1462580 Improper use of negative value

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462578 Resource leak
Pauli [Sun, 26 Apr 2020 23:26:48 +0000 (09:26 +1000)]
coverity 1462578 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462576 Resource leak
Pauli [Sun, 26 Apr 2020 23:25:42 +0000 (09:25 +1000)]
coverity 1462576 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462567: Null pointer dereferences
Pauli [Sun, 26 Apr 2020 21:48:32 +0000 (07:48 +1000)]
coverity 1462567: Null pointer dereferences

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462574 Resource leak
Pauli [Sun, 26 Apr 2020 23:19:11 +0000 (09:19 +1000)]
coverity 1462574 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462573 Dereference after null check
Pauli [Sun, 26 Apr 2020 23:17:48 +0000 (09:17 +1000)]
coverity 1462573 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462572 Dereference after null check
Pauli [Sun, 26 Apr 2020 23:16:04 +0000 (09:16 +1000)]
coverity 1462572 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462571 Dereference after null check
Pauli [Sun, 26 Apr 2020 23:13:46 +0000 (09:13 +1000)]
coverity 1462571 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462570 Resource leak
Pauli [Sun, 26 Apr 2020 23:10:15 +0000 (09:10 +1000)]
coverity 1462570 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462566 Resource leak
Pauli [Sun, 26 Apr 2020 23:06:14 +0000 (09:06 +1000)]
coverity 1462566 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462564 Improper use of negative value
Pauli [Sun, 26 Apr 2020 23:04:05 +0000 (09:04 +1000)]
coverity 1462564 Improper use of negative value

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462562 Dereference before null check
Pauli [Sun, 26 Apr 2020 22:58:59 +0000 (08:58 +1000)]
coverity 1462562 Dereference before null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462561 Uninitialized scalar variable
Pauli [Sun, 26 Apr 2020 22:57:38 +0000 (08:57 +1000)]
coverity 1462561 Uninitialized scalar variable

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462560 Resource leak
Pauli [Sun, 26 Apr 2020 22:54:28 +0000 (08:54 +1000)]
coverity 1462560 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462556 Resource leak
Pauli [Sun, 26 Apr 2020 22:45:04 +0000 (08:45 +1000)]
coverity 1462556 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462554 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:42:20 +0000 (08:42 +1000)]
coverity 1462554 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462549 Dereference before null check
Pauli [Sun, 26 Apr 2020 22:33:27 +0000 (08:33 +1000)]
coverity 1462549 Dereference before null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462548 Resource leak
Pauli [Sun, 26 Apr 2020 22:30:49 +0000 (08:30 +1000)]
coverity 1462548 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462546 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:26:39 +0000 (08:26 +1000)]
coverity 1462546 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462545 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:25:33 +0000 (08:25 +1000)]
coverity 1462545 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity: 1462544 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:21:06 +0000 (08:21 +1000)]
coverity: 1462544 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462543 Logically dead code
Pauli [Sun, 26 Apr 2020 22:05:23 +0000 (08:05 +1000)]
coverity 1462543 Logically dead code

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462541 Dereference after null check
Pauli [Sun, 26 Apr 2020 22:01:28 +0000 (08:01 +1000)]
coverity 1462541 Dereference after null check

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462550 Resource leak
Pauli [Sun, 26 Apr 2020 21:59:02 +0000 (07:59 +1000)]
coverity 1462550 Resource leak

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462565: Null pointer dereferences
Pauli [Sun, 26 Apr 2020 21:51:16 +0000 (07:51 +1000)]
coverity 1462565: Null pointer dereferences

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agocoverity 1462577: Incorrect expression
Pauli [Sun, 26 Apr 2020 21:40:17 +0000 (07:40 +1000)]
coverity 1462577: Incorrect expression

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agoparam bld: avoid freeing the param builder structure on error paths.
Pauli [Sun, 26 Apr 2020 21:32:43 +0000 (07:32 +1000)]
param bld: avoid freeing the param builder structure on error paths.

The param builder was recently modified so that it doesn't free the passed in
param builder structure.  Some of the error paths didn't get synced up with this
change and resulted in double frees.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11651)

4 years agoFix snprintf missing for windows build
Shane Lontis [Wed, 29 Apr 2020 06:19:16 +0000 (16:19 +1000)]
Fix snprintf missing for windows build

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11675)

4 years agoUndeprecate DH, DSA and RSA _bits() functions.
Pauli [Tue, 28 Apr 2020 09:03:05 +0000 (19:03 +1000)]
Undeprecate DH, DSA and RSA _bits() functions.

