[openssl] OpenSSL_1_1_1-stable update

[Dr . Paul Dale]

The branch OpenSSL_1_1_1-stable has been updated
   via  35cefdcab0f474deafcd769a2eb93f2c0f07051e (commit)
   via  5f9c384a1cd54ff28707d8c652343d2bf636c245 (commit)
  from  a9972440d26e482cec9d7a8c4c0063baa20d9eac (commit)


- Log -
commit 35cefdcab0f474deafcd769a2eb93f2c0f07051e
Author: Tomas Mraz 
Date:   Fri Aug 27 11:41:04 2021 +0200

ci: Add -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to asan build

Reviewed-by: Bernd Edlinger 
Reviewed-by: Paul Dale 
(Merged from https://github.com/openssl/openssl/pull/16441)

commit 5f9c384a1cd54ff28707d8c652343d2bf636c245
Author: Tomas Mraz 
Date:   Fri Aug 27 11:37:10 2021 +0200

Make the -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION pass tests

Fixes #16428

Reviewed-by: Bernd Edlinger 
Reviewed-by: Paul Dale 
(Merged from https://github.com/openssl/openssl/pull/16441)

---

Summary of changes:
 .github/workflows/ci.yml |  2 +-
 crypto/asn1/a_print.c|  7 ---
 crypto/asn1/asn1_lib.c   | 11 ---
 ssl/ssl_asn1.c   |  2 +-
 4 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6b61af9c03..367b8cf41f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -113,7 +113,7 @@ jobs:
 steps:
 - uses: actions/checkout@v2
 - name: config
-  run: ./config --debug enable-asan enable-ubsan enable-rc5 enable-md2 
enable-ec_nistp_64_gcc_128 && perl configdata.pm --dump
+  run: ./config --debug enable-asan enable-ubsan enable-rc5 enable-md2 
enable-ec_nistp_64_gcc_128 -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION && perl 
configdata.pm --dump
 - name: make
   run: make -s -j4
 - name: make test
diff --git a/crypto/asn1/a_print.c b/crypto/asn1/a_print.c
index 85a631a27a..f86623fdfa 100644
--- a/crypto/asn1/a_print.c
+++ b/crypto/asn1/a_print.c
@@ -18,12 +18,13 @@ int ASN1_PRINTABLE_type(const unsigned char *s, int len)
 int ia5 = 0;
 int t61 = 0;
 
-if (len <= 0)
-len = -1;
 if (s == NULL)
 return V_ASN1_PRINTABLESTRING;
 
-while ((*s) && (len-- != 0)) {
+if (len < 0)
+len = strlen((const char *)s);
+
+while (len-- > 0) {
 c = *(s++);
 if (!ossl_isasn1print(c))
 ia5 = 1;
diff --git a/crypto/asn1/asn1_lib.c b/crypto/asn1/asn1_lib.c
index 3d99d1383d..b9b7ad8e9e 100644
--- a/crypto/asn1/asn1_lib.c
+++ b/crypto/asn1/asn1_lib.c
@@ -294,7 +294,7 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, 
int len_in)
 c = str->data;
 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
 /* No NUL terminator in fuzzing builds */
-str->data = OPENSSL_realloc(c, len);
+str->data = OPENSSL_realloc(c, len != 0 ? len : 1);
 #else
 str->data = OPENSSL_realloc(c, len + 1);
 #endif
@@ -307,7 +307,11 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, 
int len_in)
 str->length = len;
 if (data != NULL) {
 memcpy(str->data, data, len);
-#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+/* Set the unused byte to something non NUL and printable. */
+if (len == 0)
+str->data[len] = '~';
+#else
 /*
  * Add a NUL terminator. This should not be necessary - but we add it 
as
  * a safety precaution
@@ -375,7 +379,8 @@ int ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING 
*b)
 
 i = (a->length - b->length);
 if (i == 0) {
-i = memcmp(a->data, b->data, a->length);
+if (a->length != 0)
+i = memcmp(a->data, b->data, a->length);
 if (i == 0)
 return a->type - b->type;
 else
diff --git a/ssl/ssl_asn1.c b/ssl/ssl_asn1.c
index 799fee771b..dd4a2e3203 100644
--- a/ssl/ssl_asn1.c
+++ b/ssl/ssl_asn1.c
@@ -225,7 +225,7 @@ static int ssl_session_strndup(char **pdst, 
ASN1_OCTET_STRING *src)
 static int ssl_session_memcpy(unsigned char *dst, size_t *pdstlen,
   ASN1_OCTET_STRING *src, size_t maxlen)
 {
-if (src == NULL) {
+if (src == NULL || src->length == 0) {
 *pdstlen = 0;
 return 1;
 }

SUCCESSFUL build of OpenSSL branch master with options enable-fuzz-afl no-shared no-module

[OpenSSL run-checker]

Platform and configuration command:

$ uname -a
Linux run 5.4.0-74-generic #83-Ubuntu SMP Sat May 8 02:35:39 UTC 2021 x86_64 
x86_64 x86_64 GNU/Linux
$ CC=afl-clang-fast ../openssl/config enable-fuzz-afl no-shared no-module

