[openssl] master update
The branch master has been updated via ef33889e1878739a8355e8ba027b3ed21a917898 (commit) from 458d168cd48ab57ffd8e6c8322073e4a77d03d26 (commit) - Log - commit ef33889e1878739a8355e8ba027b3ed21a917898 Author: Pauli Date: Thu Feb 18 09:55:11 2021 +1000 doc: remove notes section in OSSL_ENCODER.pod Fixes #14212 The note wasn't adding anything useful. Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/14220) --- Summary of changes: doc/man3/OSSL_ENCODER.pod | 6 -- 1 file changed, 6 deletions(-) diff --git a/doc/man3/OSSL_ENCODER.pod b/doc/man3/OSSL_ENCODER.pod index 6952d850f4..2c68d1a761 100644 --- a/doc/man3/OSSL_ENCODER.pod +++ b/doc/man3/OSSL_ENCODER.pod @@ -108,12 +108,6 @@ otherwise 0. OSSL_ENCODER_number() returns an integer. -=head1 NOTES - -OSSL_ENCODER_fetch() may be called implicitly by other fetching -functions, using the same library context and properties. -Any other API that uses keys will typically do this. - =head1 SEE ALSO L, L, L,
Still FAILED build of OpenSSL branch master with options -d enable-fuzz-afl no-shared no-module
Platform and configuration command: $ uname -a Linux run 5.4.0-52-generic #57-Ubuntu SMP Thu Oct 15 10:57:00 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux $ CC=afl-clang-fast ../openssl/config -d enable-fuzz-afl no-shared no-module Commit log since last time: adc11e1b9c x509_vfy: fix mem leaks in chain_build() on malloc error Coverify CID 1473068 b51bed05c2 apps/cmp.c: Improve initialization of ext_ctx structure w.r.t. CSR d44a8a16c8 apps/ca.c: Make sure ext_ctx structure gets initialized fe75766c9c Rename OSSL_ENCODER_CTX_new_by_EVP_PKEY and OSSL_DECODER_CTX_new_by_EVP_PKEY e5ac413b2d Fix backward incompatibility revolving around OSSL_HTTP_REQ_CTX_sendreq_d2i() 3a962b2093 [doc/man3][OSSL_ENCODER] Move NOTES to the bottom 851b06b705 [doc/man3] Fix typo in DESCRIPTION of OSSL_ENCODER_properties 68883d9db8 doc: document the two new RAND functions 335e85f542 rand: update DRBGs to use the get_entropy call for seeding 78436fd146 core: add get_entropy and clear_entropy calls to RAND e2730b8426 RNG test: add get_entropy hook for testing. 9ed185a926 RNG seed: add get_entropy hook for seeding. 381289f6c7 err: generated error files 79d68c4fb4 test: DRBG test with long seed. 574ca403c8 Replace SSL_CTX_new by SSL_CTX_new_ex in apps/s_server + s_client 5b888e931b Fix propquery handling in EVP_DigestSignInit_ex 55e9d8cfff TEST: Add missing initialization c913dbd716 Update CHANGES and NEWS for new release c9fb704cf3 Don't overflow the output length in EVP_CipherUpdate calls c1ddd392cf Fix rsa_test to properly test RSA_SSLV23_PADDING d9461cbe87 Fix the RSA_SSLV23_PADDING padding type 4357b6174a Refactor rsa_test 55869f594f Test that X509_issuer_and_serial_hash doesn't crash 8130d654d1 Fix Null pointer deref in X509_issuer_and_serial_hash() c9e955dd50 Do not match RFC 5114 groups without q as it is significant 62829f9f26 README-ENGINES: fix the link to the provider API README 9dc9c7f2d7 Document the newly added function EVP_PKEY_param_check_quick() 0217e53e33 Fix the dhparam_check test 899e25643d Implement EVP_PKEY_param_check_quick() and use it in libssl aee73562d1 Run DH_check_ex() not DH_check_params_ex() when checking params 93e43f4c47 RSA: avoid dereferencing possibly-NULL parameter in initializers 63ae847679 x509_vfy: remove redundant stack allocation 99c166a1b0 Add docs for ASN1_item_sign and ASN1_item_verify functions Build log ended with (last 100 lines): ../../../../../enable-fuzz-afl/util/wrap.pl ../../../../../enable-fuzz-afl/apps/openssl cmp -config ../Mock/test.cnf -section 'Mock enrollment' -certout ../../../../../enable-fuzz-afl/test-runs/test_cmp_http/test.cert.pem -proxy '' -no_proxy 127.0.0.1 -cmd ir -newkey new.key -newkeypass 'pass:' -popo -1 -certout ../../../../../enable-fuzz-afl/test-runs/test_cmp_http/test.certout_popo5.pem -out_trusted root.crt => 0 not ok 47 - popo NONE # -- # Failed test 'popo NONE' # at ../openssl/test/recipes/80-test_cmp_http.t line 145. # cmp_main:../openssl/apps/cmp.c:2687:CMP info: using section(s) 'Mock enrollment' of OpenSSL configuration file '../Mock/test.cnf' # opt_str:../openssl/apps/cmp.c:2286:CMP warning: argument of -proxy option is empty string, resetting option # warn_cert_msg:../openssl/apps/cmp.c:694:CMP warning: certificate from 'trusted.crt' with subject '/O=openssl_cmp' is not a CA cert # setup_client_ctx:../openssl/apps/cmp.c:2003:CMP info: will contact http://127.0.0.1:1700/pkix/ # send_receive_check:../openssl/crypto/cmp/cmp_client.c:165:CMP info: sending IR # send_receive_check:../openssl/crypto/cmp/cmp_client.c:183:CMP info: received IP # send_receive_check:../openssl/crypto/cmp/cmp_client.c:165:CMP info: sending CERTCONF # send_receive_check:../openssl/crypto/cmp/cmp_client.c:183:CMP info: received PKICONF # save_free_certs:../openssl/apps/cmp.c:2053:CMP info: received 1 enrolled certificate(s), saving to file '../../../../../enable-fuzz-afl/test-runs/test_cmp_http/test.certout_popo6.pem' ../../../../../enable-fuzz-afl/util/wrap.pl ../../../../../enable-fuzz-afl/apps/openssl cmp -config ../Mock/test.cnf -section 'Mock enrollment' -certout ../../../../../enable-fuzz-afl/test-runs/test_cmp_http/test.cert.pem -proxy '' -no_proxy 127.0.0.1 -cmd ir -newkey new.key -newkeypass 'pass:' -popo 2 -certout ../../../../../enable-fuzz-afl/test-runs/test_cmp_http/test.certout_popo6.pem -out_trusted root.crt => 0 not ok 48 - popo KEYENC not supported # -- # Looks like you failed 3 tests of 92. not ok 5 - CMP app CLI Mock enrollment # -- # # Failed test 'CMP app CLI Mock enrollment # ' # at /home/openssl/run-checker/enable-fuzz-afl/../openssl/util/perl/OpenSSL/Test.pm line 1335. # Looks like you failed 3 tests of 5.80-test_cmp_http.t . Dubious, test returned 3 (wstat
[openssl] OpenSSL_1_1_1-stable update
The branch OpenSSL_1_1_1-stable has been updated
via a12c6442f24a32867c971b6feb5db61d01b02c1f (commit)
via b6de54b2c1062f15819174784d9bd53c85c432d3 (commit)
from 01cf4f868e08f82daa16d049fa7d241d8089c8d8 (commit)
- Log -
commit a12c6442f24a32867c971b6feb5db61d01b02c1f
Author: John Baldwin
Date: Thu Jan 7 14:09:41 2021 -0800
Close /dev/crypto file descriptor after CRIOGET ioctl().
