37214 Commits

All Branches

Search

Author	SHA1	Message	Date
Dr. David von Oheimb	ea7b971563	fix asn1_write_micalg() in asn_mime.c on GostR3411 and SHAKE, also return 0 on I/O errors ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:20 +02:00
Dr. David von Oheimb	d8e87f9c2f	SMIME_write_ASN1_ex() used for CMS: add error checking for calls to BIO_printf(), BIO_puts(), and asn1_write_micalg() ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:20 +02:00
Dr. David von Oheimb	1beaf112e5	apps/cms.c: add missing error message on error writing CMS output (ret == 6) ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:20 +02:00
Simo Sorce	c1ab5734ab	Return SLH-DSA public key when requested ... Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27605)	2025-05-14 09:39:09 +10:00
Simo Sorce	3e82012b39	Return ML-DSA public key when requested ... Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27605)	2025-05-14 09:39:09 +10:00
Pauli	b87f4407c7	chacha_poly: use TRIE based param name decoder ... Converted to using a TRIE based param name decoder to improve performance. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27523)	2025-05-13 17:23:12 +02:00
JiashengJiang	3818f7779e	test/testutil/testutil_init.c: Add OPENSSL_free() to avoid memory leak ... Free trace_data if error occurs to avoid memory leak. Fixes: d73458d17a ("Add tracing capability in test utilities") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27600)	2025-05-13 14:17:28 +02:00
Matt Caswell	aa8bca2e81	Stop a TLSv1.3 server emitting an unsolicited PSK extension ... If we attempt to accept a connection on an SSL object, and the application has set an SSL_SESSION on that SSL object then we can mistakenly believe that we are resuming and emit an unsolicited PSK extension back to the client. This can especially happen when using SSL_clear() which leaves any SSL_SESSION associated with the SSL object. See https://github.com/openssl/openssl/discussions/27563#discussioncomment-13049352 and https://github.com/openssl/openssl/discussions/24567 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27584)	2025-05-13 14:12:21 +02:00
Norbert Pocs	831cbbb5dd	statem_srvr.c: Add check for empty ecdhe encoded key ... The RFC definition about the errors is very vague. The TLSv1.3 RFC is a bit more specific about decode_error (but if this specific case goes for decode_error or illegal parameter is still debatable): ``` decode_error: A message could not be decoded because some field was out of the specified range or the length of the message was incorrect. This alert is used for errors where the message does not conform to the formal protocol syntax. This alert should never be observed in communication between proper implementations, except when messages were corrupted in the network. ``` Thank you @GeorgePantelakis for reporting this issue! Resolves: #27530 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27594)	2025-05-13 14:11:20 +02:00
Dr. David von Oheimb	35e431ed6d	APPS/cmp.c: fix char encoding of subject, issuer, sender, and recipient DN ... Fixes #27572 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27592)	2025-05-13 14:08:50 +02:00
Jakub Zelenka	4eb3eea7a3	Check rand_meth_lock existence before trying to lock it ... There are situations during exit clean up where dependent libraries might be using TLS to finalize stuff but that might crash because the rand_meth_lock can get freed and there is still an attempt to get rand bytes. This change makes sure that things fail nicely. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27119)	2025-05-13 11:38:29 +02:00
pohsingwu	53ea500c49	Raise an error if PBKDF2 iteration count set to zero on check disabled in default provider ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27589)	2025-05-13 09:15:52 +10:00
Neil Horman	5810149e65	Add retry capability to apt commands in quic interop ... We're getting more frequent overnight failures in quic interop due to failing updates that appear transient when conducting apt installs Add the capability to do retry commands here Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27489)	2025-05-09 07:44:31 -04:00
Stanciu, Adrian	ce76714966	SHA512/x86_64: Fix SIGSEGV on $avx=0 path ... Fixes #27555 When $avx>1, codegen is: lea OPENSSL_ia32cap_P(%rip),%r10 mov 0(%r10),%r9 mov 8(%r10),%r11d mov 20(%r10),%r10d When $avx is true, codegen was: lea OPENSSL_ia32cap_P(%rip),%r10 mov 0(%r10),%r9 mov 8(%r10),%r11d mov 20(%r10),%r10d # not used by dispatcher When $avx=0, codegen was: mov 20(%r10),%r10d # %r10 not initalized, causing SIGSEGV After fix, `mov 20(%r10),%r10d` is only included when $avx>1 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27574)	2025-05-09 09:33:37 +10:00