Commit log since last time:

59f4a51a7f Add a test for verifying an email with a bad othername type
c7f8edfc11 Ensure that we check the ASN.1 type of an "otherName" before using it
5595058714 Add the self test type OSSL_SELF_TEST_TYPE_PCT_SIGNATURE
9b6d17e423 Add a warning about locking in the child provider callback docs
4f8e0272c1 Add additional test to thread sanitizer build
2b4a611ef1 Refactor provider_core.c to adhere to the locking rules
03c137de97 Add commentary about lock usage in provider_core.c
c7468c17d7 CI: add builds covering a number of different compiler versions
2bdab81198 apps/pkcs12: Do not assume null termination of ASN1_UTF8STRING
3f7ad402b0 ci: Add -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to asan build
72a509f94f Make the -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION pass tests
6922255225 Document that EVP_get_cipherbyname() does not work for some new 
algorithm names.
028593f546 Typo correction.

[openssl] OpenSSL_1_1_1-stable update

[nic . tuv]

The branch OpenSSL_1_1_1-stable has been updated
   via  a9972440d26e482cec9d7a8c4c0063baa20d9eac (commit)
   via  f397efb0b999af6a54bc192ce8551e76c79ff245 (commit)
   via  45487dba0fb8c36fe390fa8131204403c00c01fc (commit)
   via  3d97638062595efb23b32f9150c38d60db89de7f (commit)
  from  f661c76a9e27a87f4bbbed135faf89a3fccac75f (commit)


- Log -
commit a9972440d26e482cec9d7a8c4c0063baa20d9eac
Author: Bernd Edlinger 
Date:   Fri Aug 20 20:42:55 2021 +0200

Use applink to fix windows tests

(cherry picked from commit 
)

Reviewed-by: Tomas Mraz 
Reviewed-by: Nicola Tuveri 
(Merged from https://github.com/openssl/openssl/pull/12457)

commit f397efb0b999af6a54bc192ce8551e76c79ff245
Author: Nicola Tuveri 
Date:   Thu Jul 16 03:23:26 2020 +0300

[ec] Do not default to OPENSSL_EC_NAMED_CURVE for curves without OID

Some curves don't have an associated OID: for those we should not
default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and instead
set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.

This is a follow-up to https://github.com/openssl/openssl/pull/12312

(cherry picked from commit 7aa3dfc42104588f65301d20324388ac2c9a6b11)

Reviewed-by: Tomas Mraz 
(Merged from https://github.com/openssl/openssl/pull/12457)

commit 45487dba0fb8c36fe390fa8131204403c00c01fc
Author: Nicola Tuveri 
Date:   Thu Jul 16 02:02:16 2020 +0300

Fix d2i_ECPKParameters_fp and i2d_ECPKParameters_fp macros

These functions are part of the public API but we don't have tests
covering their usage.
They are actually implemented as macros and the absence of tests has
caused them to fall out-of-sync with the latest changes to ASN1 related
functions and cause compilation warnings.

This commit fixes the public headers to reflect these changes.

Fixes #12443

(cherry picked from commit cca8a4cedaafe63b0b5729b72133661ece24ff08)

Reviewed-by: Tomas Mraz 
(Merged from https://github.com/openssl/openssl/pull/12457)

commit 3d97638062595efb23b32f9150c38d60db89de7f
Author: Nicola Tuveri 
Date:   Thu Jul 16 01:57:09 2020 +0300

Add tests for i2d_TYPE_fp and d2i_TYPE_fp

These functions are part of the public API but we don't have tests
covering their usage.
They are actually implemented as macros and the absence of tests has
caused them to fall out-of-sync with the latest changes to ASN1 related
functions and cause compilation warnings.

@@ Note: This commit limits to ECPKParameters as a type.

(cherry picked from commit ea1128e94e36fa9fa25278dc6b3f5b42d8735782)

Reviewed-by: Tomas Mraz 
(Merged from https://github.com/openssl/openssl/pull/12457)

---

Summary of changes:
 crypto/ec/ec_asn1.c |  2 +-
 crypto/ec/ec_curve.c| 27 +++
 include/openssl/ec.h| 15 +--
 test/build.info |  4 +++-
 test/ec_internal_test.c | 43 +++
 5 files changed, 83 insertions(+), 8 deletions(-)

diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c
index c8ee1e6f17..4335b3da1a 100644
--- a/crypto/ec/ec_asn1.c
+++ b/crypto/ec/ec_asn1.c
@@ -548,7 +548,7 @@ ECPKPARAMETERS *EC_GROUP_get_ecpkparameters(const EC_GROUP 
*group,
 ECPARAMETERS_free(ret->value.parameters);
 }
 
-if (EC_GROUP_get_asn1_flag(group)) {
+if (EC_GROUP_get_asn1_flag(group) == OPENSSL_EC_NAMED_CURVE) {
 /*
  * use the asn1 OID to describe the elliptic curve parameters
  */
diff --git a/crypto/ec/ec_curve.c b/crypto/ec/ec_curve.c
index 8de486cbd7..dfe5263f59 100644
--- a/crypto/ec/ec_curve.c
+++ b/crypto/ec/ec_curve.c
@@ -12,6 +12,7 @@
 #include "ec_local.h"
 #include 
 #include 
+#include 
 #include 
 #include "internal/nelem.h"
 
