oweals/openssl.git
5 years agoMore KDF cleanup
Richard Levitte [Fri, 30 Aug 2019 13:36:20 +0000 (15:36 +0200)]
More KDF cleanup

The EVP_KDF_ definitions are no longer needed, and neither is
EVP_get_kdfbyname()

test/evp_kdf_test.c tried to use a EVP_get_kdfbyname() that was rewritten
to use EVP_KDF_fetch() without ever freeing the resulting KDF method.
It's better to refactor the test to use EVP_KDF_fetch directly.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoPBKDF2 implementation: refactor to avoid memleak
Richard Levitte [Fri, 30 Aug 2019 13:11:08 +0000 (15:11 +0200)]
PBKDF2 implementation: refactor to avoid memleak

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoFix memleaks in KDF implementations
Richard Levitte [Fri, 30 Aug 2019 12:35:43 +0000 (14:35 +0200)]
Fix memleaks in KDF implementations

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agocrypto/evp/pkey_kdf.c: Redo parameter processing
Richard Levitte [Fri, 30 Aug 2019 12:32:55 +0000 (14:32 +0200)]
crypto/evp/pkey_kdf.c: Redo parameter processing

Undo the caching scheme, pass through most controls as parameters, except
for SEED and INFO, where we keep supporting adding data through additional
ctrl calls by collecting the data, and only passing it to the EVP_KDF
before calling its derive function.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agocrypto/evp/kdf_meth.c: Add the reset function to the method
Richard Levitte [Fri, 30 Aug 2019 12:32:33 +0000 (14:32 +0200)]
crypto/evp/kdf_meth.c: Add the reset function to the method

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoUpdate private.num for KDFs/PRFs
Pauli [Thu, 29 Aug 2019 05:07:55 +0000 (15:07 +1000)]
Update private.num for KDFs/PRFs

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoossl_provider_library_context(NULL) returns NULL.
Pauli [Thu, 29 Aug 2019 03:02:54 +0000 (13:02 +1000)]
ossl_provider_library_context(NULL) returns NULL.

This will only be required until everything is moved to providers and a NULL
provider pointer won't be possible.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoParams from text to allow zero length value fields
Pauli [Tue, 27 Aug 2019 05:48:39 +0000 (15:48 +1000)]
Params from text to allow zero length value fields

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoUpdate EVP test data for KDFs and PRFs.
Pauli [Tue, 27 Aug 2019 05:23:09 +0000 (15:23 +1000)]
Update EVP test data for KDFs and PRFs.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoKDF error codes reworked
Pauli [Sat, 24 Aug 2019 10:14:51 +0000 (20:14 +1000)]
KDF error codes reworked

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoCleanse KDF missing crypto files
Pauli [Sat, 24 Aug 2019 09:50:46 +0000 (19:50 +1000)]
Cleanse KDF missing crypto files

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoCleanse KDF error files
Pauli [Sat, 24 Aug 2019 09:50:21 +0000 (19:50 +1000)]
Cleanse KDF error files

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoCleanse crypto/kdf directory
Pauli [Sat, 24 Aug 2019 09:49:46 +0000 (19:49 +1000)]
Cleanse crypto/kdf directory

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoKDF/PRF updates to libcrypto
Pauli [Wed, 21 Aug 2019 08:54:35 +0000 (18:54 +1000)]
KDF/PRF updates to libcrypto

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoApp updates for KDF provider conversion.
Pauli [Wed, 21 Aug 2019 08:53:45 +0000 (18:53 +1000)]
App updates for KDF provider conversion.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoKDF provider conversion error updates - generated
Pauli [Wed, 21 Aug 2019 08:53:07 +0000 (18:53 +1000)]
KDF provider conversion error updates - generated

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoKDF additons to names and numbers
Pauli [Wed, 21 Aug 2019 08:52:32 +0000 (18:52 +1000)]
KDF additons to names and numbers

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoTest updates in light of the KDF switchover
Pauli [Wed, 21 Aug 2019 08:52:04 +0000 (18:52 +1000)]
Test updates in light of the KDF switchover

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoDocumentation updates in light of the KDF conversion
Pauli [Wed, 21 Aug 2019 08:51:34 +0000 (18:51 +1000)]
Documentation updates in light of the KDF conversion

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoAdd KDFs to providers
Pauli [Wed, 21 Aug 2019 03:09:10 +0000 (13:09 +1000)]
Add KDFs to providers

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoFix users of KDFs to use params not ctls
Pauli [Tue, 20 Aug 2019 22:06:29 +0000 (08:06 +1000)]
Fix users of KDFs to use params not ctls

