| 70411a5 | Richard Levitte | 24 April 2020, 08:08:42 UTC | Configurations/windows-makefile.tmpl: Fix template code for INSTALL_MODULES Fixes #11623 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11629) | 25 April 2020, 20:54:47 UTC |
| 47f387e | Dirk-Willem van Gulik | 21 April 2020, 21:06:38 UTC | Add support for unusal 'othername' subjectAltNames Increasingly certificates seem to have special things in the subjectAltName that have arbitrary strings in them. E.g. some (now) common in EU export certificates and, for a few years now, certificates issued to medical doctors (in for example the netherlands, the full spec is https://www.uziregister.nl/Media/Default/PDF/20200325%20CA%20model%20pasmodel%20certificaatprofielen%20v10_0.pdf, section 4.8, page 16 for an example of one country). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11599) | 25 April 2020, 15:52:30 UTC |
| a3ab4d6 | Pauli | 22 April 2020, 11:38:19 UTC | travis: remove GENERATE=yes from some non no-deprecated builds Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11607) | 25 April 2020, 11:39:55 UTC |
| 52698fb | Pauli | 22 April 2020, 10:01:30 UTC | travis: add GENERATE=yes no-makedepend to the ARM64 build. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11607) | 25 April 2020, 11:39:55 UTC |
| 54b47af | Pauli | 23 April 2020, 10:31:12 UTC | keymgmt: convert to use the params modification detection. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11601) | 25 April 2020, 08:46:32 UTC |
| 3873887 | Pauli | 23 April 2020, 10:23:48 UTC | params: change OSSL_PARAM_set_unmodified() to operate on a params array Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11601) | 25 April 2020, 08:46:32 UTC |
| 99ea4f0 | Pauli | 22 April 2020, 04:20:11 UTC | evp: convert existing code to use the new modified sentinel for params. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11601) | 25 April 2020, 08:46:01 UTC |
| 2baf2d8 | Pauli | 22 April 2020, 04:10:24 UTC | params: handle the modified sentinel. The param builder and the params from text helpers also need to be modified aware. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11601) | 25 April 2020, 08:46:01 UTC |
| 6a960a9 | Richard Levitte | 23 April 2020, 16:59:10 UTC | Configure: Allow quoted values in VERSION Fixes #11618 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11624) | 25 April 2020, 02:05:27 UTC |
| 8d6fc5f | Richard Levitte | 23 April 2020, 14:38:40 UTC | Fix dev/release-aux-openssl-announce-pre-release.tmpl $LABEL -> $label Removed link to release notes, as we don't produce them for master. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11617) | 25 April 2020, 02:02:10 UTC |
| 75e8e22 | Nikolay Morozov | 22 April 2020, 08:45:16 UTC | Code cleanup in X509v3 String Extentions Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11604) | 24 April 2020, 17:05:22 UTC |
| 01c1210 | Dr. David von Oheimb | 22 April 2020, 12:58:41 UTC | Clean up the use of ERR_print_errors() in apps.c and in four apps Also make sure that all error messages in apps.c consistently begin upper-case. Changed files: apps/lib/apps.c and apps/{req.c,s_client.c,s_server.c,x509.c} Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940) | 24 April 2020, 16:00:24 UTC |
| 3ee4e8c | David von Oheimb | 26 December 2017, 18:33:04 UTC | Remove a bad 'goto end' and a few superfluous ones in apps/lib/apps.c Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940) | 24 April 2020, 16:00:24 UTC |
| 51c833a | David von Oheimb | 22 December 2017, 18:50:17 UTC | Improve feedback on wrong format with new print_format_error() in apps/lib/opt.c Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940) | 24 April 2020, 16:00:24 UTC |
| 9d5aca6 | David von Oheimb | 15 December 2017, 19:50:37 UTC | Add function load_csr(file,format,desc) to apps/lib/apps.c Make use of new load_csr() in 'ca', 'req', and 'x509' app Add '-inform' and '-certform' option to 'ca' app Add 'desc' parameter to load_crl() function defined in apps/lib/apps.c Allow 'desc' parameter to be NULL (gives option to suppress error output) Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940) | 24 April 2020, 16:00:24 UTC |
