aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2024-03-22tcl_tests: ca.try: Ignore openssl crl exit status for 'corrupted CRL' testHEADmasterVitaly Chikunov1-2/+1
Older `openssl crl` exits with 0 in regard to verify no matter actual verify status, newer `openssl crl` could exit with 1 on verify failure. Make the test backward-compatible comparing only an output. Fixes: https://github.com/gost-engine/engine/issues/452 Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2024-03-22tcl_tests: Introduce new exitStatus -1 to ignore exit codesVitaly Chikunov1-1/+2
It's proposed[1] that crl and req change exit code making it unreliable for some commands. Allow tests to ignore exit codes by specifying expected exit code `-1`. This will also make such tests to always use regexp match mode. Also, slightly fix the logic of applying regexp. Commentary says test _parameter_ (`exitStatus`) 1 is used to trigger regexp matching but in fact actual command exit code (`status`) 1 is used for that. This change did not cause any test result difference. Link: https://github.com/openssl/openssl/pull/23773 Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2023-11-17Big-Endian platforms magma-mgm fixv3.0.3Dmitry Belyavskiy1-1/+4
2023-07-28Adjust CA test according to new wordingv3.0.2Dmitry Belyavskiy1-3/+3
2023-06-15Fix gcc13 error: writing 1 byte into a region of size 0Vitaly Chikunov1-2/+8
gcc-13 thinks `bl` can take negative value (when returned from EVP_CIPHER_CTX_block_size). Do simple sanity checking to workaround this. Also, add error propagation up to EVP_DigestFinal_ex, so this sanity checking is not in vain. Error message: In function 'make_kn', inlined from 'CMAC_ACPKM_Final' at /builddir/build/BUILD/engine-3.0.0/gost_omac_acpkm.c:274:5, inlined from 'omac_acpkm_imit_final' at /builddir/build/BUILD/engine-3.0.0/gost_omac_acpkm.c:354:5: /builddir/build/BUILD/engine-3.0.0/gost_omac_acpkm.c:55:20: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=] 55 | k1[bl - 1] ^= bl == 16 ? 0x87 : 0x1b; | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ /builddir/build/BUILD/engine-3.0.0/gost_omac_acpkm.c: In function 'omac_acpkm_imit_final': /builddir/build/BUILD/engine-3.0.0/gost_omac_acpkm.c:260:24: note: at offset [-2147483649, -1] into destination object 'k2' of size 32 260 | unsigned char *k1, k2[EVP_MAX_BLOCK_LENGTH]; | ^~ Fixes: https://github.com/gost-engine/engine/issues/436 Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2023-01-05Correct CMake files installation pathCraig Andrews1-2/+2
install(EXPORT GostEngineConfig DESTINATION share/cmake/GostEngine) will to a path like this: /usr/GostEngine/share/cmake/GostEngine/GostEngineConfig.cmake which is not standard or expected. These files should be installed to: /usr/share/cmake/GostEngine/GostEngineConfig.cmake which can be done by changing the installation line to: install(EXPORT GostEngineConfig DESTINATION share/cmake/GostEngine)
2022-12-02provider wrapping for -mgm ciphersSergei Ianovich3-4/+48
Signed-off-by: Sergei Ianovich <sergei.ianovich@ya.ru>
2022-12-02Implementation of the MGM mode for magma/kuznyechikigrkir15-12/+1247
first implemented in ossl_patched branch uses dynamic NIDs Signed-off-by: Sergei Ianovich <sergei.ianovich@ya.ru>
2022-12-02engine: create missing NIDsSergei Ianovich2-0/+45
Signed-off-by: Sergei Ianovich <sergei.ianovich@ya.ru>
2022-11-02Merge pull request #421 from chipitsine/masterIlya Shipitsin1-1/+1
CI: cirrus: bump image to freebsd 13.1
2022-11-02CI: cirrus: bump image to freebsd 13.1Ilya Shipitsin1-1/+1
2022-09-25updating CA constraintsDmitry Belyavskiy1-1/+23
2022-08-11Add magma-ecb mode. Fixes #410Mark Fedorov5-6/+45
2022-07-22We need to init submodule explicitlyDmitry Belyavskiy1-0/+3
Thanks to Matt Caswell for pointing on it
2022-07-11Refactored acpkm_magma_key_meshingMark Fedorov1-12/+3
2022-07-02Refactor little-to-big-endian subroutine for magmaMark Fedorov3-24/+121
2022-05-24gost_ec_sign: Fix sig verify step 1 range checksVitaly Chikunov1-2/+2
Ensure 0 < r < q, 0 < s < q. (34.10-2021 6.2). Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2022-05-23On unpacking key blob output buffer size should be fixedv3.0.1Dmitry Belyavskiy1-9/+14
Related: CVE-2022-29242
2022-05-23Fix buffer overrun in creating key transport blob according to RFC 9189, 4.2.4.2Dmitry Belyavskiy1-1/+21
Resolves: CVE-2022-29242
2022-05-23Fix buffer overrun in creating key transport blob according to RFC 9189, 4.2.4.1Dmitry Belyavskiy3-1/+22
Resolves: CVE-2022-29242
2022-05-04Make TLS tests on SECLEVEL 0Dmitry Belyavskiy1-14/+14
As https://github.com/openssl/openssl/pull/18236 is going to ban SSL3, TLS1, TLS1.1 and DTLS1.0 at security level one and above, we have to adjust GOST TLS tests.
