Dr. Matthias St. Pierre [Fri, 5 Jul 2019 13:50:50 +0000 (15:50 +0200)]
Remove OPENSSL_X509V3_H include detector from openssl/cms.h
The check is redundant, because <openssl/x509v3.h> is included.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9364)
Dr. Matthias St. Pierre [Thu, 4 Jul 2019 10:38:43 +0000 (12:38 +0200)]
Remove HEADER_BSS_FILE_C module include guard
This include guard inside an object file comes as a surprise and
serves no purpose anymore. It seems like this object file was
included by crypto/threads/mttest.c at some time, but the include
directive was removed in commit
bb8abd6.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9364)
Bernd Edlinger [Mon, 22 Jul 2019 20:50:19 +0000 (22:50 +0200)]
Enforce a minimum DH modulus size of 512 bits
[extended tests]
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9437)
Richard Levitte [Sun, 7 Jul 2019 08:56:46 +0000 (10:56 +0200)]
Adapt DH to use with KEYMGMT
The biggest part in this was to move the key->param builder from EVP
to the DH ASN.1 method, and to implement the KEYMGMT support in the
provider DH.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9394)
Matt Caswell [Mon, 22 Jul 2019 14:19:02 +0000 (15:19 +0100)]
Remove some utilities from the core to provider interface
The core provides a number of essential functions as "upcalls" to
providers. Some of those were just utility functions that wrap other
upcalls - which don't seem essential and bloat the interface. We should
remove them in order to simplify the interface.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9432)
Rich Salz [Thu, 18 Jul 2019 19:40:12 +0000 (15:40 -0400)]
Don't complain if function name doesn't match
The "function" argument is now unused in the XXXerr defines, so mkerr
doesn't need to check if the value/name match.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9413)
Pauli [Tue, 23 Jul 2019 08:07:19 +0000 (18:07 +1000)]
Make rand_pool buffers more dynamic in their sizing.
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9428)
Pauli [Tue, 23 Jul 2019 06:54:52 +0000 (16:54 +1000)]
Avoid double clearing some BIGNUMs
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9438)
Richard Levitte [Thu, 11 Jul 2019 10:19:33 +0000 (12:19 +0200)]
Replace OSSL_ITEM with OSSL_PARAM as parameter descriptor, everywhere
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9346)
Richard Levitte [Thu, 11 Jul 2019 10:18:42 +0000 (12:18 +0200)]
Describe OSSL_PARAM as a parameter descriptor
This affects doc/man3/OSSL_PARAM.pod and doc/man7/openssl-core.h.pod
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9346)
Richard Levitte [Sat, 13 Jul 2019 05:04:01 +0000 (07:04 +0200)]
Re-implement the cipher and digest listings for 'openssl list'
They now display both legacy and provided algorithms.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9356)
Richard Levitte [Sat, 13 Jul 2019 05:02:54 +0000 (07:02 +0200)]
Add EVP_CIPHER_do_all_ex() and EVP_MD_do_all_ex()
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9356)
Richard Levitte [Sat, 13 Jul 2019 04:53:44 +0000 (06:53 +0200)]
Add internal function evp_generic_do_all()
This function is used to traverse all algorithm implementations for a
given operation type, and execute the given function for each of them.
For each algorithm implementation, a method is created and passed to
the given function, and then freed after that function's return. If
the caller wishes to keep the method for longer, they must call the
appropriate up_ref function on the method, and they must also make
sure to free the passed methods at some point.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9356)
Richard Levitte [Wed, 10 Jul 2019 21:14:03 +0000 (23:14 +0200)]
Refactor ossl_method_construct() in terms of ossl_algorithm_do_all()
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9356)
Richard Levitte [Wed, 10 Jul 2019 21:11:27 +0000 (23:11 +0200)]
Add internal function ossl_algorithm_do_all()
This function is used to traverse all the implementations provided by
one provider, or all implementation for a specific operation across
all loaded providers, or both, and execute a given function for each
occurence.
