- May 07, 2019
-
-
Boris Pismenny authored
This commit introduces support for Linux KTLS sendfile. Sendfile semantics require the use of a kernel TLS socket to construct the TLS record headers, encrypt and authenticate the data. KTLS sendfile improves performance by avoiding the copy of file data into user space, which is required today. Signed-off-by:
Boris Pismenny <borisp@mellanox.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8727)
-
Dr. Matthias St. Pierre authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8893)
-
- May 03, 2019
-
-
Simo Sorce authored
Conform to other modules which were changed at the last minute and this discrepancy was not noticed. Retain "md" as an alias so not to break 3rd party backports/tests scripts. Signed-off-by:
Simo Sorce <simo@redhat.com> Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8783)
-
Shane Lontis authored
Reviewed-by:
-
Shane Lontis authored
Reviewed-by:
-
Todd Short authored
Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
-
- May 02, 2019
-
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
We should be seeking to move the OPENSSL_init_crypto and OPENSSL_cleanup processing into OPENSSL_CTX instead. Reviewed-by:
-
Matt Caswell authored
Various core and property related code files used global data. We should store all of that in an OPENSSL_CTX instead. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Klotz, Tobias authored
Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/8023)
-
Dr. Matthias St. Pierre authored
If the `openssl cms` command is called without specifying an operation option, it replies with the following laconic error message: cms: Use -help for summary. This commit adds a helpful error message: No operation option (-encrypt|-decrypt|-sign|-verify|...) specified. Reviewed-by: -
Dr. Matthias St. Pierre authored
Since commit 137096a7 it is possible to specify keywords instead of negative magic numbers for the salt length. This commit replaces the remaining occurrences of `rsa_pss_saltlen:-3` in the test recipes by `rsa_pss_saltlen:max`. Reviewed-by:
-
Wojciech Kaluza authored
Reviewed-by:
-
Wojciech Kaluza authored
- Allow user-defined RCFLAGS - Pass RCFLAGS to RC Reviewed-by:
-
- May 01, 2019
-
-
Matt Caswell authored
Reviewed-by:
-
Richard Levitte authored
Fixes #8796 Reviewed-by:
-
Philip Prindeville authored
Other commands like 'req' support -verbose, so why not gendsa and dsaparam? Part of a larger and more ambitious effort to add -verbose to all apps that might be used in scripts and need to otherwise run silently (well, without belching out anything that isn't a warning or error... which ties into a later scrub of using STDOUT were appropriate for informative messages instead of STDERR)... so that scripts also have the option of doing >/dev/null without losing anything critical. Signed-off-by:
Philip Prindeville <philipp@redfish-solutions.com> Reviewed-by:
-
Philip Prindeville authored
Other commands like 'req' support -verbose, so why not genrsa? Signed-off-by:
-
- Apr 30, 2019
-
-
Pauli authored
Introduce a macro that allows all structure alignment tricks to be rolled up into a single place. Reviewed-by:
-
Richard Levitte authored
OSSL_provider_init() gets another output parameter, holding a pointer to a provider side context. It's entirely up to the provider to define the context and what it's being used for. This pointer is passed back to other provider functions, typically the provider global get_params and set_params functions, and also the diverse algorithm context creators, and of course, the teardown function. With this, a provider can be instantiated more than once, or be re-loaded as the case may be, while maintaining instance state. Reviewed-by:
-
Richard Levitte authored
The OP_cipher_final function takes a return output size and an output buffer size argument. The oneshot OP_cipher_cipher function should do the same. Reviewed-by:
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
Richard Levitte authored
The reason is that the shared-info attributes may depend on %disabled, so we need to process all enablings/disablings first. Reviewed-by:
-
Pauli authored
Digest stored entropy for CRNG test. Via the FIPS lab, NIST confirmed: The CMVP had a chance to discuss this inquiry and we agree that hashing the NDRNG block does meet the spirit and letter of AS09.42. However, the CMVP did have a few questions: what hash algorithm would be used in this application? Is it approved? Is it CAVs tested? SHA256 is being used here and it will be both approved and CAVs tested. This means that no raw entropy needs to be kept between RNG seedings, preventing a potential attack vector aganst the randomness source and the DRBG chains. It also means the block of secure memory allocated for this purpose is no longer required. Reviewed-by:
-
- Apr 29, 2019
-
-
Todd Short authored
With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by:
Paul Yang <yang.yang@baishancloud.com> Reviewed-by:
-
- Apr 26, 2019
-
-
David Benjamin authored
pkey_rsa_copy was missing a field. Test this by repeating the operation through an EVP_PKEY_CTX_dup copy in evp_test. Reviewed-by:
-
- Apr 25, 2019
-
-
Patrick Steuer authored
Signed-off-by:
Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by:
-
Patrick Steuer authored
Signed-off-by:
-
Patrick Steuer authored
Add non-base instructions which are used by the chacha20 and poly1305 modules. Signed-off-by:
-
Patrick Steuer authored
z14 introduced alignment hints to help vector load/store performance. For its predecessors, alignment hint defaults to 0 (no alignment indicated). Signed-off-by:
-
Pauli authored
Add a Chi^2 goodness of fit test to empirically provide a degree of confidence in the uniformity of the output of the random range generation function. Reviewed-by:
-
Matt Caswell authored
If we were using a different type of BIO than a socket BIO then BIO_get_ktls_send() and BIO_get_ktls_recv() could return the wrong result. The above occurred even if KTLS was disabled at compile time - so we should additionally ensure that those macros do nothing if KTLS is disabled. Finally we make the logic in ssl3_get_record() a little more robust when KTLS has been disabled. [extended tests] Reviewed-by:
-
Matt Caswell authored
If the kernel headers are sufficiently recent to have KTLS transmit support, but not recent enough to have KTLS receive support then a compilation error would be the result. Reviewed-by:
-
Guido Vranken authored
Return error if the output tag buffer size doesn't match the tag size exactly. This prevents the caller from using that portion of the tag buffer that remains uninitialized after an otherwise succesfull call to CRYPTO_ccm128_tag. Bug found by OSS-Fuzz. Fix suggested by Kurt Roeckx. Signed-off-by:
Guido Vranken <guidovranken@gmail.com> Reviewed-by:
-
- Apr 24, 2019
-
-
Jakub Jelen authored
CLA: trivial Signed-off-by:
Jakub Jelen <jjelen@redhat.com> Reviewed-by:
-
Shane Lontis authored
Reviewed-by:
-
Shane Lontis authored
Reviewed-by:
-
Richard Levitte authored
Because we depend on knowing if clang's address, memory or undefinedbehavior sanitizers are enabled, we make an extra effort to detect them among the C flags, and adjust the %disabled values accordingly. Reviewed-by:
-
- Apr 23, 2019
-
-
Richard Levitte authored
OpenSSL_version(OPENSSL_DIR) gives you a nicely formatted string for display, but if all you really want is the directory itself, you were forced to parsed the string. This introduces a new function to get diverse configuration data from the library, OPENSSL_info(). This works the same way as OpenSSL_version(), but has its own series of types, currently including: OPENSSL_INFO_CONFIG_DIR returns OPENSSLDIR OPENSSL_INFO_ENGINES_DIR returns ENGINESDIR OPENSSL_INFO_MODULES_DIR returns MODULESDIR OPENSSL_INFO_DSO_EXTENSION returns DSO_EXTENSION OPENSSL_INFO_DIR_FILENAME_SEPARATOR returns directory/filename separator OPENSSL_INFO_LIST_SEPARATOR returns list separator For scripting purposes, this also adds the command 'openssl info'. Reviewed-by:
-
