| 4264ecd | Matt Caswell | 01 May 2020, 08:17:40 UTC | Don't offer or accept ciphersuites that we can't support We were not correctly detecting whether TLSv1.3 ciphersuites could actually be supported by the available provider implementations. For example a FIPS client would still offer CHACHA20-POLY1305 based ciphersuites even though it couldn't actually use them. Similarly on the server would try to use CHACHA20-POLY1305 and then fail the handshake. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11700) | 06 May 2020, 10:49:59 UTC |
| 15dd075 | Matt Caswell | 01 May 2020, 14:15:13 UTC | Fix a memory leak in CONF .include handling If OPENSSL_CONF_INCLUDE has been set then we may leak the "include" buffer. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11691) | 06 May 2020, 10:40:53 UTC |
| 6ed34b3 | Matt Caswell | 30 April 2020, 15:08:57 UTC | Centralise Environment Variables for the tests The test_includes test was failing if OPENSSL_CONF_INCLUDE happened to be set in the user's environment. To ensure that no tests accidentally use this or other enviroment variables from the user's environment we automatically set them centrally for all tests. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11691) | 06 May 2020, 10:40:53 UTC |
| 500a761 | Tomas Mraz | 05 May 2020, 07:52:25 UTC | The synthesized OPENSSL_VERSION_NUMBER must be long (to keep API compatibility with older releases) Fixes #11716 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11732) | 06 May 2020, 10:32:42 UTC |
| 35774d5 | Benjamin Kaduk | 04 May 2020, 18:50:25 UTC | Fix up whitespace nits introduced by PR #11416 Expand a couple literal tabs, and de-indent the body of a function. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11728) | 06 May 2020, 00:21:51 UTC |
| 6763f9c | Christian Heimes | 04 May 2020, 12:26:12 UTC | Use fips=yes consistently in documentation The documentation for ``EVP_default_properties_is_fips_enabled()`` uses ``fips=yes`` in one place and ``fips=true`` in another place. Stick to ``fips=yes`` like everywhere else. Signed-off-by: Christian Heimes <christian@python.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11723) | 05 May 2020, 16:27:36 UTC |
| 278260b | Dr. David von Oheimb | 30 April 2020, 17:31:07 UTC | Strengthen X509_STORE_CTX_print_verify_cb() to print expected host etc. Add X509_VERIFY_PARAM_get0_host(), X509_VERIFY_PARAM_get0_email(), and X509_VERIFY_PARAM_get1_ip_asc() to support this, as well as the internal helper function ipaddr_to_asc(), which is used also for simplifying other IP address output functions. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11693) | 05 May 2020, 08:27:28 UTC |
| e307e61 | Kurt Roeckx | 13 April 2020, 11:01:29 UTC | Improve SSL_shutdown documentation. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11531) | 05 May 2020, 04:31:27 UTC |
| 3327c8d | Shane Lontis | 01 May 2020, 07:09:01 UTC | Fix aix compile error in cmp_ctx_test.c Errors were of the form 1506-226 (S) The ":" operator is not allowed between "int" and "char*". I think it is valid syntax the way it was written, But just rewrote so it compiled. The aix compiler must be looking at the type of blah() when doing test ? (blah(), NULL) : X. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11698) | 04 May 2020, 23:46:23 UTC |
| 95cf644 | Shane Lontis | 02 May 2020, 03:51:35 UTC | Fix incorrect default keysize for CAST ofb and cfb modes. Fixes #11459 It was incorrectly using 8 bytes instead of 16 as the default. This was verified by expanding the macros used in e_cast.c. The issue occurs if EVP_CIPHER_CTX_set_key_length() is not called. evp_test.c hides this issue as it always calls EVP_CIPHER_CTX_set_key_length() before using EVP_CipherInit_ex(...., key, ..). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11707) | 04 May 2020, 23:38:08 UTC |
| b756626 | Matt Caswell | 28 April 2020, 16:45:53 UTC | Allow OSSL_PARAM_get_octet_string() to pass a NULL buffer We may just want to know the number of octets so allow passing a NULL buffer. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635) | 04 May 2020, 08:30:55 UTC |
| 86dc26b | Matt Caswell | 27 April 2020, 16:17:05 UTC | Add some tests for the newly added raw private/public key functions We already had soem tests for the older raw private/public key functions so we expand those to call the new versions as well and pass in a libctx. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635) | 04 May 2020, 08:30:55 UTC |
| 2b1bc78 | Matt Caswell | 27 April 2020, 15:48:18 UTC | Document the new raw private/public key functions Document the newly added EVP_PKEY_new_raw_private_key_with_libctx and EVP_PKEY_new_raw_public_key_with_libctx functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635) | 04 May 2020, 08:30:55 UTC |