This will be used by ossl_method_construct(), but also by information
processing functions.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9356)
Richard Levitte [Wed, 10 Jul 2019 21:00:22 +0000 (23:00 +0200)]
Add OSSL_PROVIDER_name()
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9356)
Richard Levitte [Wed, 10 Jul 2019 20:59:07 +0000 (22:59 +0200)]
Add EVP_MD_provider() and EVP_CIPHER_provider()
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9356)
Richard Levitte [Wed, 10 Jul 2019 20:24:00 +0000 (22:24 +0200)]
Re-implement EVP_MD_name() and EVP_CIPHER_name() as functions
They will do the same as usual for non-provider algorithms
implementations, but can handle provider implementations as well.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9356)
Richard Levitte [Wed, 10 Jul 2019 20:22:16 +0000 (22:22 +0200)]
Add a mechnism to save the name of fetched methods
This will be useful for information display, as well as for code that
want to check the name of an algorithm. This can eventually replace
all NID checks.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9356)
Richard Levitte [Mon, 22 Jul 2019 08:46:10 +0000 (10:46 +0200)]
provider-keymgmt(7): Document the KEYMGMT interface
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9429)
Patrick Steuer [Fri, 19 Jul 2019 14:41:46 +0000 (16:41 +0200)]
Remove superfluous call to OPENSSL_cpuid_setup
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9417)
Bernd Edlinger [Wed, 10 Jul 2019 13:52:36 +0000 (15:52 +0200)]
Change DH parameters to generate the order q subgroup instead of 2q
This avoids leaking bit 0 of the private key.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/9363)
Richard Levitte [Thu, 18 Jul 2019 13:07:13 +0000 (15:07 +0200)]
Documentation: add provider-base(7), describing the base functions
The base functions are the first tables of function pointers that
libcrypto and the provider pass to each other, thereby providing a
baseline with which they can communicate further with each other.
This also contains an example for a ficticious provider, providing an
implement of a fictitious algorithm for a fictitious operation.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9409)
Richard Levitte [Thu, 18 Jul 2019 10:24:55 +0000 (12:24 +0200)]
Documentation: Move the description of the fetching functions
Now that the general descriptions have moved from
doc/man3/EVP_MD_fetch.pod to doc/man7/provider.pod, the description of
the fetching functions themselves can be moved to other pages where
related functions are already described.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9409)
Richard Levitte [Thu, 18 Jul 2019 10:23:23 +0000 (12:23 +0200)]
Documentation: Add provider(7), for general description of providers
This includes an enumeration of the providers supplied with OpenSSL,
and what implementations they offer.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9409)
Rich Salz [Tue, 16 Jul 2019 23:55:44 +0000 (19:55 -0400)]
Include deprecated SYS_F_xxx codes
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9072)
Rich Salz [Tue, 16 Jul 2019 16:54:24 +0000 (12:54 -0400)]
Deprecate SYSerr, add new FUNCerr macro
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9072)
Rich Salz [Tue, 11 Jun 2019 19:42:42 +0000 (15:42 -0400)]
Add ERR_put_func_error, and use it.
Change SYSerr to have the function name; remove SYS_F_xxx defines
Add a test and documentation.
Use get_last_socket_err, which removes some ifdef's in OpenSSL code.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9072)
Bernd Edlinger [Sat, 20 Jul 2019 09:22:46 +0000 (11:22 +0200)]
Allocate DRBG additional data pool from non-secure memory
The additional data allocates 12K per DRBG instance in the
secure memory, which is not necessary. Also nonces are not
considered secret.
[extended tests]
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9423)
Dr. Matthias St. Pierre [Fri, 12 Jul 2019 10:42:39 +0000 (12:42 +0200)]
x509: publish X509_PUBKEY_dup
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9353)
Dr. Matthias St. Pierre [Fri, 12 Jul 2019 10:00:58 +0000 (12:00 +0200)]
x509: add missing X509 dup functions
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9353)
Dr. Matthias St. Pierre [Fri, 12 Jul 2019 09:59:42 +0000 (11:59 +0200)]
x509: sort X509 dup functions alphabetically
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9353)
Richard Levitte [Thu, 11 Jul 2019 10:52:16 +0000 (12:52 +0200)]
Add an internal API to access the KEYMGMT provider functions
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9312)
Richard Levitte [Wed, 10 Jul 2019 12:30:55 +0000 (14:30 +0200)]
Add evp_keymgmt_clear_pkey_cache() and use it
This function clears the cache of provider key references, and is used
in evp_keymgmt_export_to_provider() when the internal key is dirty, as
well as by EVP_PKEY_free_it().