Reviewed-by: Matt Caswell
Reviewed-by: Ben Kaduk
(cherry picked from commit 3ddf44ea5a2c1c8c55f4f4072a611791c79d4e7c)
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/13853)
commit b6de54b2c1062f15819174784d9bd53c85c432d3
Author: John Baldwin
Date: Fri Nov 20 17:07:35 2020 -0800
Use CRIOGET to fetch a crypto descriptor when present.
FreeBSD's current /dev/crypto implementation requires that consumers
clone a separate file descriptor via the CRIOGET ioctl that can then
be used with other ioctls such as CIOCGSESSION.
Reviewed-by: Matt Caswell
Reviewed-by: Ben Kaduk
(cherry picked from commit b39c215decf6e68c28cb64dcfaf5ae5a7e8d35b4)
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/13853)
---
Summary of changes:
crypto/engine/eng_devcrypto.c | 15 ++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/crypto/engine/eng_devcrypto.c b/crypto/engine/eng_devcrypto.c
index 49e9ce1af3..997271e150 100644
--- a/crypto/engine/eng_devcrypto.c
+++ b/crypto/engine/eng_devcrypto.c
@@ -758,8 +758,9 @@ static int devcrypto_unload(ENGINE *e)
void engine_load_devcrypto_int()
{
ENGINE *e = NULL;
+int fd;
-if ((cfd = open("/dev/crypto", O_RDWR, 0)) < 0) {
+if ((fd = open("/dev/crypto", O_RDWR, 0)) < 0) {
#ifndef ENGINE_DEVCRYPTO_DEBUG
if (errno != ENOENT)
#endif
@@ -767,6 +768,18 @@ void engine_load_devcrypto_int()
return;
}
+#ifdef CRIOGET
+if (ioctl(fd, CRIOGET, ) < 0) {
+fprintf(stderr, "Could not create crypto fd: %s\n", strerror(errno));
+close(fd);
+cfd = -1;
+return;
+}
+close(fd);
+#else
+cfd = fd;
+#endif
+
if ((e = ENGINE_new()) == NULL
|| !ENGINE_set_destroy_function(e, devcrypto_unload)) {
ENGINE_free(e);
Build completed: openssl master.39985
Build openssl master.39985 completed Commit 231f9ee155 by Pauli on 2/18/2021 12:32 AM: fixup! doc: wording change in OSSL_ENCODER.pod Configure your notification preferences
Build failed: openssl master.39984
Build openssl master.39984 failed Commit 32af6c0a63 by Pauli on 2/17/2021 11:16 PM: provider: add OSSL_PROVIDER_load_leave_fallbacks() call. Configure your notification preferences
[openssl] master update
The branch master has been updated via 458d168cd48ab57ffd8e6c8322073e4a77d03d26 (commit) via 125107e8ea9110e9cfae493a27b58f8704d390e9 (commit) from 70793dbbb983b0f95da30b79e8c8744289062499 (commit) - Log - commit 458d168cd48ab57ffd8e6c8322073e4a77d03d26 Author: Georg Höllrigl Date: Fri Feb 12 19:26:20 2021 +0100 rfc2606 compliant example domains for x509v3_config.pod Reviewed-by: Ben Kaduk Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/14210) commit 125107e8ea9110e9cfae493a27b58f8704d390e9 Author: georg-x Date: Fri Feb 12 19:15:00 2021 +0100 Various improvements of doc/man5/x509v3_config.pod include is the better word Co-authored-by: kaduk Reviewed-by: Ben Kaduk Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/14210) --- Summary of changes: doc/man5/x509v3_config.pod | 36 ++-- 1 file changed, 22 insertions(+), 14 deletions(-) diff --git a/doc/man5/x509v3_config.pod b/doc/man5/x509v3_config.pod index 134051da9a..f8bc6d0ff1 100644 --- a/doc/man5/x509v3_config.pod +++ b/doc/man5/x509v3_config.pod @@ -79,8 +79,8 @@ section. In this example: subjectAltName = @alt_section [alt_section] - email = steve@here - email = steve@there + email = st...@example.com + email = st...@example.org will only recognize the last value. To specify multiple values append a numeric identifier, as shown here: @@ -89,8 +89,8 @@ numeric identifier, as shown here: subjectAltName = @alt_section [alt_section] - email.1 = steve@here - email.2 = steve@there + email.1 = st...@example.com + email.2 = st...@example.org The syntax of raw extensions is defined by the source code that parses the extension but should be documened. @@ -237,13 +237,13 @@ using the syntax in L. Examples: - subjectAltName = email:copy, email:my@other.address, URI:http://my.url.here/ + subjectAltName = email:copy, email:m...@example.com, URI:http://my.example.com/ subjectAltName = IP:192.168.7.1 subjectAltName = IP:13::17 - subjectAltName = email:my@other.address, RID:1.2.3.4 + subjectAltName = email:m...@example.com, RID:1.2.3.4 subjectAltName = otherName:1.2.3.4;UTF8:some other identifier @@ -284,9 +284,17 @@ B, where B is an object identifier (although only a few values are well-known) and B has the same syntax as subject alternative name (except that B is not supported). +Possible values for access_id include B (OCSP responder), +B (CA Issuers), +B (AD Time Stamping), +B (ad dvcs), +B (CA Repository). + Examples: - authorityInfoAccess = OCSP;URI:http://ocsp.my.host/ + authorityInfoAccess = OCSP;URI:http://ocsp.example.com/,caIssuers;URI:http://myca.example.com/ca.cer + + authorityInfoAccess = OCSP;URI:http://ocsp.example.com/ =head2 CRL distribution points @@ -330,9 +338,9 @@ Only one of B or B should be specified. Simple examples: - crlDistributionPoints = URI:http://myhost.com/myca.crl + crlDistributionPoints = URI:http://example.com/myca.crl - crlDistributionPoints = URI:http://my.com/my.crl, URI:http://oth.com/my.crl + crlDistributionPoints = URI:http://example.com/myca.crl, URI:http://example.org/my.crl Full distribution point example: @@ -340,7 +348,7 @@ Full distribution point example: crlDistributionPoints = crldp1_section [crldp1_section] - fullname = URI:http://myhost.com/myca.crl + fullname = URI:http://example.com/myca.crl CRLissuer = dirName:issuer_sect reasons = keyCompromise, CACompromise @@ -386,7 +394,7 @@ Example: issuingDistributionPoint = critical, @idp_section [idp_section] - fullname = URI:http://myhost.com/myca.crl + fullname = URI:http://example.com/myca.crl indirectCRL = TRUE onlysomereasons = keyCompromise, CACompromise @@ -429,8 +437,8 @@ Example: [polsect] policyIdentifier = 1.3.5.8 - CPS.1 = "http://my.host.name/; - CPS.2 = "http://my.your.name/; + CPS.1 = "http://my.host.example.com/; + CPS.2 = "http://my.your.example.com/; userNotice.1 = @notice [notice] @@ -475,7 +483,7 @@ Examples: nameConstraints = permitted;IP:192.168.0.0/255.255.0.0 - nameConstraints = permitted;email:.somedomain.com + nameConstraints = permitted;email:.example.com nameConstraints = excluded;email:.com
[openssl] master update
The branch master has been updated
via 70793dbbb983b0f95da30b79e8c8744289062499 (commit)
via 3a2171f6aa0f72ca95210fa80d92214315d1e744 (commit)
from 3262300a2c2351c6706f37b89fef015430988a31 (commit)
- Log -
commit 70793dbbb983b0f95da30b79e8c8744289062499
Author: Matt Caswell
Date: Sat Feb 13 14:24:15 2021 +
Pass the object type and data structure from the pem2der decoder
The pem2der decoder can infer certain information about the endoded der
data based on the PEM headers. This information should be passed to the
next decoders in the chain to ensure we end up loading the correct type of
thing.