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoRemove old KDF initialisation
Pauli [Tue, 20 Aug 2019 22:04:27 +0000 (08:04 +1000)]
Remove old KDF initialisation

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoFix TLS/SSL PRF usages.
Pauli [Tue, 20 Aug 2019 22:01:08 +0000 (08:01 +1000)]
Fix TLS/SSL PRF usages.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoMove KDFs to the provider.
Pauli [Tue, 20 Aug 2019 22:00:12 +0000 (08:00 +1000)]
Move KDFs to the provider.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

5 years agoTeach TLSProxy how to parse CertificateRequest messages
Matt Caswell [Thu, 5 Sep 2019 15:21:56 +0000 (16:21 +0100)]
Teach TLSProxy how to parse CertificateRequest messages

We also use this in test_tls13messages to check that the extensions we
expect to see in a CertificateRequest are there.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9780)

5 years agoDon't send a status_request extension in a CertificateRequest message
Matt Caswell [Thu, 5 Sep 2019 15:43:57 +0000 (16:43 +0100)]
Don't send a status_request extension in a CertificateRequest message

If a TLSv1.3 server configured to respond to the status_request extension
also attempted to send a CertificateRequest then it was incorrectly
inserting a non zero length status_request extension into that message.

The TLSv1.3 RFC does allow that extension in that message but it must
always be zero length.

In fact we should not be sending the extension at all in that message
because we don't support it.

Fixes #9767

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9780)

5 years agoUndeprecate OpenSSL_version_num and OPENSSL_VERSION_NUMBER
Viktor Dukhovni [Sun, 9 Dec 2018 22:10:29 +0000 (17:10 -0500)]
Undeprecate OpenSSL_version_num and OPENSSL_VERSION_NUMBER

The OpenSSL_version_num() function returns at runtime the
OPENSSL_VERSION_NUMBER of the compiled OpenSSL library.  This is a
used and useful interface, and should not (at least yet) be
deprecated, we just introduced the new versioning schema, it seems
too early to deprecate the old.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7853)

5 years agoReverting check to correct
Dmitry Belyavskiy [Thu, 5 Sep 2019 12:50:58 +0000 (15:50 +0300)]
Reverting check to correct

Fixes #9773.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9776)

5 years agoDisallow change EVP_CIPHER properties once set
Dmitry Belyavskiy [Thu, 5 Sep 2019 05:31:38 +0000 (08:31 +0300)]
Disallow change EVP_CIPHER properties once set

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9764)

5 years agoDisallow change EVP_MD properties once set
Dmitry Belyavskiy [Wed, 4 Sep 2019 19:49:09 +0000 (22:49 +0300)]
Disallow change EVP_MD properties once set

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9764)

5 years ago[test] computing ECC cofactors: regression test
Billy Brumley [Mon, 2 Sep 2019 12:03:26 +0000 (15:03 +0300)]
[test] computing ECC cofactors: regression test

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9827)

5 years ago[crypto/ec] for ECC parameters with NULL or zero cofactor, compute it
Billy Brumley [Mon, 2 Sep 2019 12:02:30 +0000 (15:02 +0300)]
[crypto/ec] for ECC parameters with NULL or zero cofactor, compute it

The cofactor argument to EC_GROUP_set_generator is optional, and SCA mitigations for ECC currently use it. So the library currently falls back to very old SCA-vulnerable code if the cofactor is not present.

This PR allows EC_GROUP_set_generator to compute the cofactor for all curves of cryptographic interest. Steering scalar multiplication to more SCA-robust code.

This issue affects persisted private keys in explicit parameter form, where the (optional) cofactor field is zero or absent.

It also affects curves not built-in to the library, but constructed programatically with explicit parameters, then calling EC_GROUP_set_generator with a nonsensical value (NULL, zero).

The very old scalar multiplication code is known to be vulnerable to local uarch attacks, outside of the OpenSSL threat model. New results suggest the code path is also vulnerable to traditional wall clock timing attacks.

