[openssl] master update
The branch master has been updated
via 63b64f19c13d59d68dc2e525f454aea62a739842 (commit)
via bef876f97e26309ccd20f916cf1e5e305735ee98 (commit)
via 6b937ae3a7a2dfac55d25a18bd6d5a084c24e3d5 (commit)
via 49f07be43d031f0407db8ae1b8cdf6452a79e558 (commit)
from d07d8057991712261323c05bb022d000a01404d0 (commit)
- Log -
commit 63b64f19c13d59d68dc2e525f454aea62a739842
Author: Dr. David von Oheimb
Date: Fri Mar 12 19:45:40 2021 +0100
TS and CMS CAdES-BES: Refactor check_signing_certs() funcs into common ESS
func
Also constify related CMS/PKCS7 functions and improve error codes thrown.
Reviewed-by: Tomas Mraz
(Merged from https://github.com/openssl/openssl/pull/14503)
commit bef876f97e26309ccd20f916cf1e5e305735ee98
Author: Dr. David von Oheimb
Date: Fri Mar 12 15:54:34 2021 +0100
ts_check_signing_certs(): Make sure both ESSCertID and ESSCertIDv2 are
checked
Reviewed-by: Tomas Mraz
(Merged from https://github.com/openssl/openssl/pull/14503)
commit 6b937ae3a7a2dfac55d25a18bd6d5a084c24e3d5
Author: Dr. David von Oheimb
Date: Wed Mar 10 17:21:37 2021 +0100
TS ESS: Invert the search logic of ts_check_signing_certs() to correctly
cover cert ID list
Fixes #14190
Reviewed-by: Tomas Mraz
(Merged from https://github.com/openssl/openssl/pull/14503)
commit 49f07be43d031f0407db8ae1b8cdf6452a79e558
Author: Dr. David von Oheimb
Date: Sat Mar 13 11:29:19 2021 +0100
apps.c: Fix missing newline in warn_cert_msg() output
Reviewed-by: Tomas Mraz
(Merged from https://github.com/openssl/openssl/pull/14503)
---
Summary of changes:
CHANGES.md | 9 ++
apps/cms.c | 6 +-
apps/lib/apps.c| 2 +-
crypto/cms/cms_att.c | 3 +-
crypto/cms/cms_err.c | 2 -
crypto/cms/cms_ess.c | 63 +-
crypto/cms/cms_local.h | 3 +-
crypto/cms/cms_smime.c | 2 +-
crypto/err/openssl.txt | 10 +-
crypto/ess/ess_asn1.c | 4 +-
crypto/ess/ess_err.c | 14 ++-
crypto/ess/ess_lib.c | 127 -
crypto/pkcs7/pk7_doit.c| 8 +-
crypto/ts/ts_rsp_verify.c | 60 ++
doc/man1/openssl-cms.pod.in| 26 +++--
doc/man1/openssl-ts.pod.in | 11 +-
doc/man3/CMS_verify.pod| 4 +-
include/crypto/cms.h | 4 +-
include/crypto/ess.h | 12 +-
include/crypto/esserr.h| 2 +-
include/openssl/cms.h.in | 3 +-
include/openssl/cmserr.h | 1 -
include/openssl/esserr.h | 6 +
include/openssl/pkcs7.h.in | 4 +-
test/recipes/80-test_cms.t | 10 +-
test/recipes/80-test_tsa.t | 96 +++-
test/recipes/80-test_tsa_data/all-zero.tsq | Bin 0 -> 59 bytes
test/recipes/80-test_tsa_data/comodo-aaa.pem | 25
test/recipes/80-test_tsa_data/sectigo-all-zero.tsr | Bin 0 -> 4981 bytes
test/recipes/80-test_tsa_data/sectigo-signer.pem | 40 +++
.../80-test_tsa_data/sectigo-time-stamping-ca.pem | 39 +++
.../recipes/80-test_tsa_data/user-trust-ca-aaa.pem | 32 ++
test/recipes/80-test_tsa_data/user-trust-ca.pem| 34 ++
33 files changed, 415 insertions(+), 247 deletions(-)
create mode 100644 test/recipes/80-test_tsa_data/all-zero.tsq
create mode 100644 test/recipes/80-test_tsa_data/comodo-aaa.pem
create mode 100644 test/recipes/80-test_tsa_data/sectigo-all-zero.tsr
create mode 100644 test/recipes/80-test_tsa_data/sectigo-signer.pem
create mode 100644 test/recipes/80-test_tsa_data/sectigo-time-stamping-ca.pem
create mode 100644 test/recipes/80-test_tsa_data/user-trust-ca-aaa.pem
create mode 100644 test/recipes/80-test_tsa_data/user-trust-ca.pem
diff --git a/CHANGES.md b/CHANGES.md
index e51e61a96b..f6800a337d 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -58,6 +58,15 @@ OpenSSL 3.0
*Richard Levitte*
+ * Improved adherence to Enhanced Security Services (ESS, RFC 2634 and RFC
5035)
+ for the TSP and CMS Advanced Electronic Signatures (CAdES) implementations.