JiashengJiang	f4d9904763	test/timing_load_creds.c: Free contents in error handling to avoid memory leak ... Add a call to OPENSSL_free() in the error handling path to ensure contents is properly freed and prevent a memory leak. Fixes: 45479dcee1 ("test/timing_load_creds.c: fix coding style and other (mostly minor) issues") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27570)	2025-05-09 09:32:22 +10:00
Pauli	d521ed9ea5	chacha_poly: fix settable ctx param list ... The settable list used the generic AEAD cipher list which included an extra parameter and omitted the IV length one. The set ctx param call was custom so the errant list didn't directly impact operation. The comment about ignoring OSSL_CIPHER_PARAM_AEAD_MAC_KEY is completely bogus. That parameter isn't accepted either here or by the shared AEAD cipher params. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27534) (cherry picked from commit 1c63382294)	2025-05-09 08:15:47 +10:00
Neil Horman	a6d5af4fb5	Update IMPL_*_SIGALG to not have to stringify parameter ... Noted while playing with some c-style tools that these macros got mis-handled when doing style changes. Specifically, the last parameter, as it passed externally as a token, but stringified internal to the associated macro, got handled as an arithmetic expression rather than a string. Given that the only thing this parameter is used for is as a string, cut out the middle man and just pass it as a string in the first place Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/27579)	2025-05-08 14:26:07 -04:00
Matt Caswell	1afcc27f94	Add a test for app data received too early ... Add a test for app data which was received prior to the Finished is read correctly, and that if we continue to read we get the expected result. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/27543)	2025-05-08 14:06:12 -04:00
Matt Caswell	d2a33efd39	Ensure we properly release DTLS buffered app data records ... If we read an app data record before we have read the Finished we buffer it. Once we've read it we need to make sure we've properly released it otherwise we will attempt to read it again (and this time there will be no data in it). Fixes #27316 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/27543)	2025-05-08 14:06:11 -04:00
JiashengJiang	4dca928a29	test/bio_comp_test.c: Initialize pointer to avoid undefined behavior ... If the allocation for "original" fails, "result" may be freed without being properly initialized. Since result could hold a random value due to its assignment in do_bio_comp_test(), freeing it without initialization is unsafe and may lead to undefined behavior. Fixes: 12e96a2360 ("Add brotli compression support (RFC7924)") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27569)	2025-05-08 13:47:01 +02:00
Dmitry Belyavskiy	8109618a1c	CHANGES/NEWS entries for configutl ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27290)	2025-05-08 11:05:42 +10:00
Dmitry Belyavskiy	b43913be7e	Configutl tests ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27290)	2025-05-08 11:05:42 +10:00
Dmitry Belyavskiy	08616b09e0	configutl documentation ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27290)	2025-05-08 11:05:42 +10:00
Dmitry Belyavskiy	78ca45cef0	Utility for dumping OpenSSL config file ... Based on @neverpanic code` Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27290)	2025-05-08 11:05:42 +10:00
Matt Caswell	d56f9b4d89	Fix memory management in port_make_channel ... Also make port_new_handshake_layer processing clearer. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27562)	2025-05-07 15:08:21 +02:00
Matt Caswell	fe01b4d2f6	Add a test for sending an empty app data record in DTLS ... DTLS should ignore this Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27541)	2025-05-07 14:36:30 +02:00
Matt Caswell	a23d5e20f1	Drop empty app data records in DTLS ... App data records with 0 bytes of payload will confuse callers of SSL_read(). This will cause a successful read and return 0 bytes as read. Unfortunately a 0 return from SSL_read() is considered a failure response. A subsequent call to SSL_get_error() will then give the wrong result. Zero length app data records are actually allowed by the spec, but have never been handled correctly by OpenSSL. We already disallow creating such empty app data records. Since the SSL_read() API does not have a good way to handle this type of read, we simply ignore them. Partial fix for #27316 Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27541)	2025-05-07 14:35:47 +02:00
pohsingwu	cba510ab86	Align PBKDF2 indicator behavior with other implementations ... Fixes #26983 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27001)	2025-05-07 12:01:29 +02:00