CVE-2019-1547

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9827)

5 years agoMake failed messages easier to find
Rich Salz [Sun, 18 Aug 2019 13:04:17 +0000 (09:04 -0400)]
Make failed messages easier to find

Now that we use travis_terminate, we can make the status messages
simpler to find, and we don't need the "OK" output.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9707)

5 years agoFix error handling in x509_lu.c
Bernd Edlinger [Mon, 19 Aug 2019 15:12:22 +0000 (17:12 +0200)]
Fix error handling in x509_lu.c

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9639)

5 years agoCleanup includes in rand_unix.c
Bernd Edlinger [Wed, 4 Sep 2019 09:39:54 +0000 (11:39 +0200)]
Cleanup includes in rand_unix.c

Fixes #9757

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9761)

5 years agoChange provider params from int to size_t
Shane Lontis [Thu, 5 Sep 2019 01:23:57 +0000 (11:23 +1000)]
Change provider params from int to size_t

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9699)

5 years agoHandle the renamed command POD files in find-doc-nits
Rich Salz [Thu, 29 Aug 2019 16:12:17 +0000 (12:12 -0400)]
Handle the renamed command POD files in find-doc-nits

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9729)

5 years agoMove libapps.a source to apps/lib
Richard Levitte [Wed, 28 Aug 2019 20:27:47 +0000 (22:27 +0200)]
Move libapps.a source to apps/lib

This makes it clearer what's what.  The 'openssl' application and its
sub-commands remain in apps/

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9723)

5 years agoSuppress 'No server certificate CA names sent' message
Billy Brawner [Wed, 28 Aug 2019 00:07:17 +0000 (17:07 -0700)]
Suppress 'No server certificate CA names sent' message

Fixes #9080

Signed-off-by: Billy Brawner <billy@wbrawner.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9710)

5 years agoOSSL_PARAM_construct_utf8_string computes the string length.
Pauli [Wed, 4 Sep 2019 09:27:08 +0000 (19:27 +1000)]
OSSL_PARAM_construct_utf8_string computes the string length.

If the passed string length is zero, the function computes the string length
from the passed string.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9760)

5 years agoNew function EVP_CIPHER_free()
Richard Levitte [Tue, 3 Sep 2019 16:11:49 +0000 (18:11 +0200)]
New function EVP_CIPHER_free()

This function re-implements EVP_CIPHER_meth_free(), but has a name that
isn't encumbered by legacy EVP_CIPHER construction functionality.

We also refactor most of EVP_CIPHER_meth_new() into an internal
evp_cipher_new() that's used when creating fetched methods.

EVP_CIPHER_meth_new() and EVP_CIPHER_meth_free() are rewritten in terms of
evp_cipher_new() and EVP_CIPHER_free().  This means that at any time, we can
deprecate all the EVP_CIPHER_meth_ functions with no harmful consequence.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9758)

5 years agoNew function EVP_MD_free()
Richard Levitte [Tue, 3 Sep 2019 15:47:13 +0000 (17:47 +0200)]
New function EVP_MD_free()

This function re-implements EVP_MD_meth_free(), but has a name that
isn't encumbered by legacy EVP_MD construction functionality.

We also refactor most of EVP_MD_meth_new() into an internal
evp_md_new() that's used when creating fetched methods.

EVP_MD_meth_new() and EVP_MD_meth_free() are rewritten in terms of
evp_md_new() and EVP_MD_free().  This means that at any time, we can
deprecate all the EVP_MD_meth_ functions with no harmful consequence.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9758)

5 years agotest/errtest.c: more conditions for checking __FILE__ and __LINE__
Richard Levitte [Tue, 3 Sep 2019 13:10:43 +0000 (15:10 +0200)]
test/errtest.c: more conditions for checking __FILE__ and __LINE__

When at least one of OPENSSL_NO_ERR or OPENSSL_NO_FILENAMES is
defined, __FILE__ and __LINE__ are not saved with the error record.
This test only checked OPENSSL_NO_FILENAMES.  Now fixed.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9755)

5 years agoRefactor how KEYMGMT methods get associated with other methods
Richard Levitte [Fri, 23 Aug 2019 12:03:28 +0000 (14:03 +0200)]
Refactor how KEYMGMT methods get associated with other methods

KEYMGMT methods were attached to other methods after those were fully
created and registered, thereby creating a potential data race, if two
threads tried to create the exact same method at the same time.

Instead of this, we change the method creating function to take an
extra data parameter, passed all the way from the public fetching
function.  In the case of EVP_KEYEXCH, we pass all the necessary data
that evp_keyexch_from_dispatch() needs to be able to fetch the
appropriate KEYMGMT method on the fly.