+ As required by RFC 5035 check both ESSCertID and ESSCertIDv2 if both
present.
+ Correct the semantics of checking the validation chain in case
ESSCertID{,v2}
+ contains more than one certificate identifi
[openssl] master update
The branch master has been updated
via d07d8057991712261323c05bb022d000a01404d0 (commit)
via eb27d75788e7d53a2a43aacc25f23c2856b4065d (commit)
via ba64e5a92a6f009e311ad1c3565817820a1632a4 (commit)
via 90165623a50fa30454c4a2f9bece7af2c611b731 (commit)
from 11c7874d0c055450783252e68d97dc1de7151dc3 (commit)
- Log -
commit d07d8057991712261323c05bb022d000a01404d0
Author: Beat Bolli
Date: Sun Feb 14 23:47:57 2021 +0100
Add tests for the limited Unicode code point range
Signed-off-by: Beat Bolli
Reviewed-by: Shane Lontis
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/14185)
commit eb27d75788e7d53a2a43aacc25f23c2856b4065d
Author: Beat Bolli
Date: Sun Feb 14 23:47:15 2021 +0100
ASN1: check the Unicode code point range in ASN1_mbstring_copy()
Signed-off-by: Beat Bolli
Reviewed-by: Shane Lontis
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/14185)
commit ba64e5a92a6f009e311ad1c3565817820a1632a4
Author: Beat Bolli
Date: Sun Feb 14 19:27:56 2021 +0100
ASN1: limit the Unicode code point range in UTF8_getc() and UTF8_putc()
Since the Unicode 4.0.0 standard, the valid code point range is U+
to U+10. Make code points outside this range invalid when converting
from/to UTF-8.
Signed-off-by: Beat Bolli
Reviewed-by: Shane Lontis
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/14185)
commit 90165623a50fa30454c4a2f9bece7af2c611b731
Author: Beat Bolli
Date: Tue Feb 16 19:15:45 2021 +0100
ASN1: add an internal header to validate Unicode ranges
Reviewed-by: Shane Lontis
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/14185)
---
Summary of changes:
crypto/asn1/a_mbstr.c | 16 --
crypto/asn1/a_utf8.c | 75 --
include/internal/unicode.h | 31 +++
test/asn1_internal_test.c | 41 +
4 files changed, 97 insertions(+), 66 deletions(-)
create mode 100644 include/internal/unicode.h
diff --git a/crypto/asn1/a_mbstr.c b/crypto/asn1/a_mbstr.c
index 2af2445410..208a383af2 100644
--- a/crypto/asn1/a_mbstr.c
+++ b/crypto/asn1/a_mbstr.c
@@ -1,5 +1,5 @@
/*
- * Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -10,6 +10,7 @@
#include
#include "crypto/ctype.h"
#include "internal/cryptlib.h"
+#include "internal/unicode.h"
#include
static int traverse_string(const unsigned char *p, int len, int inform,
@@ -242,6 +243,9 @@ static int traverse_string(const unsigned char *p, int len,
int inform,
static int in_utf8(unsigned long value, void *arg)
{
int *nchar;
+
+if (!is_unicode_valid(value))
+return -2;
nchar = arg;
(*nchar)++;
return 1;
@@ -251,9 +255,13 @@ static int in_utf8(unsigned long value, void *arg)
static int out_utf8(unsigned long value, void *arg)
{
-int *outlen;
+int *outlen, len;
+
+len = UTF8_putc(NULL, -1, value);
+if (len <= 0)
+return len;
outlen = arg;
-*outlen += UTF8_putc(NULL, -1, value);
+*outlen += len;
return 1;
}
@@ -278,6 +286,8 @@ static int type_str(unsigned long value, void *arg)
types &= ~B_ASN1_T61STRING;
if ((types & B_ASN1_BMPSTRING) && (value > 0x))
types &= ~B_ASN1_BMPSTRING;
+if ((types & B_ASN1_UTF8STRING) && !is_unicode_valid(value))
+types &= ~B_ASN1_UTF8STRING;
if (!types)
return -1;
*((unsigned long *)arg) = types;
diff --git a/crypto/asn1/a_utf8.c b/crypto/asn1/a_utf8.c
index 143ae01db7..6572726cf1 100644
--- a/crypto/asn1/a_utf8.c
+++ b/crypto/asn1/a_utf8.c
@@ -1,5 +1,5 @@
/*
- * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -9,6 +9,7 @@