@@ -3097,6 +3098,32 @@ static EC_GROUP *ec_group_new_from_data(const 
ec_list_element curve)
 goto err;
 }
 }
+
+if (EC_GROUP_get_asn1_flag(group) == OPENSSL_EC_NAMED_CURVE) {
+/*
+ * Some curves don't have an associated OID: for those we should not
+ * default to `OPENSSL_EC_NAMED_CURVE` encoding of parameters and
+ * instead set the ASN1 flag to `OPENSSL_EC_EXPLICIT_CURVE`.
+ *
+ * Note that `OPENSSL_EC_NAMED_CURVE` is set as the default ASN1 flag 
on
+ * `EC_GROUP_new()`, when we don't have enough elements to determine if
+ * an OID for the curve name actually exists.
+ * We could implement this check on `EC_GROUP_set_curve_name()` but
+ * overloading the simple setter with this lookup could have a negative
+ * performance impact and unexpected consequences.
+ */
+ASN1_OBJE

[openssl] master update

[Dr . Paul Dale]

The branch master has been updated
   via  59f4a51a7f2c53b9fd161b032d0fcb8a85f4f19d (commit)
   via  c7f8edfc1186a48463c14cfdc7f70456cbcb1cda (commit)
  from  5595058714832bdff03604c881cf44f91c14b5fc (commit)


- Log -
commit 59f4a51a7f2c53b9fd161b032d0fcb8a85f4f19d
Author: Matt Caswell 
Date:   Thu Aug 26 10:03:51 2021 +0100

Add a test for verifying an email with a bad othername type

Reviewed-by: Tomas Mraz 
Reviewed-by: Paul Dale 
(Merged from https://github.com/openssl/openssl/pull/16443)

commit c7f8edfc1186a48463c14cfdc7f70456cbcb1cda
Author: Matt Caswell 
Date:   Thu Aug 26 09:43:50 2021 +0100

Ensure that we check the ASN.1 type of an "otherName" before using it

We should not assume that the type of an ASN.1 value is UTF8String as
expected. We must actually check it, otherwise we could get a NULL ptr
deref, or worse memory errors.

Reported by David Benjamin.

Reviewed-by: Tomas Mraz 
Reviewed-by: Paul Dale 
(Merged from https://github.com/openssl/openssl/pull/16443)

---

Summary of changes:
 crypto/x509/v3_utl.c| 17 -
 test/recipes/25-test_eai_data.t | 14 --
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/crypto/x509/v3_utl.c b/crypto/x509/v3_utl.c
index 5c63d2d9d8..a70917a39b 100644
--- a/crypto/x509/v3_utl.c
+++ b/crypto/x509/v3_utl.c
@@ -901,12 +901,19 @@ static int do_x509_check(X509 *x, const char *chk, size_t 
chklen,
 if (OBJ_obj2nid(gen->d.otherName->type_id) ==
 NID_id_on_SmtpUTF8Mailbox) {
 san_present = 1;
-cstr = gen->d.otherName->value->value.utf8string;
 
-/* Positive on success, negative on error! */
-if ((rv = do_check_string(cstr, 0, equal, flags,
-  chk, chklen, peername)) != 0)
-break;
+/*
+ * If it is not a UTF8String then that is unexpected and we
+ * treat it as no match
+ */
+if (gen->d.otherName->value->type == V_ASN1_UTF8STRING) {
+cstr = gen->d.otherName->value->value.utf8string;
+
+/* Positive on success, negative on error! */
+if ((rv = do_check_string(cstr, 0, equal, flags,
+chk, chklen, peername)) != 0)
+break;
+}
 } else
 continue;
 } else {
diff --git a/test/recipes/25-test_eai_data.t b/test/recipes/25-test_eai_data.t
index 8aebf5d621..522982ddfb 100644
--- a/test/recipes/25-test_eai_data.t
+++ b/test/recipes/25-test_eai_data.t
@@ -12,7 +12,7 @@ use warnings;
 
 use File::Spec;
 use OpenSSL::Test::Utils;
-use OpenSSL::Test qw/:DEFAULT srctop_file/;
+use OpenSSL::Test qw/:DEFAULT srctop_file with/;
 
 setup("test_eai_data");
 
@@ -21,7 +21,7 @@ setup("test_eai_data");
 #./util/wrap.pl apps/openssl verify -nameopt utf8 -no_check_time -CAfile 
test/recipes/25-test_eai_data/utf8_chain.pem 
test/recipes/25-test_eai_data/ascii_leaf.pem
 #./util/wrap.pl apps/openssl verify -nameopt utf8 -no_check_time -CAfile 
test/recipes/25-test_eai_data/ascii_chain.pem 
test/recipes/25-test_eai_data/utf8_leaf.pem
 