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9312)
Richard Levitte [Tue, 9 Jul 2019 15:31:24 +0000 (17:31 +0200)]
Adapt int_ctx_new() to use with providers
This affects all its callers: EVP_PKEY_CTX_new(), EVP_PKEY_CTX_new_id().
They are now possible to called with "zero" values, i.e.:
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new(NULL, NULL);
or
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(0, NULL);
This is suitable for provider use, as the key functionality is tied
with its keys, and the operation time is determined by the init
functions the EVP_PKEY_CTX is used with.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9312)
Richard Levitte [Sat, 6 Jul 2019 19:57:15 +0000 (21:57 +0200)]
Add evp_keymgmt_export_to_provider(), for key transfer between providers
This function is used to transport private key materia from whatever
is already attached to the EVP_PKEY to the new provider, using key
data export and import functionality.
If a legacy lower level key has been assigned to the EVP_PKEY, we use
its data to create a provider side key, and thereby have a bridge
between old style public key types and the EVP_PKEY on providers.
If successful, this function returns a reference to the appropriate
provider side data for the key.
This can be used by any operation that wants to use this key.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9312)
Richard Levitte [Thu, 4 Jul 2019 22:31:42 +0000 (00:31 +0200)]
Add basic EVP_KEYMGMT API and libcrypto <-> provider interface
The idea with the key management "operation" is to support the
following set of functionality:
- Key domain parameter generation
- Key domain parameter import
- Key domain parameter export
- Key generation
- Key import
- Key export
- Key loading (HSM / hidden key support)
With that set of function, we can support handling domain parameters
on one provider, key handling on another, and key usage on a third,
with transparent export / import of applicable data. Of course, if a
provider doesn't offer export / import functionality, then all
operations surrounding a key must be performed with the same
provider.
This method also avoids having to do anything special with legacy
assignment of libcrypto key structures, i.e. EVP_PKEY_assign_RSA().
They will simply be used as keys to be exported from whenever they are
used with provider based operations.
This change only adds the EVP_KEYMGMT API and the libcrypto <->
provider interface. Further changes will integrate them into existing
libcrypto functionality.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9312)
Pauli [Thu, 18 Jul 2019 15:14:07 +0000 (01:14 +1000)]
Add param builder free function.
This means include deallocation information in the return from
the ossl_param_bld_to_param function.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9404)
Richard Levitte [Wed, 17 Jul 2019 19:22:42 +0000 (21:22 +0200)]
Cygwin: enable the use of Dl_info and dladdr()
These weren't available in Cygwin at the time our DSO code was
written, but things have changed since.
Fixes #9385
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9402)
Richard Levitte [Tue, 16 Jul 2019 10:21:47 +0000 (12:21 +0200)]
test/enginetest.c: Make sure no config file is loaded
If a config file gets loaded, the tests get disturbed.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9393)
Richard Levitte [Thu, 18 Jul 2019 07:19:43 +0000 (09:19 +0200)]
doc: fix some links
Some links are aged and need an adjustment.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9407)
Richard Levitte [Thu, 18 Jul 2019 07:03:18 +0000 (09:03 +0200)]
util/find-doc-nits: fixups
- Treat .pod.in files as well, and parse out the base name for those
too.
- Correct the detection of the description part in the NAME section
(the separating dash MUST be preceeded with a space)
- Allow slahes in names of the NAME section (convert them to dashes
for file name comparison). This allows manual pages for some of our
header files, such as openssl/core.h.