| 262ff12 | Matt Caswell | 27 April 2020, 15:14:16 UTC | Implement key match functionality for ECX keys This makes EVP_PKEY_cmp work for provider side ECX keys. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635) | 04 May 2020, 08:30:55 UTC |
| 48b4b10 | Matt Caswell | 24 April 2020, 16:40:31 UTC | Fix the KEYNID2TYPE macro This macro was not correctly handling Ed25519 keys Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635) | 04 May 2020, 08:30:55 UTC |
| d4fe478 | Matt Caswell | 24 April 2020, 15:20:27 UTC | Don't export ECX key data twice We had a redundant couple of lines where we exported key data twice. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635) | 04 May 2020, 08:30:55 UTC |
| c19d897 | Matt Caswell | 24 April 2020, 15:19:25 UTC | Ensure EVP_PKEY_get_raw_[private|public]_key work with provider keys If the key is a provider key then we should export it from the provider. Fixes #11627 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635) | 04 May 2020, 08:30:55 UTC |
| f3336f4 | Matt Caswell | 24 April 2020, 14:43:20 UTC | Add the library ctx into an ECX_KEY At various points we need to be able to retrieve the current library context so we store it in the ECX_KEY structure. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635) | 04 May 2020, 08:30:55 UTC |
| 969024b | Matt Caswell | 24 April 2020, 14:32:34 UTC | Add the ability to ECX to import keys with only the private key ECX keys can very easily crete the public key from the private key. Therefore when we import ecx keys it is sufficent to just have the private key. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635) | 04 May 2020, 08:30:55 UTC |
| a6f8a83 | Matt Caswell | 24 April 2020, 10:44:15 UTC | Ensure OSSL_PARAM_BLD_free() can accept a NULL All OpenSSL free functions should accept NULL. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635) | 04 May 2020, 08:30:55 UTC |
| 1c4f340 | Matt Caswell | 24 April 2020, 10:33:33 UTC | Make EVP_new_raw_[private|public]_key provider aware We also introduce variants which are OPENSSL_CTX aware Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635) | 04 May 2020, 08:30:55 UTC |
| 7421f08 | nia | 30 April 2020, 13:43:04 UTC | rand_unix.c: Ensure requests to KERN_ARND don't exceed 256 bytes. Requests for more than 256 bytes will fail. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11689) | 04 May 2020, 07:55:47 UTC |
| 0c27ce7 | nia | 30 April 2020, 13:42:09 UTC | rand_unix.c: Only enable hack for old FreeBSD versions on FreeBSD Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11689) | 04 May 2020, 07:55:47 UTC |
| e2e4b78 | nia | 30 April 2020, 13:41:07 UTC | rand_unix.c: Include correct headers for sysctl() on NetBSD This allows sysctl(KERN_ARND) to be detected properly. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11689) | 04 May 2020, 07:55:47 UTC |
| e4ec769 | Leo Neat | 17 March 2020, 01:15:50 UTC | CIFuzz turning dry_run off Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11339) | 04 May 2020, 07:51:56 UTC |
| 12cbb8e | Richard Levitte | 01 May 2020, 16:06:18 UTC | WPACKET: don't write DER length when we don't want to With endfirst writing, it could be that we want to abandon any zero length sub-packet. That's what WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH was supposed to make happen, but the DER length writing code didn't look at that flag. Now it does. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11703) | 04 May 2020, 03:50:06 UTC |
| 200e5ee | Richard Levitte | 02 May 2020, 08:48:59 UTC | Fix reason code clash EVP_R_NULL_MAC_PKEY_CTX vs EVP_R_SET_DEFAULT_PROPERTY_FAILURE Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11708) | 03 May 2020, 04:26:30 UTC |
| 6d81bb2 | Richard Levitte | 01 May 2020, 17:24:50 UTC | util/perl/OpenSSL/OID.pm: remove the included unit test The unit test uses features that appeared in perl 5.12, and is therefore a source of trouble when building. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11704) | 03 May 2020, 04:05:27 UTC |
| c450922 | Shane Lontis | 01 May 2020, 05:15:02 UTC | Add solaris assembler fixes for legacy provider The legacy provider contains assembler references. Most code is automagically pulled in from the libcrypto - but the platform specific assembler functions will not be visible in the symbol table. Copying BNASM and DESASM into liblegacy seems to be a better solution than exposing platform specific function in libcrypto.num. Added a missing call in the des_cbc code for sparc. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11697) | 02 May 2020, 07:55:07 UTC |
