aboutsummaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)AuthorFilesLines
2020-05-20Add OSSL_PROVIDER_do_all()Richard Levitte1-0/+3
This allows applications to iterate over all loaded providers. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11858)
2020-05-19Introducing option SSL_OP_IGNORE_UNEXPECTED_EOFDmitry Belyavskiy1-6/+1
Partially fixes #11209. Before OpenSSL 3.0 in case when peer does not send close_notify, the behaviour was to set SSL_ERROR_SYSCALL error with errno 0. This behaviour has changed. The SSL_OP_IGNORE_UNEXPECTED_EOF restores the old behaviour for compatibility's sake. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11735)
2020-05-19Use {module,install}-mac, not -checksumRich Salz1-2/+2
As the documentation points out, these fipsmodule.cnf fields are a MAC, not a digest or checksum. Rename them to be correct. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11369)
2020-05-19Add missing pragma weak declaration to lhash.hNorm Green1-0/+1
The missing symbol caused a linker failure on solaris x86_64. Fixes #11796 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11798)
2020-05-19deprecate EC precomputation functionalityBilly Brumley1-3/+3
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11851)
2020-05-19GOST-related objects changesDmitry Belyavskiy1-0/+4
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11442)
2020-05-19Constants for new GOST TLS 1.2 ciphersuitesDmitry Belyavskiy3-1/+9
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11442)
2020-05-19CORE: query for operations only once per provider (unless no_store is true)Richard Levitte2-0/+9
When a desired algorithm wasn't available, we didn't register anywhere that an attempt had been made, with the result that next time the same attempt was made, the whole process would be done again. To avoid this churn, we register a bit for each operation that has been queried in the libcrypto provider object, and test it before trying the same query and method construction loop again. If course, if the provider has told us not to cache, we don't register this bit. Fixes #11814 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11842)
2020-05-18Fix some places where X509_up_ref is usedBernd Edlinger1-1/+3
without error handling. This takes up the ball from #11278 without trying to solve everything at once. [extended tests] Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/11850)
2020-05-16deprecate EC_POINTs_mul functionBilly Brumley2-3/+5
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11807)
2020-05-16Maintain strict type discipline between the core and providersMatt Caswell4-28/+38
A provider could be linked against a different version of libcrypto than the version of libcrypto that loaded the provider. Different versions of libcrypto could define opaque types differently. It must never occur that a type created in one libcrypto is used directly by the other libcrypto. This will cause crashes. We can "cheat" for "built-in" providers that are part of libcrypto itself, because we know that the two libcrypto versions are the same - but not for other providers. To ensure this does not occur we use different types names for the handful of opaque types that are passed between the core and providers. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11758)
2020-05-15Clean up macro definitions of openssl_fdset() in apps.h and sockets.hDr. David von Oheimb1-2/+2
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4277)
2020-05-15Update copyright yearMatt Caswell8-8/+8
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11839)
2020-05-14EVP: Refactor the RSA-PSS key generation controls for providersRichard Levitte1-8/+4
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11710)
2020-05-14EVP: For SIGNATURE operations, pass the propquery earlyRichard Levitte1-5/+4
Instead of passing it with signature->digest_verify_init() and signature->digest_sign_init(), we pass it with signature->newctx(). This allows the digests that are indicated by RSA PSS parameters to have a useful propquery. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11710)
2020-05-14PROV & KEYMGMT: Add PSS-parameter support in the RSA KEYMGMT implementationRichard Levitte1-0/+1
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11710)
2020-05-14RSA: Add PSS-parameter processing in EVP_PKEY_ASN1_METHOD functionsRichard Levitte1-1/+1
The import and export functions are affected. We also refactor them to assign the RSA key type more carefully. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11710)
2020-05-14RSA: Add a less loaded PSS-parameter structureRichard Levitte2-3/+43
RSA_PSS_PARAMS carries with it a lot of baggage in form of X509_ALGOR and ASN1_INTEGER, which we would rather avoid in our providers. Therefore, we create a parallell structure - RSA_PSS_PARAMS_30 - that contains the same information, but uses numeric identities (*) and C integers (**). This makes it simpler to handle. Note that neither this structure nor its contents are passed between libcrypto and the providers. Instead, the numeric identities are translated to and from names, which are then passed over that boundary. For future considerations, we might consider dropping RSA_PSS_PARAMS entirely. For now, it's still reserved for EVP_PKEY_ASN1_METHOD code, which RSA_PSS_PARAMS_30 is (almost entirely) reserved for use in our providers. (*) We use NIDs in this case, because we already have them and because only algorithms that libcrypto knows about are permitted in PSS restrictions. We could use any number series we want, as long as we know for sure what they represent. (**) That's for saltlen and for trailerfield, which are never expect to surpass the set of numbers that fit in a regular 'int'. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11710)