| 852c2ed | Rich Salz | 19 December 2019, 22:30:24 UTC | In OpenSSL builds, declare STACK for datatypes ... ... and only *define* them in the source files that need them. Use DEFINE_OR_DECLARE which is set appropriately for internal builds and not non-deprecated builds. Deprecate stack-of-block Better documentation Move some ASN1 struct typedefs to types.h Update ParseC to handle this. Most of all, ParseC needed to be more consistent. The handlers are "recursive", in so far that they are called again and again until they terminate, which depends entirely on what the "massager" returns. There's a comment at the beginning of ParseC that explains how that works. {Richard Levtte} Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10669) | 24 April 2020, 14:42:46 UTC |
| 4692e98 | Nicola Tuveri | 21 April 2020, 15:34:17 UTC | Fix typo from #10631 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11595) | 24 April 2020, 14:37:31 UTC |
| 2b9bafe | Rich Salz | 28 March 2020, 16:51:05 UTC | Rewrite man5/config.pod and related conf code cleanup The manpage is basically rewritten. Use consistent name/value terminology. Use consistent phraseology to refer to section pointers and lists of section pointers. Add more cross-references. Also found a bunch of trivial style things in conf_api.c while investigating how config works. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11431) | 24 April 2020, 11:29:16 UTC |
| c16aec5 | Rich Salz | 28 March 2020, 16:50:49 UTC | SSL_CTX_config.pod: Remove needless "NOTE" heading Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11431) | 24 April 2020, 11:28:50 UTC |
| 713fc10 | Rich Salz | 21 April 2020, 17:55:12 UTC | Rename fipsinstall.cnf->fipsmodule.cnf Introduced by rebasing Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11177) | 24 April 2020, 11:19:16 UTC |
| 1cd2c1f | Rich Salz | 25 February 2020, 21:27:24 UTC | Update some nits around the FIPS module - Changed the generated FIPS signature file to be "fipsmodule.conf" since it contains information about the FIPS module/file. - Add -q option to fipsinstall command, to stop chatty verbose status messages. - Document env var OPENSSL_CONF_INCLUDE Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11177) | 24 April 2020, 11:19:16 UTC |
| d38997a | Matt Caswell | 23 April 2020, 13:10:38 UTC | Prepare for 3.0 alpha 2 Reviewed-by: Richard Levitte <levitte@openssl.org> | 23 April 2020, 13:10:38 UTC |
| 05feb0a | Matt Caswell | 23 April 2020, 13:08:36 UTC | Prepare for release of 3.0 alpha 1 Reviewed-by: Richard Levitte <levitte@openssl.org> | 23 April 2020, 13:08:36 UTC |
| 33388b4 | Matt Caswell | 23 April 2020, 12:55:52 UTC | Update copyright year Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11616) | 23 April 2020, 12:55:52 UTC |
| e7774c2 | Dr. David von Oheimb | 22 April 2020, 11:12:45 UTC | Add info on the CMP implementation and HTTP client to NEWS.md and CHANGES.md Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11608) | 23 April 2020, 12:15:16 UTC |
| 32a5dc9 | Matt Caswell | 23 April 2020, 10:50:20 UTC | Fix a typo in the makefile templates The fips.so and legacy.so providers were not being installed because of a typo in the makefile templates. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11615) | 23 April 2020, 12:12:27 UTC |
| 486d897 | Matt Caswell | 21 April 2020, 14:13:30 UTC | Mention the 3.0 wiki page in the release announcement emails Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11593) | 23 April 2020, 10:28:37 UTC |
| aa45c4a | Richard Levitte | 20 April 2020, 19:35:03 UTC | PROV: Ensure that EC keys have a default digest Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11576) | 23 April 2020, 09:44:37 UTC |
| 1a7328c | Richard Levitte | 20 April 2020, 07:29:47 UTC | PROV: Ensure that ED25519 & ED448 keys have a mandatory digest This adds handling of the parameter "mandatory-digest" and responds with an empty string, meaning that no digest may be used. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11576) | 23 April 2020, 09:44:37 UTC |
| 4c627d8 | Richard Levitte | 20 April 2020, 07:29:16 UTC | EVP: Fix EVP_Digest{Sign,Verify}Init() to handle no default digest EVP_DigestSignInit() and EVP_DigestVerifyInit() would detect if there is no default digest when using legacy (EVP_PKEY_ASN1_METHOD) implementations. However, it doesn't do that when provider side keys are used. Furthermore, because EVP_PKEY_get_default_digest_name() was used in the portion of the code that uses the provider implementation, the EVP_PKEY_ASN1_METHOD would be used if the key has one attached. This is now changed to use evp_keymgmt_util_get_deflt_digest_name() instead. Finally, we make sure to detect if the provider implementation supports the digest name parameters (default or mandatory), and returns with error if not. This is what the legacy portion of the code does. Fixes #11571 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11576) | 23 April 2020, 09:44:37 UTC |