| e0624f0 | Shane Lontis | 02 May 2020, 04:17:54 UTC | Add default property API's to enable and test for fips Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11239) | 02 May 2020, 04:17:54 UTC |
| e908f29 | Benjamin Kaduk | 02 April 2020, 00:08:10 UTC | make update for SSL_new_session_ticket Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11416) | 01 May 2020, 22:19:23 UTC |
| f0049b8 | Benjamin Kaduk | 17 March 2020, 17:08:11 UTC | Add test for SSL_new_session_ticket() Run a normal handshake and then request some extra tickets, checking that the new_session_cb is called the expected number of times. Since the tickets are generated in the same way as other tickets, there should not be a need to verify that these specific ones can be used to resume. Run the test with both zero and a non-zero number of tickets issued in the initial handshake. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11416) | 01 May 2020, 22:19:23 UTC |
| 3bfacb5 | Benjamin Kaduk | 16 March 2020, 18:25:58 UTC | Add SSL_new_session_ticket() API This API requests that the TLS stack generate a (TLS 1.3) NewSessionTicket message the next time it is safe to do so (i.e., we do not have other data pending write, which could be mid-record). For efficiency, defer actually generating/writing the ticket until there is other data to write, to avoid producing server-to-client traffic when not needed. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11416) | 01 May 2020, 22:10:11 UTC |
| 6250282 | Benjamin Kaduk | 16 March 2020, 18:25:12 UTC | Fix whitespace nit in ossl_statem_server_pre_work An 'if' clause was nestled against a previous closing brace as it if was an 'else if', but should properly stand on its own line. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11416) | 01 May 2020, 22:10:10 UTC |
| 9011309 | Mat Berchtold | 22 April 2020, 00:30:40 UTC | Add a test for EVP_PKEY_*_check functions for "DSA" keys Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11598) | 01 May 2020, 06:54:29 UTC |
| 2fc2e37 | Mat Berchtold | 21 April 2020, 19:13:16 UTC | When a private key is validated and there is no private key, return early. Affected functions: dsa_validate_public dsa_validate_private dh_validate_public dh_validate_private Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11598) | 01 May 2020, 06:54:29 UTC |
| 64e54bf | Pauli | 26 April 2020, 23:32:14 UTC | coverity 1462581 Dereference after null check Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:33 UTC |
| 206da66 | Pauli | 26 April 2020, 23:28:55 UTC | coverity 1462580 Improper use of negative value Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:33 UTC |
| 209c3d3 | Pauli | 26 April 2020, 23:26:48 UTC | coverity 1462578 Resource leak Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:33 UTC |
| 6f0bdf4 | Pauli | 26 April 2020, 23:25:42 UTC | coverity 1462576 Resource leak Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:33 UTC |
| 3e47e7b | Pauli | 26 April 2020, 21:48:32 UTC | coverity 1462567: Null pointer dereferences Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:33 UTC |
| ba61a0e | Pauli | 26 April 2020, 23:19:11 UTC | coverity 1462574 Resource leak Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:33 UTC |
| 5e12a13 | Pauli | 26 April 2020, 23:17:48 UTC | coverity 1462573 Dereference after null check Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:33 UTC |
| cb383f1 | Pauli | 26 April 2020, 23:16:04 UTC | coverity 1462572 Dereference after null check Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:33 UTC |
| 61cdc2a | Pauli | 26 April 2020, 23:13:46 UTC | coverity 1462571 Dereference after null check Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:33 UTC |
| 67d744b | Pauli | 26 April 2020, 23:10:15 UTC | coverity 1462570 Resource leak Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:32 UTC |
| d4d67ba | Pauli | 26 April 2020, 23:06:14 UTC | coverity 1462566 Resource leak Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:32 UTC |
| 0e2b609 | Pauli | 26 April 2020, 23:04:05 UTC | coverity 1462564 Improper use of negative value Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:32 UTC |
| 437e36a | Pauli | 26 April 2020, 22:58:59 UTC | coverity 1462562 Dereference before null check Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:32 UTC |
| 70e18f9 | Pauli | 26 April 2020, 22:57:38 UTC | coverity 1462561 Uninitialized scalar variable Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:32 UTC |
