Commit Graph

29555 Commits

Author SHA1 Message Date
Richard Levitte 32eebfa27f Make providers/fips.module.sources.new depend on configdata.pm
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15514)
2021-05-29 11:02:37 +02:00
Richard Levitte e653b04bd2 configdata.pm: Allow extra arguments when --query is given.
That allows operations like this:

    ./configdata.pm --query 'get_sources(@ARGV)' file1 file2 file3

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15514)
2021-05-29 11:02:37 +02:00
Pauli 5cbd2ea3f9 add zero strenght arguments to BN and RAND RNG calls
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)
2021-05-29 17:17:12 +10:00
Pauli 965fa9c080 prov: add zero strenght arguments to BN and RAND RNG calls
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)
2021-05-29 17:17:12 +10:00
Pauli 0f8815aace ssl: add zero strenght arguments to BN and RAND RNG calls
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)
2021-05-29 17:17:12 +10:00
Pauli 23e97567be test: add zero strenght arguments to BN and RAND RNG calls
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)
2021-05-29 17:17:12 +10:00
Pauli 508258caa0 rand: add a strength argument to the BN and RAND RNG calls
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)
2021-05-29 17:17:12 +10:00
Pauli e587bccdf9 doc: document the strength arugments to the RNG functions
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15513)
2021-05-29 17:17:12 +10:00
Rich Salz 83058e810b Make undef'd counts zero by default.
Fixes #15409

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15467)
2021-05-29 16:09:08 +10:00
Amitay Isaacs 30691da1ba ec: Add PPC64 vector assembly version of p521 field operations
Only field multiplication and squaring (but not reduction) show a
significant improvement.  This is enabled on Power ISA >= 3.0.

On a Power 9 CPU an average 10% performance improvement is seen (ECHDE:
14%, ECDSA sign: 6%, ECDSA verify 10%), compared to existing code.

On an upcoming Power 10 CPU we see an average performance improvement
of 26% (ECHDE: 38%, ECDSA sign: 16%, ECDSA verify 25%), compared to
existing code.

Signed-off-by: Amitay Isaacs <amitay@ozlabs.org>
Signed-off-by: Martin Schwenke <martin@meltin.net>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15401)
2021-05-29 16:07:15 +10:00
Martin Schwenke 1036749883 ec: Add run time code selection for p521 field operations
This is only used if ECP_NISTP521_ASM is defined and this currently
only occurs on PPC64.

This simply chooses the C reference implementation, which will be the
default when custom code is available for certain CPUs.

Only the multiplication and squaring operations are handled, since the
upcoming assembly code only contains those.  This scheme can be easily
extended to handle reduction too.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Signed-off-by: Amitay Isaacs <amitay@ozlabs.org>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15401)
2021-05-29 16:07:15 +10:00
Martin Schwenke 3363a2c3d6 ec: Rename reference p521 field operations and use them via macros
This will allow clean addition of assembly versions of these operations.

Signed-off-by: Martin Schwenke <martin@meltin.net>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15401)
2021-05-29 16:07:15 +10:00
Martin Schwenke 7711227059 perlasm/ppc-xlate.pl: Handle rewriting of vector registers
Power has 2 numbering systems for vector registers:

* VR: Vector Registers are numbered from 0 to 31
* VSR: Vector-Scalar registers are numbers from 32 to 63

These refer to the same registers.  Some instructions use VR numbering
for their operands, while others use VSR numbering.

When using Perl to provide a meaningful name for a register it makes
sense to use the same variable for both VR and VSR instructions.  This
makes the code more readable.

However, providing a VSR number (i.e. >=32) to an instruction that
expects a VR number will cause an assembler error.

So, for instructions that require VR numbering, map VSR numbers
(i.e. >=32) to VR numbers.  This also allows existing code that uses
VR numbering to remain unchanged.