Reviewed-by: Richard Levitte
(Merged from https://github.com/openssl/openssl/pull/14191)
commit 3a2171f6aa0f72ca95210fa80d92214315d1e744
Author: Matt Caswell
Date: Thu Feb 11 16:32:58 2021 +
Don't forget the type of thing we are loading
The apps helper function load_key_certs_crls() is a general purpose
function for loading different types of objects from a given URI. It
sets up an OSSL_STORE and calls OSSL_STORE_expect() so that the store
knows what type of thing to expect to load. Unfortunately this wasn't
working and was always setting "expect" to 0 - which means "anything".
Fixes #13709
Reviewed-by: Richard Levitte
(Merged from https://github.com/openssl/openssl/pull/14191)
---
Summary of changes:
apps/lib/apps.c| 37 +
crypto/store/store_result.c| 10 +++-
.../implementations/encode_decode/decode_pem2der.c | 64 +-
test/recipes/20-test_cli_fips.t| 59
4 files changed, 132 insertions(+), 38 deletions(-)
diff --git a/apps/lib/apps.c b/apps/lib/apps.c
index f53f1b2003..7c1015737d 100644
--- a/apps/lib/apps.c
+++ b/apps/lib/apps.c
@@ -730,11 +730,11 @@ int load_key_certs_crls(const char *uri, int maybe_stdin,
return 0;
}
-if (pcerts != NULL && *pcerts == NULL
-&& (*pcerts = sk_X509_new_null()) == NULL) {
-BIO_printf(bio_err, "Out of memory loading");
-goto end;
-} else {
+if (pcerts != NULL) {
+if (*pcerts == NULL && (*pcerts = sk_X509_new_null()) == NULL) {
+BIO_printf(bio_err, "Out of memory loading");
+goto end;
+}
cnt_expectations++;
expect = OSSL_STORE_INFO_CERT;
}
@@ -743,11 +743,11 @@ int load_key_certs_crls(const char *uri, int maybe_stdin,
cnt_expectations++;
expect = OSSL_STORE_INFO_CRL;
}
-if (pcrls != NULL && *pcrls == NULL
-&& (*pcrls = sk_X509_CRL_new_null()) == NULL) {
-BIO_printf(bio_err, "Out of memory loading");
-goto end;
-} else {
+if (pcrls != NULL) {
+if (*pcrls == NULL && (*pcrls = sk_X509_CRL_new_null()) == NULL) {
+BIO_printf(bio_err, "Out of memory loading");
+goto end;
+}
cnt_expectations++;
expect = OSSL_STORE_INFO_CRL;
}
@@ -787,8 +787,21 @@ int load_key_certs_crls(const char *uri, int maybe_stdin,
OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
int type, ok = 1;
-if (info == NULL)
-break;
+/*
+ * This can happen (for example) if we attempt to load a file with
+ * multiple different types of things in it - but the thing we just
+ * tried to load wasn't one of the ones we wanted, e.g. if we're trying
+ * to load a certificate but the file has both the private key and the
+ * certificate in it. We just retry until eof.
+ */
+if (info == NULL) {
+if (OSSL_STORE_error(ctx)) {
+ERR_print_errors(bio_err);
+ERR_clear_error();
+}
+continue;
+}
+
type = OSSL_STORE_INFO_get_type(info);
switch (type) {
case OSSL_STORE_INFO_PKEY:
diff --git a/crypto/store/store_result.c b/crypto/store/store_result.c
index b79126e1cb..64b0e814b3 100644
--- a/crypto/store/store_result.c
+++ b/crypto/store/store_result.c
@@ -62,6 +62,7 @@
struct extracted_param_data_st {
int object_type;
const char *data_type;
+const char *data_structure;
const char *utf8_data;
const void *octet_data;
size_t octet_data_size;
@@ -128,6 +129,10 @@ int ossl_store_handle_load_result(const OSSL_PARAM
params[], void *arg)
_data.octet_data_size)
&& !OSSL_PARAM_get_utf8_string_ptr(p, _data.utf8_data))
return 0;
+p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA_STRUCTURE);
+if (p != NULL
+&& !OSSL_PARAM_get_utf8_string_ptr(p, _data.data_structure))
+return 0;
p =
[openssl] master update
The branch master has been updated
via 3262300a2c2351c6706f37b89fef015430988a31 (commit)
via 247a1786e25dbf77548168572e383d57aa743af4 (commit)
from c1be4d617cf9435e8326ebba643aa4d7cbcb3645 (commit)
- Log -
commit 3262300a2c2351c6706f37b89fef015430988a31
Author: Richard Levitte
Date: Sat Feb 13 06:49:05 2021 +0100
Adjust the few places where the string length was confused
Reviewed-by: Tomas Mraz
(Merged from https://github.com/openssl/openssl/pull/14168)
commit 247a1786e25dbf77548168572e383d57aa743af4
Author: Richard Levitte
Date: Fri Feb 12 20:30:40 2021 +0100
OSSL_PARAM: Correct the assumptions on the UTF8 string length
When the string "ABCDEFGH" is passed, what's considered its data, this?
{ 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H' }
or this?
{ 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', '\0' }
If it's passed as a pass phrase, should the terminating NUL byte be
considered part of the pass phrase, or not?
Our treatment of OSSL_PARAMs with the data type OSSL_PARAM_UTF8_STRING
set the length of the string to include the terminating NUL byte,
which is quite confusing. What should the recipient of such a string
believe?
Instead of perpetuating this confusion, we change the assumption to
set the OSSL_PARAM to the length of the string, not including the
terminating NUL byte, thereby giving it the same value as a strlen()
call would give.
Reviewed-by: Tomas Mraz
(Merged from https://github.com/openssl/openssl/pull/14168)
---
Summary of changes:
crypto/params.c| 57 +++---
doc/man3/OSSL_PARAM.pod| 7
doc/man3/OSSL_PARAM_int.pod| 20 +
doc/man7/EVP_KDF-SSHKDF.pod| 2 +-
providers/fips/self_test.c | 3 +-
providers/implementations/rands/drbg_ctr.c | 10 +++--
test/evp_kdf_test.c| 19 -
test/params_api_test.c | 5 ++-
test/params_test.c | 66 +++---
9 files changed, 113 insertions(+), 76 deletions(-)
diff --git a/crypto/params.c b/crypto/params.c
index e28affe708..a3263e93c3 100644
--- a/crypto/params.c
+++ b/crypto/params.c
@@ -1070,15 +1070,21 @@ OSSL_PARAM OSSL_PARAM_construct_double(const char *key,
double *buf)
return ossl_param_construct(key, OSSL_PARAM_REAL, buf, sizeof(double));
}
-static int get_string_internal(const OSSL_PARAM *p, void **val, size_t max_len,
- size_t *used_len, unsigned int type)
+static int get_string_internal(const OSSL_PARAM *p, void **val,
+ size_t *max_len, size_t *used_len,
+ unsigned int type)
{
-size_t sz;
+size_t sz, alloc_sz;
if ((val == NULL && used_len == NULL) || p == NULL || p->data_type != type)
return 0;
sz = p->data_size;
+/*
+ * If the input size is 0, or the input string needs NUL byte
+ * termination, allocate an extra byte.
