37584 Commits

All Branches

Search

Author	SHA1	Message	Date
Nikola Pajkovsky	e08b83cbb3	Pairwise check for DH keys import as part of FIPS ... For DH key import, it appears the PCT and assurances are implemented in the source but are not be performed by default. Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28058)	2025-07-29 15:10:02 +02:00
Nikola Pajkovsky	9c09d2076a	Update dh_pub to be pairwise consistent with dh_priv ... Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28058)	2025-07-29 15:10:02 +02:00
Tomas Mraz	1a1c10f5d7	Exchange no-sm2 and no-ssl-trace between on PR and daily jobs ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28106)	2025-07-28 11:15:52 +02:00
Tomas Mraz	981d6776a3	test-ec: Skip SM2 key import test if SM2 is disabled ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28106)	2025-07-28 11:13:06 +02:00
Igor Ustinov	44ef69cffb	Fixed #27506, now the behavior with an empty IDN is the same as with ... an incorrect IDN. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28080)	2025-07-27 12:45:27 +02:00
Alexandr Nedvedicky	d777deffba	- adding a missing file ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28023)	2025-07-27 04:48:28 -04:00
Alexandr Nedvedicky	92330c8f80	- changes suggested by @t8m ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28023)	2025-07-27 04:48:28 -04:00
sashan	a43b926fd2	- fix RFC reference and indentation ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28023)	2025-07-27 04:48:28 -04:00
Sashan	b083613476	Update ssl/quic/quic_ackm.c ... Co-authored-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28023)	2025-07-27 04:48:28 -04:00
Sashan	4a3c954a0c	Update ssl/quic/quic_ackm.c ... Co-authored-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28023)	2025-07-27 04:48:28 -04:00
sashan	cdbfacead0	ACK manager must avoid infinite probe time when waiting handshake confirmation ... According to RFC 9002, section 6.2.2.1 the client the client must keep PTO (probe time out) armed if it has not seen HANDSHAKE_DONE quic message from server. Not following RFC spec here may cause the QUIC session to stale during TLS handshake. Fixes openssl/project#1266 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28023)	2025-07-27 04:48:28 -04:00
Richard Levitte	49f8db5327	Add a test of 'openssl storeutl' with a BER-encoded PKCS#12 file ... The test file (test-BER.p12) was given to us by David von Oheimb Co-Authored-By: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/28016)	2025-07-26 11:33:56 +02:00
Richard Levitte	1f3af48c31	Fix OSSL_STORE to consider cached info in the EOF check. ... OSSL_STORE_load() called OSSL_STORE_eof() before checking if there is cached OSSL_STORE_INFO to consider. To fix this issue, the cached info check is moved to OSSL_STORE_eof(), as that seems to make most common sense. This solves an issue with PKCS#12 files, where the cached info was never considered because the underlying file IO layer signaled that EOF is reached. Fixes #28010 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/28016)	2025-07-26 11:33:56 +02:00
Andrew Dinh	9665baf0f9	Update workflows to test msquic with OpenSSL ... Update GitHub Workflows to build msquic with OpenSSL with TLS backend, push to Quay.io, and test with current QUIC interop workflow Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28045)	2025-07-25 12:43:59 -04:00
martin	b1b4b154fd	Add support for TLS 1.3 OCSP multi-stapling for server certs ... Co-authored-by: Michael Krueger Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20945)	2025-07-25 17:24:37 +02:00
AntonMoryakov	c108ead284	sm2: sm2_sign.c: check EC_KEY_get0_private_key() for NULL in sm2_sig_gen() ... Static analysis revealed that sm2_sig_gen() dereferences the return value of EC_KEY_get0_private_key() without checking for NULL. This could lead to a crash if the private key is unset. This patch adds a NULL check and raises ERR_R_PASSED_NULL_PARAMETER if the key is missing. Issue found by static analyzer: > Return value of EC_KEY_get0_private_key() is dereferenced without checking for NULL (11/12 checked) CLA: trivial Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27741)	2025-07-25 12:06:54 +02:00
Alen Yan	bd172dd0e1	fix SM2 privatekey decode(PEM format, ECPrivateKey). ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27963)	2025-07-25 09:51:00 +02:00
Daniel Van Geest	e7d5398aa1	openssl rand command should use the loaded library context ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28075)	2025-07-24 13:26:59 +02:00
Jiasheng Jiang	d3e781b764	test/timing_load_creds.c: Add fclose() if error occurs ... Add fclose() if error occurs to release fp. Fixes: 6212fc6814 ("Add a stand-alone "timing" program") Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28007)	2025-07-24 11:58:36 +02:00
Julian Zhu	c64b6af5e2	LoongArch: Add SHA-512 assembly implementation for better performance on small-size data ... Signed-off-by: Julian Zhu <jz531210@gmail.com> Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27904)	2025-07-24 12:02:49 +10:00
Julian Zhu	895f8f6ad1	LoongArch: Add SHA-256 assembly implementation for better performance ... It can get about 25%~ better performance than compiler-generated code (gcc version 15.1.1). Signed-off-by: Julian Zhu <jz531210@gmail.com> Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27904)	2025-07-24 12:02:49 +10:00
Dmitry Misharov	d217b49994	--amend ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27467)	2025-07-23 11:22:38 -04:00
Dmitry Misharov	d9044daf1e	replace GitHub Actions in Windows jobs ... Most of the GitHub Actions can be replaced with a couple of commands. This will reduce dependencies bloating and some attacks surface. This commit replaces all GitHub Actions which are not from GitHub and Cygwin for Windows jobs with plain commands. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27467)	2025-07-23 11:22:38 -04:00
Norbert Pocs	d05ac3becd	Fix perl warnings on various scripts ... Resolves: https://github.com/openssl/project/issues/1273 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28046)	2025-07-23 08:59:53 -04:00
