Skip tests using KTLS RX for TLS 1.3.

KTLS RX is not yet supported for TLS 1.3.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Skip tests using KTLS RX for TLS 1.3.

KTLS RX is not yet supported for TLS 1.3.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12111)

show more ...

Skip tests using KTLS RX if KTLS RX is not supported.

This skips tests using KTLS RX when run on systems that only support
KTLS TX.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.

Skip tests using KTLS RX if KTLS RX is not supported.

This skips tests using KTLS RX when run on systems that only support
KTLS TX.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12111)

show more ...

Refactor the KTLS tests to minimize code duplication.

Use the low 4 bits of the test number directly as flags for which of
the connection sides should use KTLS or not for each test inste

Refactor the KTLS tests to minimize code duplication.

Use the low 4 bits of the test number directly as flags for which of
the connection sides should use KTLS or not for each test instead of
having 16 nearly identical functions to do the same thing.

This makes it easier to skip tests that aren't supported (e.g. KTLS RX
on TLS 1.3).

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12111)

show more ...

Move KTLS inline functions only used by libssl into ssl/ktls.c.

These functions are a bit large to inline and are not usable outside
of libssl.

Reviewed-by: Tomas Mraz <tmraz@fe

Move KTLS inline functions only used by libssl into ssl/ktls.c.

These functions are a bit large to inline and are not usable outside
of libssl.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12111)

show more ...

Support for KTLS TX on FreeBSD for TLS 1.3.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/ope

Support for KTLS TX on FreeBSD for TLS 1.3.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12111)

show more ...

Don't check errno if ktls_read_record() returned 0.

errno is only valid if ktls_read_record() fails with a negative return
value.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.or

Don't check errno if ktls_read_record() returned 0.

errno is only valid if ktls_read_record() fails with a negative return
value.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12111)

show more ...

Add support for KTLS receive for TLS 1.1-1.2 on FreeBSD.

Similar to KTLS receive for Linux, KTLS receive for FreeBSD is enabled
by passing a session key to the kernel via a new socket op

Add support for KTLS receive for TLS 1.1-1.2 on FreeBSD.

Similar to KTLS receive for Linux, KTLS receive for FreeBSD is enabled
by passing a session key to the kernel via a new socket option. Once
KTLS receive is enabled on a socket, the socket returns records via
recvmsg(). A control message attached to each record supplies the
original TLS header, and the decrypted plaintext is returned in the
data buffer passed to recvmsg().

To support the case that the userland buffer may already contain
pending encrypted records (which is already handled by Linux's KTLS
receive), the socket option structure for FreeBSD has been extended to
include the initial sequence number.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12111)

show more ...

Add helper functions for FreeBSD KTLS.

These are similar to the helpers added in 95badfeb60. I've adjusted
the arguments passed to ktls_check_supported_cipher and
ktls_configure_cry

Add helper functions for FreeBSD KTLS.

These are similar to the helpers added in 95badfeb60. I've adjusted
the arguments passed to ktls_check_supported_cipher and
ktls_configure_crypto so that FreeBSD and Linux can both use the same
signature to avoid OS-specific #ifdef's in libssl. This also required
moving the check on valid TLS versions into
ktls_check_supported_cipher for Linux. This has largely removed
OS-specific code and OS-specific #ifdef's for KTLS outside of
<internal/ktls.h>.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12111)

show more ...

Add a ktls_crypto_info_t typedef.

This type is defined to hold the OS-specific structure passed to
BIO_set_ktls.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-b

Add a ktls_crypto_info_t typedef.

This type is defined to hold the OS-specific structure passed to
BIO_set_ktls.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12111)

show more ...

Update test data for DSA public key text

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/open

Update test data for DSA public key text

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12688)

show more ...

Add the correct enum value for DSA public key serialization

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://gith

Add the correct enum value for DSA public key serialization

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12688)

show more ...

Fix ECX serializer import calls to use correct selection flags.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12698)

Fix RSA serializer import calls to use correct selection flags.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12698)

Fix DSA serializer import calls to use correct selection flags.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12698)

Fix DH serializer import calls to use correct selection flags.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12698)

Fix PKCS#7 so that it still works with non fetchable cipher algorithms.

Fixes #12697

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Shane Lontis <shane.lontis@or

Fix PKCS#7 so that it still works with non fetchable cipher algorithms.

Fixes #12697

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12740)

show more ...

Fix PKCS#7 so that it still works with non fetchable digest algorithms.

Fixes #12684
Partially fixes #12697

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Sh

Fix PKCS#7 so that it still works with non fetchable digest algorithms.

Fixes #12684
Partially fixes #12697

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12740)

show more ...

Check whether we have MD5-SHA1 and whether we need it

If we don't have MD5-SHA1 then we must be use (D)TLSv1.2 or above. We
check that this is consistent with the way we've been configur

Check whether we have MD5-SHA1 and whether we need it

If we don't have MD5-SHA1 then we must be use (D)TLSv1.2 or above. We
check that this is consistent with the way we've been configured. We also
ensure that we never attempt to negotiate <(D)TLSv1.2 if MD5-SHA1 is not
available.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12733)

show more ...

Improve some error messages if a digest is not available

If a digest is not available we just get an "internal error" error
message - which isn't very helpful for diagnosing problems. In

Improve some error messages if a digest is not available

If a digest is not available we just get an "internal error" error
message - which isn't very helpful for diagnosing problems. Instead we
explicitly state that we couldn't find a suitable digest.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12733)

show more ...

Include "legacy" in the name of the various MAC bridge functions

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12637)

Add some documentation about the EVP_PKEY MAC interface

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12637)

Improve code reuse in the provider MAC bridge

We reuse concepts such as PROV_CIPHER, and make use of some common code
in provider_util.c

Reviewed-by: Paul Dale <paul.dale@oracle

Improve code reuse in the provider MAC bridge

We reuse concepts such as PROV_CIPHER, and make use of some common code
in provider_util.c

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12637)

show more ...

Document the EVP_PKEY_new_CMAC_key_with_libctx() function

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12637)

Extend test_CMAC_keygen in evp_extra_test

The test only setup the generation of a key. It did not complete that
generation. We extend the test to complete the generation and to use the

Extend test_CMAC_keygen in evp_extra_test

The test only setup the generation of a key. It did not complete that
generation. We extend the test to complete the generation and to use the
generated key. We also compare the result with a key generated in a
different way.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12637)

show more ...

Delete unused PKEY MAC files

Now that the all the legacy PKEY MAC bridge code has been moved to the
providers we no longer need the old bridge and it can be removed.

Reviewed-by

Delete unused PKEY MAC files

Now that the all the legacy PKEY MAC bridge code has been moved to the
providers we no longer need the old bridge and it can be removed.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12637)

show more ...