These were deemed information and useful and that they should not be
deprecated.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11669)

4 years agoEVP: Fix evp_keymgmt_util_copy() for to->keymgmt == NULL
Richard Levitte [Tue, 28 Apr 2020 06:41:20 +0000 (08:41 +0200)]
EVP: Fix evp_keymgmt_util_copy() for to->keymgmt == NULL

evp_keymgmt_util_copy() didn't treat the case to->keymgmt correctly.
The proper change is to use from->keymgmt when to->keymgmt is NULL.

Fixes coverity #1462553

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11668)

4 years agoAmend references to "OpenSSL license"
Shourya Shukla [Mon, 27 Apr 2020 04:59:50 +0000 (10:29 +0530)]
Amend references to "OpenSSL license"

A small number of files contain references to the "OpenSSL license"
which has been deprecated and replaced by the "Apache License 2.0".
Amend the occurences.

Fixes #11649

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11663)

4 years agoUpdate EVP_PKEY_fromdata.pod
opensignature [Mon, 27 Apr 2020 09:47:44 +0000 (11:47 +0200)]
Update EVP_PKEY_fromdata.pod

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11660)

4 years agoinclude/openssl/ts.h: clean away a misplaced EVP_MD stack definition
Richard Levitte [Mon, 27 Apr 2020 09:59:17 +0000 (11:59 +0200)]
include/openssl/ts.h: clean away a misplaced EVP_MD stack definition

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11655)

4 years agoinclude/openssl/x509v3.h: restore previous stack definition arrangement
Richard Levitte [Mon, 27 Apr 2020 06:36:53 +0000 (08:36 +0200)]
include/openssl/x509v3.h: restore previous stack definition arrangement

It turned out that configuration options may affect the definition and
use of diverse stacks and how they relate to the underlying types.
For example, the configuration option 'no-rfc3779' results in a build
error around STACK_OF(IPAddressFamily) and related stacks.

Previously, STACK_OF definitions were located near the definition of
the underlying type, which are also affected by configuration options,
which made this easier to maintain.  We relocate the new stack
definitions back to those locations for that reason.

We apply the same type of relocation in other header files as well, following
the general rule that it's better to use DEFINE_OR_DECLARE_STACK_OF after the
type it defines a stack for has been defined.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11655)

4 years agoUpdate README.ssltests.md
Matt Caswell [Mon, 27 Apr 2020 09:36:35 +0000 (10:36 +0100)]
Update README.ssltests.md

The ssltest docs were out of date because gneerate_ssl_tests now needs
a provider to be specified on the command line.

Fixes #11639

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11659)

4 years agoRename FIPS_MODE to FIPS_MODULE
Richard Levitte [Mon, 13 Apr 2020 20:34:56 +0000 (22:34 +0200)]
Rename FIPS_MODE to FIPS_MODULE

This macro is used to determine if certain pieces of code should
become part of the FIPS module or not.  The old name was confusing.

Fixes #11538

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11539)

4 years agoConfigurations: Identify the shell variables around MANSUFFIX
Sebastian Andrzej Siewior [Sat, 25 Apr 2020 18:29:48 +0000 (20:29 +0200)]
Configurations: Identify the shell variables around MANSUFFIX

With MANSUFFIX=A the statement '$$fn$(MANSUFFIX)' is reaplaces with
'$fnA' and left empty because the `fnA' variables is not recognized
within the shell.

With {} around fn it is then bocomes ${fn}A and works as expected.
While here, add the MANSUFFIX to the ECHO line so it is properly printed
during build.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11643)

4 years agoFix GOST curve sec bits
Nikolay Morozov [Wed, 22 Apr 2020 09:09:38 +0000 (12:09 +0300)]
Fix GOST curve sec bits

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11637)

4 years agoConfigure: change all references to INSTALL to INSTALL.md
Richard Levitte [Mon, 27 Apr 2020 07:08:36 +0000 (09:08 +0200)]
Configure: change all references to INSTALL to INSTALL.md

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11657)

4 years agoConfigurations/unix-Makefile.tmpl: fix typo
Richard Levitte [Mon, 27 Apr 2020 06:11:52 +0000 (08:11 +0200)]
Configurations/unix-Makefile.tmpl: fix typo