Signed-off-by: Martin Schwenke <martin@meltin.net>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15401)
2021-05-29 16:07:15 +10:00
Dr. David von Oheimb 24c07e5055 BIO acpt_state(): Allow retrying addresses (e.g., using IPv6 vs. IPv4) on creating accept socket
Fixes #15386

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15417)
2021-05-29 07:47:03 +02:00
Dr. David von Oheimb a7014122ac BIO_s_accept.pod: Add missing documentation for BIO_{get,set}_accept_ip_family()
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15417)
2021-05-29 07:47:03 +02:00
Dr. David von Oheimb f4706b165a apps/ocsp: Allow -port 0
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15417)
2021-05-29 07:47:03 +02:00
Dr. David von Oheimb d318fc9545 DOC: Slightly improve the documentation of BIO_lookup() and related functions
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15417)
2021-05-29 07:47:03 +02:00
Dr. David von Oheimb d357dd51cb apps/lib/s_socket.c and 80-test_cmp_http.t: Make ACCEPT port reporting more robust
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15417)
2021-05-29 07:47:03 +02:00
Shane Lontis 189c4759eb Fix intermittent CI failure in evp_kdf_test for non_caching build.
Fixes #15515

Another case of the order that tests run in causes a failure.
A new test was loading "legacy" into the default lib ctx. If it
ran first then everything fails. The test now has its own lib ctx.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15516)
2021-05-29 07:20:01 +10:00
Shane Lontis b6b3694c90 Fix incorrect gettable OSSL_CIPHER_PARAM_TLS_MAC parameter
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15416)
2021-05-28 14:29:13 +02:00
Shane Lontis 37115f6512 Fix incorrect OSSL_CIPHER_PARAM_SPEED get_ctx_params
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15416)
2021-05-28 14:29:13 +02:00
Shane Lontis f5d0c02cdc Add missing EVP_CTRL_CCM_SET_L control
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15416)
2021-05-28 14:29:13 +02:00
Shane Lontis b9098d4edd Add Docs for EVP_CIPHER-*
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15416)
2021-05-28 14:29:13 +02:00
Shane Lontis 97aede6846 EVP_CIPHER Documentation updates
EVP_EncryptInit.pod now follows the pattern used in EVP_DigestInit.pod.
i.e.
'=item' is used for methods
PARAMETERS and CONTROLS sections have been added.

The PARAMETERS list has been moved from provider-cipher.pod (this file just
has a link now).
Missing fields were updated.

The CONTROLS shows the mappings to OSSL_PARAM keys.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15416)
2021-05-28 14:28:44 +02:00
Sven Schwermer 29253e1e87 ERR: Rebuild generated engine error files
CLA: trivial

Signed-off-by: Sven Schwermer <sven.schwermer@disruptive-technologies.com>

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15495)
2021-05-28 14:22:45 +02:00
Sven Schwermer 5642882f11 mkerr: Fix string literal conversion
This fixes a compiler warning on clang-1205.0.22.9 when compiling the
generated code as C++11:

ISO C++11 does not allow conversion from string literal to 'char *'
[-Wwritable-strings]

CLA: trivial

Signed-off-by: Sven Schwermer <sven.schwermer@disruptive-technologies.com>

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15495)
2021-05-28 14:22:45 +02:00
Shane Lontis da5f770ae3 Fix PKCS12_create() so that a fetch error is not added to the error stack.
Fixes #15392

PBE algorithms such as NID_pbe_WithSHA1And3_Key_TripleDES_CBC will
currently always fail to the EVP_CIPHER_fetch() call, so the fallback to
a legacy algorithm always happens. In this case the error stack should
ignore the fetch error.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15473)
2021-05-28 13:54:19 +02:00
Tommy Chiang 6c014da0b2 Fix typo about SSL_CONF_FLAG_CMDLINE
change SSL_CONF_CMDLINE to SSL_CONF_FLAG_CMDLINE
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15489)
2021-05-28 11:20:20 +02:00
Rich Salz 3e3ad3c548 Fix issues found by md-nits
Fixes #15460

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15461)
2021-05-28 11:14:46 +02:00
Petr Gotthard 32075a1724 Fix memory leak in OSSL_CMP_CTX
The ctx->propq is strdup'ed, so it must be free'd too.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15458)
2021-05-28 11:11:53 +02:00
Rich Salz a935791d54 Rework and make DEBUG macros consistent.
Remove unused -DCONF_DEBUG and -DBN_CTX_DEBUG.