Fixes #9592

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9678)

5 years agoFix Coverity 1453452: Control flow issues (DEADCODE)
Pauli [Sun, 1 Sep 2019 23:12:53 +0000 (09:12 +1000)]
Fix Coverity 1453452: Control flow issues (DEADCODE)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9749)

5 years agoAdd CPU info to the speed command summary
Bernd Edlinger [Thu, 22 Aug 2019 12:28:23 +0000 (14:28 +0200)]
Add CPU info to the speed command summary

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9669)

5 years agoDiverse ERR fixes
Richard Levitte [Sun, 1 Sep 2019 08:58:19 +0000 (10:58 +0200)]
Diverse ERR fixes

1.  There are still references to the removed ERR_put_func_error().
2.  ERR_put_error() is deprecated as off version 3.0, so should
    ERR_PUT_error().
3.  'no-err' didn't affect what was passed to ERR_set_debug().

Fixes #9522

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9747)

5 years agoRework the documentation of our individual MAC implementations
Richard Levitte [Wed, 28 Aug 2019 07:13:21 +0000 (09:13 +0200)]
Rework the documentation of our individual MAC implementations

We now describe parameters instead of controls.

Also, since macros like EVP_MAC_CMAC do not exist any more, we rename
the pod files from EVP_MAC_{algo}.pod to EVP_MAC-{algo}.pod.  This
allows getting the documentation like this:

    man EVP_MAC CMAC

[skip ci]
Fixes #9709

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9713)

5 years agoFix function name typo in MAC documentation.
Pauli [Mon, 2 Sep 2019 04:09:37 +0000 (14:09 +1000)]
Fix function name typo in MAC documentation.

A spurious CTX crept into one of the function names.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9750)

5 years agoRemove extern declarations of OPENSSL_ia32cap_P
Bernd Edlinger [Sat, 24 Aug 2019 09:28:19 +0000 (11:28 +0200)]
Remove extern declarations of OPENSSL_ia32cap_P

Use the header file internal/cryptlib.h instead.
Remove checks for OPENSSL_NO_ASM and I386_ONLY
in cryptlib.c, to match the checks in other
places where OPENSSL_ia32cap_P is used and
assumed to be initialized.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/9688)

5 years agoFix platform specific issues with provider ciphers
Shane Lontis [Tue, 27 Aug 2019 09:22:42 +0000 (19:22 +1000)]
Fix platform specific issues with provider ciphers

s390_aes naming issues with ofb128 and cfb128
Solaris missing include for camellia.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9702)

5 years agoFix pkeyutl -verifyrecover
Matt Caswell [Thu, 29 Aug 2019 16:15:16 +0000 (17:15 +0100)]
Fix pkeyutl -verifyrecover

When performing a pkeyutl -verifyrecover operation the input file is not
a hash - it is the signature itself. Therefore don't do the check to make
sure it looks like a hash.

Fixes #9658

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9731)

5 years agoDon't include the DEVRANDOM being seeded logic on Android.
Pauli [Thu, 29 Aug 2019 21:38:58 +0000 (07:38 +1000)]
Don't include the DEVRANDOM being seeded logic on Android.

It lacks exposure of the `shm*` functions and should prefer the GETRANDOM
source.

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9735)

5 years agoFix NITs in comments and CHANGES for DEVRANDOM seeded check.
Pauli [Thu, 29 Aug 2019 21:29:35 +0000 (07:29 +1000)]
Fix NITs in comments and CHANGES for DEVRANDOM seeded check.

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/9734)

5 years agofix ERR_add_error_vdata() for use with multiple args/calls
Dr. David von Oheimb [Thu, 8 Aug 2019 20:30:38 +0000 (22:30 +0200)]
fix ERR_add_error_vdata() for use with multiple args/calls

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9558)

5 years agoUse ENGINE_get_id() instead of ENGINE_get_name()
Matt Caswell [Thu, 29 Aug 2019 10:55:57 +0000 (11:55 +0100)]
Use ENGINE_get_id() instead of ENGINE_get_name()

ENGINE_get_name() actually returns more of a long description of the
engine, whilst ENGINE_get_id() returns a shorter id.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9720)

5 years agoFix no-engine
Matt Caswell [Wed, 28 Aug 2019 15:18:05 +0000 (16:18 +0100)]
Fix no-engine

Make sure references to ENGINE functions are appropriately guarded.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9720)

5 years agoFix no-cmac
Matt Caswell [Wed, 28 Aug 2019 14:46:26 +0000 (15:46 +0100)]
Fix no-cmac

Don't include files that we don't want to build

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9718)

5 years agoFix no-poly1305, no-siphash and no-blake2
Matt Caswell [Wed, 28 Aug 2019 13:57:56 +0000 (14:57 +0100)]
Fix no-poly1305, no-siphash and no-blake2