PROCESSSOR => PROCESSOR

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11654)

4 years agosslapitest: only compile test when it will be used
Benjamin Kaduk [Wed, 1 Apr 2020 20:51:40 +0000 (13:51 -0700)]
sslapitest: only compile test when it will be used

The test_ccs_change_cipher() test routine is used only when TLS 1.2
is enabled; to fix the strict-warnings build we should not try to
compile it when TLS 1.2 is disabled, either.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11458)

4 years agodoc: Random spellchecking
Sebastian Andrzej Siewior [Sat, 25 Apr 2020 21:57:00 +0000 (23:57 +0200)]
doc: Random spellchecking

A little spell checking.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/11644)

4 years agofuzz/asn1.c: Add missing #include
Richard Levitte [Sat, 25 Apr 2020 02:11:09 +0000 (04:11 +0200)]
fuzz/asn1.c: Add missing #include

<openssl/dsa.h> gets included via ts.h...  except when 'no-ts' has been
configured.

Fixes #11597

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11640)

4 years agoi2b_PVK_bio: don't set PEM_R_BIO_WRITE_FAILURE in case of success
Christian Hohnstaedt [Sun, 22 Mar 2020 08:41:30 +0000 (09:41 +0100)]
i2b_PVK_bio: don't set PEM_R_BIO_WRITE_FAILURE in case of success

but in case of an error

CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11380)

4 years agoFix type cast in SSL_CTX_set1_groups macro
Arne Schwabe [Thu, 23 Apr 2020 10:42:51 +0000 (12:42 +0200)]
Fix type cast in SSL_CTX_set1_groups macro

The macro casts the glist parameter to char*
instead of (int *) like the documentation of the function suggest.

Also the function tls1_set_groups that is called from SSL_CTX_ctrl
takes an int * argument. This looks like a copy&paste error from
SSL_CTX_set1_groups_list function.

CLA: trivial
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11614)

4 years agocrypto/x509/v3_alt.c: make 'othername' a bit bigger
Richard Levitte [Mon, 27 Apr 2020 06:43:18 +0000 (08:43 +0200)]
crypto/x509/v3_alt.c: make 'othername' a bit bigger

We want to fill 'othername' with the contents of 'oline' (256 bytes)
plus some additional text.  We need to ensure that 'othername' is
large enough to contain this.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11656)

4 years agoFix links in CONTRIBUTING.md
Nicola Tuveri [Fri, 24 Apr 2020 16:25:56 +0000 (19:25 +0300)]
Fix links in CONTRIBUTING.md

CHANGES and NEWS were renamed into CHANGES.md and NEWS.md; this commit
updates the references inside CONTRIBUTING.md to fix broken links.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/11634)

4 years agoConfigurations/windows-makefile.tmpl: Fix template code for INSTALL_MODULES
Richard Levitte [Fri, 24 Apr 2020 08:08:42 +0000 (10:08 +0200)]
Configurations/windows-makefile.tmpl: Fix template code for INSTALL_MODULES

Fixes #11623

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11629)

4 years agoAdd support for unusal 'othername' subjectAltNames
Dirk-Willem van Gulik [Tue, 21 Apr 2020 21:06:38 +0000 (23:06 +0200)]
Add support for unusal 'othername' subjectAltNames

Increasingly certificates seem to have special things in the subjectAltName that have arbitrary strings in them.

E.g. some (now) common in EU export certificates and, for a few years now, certificates issued to medical doctors (in for example the netherlands, the full spec is https://www.uziregister.nl/Media/Default/PDF/20200325%20CA%20model%20pasmodel%20certificaatprofielen%20v10_0.pdf, section 4.8, page 16 for an example of one country).