| 3b924da | Richard Levitte | 20 April 2020, 07:14:59 UTC | EVP: add internal evp_keymgmt_util_get_deflt_digest_name() and use it evp_keymgmt_util_get_deflt_digest_name() is a refactor of the provider side key part of EVP_PKEY_get_default_digest_name(), that takes EVP_KEYMGMT and provider keydata pointers instead of an EVP_PKEY pointer. We also ensure that it uses SN_undef as the default name if the provider implementation gave us an empty string, since this is what EVP_PKEY_get_default_digest_name() responds when getting the digest name via a EVP_PKEY_ASN1_METHOD ctrl call that returns NID_undef. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11576) | 23 April 2020, 09:44:37 UTC |
| 916b1f8 | Pauli | 22 April 2020, 07:08:30 UTC | FIPS: remove algorithms that are not being validated. Several MACs and one KDF are included in the FIPS provider with the property "fips=yes" set but are not listed as being part of the OpenSSL validation. This removes them from the FIPS provider. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11602) | 23 April 2020, 09:30:23 UTC |
| 555ed96 | Matt Caswell | 20 April 2020, 14:04:35 UTC | Fix no-err This fixes an assertion failure that can occur in the CMP code in the event of a no-err build. The "improve_location_name" function assumed that the fallback argument was always populated with something. However in a no-err build this is not the case. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11584) | 22 April 2020, 09:41:58 UTC |
| 9be92be | Matt Caswell | 20 April 2020, 13:18:36 UTC | Skip a no-dsa test in the fipsinstall test In a similar way to the previous commit we also skip a fipsinstall test if DSA has been disabled. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11582) | 22 April 2020, 09:32:47 UTC |
| a7a7643 | Matt Caswell | 20 April 2020, 13:05:47 UTC | Skip a test in a no-dh build One of the sub-tests in the fipsinstall test corrupts a DH test to confirm that fipsinstall fails. However that is never noticed in a no-dh build - so we just skip that test in a no-dh build. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11582) | 22 April 2020, 09:32:47 UTC |
| a033c9a | Matt Caswell | 20 April 2020, 13:05:23 UTC | Fix some build failures with no-dh Add some missing OPENSSL_NO_DH guards. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11582) | 22 April 2020, 09:32:47 UTC |
| 0345f9e | Matt Caswell | 20 April 2020, 11:27:59 UTC | Fix no-ec This was missed by Travis because, although it has a no-ec build, the test that failed only runs in a debug build. The Travis job with no-ec is not a debug build and so the test was skipped. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11581) | 22 April 2020, 09:23:32 UTC |
| 75dbc66 | Matt Caswell | 20 April 2020, 18:39:32 UTC | Add a link to wiki 3.0 upgrade notes Provide a link to the 3.0 upgrade notes so that users of the alpha/beta/ final releases can understand the differences between this version and previous versions. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11587) | 22 April 2020, 09:21:56 UTC |
| fa555aa | Nikolay Morozov | 18 April 2020, 20:59:45 UTC | GOST2012 TLS Supported Groups Identifiers Support For GOST2012-GOST8912-GOST8912 IANA introduce TLS Supported Groups Identifiers https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11568) | 22 April 2020, 08:22:00 UTC |
| 28308a2 | Pauli | 20 April 2020, 02:43:49 UTC | evptest: set the DESX provider to be the legacy provider. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11573) | 22 April 2020, 03:58:25 UTC |
| 8d5fb64 | Pauli | 21 April 2020, 00:49:19 UTC | params: add functionality to test if an OSSL_PARAM has been set. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11588) | 22 April 2020, 03:56:44 UTC |
| 07caec8 | Billy Brumley | 12 April 2020, 15:17:19 UTC | [crypto/ec] deprecate Jprojective_coordinates_GFp functions Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11527) | 21 April 2020, 23:06:50 UTC |
| c72e593 | Dirk-Willem van Gulik | 10 January 2020, 17:35:49 UTC | Add setter equivalents to X509_REQ_get0_signature Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10563) | 21 April 2020, 14:52:50 UTC |
