Branch: refs/heads/master
Home: https://github.com/openssl/openssl
Commit: 0557d6c62b7d1f46f6f51e0dca87ad9409236164
https://github.com/openssl/openssl/commit/0557d6c62b7d1f46f6f51e0dca87ad9409236164
Author: slontis <shane.lon...@oracle.com>
Date: 2024-07-11 (Thu, 11 Jul 2024)
Changed paths:
M crypto/build.info
M crypto/context.c
A crypto/indicator_core.c
M crypto/provider_core.c
M doc/build.info
A doc/man3/OSSL_INDICATOR_set_callback.pod
M include/crypto/context.h
M include/internal/cryptlib.h
M include/openssl/core_dispatch.h
A include/openssl/indicator.h
M providers/fips/fipsprov.c
Log Message:
-----------
Add FIPS indicator callback.
Add a FIPS indicator callback that can be set via
OSSL_INDICATOR_set_callback(). This callback is intended to be run
whenever a non approved algorithm check has occurred and strict checking
has been disabled.The callback may be used to
log non approved algorithms. The callback is passed a type and
description string as well as the cbarg specified in
OSSL_INDICATOR_set_callback.
The return value can be either 0 or 1.
A value of 0 can be used for testing purposes to force an error to occur from
the algorithm
that called the callback.
Reviewed-by: Neil Horman <nhor...@openssl.org>
Reviewed-by: Paul Dale <pa...@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24623)
Commit: d4848934a61a668d16078f3118786c9a741b7efd
https://github.com/openssl/openssl/commit/d4848934a61a668d16078f3118786c9a741b7efd
Author: slontis <shane.lon...@oracle.com>
Date: 2024-07-11 (Thu, 11 Jul 2024)
Changed paths:
A providers/common/include/prov/fipsindicator.h
M providers/fips/build.info
A providers/fips/fipsindicator.c
Log Message:
-----------
Add FIPS indicator helpers
Each provider algorithm context can use these helpers to add indicator
support.
Reviewed-by: Neil Horman <nhor...@openssl.org>
Reviewed-by: Paul Dale <pa...@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24623)
Commit: c13ddf0a6c71efac8ef546f0d3632341afab3f07
https://github.com/openssl/openssl/commit/c13ddf0a6c71efac8ef546f0d3632341afab3f07
Author: slontis <shane.lon...@oracle.com>
Date: 2024-07-11 (Thu, 11 Jul 2024)
Changed paths:
M doc/man7/EVP_ASYM_CIPHER-RSA.pod
M doc/man7/EVP_KDF-TLS1_PRF.pod
M doc/man7/EVP_KEM-RSA.pod
M doc/man7/EVP_KEYEXCH-DH.pod
M doc/man7/EVP_KEYEXCH-ECDH.pod
M doc/man7/EVP_SIGNATURE-DSA.pod
M doc/man7/EVP_SIGNATURE-ECDSA.pod
M doc/man7/EVP_SIGNATURE-RSA.pod
M doc/man7/provider-asym_cipher.pod
M doc/man7/provider-kem.pod
M doc/man7/provider-keyexch.pod
M doc/man7/provider-rand.pod
M doc/man7/provider-signature.pod
M providers/common/include/prov/fipsindicator.h
M providers/common/include/prov/securitycheck.h
M providers/common/securitycheck.c
M providers/common/securitycheck_default.c
M providers/common/securitycheck_fips.c
M providers/implementations/asymciphers/rsa_enc.c
M providers/implementations/exchange/dh_exch.c
M providers/implementations/exchange/ecdh_exch.c
M providers/implementations/kdfs/tls1_prf.c
M providers/implementations/kem/rsa_kem.c
M providers/implementations/rands/drbg.c
M providers/implementations/rands/drbg_ctr.c
M providers/implementations/rands/drbg_hash.c
M providers/implementations/rands/drbg_hmac.c
M providers/implementations/rands/drbg_local.h
M providers/implementations/signature/dsa_sig.c
M providers/implementations/signature/ecdsa_sig.c
M providers/implementations/signature/rsa_sig.c
M util/perl/OpenSSL/paramnames.pm
Log Message:
-----------
Change all existing FIPS configurable checks to use FIPS indicators.
This changes the logic to always do the security checks and then decide
what to do based on if this passes or not. Failure of a check causes
either a failure OR the FIPS indicator callback to be triggered.
Reviewed-by: Neil Horman <nhor...@openssl.org>
Reviewed-by: Paul Dale <pa...@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24623)
Commit: 06da14737369e7c90899aed4bb21cce9a0910d29
https://github.com/openssl/openssl/commit/06da14737369e7c90899aed4bb21cce9a0910d29
Author: slontis <shane.lon...@oracle.com>
Date: 2024-07-11 (Thu, 11 Jul 2024)
Changed paths:
M test/evp_test.c
M test/recipes/30-test_evp_data/evpkdf_tls12_prf.txt
M test/recipes/30-test_evp_data/evppkey_dsa.txt
M test/recipes/30-test_evp_data/evppkey_ecc.txt
M test/recipes/30-test_evp_data/evppkey_ecdh.txt
M test/recipes/30-test_evp_data/evppkey_ecdsa.txt
M test/recipes/30-test_evp_data/evppkey_ffdhe.txt
M test/recipes/30-test_evp_data/evppkey_kas.txt
M test/recipes/30-test_evp_data/evppkey_rsa.txt
M test/recipes/30-test_evp_data/evppkey_rsa_common.txt
M test/recipes/30-test_evp_data/evprand.txt
M util/libcrypto.num
Log Message:
-----------
Add FIPS indicators to evp_test
evp_test code needed to be modified to defer setting algorithm contexts
until the run phase. The parse functions also defer setting into the context
until the run phase, which allows the context to initialize in a controlled
order.
This allows params to be passed into the algorithm init function.
Reviewed-by: Neil Horman <nhor...@openssl.org>
Reviewed-by: Paul Dale <pa...@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24623)
Compare: https://github.com/openssl/openssl/compare/45cada1339ba...06da14737369
To unsubscribe from these emails, change your notification settings at
https://github.com/openssl/openssl/settings/notifications
