- 14 2月, 2020 9 次提交
-
-
由 Bastian Germann 提交于
OpenSSL 1.1.0 has extended option checking, and rejects passing a PKCS#11 engine URL to "-signkey" option. The actual code is ready to take it. Change the option parsing to allow an engine URL to be passed and modify the manpage accordingly. CLA: trivial Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NDmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11086)
-
由 Rich Salz 提交于
Adding support for "no-secure-memory" was simple, a one-liner. Fixing all the "ifdef OPENSSL_SECURE_MEMORY" to be "ifndef NO_xxx" was a bit more work. My original goof, for not following the OpenSSL pattern "ifndef NO_" used everywhere else. Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11023)
-
由 Richard Levitte 提交于
It uses EVP_PKEY serializers to get the desired results. Reviewed-by: NShane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11078)
-
由 Richard Levitte 提交于
It uses EVP_PKEY serializers to get the desired results. One might think that ddoing this might make things a bit dicy for existing serializers, as they should obviously use i2d functions. However, since our serializers use much more primitive functions such as i2d_ASN1_INTEGER(), or keytype specific ones such as i2d_RSAPrivateKey(), there is no clash. Reviewed-by: NShane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11056)
-
由 Nikolay Morozov 提交于
Reviewed-by: NShane Lontis <shane.lontis@oracle.com> Reviewed-by: NDmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11072)
-
由 Pauli 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11081)
-
由 Pauli 提交于
This also means that there doesn't need to be any conditional checks in the .c files to avoid deprecated builds. Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11067)
-
由 Shane Lontis 提交于
CID : 1458169 RESOURCE LEAK ffc_params_generate.c - False positive, but addressed another Leak in adjacent code CID : 1458171 UNCHECKED RET apps/pkeyutl.c CID : 1458173 DEAD CODE ffc_params_generate.c CID : 1458174 RESOURCE LEAK ssl_lib.c Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11048)
-
由 H.J. Lu 提交于
We should always generate .note.gnu.property section in x86_64 assembly codes for ELF outputs to mark Intel CET support since all input files must be marked with Intel CET support in order for linker to mark output with Intel CET support. Also .note.gnu.property section in x32 should be aligned to 4 bytes, not 8 bytes and .p2align should be used consistently. Verified with $ CC="gcc -Wl,-z,cet-report=error" ./Configure shared linux-x86_64 -fcf-protection $ make $ make test and $ CC="gcc -mx32 -Wl,-z,cet-report=error" ./Configure shared linux-x32 -fcf-protection $ make $ make test # <<< 90-test_sslapi.t failed because 8-byte pointer size. Fix #10896 Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NPaul Dale <paul.dale@oracle.com> Reviewed-by: NTomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10985)
-
- 13 2月, 2020 4 次提交
-
-
由 Matt Caswell 提交于
Make sure we free up any ENGINE references after we have finished using them. Fixes #11064 Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11070)
-
由 Matt Caswell 提交于
We also add some DSA tests for code that is already in the FIPS provider. Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NShane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10881)
-
由 Matt Caswell 提交于
RSA ASYM_CIPHER was already available within the default provider. We now make it also available from inside the FIPS module. Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NShane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10881)
-
由 Christopher J Zurcher 提交于
Reviewed-by: NPaul Dale <paul.dale@oracle.com> Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11054)
-
- 12 2月, 2020 20 次提交
-
-
由 Matt Caswell 提交于
Don't attempt to build ecx related source files in a "no-ec" build. Reviewed-by: NPaul Dale <paul.dale@oracle.com> Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11065)
-
由 Richard Levitte 提交于
It's already used internally, there's no reason the DER serializer propqueries shouldn't be present alongside the PEM and TEXT ones. Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11055)
-
由 Dr. David von Oheimb 提交于
fix also formatting nits w.r.t. #if indentations in ocsp.h Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NDavid von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11058)
-
由 Pauli 提交于
The recently introduced ossl_param_bld_to_param_ex() function is only called by the unit tests. Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11053)
-
由 Pauli 提交于
This function is recently introduced and never called by the library or tests. Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11053)
-
由 Pauli 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
-
由 Pauli 提交于
speed is updated to not support DSA instead of being removed. The dhparam, dsaparam, dsa and gendsa commands are deprecated but still exist without NO_DEPRECATED defined. Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
