Add missing ERR_load_KDF_strings(3) to util/missingcrypto111.txt as well.

This partially reverts commit a308acb2c2809cb9ac30e8e987b2bdfb21f096e0.

Reviewed-by: Matt Caswell <matt@ope

Add missing ERR_load_KDF_strings(3) to util/missingcrypto111.txt as well.

This partially reverts commit a308acb2c2809cb9ac30e8e987b2bdfb21f096e0.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13390)

show more ...

ERR: Rebuild all generated error headers and source files

This is the result of 'make errors ERROR_REBUILD=-rebuild'

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from ht

ERR: Rebuild all generated error headers and source files

This is the result of 'make errors ERROR_REBUILD=-rebuild'

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13390)

show more ...

Modify the ERR init functions to use the internal ERR string loaders

This deprecates all the ERR_load_ functions, and moves their definition to
separate C source files that can easily be

Modify the ERR init functions to use the internal ERR string loaders

This deprecates all the ERR_load_ functions, and moves their definition to
separate C source files that can easily be removed when those functions are
finally removed.

This also reduces include/openssl/kdferr.h to include cryptoerr_legacy.h,
moves the declaration of ERR_load_ERR_strings() from include/openssl/err.h
to include/openssl/cryptoerr_legacy.h, and finally removes the declaration
of ERR_load_DSO_strings(), which was entirely internal anyway.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13390)

show more ...

ERR: Modify util/mkerr.pl to produce internal err string loaders

This also modifies the .ec L statement to take a third file, which is
the internal header file to declare internal things

ERR: Modify util/mkerr.pl to produce internal err string loaders

This also modifies the .ec L statement to take a third file, which is
the internal header file to declare internal things. This is only
useful for our internal declarations and will not affect engines.

Fixes #10527

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13390)

show more ...

Turn on Github CI

As an interim measure until we work out our longer term CI strategy
this PR enables some basic CI tests using the Github CI capability.

Reviewed-by: Richard Le

Turn on Github CI

As an interim measure until we work out our longer term CI strategy
this PR enables some basic CI tests using the Github CI capability.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13489)

show more ...

Fix double-free in decoder_pkey.c

Fix for the issue #13472. The decoderctx has to be initialized in every
cycle as its constructor may not be called due to lazy evaluation of
the if-

Fix double-free in decoder_pkey.c

Fix for the issue #13472. The decoderctx has to be initialized in every
cycle as its constructor may not be called due to lazy evaluation of
the if-condition.

CLA: trivial

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13473)

show more ...

TEST: Make our test data binary

Our test data (test/data.txt and test/data2.txt) are text files, but
declaring them binary means that there will be no line ending
transformation done

TEST: Make our test data binary

Our test data (test/data.txt and test/data2.txt) are text files, but
declaring them binary means that there will be no line ending
transformation done on them. This is necessary for testing on
non-Unix platforms, where certain tests could otherwise give results
that don't match expected results.

Fixes #13474

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13477)

show more ...

Move some libssl global variables into SSL_CTX

disabled_enc_mask et al were global. Now that cipher loading is done
individually for each SSL_CTX, based on the libctx configured for that

Move some libssl global variables into SSL_CTX

disabled_enc_mask et al were global. Now that cipher loading is done
individually for each SSL_CTX, based on the libctx configured for that
SSL_CTX this means that some things will be disabled for one SSL_CTX but
not for another. The global variables set up the potential for different
SSL_CTXs to trample on each other. We move these variables into the SSL_CTX
structure.

Fixes #12040

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/13465)

show more ...

Add a test for the dhparam CLI application

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/13231)

Remove some unneeded variables from dhparam

Previously changes left some variables behind that were no longer needed.
We now remove them.

Reviewed-by: Paul Dale <paul.dale@oracl

Remove some unneeded variables from dhparam

Previously changes left some variables behind that were no longer needed.
We now remove them.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/13231)

show more ...

Add encoder support to dhparam

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/13231)

Convert dhparam to be fully based on EVP

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/13231)

Support for Android NDK r22-beta1

I think builds using standalone toolchain are fine so I left them alone,
but `Configure` will fail if using the NDK directly because the
`platforms`

Support for Android NDK r22-beta1

I think builds using standalone toolchain are fine so I left them alone,
but `Configure` will fail if using the NDK directly because the
`platforms` and `sysroot` directories were removed.

If `sysroot` is missing, omit the `--sysroot` and `-gcc-toolchain`
arguments and use the triplet form clang command.

Also since `platforms` was being used for the default API level, use
`meta/platforms.json` instead if needed.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13434)

show more ...

RSA: Fix guard mixup

A OSSL_DEPRECATEDIN_0_9_8 function was surrounded by a
OPENSSL_NO_DEPRECATED_3_0 guard.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https:

RSA: Fix guard mixup

A OSSL_DEPRECATEDIN_0_9_8 function was surrounded by a
OPENSSL_NO_DEPRECATED_3_0 guard.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13448)

show more ...

x509_vfy.c: Remove superfluous assignment to 'ret' in check_chain()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://gi

x509_vfy.c: Remove superfluous assignment to 'ret' in check_chain()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/13458)

show more ...

util/fix-deprecation: DEPRECATEDIN conversion util for public headers

Use this for quick and easy conversion of old-style to new-style deprecation:

perl util/fix-deprecation \

util/fix-deprecation: DEPRECATEDIN conversion util for public headers

Use this for quick and easy conversion of old-style to new-style deprecation:

perl util/fix-deprecation \
< include/openssl/rsa.h > include/openssl/rsa.h.new
mv include/openssl/rsa.h.new include/openssl/rsa.h

This is not a perfect utility, but it does the job. It doesn't try to
re-indent, that's left for manual post processing.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13239)

show more ...

ossl_cmp_certreq_new(): Fix POPO key mismatch in case newPkey is just public key

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13409)

CMP: prevent misleading PKIStatusInfo output if not response available

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13409)

apps/cmp.c: Improve diagnostics on -server URL parse error

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13409)

apps/cmp.c: Add diagnostics on config file section(s) used

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13409)

apps.c: re-enable loading single certs and CRLs over HTTP

Fixes #13403

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13404)

SSL: Change SSLerr() to ERR_raise()

This was probably due to a merge

Fixes #13449

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.

SSL: Change SSLerr() to ERR_raise()

This was probably due to a merge

Fixes #13449

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/13450)

show more ...

Fix crash in genpkey app when -pkeyopt digest:name is used for DH or DSA.

By the time the keygen is called the references to strings inside the
gen ctx are floating pointers. A strdup so

Fix crash in genpkey app when -pkeyopt digest:name is used for DH or DSA.

By the time the keygen is called the references to strings inside the
gen ctx are floating pointers. A strdup solves this problem.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13432)

show more ...

Haiku system build fix.

overriding ar and flags from BASE_common mainly.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Me

Haiku system build fix.

overriding ar and flags from BASE_common mainly.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/13438)

show more ...

test RNG: set state to uninitialised as part of uninstantiate call.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merg

test RNG: set state to uninitialised as part of uninstantiate call.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/13226)

show more ...