| 1269a9a | Matt Caswell | 20 April 2020, 13:32:21 UTC | Fix no-deprecated tests where the GOST engine is present The GOST test only runs if it detects that the GOST engine is present. This is the case for the run-checker environment. The GOST engine uses some deprecated functions, so we disable that test in a no-deprecated build. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11583) | 21 April 2020, 13:58:52 UTC |
| 2d3e6d4 | Matt Caswell | 20 April 2020, 10:23:34 UTC | Fix no-des Disable a recently added CMS test in the case of no-des. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/11578) | 21 April 2020, 13:52:08 UTC |
| eb75980 | Matt Caswell | 20 April 2020, 16:06:40 UTC | Fix an ssl_test_old test failure In builds where SSLv3 is enabled ssl_test_old was failing. We need to make sure we disable SSLv3 related tests when using the FIPS provider. [extended tests] Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11586) | 21 April 2020, 13:50:48 UTC |
| 62ba834 | Matt Caswell | 20 April 2020, 16:04:57 UTC | Fix test_ssl_new test failure A couple of fetches of the MD5 and SHA1 digests were not using the libctx in libssl and causing test_ssl_new to fail in travis. This only occurs on builds with SSLv3 enabled (its disabled by default). [extended tests] Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11586) | 21 April 2020, 13:50:48 UTC |
| 1e78a50 | Richard Levitte | 21 April 2020, 10:24:44 UTC | Revert "TEST: make and use a fipsinstall script" Unfortunately, this won't work on MacOS because of system integrity measures on that platform, which clears DYLD_LIBRARY_PATH before starting a sub-process executable. Ref: https://developer.apple.com/library/archive/documentation/Security/Conceptual/System_Integrity_Protection_Guide/RuntimeProtections/RuntimeProtections.html This reverts commit ae6b654b669638882a6ddce012ff55adc7cf6a82. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11592) | 21 April 2020, 13:43:57 UTC |
| a87f3fe | Benjamin Kaduk | 10 April 2020, 19:27:28 UTC | Fix NULL dereference in SSL_check_chain() for TLS 1.3 In the tls1_check_sig_alg() helper function, we loop through the list of "signature_algorithms_cert" values received from the client and attempt to look up each one in turn in our internal table that maps wire codepoint to string-form name, digest and/or signature NID, etc., in order to compare the signature scheme from the peer's list against what is used to sign the certificates in the certificate chain we're checking. Unfortunately, when the peer sends a value that we don't support, the lookup returns NULL, but we unconditionally dereference the lookup result for the comparison, leading to an application crash triggerable by an unauthenticated client. Since we will not be able to say anything about algorithms we don't recognize, treat NULL return from lookup as "does not match". We currently only apply the "signature_algorithm_cert" checks on TLS 1.3 connections, so previous TLS versions are unaffected. SSL_check_chain() is not called directly from libssl, but may be used by the application inside a callback (e.g., client_hello or cert callback) to verify that a candidate certificate chain will be acceptable to the client. CVE-2020-1967 Reviewed-by: Matt Caswell <matt@openssl.org> | 21 April 2020, 12:32:35 UTC |
| 3656c08 | Benjamin Kaduk | 10 April 2020, 19:27:28 UTC | Add test for CVE-2020-1967 Add to test_sslsigalgs a TLSProxy test that injects a "signature_algorithms_cert" extension that contains an unallocated codepoint. The test currently fails, since s_server segfaults instead of ignoring the unrecognized value. Since "signature_algorithms" and "signature_algorithms_cert" are very similar, also add the analogous test for "signature_algorithms". Reviewed-by: Matt Caswell <matt@openssl.org> | 21 April 2020, 12:32:35 UTC |
| b0b0b6a | Richard Levitte | 06 April 2020, 21:58:24 UTC | Developer scripts: Release script The old release script that exists in another repository has aged, and risks becoming messy beyond maintainability if it's made to deal with multiple OpenSSL version schemes. A solution, which has been seen in other projects, is to have the release script as part of the versioned source tree, and ensure it's adapted for the ongoing version scheme in that source tree. This introduces dev/, a directory of OpenSSL developer "stuff". We may expand it with other practical scripts to easy development setup and other similar things that developers may need. For now, it's the release script dev/release.sh, with auxilliary files in dev/release-aux/. The script is self describing, the manual is available by running the command `./dev/release.sh --manual`. The dev/ directory shall never appear in a source distribution. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11516) | 21 April 2020, 08:11:41 UTC |