+ */
+alloc_sz = sz + (type == OSSL_PARAM_UTF8_STRING || sz == 0);
if (used_len != NULL)
*used_len = sz;
@@ -1090,16 +1096,15 @@ static int get_string_internal(const OSSL_PARAM *p,
void **val, size_t max_len,
return 1;
if (*val == NULL) {
-char *const q = OPENSSL_malloc(sz > 0 ? sz : 1);
+char *const q = OPENSSL_malloc(alloc_sz);
if (q == NULL)
return 0;
*val = q;
-if (sz != 0)
-memcpy(q, p->data, sz);
-return 1;
+*max_len = alloc_sz;
}
-if (max_len < sz)
+
+if (*max_len < sz)
return 0;
memcpy(*val, p->data, sz);
return 1;
@@ -1107,14 +1112,35 @@ static int get_string_internal(const OSSL_PARAM *p,
void **val, size_t max_len,
int OSSL_PARAM_get_utf8_string(const OSSL_PARAM *p, char **val, size_t max_len)
{
-return get_string_internal(p, (void **)val, max_len, NULL,
- OSSL_PARAM_UTF8_STRING);
+int ret = get_string_internal(p, (void **)val, _len, NULL,
+ OSSL_PARAM_UTF8_STRING);
+
+/*
+ * We try to ensure that the copied string is terminated with a
+ * NUL byte. That should be easy, just place a NUL byte at
+ * |((char*)*val)[p->data_size]|.
+ * Unfortunately, we have seen cases where |p->data_size| doesn't
+ * correctly reflect the length of the string, and just happens
+ * to be out of bounds according to |max_len|, so in that case, we
+ * make the extra step of trying to find the true length of the
+ * string that |p->data| points at, and use that as an index to
+ * place the NUL byte in |*val|.
+ */
+size_t
[openssl] master update
The branch master has been updated
via c1be4d617cf9435e8326ebba643aa4d7cbcb3645 (commit)
via daf1300b80443b6bf0dec19085056ec407925d89 (commit)
from 937984efc6ed1664e5aeb0e06067d31520066960 (commit)
- Log -
commit c1be4d617cf9435e8326ebba643aa4d7cbcb3645
Author: Dr. David von Oheimb
Date: Wed Feb 17 12:29:39 2021 +0100
Rename internal X509_add_cert_new() to ossl_x509_add_cert_new()
Reviewed-by: Tomas Mraz
(Merged from https://github.com/openssl/openssl/pull/14039)
commit daf1300b80443b6bf0dec19085056ec407925d89
Author: Dr. David von Oheimb
Date: Wed Dec 23 16:06:05 2020 +0100
Add internal X509_add_certs_new(), which simplifies matters
Reviewed-by: Tomas Mraz
(Merged from https://github.com/openssl/openssl/pull/14039)
---
Summary of changes:
crypto/cmp/cmp_ctx.c | 16 ++--
crypto/cmp/cmp_local.h | 1 +
crypto/cmp/cmp_msg.c | 12
crypto/cmp/cmp_protect.c | 17 ++---
crypto/cmp/cmp_util.c | 8 +++-
crypto/cmp/cmp_vfy.c | 1 -
crypto/cms/cms_lib.c | 4 ++--
crypto/cms/cms_sd.c| 6 +++---
crypto/ocsp/ocsp_cl.c | 2 +-
crypto/ocsp/ocsp_local.h | 2 +-
crypto/ocsp/ocsp_srv.c | 2 +-
crypto/ocsp/ocsp_vfy.c | 4
crypto/pkcs12/p12_kiss.c | 4 ++--
crypto/pkcs7/pk7_lib.c | 2 +-
crypto/x509/x509_cmp.c | 23 +--
crypto/x509/x509_vfy.c | 2 +-
include/crypto/x509.h | 4 +++-
test/helpers/cmp_testlib.h | 1 -
18 files changed, 52 insertions(+), 59 deletions(-)
diff --git a/crypto/cmp/cmp_ctx.c b/crypto/cmp/cmp_ctx.c
index 26274611a8..e65dabe323 100644
--- a/crypto/cmp/cmp_ctx.c
+++ b/crypto/cmp/cmp_ctx.c
@@ -12,7 +12,6 @@
#include
#include
#include /* for OCSP_REVOKED_STATUS_* */
-#include "crypto/x509.h" /* for x509v3_cache_extensions() */
#include "cmp_local.h"
@@ -65,15 +64,14 @@ STACK_OF(X509) *OSSL_CMP_CTX_get0_untrusted(const
OSSL_CMP_CTX *ctx)
*/
int OSSL_CMP_CTX_set1_untrusted(OSSL_CMP_CTX *ctx, STACK_OF(X509) *certs)
{
-STACK_OF(X509) *untrusted;
+STACK_OF(X509) *untrusted = NULL;
+
if (ctx == NULL) {
ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
return 0;
}
-if ((untrusted = sk_X509_new_null()) == NULL)
-return 0;
-if (X509_add_certs(untrusted, certs,
- X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP) != 1)
+if (!ossl_x509_add_certs_new(, certs,
+ X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
goto err;
sk_X509_pop_free(ctx->untrusted, X509_free);
ctx->untrusted = untrusted;
@@ -731,10 +729,8 @@ int OSSL_CMP_CTX_build_cert_chain(OSSL_CMP_CTX *ctx,
X509_STORE *own_trusted,
return 0;
}
-if (ctx->untrusted != NULL ?
-!X509_add_certs(ctx->untrusted, candidates,
-X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP) :
-!OSSL_CMP_CTX_set1_untrusted(ctx, candidates))
+if (!ossl_x509_add_certs_new(>untrusted, candidates,
+ X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
return 0;
ossl_cmp_debug(ctx, "trying to build chain for own CMP signer cert");
diff --git a/crypto/cmp/cmp_local.h b/crypto/cmp/cmp_local.h
index c615865864..a4d3cf9ea4 100644
--- a/crypto/cmp/cmp_local.h
+++ b/crypto/cmp/cmp_local.h
@@ -23,6 +23,7 @@
# include
# include
# include
+# include "crypto/x509.h"
/*
* this structure is used to store the context for CMP sessions
diff --git a/crypto/cmp/cmp_msg.c b/crypto/cmp/cmp_msg.c
index 4e94d5c1fd..36256b3d1d 100644
--- a/crypto/cmp/cmp_msg.c
+++ b/crypto/cmp/cmp_msg.c
@@ -19,7 +19,6 @@
#include
#include
#include
-#include "crypto/x509.h" /* for x509_set0_libctx() */
OSSL_CMP_PKIHEADER *OSSL_CMP_MSG_get0_header(const OSSL_CMP_MSG *msg)
{
@@ -466,13 +465,10 @@ OSSL_CMP_MSG *ossl_cmp_certrep_new(OSSL_CMP_CTX *ctx, int
bodytype,
if (bodytype == OSSL_CMP_PKIBODY_IP && caPubs != NULL
&& (repMsg->caPubs = X509_chain_up_ref(caPubs)) == NULL)
goto err;
-if (sk_X509_num(chain) > 0) {
-msg->extraCerts = sk_X509_new_reserve(NULL, sk_X509_num(chain));
-if (msg->extraCerts == NULL
-|| !X509_add_certs(msg->extraCerts, chain,
- X509_ADD_FLAG_UP_REF |
X509_ADD_FLAG_NO_DUP))
-goto err;
-}
+if (sk_X509_num(chain) > 0
+&& !ossl_x509_add_certs_new(>extraCerts, chain,
+X509_ADD_FLAG_UP_REF |
X509_ADD_FLAG_NO_DUP))