- Properly detect repeated names in the NAME section.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9407)
Matt Caswell [Wed, 17 Jul 2019 10:40:41 +0000 (11:40 +0100)]
Fix no-dh
The recent move of the DH code into the default provider broke no-dh. This
adds back in various missing guards.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9399)
Richard Levitte [Thu, 18 Jul 2019 07:25:24 +0000 (09:25 +0200)]
Correct some OSSL_PARAM documentation
The documentation wasn't quite in sync with the implementation.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9408)
Bernd Edlinger [Fri, 21 Jun 2019 19:26:19 +0000 (21:26 +0200)]
Add value_barriers in constant time select functions
The barriers prevent the compiler from narrowing down the
possible value range of the mask and ~mask in the select
statements, which avoids the recognition of the select
and turning it into a conditional load or branch.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/9217)
Shane Lontis [Wed, 17 Jul 2019 22:25:44 +0000 (08:25 +1000)]
Fix S390X compile error due to missing defines
Add the missing S390X_aes_XXX_gcm_CAPABLE() macros into aes_platform.h.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9403)
Shane Lontis [Mon, 15 Jul 2019 02:42:38 +0000 (12:42 +1000)]
Cleanup use of X509 STORE locks
Cosmetic changes to use the X509_STORE_lock/unlock functions.
Renamed some ctx variables to store.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9366)
Dr. Matthias St. Pierre [Wed, 17 Jul 2019 17:14:01 +0000 (19:14 +0200)]
Fix init_get_thread_local()
Previously, init_get_thread_local() pushed the thread event handler
list onto the global register before calling CRYPTO_THREAD_set_local(),
and when the latter failed, forgot to pop the list from the stack again.
Instead of cleaning the stack on error, this commit avoids the situation
entirely by postponing the push operation until all other operations
succeeded. This reordering also significantly reduces the scope of the
critical section.
Another simplification of the code is achieved by moving the push operation
onto the register (which is disabled in FIPS mode) into a separate function.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9401)
Rich Salz [Wed, 10 Jul 2019 20:22:12 +0000 (16:22 -0400)]
Deprecated {OPENSSL,CRYPTO}_debug_mem_{push,pop}
They were only used for recursive ASN1 parsing.
Even if the internal memory-debugging facility remains,
this simplification seems worthwhile.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9342)
Matt Caswell [Tue, 16 Jul 2019 14:32:35 +0000 (15:32 +0100)]
Fix the return value for SSL_get0_chain_certs()
This function was always returning 0. It should return 1 on success.
Fixes #9374
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/9395)
Pauli [Wed, 17 Jul 2019 06:59:09 +0000 (16:59 +1000)]
Parameter building utilities.
A fuller implementation of PARAMS_TEMPLATE as per #9266 but renamed.
This introduces a statis data type which can be used to constructor a
description of a parameter array. It can then be converted into a OSSL_PARAM
array and the allocated storage freed by a single call to OPENSSL_free.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9305)
Pauli [Tue, 16 Jul 2019 10:35:42 +0000 (20:35 +1000)]
remove end of line spaces
Reviewed-by: Paul Yang <yang.yang@baishancloud.com>
(Merged from https://github.com/openssl/openssl/pull/9397)
Pauli [Tue, 16 Jul 2019 10:24:10 +0000 (20:24 +1000)]
Remove tab characters from C source files.
Some have been creeping into the source code.
Reviewed-by: Paul Yang <yang.yang@baishancloud.com>
(Merged from https://github.com/openssl/openssl/pull/9397)
Kurt Roeckx [Sun, 7 Jul 2019 09:04:32 +0000 (11:04 +0200)]
Auto add a label depending on the type of issue they report.