| 2a4ad6a | Pauli | 26 April 2020, 22:54:28 UTC | coverity 1462560 Resource leak Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:32 UTC |
| 576bcdb | Pauli | 26 April 2020, 22:45:04 UTC | coverity 1462556 Resource leak Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:32 UTC |
| 9dbfb11 | Pauli | 26 April 2020, 22:42:20 UTC | coverity 1462554 Dereference after null check Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:32 UTC |
| 4dcff55 | Pauli | 26 April 2020, 22:33:27 UTC | coverity 1462549 Dereference before null check Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:32 UTC |
| ada7d4c | Pauli | 26 April 2020, 22:30:49 UTC | coverity 1462548 Resource leak Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:32 UTC |
| 089c292 | Pauli | 26 April 2020, 22:26:39 UTC | coverity 1462546 Dereference after null check Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:31 UTC |
| dc8908b | Pauli | 26 April 2020, 22:25:33 UTC | coverity 1462545 Dereference after null check Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:31 UTC |
| e655ce1 | Pauli | 26 April 2020, 22:21:06 UTC | coverity: 1462544 Dereference after null check Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:31 UTC |
| 1f74259 | Pauli | 26 April 2020, 22:05:23 UTC | coverity 1462543 Logically dead code Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:31 UTC |
| bd5f280 | Pauli | 26 April 2020, 22:01:28 UTC | coverity 1462541 Dereference after null check Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:16 UTC |
| 9b0e74c | Pauli | 26 April 2020, 21:59:02 UTC | coverity 1462550 Resource leak Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:16 UTC |
| 7213307 | Pauli | 26 April 2020, 21:51:16 UTC | coverity 1462565: Null pointer dereferences Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:16 UTC |
| 4f5e206 | Pauli | 26 April 2020, 21:40:17 UTC | coverity 1462577: Incorrect expression Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:16 UTC |
| 92f0684 | Pauli | 26 April 2020, 21:32:43 UTC | param bld: avoid freeing the param builder structure on error paths. The param builder was recently modified so that it doesn't free the passed in param builder structure. Some of the error paths didn't get synced up with this change and resulted in double frees. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651) | 30 April 2020, 10:21:16 UTC |
| bb4f391 | Shane Lontis | 29 April 2020, 06:19:16 UTC | Fix snprintf missing for windows build Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11675) | 30 April 2020, 08:04:05 UTC |
| 588d5d0 | Pauli | 28 April 2020, 09:03:05 UTC | Undeprecate DH, DSA and RSA _bits() functions. These were deemed information and useful and that they should not be deprecated. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11669) | 30 April 2020, 04:51:37 UTC |
| 036ee37 | Richard Levitte | 28 April 2020, 06:41:20 UTC | EVP: Fix evp_keymgmt_util_copy() for to->keymgmt == NULL evp_keymgmt_util_copy() didn't treat the case to->keymgmt correctly. The proper change is to use from->keymgmt when to->keymgmt is NULL. Fixes coverity #1462553 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11668) | 29 April 2020, 13:35:02 UTC |
| a6ed19d | Shourya Shukla | 27 April 2020, 04:59:50 UTC | Amend references to "OpenSSL license" A small number of files contain references to the "OpenSSL license" which has been deprecated and replaced by the "Apache License 2.0". Amend the occurences. Fixes #11649 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11663) | 29 April 2020, 13:27:22 UTC |
| 5e427a4 | opensignature | 27 April 2020, 09:47:44 UTC | Update EVP_PKEY_fromdata.pod Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11660) | 29 April 2020, 08:49:59 UTC |
| 90a37ce | Richard Levitte | 27 April 2020, 09:59:17 UTC | include/openssl/ts.h: clean away a misplaced EVP_MD stack definition Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11655) | 29 April 2020, 04:37:32 UTC |
| 0165913 | Richard Levitte | 27 April 2020, 06:36:53 UTC | include/openssl/x509v3.h: restore previous stack definition arrangement It turned out that configuration options may affect the definition and use of diverse stacks and how they relate to the underlying types. For example, the configuration option 'no-rfc3779' results in a build error around STACK_OF(IPAddressFamily) and related stacks. Previously, STACK_OF definitions were located near the definition of the underlying type, which are also affected by configuration options, which made this easier to maintain. We relocate the new stack definitions back to those locations for that reason. We apply the same type of relocation in other header files as well, following the general rule that it's better to use DEFINE_OR_DECLARE_STACK_OF after the type it defines a stack for has been defined. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11655) | 29 April 2020, 04:37:10 UTC |