Make sure we don't include files that we don't need if we've disabled
them.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9717)

5 years agoFix a documentation bug in ec.h
Matt Caswell [Wed, 28 Aug 2019 08:53:58 +0000 (09:53 +0100)]
Fix a documentation bug in ec.h

The EC_GROUP_new() function does not take a libctx parameter

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/9715)

5 years agoFix no-ec
Matt Caswell [Wed, 28 Aug 2019 13:31:39 +0000 (14:31 +0100)]
Fix no-ec

A test in sslapitest.c was failing in a no-ec build because we were using
an EC based ciphersuite. That particular test doesn't require EC
specifically, so we swap to a non EC based ciphersuite.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9716)

5 years agoFix no-des
Matt Caswell [Wed, 28 Aug 2019 15:00:01 +0000 (16:00 +0100)]
Fix no-des

Don't refer to cipher functions in the providers that have been compiled
out.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9719)

5 years agoUpdate fuzz README.md
Matt Caswell [Wed, 28 Aug 2019 16:30:14 +0000 (17:30 +0100)]
Update fuzz README.md

Building with enable-fuzz-afl has always required no-shared. We now also
need no-module for a successful build. Therefore update the README
accordingly.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9721)

5 years agoFix data races in EVP_CIPHER_fetch and EVP_MD_fetch
Matt Caswell [Wed, 14 Aug 2019 17:09:28 +0000 (18:09 +0100)]
Fix data races in EVP_CIPHER_fetch and EVP_MD_fetch

Don't modify the cipher/md we just fetched - it could be shared by multiple
threads.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9590)

5 years agoMake sure we pre-initialise properties
Matt Caswell [Wed, 14 Aug 2019 14:00:35 +0000 (15:00 +0100)]
Make sure we pre-initialise properties

Simplify the initialisation of the core by pre-initialising properties.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9590)

5 years agoFix context locking
Matt Caswell [Wed, 14 Aug 2019 13:43:11 +0000 (14:43 +0100)]
Fix context locking

Some parts of OPENSSL_CTX intialisation can get quite complex (e.g. RAND).
This can lead to complex interactions where different parts of the library
try to initialise while other parts are still initialising. This can lead
to deadlocks because both parts want to obtain the init lock.

We separate out the init lock so that it is only used to manage the
dynamic list of indexes. Each part of the library gets its own
initialisation lock.

Fixes #9454

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9590)

5 years agoAllow an output indentation of zero in apps.
Pauli [Thu, 29 Aug 2019 05:21:04 +0000 (15:21 +1000)]
Allow an output indentation of zero in apps.

Previously, it would indent one space even if zero were specified.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9725)

5 years agoopenssl provider: New sub-command, for provider discovery
Richard Levitte [Mon, 26 Aug 2019 20:09:27 +0000 (22:09 +0200)]
openssl provider: New sub-command, for provider discovery

This command is somewhat similar to 'openssl engine', but displays
what it can about the given providers.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9697)

5 years agoMove print_param_types() to libapps, and give it indent argument
Richard Levitte [Mon, 26 Aug 2019 20:08:04 +0000 (22:08 +0200)]
Move print_param_types() to libapps, and give it indent argument

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9697)

5 years agoCoverty fixes for MACs
Richard Levitte [Tue, 27 Aug 2019 08:12:34 +0000 (10:12 +0200)]
Coverty fixes for MACs

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9700)

5 years agoOPENSSL_info(): add the item OPENSSL_INFO_SEED_SOURCE and use it
Richard Levitte [Sat, 24 Aug 2019 10:40:10 +0000 (12:40 +0200)]
OPENSSL_info(): add the item OPENSSL_INFO_SEED_SOURCE and use it

'openssl version -r' prints the seed source based on compiler macros.
This does not necessarily reflect the library's idea of what seed
sources to use, so we reimplement the list of seed sources as a
OPENSSL_info() item and display that instead.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9689)

5 years agoFix bogus check for EVP_PKEY_supports_digest_nid() in check_cert_usable()
David Woodhouse [Thu, 22 Aug 2019 17:09:11 +0000 (18:09 +0100)]
Fix bogus check for EVP_PKEY_supports_digest_nid() in check_cert_usable()

In commit 2d263a4a73 ("Honour mandatory digest on private key in
has_usable_cert()" I added two checks for the capabilities of the
EVP_PKEY being used. One of them was wrong, as it should only be
checking the signature of the X.509 cert (by its issuer) against the
sigalgs given in a TLS v1.3 signature_algorithms_cert extension.