+goto err;
if (!unprotectedErrors
|| ossl_cmp_pkisi_get_status(si) != OSSL_CMP_PKISTATUS_rejection)
diff --git a/crypto/cmp/cmp_protect.c b/crypto/cmp/cmp_protect.c
index fce2ebc468..dcc0232e01 100644
---
[web] master update
The branch master has been updated via 534023923c6dc5b0d26ea9a1fd28456f80afd311 (commit) from 5db03e20c8e936a62f1ee71b7178b4844c5ad838 (commit) - Log - commit 534023923c6dc5b0d26ea9a1fd28456f80afd311 Author: Matt Caswell Date: Thu Feb 18 15:16:04 2021 + Update newsflash for 3.0 alpha 12 release Reviewed-by: Mark J. Cox Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/web/pull/220) --- Summary of changes: news/newsflash.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/news/newsflash.txt b/news/newsflash.txt index 16f4f7c..89e7ae8 100644 --- a/news/newsflash.txt +++ b/news/newsflash.txt @@ -5,6 +5,7 @@ # headings. URL paths must all be absolute. Date: Item +18-Feb-2021: Alpha 12 of OpenSSL 3.0 is now available: please download and test it 16-Feb-2021: OpenSSL 1.1.1j is now available, including bug and security fixes 28-Jan-2021: Alpha 11 of OpenSSL 3.0 is now available: please download and test it 07-Jan-2021: Alpha 10 of OpenSSL 3.0 is now available: please download and test it
[openssl] openssl-3.0.0-alpha12 create
The annotated tag openssl-3.0.0-alpha12 has been created
at ba908b36f412d1a4a26aefee3841e276c09b5413 (tag)
tagging b467d394eb11ac94500d9f003426f5fa75d60c3c (commit)
replaces openssl-3.0.0-alpha11
tagged by Matt Caswell
on Thu Feb 18 15:08:54 2021 +
- Log -
OpenSSL 3.0.0-alpha12 release tag
-BEGIN PGP SIGNATURE-
iQFFBAABCAAvFiEEhlersmDwVrHlGQg52cTSbQ5gRJEFAmAugwYRHG1hdHRAb3Bl
bnNzbC5vcmcACgkQ2cTSbQ5gRJEqoggAq+1HjMo/su4rXEcxn6kH3kRMJUNKe887
tky9dlzVjCJH7cWQm8tVGlmcvqmYqXvW0Wj2oImKWlrFifcIhQcrhmtw/hDHLd5l
zaf/yrILs19B8zenw9gCKEQe1TY2JJ6YorvVXE8GtdgaOl+JMM6LSC69Js+m9Ffl
ij7NxZJYGEcdPNlWjdf0kdy5WrrGU7SO4vpKe983LvNWsd8TaOFCghPCruSgpg72
tkFMtoRQeng1ukBivOQf2GTrlzL8OQ9+I7OX4gCh7/WN228uOVaRU23Bot5EP1nR
+qkyox8L32zbvivlzEWB+5kq3VSjbLWf5LRhkc50jumwDM00LkyZuQ==
=oN+j
-END PGP SIGNATURE-
Armin Fuerst (1):
apps/ca: Properly handle certificate expiration times in do_updatedb
Beat Bolli (1):
README-ENGINES: fix the link to the provider API README
Benjamin Kaduk (3):
Remove unused 'peer_type' from SSL_SESSION
x509_vfy: remove redundant stack allocation
RSA: avoid dereferencing possibly-NULL parameter in initializers
Daniel Bevenius (1):
EVP: fix keygen for EVP_PKEY_RSA_PSS
Disconnect3d (1):
passwd.c: use the actual ROUNDS_DEFAULT macro
Dmitry Belyavskiy (2):
DH/DHX parameter check using pkeyparam
DSA parameter check using pkeyparam
Dr. David von Oheimb (28):
obj_xref: rsassaPss must map to 'undef rsassaPss' (not 'undef
rsaEncryption')
Fix rsa_pss_asn1_meth to refert to rsa_sig_info_set
check_sig_alg_match(): weaken sig nid comparison to allow RSA{,PSS} key
verify RSA-PSS
OSSL_HTTP_REQ_CTX_nbio(): Revert to having state var that keeps req len
still to send
Fix not backwards-compat X509_http_nbio() and X509_CRL_http_nbio()
HTTP: Fix mistakes and unclarities on maxline and max_resp_len params
HTTP: add more error detection to low-level API
Constify OSSL_HTTP_REQ_CTX_get0_mem_bio()
OSSL_HTTP_REQ_CTX.pod and OSSL_HTTP_transfer.pod: various improvements
openssl.pod: Add documentation for using the loader_attic engine
apps/cmp.c: check and exit on engine load error
test/recipes: split 81_test_cmp_cli.t, add test using -engine loader_attic
run_tests.pl: Improve diagnostics on the use of HARNESS_JOBS
Allow NULL arg to OPENSSL_sk_{dup,deep_copy} returning empty stack
x509_vfy.c: Improve coding style and comments all over the file
Add X509_STORE_CTX_verify(), which takes the first untrusted cert as
default target
mknum.pl: Exclude duplicate entries and include source file name in
diagnostics
x509_vfy.c: Fix various coding style and documentation style nits
x509_vfy: Clarify relevance of ctx->error also on successful verification
X509_get_pubkey_parameters(): Correct failure behavior and its use
x509_vfy.c: Sort out return values 0 vs. -1 (failure/internal error)
x509_vfy.c: Make chain_build() error diagnostics to the point
X509_STORE_CTX_get1_issuer(): Make preference on expired certs consistent
with find_issuer()
X509_STORE_CTX_cleanup(): Use internally so no need to call explicitly
apps/ca.c: Make sure ext_ctx structure gets initialized
apps/cmp.c: Improve initialization of ext_ctx structure w.r.t. CSR
x509_vfy: fix mem leaks in chain_build() on malloc error Coverify CID
1473068
chain_build(): Call verify_cb_cert() if a preliminary error has become
final
Dr. Matthias St. Pierre (6):
Add some missing committers to the AUTHORS list
Revise some renamings of NOTES and README files
Reformat some NOTES and README files
Unify the markdown links to the NOTES and README files
Add deprecation note to the README-ENGINES file
Add a skeleton README-PROVIDERS file
FdaSilvaYY (3):
include/crypto: add a few missing #pragma once directives
include/openssl: add a few missing #pragma once directives
include/internal: add a few missing #pragma once directives
Jay Satiro (1):
NOTES-WINDOWS: fix typo
Job Snijders (2):
Add some PKIX-RPKI objects
Add OID for draft-ietf-opsawg-finding-geofeeds detached CMS signature
Jon Spillett (1):
Switch to BIO_snprintf to avoid missing symbol problems on Windows
Juergen Christ (3):
Fix cipher reinit on s390x if no key is specified
Fix parameter types in sshkdf
Remove superfluous EVP_KDF_CTRL_ defines.