2020-05-14RSA: Add rsa_schemes.c, to store scheme data and translator functionsRichard Levitte1-0/+4
The scheme currently added is OAEP-PSSDigestAlgorithms codified. The translator functions translate an EVP_MD into a NID, and a NID into a name, to support the creation and parsing of OSSL_PARAM items. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11710)
2020-05-14RSA: Extract much of the rsa_pkey_export_to() code to a separate functionRichard Levitte1-0/+2
The resulting function, rsa_todata(), is designed to be usable by providers as well. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11710)
2020-05-14RSA: Add RSA key typesRichard Levitte1-0/+18
The support of restricted RSA key types (OAEP and PSS) was lacking, or dependent on the presence of restriction parameters. For example, this means that even though an RSA-PSS key may have been generated, it may appear as a plain unrestricted RSA key if parameters weren't present (which is the case when default restriction parameters are used) To make it clearer what an RSA key is intended for, and avoid depending in an EVP_PKEY, we introduce RSA key types. This is done by reserving a section of the RSA flags (4 bits, which allows a total of 16 different types). This isn't terribly important for EVP_PKEY_ASN1_METHOD code, as that has access to the wrapping EVP_PKEY. This is very important for provider code, which has no access to the wrapping EVP_PKEY. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11710)
2020-05-13Rename OSSL_CMP_CTX_set1_clCert() to OSSL_CMP_CTX_set1_cert()Dr. David von Oheimb1-1/+1
Also update documentation and example code in openssl-cmp.pod.in Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11470)
2020-05-13Add -reqin_new_tid option to apps/cmp.c and OSSL_CMP_MSG_update_transactionID()Dr. David von Oheimb1-7/+10
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11470)
2020-05-13OSSL_STORE: Make it possible to attach an OSSL_STORE to an opened BIORichard Levitte2-4/+32
This capability existed internally, and is now made public. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11756)
2020-05-12CORE: Fix the signature of OSSL_provider_query_operation_fnRichard Levitte1-1/+1
For some reason, the 'no_cache' parameter was declare 'const', when it's in fact supposed to be modifiable. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11777)
2020-05-09Constify 'req' parameter of OSSL_HTTP_post_asn1()Dr. David von Oheimb1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11736)
2020-05-07SSL_OP_DISABLE_TLSEXT_CA_NAMES option implementationNikolay Morozov1-1/+2
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11709)
2020-05-07Remove legacy FIPS_mode functionsShane Lontis1-3/+0
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11680)
2020-05-07Add RSA SHA512 truncated digest supportShane Lontis1-0/+2
Partial Fix for #11648. Some additional work still needs to be done to support RSA-PSS mode. RSA legacy digests will be addressed in another PR. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11681)
2020-05-07Remove gen_get_params & gen_gettable_params from keygen operationShane Lontis2-8/+2
EVP_PKEY_CTX_gettable_params() was missing code for the keygen operation. After adding it it was noticed that it is probably not required for this type, so instead the gen_get_params and gen_gettable_params have been remnoved from the provider interface. gen_get_params was only implemented for ec to get the curve name. This seems redundant since normally you would set parameters into the keygen_init() and then generate a key. Normally you would expect to extract data from the key - not the object that we just set up to do the keygen. Added a simple settable and gettable test into a test that does keygen. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11683)
2020-05-06The synthesized OPENSSL_VERSION_NUMBER must be longTomas Mraz1-2/+2
(to keep API compatibility with older releases) Fixes #11716 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11732)
2020-05-05Strengthen X509_STORE_CTX_print_verify_cb() to print expected host etc.Dr. David von Oheimb2-0/+4
Add X509_VERIFY_PARAM_get0_host(), X509_VERIFY_PARAM_get0_email(), and X509_VERIFY_PARAM_get1_ip_asc() to support this, as well as the internal helper function ipaddr_to_asc(), which is used also for simplifying other IP address output functions. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11693)
2020-05-04Add the library ctx into an ECX_KEYMatt Caswell1-1/+2
At various points we need to be able to retrieve the current library context so we store it in the ECX_KEY structure. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635)
2020-05-04Add the ability to ECX to import keys with only the private keyMatt Caswell1-0/+1