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11599)

4 years agotravis: remove GENERATE=yes from some non no-deprecated builds
Pauli [Wed, 22 Apr 2020 11:38:19 +0000 (21:38 +1000)]
travis: remove GENERATE=yes from some non no-deprecated builds

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11607)

4 years agotravis: add GENERATE=yes no-makedepend to the ARM64 build.
Pauli [Wed, 22 Apr 2020 10:01:30 +0000 (20:01 +1000)]
travis: add GENERATE=yes no-makedepend to the ARM64 build.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11607)

4 years agokeymgmt: convert to use the params modification detection.
Pauli [Thu, 23 Apr 2020 10:31:12 +0000 (20:31 +1000)]
keymgmt: convert to use the params modification detection.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

4 years agoparams: change OSSL_PARAM_set_unmodified() to operate on a params array
Pauli [Thu, 23 Apr 2020 10:23:48 +0000 (20:23 +1000)]
params: change OSSL_PARAM_set_unmodified() to operate on a params array

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

4 years agoevp: convert existing code to use the new modified sentinel for params.
Pauli [Wed, 22 Apr 2020 04:20:11 +0000 (14:20 +1000)]
evp: convert existing code to use the new modified sentinel for params.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

4 years agoparams: handle the modified sentinel.
Pauli [Wed, 22 Apr 2020 04:10:24 +0000 (14:10 +1000)]
params: handle the modified sentinel.

The param builder and the params from text helpers also need to be modified
aware.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11601)

4 years agoConfigure: Allow quoted values in VERSION
Richard Levitte [Thu, 23 Apr 2020 16:59:10 +0000 (18:59 +0200)]
Configure: Allow quoted values in VERSION

Fixes #11618

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11624)

4 years agoFix dev/release-aux-openssl-announce-pre-release.tmpl
Richard Levitte [Thu, 23 Apr 2020 14:38:40 +0000 (16:38 +0200)]
Fix dev/release-aux-openssl-announce-pre-release.tmpl

$LABEL -> $label

Removed link to release notes, as we don't produce them for master.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11617)

4 years agoCode cleanup in X509v3 String Extentions
Nikolay Morozov [Wed, 22 Apr 2020 08:45:16 +0000 (11:45 +0300)]
Code cleanup in X509v3 String Extentions

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11604)

4 years agoClean up the use of ERR_print_errors() in apps.c and in four apps
Dr. David von Oheimb [Wed, 22 Apr 2020 12:58:41 +0000 (14:58 +0200)]
Clean up the use of ERR_print_errors() in apps.c and in four apps

Also make sure that all error messages in apps.c consistently begin upper-case.
Changed files: apps/lib/apps.c and apps/{req.c,s_client.c,s_server.c,x509.c}

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

4 years agoRemove a bad 'goto end' and a few superfluous ones in apps/lib/apps.c
David von Oheimb [Tue, 26 Dec 2017 18:33:04 +0000 (19:33 +0100)]
Remove a bad 'goto end' and a few superfluous ones in apps/lib/apps.c

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

4 years agoImprove feedback on wrong format with new print_format_error() in apps/lib/opt.c
David von Oheimb [Fri, 22 Dec 2017 18:50:17 +0000 (19:50 +0100)]
Improve feedback on wrong format with new print_format_error() in apps/lib/opt.c

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

4 years agoAdd function load_csr(file,format,desc) to apps/lib/apps.c
David von Oheimb [Fri, 15 Dec 2017 19:50:37 +0000 (20:50 +0100)]
Add function load_csr(file,format,desc) to apps/lib/apps.c

Make use of new load_csr() in 'ca', 'req', and 'x509' app
Add '-inform' and '-certform' option to 'ca' app
Add 'desc' parameter to load_crl() function defined in apps/lib/apps.c
Allow 'desc' parameter to be NULL (gives option to suppress error output)

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4940)

4 years agoIn OpenSSL builds, declare STACK for datatypes ...
Rich Salz [Thu, 19 Dec 2019 22:30:24 +0000 (17:30 -0500)]
In OpenSSL builds, declare STACK for datatypes ...

... and only *define* them in the source files that need them.
Use DEFINE_OR_DECLARE which is set appropriately for internal builds
and not non-deprecated builds.

Deprecate stack-of-block

Better documentation

Move some ASN1 struct typedefs to types.h

Update ParseC to handle this.  Most of all, ParseC needed to be more
consistent.  The handlers are "recursive", in so far that they are called
again and again until they terminate, which depends entirely on what the
"massager" returns.  There's a comment at the beginning of ParseC that
explains how that works. {Richard Levtte}

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10669)

4 years agoFix typo from #10631
Nicola Tuveri [Tue, 21 Apr 2020 15:34:17 +0000 (18:34 +0300)]
Fix typo from #10631

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11595)

4 years agoRewrite man5/config.pod and related conf code cleanup
Rich Salz [Sat, 28 Mar 2020 16:51:05 +0000 (12:51 -0400)]
Rewrite man5/config.pod and related conf code cleanup

The manpage is basically rewritten.  Use consistent name/value
terminology. Use consistent phraseology to refer to section pointers
and lists of section pointers. Add more cross-references.