2022-02-08Get rid of irrelevant examplesDmitry Belyavskiy1-1/+0
2022-02-08Fix gcc12 -fanalyzer warningVitaly Chikunov1-0/+3
GCC do not understand that `algname` cannot be NULL. Add dummy default case to cover all execution paths. Fixes https://github.com/gost-engine/engine/issues/389 Tested-by: Ilya Shipitsin <chipitsine@gmail.com> Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2022-02-07Ensure that CMAC_ACPKM_CTX_copy works with 2 non-NULL pointers - fixupDmitry Belyavskiy1-2/+3
Related: #387
2022-02-06Ensure that CMAC_ACPKM_CTX_copy works with 2 non-NULL pointers.Dmitry Belyavskiy1-1/+1
Related: #387
2022-01-10gost_prov: OPENSSL_free what is OPENSSL_zalloc'dVitaly Chikunov1-1/+1
*** CID 345254: API usage errors (ALLOC_FREE_MISMATCH) /gost_prov.c: 71 in provider_ctx_new() 65 && populate_gost_engine(ctx->e)) { 66 ctx->core_handle = core; 67 68 /* Ugly hack */ 69 err_handle = ctx->proverr_handle; 70 } else { >>> CID 345254: API usage errors (ALLOC_FREE_MISMATCH) >>> Calling "provider_ctx_free" frees "ctx" using "free" but it should have been freed using "CRYPTO_free". 71 provider_ctx_free(ctx); 72 ctx = NULL; 73 } 74 return ctx; 75 } Fixes: f5a3951 ("gost_prov: Avoid access to unallocated memory") Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2022-01-09gost_prov: Avoid access to unallocated memoryVitaly Chikunov1-1/+1
This should fix Coverity warning: *** CID 345245: (UNINIT) /gost_prov.c: 71 in provider_ctx_new() 65 && populate_gost_engine(ctx->e)) { 66 ctx->core_handle = core; 67 68 /* Ugly hack */ 69 err_handle = ctx->proverr_handle; 70 } else { >>> CID 345245: (UNINIT) >>> Using uninitialized value "ctx->e" when calling "provider_ctx_free". 71 provider_ctx_free(ctx); 72 ctx = NULL; 73 } 74 return ctx; 75 } Signed-off-by: Vitaly Chikunov <vt@altlinux.org> Issue: #380
2022-01-09gost_ec_keyx: Check CTX data before it's really usedVitaly Chikunov1-4/+12
This should fix Coverity warning: *** CID 345243: Null pointer dereferences (REVERSE_INULL) /gost_ec_keyx.c: 681 in pkey_gost2018_decrypt() 675 o Q_eph is on the same curve as server public key; 676 677 o Q_eph is not equal to zero point; 678 679 o q * Q_eph is not equal to zero point. 680 */ >>> CID 345243: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "data" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 681 if (eph_key == NULL || priv == NULL || data == NULL) { 682 GOSTerr(GOST_F_PKEY_GOST2018_DECRYPT, 683 GOST_R_ERROR_COMPUTING_EXPORT_KEYS); 684 ret = 0; 685 goto err; 686 } Signed-off-by: Vitaly Chikunov <vt@altlinux.org> Issue: #380
2022-01-08Merge pull request #379 from chipitsine/masterIlya Shipitsin1-0/+28
CI: add daily Coverity scan job
2022-01-07CI: add daily Coverity scan jobIlya Shipitsin1-0/+28
2021-12-21test_tls: Rework test to be single processVitaly Chikunov2-191/+97
Rework the test to be similar to sslapitest.c. Using BIO only connections and non-blocking IO instead of socketpair and separate processes. This will allow it to compile and work on Windows. Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-21MSVC: Fix casting warning C4057Vitaly Chikunov1-2/+2
test_tls.c(103,5): warning C4057: 'function': 'const unsigned char *' differs in indirection to slightly different base types from 'char [8]' test_tls.c(104,5): warning C4057: 'function': 'const unsigned char *' differs in indirection to slightly different base types from 'char [9]' Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-21MSVC: CI: Specify explicitly OpenSSL build targetVitaly Chikunov1-1/+1
Useful to copy-paste for manual builds. Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-20Output provider infoVitaly Chikunov2-0/+12
Output something in `openssl list -providers` so it's merrier. Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-15CMake: Set default build type to RelWithDebInfoVitaly Chikunov1-0/+5
To maintain backward compatibility for users already familiar with older engine build type (basically restores `-O2 -g'). Fixes: 5ad6c77 ("Adapt C flags for the cmake build type") Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Add dllexport to OSSL_provider_initVitaly Chikunov1-0/+1
