summaryrefslogtreecommitdiffstats
path: root/test/Sssdsa.cnf (unfollow)
Commit message (Collapse)AuthorFilesLines
2019-09-06Documentation updates in light of the KDF conversionPauli1-57/+35
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-09-06Add KDFs to providersPauli15-1232/+1406
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-09-06Fix users of KDFs to use params not ctlsPauli5-93/+198
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-09-06Remove old KDF initialisationPauli3-58/+2
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-09-06Fix TLS/SSL PRF usages.Pauli2-39/+74
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-09-06Move KDFs to the provider.Pauli8-0/+15
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-09-06Teach TLSProxy how to parse CertificateRequest messagesMatt Caswell7-26/+262
We also use this in test_tls13messages to check that the extensions we expect to see in a CertificateRequest are there. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9780)
2019-09-06Don't send a status_request extension in a CertificateRequest messageMatt Caswell1-0/+4
If a TLSv1.3 server configured to respond to the status_request extension also attempted to send a CertificateRequest then it was incorrectly inserting a non zero length status_request extension into that message. The TLSv1.3 RFC does allow that extension in that message but it must always be zero length. In fact we should not be sending the extension at all in that message because we don't support it. Fixes #9767 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9780)
2019-09-05Undeprecate OpenSSL_version_num and OPENSSL_VERSION_NUMBERViktor Dukhovni4-17/+11
The OpenSSL_version_num() function returns at runtime the OPENSSL_VERSION_NUMBER of the compiled OpenSSL library. This is a used and useful interface, and should not (at least yet) be deprecated, we just introduced the new versioning schema, it seems too early to deprecate the old. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7853)
2019-09-05Reverting check to correctDmitry Belyavskiy1-1/+1
Fixes #9773. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9776)
2019-09-05Disallow change EVP_CIPHER properties once setDmitry Belyavskiy1-0/+27
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9764)
2019-09-05Disallow change EVP_MD properties once setDmitry Belyavskiy1-0/+30
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9764)
2019-09-05[test] computing ECC cofactors: regression testBilly Brumley1-3/+86
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9827)
2019-09-05[crypto/ec] for ECC parameters with NULL or zero cofactor, compute itBilly Brumley1-9/+96
The cofactor argument to EC_GROUP_set_generator is optional, and SCA mitigations for ECC currently use it. So the library currently falls back to very old SCA-vulnerable code if the cofactor is not present. This PR allows EC_GROUP_set_generator to compute the cofactor for all curves of cryptographic interest. Steering scalar multiplication to more SCA-robust code. This issue affects persisted private keys in explicit parameter form, where the (optional) cofactor field is zero or absent. It also affects curves not built-in to the library, but constructed programatically with explicit parameters, then calling EC_GROUP_set_generator with a nonsensical value (NULL, zero). The very old scalar multiplication code is known to be vulnerable to local uarch attacks, outside of the OpenSSL threat model. New results suggest the code path is also vulnerable to traditional wall clock timing attacks. CVE-2019-1547 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9827)
2019-09-05Make failed messages easier to findRich Salz1-35/+21
Now that we use travis_terminate, we can make the status messages simpler to find, and we don't need the "OK" output. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9707)
2019-09-05Fix error handling in x509_lu.cBernd Edlinger1-9/+27
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9639)
2019-09-05Cleanup includes in rand_unix.cBernd Edlinger1-5/+6
Fixes #9757 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9761)
2019-09-05Change provider params from int to size_tShane Lontis23-195/+209
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9699)
2019-09-04Handle the renamed command POD files in find-doc-nitsRich Salz1-7/+10
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9729)
2019-09-04Move libapps.a source to apps/libRichard Levitte16-35/+37
This makes it clearer what's what. The 'openssl' application and its sub-commands remain in apps/ Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9723)
2019-09-04Suppress 'No server certificate CA names sent' messageBilly Brawner1-1/+2
Fixes #9080 Signed-off-by: Billy Brawner <billy@wbrawner.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9710)
2019-09-04OSSL_PARAM_construct_utf8_string computes the string length.Pauli10-36/+23
If the passed string length is zero, the function computes the string length from the passed string. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9760)
2019-09-04New function EVP_CIPHER_free()Richard Levitte12-58/+97
This function re-implements EVP_CIPHER_meth_free(), but has a name that isn't encumbered by legacy EVP_CIPHER construction functionality. We also refactor most of EVP_CIPHER_meth_new() into an internal evp_cipher_new() that's used when creating fetched methods. EVP_CIPHER_meth_new() and EVP_CIPHER_meth_free() are rewritten in terms of evp_cipher_new() and EVP_CIPHER_free(). This means that at any time, we can deprecate all the EVP_CIPHER_meth_ functions with no harmful consequence. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9758)
2019-09-04New function EVP_MD_free()Richard Levitte17-78/+121
This function re-implements EVP_MD_meth_free(), but has a name that isn't encumbered by legacy EVP_MD construction functionality. We also refactor most of EVP_MD_meth_new() into an internal evp_md_new() that's used when creating fetched methods. EVP_MD_meth_new() and EVP_MD_meth_free() are rewritten in terms of evp_md_new() and EVP_MD_free(). This means that at any time, we can deprecate all the EVP_MD_meth_ functions with no harmful consequence. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9758)
2019-09-03test/errtest.c: more conditions for checking __FILE__ and __LINE__Richard Levitte1-5/+9
When at least one of OPENSSL_NO_ERR or OPENSSL_NO_FILENAMES is defined, __FILE__ and __LINE__ are not saved with the error record. This test only checked OPENSSL_NO_FILENAMES. Now fixed. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9755)