Also found a bunch of trivial style things in conf_api.c while
investigating how config works.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11431)

4 years agoSSL_CTX_config.pod: Remove needless "NOTE" heading
Rich Salz [Sat, 28 Mar 2020 16:50:49 +0000 (12:50 -0400)]
SSL_CTX_config.pod: Remove needless "NOTE" heading

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11431)

4 years agoRename fipsinstall.cnf->fipsmodule.cnf
Rich Salz [Tue, 21 Apr 2020 17:55:12 +0000 (13:55 -0400)]
Rename fipsinstall.cnf->fipsmodule.cnf

Introduced by rebasing

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11177)

4 years agoUpdate some nits around the FIPS module
Rich Salz [Tue, 25 Feb 2020 21:27:24 +0000 (16:27 -0500)]
Update some nits around the FIPS module

- Changed the generated FIPS signature file to be "fipsmodule.conf"
since it contains information about the FIPS module/file.
- Add -q option to fipsinstall command, to stop chatty verbose status
messages.
- Document env var OPENSSL_CONF_INCLUDE

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11177)

4 years agoPrepare for 3.0 alpha 2
Matt Caswell [Thu, 23 Apr 2020 13:10:38 +0000 (14:10 +0100)]
Prepare for 3.0 alpha 2

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoPrepare for release of 3.0 alpha 1 openssl-3.0.0-alpha1
Matt Caswell [Thu, 23 Apr 2020 13:08:36 +0000 (14:08 +0100)]
Prepare for release of 3.0 alpha 1

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoUpdate copyright year
Matt Caswell [Thu, 23 Apr 2020 12:55:52 +0000 (13:55 +0100)]
Update copyright year

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11616)

4 years agoAdd info on the CMP implementation and HTTP client to NEWS.md and CHANGES.md
Dr. David von Oheimb [Wed, 22 Apr 2020 11:12:45 +0000 (13:12 +0200)]
Add info on the CMP implementation and HTTP client to NEWS.md and CHANGES.md

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11608)

4 years agoFix a typo in the makefile templates
Matt Caswell [Thu, 23 Apr 2020 10:50:20 +0000 (11:50 +0100)]
Fix a typo in the makefile templates

The fips.so and legacy.so providers were not being installed because of
a typo in the makefile templates.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11615)

4 years agoMention the 3.0 wiki page in the release announcement emails
Matt Caswell [Tue, 21 Apr 2020 14:13:30 +0000 (15:13 +0100)]
Mention the 3.0 wiki page in the release announcement emails

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11593)

4 years agoPROV: Ensure that EC keys have a default digest
Richard Levitte [Mon, 20 Apr 2020 19:35:03 +0000 (21:35 +0200)]
PROV: Ensure that EC keys have a default digest

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

4 years agoPROV: Ensure that ED25519 & ED448 keys have a mandatory digest
Richard Levitte [Mon, 20 Apr 2020 07:29:47 +0000 (09:29 +0200)]
PROV: Ensure that ED25519 & ED448 keys have a mandatory digest

This adds handling of the parameter "mandatory-digest" and responds
with an empty string, meaning that no digest may be used.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

4 years agoEVP: Fix EVP_Digest{Sign,Verify}Init() to handle no default digest
Richard Levitte [Mon, 20 Apr 2020 07:29:16 +0000 (09:29 +0200)]
EVP: Fix EVP_Digest{Sign,Verify}Init() to handle no default digest

EVP_DigestSignInit() and EVP_DigestVerifyInit() would detect if there
is no default digest when using legacy (EVP_PKEY_ASN1_METHOD)
implementations.  However, it doesn't do that when provider side keys
are used.

Furthermore, because EVP_PKEY_get_default_digest_name() was used in
the portion of the code that uses the provider implementation, the
EVP_PKEY_ASN1_METHOD would be used if the key has one attached.  This
is now changed to use evp_keymgmt_util_get_deflt_digest_name()
instead.

Finally, we make sure to detect if the provider implementation
supports the digest name parameters (default or mandatory), and
returns with error if not.  This is what the legacy portion of the
code does.