Remove it and provide the code comments which, if they'd been present
in the first place, would hopefully have prevented the mistake.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9672)

5 years agotesting: set OPENSSL_MODULES to the providers directory by default
Richard Levitte [Sat, 17 Aug 2019 06:35:32 +0000 (08:35 +0200)]
testing: set OPENSSL_MODULES to the providers directory by default

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9618)

5 years agoFix SCA vulnerability when using PVK and MSBLOB key formats
Cesar Pereida Garcia [Wed, 14 Aug 2019 07:17:06 +0000 (10:17 +0300)]
Fix SCA vulnerability when using PVK and MSBLOB key formats

This commit addresses a side-channel vulnerability present when
PVK and MSBLOB key formats are loaded into OpenSSL.
The public key was not computed using a constant-time exponentiation
function.

This issue was discovered and reported by the NISEC group at TAU Finland.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9587)

5 years agoDo not have duplicate section heads
Rich Salz [Fri, 16 Aug 2019 12:34:16 +0000 (08:34 -0400)]
Do not have duplicate section heads

Change find-doc-nits to complain if a section header is repeated,
within a parent header (i.e., duplicate =head2 within a =head1).
In almost all cases, we just remove the duplicate header, as
it was a "continuation" of the =head1 that was already in affect.
In some cases, just remove "=head1 NOTES", possibly moving text
around, because the "NOTES" were really important parts of the
DESCRIPTION section.

No =headX sections should end with a period.
All =head1 labels should be in all uppercase.
No sub-head (=head2, etc) should be in all uppercase.
Update find-doc-nits to reject the above.

Fixup an internal POD link

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9631)

5 years agoInclude mac_meth and mac_lib in the FIPS provider
Pauli [Mon, 26 Aug 2019 07:30:13 +0000 (17:30 +1000)]
Include mac_meth and mac_lib in the FIPS provider

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9694)

5 years agoCleanup ciphers and Add 3des ciphers.
Shane Lontis [Mon, 26 Aug 2019 07:05:08 +0000 (17:05 +1000)]
Cleanup ciphers and Add 3des ciphers.

Moved the relevant ciphers into default and restructed headers to allow the move.
This removed most of the cases of #ifdef NO_XXX (which are now specified in build.info)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9482)

5 years agoFix Issue OSS-Fuzz: Branch on uninitialized memory (in ccm code).
Shane Lontis [Sun, 25 Aug 2019 07:10:48 +0000 (17:10 +1000)]
Fix Issue OSS-Fuzz: Branch on uninitialized memory (in ccm code).

This would also happen for aes-ccm. There was one branch path where it just returned 1
without setting *padlen, It now branches so that the value is set to 0.

Fixes #9691

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9692)

5 years agoUpdate EVP_MAC.pod
Richard Levitte [Fri, 23 Aug 2019 12:54:16 +0000 (14:54 +0200)]
Update EVP_MAC.pod

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9667)

5 years agoGet rid of the diversity of names for MAC parameters
Richard Levitte [Thu, 22 Aug 2019 10:50:00 +0000 (12:50 +0200)]
Get rid of the diversity of names for MAC parameters

The EVP_PKEY MAC implementations had a diversity of controls that were
really the same thing.  We did reproduce that for the provider based
MACs, but are changing our minds on this.  Instead of that, we now use
one parameter name for passing the name of the underlying ciphers or
digests to a MAC implementation, "cipher" and "digest", and one
parameter name for passing the output size of the MAC, "size".

Then we leave it to the EVP_PKEY->EVP_MAC bridge to translate "md"
to "digest", and "digestsize" to "size".

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9667)

5 years agoRemove MAC cruft
Richard Levitte [Thu, 22 Aug 2019 10:08:55 +0000 (12:08 +0200)]
Remove MAC cruft

A few declarations and static functions / arrays that are no longer
used were left behind when MACs moved to be implemented by providers.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9667)

5 years agoAdd app for fips installation
Shane Lontis [Sat, 24 Aug 2019 08:56:34 +0000 (18:56 +1000)]
Add app for fips installation

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9634)

5 years agoAvoid overflowing FDSET when using select(2).
Pauli [Sat, 24 Aug 2019 06:13:24 +0000 (16:13 +1000)]
Avoid overflowing FDSET when using select(2).