JiashengJiang	9884f1dc11	crypto/provider_conf.c: Fix possible memory leak ... Assign the return value of ossl_provider_info_add_to_store to added instead of setting it directly to 1, in order to avoid a memory leak caused by entry not being freed if ossl_provider_info_add_to_store() fails. Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27472)	2025-05-07 11:49:06 +02:00
Pauli	3f5dc064d0	ccm: update CCM mode ciphers to use the TRIE param name decoder for AEAD ciphers ... This brings the implementation in line with GCM which has had this capability for a while. It will improveme performance setting and retrieving the authenticatoin tag. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27392)	2025-05-07 11:47:24 +02:00
Pauli	0d969379cb	gcm: use TRIE based param name decoder ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27392)	2025-05-07 11:47:24 +02:00
Pauli	bf0f1b5d6f	AEAD params: generate a TRIE to decode AEAD cipher parameter names ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27392)	2025-05-07 11:47:24 +02:00
Pauli	c9c7bfcd42	rename ciphercommon.c ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27392)	2025-05-07 11:47:24 +02:00
Pauli	7a10ecd405	params: update generation script to support multiple TRIE output ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27392)	2025-05-07 11:47:24 +02:00
Pauli	b747a48bb1	params: don't build removed file ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27392)	2025-05-07 11:47:24 +02:00
Pauli	9d80e50df5	params: don't build global param name TRIE ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27392)	2025-05-07 11:47:24 +02:00
cjf7669	67ad6a0898	Fixed chacha20 get updated IV ... Fixes #26998 Addresses an issue where the EVP_CIPHER_CTX_get_updated_iv() function does not properly return the updated IV for the ChaCha20 cipher. chacha20_get_ctx_params was updated to be sensitive to the OSSL_CIPHER_PARAM_UPDATED_IV parameter. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27484)	2025-05-07 11:19:50 +10:00
Aleksander Jan Bajkowski	fda4777c14	Enable AES and SHA3 optimisations on Qualcomm Snapdragon X systems ... For larger data blocks, AES gets performance gains of up to 26.5%, and SHA3 up to 15%. Tested on a Dell 9345 with Snapdragon X1E-80-100. Below are detailed data. Before: type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes AES-128-GCM 176805.90k 677599.17k 1932362.15k 4803628.03k 7696804.52k 8036674.22k AES-192-GCM 178621.88k 673165.14k 1884515.41k 4690465.11k 7669383.17k 8021562.71k AES-256-GCM 177187.09k 668302.19k 1843664.13k 4405732.35k 6911937.19k 7201800.19k sha3-224 71694.30k 286854.87k 686716.67k 784932.86k 922643.11k 926182.06k sha3-256 71997.70k 288208.13k 688777.98k 786555.22k 865192.62k 874643.46k sha3-384 72167.35k 287085.80k 487257.00k 639260.33k 673180.33k 675108.18k sha3-512 71581.52k 287953.09k 378381.31k 436353.02k 471433.22k 472804.01k After: type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes AES-128-GCM 177140.20k 674365.06k 1928108.37k 5285980.84k 9581854.72k 10167205.89k AES-192-GCM 178512.57k 669584.09k 1890147.75k 5052911.96k 8831027.88k 9337787.73k AES-256-GCM 177685.05k 664798.83k 1844782.17k 4816555.35k 8176435.20k 8592359.42k sha3-224 71444.47k 286178.99k 747224.32k 911052.46k 1063985.15k 1067712.51k sha3-256 71188.32k 285318.74k 746304.34k 903716.52k 984566.44k 997430.61k sha3-384 71715.30k 285965.27k 546631.59k 733781.67k 766448.98k 768262.14k sha3-512 70853.85k 284883.33k 427553.71k 489698.99k 520415.91k 520743.59k Change: type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes AES-128-GCM +0.2 % -0.5 % -0.2 % +10.0 % +24.5 % +26.5 % AES-192-GCM -0.1 % -0.5 % +0.3 % +7.7 % +15.1 % +16.4 % AES-256-GCM +0.3 % -0.5 % +0.1 % +9.3 % +18.3 % +19.3 % sha3-224 -0.3 % -0.2 % +8.8 % +16.1 % +15.3 % +15.3 % sha3-256 -1.1 % -1.0 % +8.4 % +14.9 % +13.8 % +14.0 % sha3-384 -0.6 % -0.4 % +12.2 % +14.8 % +13.9 % +13.8 % sha3-512 -1.0 % -1.1 % +13.0 % +12.2 % +10.4 % +10.1 % Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27503)	2025-05-07 11:17:48 +10:00
Dr. David von Oheimb	1eee02d3e7	Fix SSL_{set1,add1}_host() handling of host name/IP address and related documentation ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27457)	2025-05-06 15:11:15 +02:00
Dr. David von Oheimb	eb909d785f	SSL_set1_host.pod: add recommendation to use SSL_{set1,add1}_host() and SSL_set_tlsext_host_name() ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27457)	2025-05-06 15:11:15 +02:00
Julian Zhu	49a3e7adc3	RISC-V: Provide generic optimized SHA-256 implementation for rv64gc ... Signed-off-by: Julian Zhu <julian.oerv@isrc.iscas.ac.cn> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27381)	2025-05-06 11:57:24 +02:00