KOBAYASHI Ittoku (1):
Match description with actual output of dgst
Matt Caswell (38):
Ensure EC keys with a private key but without a public key can be created
Test that EC keys without a public key in them work as expected
Add a multi-thread test for shared EVP_PKEYs
Refactor RAND_get0_primary() locking
Avoid races by caching exported
[openssl] master update
The branch master has been updated via 937984efc6ed1664e5aeb0e06067d31520066960 (commit) via b467d394eb11ac94500d9f003426f5fa75d60c3c (commit) from a28d06f3e9cbc5594c7985c99a0c6bac5261ae67 (commit) - Log - commit 937984efc6ed1664e5aeb0e06067d31520066960 Author: Matt Caswell Date: Thu Feb 18 15:09:04 2021 + Prepare for 3.0 alpha 13 Reviewed-by: Tomas Mraz commit b467d394eb11ac94500d9f003426f5fa75d60c3c Author: Matt Caswell Date: Thu Feb 18 15:08:53 2021 + Prepare for release of 3.0 alpha 12 Reviewed-by: Tomas Mraz --- Summary of changes: VERSION.dat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION.dat b/VERSION.dat index a39467470d..e54cbf764d 100644 --- a/VERSION.dat +++ b/VERSION.dat @@ -1,7 +1,7 @@ MAJOR=3 MINOR=0 PATCH=0 -PRE_RELEASE_TAG=alpha12-dev +PRE_RELEASE_TAG=alpha13-dev BUILD_METADATA= RELEASE_DATE="" SHLIB_VERSION=3
Build failed: openssl master.39979
Build openssl master.39979 failed Commit aa243be496 by Rich Salz on 2/17/2021 9:15 PM: Fetch and free cipher and md's Configure your notification preferences
Build failed: openssl master.39977
Build openssl master.39977 failed Commit f7c68603fd by Rich Salz on 2/17/2021 7:42 PM: Avoid inifinite loop, use define not enums. Configure your notification preferences
[openssl] master update
The branch master has been updated
via 7b676cc8c60823570e283fbe325b263670c6ccc2 (commit)
via 47c076acfc5debbae386c552bdb423e832042ae7 (commit)
from bcb61b39b47419b9de1dbc37cd2f67b71eeb23ea (commit)
- Log -
commit 7b676cc8c60823570e283fbe325b263670c6ccc2
Author: Shane Lontis
Date: Wed Feb 17 20:01:34 2021 +1000
Fix external symbols related to provider related security checks for
keys and digests.
Partial fix for #12964
This adds ossl_ names for the following symbols:
digest_get_approved_nid, digest_get_approved_nid_with_sha1
digest_is_allowed, digest_md_to_nid, digest_rsa_sign_get_md_nid,
securitycheck_enabled,
dh_check_key, dsa_check_key, ec_check_key,
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/14211)
commit 47c076acfc5debbae386c552bdb423e832042ae7
Author: Shane Lontis
Date: Wed Feb 17 19:56:35 2021 +1000
Fix external symbols in the provider digest implementations.
Partial fix for #12964
This adds ossl_ names for the following symbols:
blake2b512_init,blake2b_final,blake2b_init,blake2b_init_key,
blake2b_param_init,blake2b_param_set_digest_length,blake2b_param_set_key_length,
blake2b_param_set_personal,blake2b_param_set_salt,blake2b_update,
blake2s256_init,blake2s_final,blake2s_init,blake2s_init_key,
blake2s_param_init,blake2s_param_set_digest_length,blake2s_param_set_key_length,
blake2s_param_set_personal,blake2s_param_set_salt,blake2s_update,
digest_default_get_params,digest_default_gettable_params
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/14211)
---
Summary of changes:
crypto/evp/legacy_blake2.c | 8 ++--
providers/common/digest_to_nid.c | 6 +--
providers/common/include/prov/securitycheck.h | 18
providers/common/securitycheck.c | 26 ++--
providers/common/securitycheck_default.c | 9 ++--
providers/common/securitycheck_fips.c | 10 ++---
providers/implementations/digests/blake2_prov.c| 22 +-
providers/implementations/digests/blake2b_prov.c | 23 +-
providers/implementations/digests/blake2s_prov.c | 23 +-
providers/implementations/digests/digestcommon.c | 6 +--
providers/implementations/exchange/dh_exch.c | 4 +-
providers/implementations/exchange/ecdh_exch.c | 6 +--
providers/implementations/include/prov/blake2.h| 49 --
.../implementations/include/prov/digestcommon.h| 26 ++--
providers/implementations/macs/blake2b_mac.c | 16 +++
providers/implementations/macs/blake2s_mac.c | 16 +++
providers/implementations/signature/dsa.c | 4 +-
providers/implementations/signature/ecdsa.c| 4 +-
providers/implementations/signature/rsa.c | 4 +-
19 files changed, 147 insertions(+), 133 deletions(-)
diff --git a/crypto/evp/legacy_blake2.c b/crypto/evp/legacy_blake2.c
index e03403406f..22765aca0d 100644
--- a/crypto/evp/legacy_blake2.c
+++ b/crypto/evp/legacy_blake2.c
@@ -11,11 +11,11 @@
#include "prov/blake2.h"/* diverse BLAKE2 macros */
#include "legacy_meth.h"
-#define blake2b_init blake2b512_init
-#define blake2s_init blake2s256_init
+#define ossl_blake2b_init ossl_blake2b512_init
+#define ossl_blake2s_init ossl_blake2s256_init
-IMPLEMENT_LEGACY_EVP_MD_METH_LC(blake2s_int, blake2s)
-IMPLEMENT_LEGACY_EVP_MD_METH_LC(blake2b_int, blake2b)
+IMPLEMENT_LEGACY_EVP_MD_METH_LC(blake2s_int, ossl_blake2s)
+IMPLEMENT_LEGACY_EVP_MD_METH_LC(blake2b_int, ossl_blake2b)
static const EVP_MD blake2b_md = {
NID_blake2b512,
diff --git a/providers/common/digest_to_nid.c b/providers/common/digest_to_nid.c
index 496d814173..f66b61b4fa 100644
--- a/providers/common/digest_to_nid.c
+++ b/providers/common/digest_to_nid.c
@@ -20,7 +20,7 @@
* Internal library code deals with NIDs, so we need to translate from a name.
* We do so using EVP_MD_is_a(), and therefore need a name to NID map.
*/
-int digest_md_to_nid(const EVP_MD *md, const OSSL_ITEM *it, size_t it_len)
+int ossl_digest_md_to_nid(const EVP_MD *md, const OSSL_ITEM *it, size_t it_len)
{
size_t i;
@@ -37,7 +37,7 @@ int digest_md_to_nid(const EVP_MD *md, const OSSL_ITEM *it,
size_t it_len)
* Retrieve one of the FIPs approved hash algorithms by nid.
* See FIPS 180-4 "Secure Hash Standard" and FIPS 202 - SHA-3.