| 9df3dd6 | Matt Caswell | 27 April 2020, 09:36:35 UTC | Update README.ssltests.md The ssltest docs were out of date because gneerate_ssl_tests now needs a provider to be specified on the command line. Fixes #11639 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11659) | 28 April 2020, 16:14:44 UTC |
| f844f9e | Richard Levitte | 13 April 2020, 20:34:56 UTC | Rename FIPS_MODE to FIPS_MODULE This macro is used to determine if certain pieces of code should become part of the FIPS module or not. The old name was confusing. Fixes #11538 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11539) | 28 April 2020, 13:37:37 UTC |
| cf86057 | Sebastian Andrzej Siewior | 25 April 2020, 18:29:48 UTC | Configurations: Identify the shell variables around MANSUFFIX With MANSUFFIX=A the statement '$$fn$(MANSUFFIX)' is reaplaces with '$fnA' and left empty because the `fnA' variables is not recognized within the shell. With {} around fn it is then bocomes ${fn}A and works as expected. While here, add the MANSUFFIX to the ECHO line so it is properly printed during build. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11643) | 28 April 2020, 10:09:11 UTC |
| c9c78d2 | Nikolay Morozov | 22 April 2020, 09:09:38 UTC | Fix GOST curve sec bits Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11637) | 28 April 2020, 08:40:18 UTC |
| f828ba0 | Richard Levitte | 27 April 2020, 07:08:36 UTC | Configure: change all references to INSTALL to INSTALL.md Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11657) | 28 April 2020, 08:03:40 UTC |
| cf076a3 | Richard Levitte | 27 April 2020, 06:11:52 UTC | Configurations/unix-Makefile.tmpl: fix typo PROCESSSOR => PROCESSOR Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11654) | 28 April 2020, 07:45:37 UTC |
| fb12163 | Benjamin Kaduk | 01 April 2020, 20:51:40 UTC | sslapitest: only compile test when it will be used The test_ccs_change_cipher() test routine is used only when TLS 1.2 is enabled; to fix the strict-warnings build we should not try to compile it when TLS 1.2 is disabled, either. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11458) | 27 April 2020, 23:22:48 UTC |
| af0d413 | Sebastian Andrzej Siewior | 25 April 2020, 21:57:00 UTC | doc: Random spellchecking A little spell checking. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11644) | 27 April 2020, 23:06:04 UTC |
| 60ebc0c | Richard Levitte | 25 April 2020, 02:11:09 UTC | fuzz/asn1.c: Add missing #include <openssl/dsa.h> gets included via ts.h... except when 'no-ts' has been configured. Fixes #11597 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11640) | 27 April 2020, 22:03:17 UTC |
| 80b94a5 | Christian Hohnstaedt | 22 March 2020, 08:41:30 UTC | i2b_PVK_bio: don't set PEM_R_BIO_WRITE_FAILURE in case of success but in case of an error CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11380) | 27 April 2020, 15:43:19 UTC |
| 7ffce85 | Arne Schwabe | 23 April 2020, 10:42:51 UTC | Fix type cast in SSL_CTX_set1_groups macro The macro casts the glist parameter to char* instead of (int *) like the documentation of the function suggest. Also the function tls1_set_groups that is called from SSL_CTX_ctrl takes an int * argument. This looks like a copy&paste error from SSL_CTX_set1_groups_list function. CLA: trivial Signed-off-by: Arne Schwabe <arne@rfc2549.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11614) | 27 April 2020, 15:38:06 UTC |
| d0bcad7 | Richard Levitte | 27 April 2020, 06:43:18 UTC | crypto/x509/v3_alt.c: make 'othername' a bit bigger We want to fill 'othername' with the contents of 'oline' (256 bytes) plus some additional text. We need to ensure that 'othername' is large enough to contain this. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11656) | 27 April 2020, 13:52:01 UTC |
| ee6c7cd | Nicola Tuveri | 24 April 2020, 16:25:56 UTC | Fix links in CONTRIBUTING.md CHANGES and NEWS were renamed into CHANGES.md and NEWS.md; this commit updates the references inside CONTRIBUTING.md to fix broken links. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11634) | 27 April 2020, 13:35:39 UTC |
| 70411a5 | Richard Levitte | 24 April 2020, 08:08:42 UTC | Configurations/windows-makefile.tmpl: Fix template code for INSTALL_MODULES Fixes #11623 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11629) | 25 April 2020, 20:54:47 UTC |