There is a problem in the rand_unix.c code when the random seed fd is greater
than or equal to FD_SETSIZE and the FDSET overruns its limit and walks the
stack.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9686)

5 years agotest/evp_test.c: distinguish parsing errors from processing errors
Richard Levitte [Fri, 23 Aug 2019 15:41:23 +0000 (17:41 +0200)]
test/evp_test.c: distinguish parsing errors from processing errors

Parsing functions are at liberty to return:

1:  when parsing on processing of the parsed value succeeded
0:  when the parsed keyword is unknown
-1: when the parsed value processing failed

Some parsing functions didn't do this quite right, they returned 0
when they should have returned -1, causing a message like this:

    Line 123: unknown keyword PeerKey

When this message (which is displayed when the parsing function
returns -1) would have been more appropriate:

    Line 123: error processing keyword PeerKey = ffdhe2048-2-pub

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9682)

5 years agocrypto/bn/build.info: define OPENSL_IA32_SSE2 globally when needed
Richard Levitte [Fri, 23 Aug 2019 15:19:08 +0000 (17:19 +0200)]
crypto/bn/build.info: define OPENSL_IA32_SSE2 globally when needed

This is done conditionally.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9679)

5 years agoConfigure: Allow 'DEFINE[]=def'
Richard Levitte [Fri, 23 Aug 2019 15:16:48 +0000 (17:16 +0200)]
Configure: Allow 'DEFINE[]=def'

DEFINE[] definitions end up pushed in @{$config{defines}} instead of
being added to the output file list of defines.  This allows for the
unusual case where we need something to be defined globally, so it
gets picked up by anything using $(CPPFLAGS).

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9679)

5 years agoDeprecate unprefixed manual entries for openssl commands
Dr. Matthias St. Pierre [Wed, 21 Aug 2019 23:04:41 +0000 (01:04 +0200)]
Deprecate unprefixed manual entries for openssl commands

Initially, the manual page entry for the 'openssl cmd' command used
to be available at 'cmd(1)'. Later, the aliases 'openssl-cmd(1)' was
introduced, which made it easier to group the openssl commands using
the 'apropos(1)' command or the shell's tab completion.

In order to reduce cluttering of the global manual page namespace,
the manual page entries without the 'openssl-' prefix have been
deprecated in OpenSSL 3.0 and will be removed in OpenSSL 4.0.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9666)

5 years agoopenssl dgst, openssl enc: check for end of input
Richard Levitte [Thu, 22 Aug 2019 11:34:16 +0000 (13:34 +0200)]
openssl dgst, openssl enc: check for end of input

The input reading loop in 'openssl dgst' and 'openssl enc' doesn't
check for end of input, and because of the way BIO works, it thereby
won't detect that the end is reached before the read is an error.
With the FILE BIO, an error occurs when trying to read past EOF, which
is fairly much ok, except when the command is used interactively, at
least on Unix.  The result in that case is that the user has to press
Ctrl-D twice for the command to terminate.

The issue is further complicated because both these commands use
filter BIOs on top of the FILE BIO, so a naïve attempt to check
BIO_eof() doesn't quite solve it, since that only checks the state of
the source/sink BIO, and the filter BIO may have some buffered data
that still needs to be read.  Fortunately, there's BIO_pending() that
checks exactly that, if any filter BIO has pending data that needs to
be processed.

We end up having to check both BIO_pending() and BIO_eof().

Thanks to Zsigmond Lőrinczy for the initial effort and inspiration.

Fixes #9355

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9668)

5 years agoSupport parsing of SM2 ID in hexdecimal
Paul Yang [Tue, 30 Jul 2019 15:05:44 +0000 (23:05 +0800)]
Support parsing of SM2 ID in hexdecimal

The current EVP_PEKY_ctrl for SM2 has no capability of parsing an ID
input in hexdecimal.

The newly added ctrl string is called: sm2_hex_id

Test cases and documentation are updated.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9584)

5 years agoAdd basic aria and camellia ciphers modes to default provider
Shane Lontis [Thu, 22 Aug 2019 01:42:54 +0000 (11:42 +1000)]
Add basic aria and camellia ciphers modes to default provider

The aes code has been refactored into generic and algorithn specific parts,
so that most of the code can be shared.
The cipher related files have been broken up into smaller parts.
Add chunked variant of mode ciphers - aria uses this (many other ciphers will use this new code instead of the
generic code used by aes).