Rename REF_PRINT to REF_DEBUG for consistency, and add a new
tracing category and use it for printing reference counts.

Rename -DDEBUG_UNUSED to -DUNUSED_RESULT_DEBUG

Fix BN_DEBUG_RAND so it compiles and, when set, force DEBUG_RAND to
be set also.

Rename engine_debug_ref to be ENGINE_REF_PRINT also for consistency.

Fixes #15357

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15353)
2021-05-28 10:04:31 +02:00
David Makepeace 6bf3692d31 Fix doc typos.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15483)
2021-05-28 14:03:36 +10:00
Tom Cosgrove bb97dc508f Initialise OPENSSL_armcap_P to 0 before setting it based on capabilities, not after
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15486)
2021-05-28 10:28:29 +10:00
Tomas Mraz 365d207faa FIPS Checksums: checkout the head of the base repo as pristine
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15503)
2021-05-28 09:11:18 +10:00
Todd Short e49095f186 Call SSLfatal when the generate_ticket_cb returns 0
Otherwise, the state machine ends up being in a bad state:
```
SSL routines:write_state_machine:missing fatal:ssl/statem/statem.c:XXX:
```

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/15487)
2021-05-27 11:54:32 -07:00
Tomas Mraz 07fb85cf61 FIPS Checksums CI: use separate directories for the checkouts
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15481)
2021-05-27 15:30:58 +02:00
Tomas Mraz 9fc7a053fc generate_fips_sources: properly include providers/common/der/*.in
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15481)
2021-05-27 15:30:58 +02:00
Juergen Christ 4612eec35d Fix compilation warning with GCC11.
Parameter "header" of ssl3_cbc_digest_record was fixed to a 13 bytes header
but used as a pointer.  This caused a warning about out-of-bounds array access
with GCC 11.

Fixes #15462.

Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15463)
2021-05-27 20:31:13 +10:00
Pauli 72f62f4408 coverity 1484912: Null pointer dereferences (NULL_RETURNS)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15425)
2021-05-27 20:29:24 +10:00
Pauli 29604f4920 coverity 1484913: Null pointer dereferences (REVERSE_INULL)
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15425)
2021-05-27 20:29:14 +10:00
Dr. David von Oheimb 91f2b15f2e TEST: Prefer using precomputed RSA and DH keys for more efficient tests
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13715)
2021-05-27 11:06:01 +02:00
Dr. David von Oheimb 8b893c35da APPS req: Extend the -keyout option to be respected also with -key
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13715)
2021-05-27 11:06:01 +02:00
Dr. David von Oheimb 54e8f7259b DOC: Improve description of 'req' app: -new, -newkey, and -keyout options
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13715)
2021-05-27 11:06:01 +02:00
Shane Lontis 3257179b7a Fix spelling mistake in d2i_PrivateKey.pod
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15423)
2021-05-27 18:51:36 +10:00
Shane Lontis 8cf78d634b Add demo for EC keygen
Fixes #14112

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15423)
2021-05-27 18:51:36 +10:00
jwalch dcc780cf8d Fix OCSP_sendreq_nbio arg order
Fixes #15470

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15471)
2021-05-27 13:20:38 +10:00
Pauli 422da9bbfb test: test MP genrsa in deprecated builds
These multi-prime tests were omitted when genrsa was deprecated but not
returned when it was restored.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15472)
2021-05-27 13:01:50 +10:00
Pauli 5c99d57ea3 test: add test for key generation strength > RNG strength
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15472)
2021-05-27 13:01:50 +10:00
Pauli dfad3a00be test: test genrsa in deprecated builds
These tests were omitted when genrsa was deprecated but not returned when
it was restored.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15472)
2021-05-27 13:01:50 +10:00
Pauli 3134fb284f errors: update error message (to be squashed)
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15472)
2021-05-27 13:01:50 +10:00