*/
-int digest_get_approved_nid(const EVP_MD *md)
+int ossl_digest_get_approved_nid(const EVP_MD *md)
{
static const OSSL_ITEM name_to_nid[] = {
{ NID_sha1, OSSL_DIGEST_NAME_SHA1 },
@@ -53,5 +53,5 @@ int digest_get_approved_nid(const EVP_MD *md)
{ NID_sha3_512, OSSL_DIGEST_NAME_SHA3_512 },
};
[openssl] master update
The branch master has been updated via bcb61b39b47419b9de1dbc37cd2f67b71eeb23ea (commit) from 5d8ffebbcdf4992d3c428201b1f3330020bbe92e (commit) - Log - commit bcb61b39b47419b9de1dbc37cd2f67b71eeb23ea Author: zekeevans-mf <77804765+zekeevans...@users.noreply.github.com> Date: Thu Jan 21 12:24:51 2021 -0700 Add deep copy of propq field in mac_dupctx to avoid double free mac_dupctx() should make a copy of the propq field. Currently it does a shallow copy which can result in a double free and crash. The double free occurs when using a provider property string. For example, passing in "fips=no" to SSL_CTX_new_ex() causes the propq field to get set to that value. When mac_dupctx() and mac_freectx() is called (ie: in SSL_write()) it ends up freeing the reference of the original object instead of a copy. Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/13926) --- Summary of changes: providers/implementations/signature/mac_legacy.c | 4 1 file changed, 4 insertions(+) diff --git a/providers/implementations/signature/mac_legacy.c b/providers/implementations/signature/mac_legacy.c index 7d23e36f2b..2386583069 100644 --- a/providers/implementations/signature/mac_legacy.c +++ b/providers/implementations/signature/mac_legacy.c @@ -172,9 +172,13 @@ static void *mac_dupctx(void *vpmacctx) return NULL; *dstctx = *srcctx; +dstctx->propq = NULL; dstctx->key = NULL; dstctx->macctx = NULL; +if (srcctx->propq != NULL && (dstctx->propq = OPENSSL_strdup(srcctx->propq)) == NULL) +goto err; + if (srcctx->key != NULL && !ossl_mac_key_up_ref(srcctx->key)) goto err; dstctx->key = srcctx->key;
[openssl] master update
The branch master has been updated
via 5d8ffebbcdf4992d3c428201b1f3330020bbe92e (commit)
from 0b3139e815d3d14c4d7506488add6e02a2b682ec (commit)
- Log -
commit 5d8ffebbcdf4992d3c428201b1f3330020bbe92e
Author: Sahana Prasad
Date: Mon Jan 25 14:44:29 2021 +0100
DH: Make DH_bits(), DH_size(), and DH_security_bits() check that there are
key parameters
Fixes #13569
Signed-off-by: Sahana Prasad
Reviewed-by: Richard Levitte
Reviewed-by: Paul Dale
Reviewed-by: Dmitry Belyavskiy
(Merged from https://github.com/openssl/openssl/pull/13955)
---
Summary of changes:
crypto/dh/dh_lib.c | 12 +---
doc/man3/DH_size.pod | 9 ++---
2 files changed, 15 insertions(+), 6 deletions(-)
diff --git a/crypto/dh/dh_lib.c b/crypto/dh/dh_lib.c
index e8a66878ab..46aba02bad 100644
--- a/crypto/dh/dh_lib.c
+++ b/crypto/dh/dh_lib.c
@@ -187,12 +187,16 @@ void *DH_get_ex_data(const DH *d, int idx)
int DH_bits(const DH *dh)
{
-return BN_num_bits(dh->params.p);
+if (dh->params.p != NULL)
+return BN_num_bits(dh->params.p);
+return -1;
}
int DH_size(const DH *dh)
{
-return BN_num_bytes(dh->params.p);
+if (dh->params.p != NULL)
+return BN_num_bytes(dh->params.p);
+return -1;
}
int DH_security_bits(const DH *dh)
@@ -204,7 +208,9 @@ int DH_security_bits(const DH *dh)
N = dh->length;
else
N = -1;
-return BN_security_bits(BN_num_bits(dh->params.p), N);
+if (dh->params.p != NULL)
+return BN_security_bits(BN_num_bits(dh->params.p), N);
+return -1;
}
void DH_get0_pqg(const DH *dh,
diff --git a/doc/man3/DH_size.pod b/doc/man3/DH_size.pod
index 099c1bad3f..99e34034f2 100644
--- a/doc/man3/DH_size.pod
+++ b/doc/man3/DH_size.pod
@@ -38,11 +38,14 @@ key. See L.
=head1 RETURN VALUES
-DH_bits() returns the number of bits in the key.
+DH_bits() returns the number of bits in the key, or -1 if
+B doesn't hold any key parameters.
-DH_size() returns the prime size of Diffie-Hellman in bytes.
+DH_size() returns the prime size of Diffie-Hellman in bytes, or -1 if
+B doesn't hold any key parameters.
-DH_security_bits() returns the number of security bits.
+DH_security_bits() returns the number of security bits, or -1 if
+B doesn't hold any key parameters.
=head1 SEE ALSO
[openssl] master update
The branch master has been updated
via 0b3139e815d3d14c4d7506488add6e02a2b682ec (commit)
from ba37b82045b1b2fbcbf7580b317de5e3b52c8035 (commit)
- Log -
commit 0b3139e815d3d14c4d7506488add6e02a2b682ec
Author: Dr. David von Oheimb
Date: Thu Feb 11 21:07:14 2021 +0100
chain_build(): Call verify_cb_cert() if a preliminary error has become final
Reviewed-by: Tomas Mraz
(Merged from https://github.com/openssl/openssl/pull/14157)
---
Summary of changes:
crypto/x509/x509_vfy.c | 17 -
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index d5c09d28f4..83dddeeb3d 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -352,7 +352,7 @@ static int check_issued(ossl_unused X509_STORE_CTX *ctx,
X509 *x, X509 *issuer)
*/
if (err != X509_V_ERR_SUBJECT_ISSUER_MISMATCH)
ctx->error = err;
-return 0; /* Better call verify_cb_cert(ctx, x, ctx->error_depth, err) ? */
+return 0;
}
/*
@@ -3282,10 +3282,17 @@ static int build_chain(X509_STORE_CTX *ctx)
return 0;
case X509_TRUST_UNTRUSTED:
default:
-if (ctx->error != X509_V_OK)
-/* Callback already issued in most such cases */
-return 0;
-num = sk_X509_num(ctx->chain);
+switch(ctx->error) {
+case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
+case X509_V_ERR_CERT_NOT_YET_VALID:
+case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
+case X509_V_ERR_CERT_HAS_EXPIRED:
+return 0; /* Callback already issued by x509_check_cert_time() */
+default: /* A preliminary error has become final */
+return verify_cb_cert(ctx, NULL, num - 1, ctx->error);
+case X509_V_OK:
+break;
+}
CB_FAIL_IF(num > depth,
ctx, NULL, num - 1, X509_V_ERR_CERT_CHAIN_TOO_LONG);
CB_FAIL_IF(DANETLS_ENABLED(dane)
[openssl] master update
The branch master has been updated via ba37b82045b1b2fbcbf7580b317de5e3b52c8035 (commit) via ebcaf110b250cd55281500fa1debef806ab490f0 (commit) from e36b3c2f757cc7d68dc24174a00476104428b099 (commit) - Log - commit ba37b82045b1b2fbcbf7580b317de5e3b52c8035 Author: Tomas Mraz Date: Wed Feb 10 18:44:00 2021 +0100 dsa_check: Perform simple parameter check if seed is not available Added primality check on p and q in the ossl_ffc_params_simple_validate(). Checking for p and q sizes in the default provider is made more lenient. Added two testcases for invalid parameters. Fixes #13950 Reviewed-by: Shane Lontis (Merged from https://github.com/openssl/openssl/pull/14148) commit ebcaf110b250cd55281500fa1debef806ab490f0 Author: Dmitry Belyavskiy Date: Fri Jan 22 13:44:16 2021 +0100 DSA parameter check using pkeyparam Reviewed-by: Shane Lontis Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/14148) --- Summary of changes: crypto/dh/dh_key.c | 2 +- crypto/dsa/dsa_check.c | 19 +++-- crypto/dsa/dsa_err.c | 1 + crypto/dsa/dsa_key.c | 2 +- crypto/err/openssl.txt | 1 + crypto/ffc/ffc_params_generate.c | 10 +-- crypto/ffc/ffc_params_validate.c | 98 ++ include/crypto/dsa.h | 2 +- include/internal/ffc.h | 8 +- include/openssl/dsaerr.h | 1 + providers/implementations/keymgmt/dsa_kmgmt.c | 6 +- test/recipes/15-test_dsaparam.t| 78 + .../invalid/p2048_q256_bad_q.pem | 14 .../invalid/p768_q160_too_small.pem| 7 ++ .../valid/p1024_q160_t1862.pem | 9 ++ .../valid/p1024_q160_t1862_gind1.pem | 9 ++ .../valid/p1024_q160_t1864.pem | 9 ++ .../valid/p1024_q160_t1864_gind1.pem | 9 ++ .../valid/p1024_q224_t1862.pem | 9 ++ .../valid/p1024_q224_t1862_gind1.pem | 9 ++ .../valid/p1024_q256_t1862.pem | 9 ++ .../valid/p1024_q256_t1862_gind1.pem | 9 ++ .../valid/p2048_q160_t1862.pem | 14 .../valid/p2048_q160_t1862_gind1.pem | 14 .../valid/p2048_q224_t1862.pem | 14 .../valid/p2048_q224_t1862_gind1.pem | 14 .../valid/p2048_q224_t1864.pem | 14 .../valid/p2048_q224_t1864_gind1.pem | 14 .../valid/p2048_q256_t1862.pem | 14 .../valid/p2048_q256_t1862_gind1.pem | 14 .../valid/p2048_q256_t1864.pem | 14 .../valid/p2048_q256_t1864_gind1.pem | 14 .../valid/p3072_q160_t1862.pem | 19 + .../valid/p3072_q160_t1862_gind1.pem | 19 + .../valid/p3072_q224_t1862.pem | 19 + .../valid/p3072_q224_t1862_gind1.pem | 19 + .../valid/p3072_q256_t1862.pem | 19 + .../valid/p3072_q256_t1862_gind1.pem | 19 + .../valid/p3072_q256_t1864.pem | 19 + .../valid/p3072_q256_t1864_gind1.pem | 19 + 40 files changed, 577 insertions(+), 36 deletions(-) create mode 100644 test/recipes/15-test_dsaparam.t create mode 100644 test/recipes/15-test_dsaparam_data/invalid/p2048_q256_bad_q.pem create mode 100644 test/recipes/15-test_dsaparam_data/invalid/p768_q160_too_small.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p1024_q160_t1862.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p1024_q160_t1862_gind1.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p1024_q160_t1864.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p1024_q160_t1864_gind1.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p1024_q224_t1862.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p1024_q224_t1862_gind1.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p1024_q256_t1862.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p1024_q256_t1862_gind1.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p2048_q160_t1862.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p2048_q160_t1862_gind1.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p2048_q224_t1862.pem create mode 100644 test/recipes/15-test_dsaparam_data/valid/p2048_q224_t1862_gind1.pem create mode
[openssl] master update
The branch master has been updated
via e36b3c2f757cc7d68dc24174a00476104428b099 (commit)
from adc11e1b9cf12df3c67de165a2b42ac72266cbca (commit)
- Log -
commit e36b3c2f757cc7d68dc24174a00476104428b099
Author: Shane Lontis
Date: Wed Feb 17 17:54:29 2021 +1000
Fix external symbols in the provider cipher implementations.