| 47f387e | Dirk-Willem van Gulik | 21 April 2020, 21:06:38 UTC | Add support for unusal 'othername' subjectAltNames Increasingly certificates seem to have special things in the subjectAltName that have arbitrary strings in them. E.g. some (now) common in EU export certificates and, for a few years now, certificates issued to medical doctors (in for example the netherlands, the full spec is https://www.uziregister.nl/Media/Default/PDF/20200325%20CA%20model%20pasmodel%20certificaatprofielen%20v10_0.pdf, section 4.8, page 16 for an example of one country). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11599) | 25 April 2020, 15:52:30 UTC |
| a3ab4d6 | Pauli | 22 April 2020, 11:38:19 UTC | travis: remove GENERATE=yes from some non no-deprecated builds Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11607) | 25 April 2020, 11:39:55 UTC |
| 52698fb | Pauli | 22 April 2020, 10:01:30 UTC | travis: add GENERATE=yes no-makedepend to the ARM64 build. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11607) | 25 April 2020, 11:39:55 UTC |
| 54b47af | Pauli | 23 April 2020, 10:31:12 UTC | keymgmt: convert to use the params modification detection. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11601) | 25 April 2020, 08:46:32 UTC |
| 3873887 | Pauli | 23 April 2020, 10:23:48 UTC | params: change OSSL_PARAM_set_unmodified() to operate on a params array Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11601) | 25 April 2020, 08:46:32 UTC |
| 99ea4f0 | Pauli | 22 April 2020, 04:20:11 UTC | evp: convert existing code to use the new modified sentinel for params. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11601) | 25 April 2020, 08:46:01 UTC |
| 2baf2d8 | Pauli | 22 April 2020, 04:10:24 UTC | params: handle the modified sentinel. The param builder and the params from text helpers also need to be modified aware. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11601) | 25 April 2020, 08:46:01 UTC |
| 6a960a9 | Richard Levitte | 23 April 2020, 16:59:10 UTC | Configure: Allow quoted values in VERSION Fixes #11618 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11624) | 25 April 2020, 02:05:27 UTC |
| 8d6fc5f | Richard Levitte | 23 April 2020, 14:38:40 UTC | Fix dev/release-aux-openssl-announce-pre-release.tmpl $LABEL -> $label Removed link to release notes, as we don't produce them for master. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11617) | 25 April 2020, 02:02:10 UTC |
| 75e8e22 | Nikolay Morozov | 22 April 2020, 08:45:16 UTC | Code cleanup in X509v3 String Extentions Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11604) | 24 April 2020, 17:05:22 UTC |
| 01c1210 | Dr. David von Oheimb | 22 April 2020, 12:58:41 UTC | Clean up the use of ERR_print_errors() in apps.c and in four apps Also make sure that all error messages in apps.c consistently begin upper-case. Changed files: apps/lib/apps.c and apps/{req.c,s_client.c,s_server.c,x509.c} Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940) | 24 April 2020, 16:00:24 UTC |
| 3ee4e8c | David von Oheimb | 26 December 2017, 18:33:04 UTC | Remove a bad 'goto end' and a few superfluous ones in apps/lib/apps.c Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940) | 24 April 2020, 16:00:24 UTC |
| 51c833a | David von Oheimb | 22 December 2017, 18:50:17 UTC | Improve feedback on wrong format with new print_format_error() in apps/lib/opt.c Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940) | 24 April 2020, 16:00:24 UTC |
| 9d5aca6 | David von Oheimb | 15 December 2017, 19:50:37 UTC | Add function load_csr(file,format,desc) to apps/lib/apps.c Make use of new load_csr() in 'ca', 'req', and 'x509' app Add '-inform' and '-certform' option to 'ca' app Add 'desc' parameter to load_crl() function defined in apps/lib/apps.c Allow 'desc' parameter to be NULL (gives option to suppress error output) Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940) | 24 April 2020, 16:00:24 UTC |
| 852c2ed | Rich Salz | 19 December 2019, 22:30:24 UTC | In OpenSSL builds, declare STACK for datatypes ... ... and only *define* them in the source files that need them. Use DEFINE_OR_DECLARE which is set appropriately for internal builds and not non-deprecated builds. Deprecate stack-of-block Better documentation Move some ASN1 struct typedefs to types.h Update ParseC to handle this. Most of all, ParseC needed to be more consistent. The handlers are "recursive", in so far that they are called again and again until they terminate, which depends entirely on what the "massager" returns. There's a comment at the beginning of ParseC that explains how that works. {Richard Levtte} Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10669) | 24 April 2020, 14:42:46 UTC |