Pauli	499f655337	sm2: add some signing tests. ... Because SM2 uses entropy as part of it's signing process, there were no signing tests under evp_test. This corrects the shortcoming. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27997)	2025-07-23 18:22:53 +10:00
Pauli	d73d40af37	evp_test: add a new global "Test-Entropy" line to allow deterministic `random` input. ... When specified, this directive replaces the public and private DRBGs with a generator that returns the specified bytes. If more bytes are requested than are specified, the generator loops around the supplied bytes to satisfy the request. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27997)	2025-07-23 18:22:53 +10:00
Pauli	7bf4b30bcc	sm2 test: remove unnecessary available in lines ... This test is only run against the default provider so no need to double check this. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27997)	2025-07-23 18:22:53 +10:00
slontis	bde55d421b	ECX/ED keymanager param getter fixes. ... Fixes #28034 ECX and ED were sharing the same code for the getter, whilst also maintaining seperate gettable tables. The code has been reworked so that common code is shared, and algorithm specific code is seperated out to make this clearer. This fixes: (1) The security category not being in the gettable table for ED (2) The fips indicator for ED. i.e There is no fips indicator for ED (previously there was no gettable, but the get() still tried to return unapproved). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28039)	2025-07-22 21:08:26 +10:00
lanming	5d0c6c52e7	Raise PROV_R_NULL_OUTPUT_BUFFER if shsec is NULL in ml_kem_encapsulate() ... Signed-off-by: lanming <lanming@huawei.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28009)	2025-07-22 11:28:35 +10:00
Dmitry Misharov	b3187ab5a7	Add CODEOWNERS file ... quarckster is the owner of the /.github/workflows/ directory. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28060)	2025-07-21 20:30:51 +02:00
Dmitry Misharov	9ee9a519be	pin GitHub Actions revisions from untrusted vendors ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27181)	2025-07-21 09:56:23 -04:00
Dmitry Misharov	a9a7e017b8	Update container images in OS Zoo CI workflow ... Replace outdated and unsupported distro versions with up-to-date ones. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28049)	2025-07-21 15:23:16 +02:00
Norbert Pocs	c315f98f71	evp_pkey_type: Make base_id_conversion table static ... This commit fixes CI failures (when configured with --strict-warnings) Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28061)	2025-07-18 08:57:16 +02:00
Stanciu, Adrian	055dd1d8bb	Add AES-CFB128 optimizations with Intel AVX-512 and VAES ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26902)	2025-07-17 16:29:57 -04:00
Adrian Stanciu	886396462d	Extract AES CFB implementation to cipher_aes_cfb* ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26902)	2025-07-17 16:29:57 -04:00
Norbert Pocs	b89ab15f13	Add workflow to check perl core modules for 5.10.1 ... The motivation is to notice if we would add a module which is not a core module in the minimal supported perl version. This does not fail on other errors or warnings by perl, but we should clear out those also. Resolves: https://github.com/openssl/project/issues/1269 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28024)	2025-07-17 11:59:19 -04:00
Norbert Pocs	3a90d5f83c	Deprecate ASN1_METH related tests ... ASN1 tests had to be turned off, but the biggest change is the ssl_test_ctx, where the NID resolution does not equal to the old one and a little hack had to be used to make the test work. Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27727)	2025-07-17 11:25:18 -04:00
Norbert Pocs	af2aaf3271	Deprecate ASN1_METH internal usage ... Some of them are needed and were kept by adding `#include "internal/deprecated"` and some had to be turned off. Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27727)	2025-07-17 11:25:18 -04:00
Norbert Pocs	6b5540c21c	libcrypto.num: Deprecate EVP_PKEY_ASN1_METHOD related functions ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27727)	2025-07-17 11:25:18 -04:00
Norbert Pocs	23de79343f	Update documentation on EVP_PKEY_ASN1_METHOD deprecation ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27727)	2025-07-17 11:25:18 -04:00
Norbert Pocs	52d212dd70	Deprecate EVP_PKEY_ASN1_METHOD related function declarations and definitions ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27727)	2025-07-17 11:25:18 -04:00
Norbert Pocs	1bc3191b68	Add deprecation macros for 3.6.0 ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27727)	2025-07-17 11:25:18 -04:00
Norbert Pocs	704a2108ab	providers/implementations/digests/sha3_prov.c optimize ossl_(un)likely ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27961)	2025-07-16 13:07:15 -04:00
Norbert Pocs	682f701985	crypto/params.c optimize ossl_(un)likely ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27961)	2025-07-16 13:07:15 -04:00
Norbert Pocs	340827c819	crypto/init.c optimize ossl_(un)likely ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27961)	2025-07-16 13:07:15 -04:00
Norbert Pocs	e740864976	crypto/threads_pthread.c optimize ossl_(un)likely ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27961)	2025-07-16 13:07:15 -04:00
Norbert Pocs	296e4d3c95	crypto/mem.c optimize ossl_(un)likely ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27961)	2025-07-16 13:07:15 -04:00
Norbert Pocs	d083024b73	crypto/bn/bn_gf2m.c: optimize ossl_(un)likely ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27961)	2025-07-16 13:07:15 -04:00
Norbert Pocs	d1facb4858	include/crypto/md32_common.h: optimize ossl_(un)likely ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27961)	2025-07-16 13:07:15 -04:00
Norbert Pocs	6c9712e6b7	crypto/bn/bn_lib.c: optimize - seems to bring not much benefit ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27961)	2025-07-16 13:07:15 -04:00