| 78b4aba | Dr. David von Oheimb | 20 April 2020, 15:19:50 UTC | Fix test_cmp_vfy failures with FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION [extended tests] Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11585) | 21 April 2020, 05:58:55 UTC |
| 7a92e80 | Pauli | 19 April 2020, 23:33:51 UTC | gendsa: remove unnecessary OPENSSL_SUPPRESS_DEPRECATED definition Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/11570) | 21 April 2020, 03:25:23 UTC |
| be9d82b | Matt Caswell | 13 April 2020, 13:32:51 UTC | Teach ssl_test_old to use the FIPS provider for its tests Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11534) | 20 April 2020, 10:40:18 UTC |
| 63215d0 | Matt Caswell | 10 April 2020, 13:31:19 UTC | Teach ssl_test_old how to run tests in a non-default library context Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11534) | 20 April 2020, 10:39:08 UTC |
| 73d391a | Matt Caswell | 18 April 2020, 10:54:23 UTC | Use a fetched MD if appropriate in ssl3_cbc_digest_record HMACs used via the legacy EVP_DigestSign interface are strange in that they use legacy codepath's which eventually (under the covers) transform the operation into a new style EVP_MAC. This can mean the digest in use can be a legacy one, so we need to be careful with any digest we extract from the ctx. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11511) | 20 April 2020, 10:29:31 UTC |
| 682bc86 | Matt Caswell | 07 April 2020, 16:03:19 UTC | Teach ssl_test_new how to test the FIPS module We load the FIPS module and make sure it is configured before running the ssl_test_new tests. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11511) | 20 April 2020, 10:29:17 UTC |
| ab5a02f | Matt Caswell | 07 April 2020, 15:22:49 UTC | Teach ssl_test_new to have different tests for different loaded providers We now run the tests twice: Once with no specific providers loaded and just using the default libctx, and a second time with a non-default libctx and the default provider. In the second run we disable tests which use a PSS cert/key because we don't yet have support for that. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11511) | 20 April 2020, 10:25:56 UTC |
| fea4e2b | Matt Caswell | 03 April 2020, 14:40:00 UTC | Run ssl_test_new with a non-default library context We also prepare the way for a future commit to run ssl_test_new with just the FIPS provider loaded. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11511) | 20 April 2020, 10:25:56 UTC |
| 0aa87e8 | Dr. David von Oheimb | 07 March 2020, 10:51:42 UTC | Update comment on crls_http_cb() as it does support non-blocking I/O since #10667 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11273) | 20 April 2020, 09:34:02 UTC |
| 2b264ae | Dr. David von Oheimb | 06 March 2020, 20:46:33 UTC | Fix descriptions of credentials and verification options for various apps fix doc of s_client and s_server credentials and verification options fix doc of verification options also for s_time, x509, crl, req, ts, and verify correcting and extending texts regarding untrusted and trusted certs, making the order of options in the docs and help texts more consistent, etc. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11273) | 20 April 2020, 09:33:53 UTC |
| b418980 | Dr. Matthias St. Pierre | 16 April 2020, 17:10:14 UTC | Swap parameters of evp_method_id() The order of the function's parameters `name_id` and `operation_id` was reverted compared to their order of appearance in the comments and assertions. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11542) | 20 April 2020, 05:30:25 UTC |
| 64f849f | Dr. Matthias St. Pierre | 13 April 2020, 22:12:48 UTC | Fix an assertion (and a comment) of evp_method_id() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11542) | 20 April 2020, 05:30:25 UTC |