Partial fix for #12964
This add ossl_ names for the following symbols.
chacha20_dinit, chacha20_einit, chacha20_initctx,
ccm_cipher, ccm_dinit, ccm_einit, ccm_generic_auth_decrypt,
ccm_generic_auth_encrypt,
ccm_generic_gettag, ccm_generic_setaad, ccm_generic_setiv,
ccm_get_ctx_params,
ccm_initctx, ccm_set_ctx_params, ccm_stream_final, ccm_stream_update
gcm_aad_update, gcm_cipher, gcm_cipher_final, gcm_cipher_update
gcm_dinit, gcm_einit, gcm_get_ctx_params, gcm_initctx, gcm_one_shot
gcm_set_ctx_params, gcm_setiv, gcm_stream_final, gcm_stream_update
tdes_dinit, tdes_dupctx, tdes_einit, tdes_freectx
tdes_get_ctx_params, tdes_gettable_ctx_params, tdes_newctx
PROV_CIPHER_HW_des_*,
padblock, unpadblock, tlsunpadblock, fillblock, trailingdata
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/14209)
---
Summary of changes:
providers/implementations/ciphers/cipher_aes_ccm.c | 2 +-
.../implementations/ciphers/cipher_aes_ccm_hw.c| 10 +++---
.../ciphers/cipher_aes_ccm_hw_aesni.inc| 10 +++---
.../ciphers/cipher_aes_ccm_hw_t4.inc | 10 +++---
providers/implementations/ciphers/cipher_aes_gcm.c | 4 +--
.../implementations/ciphers/cipher_aes_gcm_hw.c| 8 ++---
.../ciphers/cipher_aes_gcm_hw_aesni.inc| 8 ++---
.../ciphers/cipher_aes_gcm_hw_armv8.inc| 8 ++---
.../ciphers/cipher_aes_gcm_hw_t4.inc | 8 ++---
providers/implementations/ciphers/cipher_aes_ocb.c | 5 +--
.../implementations/ciphers/cipher_aria_ccm.c | 2 +-
.../implementations/ciphers/cipher_aria_ccm_hw.c | 10 +++---
.../implementations/ciphers/cipher_aria_gcm.c | 4 +--
.../implementations/ciphers/cipher_aria_gcm_hw.c | 10 +++---
.../implementations/ciphers/cipher_chacha20.c | 16 +-
.../implementations/ciphers/cipher_chacha20.h | 6 ++--
.../ciphers/cipher_chacha20_poly1305.c | 2 +-
.../ciphers/cipher_chacha20_poly1305_hw.c | 10 +++---
providers/implementations/ciphers/cipher_des.c | 2 +-
providers/implementations/ciphers/cipher_des.h | 12 +++
providers/implementations/ciphers/cipher_des_hw.c | 2 +-
providers/implementations/ciphers/cipher_tdes.h| 34 ++--
.../implementations/ciphers/cipher_tdes_common.c | 22 ++---
.../implementations/ciphers/cipher_tdes_wrap.c | 19 ++-
providers/implementations/ciphers/ciphercommon.c | 17 ++
.../implementations/ciphers/ciphercommon_block.c | 23 --
.../implementations/ciphers/ciphercommon_ccm.c | 29 -
.../implementations/ciphers/ciphercommon_ccm_hw.c | 22 ++---
.../implementations/ciphers/ciphercommon_gcm.c | 31 +-
.../implementations/ciphers/ciphercommon_gcm_hw.c | 17 +-
.../implementations/ciphers/ciphercommon_local.h | 10 +++---
.../implementations/include/prov/ciphercommon.h| 11 ---
.../include/prov/ciphercommon_aead.h | 16 +-
.../include/prov/ciphercommon_ccm.h| 37 +++---
.../include/prov/ciphercommon_gcm.h| 36 ++---
35 files changed, 244 insertions(+), 229 deletions(-)
diff --git a/providers/implementations/ciphers/cipher_aes_ccm.c
b/providers/implementations/ciphers/cipher_aes_ccm.c
index 5913b2ce0c..8da044bd95 100644
--- a/providers/implementations/ciphers/cipher_aes_ccm.c
+++ b/providers/implementations/ciphers/cipher_aes_ccm.c
@@ -29,7 +29,7 @@ static void *aes_ccm_newctx(void *provctx, size_t keybits)
ctx = OPENSSL_zalloc(sizeof(*ctx));
if (ctx != NULL)
-ccm_initctx(>base, keybits, ossl_prov_aes_hw_ccm(keybits));
+ossl_ccm_initctx(>base, keybits, ossl_prov_aes_hw_ccm(keybits));
return ctx;
}
diff --git a/providers/implementations/ciphers/cipher_aes_ccm_hw.c
b/providers/implementations/ciphers/cipher_aes_ccm_hw.c
index db50187ea9..c9a7d18d7a 100644
--- a/providers/implementations/ciphers/cipher_aes_ccm_hw.c
+++ b/providers/implementations/ciphers/cipher_aes_ccm_hw.c
@@ -48,11 +48,11 @@ static int ccm_generic_aes_initkey(PROV_CCM_CTX *ctx, const
unsigned char *key,
static const PROV_CCM_HW aes_ccm = {
ccm_generic_aes_initkey,
-ccm_generic_setiv,
-ccm_generic_setaad,
-ccm_generic_auth_encrypt,
-ccm_generic_auth_decrypt,
-ccm_generic_gettag
+ossl_ccm_generic_setiv,
+
