- Dec 20, 2018
-
-
Ken Goldman authored
The check_key_level() function currently fails when the public key cannot be extracted from the certificate because its algorithm is not supported. However, the public key is not needed for the last certificate in the chain. This change moves the check for level 0 before the check for a non-NULL public key. For background, this is the TPM 1.2 endorsement key certificate. I.e., this is a real application with millions of certificates issued. The key is an RSA-2048 key. The TCG (for a while) specified Public Key Algorithm: rsaesOaep rather than the commonly used Public Key Algorithm: rsaEncryption because the key is an encryption key rather than a signing key. The X509 certificate parser fails to get the public key. Reviewed-by:Viktor Dukhovni <viktor@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7906)
-
- Dec 19, 2018
-
-
Christian Heimes authored
The correct function name is SSL_CTX_enable_ct, not SSL_CTX_ct_enable. Signed-off-by:
Christian Heimes <christian@python.org> Reviewed-by:
Paul Dale <paul.dale@oracle.com> Reviewed-by:
-
Rich Salz authored
Remove some casts on password callback by adding a wrapper function. Remove level of indent by doing an early-return on failure. Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
-
Richard Levitte authored
This implements 3.5.18 "Consistent Public Key and Signature Algorithms" from RFC 4158 "Internet X.509 Public Key Infrastructure: Certification Path Building" Ref: https://tools.ietf.org/html/rfc4158#section-3.5.18 Fixes #7899 Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7919)
-
- Dec 17, 2018
-
-
Quantomicus authored
Fixes #7722 CLA: trivial Signed-off-by:
Mateja Milosevic <quantumgleam@gmail.com> Reviewed-by:
Paul Yang <yang.yang@baishancloud.com> Reviewed-by:
-
- Dec 15, 2018
-
-
Dr. Matthias St. Pierre authored
While stereotyped repetitions are frowned upon in literature, they serve a useful purpose in manual pages, because it is easier for the user to find certain information if it is always presented in the same way. For that reason, this commit harmonizes the varying formulations in the HISTORY section about which functions, flags, etc. were added in which OpenSSL version. It also attempts to make the pod files more grep friendly by avoiding to insert line breaks between the symbol names and the corresponding version number in which they were introduced (wherever possible). Some punctuation and typographical errors were fixed on the way. Reviewed-by:
-
Kurt Roeckx authored
Reviewed-by: -
Kurt Roeckx authored
Fixes: #7183 Reviewed-by:Matt Caswell <matt@openssl.org> GH: #7260
-
Kurt Roeckx authored
Use 0 if we don't want to set a minimum or maximum version Reviewed-by:
-
- Dec 14, 2018
-
-
Richard Levitte authored
It turns out that intialization may change the error number, so we need to preserve the system error number in functions where initialization is called for. These are ERR_get_state() and err_shelve_state() Fixes #7897 Reviewed-by:
-
- Dec 13, 2018
-
-
Todd Short authored
Convert CMAC APIs to EVP_MAC APIs Reviewed-by:
-
Mansour Ahmadi authored
Fixes #7657 Reviewed-by:
Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by:
-
Mansour Ahmadi authored
Fixes #7650 Reviewed-by:
Kurt Roeckx <kurt@roeckx.be> Reviewed-by:
-
Mansour Ahmadi authored
Fixes #7117 Reviewed-by:
-
Rich Salz authored
Reviewed-by:
-
- Dec 12, 2018
-
-
Richard Levitte authored
It turned out that .S files aren't to be treated as lightly as I thought. They need to go through a preprocessing step, which .s files don't need to. Corrects #7703 Reviewed-by:
-
Dr. Matthias St. Pierre authored
Fixes #7883 Reviewed-by:
-
Jakub Jelen authored
CLA: trivial Signed-off-by:
Jakub Jelen <jjelen@redhat.com> Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Tobias Stoeckmann authored
There was a trailing :w at a line, which didn't make sense in context of the sentence/styling. Removed it, because I think it's a leftover vi command. CLA: trivial Signed-off-by:
Tobias Stoeckmann <tobias@stoeckmann.org> Reviewed-by:
-
- Dec 11, 2018
-
-
Todd Short authored
Based originally on github.com/dfoxfranke/libaes_siv This creates an SIV128 mode that uses EVP interfaces for the CBC, CTR and CMAC code to reduce complexity at the cost of perfomance. The expected use is for short inputs, not TLS-sized records. Add multiple AAD input capacity in the EVP tests. Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3540)
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Check that s is less than the order before attempting to verify the signature as per RFC8032 5.2.7 Fixes #7706 Reviewed-by:
-
nxtstep authored
CLA: trivial Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
This was forgotten in a few places Fixes #7862 Reviewed-by:
-
- Dec 10, 2018
-
-
Richard Levitte authored
Fixes #7861 Reviewed-by:
-
Richard Levitte authored
The regexp to parse the incoming version number was flawed, and since we allow ourselves to add missing APIs in PATCH releases, the compatibility settings still need to include the PATCH part of the version number. Reviewed-by:
-
Eneas U de Queiroz authored
This is useful to determine the kernel driver running each algorithm. Signed-off-by:
Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by:
-
Eneas U de Queiroz authored
USE_SOFTDRIVERS: whether to use software (not accelerated) drivers CIPHERS: list of ciphers to enable DIGESTS: list of digests to enable Signed-off-by:
-
Eneas U de Queiroz authored
Since each ioctl causes a context switch, slowing things down, if EVP_MD_CTX_FLAG_ONESHOT is set, then: - call the ioctl in digest_update, saving the result; and - just copy the result in digest_final, instead of using another ioctl. Signed-off-by:
-
Eneas U de Queiroz authored
Digest must be able to do partial-state copy to be used. Signed-off-by:
-
Eneas U de Queiroz authored
Make CTR mode behave like a stream cipher. Signed-off-by:
-
Eneas U de Queiroz authored
The engine needs a custom cipher context copy function to open a new /dev/crypto session. Signed-off-by:
-
Eneas U de Queiroz authored
Close the session in digest_cleanup instead of digest_final. A failure in closing the session does not mean a previous successful digest final has failed as well. Signed-off-by:
-
Eneas U de Queiroz authored
If the source ctx has not been initialized, don't initialize the copy either. Signed-off-by:
-
Eneas U de Queiroz authored
Return failure when the digest_ctx is null in digest_update and digest_final, and when md is null in digest_final. Signed-off-by:
-
Eneas U de Queiroz authored
Call functions to prepare methods after confirming that /dev/crytpo was sucessfully open and that the destroy function has been set. Signed-off-by:
-
Eneas U de Queiroz authored
Signed-off-by:
-
Matt Caswell authored
Fixes #7727 Reviewed-by:
-