-plan tests => 11;
+plan tests => 12;
 
 require_ok(srctop_file('test','recipes','tconversion.pl'));
 my $folder = "test/recipes/25-test_eai_data";
@@ -60,3 +60,13 @@ ok(run(app(["openssl", "verify", "-nameopt", "utf8", 
"-no_check_time", "-CAfile"
 ok(!run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", 
"-CAfile", $ascii_chain_pem, $utf8_pem])));
 ok(!run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", 
"-CAfile", $utf8_chain_pem,  $ascii_pem])));
 
+#Check that we get the expected failure return code
+with({ exit_checker => sub { return shift == 2; } },
+ sub {
+ok(run(app(["openssl", "verify", "-CAfile",
+srctop_file("test", "certs", "bad-othername-namec.pem"),
+"-partial_chain", "-no_check_time", "-verify_email",
+'f...@example.com',
+srctop_file("test", "certs", 
"bad-othername-namec.pem")])));
+ });
+

[openssl] master update

[Dr . Paul Dale]

The branch master has been updated
   via  5595058714832bdff03604c881cf44f91c14b5fc (commit)
  from  9b6d17e423da138ea7fd190ae366580c539dceca (commit)


- Log -
commit 5595058714832bdff03604c881cf44f91c14b5fc
Author: slontis 
Date:   Mon Aug 30 09:59:54 2021 +1000

Add the self test type OSSL_SELF_TEST_TYPE_PCT_SIGNATURE

Fixes #16457

The ECDSA and DSA signature tests use Pairwise tests instead of KATS.
Note there is a seperate type used by the keygen for conditional Pairwise 
Tests.

Reviewed-by: Tim Hudson 
Reviewed-by: Tomas Mraz 
Reviewed-by: Paul Dale 
(Merged from https://github.com/openssl/openssl/pull/16461)

---

Summary of changes:
 doc/man7/OSSL_PROVIDER-FIPS.pod| 6 +-
 include/openssl/self_test.h| 3 ++-
 providers/fips/self_test_kats.c| 6 +-
 test/recipes/03-test_fipsinstall.t | 2 +-
 4 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/doc/man7/OSSL_PROVIDER-FIPS.pod b/doc/man7/OSSL_PROVIDER-FIPS.pod
index 62e495aef1..0eac85b324 100644
--- a/doc/man7/OSSL_PROVIDER-FIPS.pod
+++ b/doc/man7/OSSL_PROVIDER-FIPS.pod
@@ -214,6 +214,10 @@ Known answer test for a digest.
 
 Known answer test for a signature.
 
+=item "PCT_Signature" (B)  
+
+Pairwise Consistency check for a signature.
+
 =item "KAT_KDF" (B)
 
 Known answer test for a key derivation function.
@@ -226,7 +230,7 @@ Known answer test for key agreement.
 
 Known answer test for a Deterministic Random Bit Generator.
 
-=item "Pairwise_Consistency_Test" (B)
+=item "Conditional_PCT" (B)
 
 Conditional test that is run during the generation of key pairs.
 
diff --git a/include/openssl/self_test.h b/include/openssl/self_test.h
index 564fc95088..77c600a0d1 100644
--- a/include/openssl/self_test.h
+++ b/include/openssl/self_test.h
@@ -29,11 +29,12 @@ extern "C" {
 # define OSSL_SELF_TEST_TYPE_MODULE_INTEGRITY   "Module_Integrity"
 # define OSSL_SELF_TEST_TYPE_INSTALL_INTEGRITY  "Install_Integrity"
 # define OSSL_SELF_TEST_TYPE_CRNG   "Continuous_RNG_Test"
-# define OSSL_SELF_TEST_TYPE_PCT"Pairwise_Consistency_Test"
+# define OSSL_SELF_TEST_TYPE_PCT"Conditional_PCT"
 # define OSSL_SELF_TEST_TYPE_KAT_CIPHER "KAT_Cipher"
 # define OSSL_SELF_TEST_TYPE_KAT_ASYM_CIPHER"KAT_AsymmetricCipher"
 # define OSSL_SELF_TEST_TYPE_KAT_DIGEST "KAT_Digest"
 # define OSSL_SELF_TEST_TYPE_KAT_SIGNATURE  "KAT_Signature"
+# define OSSL_SELF_TEST_TYPE_PCT_SIGNATURE  "PCT_Signature"
 # define OSSL_SELF_TEST_TYPE_KAT_KDF"KAT_KDF"
 # define OSSL_SELF_TEST_TYPE_KAT_KA "KAT_KA"
 # define OSSL_SELF_TEST_TYPE_DRBG   "DRBG"
diff --git a/providers/fips/self_test_kats.c b/providers/fips/self_test_kats.c
index d411767205..81f7226ba1 100644
--- a/providers/fips/self_test_kats.c
+++ b/providers/fips/self_test_kats.c
@@ -452,8 +452,12 @@ static int self_test_sign(const ST_KAT_SIGN *t,
 0x48, 0xa1, 0xd6, 0x5d, 0xfc, 0x2d, 0x4b, 0x1f, 0xa3, 0xd6, 0x77, 0x28,
 0x4a, 0xdd, 0xd2, 0x00, 0x12, 0x6d, 0x90, 0x69
 };
+const char *typ = OSSL_SELF_TEST_TYPE_KAT_SIGNATURE;
 
-OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_KAT_SIGNATURE, t->desc);
+if (t->sig_expected == NULL)
+typ = OSSL_SELF_TEST_TYPE_PCT_SIGNATURE;
+
+OSSL_SELF_TEST_onbegin(st, typ, t->desc);
 
 bnctx = BN_CTX_new_ex(libctx);
 if (bnctx == NULL)
diff --git a/test/recipes/03-test_fipsinstall.t 
b/test/recipes/03-test_fipsinstall.t
index db64362538..d99974e467 100644
--- a/test/recipes/03-test_fipsinstall.t
+++ b/test/recipes/03-test_fipsinstall.t
@@ -235,7 +235,7 @@ SKIP: {
 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
 '-section_name', 'fips_sect',
 '-corrupt_desc', 'DSA',
-'-corrupt_type', 'KAT_Signature'])),
+'-corrupt_type', 'PCT_Signature'])),
"fipsinstall fails when the signature result is corrupted");
 }
 

[openssl] master update

[Dr . Paul Dale]

The branch master has been updated
   via  9b6d17e423da138ea7fd190ae366580c539dceca (commit)
   via  4f8e0272c1bde43d97bc1c4471dbaecfc89f7aae (commit)
   via  2b4a611ef18b0696bff57da889622e0e42ed4521 (commit)
   via  03c137de971354b7c2e00f0198e85446ead6cfc3 (commit)
  from  c7468c17d7090492c266492ffa4ccf5baf93ffc4 (commit)


- Log -
commit 9b6d17e423da138ea7fd190ae366580c539dceca
Author: Matt Caswell 
Date:   Mon Aug 30 15:54:22 2021 +0100

Add a warning about locking in the child provider callback docs

The child provider callbacks can hold the store lock. In order to avoid
deadlocks we require that the callback implementations don't themselves
call functions that may aquire those locks.

Reviewed-by: Tomas Mraz 
Reviewed-by: Paul Dale 
(Merged from https://github.com/openssl/openssl/pull/16469)

commit 4f8e0272c1bde43d97bc1c4471dbaecfc89f7aae
Author: Pauli 
Date:   Mon Aug 16 12:20:56 2021 +1000

Add additional test to thread sanitizer build

Reviewed-by: Tomas Mraz 
(Merged from https://github.com/openssl/openssl/pull/16469)

commit 2b4a611ef18b0696bff57da889622e0e42ed4521
Author: Matt Caswell 
Date:   Mon Aug 30 13:04:31 2021 +0100

Refactor provider_core.c to adhere to the locking rules

The previous commit provided some guidelines and some rules for using
locking in order to avoid deadlocks. This commit refactors the code in
order to adhere to those guidelines and rules.

Fixes #16312

Reviewed-by: Tomas Mraz 
Reviewed-by: Paul Dale 
(Merged from https://github.com/openssl/openssl/pull/16469)

commit 03c137de971354b7c2e00f0198e85446ead6cfc3
Author: Matt Caswell 
Date:   Mon Aug 30 15:33:07 2021 +0100

Add commentary about lock usage in provider_core.c

Provide some guidelines, as well as some rules for using the locks in
provider_core.c, in order to avoid the introduction of deadlocks.

Reviewed-by: Tomas Mraz 
Reviewed-by: Paul Dale 
(Merged from https://github.com/openssl/openssl/pull/16469)

---

Summary of changes:
 .github/workflows/ci.yml   |   2 +-
 crypto/provider_core.c | 239 +++--
 doc/man7/provider-base.pod |   6 +-
 3 files changed, 190 insertions(+), 57 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f2a9b9fb2..601ba5f6b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -157,7 +157,7 @@ jobs:
 - name: make
   run: make -s -j4
 - name: make test
-  run: make TESTS=test_threads test HARNESS_JOBS=${HARNESS_JOBS:-4}
+  run: make V=1 TESTS="test_threads test_internal_provider test_provfetch 
test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp" test 
HARNESS_JOBS=${HARNESS_JOBS:-4}
 
   enable_non-default_options:
 runs-on: ubuntu-latest
diff --git a/crypto/provider_core.c b/crypto/provider_core.c
index 1f688557c1..e4069eb4f7 100644
--- a/crypto/provider_core.c
+++ b/crypto/provider_core.c
@@ -28,6 +28,89 @@
 # include 
 #endif
 
+/*
+ * This file defines and uses a number of different structures:
+ *
+ * OSSL_PROVIDER (provider_st): Used to represent all information related to a
+ * single instance of a provider.
+ *
+ * provider_store_st: Holds information about the collection of providers that
+ * are available within the current library context (OSSL_LIB_CTX). It also
+ * holds configuration information about providers that could be loaded at some
+ * future point.
+ *
+ * OSSL_PROVIDER_CHILD_CB: An instance of this structure holds the callbacks
+ * that have been registered for a child library context and the associated
+ * provider that registered those callbacks.
+ *
+ * Where a child library context exists then it has its own instance of the
+ * provider store. Each provider that exists in the parent provider store, has
+ * an associated child provider in the child library context's provider store.
+ * As providers get activated or deactivated this needs to be mirrored in the
+ * associated child providers.
+ *
+ * LOCKING
+ * ===
+ *
+ * There are a number of different locks used in this file and it is important
+ * to understand how they should be used in order to avoid deadlocks.
+ *
+ * Fields within a structure can often be "write once" on creation, and then
+ * "read many". Creation of a structure is done by a single thread, and
+ * therefore no lock is required for the "write once/read many" fields. It is
+ * safe for multiple threads to read these fields without a lock, because they
+ * will never be changed.
+ *
+ * However some fields may be changed after a structure has been created and
+ * shared between multiple threads. Where this is the case a lock is required.
+ *
+ * The locks available are:
+ *
+ * The provider flag_lock: Used to control updates t

