WIP: Preview of CMP implementation, incremental PR chunk 4: CMP context/parameters#178
WIP: Preview of CMP implementation, incremental PR chunk 4: CMP context/parameters#178DDvO wants to merge 51 commits intocmpossl_incremental3from
Conversation
39d49a0 to
a992358
Compare
f28fa40 to
a1b4f0b
Compare
e8b39d0 to
67032c0
Compare
13ed82b to
283178d
Compare
|
@mattcaswell, did you notice that, as discussed in with our PR for chunk3: openssl#8669, the preview of our chunk 4 is here? |
67032c0 to
ff1d80b
Compare
283178d to
b328f9f
Compare
|
Yes, I noticed...I just haven't got as far as taking a look yet. Will try to do that soon. |
8f1ef7e to
70f9953
Compare
|
Thanks @mattcaswell for all your comments! |
39c2fcb to
168a960
Compare
9a3eafb to
6ac128f
Compare
cec9c6b to
317ad15
Compare
The openssl#7408 implemented mandatory digest checking in TLS. However this broke compatibility of DSS support with GnuTLS which supports only SHA1 with DSS. There is no reason why SHA256 would be a mandatory digest for DSA as other digests in SHA family can be used as well. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from openssl#9015)
Use -bnoentry, not -bexpall Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from openssl#9012)
Not all Unixen know the -v option Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from openssl#9012)
enabling the 'enable-crypto-mdebug' option and running parameter generation causes timeouts. Loading pregenerated params is more suited for these tests. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from openssl#9022)
Rework the test so that it fails far less often. A number of independent tests are executed and 5% are expected to fail. The number of such failures follows a binomial distribution which permits a statistical test a 0.01% expected failure rate. There is a command line option to enable the stochastic range checking. It is off by default. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from openssl#8830)
CLA: trivial Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from openssl#9021)
openssl_config_int() returns the uninitialized variable `ret` when compiled with OPENSSL_SYS_UEFI. Fixes openssl#9026 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from openssl#9029)
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from openssl#8117)
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from openssl#8117)
1586c96 to
e2715d6
Compare
This has been long overdue. Note that this does not join the X509 and X509V3 error modules, that will be too many macro changes at this stage. Fixes openssl#8919 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from openssl#8925)
2abe29d to
483174d
Compare
|
Can this be raised as an official PR now? |
Did you see the two comments I made above: #178 (comment) and #178 (comment) yesterday evening?
|
This causes travis build failures on master Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from openssl#9087)
2ff89f1 to
9c6952d
Compare
|
@mattcaswell, I've just dome some further small improvements to the preliminary trace enhancements. |
|
Will try and take a look tomorrow. |
covID 1445689 Resource leak (in error path) covID 1445318 Resource leak (in test - minor) covID 1443705 Unchecked return value (Needed if CRYPTO_atomic_add() was used) covID 1443691 Resource leak (in app - minor) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from openssl#9071)
… folders Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from openssl#9083)
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from openssl#9090)
Fixes openssl#9092 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from openssl#9093)
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> GH: openssl#7651
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> GH: openssl#7651
[skip ci] Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from openssl#9102)
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from openssl#9101)
9c6952d to
35d89b4
Compare
In preparation for moving the RAND code into the FIPS module we make drbg_lib.c OPENSSL_CTX aware. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from openssl#9039)
This is in preparation for moving this code inside the FIPS module. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from openssl#9039)
It was previously rand_lib but it makes more sense in drbg_lib.c since all the functions that use this lock are only ever called from drbg_lib.c We add some FIPS_MODE defines in preparation for later moving this code into the FIPS module. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from openssl#9039)
Various functions have been added that take an OPENSSL_CTX parameter as a result of moving the RAND code into the FIPS module. We document all of those functions. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from openssl#9039)
e7e96b7 to
394e744
Compare
Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712)
CMP and CRMF API is added to libcrypto, and the "cmp" app to the openssl CLI.
Adds extensive man pages and tests. Integration into build scripts.
Incremental pull request based on OpenSSL commit 1362190 of 2018-09-26
3rd chunk: CMP ASN.1 structures (in crypto/cmp/cmp_asn.c) and related files
Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712)
CMP and CRMF API is added to libcrypto, and the "cmp" app to the openssl CLI.
Adds extensive man pages and tests. Integration into build scripts.
Incremental pull request based on OpenSSL commit 1362190 of 2018-09-26
3rd chunk: CMP ASN.1 structures (in crypto/cmp/cmp_asn.c) and related files
Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712)
CMP and CRMF API is added to libcrypto, and the "cmp" app to the openssl CLI.
Adds extensive man pages and tests. Integration into build scripts.
Incremental pull request based on OpenSSL commit 8869ad4 of 2019-04-02
4th chunk: CMP context/parameters and utilities
in crypto/cmp/cmp_ctx.c, crypto/cmp/cmp_util.c, and related files
394e744 to
d1ef63b
Compare
|
@mattcaswell, we have just provided
|
|
Yes I saw - apologies for not getting back to you before you got that far. |
NOTE: this is not an actual pull request but is meant as a preview of a later OpenSSL PR.
While chunk 3 openssl#8669 is not yet fully approved, this preview can be used for adding initial review comments.
Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL.
Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712).
CMP and CRMF API is added to libcrypto, and the "cmp" app to the openssl CLI.
Adds extensive man pages and tests. Integration into build scripts.
4th chunk: CMP context/parameters in cmp_ctx.c and cmp_ctx_test.c and related files.
Checklist