Fixes #11571

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

4 years agoEVP: add internal evp_keymgmt_util_get_deflt_digest_name() and use it
Richard Levitte [Mon, 20 Apr 2020 07:14:59 +0000 (09:14 +0200)]
EVP: add internal evp_keymgmt_util_get_deflt_digest_name() and use it

evp_keymgmt_util_get_deflt_digest_name() is a refactor of the provider
side key part of EVP_PKEY_get_default_digest_name(), that takes
EVP_KEYMGMT and provider keydata pointers instead of an EVP_PKEY
pointer.

We also ensure that it uses SN_undef as the default name if the
provider implementation gave us an empty string, since this is what
EVP_PKEY_get_default_digest_name() responds when getting the digest
name via a EVP_PKEY_ASN1_METHOD ctrl call that returns NID_undef.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11576)

4 years agoFIPS: remove algorithms that are not being validated.
Pauli [Wed, 22 Apr 2020 07:08:30 +0000 (17:08 +1000)]
FIPS: remove algorithms that are not being validated.

Several MACs and one KDF are included in the FIPS provider with the property
"fips=yes" set but are not listed as being part of the OpenSSL validation.

This removes them from the FIPS provider.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11602)

4 years agoFix no-err
Matt Caswell [Mon, 20 Apr 2020 14:04:35 +0000 (15:04 +0100)]
Fix no-err

This fixes an assertion failure that can occur in the CMP code in the
event of a no-err build. The "improve_location_name" function assumed
that the fallback argument was always populated with something. However
in a no-err build this is not the case.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11584)

4 years agoSkip a no-dsa test in the fipsinstall test
Matt Caswell [Mon, 20 Apr 2020 13:18:36 +0000 (14:18 +0100)]
Skip a no-dsa test in the fipsinstall test

In a similar way to the previous commit we also skip a fipsinstall test
if DSA has been disabled.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11582)

4 years agoSkip a test in a no-dh build
Matt Caswell [Mon, 20 Apr 2020 13:05:47 +0000 (14:05 +0100)]
Skip a test in a no-dh build

One of the sub-tests in the fipsinstall test corrupts a DH test to
confirm that fipsinstall fails. However that is never noticed in a
no-dh build - so we just skip that test in a no-dh build.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11582)

4 years agoFix some build failures with no-dh
Matt Caswell [Mon, 20 Apr 2020 13:05:23 +0000 (14:05 +0100)]
Fix some build failures with no-dh

Add some missing OPENSSL_NO_DH guards.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11582)

4 years agoFix no-ec
Matt Caswell [Mon, 20 Apr 2020 11:27:59 +0000 (12:27 +0100)]
Fix no-ec

This was missed by Travis because, although it has a no-ec build, the test
that failed only runs in a debug build. The Travis job with no-ec is not
a debug build and so the test was skipped.

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11581)

4 years agoAdd a link to wiki 3.0 upgrade notes
Matt Caswell [Mon, 20 Apr 2020 18:39:32 +0000 (19:39 +0100)]
Add a link to wiki 3.0 upgrade notes

Provide a link to the 3.0 upgrade notes so that users of the alpha/beta/
final releases can understand the differences between this version and
previous versions.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11587)

4 years agoGOST2012 TLS Supported Groups Identifiers Support
Nikolay Morozov [Sat, 18 Apr 2020 20:59:45 +0000 (23:59 +0300)]
GOST2012 TLS Supported Groups Identifiers Support

For GOST2012-GOST8912-GOST8912 IANA introduce TLS Supported Groups Identifiers
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11568)

4 years agoevptest: set the DESX provider to be the legacy provider.
Pauli [Mon, 20 Apr 2020 02:43:49 +0000 (12:43 +1000)]
evptest: set the DESX provider to be the legacy provider.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11573)

4 years agoparams: add functionality to test if an OSSL_PARAM has been set.
Pauli [Tue, 21 Apr 2020 00:49:19 +0000 (10:49 +1000)]
params: add functionality to test if an OSSL_PARAM has been set.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11588)

4 years ago[crypto/ec] deprecate Jprojective_coordinates_GFp functions
Billy Brumley [Sun, 12 Apr 2020 15:17:19 +0000 (18:17 +0300)]
[crypto/ec] deprecate Jprojective_coordinates_GFp functions

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11527)