[openssl] master update

[Dr . Paul Dale]

The branch master has been updated
   via  c7468c17d7090492c266492ffa4ccf5baf93ffc4 (commit)
  from  2bdab81198ae366d25547b1441609c7d324b0bb4 (commit)


- Log -
commit c7468c17d7090492c266492ffa4ccf5baf93ffc4
Author: Pauli 
Date:   Mon Aug 30 16:06:49 2021 +1000

CI: add builds covering a number of different compiler versions

Reviewed-by: Tomas Mraz 
Reviewed-by: Richard Levitte 
(Merged from https://github.com/openssl/openssl/pull/16463)

---

Summary of changes:
 .github/workflows/compiler-zoo.yml | 53 ++
 1 file changed, 53 insertions(+)
 create mode 100644 .github/workflows/compiler-zoo.yml

diff --git a/.github/workflows/compiler-zoo.yml 
b/.github/workflows/compiler-zoo.yml
new file mode 100644
index 00..29a9097343
--- /dev/null
+++ b/.github/workflows/compiler-zoo.yml
@@ -0,0 +1,53 @@
+name: Compiler Zoo CI
+
+on: [push]
+
+jobs:
+  compiler:
+strategy:
+  fail-fast: false
+  matrix:
+zoo: [
+  {
+cc: gcc-7
+  }, {
+cc: gcc-8
+  }, {
+cc: gcc-9
+  }, {
+cc: gcc-10
+  }, {
+cc: clang-6.0
+  }, {
+cc: clang-7
+  }, {
+cc: clang-8
+  }, {
+cc: clang-9
+  }, {
+cc: clang-10
+  }, {
+cc: clang-11
+  }, {
+cc: clang-12
+  }
+]
+runs-on: ubuntu-latest
+steps:
+- name: install packages
+  run: |
+sudo apt-get update
+sudo apt-get -yq --force-yes install ${{ matrix.zoo.cc }}
+- uses: actions/checkout@v2
+
+- name: config
+  run: |
+CC=${{ matrix.zoo.cc }} ./config --banner=Configured no-shared \
+-Wall -Werror enable-fips --strict-warnings
+
+- name: config dump
+  run: ./configdata.pm --dump
+- name: make
+  run: make -s -j4
+- name: make test
+  run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}

[openssl] master update

[tomas]

The branch master has been updated
   via  2bdab81198ae366d25547b1441609c7d324b0bb4 (commit)
   via  3f7ad402b06fd75397f11fd9f0b2ad6778a31f99 (commit)
   via  72a509f94fc2be80c9903b7512715cd526a82e25 (commit)
  from  69222552252c86e7d68dcc24b2ce1aa0793ab3aa (commit)


- Log -
commit 2bdab81198ae366d25547b1441609c7d324b0bb4
Author: Tomas Mraz 
Date:   Tue Aug 31 09:05:59 2021 +0200

apps/pkcs12: Do not assume null termination of ASN1_UTF8STRING

Reviewed-by: Paul Dale 
Reviewed-by: Bernd Edlinger 
(Merged from https://github.com/openssl/openssl/pull/16433)

commit 3f7ad402b06fd75397f11fd9f0b2ad6778a31f99
Author: Tomas Mraz 
Date:   Thu Aug 26 15:13:58 2021 +0200

ci: Add -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to asan build

Reviewed-by: Paul Dale 
Reviewed-by: Bernd Edlinger 
(Merged from https://github.com/openssl/openssl/pull/16433)

commit 72a509f94fc2be80c9903b7512715cd526a82e25
Author: Tomas Mraz 
Date:   Thu Aug 26 15:08:15 2021 +0200

Make the -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION pass tests

Fixes #16428

Reviewed-by: Paul Dale 
Reviewed-by: Bernd Edlinger 
(Merged from https://github.com/openssl/openssl/pull/16433)