-
由 Pauli 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
-
由 Richard Levitte 提交于
Use 'openssl genpkey' instead. Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NPaul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10977)
-
由 Pauli 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
-
由 Richard Levitte 提交于
Do not run programs that depend on deprecated APIs when 'no-deprecated' is configured. We still retain the conversion tests that use 'openssl pkey', and add the one that's missing. Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NPaul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10977)
-
由 Pauli 提交于
Use of the low level DSA functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
-
由 Pauli 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
-
由 Pauli 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
-
由 Matt Caswell 提交于
Reviewed-by: NPatrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: NShane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10964)
-
由 Matt Caswell 提交于
Reviewed-by: NPatrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: NShane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10964)
-
由 Matt Caswell 提交于
Reviewed-by: NPatrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: NShane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10964)
-
由 Matt Caswell 提交于
Add ref counting and control how we allocate storage for the private key. We will need this type in following commits where we move the ecx code to be provider aware. Reviewed-by: NPatrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: NShane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10964)
-
由 Kurt Roeckx 提交于
Signature algorithms not using an MD weren't checked that they're allowed by the security level. Reviewed-by: NMatt Caswell <matt@openssl.org> GH: #10785
-
由 Kurt Roeckx 提交于
Create a whole chain of Ed488 certificates so that we can use it at security level 4 (192 bit). We had an 2048 bit RSA (112 bit, level 2) root sign the Ed488 certificate using SHA256 (128 bit, level 3). Reviewed-by: NMatt Caswell <matt@openssl.org> GH: #10785
-
- 11 2月, 2020 2 次提交
-
-
由 Bernd Edlinger 提交于
[extended tests] Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9982)
-
由 Richard Levitte 提交于
With the provided method of creating the new X509_PUBKEY, an extra EVP_PKEY is created and needs to be properly cleaned away. (note: we could choose to keep it just as well, but there are consequences, explained in a comment in the code) Reviewed-by: NDmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11038)
-
- 10 2月, 2020 4 次提交
-
-
由 Dr. David von Oheimb 提交于
The new client has become an independent libcrpyto module in crypto/http/ and * can handle any types of requests and responses (ASN.1-encoded and plain) * does not include potentially busy loops when waiting for responses but * makes use of a new timeout mechanism integrated with socket-based BIO * supports the use of HTTP proxies and TLS, including HTTPS over proxies * supports HTTP redirection via codes 301 and 302 for GET requests * returns more useful diagnostics in various error situations Also adapts - and strongly simplifies - hitherto uses of HTTP in crypto/ocsp/, crypto/x509/x_all.c, apps/lib/apps.c, and apps/{ocsp,s_client,s_server}.c Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NDavid von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10667)
-
由 Dr. David von Oheimb 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NDavid von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10667)
-
由 Richard Levitte 提交于
When setting up the hash function for DSA signature, the encoded AlgorithmIdentifier for the DSA+hash combination is queried, but not stored, which leads to problems when signing ASN.1 items in libcrypto. Reviewed-by: NShane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11037)
-
由 Davide Galassi 提交于
Typedefs of CRYPTO malloc, realloc and free. MEM_CHECK "modes" are used only as a CRYPTO_mem_ctrl() parameter The CRYPTO_mem_ctrl is defined only if OPENSSL_NO_CRYPTO_MDEBUG is defined, thus define the MEM_CHECK modes under the same condition. Maybe the macros can be removed at all since: 1. CRYPTO_mem_ctrl() just returns -1 and ignores the parameter 2. CRYPTO_mem_ctr() is declared as DEPRECATED by 3.0 Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NPaul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11042)
-
- 08 2月, 2020 1 次提交
-
-
由 H.J. Lu 提交于
We should always generate .note.gnu.property section in x86 assembly codes for ELF outputs to mark Intel CET support since all input files must be marked with Intel CET support in order for linker to mark output with Intel CET support. Verified with $ CC="gcc -Wl,-z,cet-report=error" ./Configure shared linux-x86 -fcf-protection $ make $ make test Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NPaul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11044)
-