Reviewed-by: Richard Levitte <levitte@openssl.org>
GH: #9319
Richard Levitte [Mon, 15 Jul 2019 09:55:33 +0000 (11:55 +0200)]
Provider config module: allow providers to already be loaded
This allows 'default' to be configured in the config file, if needed.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9371)
Todd Short [Mon, 15 Jul 2019 13:55:13 +0000 (09:55 -0400)]
Fix SSL_CTX_set_session_id_context() docs
Also, use define rather than sizeof
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9377)
Patrick Steuer [Mon, 15 Jul 2019 15:00:15 +0000 (17:00 +0200)]
s390x assembly pack: fix restoring of SIGILL action
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9381)
Viktor Dukhovni [Mon, 15 Jul 2019 17:12:04 +0000 (13:12 -0400)]
Actually silently ignore GET / OCSP requests
Reviewed-by: Matt Caswell <matt@openssl.org>
Matt Caswell [Fri, 28 Jun 2019 08:50:56 +0000 (09:50 +0100)]
Document the new EVP_KEYEXCH type and related functions
Previous commits added the EVP_KEYEXCH type for representing key exchange
algorithms. They also added various functions for fetching and using them,
so we document all of those functions.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9266)
Matt Caswell [Thu, 27 Jun 2019 15:37:44 +0000 (16:37 +0100)]
Add the ability to set PKCS#3 DH padding in providers
This also adds the ability to set arbitrary parameters on key exchange
algorithms. The ability to pad the output is one such parameter for DH.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9266)
Matt Caswell [Thu, 27 Jun 2019 14:03:55 +0000 (15:03 +0100)]
Enable PKCS#3 DH in the providers
The default provider now has support for PKCS#3 Diffie-Hellman so we
switch libcrypto to using providers for that algorithm.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9266)
Matt Caswell [Thu, 27 Jun 2019 11:36:30 +0000 (12:36 +0100)]
Implement PKCS#3 DH Key Exchange in the default provider
We add the capability for the default provider to perform PKCS#3
Diffie-Hellman key exchange. At this point the implementation is not used
because libcrypto still uses legacy handling for Diffie-Hellman.
Note X9.42 DH is not touched by this commit.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9266)
Matt Caswell [Thu, 27 Jun 2019 09:48:17 +0000 (10:48 +0100)]
Make the EVP Key Exchange code provider aware
We introduce a new EVP_KEYEXCH type to represent key exchange algorithms
and refactor the existing code to use it where available.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9266)
Rich Salz [Thu, 11 Jul 2019 18:01:56 +0000 (14:01 -0400)]
Regenerate mkerr files
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9058)
Rich Salz [Fri, 31 May 2019 17:52:45 +0000 (13:52 -0400)]
Remove function name from errors
Deprecate all xxx_F_ defines.
Removed some places that tested for a specific function.
Use empty field for the function names in output.
Update documentation.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9058)
Pauli [Tue, 16 Jul 2019 02:28:08 +0000 (12:28 +1000)]
Remove DRBG from SSL structure.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9390)
Shane Lontis [Mon, 15 Jul 2019 23:46:14 +0000 (09:46 +1000)]
Add Common shared code needed to move aes ciphers to providers
Custom aes ciphers will be placed into multiple new files
(instead of the monolithic setup used in the e_aes.c legacy code)
so it makes sense to have a header for the platform specific
code that needs to be shared between files.
modes_lcl.h has also moved to modes_int.h to allow sharing with the
provider source.
Code that will be common to AEAD ciphers has also been added. These
will be used by seperate PR's for GCM, CCM & OCB.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9301)
Pauli [Thu, 11 Jul 2019 20:27:19 +0000 (06:27 +1000)]
remove end of line whitespace
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9111)
Matt Caswell [Mon, 10 Jun 2019 16:52:15 +0000 (17:52 +0100)]
Convert asn1_dsa.c to use the WPACKET API instead
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9111)
Matt Caswell [Mon, 10 Jun 2019 16:48:26 +0000 (17:48 +0100)]
Give WPACKET the ability to have a NULL buffer underneath it
This means the WPACKET API can be used for calculating the number of
bytes that would have been written if a non-NULL buffer had been used.
This enables us to calculate the number of length bytes required when
encoding ASN.1
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9111)
Matt Caswell [Fri, 7 Jun 2019 16:40:21 +0000 (17:40 +0100)]
Convert asn1_dsa.c to use the PACKET API instead
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9111)
Matt Caswell [Fri, 7 Jun 2019 15:32:49 +0000 (16:32 +0100)]
Make the PACKET/WPACKET code available to both libcrypto and libssl
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9111)
David Makepeace [Mon, 3 Jun 2019 04:58:54 +0000 (14:58 +1000)]
Add simple ASN.1 utils for DSA signature DER.
Adds simple utility functions to allow both the default and fips providers to
encode and decode DSA-Sig-Value and ECDSA-Sig-Value (DSA_SIG and ECDSA_SIG
structures) to/from ASN.1 DER without requiring those providers to have a
dependency on the asn1 module.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9111)
Pauli [Sun, 14 Jul 2019 07:55:15 +0000 (17:55 +1000)]
Coverity #
1451596: check dirlen for being negative
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9362)
Pauli [Sun, 14 Jul 2019 07:53:17 +0000 (17:53 +1000)]
Coverity #
1451595: use correct free function.