`OSSL_provider_init' requires dllexport attribute to be visible (and thus loadable) in DLL. Link: https://github.com/openssl/openssl/issues/17203 Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11CMake: Add CONFIG to the output dir if MSVCVitaly Chikunov1-1/+5
This will fix setting of OPENSSL_ENGINES in ctest on Windows. Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11CMake: Test presence of prove for perl testsVitaly Chikunov1-2/+3
This will skip tests on Windows, due to prove being `.bat' file and cmake will be unable to run it. Also, `HAVE_TEST2_V0' is renamed to be more meaningful. Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Do not build in library formVitaly Chikunov1-10/+13
Library form overwrites module form due to both having the same name `gost.dll'. As temporary workaround do not build library form on Windows, until we invent how to solve it properly. Currently, there is no known need of engine in the library form on Windows. Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Fix 'no OPENSSL_Applink' errorVitaly Chikunov12-0/+58
Error message: OPENSSL_Uplink(00007FF9FB00F600,08): no OPENSSL_Applink Link: https://www.openssl.org/docs/faq.html#PROG3 Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Skip building Linux-only binariesVitaly Chikunov1-8/+14
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Fix absence of 'setenv'Vitaly Chikunov1-0/+5
Error message: test_keyexpimp.c(111,11): warning C4013: 'setenv' undefined; assuming extern returning int Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Fix include filesVitaly Chikunov2-1/+17
Error message: gost12sum.c(13,10): fatal error C1083: Cannot open include file: 'unistd.h': No such file or directory gost12sum.c(80,23): warning C4013: 'getopt' undefined; assuming extern returning int test_keyexpimp.c(7,10): fatal error C1083: Cannot open include file: 'arpa/inet.h': No such file or directory Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Fix signed/unsigned mismatch errorsVitaly Chikunov3-6/+6
test_digest.c(513,2): warning C4389: '==': signed/unsigned mismatch test_digest.c(820,5): warning C4389: '==': signed/unsigned mismatch test_sign.c(241,22): warning C4389: '==': signed/unsigned mismatch test_params.c(1131,16): warning C4018: '<': signed/unsigned mismatch test_sign.c(241,22): warning C4389: '==': signed/unsigned mismatch Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: No support for GCC's compound statement expressionsVitaly Chikunov9-64/+64
Error messages: test_ciphers.c(329,5): error C2059: syntax error: '{' test_ciphers.c(329,5): error C2059: syntax error: '}' test_ciphers.c(329,5): error C2059: syntax error: ')' Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Replace variable-length automatic arrays with allocaVitaly Chikunov1-8/+16
MSVC is not C99 compatible[1]. Errors: test_ciphers.c(312,25): error C2057: expected constant expression test_ciphers.c(312,25): error C2466: cannot allocate an array of constant size 0 test_ciphers.c(312,26): error C2133: 'c': unknown size Link: https://docs.microsoft.com/en-us/cpp/c-language/ansi-conformance Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Ifdef GCC pragmasVitaly Chikunov3-3/+9
Error message: test_ciphers.c(37,9): warning C4068: unknown pragma 'GCC' Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Avoid use `htonl' since it requires linking with WinsockVitaly Chikunov1-7/+15
No need external library (Ws2_32.lib) if we can easily implement it. Error messages: gost_core.lib(gost_keyexpimp.obj) : error LNK2019: unresolved external symbol htonl referenced in function gost_kdftree2012_256 gost.dll : fatal error LNK1120: 1 unresolved externals Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Remove GCC pragma messagesVitaly Chikunov2-4/+0
These planned to be removed later anyway. Error message: gosthash2012_ref.h(15,18): warning C4081: expected '('; found 'string' Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
2021-12-11MSVC: Replace tentative arrays with pointersVitaly Chikunov2-18/+18
Error message example: gost_prov_cipher.c(237,63): error C2059: syntax error: '}' Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
generated by cgit v1.1 at 2024-10-18 21:48:08 +0000