---

Summary of changes:
 .github/workflows/ci.yml |  2 +-
 apps/pkcs12.c|  3 ++-
 crypto/asn1/a_print.c|  7 ---
 crypto/asn1/asn1_lib.c   | 11 ---
 ssl/ssl_asn1.c   |  2 +-
 5 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bcb5cd5775..2f2a9b9fb2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -130,7 +130,7 @@ jobs:
 steps:
 - uses: actions/checkout@v2
 - name: config
-  run: ./config --banner=Configured --debug enable-asan enable-ubsan 
enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl 
configdata.pm --dump
+  run: ./config --banner=Configured --debug enable-asan enable-ubsan 
enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips 
-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION && perl configdata.pm --dump
 - name: make
   run: make -s -j4
 - name: make test
diff --git a/apps/pkcs12.c b/apps/pkcs12.c
index d745df8494..dcb173f201 100644
--- a/apps/pkcs12.c
+++ b/apps/pkcs12.c
@@ -1142,7 +1142,8 @@ void print_attribute(BIO *out, const ASN1_TYPE *av)
 break;
 
 case V_ASN1_UTF8STRING:
-BIO_printf(out, "%s\n", av->value.utf8string->data);
+BIO_printf(out, "%.*s\n", av->value.utf8string->length,
+   av->value.utf8string->data);
 break;
 
 case V_ASN1_OCTET_STRING:
diff --git a/crypto/asn1/a_print.c b/crypto/asn1/a_print.c
index 328e0abcc5..e04f9b1f2e 100644
--- a/crypto/asn1/a_print.c
+++ b/crypto/asn1/a_print.c
@@ -18,12 +18,13 @@ int ASN1_PRINTABLE_type(const unsigned char *s, int len)
 int ia5 = 0;
 int t61 = 0;
 
-if (len <= 0)
-len = -1;
 if (s == NULL)
 return V_ASN1_PRINTABLESTRING;
 
-while ((*s) && (len-- != 0)) {
+if (len < 0)
+len = strlen((const char *)s);
+
+while (len-- > 0) {
 c = *(s++);
 if (!ossl_isasn1print(c))
 ia5 = 1;
diff --git a/crypto/asn1/asn1_lib.c b/crypto/asn1/asn1_lib.c
index 02c34a4438..5359cbc117 100644
--- a/crypto/asn1/asn1_lib.c
+++ b/crypto/asn1/asn1_lib.c
@@ -303,7 +303,7 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, 
int len_in)
 c = str->data;
 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
 /* No NUL terminator in fuzzing builds */
-str->data = OPENSSL_realloc(c, len);
+str->data = OPENSSL_realloc(c, len != 0 ? len : 1);
 #else
 str->data = OPENSSL_realloc(c, len + 1);
 #endif
@@ -316,7 +316,11 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, 
int len_in)
 str->length = len;
 if (data != NULL) {
 memcpy(str->data, data, len);
-#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+/* Set the unused byte to something non NUL and printable. */
+if (len == 0)
+str->data[len] = '~';
+#else
 /*
  * Add a NUL terminator. This should not be necessary - but we add it 
as
  * a safety precaution
@@ -384,7 +388,8 @@ int ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING 
*b)
 
 i = (a->length - b->length);
 if (i == 0) {
-i = memcmp(a->data, b->data, a->length);
+if (a->length != 0)
+i = memcmp(a->data, b->data, a->length);
 if (i == 0)
 return a->type - b->type;
 else
diff --git a/ssl/ssl_asn1.c b/ssl/ssl_asn1.c
index 2cbd95fa1b..3503fdc210 100644
--- a/ssl/ssl_asn1.c
+++ b/ssl/ssl_asn1.c
@@ -229,7 +229,7 @@ static int ssl_session_strndup(char **pdst, 
ASN1_OCTET_STRING *src)
 stat

[openssl] master update

[tomas]

The branch master has been updated
   via  69222552252c86e7d68dcc24b2ce1aa0793ab3aa (commit)
  from  028593f546f66d50d399a4f9286364d97c68da78 (commit)


- Log -
commit 69222552252c86e7d68dcc24b2ce1aa0793ab3aa
Author: slontis 
Date:   Wed Aug 25 11:50:20 2021 +1000

Document that EVP_get_cipherbyname() does not work for some new algorithm 
names.

These algorithms were added to providers but have no const EVP_CIPHER*
mapping. Ciphers for SIV and CTS were previously only available via low 
level
function calls that are deprecated.

Reported by @reaperhulk.

Reviewed-by: Paul Dale 
Reviewed-by: Tomas Mraz 
(Merged from https://github.com/openssl/openssl/pull/16414)

---

Summary of changes:
 CHANGES.md   | 7 +++
 doc/man3/EVP_EncryptInit.pod | 5 +
 2 files changed, 12 insertions(+)

diff --git a/CHANGES.md b/CHANGES.md
index 5b16e34dd5..a24b30e651 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -41,6 +41,13 @@ breaking changes, and mappings for the large list of 
deprecated functions.
 
*OpenSSL team members and many third party contributors*
 
+ * The EVP_get_cipherbyname() function will return NULL for algorithms such as
+   "AES-128-SIV", "AES-128-CBC-CTS" and "CAMELLIA-128-CBC-CTS" which were
+   previously only accessible via low level interfaces. Use EVP_CIPHER_fetch()
+   instead to retrieve these algorithms from a provider.
+
+   *Shane Lontis*
+
  * On build targets where the multilib postfix is set in the build
configuration the libdir directory was changing based on whether
the lib directory with the multilib postfix exists on the system
diff --git a/doc/man3/EVP_EncryptInit.pod b/doc/man3/EVP_EncryptInit.pod
index cb36629684..62d9047dce 100644
--- a/doc/man3/EVP_EncryptInit.pod
+++ b/doc/man3/EVP_EncryptInit.pod
@@ -447,6 +447,11 @@ EVP_CipherFinal_ex() instead.
 Return an EVP_CIPHER structure when passed a cipher name, a NID or an
 ASN1_OBJECT structure.
 