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9362)
Richard Levitte [Mon, 15 Jul 2019 14:14:35 +0000 (16:14 +0200)]
util/opensslwrap.sh: adjust to define OPENSSL_MODULES as well
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9379)
Richard Levitte [Mon, 15 Jul 2019 13:03:44 +0000 (15:03 +0200)]
In documentation, consistently refer to OpenSSL 3.0
3.0.0 is a habit from pre-3.0 OpenSSL, which doesn't make sense with
the new version scheme.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9376)
Matt Caswell [Thu, 4 Jul 2019 14:41:17 +0000 (15:41 +0100)]
Make sure all BIGNUM operations work within the FIPS provider
The FIPS provider does not have a default OPENSSL_CTX so, where
necessary, we need to ensure we can always access an explicit
OPENSSL_CTX. We remove functions from the FIPS provider that use
the default OPENSSL_CTX, and fixup some places which were using
those removed functions.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9310)
Richard Levitte [Wed, 10 Jul 2019 18:25:03 +0000 (20:25 +0200)]
Move the code for 'openssl list' to its own translation unit.
That makes it easier to work with than going through apps/openssl.c
This also moves the implementation of calculate_columns() and makes it
generally accessible.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9340)
Richard Levitte [Wed, 10 Jul 2019 18:19:36 +0000 (20:19 +0200)]
Refactor apps/progs.* to be generate with 'make update'
This makes for a cleaner apps/progs.h as well as as cleaner
apps/build.info.
We also break out the type declarations to apps/include/function.h
apps/progs.c and apps/progs.h are NOT regenerated when 'apps' is
disabled.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9340)
Krists Krilovs [Mon, 8 Jul 2019 20:43:09 +0000 (13:43 -0700)]
Fix wrong lock claimed in x509 dir lookup.
x509 store's objects cache can get corrupted when using dir lookup
method in multithreaded application. Claim x509 store's lock when
accessing objects cache.
CLA: trivial
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9326)
agnosticdev [Fri, 12 Jul 2019 10:11:56 +0000 (05:11 -0500)]
issue-9316: Update return documentation for RAND_set_rand_engine
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9351)
Rich Salz [Thu, 11 Jul 2019 05:53:59 +0000 (15:53 +1000)]
Make allocation/free/clean available to providers
Also make OPENSSL_hexstr2buf available to providers.
EVP control functions need hexstring conversion, so move any
memory-allocating functions in o_str.c into new file mem_str.c
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8886)
Richard Levitte [Tue, 9 Jul 2019 10:03:00 +0000 (12:03 +0200)]
Adapt the provider AES for more use of OSSL_PARAM
The cipher context IV was a bit interesting. EVP_CIPHER_CTX_iv()
returns a pointer to the live IV, while EVP_CIPHER_CTX_ctrl() with the
type EVP_CTRL_GET_IV gets a copy of the live IV. To support both, we
support getting it with both the OSSL_PARAM_OCTET_STRING and
OSSL_PARAM_OCTET_PTR datatypes.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9328)
Richard Levitte [Tue, 9 Jul 2019 05:32:16 +0000 (07:32 +0200)]
Adapt diverse EVP_CIPHER functions to use get_params and set_params interfaces
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9328)
Richard Levitte [Tue, 9 Jul 2019 05:27:27 +0000 (07:27 +0200)]
Make more use of OSSL_PARAM for ciphers
A lot of the different numbers associated with ciphers are really
algorithm parameters. Key length, block size, IV length, that sort of
thing.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9328)
Richard Levitte [Mon, 8 Jul 2019 18:36:29 +0000 (20:36 +0200)]
test/evp_test.c: [ciphers] Test that we get back the same IV we gave
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9328)
Bernd Edlinger [Mon, 8 Jul 2019 07:49:33 +0000 (09:49 +0200)]
Replace long dash characters with normal ascii minus
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9321)
Shane Lontis [Mon, 8 Jul 2019 23:33:18 +0000 (09:33 +1000)]
Add X9.42 KDF.