| 738ee18 | Shane Lontis | 20 April 2020, 01:07:38 UTC | Fix DH_get_nid() so that it does not cache values. DH_set0_pqg() is now responsible for caching the nid, q and length. DH with or without named safe prime groups now default to using the maximum private key length (BN_num_bits(q) - 1) when generating a DH private key. The code is now shared between fips and non fips mode for DH key generation. The OSSL_PKEY_PARAM_DH_PRIV_LEN parameter can be used during keygen to override the maximum private key length to be in the range (2 * strength ... bits(q) - 1). Where the strength depends on the length of p. Added q = (p - 1) / 2 safe prime BIGNUMS so that the code is data driven (To simplify adding new names). The BIGNUMS were code generated. Fix error in documented return value for DH_get_nid Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11562) | 20 April 2020, 01:07:38 UTC |
| 9e537cd | Shane Lontis | 16 April 2020, 02:07:26 UTC | DOC: Extend EVP_PKEY-DSA(7) / EVP_PKEY_DH(7) with FFC information Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11546) | 19 April 2020, 22:56:05 UTC |
| 33df1cf | Richard Levitte | 14 April 2020, 17:06:12 UTC | DOC: Refactor provider-keymgmt(7) to give the keytypes their own pages Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11546) | 19 April 2020, 22:56:05 UTC |
| 4114964 | Richard Levitte | 17 April 2020, 13:38:45 UTC | Build files: add module installation targets We only installed engines, now we also install other modules. Fixes #11559 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11566) | 19 April 2020, 21:36:51 UTC |
| ae6b654 | Richard Levitte | 18 April 2020, 10:14:41 UTC | TEST: make and use a fipsinstall script We have copies of the exact same fipsinstall call in several test recipes. This refactors those calls into a single simple script. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11565) | 19 April 2020, 21:34:05 UTC |
| c0bfc47 | Matt Caswell | 10 April 2020, 15:32:16 UTC | Use the libctx for all EVP_PKEY_CTX operations There were a few places where we were not passing through the libctx when constructing and EVP_PKEY_CTX. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11508) | 19 April 2020, 13:40:55 UTC |
| 4f6c704 | Matt Caswell | 21 March 2020, 00:39:27 UTC | Re-enable FIPS testing in sslapitest.c Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11508) | 19 April 2020, 13:40:55 UTC |
| 5e30f2f | Matt Caswell | 18 March 2020, 17:17:37 UTC | Use a non-default libctx in sslapitest We also don't load the default provider into the default libctx to make sure there is no accidental "leakage". Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11508) | 19 April 2020, 13:40:55 UTC |
| 09ec5e6 | Pauli | 19 April 2020, 00:36:01 UTC | dhparam: white space cleaning Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:40 UTC |
| 61b2afb | Pauli | 17 April 2020, 11:50:50 UTC | apps: undeprecate the conditioned out apps Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:39 UTC |
| 19d9be0 | Pauli | 05 March 2020, 00:06:29 UTC | openssl: include the version a command was deprecated in the output text. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:39 UTC |
| f84fe4f | Pauli | 03 March 2020, 07:40:00 UTC | apps: reinstate deprecated commands but using PKEY APIs Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:39 UTC |
| 7539cb7 | Pauli | 03 March 2020, 01:01:26 UTC | dsaparam: update command line app to use EVP calls Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:39 UTC |
| b304f85 | Pauli | 12 March 2020, 23:06:04 UTC | CHANGES: note which command line utilities are marked for deprecation but still available. Some of the utilities are much easier to use than their pkey alternatives. These have been modified to use the PKEY APIs but still note that they are deprecated. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:39 UTC |
| 769cfc3 | Pauli | 10 March 2020, 05:10:37 UTC | Undeprecate DH_get_length() and DH_set_length() functions Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:39 UTC |
| dddbbc6 | Pauli | 10 March 2020, 05:09:18 UTC | gendsa: update command line app to use EVP calls Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:39 UTC |
| 8f7e1f6 | Pauli | 10 March 2020, 05:08:05 UTC | genrsa: update command line app to use EVP calls Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:39 UTC |
| 99a7c3a | Pauli | 05 March 2020, 00:06:29 UTC | openssl: include the version a command was deprecated in the output text. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:39 UTC |
| 188dd86 | Pauli | 03 March 2020, 07:40:00 UTC | apps: reinstate deprecated commands but using PKEY APIs Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:38 UTC |
| ccefc34 | Pauli | 03 March 2020, 07:38:39 UTC | dhparam: update command line app to use EVP calls Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:37:38 UTC |