Dimitri John Ledkov	995e9489e6	pkcs12: increase macsaltlen from 8 to 16 as per NIST SP 800-132 ... Align PKCS12 PBMAC1 PBKDF2 salt length with PKCS5_DEFAULT_PBE2_SALT_LEN. With this change, newly created PKCS12 PBMAC1 PBKDF2 keystores use mac salt length of 16 bytes by default. This increases interoperability with FIPS implementations which require at least 16 bytes of salt length. Otherwise FIPS implementations fail to to open keystore with invalid salt length errors (unapproved): Mac verify error: invalid password? 80EBD061AD7F0000:error:1C800070:Provider routines:kdf_pbkdf2_set_ctx_params:invalid salt length:providers/implementations/kdfs/pbkdf2.c:293: 80EBD061AD7F0000:error:118C0103:PKCS12 routines:PBMAC1_PBKDF2_HMAC:internal error:crypto/pkcs12/p12_mutl.c:143: 80EBD061AD7F0000:error:1180006D:PKCS12 routines:PKCS12_verify_mac:mac generation error:crypto/pkcs12/p12_mutl.c:324: 80EBD061AD7F0000:error:1C800070:Provider routines:kdf_pbkdf2_set_ctx_params:invalid salt length:providers/implementations/kdfs/pbkdf2.c:293: 80EBD061AD7F0000:error:118C0103:PKCS12 routines:PBMAC1_PBKDF2_HMAC:internal error:crypto/pkcs12/p12_mutl.c:143: 80EBD061AD7F0000:error:1180006D:PKCS12 routines:PKCS12_verify_mac:mac generation error:crypto/pkcs12/p12_mutl.c:324: The compile time constant is made possible to override with a build time define, such that one can revert back to 8 if so is needed for backwards compatibility. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27446)	2025-05-05 16:15:24 +02:00
20ioppolan	3f98e949d3	Removed references to vxworks because it is an unsupported platform ... Fixes #26558 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26630)	2025-05-05 16:13:35 +02:00
Tobias Brick	81e8b5a503	Fix use after free bugs for public_keys and private_keys in evp_test ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27421)	2025-05-05 16:03:09 +02:00
Lars Kanis	9da1a9c30e	Add a target config for MINGW on ARM64 ... This is necessary to build OpenSSL native on Windows on Arm64 with gcc or clang. It also works when cross compiling on Linux for aarch64-w64-windows-gnu. This patch is used since years on MSYS2: https://github.com/msys2/MINGW-packages/blob/master/mingw-w64-openssl/001-support-aarch64.patch Fixes #10533 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26605)	2025-05-05 15:07:47 +02:00
Richard Levitte	af5952d533	Drop "by store"'s by_store_subject_ex() ... It was used to pass libctx and propq, which would override the corresponding values passed to by_store_ctrl_ex(). This wasn't really reasonable to do either way, as it could potentially be a surprise to the user, who can reasonably expect that the URI is opened with the libctx and propq that was passed with the URI, and not with those passed later. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27529)	2025-05-04 08:55:15 +02:00
Dr. David von Oheimb	927debaf7b	Add test_verify tests ... Originally from https://github.com/openssl/openssl/pull/27507, with some changes. Co-authored-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27529)	2025-05-04 08:55:15 +02:00
Richard Levitte	0c48ee2bf5	Rework the "by store" X509_LOOKUP method to open the given URI early ... The cached X509_LOOKUP method data is no longer just the URI, but now includes the OSSL_STORE_CTX pointer, and required parameters to reopen the URI at any time. cache_objects() is modified to handle this, and only (re)open the URI when it wasn't previously opened, or when it was closed by an earlier call. This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and get to see possible errors when the URI is loaded. This assumes that if the URI could be opened once, it can be opened again. Fixes #27461 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27529)	2025-05-04 08:55:15 +02:00
Dmitry Misharov	3513a830cc	Run tests nightly on riscv64 runner ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27240)	2025-05-02 13:45:06 +02:00
Neil Horman	d08d77789e	Disable unterminated-string-initialization in strict-warnings ... Recently updated to fedora 42, which includes an updated gcc, which triggers a new warning: test/afalgtest.c:44:9: error: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (18 chars into 17 available) [-Werror=unterminated-string-initialization] 44 | "\x53\x69\x6e\x67\x6c\x65\x20\x62\x6c\x6f\x63\x6b\x20\x6d\x73\x67" The warning occurs because in some locations we create char buffers of length X, and fill it with X bytes of data, truncating the NULL terminator. We could fix it by adding the nonstring attribute, but given that: 1) Adding attributes might impact other platforms that don't understand the attribute. 2) We often create char buffers that don't expect a NULL terminator. 3) Converting the unsigned char arrays to uint8_t, or other types that could be interpreted as non-strings has no impact, only applying the nonstring attribute silences the warning. It seems more sensible to just disable the warning entirely Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27490)	2025-05-02 13:43:04 +02:00