Move the KDF code for CMS DH key agreement into an EVP_KDF object.
There are 2 specifications for X9.42 KDF. This implementation uses DER for
otherinfo which embeds the KDF loop counter inside the DER object.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8898)
Dmitry Belyavskiy [Mon, 8 Jul 2019 10:14:50 +0000 (20:14 +1000)]
Avoid NULL pointer dereference. Fixes #9043.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9059)
Dmitry Belyavskiy [Mon, 8 Jul 2019 10:09:13 +0000 (20:09 +1000)]
A very brief explanation of how to add custom functions to OpenSSL.
Inspired by Rich Salz's letter to openssl-users@
[edited to remove non-ASCII characters and end of line white space]
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9267)
John Schember [Tue, 2 Jul 2019 19:05:27 +0000 (15:05 -0400)]
iOS build: Replace %20 with space in config script
CLA: trivial
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9297)
Lei Maohui [Thu, 13 Jun 2019 03:17:30 +0000 (12:17 +0900)]
Fix build error for aarch64 big endian.
Modified rev to rev64, because rev only takes integer registers.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90827
Otherwise, the following error will occur.
Error: operand 1 must be an integer register -- `rev v31.16b,v31.16b'
CLA: trivial
Signed-off-by: Lei Maohui <leimaohui@cn.fujitsu.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9151)
Dr. Matthias St. Pierre [Fri, 31 May 2019 07:06:28 +0000 (09:06 +0200)]
man: fix typo in OPENSSL_fork_prepare.pod
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/9318)
Bernd Edlinger [Thu, 4 Jul 2019 15:56:23 +0000 (17:56 +0200)]
Fix an endless loop in BN_generate_prime_ex
Happens when trying to generate 4 or 5 bit safe primes.
[extended tests]
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9311)
Matt Caswell [Thu, 4 Jul 2019 09:21:53 +0000 (10:21 +0100)]
Prevent the use of RUN_ONCE inside the FIPS module
FIPS module code *always* runs within the scope of an associated
OPENSSL_CTX. When the module is loaded the OPENSSL_CTX gets created, and
when the module is unloaded the OPENSSL_CX gets freed. A module may be
loaded multiple times within the scope of different OPENSSL_CTX objects.
"Global" data should always be stored within the OPENSSL_CTX. In this
way it will always get cleaned up properly when the module is unloaded.
All current code within the FIPS module works this way. To avoid
"accidents" we disabled the RUN_ONCE code inside the FIPS module.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9308)
Tomas Mraz [Tue, 2 Jul 2019 11:32:29 +0000 (13:32 +0200)]
Clarify documentation of SSL_CTX_set_verify client side behavior
Fixes #9259
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9291)
Bernd Edlinger [Tue, 2 Jul 2019 19:33:42 +0000 (21:33 +0200)]
Fix a typo and a syntax error in opensslconf.h
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9298)
Richard Levitte [Wed, 3 Jul 2019 17:11:36 +0000 (19:11 +0200)]
test/recipes/02_test_errstr.t: Make it less fragile
Change it to split the error string returned by `openssl errstr` in a
more robust manner, and ensure it's the reason code we look at.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9304)
Martin Peylo [Wed, 22 Aug 2018 09:48:22 +0000 (12:48 +0300)]
Adding Test.pm with workaround for Perl abs2rel bug
If SRCTOP != BLDTOP, and SRCTOP is given in relative form, e.g.
"./config ../openssl", then a bug in Perl's abs2rel may trigger that directory-
rewriting in __cwd results in wrong entries in %directories under certain
circumstances, e.g. when a test executes run(app(["openssl"]) after indir.
There should not be any need to go to a higher directory from BLDDIR or SRCDIR,
so it should be OK to use them in their absolute form, also resolving all
possible symlinks, right from the start.
Following the File::Spec::Functions bug description (reported to perl.org):
When abs2rel gets a path argument with ..s that are crossing over the ..s
trailing the base argument, the result is wrong.
Example
PATH: /home/goal/test/..
BASE: /home/goal/test/../../base
Good result: ../goal
Bad result: ../..
Bug verified with File::Spec versions
- 3.6301
- 3.74 (latest)
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7031)