+EVP_get_cipherbyname() will return NULL for algorithms such as "AES-128-SIV",
+"AES-128-CBC-CTS" and "CAMELLIA-128-CBC-CTS" which were previously only
+accessible via low level interfaces. Use EVP_CIPHER_fetch() instead to retrieve
+these algorithms from a provider.
+
 =item EVP_CIPHER_get_nid() and EVP_CIPHER_CTX_get_nid()
 
 Return the NID of a cipher when passed an B or B

[openssl] master update

[tomas]

The branch master has been updated
   via  028593f546f66d50d399a4f9286364d97c68da78 (commit)
  from  78082769fa8129e3453ee4cb2255feb259846646 (commit)


- Log -
commit 028593f546f66d50d399a4f9286364d97c68da78
Author: Jaime Hablutzel 
Date:   Mon Aug 30 13:18:48 2021 -0500

Typo correction.

CLA: trivial

Reviewed-by: Paul Dale 
Reviewed-by: Tomas Mraz 
(Merged from https://github.com/openssl/openssl/pull/16470)

---

Summary of changes:
 doc/man1/openssl-verification-options.pod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/man1/openssl-verification-options.pod 
b/doc/man1/openssl-verification-options.pod
index 895ee07c60..5fa3907c28 100644
--- a/doc/man1/openssl-verification-options.pod
+++ b/doc/man1/openssl-verification-options.pod
@@ -21,7 +21,7 @@ It is a complicated process consisting of a number of steps
 and depending on numerous options.
 The most important of them are detailed in the following sections.
 
-In a nutshell, a valid chain of certifciates needs to be built up and verified
+In a nutshell, a valid chain of certificates needs to be built up and verified
 starting from the I that is to be verified
 and ending in a certificate that due to some policy is trusted.
 Verification is done relative to the given I, which is the intended 
use

[web] master update

[Mark J . Cox]

The branch master has been updated
   via  30a512b2e4a02e643216a163af87db97ccbf00d2 (commit)
   via  d3f3bf5b0d8ef336acb45a3e8077436001be82f9 (commit)
  from  0374f7e7bd8802894fee0c15c474bd20e04f5731 (commit)


- Log -
commit 30a512b2e4a02e643216a163af87db97ccbf00d2
Merge: 0374f7e d3f3bf5
Author: Mark J. Cox 
Date:   Tue Aug 31 10:55:38 2021 +0100

Merge pull request #254 from iamamoose/20210831sponsors

Add CarGurus sponsorship (silver)

commit d3f3bf5b0d8ef336acb45a3e8077436001be82f9
Author: Mark J. Cox 
Date:   Tue Aug 31 10:20:05 2021 +0100

Add CarGurus sponsorship (silver)

---

Summary of changes:
 support/acks.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/support/acks.html b/support/acks.html
index 8a81815..0b70d47 100644
--- a/support/acks.html
+++ b/support/acks.html
@@ -46,6 +46,7 @@
 
   Silver:
   
+https://cargurus.com/";>CarGurus
 https://shiguredo.jp/";>Shiguredo Inc.
   
   

Coverity Scan: Analysis completed for OpenSSL-1.0.2

[scan-admin]

Your request for analysis of OpenSSL-1.0.2 has been completed successfully.
The results are available at 
https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7Hlun-2FGpeF2rhqKLKnzox0Gkw-3D-3DE7Ne_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeGQYjN-2F1Td3APfUUU5-2FlmzRx4YfZws0ZgFULARhunOHvq7WGTmlzaGyai9cLH8SJsUvlYlmPlsKFacf6-2BABt0Jp5cAkq5qqwAZvGUidaQsoPXT9THllmiDhAiA2U3yIID3MNSk9QgdeoZWf2sjacTslm6N6uo31ACriiRMRTK5Zx7j-2BVyjvipWPfYbkgFdrioY-3D

Build ID: 405111

Analysis Summary:
   New defects found: 0
   Defects eliminated: 0

Coverity Scan: Analysis completed for openssl/openssl

[scan-admin]

Your request for analysis of openssl/openssl has been completed 
successfully.
The results are available at 
https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoN-2BQSVjTtaSz8wS4wOr7HlekBtV1P4YRtWclMVkCdvAA-3D-3DQ1fU_MulOTlHne1IxTRELXXnGni8d68xSVF-2BUCe3a7Ux-2BjeHRIssZ9k0CvbiLobdv0hibavib2cPz2luqS77HtjEomqjOTWX9X3EXM07NZ0cqCVNshIoSxvaQaLo6fGSHaG-2FqPO0BCCTX1tUgTmm-2Br6-2FL2huWmkAHlcetuEgL92E55FAhuMvbDJmls7Tp7-2B0yvMlnbRLSUkrIwGHYYUBFBhA8YuZdSP-2B9r60nfzMVyqrWaCU-3D

Build ID: 405110

Analysis Summary:
   New defects found: 0
   Defects eliminated: 0