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9451)

5 years agoFix drbg_ossl_ctx_free() and drbg_nonce_ossl_ctx_free() to handle NULL
Richard Levitte [Wed, 21 Aug 2019 08:12:05 +0000 (10:12 +0200)]
Fix drbg_ossl_ctx_free() and drbg_nonce_ossl_ctx_free() to handle NULL

If these were passed NULL, the crashed with a SIGSEGV, when they
should do like all other freeing functions and become a no-op.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9650)

5 years agoModify ossl_method_store_add() to accept an OSSL_PROVIDER and check for it
Richard Levitte [Wed, 21 Aug 2019 08:08:44 +0000 (10:08 +0200)]
Modify ossl_method_store_add() to accept an OSSL_PROVIDER and check for it

If ossl_method_store_add() gets called with a method that already exists
(i.e. the store has one with matching provider, nid and properties), that
method should not be stored.  We do this check inside ossl_method_store_add()
because it has all the locking required to do so safely.

Fixes #9561

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9650)

5 years agoModify ossl_method_store_add() to handle reference counting
Richard Levitte [Wed, 21 Aug 2019 07:58:10 +0000 (09:58 +0200)]
Modify ossl_method_store_add() to handle reference counting

Because this function affects the reference count on failure (the call
to impl_free() does this), it may as well handle incrementing it as
well to indicate the extra reference in the method store.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9650)

5 years agoFix ossl_param_bld_push_{utf8,octet}_string() / param_bld_convert()
Richard Levitte [Wed, 21 Aug 2019 09:08:20 +0000 (11:08 +0200)]
Fix ossl_param_bld_push_{utf8,octet}_string() / param_bld_convert()

ossl_param_bld_push_{utf8,octet}_string() saved the constant string
pointer to a non-constant structure field, so we change that field to
a pointer to a constant.  We also modify param_bld_convert() to
pretend the resulting pointer for PTR types points to a constant as
well.

Completes #9649

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9651)

5 years agoConstify param builder string functions.
Pauli [Wed, 21 Aug 2019 05:28:52 +0000 (15:28 +1000)]
Constify param builder string functions.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9649)

5 years agoCorrect documented return value for BIO_get_mem_data()
Johannes [Tue, 20 Aug 2019 06:13:47 +0000 (16:13 +1000)]
Correct documented return value for BIO_get_mem_data()

CLA: trivial

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9643)

5 years agoStart up DEVRANDOM entropy improvement for older Linux devices.
Pauli [Tue, 20 Aug 2019 06:10:49 +0000 (16:10 +1000)]
Start up DEVRANDOM entropy improvement for older Linux devices.

Improve handling of low entropy at start up from /dev/urandom by waiting for
a read(2) call on /dev/random to succeed.  Once one such call has succeeded,
a shared memory segment is created and persisted as an indicator to other
processes that /dev/urandom is properly seeded.

This does not fully prevent against attacks weakening the entropy source.
An attacker who has control of the machine early in its boot sequence
could create the shared memory segment preventing detection of low entropy
conditions.  However, this is no worse than the current situation.

An attacker would also be capable of removing the shared memory segment
and causing seeding to reoccur resulting in a denial of service attack.
This is partially mitigated by keeping the shared memory alive for the
duration of the process's existence.  Thus, an attacker would not only need
to have called call shmctl(2) with the IPC_RMID command but the system
must subsequently enter a state where no instances of libcrypto exist in
any process.  Even one long running process will prevent this attack.

The System V shared memory calls used here go back at least as far as
Linux kernel 2.0.  Linux kernels 4.8 and later, don't have a reliable way
to detect that /dev/urandom has been properly seeded, so a failure is raised
for this case (i.e. the getentropy(2) call has already failed).

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9595)

5 years agoprevent endless recursion when trace API is used within OPENSSL_init_crypto()
Dr. David von Oheimb [Sat, 10 Aug 2019 14:51:12 +0000 (16:51 +0200)]
prevent endless recursion when trace API is used within OPENSSL_init_crypto()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
(Merged from https://github.com/openssl/openssl/pull/9567)

5 years agocleanup provider digests
Shane Lontis [Mon, 19 Aug 2019 23:07:12 +0000 (09:07 +1000)]
cleanup provider digests

Added some missing #ifdef NO_XXX around some of the digest functions.
Renamed core_mkdigest.h to digestcommon.h
Added ERR_raise() to set/get params for digest.
Moved common code for get_params/gettable_params into digest_common.c
Renamed #defines in digestcommon.
Removed null_prov.c (It should not be needed)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9625)

5 years agoAdd aes_ccm to provider
Shane Lontis [Mon, 19 Aug 2019 22:54:41 +0000 (08:54 +1000)]
Add aes_ccm to provider

Add Cleanups for gcm - based on the changes to ccm.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com>
(Merged from https://github.com/openssl/openssl/pull/9280)