| b0cfe52 | Pauli | 03 March 2020, 01:03:47 UTC | tests: reinstate tests for deprecated but non-removed functionality Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:36:35 UTC |
| cd3572a | Pauli | 03 March 2020, 01:01:26 UTC | dsaparam: update command line app to use EVP calls Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:36:35 UTC |
| 54affb7 | Pauli | 02 March 2020, 04:30:36 UTC | rsa: update command line app to use EVP calls Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:36:35 UTC |
| b940349 | Pauli | 02 March 2020, 04:30:26 UTC | dsa: update command line app to use EVP calls Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225) | 19 April 2020, 00:36:35 UTC |
| e0331eb | Dr. David von Oheimb | 08 April 2020, 11:39:15 UTC | Prevent crash in X509_NAME_cmp() etc. when cert has no issuer or no serialNumber Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386) | 18 April 2020, 17:54:17 UTC |
| 753283c | Dr. David von Oheimb | 17 April 2020, 11:34:11 UTC | Add CMP error reason 'missing reference cert' Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386) | 18 April 2020, 17:54:17 UTC |
| e599d0a | Dr. David von Oheimb | 24 March 2020, 09:33:16 UTC | Add CMP fuzzing to fuzz/cmp.c, including a couple of helpers in crypto/cmp/ Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386) | 18 April 2020, 17:54:17 UTC |
| a81151b | Dr. David von Oheimb | 01 April 2020, 06:51:31 UTC | Add a couple of hints to fuzz/README.md Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386) | 18 April 2020, 17:54:17 UTC |
| 642f60d | Dr. David von Oheimb | 23 March 2020, 13:42:34 UTC | Rename CMP_PROTECTEDPART to OSSL_CMP_PROTECTEDPART for consistency Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386) | 18 April 2020, 17:54:17 UTC |
| 7a41760 | Nikolay Morozov | 16 April 2020, 15:55:36 UTC | GOST2012 TLS ClientCertificateType Identifiers support For GOST2012-GOST8912-GOST8912 IANA introduce ClientCertificateType Identifiers https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-2 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11558) | 18 April 2020, 10:32:49 UTC |
| ccb47db | Richard Levitte | 06 March 2020, 13:55:49 UTC | DOC: Extend the description of EVP_PKEY_CTX_new_from_name() This adds text the should lead the user to documentation on different KEYMGMT implementations. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11220) | 18 April 2020, 09:35:56 UTC |
| 476de2e | Richard Levitte | 02 March 2020, 13:39:30 UTC | DOC: Add more description of EVP_PKEY_fromdata(), and examples Fixes #11131 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11220) | 18 April 2020, 09:35:56 UTC |
| 031c9bd | 张盛豪 | 16 April 2020, 14:34:24 UTC | apps/speed: fix invalid final report when run SM2 benchmarks in parallel Fixed #11523 CLA: trivial Signed-off-by: 张盛豪 <zhangshenghao1995@163.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/11557) | 18 April 2020, 03:47:50 UTC |
| ad16671 | Dmitry Belyavskiy | 30 March 2020, 11:29:10 UTC | GOST cipher names adjustment The erroneously introduced names grasshopper-* replaced with kuznyechik-* according to official algorithm name translation. Too long symbolic names replaced with human-enterable ones. Also the mechanism of deprecating names in objects.txt is implemented Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11440) | 17 April 2020, 13:21:51 UTC |
| 301ea19 | Richard Levitte | 16 April 2020, 07:49:47 UTC | INSTALL: document 'no-ui-console' rather than 'no-ui' The UI interface itself is never disabled, but the console backend may be. 'no-ui' is a deprecated backward compatibility alias for 'no-ui-console'. Fixes #11551 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11553) | 17 April 2020, 11:36:18 UTC |
| 629c72d | Matt Caswell | 10 April 2020, 17:28:24 UTC | When calling the import_to function pass the libctx too Previously import_to just took an EVP_PKEY as the argument. However we need to some additional context data as well - specifically the libctx. Therefore we pass an EVP_PKEY_CTX instead to hold the combination of both of these things. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11536) | 17 April 2020, 11:26:56 UTC |
| 7da7b27 | Kochise | 16 March 2020, 19:04:04 UTC | Windows: Add type casting in CRYPTO_atomic_add to remove warning CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11337) | 17 April 2020, 11:21:13 UTC |