2019-09-03Refactor how KEYMGMT methods get associated with other methodsRichard Levitte11-56/+87
KEYMGMT methods were attached to other methods after those were fully created and registered, thereby creating a potential data race, if two threads tried to create the exact same method at the same time. Instead of this, we change the method creating function to take an extra data parameter, passed all the way from the public fetching function. In the case of EVP_KEYEXCH, we pass all the necessary data that evp_keyexch_from_dispatch() needs to be able to fetch the appropriate KEYMGMT method on the fly. Fixes #9592 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9678)
2019-09-03Fix Coverity 1453452: Control flow issues (DEADCODE)Pauli1-2/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9749)
2019-09-02Add CPU info to the speed command summaryBernd Edlinger9-19/+122
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9669)
2019-09-02Diverse ERR fixesRichard Levitte1-12/+22
1. There are still references to the removed ERR_put_func_error(). 2. ERR_put_error() is deprecated as off version 3.0, so should ERR_PUT_error(). 3. 'no-err' didn't affect what was passed to ERR_set_debug(). Fixes #9522 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9747)
2019-09-02Rework the documentation of our individual MAC implementationsRichard Levitte15-554/+479
We now describe parameters instead of controls. Also, since macros like EVP_MAC_CMAC do not exist any more, we rename the pod files from EVP_MAC_{algo}.pod to EVP_MAC-{algo}.pod. This allows getting the documentation like this: man EVP_MAC CMAC [skip ci] Fixes #9709 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9713)
2019-09-02Fix function name typo in MAC documentation.Pauli1-1/+1
A spurious CTX crept into one of the function names. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9750)
2019-09-01Remove extern declarations of OPENSSL_ia32cap_PBernd Edlinger11-16/+11
Use the header file internal/cryptlib.h instead. Remove checks for OPENSSL_NO_ASM and I386_ONLY in cryptlib.c, to match the checks in other places where OPENSSL_ia32cap_P is used and assumed to be initialized. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/9688)
2019-09-01Fix platform specific issues with provider ciphersShane Lontis2-8/+16
s390_aes naming issues with ofb128 and cfb128 Solaris missing include for camellia. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9702)
2019-08-30Fix pkeyutl -verifyrecoverMatt Caswell1-2/+1
When performing a pkeyutl -verifyrecover operation the input file is not a hash - it is the signature itself. Therefore don't do the check to make sure it looks like a hash. Fixes #9658 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9731)
2019-08-30Don't include the DEVRANDOM being seeded logic on Android.Pauli1-1/+1
It lacks exposure of the `shm*` functions and should prefer the GETRANDOM source. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9735)
2019-08-29Fix NITs in comments and CHANGES for DEVRANDOM seeded check.Pauli2-4/+4
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/9734)
2019-08-29fix ERR_add_error_vdata() for use with multiple args/callsDr. David von Oheimb1-1/+1
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9558)
2019-08-29Use ENGINE_get_id() instead of ENGINE_get_name()Matt Caswell1-4/+4
ENGINE_get_name() actually returns more of a long description of the engine, whilst ENGINE_get_id() returns a shorter id. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9720)
2019-08-29Fix no-engineMatt Caswell5-3/+15
Make sure references to ENGINE functions are appropriately guarded. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9720)
2019-08-29Fix no-cmacMatt Caswell3-14/+15
Don't include files that we don't want to build Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9718)
2019-08-29Fix no-poly1305, no-siphash and no-blake2Matt Caswell6-85/+72
Make sure we don't include files that we don't need if we've disabled them. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9717)
2019-08-29Fix a documentation bug in ec.hMatt Caswell1-2/+0
The EC_GROUP_new() function does not take a libctx parameter Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/9715)
2019-08-29Fix no-ecMatt Caswell1-2/+2
A test in sslapitest.c was failing in a no-ec build because we were using an EC based ciphersuite. That particular test doesn't require EC specifically, so we swap to a non EC based ciphersuite. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9716)
2019-08-29Fix no-desMatt Caswell2-0/+4
Don't refer to cipher functions in the providers that have been compiled out. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9719)
2019-08-29Update fuzz README.mdMatt Caswell1-3/+3
Building with enable-fuzz-afl has always required no-shared. We now also need no-module for a successful build. Therefore update the README accordingly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9721)
2019-08-29Fix data races in EVP_CIPHER_fetch and EVP_MD_fetchMatt Caswell2-28/+22
Don't modify the cipher/md we just fetched - it could be shared by multiple threads. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9590)
2019-08-29Make sure we pre-initialise propertiesMatt Caswell4-12/+13
Simplify the initialisation of the core by pre-initialising properties. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9590)
2019-08-29Fix context lockingMatt Caswell1-4/+38
Some parts of OPENSSL_CTX intialisation can get quite complex (e.g. RAND). This can lead to complex interactions where different parts of the library try to initialise while other parts are still initialising. This can lead to deadlocks because both parts want to obtain the init lock. We separate out the init lock so that it is only used to manage the dynamic list of indexes. Each part of the library gets its own initialisation lock. Fixes #9454 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9590)
2019-08-29Allow an output indentation of zero in apps.Pauli2-6/+6
Previously, it would indent one space even if zero were specified. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9725)
2019-08-28openssl provider: New sub-command, for provider discoveryRichard Levitte6-1/+396
This command is somewhat similar to 'openssl engine', but displays what it can about the given providers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9697)
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-20 06:39:00 +0100