ECX keys can very easily crete the public key from the private key. Therefore when we import ecx keys it is sufficent to just have the private key. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635)
2020-05-04Make EVP_new_raw_[private|public]_key provider awareMatt Caswell1-0/+10
We also introduce variants which are OPENSSL_CTX aware Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11635)
2020-05-03Fix reason code clashRichard Levitte1-1/+1
EVP_R_NULL_MAC_PKEY_CTX vs EVP_R_SET_DEFAULT_PROPERTY_FAILURE Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11708)
2020-05-02Add default property API's to enable and test for fipsShane Lontis3-0/+9
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11239)
2020-05-01Add SSL_new_session_ticket() APIBenjamin Kaduk1-0/+1
This API requests that the TLS stack generate a (TLS 1.3) NewSessionTicket message the next time it is safe to do so (i.e., we do not have other data pending write, which could be mid-record). For efficiency, defer actually generating/writing the ticket until there is other data to write, to avoid producing server-to-client traffic when not needed. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11416)
2020-04-30coverity 1462549 Dereference before null checkPauli1-0/+2
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11651)
2020-04-30Undeprecate DH, DSA and RSA _bits() functions.Pauli3-3/+3
These were deemed information and useful and that they should not be deprecated. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11669)
2020-04-29Amend references to "OpenSSL license"Shourya Shukla1-1/+1
A small number of files contain references to the "OpenSSL license" which has been deprecated and replaced by the "Apache License 2.0". Amend the occurences. Fixes #11649 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11663)
2020-04-29include/openssl/ts.h: clean away a misplaced EVP_MD stack definitionRichard Levitte1-2/+0
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11655)
2020-04-29include/openssl/x509v3.h: restore previous stack definition arrangementRichard Levitte11-62/+74
It turned out that configuration options may affect the definition and use of diverse stacks and how they relate to the underlying types. For example, the configuration option 'no-rfc3779' results in a build error around STACK_OF(IPAddressFamily) and related stacks. Previously, STACK_OF definitions were located near the definition of the underlying type, which are also affected by configuration options, which made this easier to maintain. We relocate the new stack definitions back to those locations for that reason. We apply the same type of relocation in other header files as well, following the general rule that it's better to use DEFINE_OR_DECLARE_STACK_OF after the type it defines a stack for has been defined. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11655)
2020-04-28Rename FIPS_MODE to FIPS_MODULERichard Levitte3-10/+10
This macro is used to determine if certain pieces of code should become part of the FIPS module or not. The old name was confusing. Fixes #11538 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11539)
2020-04-27Fix type cast in SSL_CTX_set1_groups macroArne Schwabe1-1/+1
The macro casts the glist parameter to char* instead of (int *) like the documentation of the function suggest. Also the function tls1_set_groups that is called from SSL_CTX_ctrl takes an int * argument. This looks like a copy&paste error from SSL_CTX_set1_groups_list function. CLA: trivial Signed-off-by: Arne Schwabe <arne@rfc2549.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11614)
2020-04-25params: change OSSL_PARAM_set_unmodified() to operate on a params arrayPauli1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11601)
2020-04-24In OpenSSL builds, declare STACK for datatypes ...Rich Salz22-121/+125
... and only *define* them in the source files that need them. Use DEFINE_OR_DECLARE which is set appropriately for internal builds and not non-deprecated builds. Deprecate stack-of-block Better documentation Move some ASN1 struct typedefs to types.h Update ParseC to handle this. Most of all, ParseC needed to be more consistent. The handlers are "recursive", in so far that they are called again and again until they terminate, which depends entirely on what the "massager" returns. There's a comment at the beginning of ParseC that explains how that works. {Richard Levtte} Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10669)
2020-04-23Update copyright yearMatt Caswell95-95/+95
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11616)
2020-04-23EVP: add internal evp_keymgmt_util_get_deflt_digest_name() and use itRichard Levitte1-1/+3
evp_keymgmt_util_get_deflt_digest_name() is a refactor of the provider side key part of EVP_PKEY_get_default_digest_name(), that takes EVP_KEYMGMT and provider keydata pointers instead of an EVP_PKEY pointer. We also ensure that it uses SN_undef as the default name if the provider implementation gave us an empty string, since this is what EVP_PKEY_get_default_digest_name() responds when getting the digest name via a EVP_PKEY_ASN1_METHOD ctrl call that returns NID_undef. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11576)
2020-04-22params: add functionality to test if an OSSL_PARAM has been set.Pauli1-1/+6
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11588)
generated by cgit v1.1 at 2024-07-13 06:41:38 +0000