Teach ssl_test_old to use the FIPS provider for its tests

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11534)

Teach ssl_test_old how to run tests in a non-default library context

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11534)

Use a fetched MD if appropriate in ssl3_cbc_digest_record

HMACs used via the legacy EVP_DigestSign interface are strange in
that they use legacy codepath's which eventually (under the co

Use a fetched MD if appropriate in ssl3_cbc_digest_record

HMACs used via the legacy EVP_DigestSign interface are strange in
that they use legacy codepath's which eventually (under the covers)
transform the operation into a new style EVP_MAC. This can mean the
digest in use can be a legacy one, so we need to be careful with any
digest we extract from the ctx.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11511)

show more ...

Teach ssl_test_new how to test the FIPS module

We load the FIPS module and make sure it is configured before running
the ssl_test_new tests.

Reviewed-by: Shane Lontis <shane.lon

Teach ssl_test_new how to test the FIPS module

We load the FIPS module and make sure it is configured before running
the ssl_test_new tests.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11511)

show more ...

Teach ssl_test_new to have different tests for different loaded providers

We now run the tests twice: Once with no specific providers loaded and
just using the default libctx, and a seco

Teach ssl_test_new to have different tests for different loaded providers

We now run the tests twice: Once with no specific providers loaded and
just using the default libctx, and a second time with a non-default libctx
and the default provider.

In the second run we disable tests which use a PSS cert/key because we
don't yet have support for that.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11511)

show more ...

Run ssl_test_new with a non-default library context

We also prepare the way for a future commit to run ssl_test_new with
just the FIPS provider loaded.

Reviewed-by: Shane Lontis

Run ssl_test_new with a non-default library context

We also prepare the way for a future commit to run ssl_test_new with
just the FIPS provider loaded.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11511)

show more ...

Update comment on crls_http_cb() as it does support non-blocking I/O since #10667

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Mer

Update comment on crls_http_cb() as it does support non-blocking I/O since #10667

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11273)

show more ...

Fix descriptions of credentials and verification options for various apps

fix doc of s_client and s_server credentials and verification options
fix doc of verification options also for s

Fix descriptions of credentials and verification options for various apps

fix doc of s_client and s_server credentials and verification options
fix doc of verification options also for s_time, x509, crl, req, ts, and verify
correcting and extending texts regarding untrusted and trusted certs,
making the order of options in the docs and help texts more consistent,
etc.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11273)

show more ...

Swap parameters of evp_method_id()

The order of the function's parameters `name_id` and `operation_id`
was reverted compared to their order of appearance in the comments
and assertio

Swap parameters of evp_method_id()

The order of the function's parameters `name_id` and `operation_id`
was reverted compared to their order of appearance in the comments
and assertions.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11542)

show more ...

Fix an assertion (and a comment) of evp_method_id()

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11542)

Fix DH_get_nid() so that it does not cache values.

DH_set0_pqg() is now responsible for caching the nid, q and length.

DH with or without named safe prime groups now default to usin

Fix DH_get_nid() so that it does not cache values.

DH_set0_pqg() is now responsible for caching the nid, q and length.

DH with or without named safe prime groups now default to using the maximum private key length (BN_num_bits(q) - 1)
when generating a DH private key. The code is now shared between fips and non fips mode for DH key generation.

The OSSL_PKEY_PARAM_DH_PRIV_LEN parameter can be used during keygen to override the maximum private key length to be
in the range (2 * strength ... bits(q) - 1). Where the strength depends on the length of p.

Added q = (p - 1) / 2 safe prime BIGNUMS so that the code is data driven (To simplify adding new names).
The BIGNUMS were code generated.

Fix error in documented return value for DH_get_nid

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11562)

show more ...

DOC: Extend EVP_PKEY-DSA(7) / EVP_PKEY_DH(7) with FFC information

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11546)

DOC: Refactor provider-keymgmt(7) to give the keytypes their own pages

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11546)

Build files: add module installation targets

We only installed engines, now we also install other modules.

Fixes #11559

Reviewed-by: Matt Caswell <matt@openssl.org>
(Me

Build files: add module installation targets

We only installed engines, now we also install other modules.

Fixes #11559

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11566)

show more ...

TEST: make and use a fipsinstall script

We have copies of the exact same fipsinstall call in several test
recipes. This refactors those calls into a single simple script.

Revie

TEST: make and use a fipsinstall script

We have copies of the exact same fipsinstall call in several test
recipes. This refactors those calls into a single simple script.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11565)

show more ...

Use the libctx for all EVP_PKEY_CTX operations

There were a few places where we were not passing through the libctx
when constructing and EVP_PKEY_CTX.

Reviewed-by: Paul Dale <p

Use the libctx for all EVP_PKEY_CTX operations

There were a few places where we were not passing through the libctx
when constructing and EVP_PKEY_CTX.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11508)

show more ...

Re-enable FIPS testing in sslapitest.c

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11508)

Use a non-default libctx in sslapitest

We also don't load the default provider into the default libctx to make
sure there is no accidental "leakage".

Reviewed-by: Paul Dale <pau

Use a non-default libctx in sslapitest

We also don't load the default provider into the default libctx to make
sure there is no accidental "leakage".

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11508)

show more ...

dhparam: white space cleaning

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11225)

apps: undeprecate the conditioned out apps

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11225)

openssl: include the version a command was deprecated in the output text.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11225)

apps: reinstate deprecated commands but using PKEY APIs

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11225)

dsaparam: update command line app to use EVP calls

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11225)

CHANGES: note which command line utilities are marked for deprecation but still available.

Some of the utilities are much easier to use than their pkey alternatives.
These have been modi

CHANGES: note which command line utilities are marked for deprecation but still available.

Some of the utilities are much easier to use than their pkey alternatives.
These have been modified to use the PKEY APIs but still note that they are
deprecated.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11225)

show more ...

Undeprecate DH_get_length() and DH_set_length() functions

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11225)