#include
#include "internal/cryptlib.h"
+#include "internal/unicode.h"
#include
/* UTF8 utilities */
@@ -58,6 +59,8 @@ int UTF8_getc(const unsigned char *str, int len, unsigned
long *val)
value |= *p++ & 0x3f;
if (value < 0x800)
return -4;
+if (is_unicode_surrogate(value))
+return -2;
ret = 3;
} else if ((*p & 0xf8) == 0xf0) {
if (len < 4)
@@ -73,40 +76,6 @@ int UTF8_getc(const unsigned char *s
Still FAILED build of OpenSSL branch master with options -d --strict-warnings no-autoerrinit
Platform and configuration command: $ uname -a Linux run 5.4.0-65-generic #73-Ubuntu SMP Mon Jan 18 17:25:17 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux $ CC=clang ../openssl/config -d --strict-warnings no-autoerrinit Commit log since last time: 9a48544058 Make EVP_PKEY_missing_parameters work properly on provided RSA keys e08993eab6 evp_keymgmt_util_copy: Fix possible leak on copy failure 48fad58f7b apps/crl: Print just the hash value if printing just hash 50864bd2f7 Convert some TODO(3.0) comments in init.c to normal comments 19ad1e9d37 Remove a TODO(3.0) from EVP_PKEY_derive_set_peer() d11f644ba5 Fix up issues found when running evp_extra_test with a non-default library context 062490dbd0 Add testing for non-default library context into evp_extra_test 4139a0c6ec EVP_KDF-KB man page: fixup ABI/API change 1f79baa55e Remove TODOs from digest.c 7128458b8a params: clean up TODO 8f391c7d1b doc: remove TODOs about redesigning the AEAD API 95856e34bb prov: remove todos in rsa_keymgmt.c cc32fbdca1 prov: remove TODO in der_rsa_key.c d1f790de0c Add some encoder and decoder code examples 5db682733d Fix a TODO(3.0) in the siphash code 37cddb2e2d p_lib.c: Remove TODO comments a289d3a427 property_test: use property values that are not used elsewhere 2217d4c9cc core_get_libctx: use assert() instead of ossl_assert() a23deef281 provider_core: Remove two TODO 3.0 a8275fbc4a decoder_process: data_structure can be NULL 1e08f3ba9e property: default queries create the property values. bd55a0be1b Use --debug with no-caching build as sanitizers need it 92a36b3705 Add a CHANGES entry for EVP_PKEY_public_check() and EVP_KEY_param_check() 2cf8bb46fc Ensure that ECX keys pass EVP_PKEY_param_check() 2db5834c43 Add a CHANGES entry for the cosmetic differences in textual output d8a809db4b apps: Make load_key_certs_crls to read only what is expected ea51096e51 apps: Add maybe_stdin argument to load_certs and set it in pkcs12 8287a4c3b2 Tiny clarification of comment for RSA_sign 3a37ddde91 Fix DSA EVP_PKEY_param_check() when defaults are used for param generation. Build log ended with (last 100 lines): 70-test_sslcertstatus.t ok 70-test_sslextension.t . ok 70-test_sslmessages.t .. ok 70-test_sslrecords.t ... ok 70-test_sslsessiontick.t ... ok 70-test_sslsigalgs.t ... ok 70-test_sslsignature.t . ok 70-test_sslskewith0p.t . ok 70-test_sslversions.t .. ok 70-test_sslvertol.t ok 70-test_tls13alerts.t .. ok 70-test_tls13cookie.t .. ok 70-test_tls13downgrade.t ... ok 70-test_tls13hrr.t . ok 70-test_tls13kexmodes.t ok 70-test_tls13messages.t ok 70-test_tls13psk.t . ok 70-test_tlsextms.t . ok 70-test_verify_extra.t . ok 70-test_wpacket.t .. ok 71-test_ssl_ctx.t .. ok 80-test_ca.t ... ok 80-test_cipherbytes.t .. ok 80-test_cipherlist.t ... ok 80-test_ciphername.t ... ok # 80-test_cmp_http.t . ok # 80-test_cms.t .. ok 80-test_cmsapi.t ... ok 80-test_ct.t ... ok 80-test_dane.t . ok 80-test_dtls.t . ok 80-test_dtls_mtu.t . ok 80-test_dtlsv1listen.t . ok 80-test_http.t . ok 80-test_ocsp.t . ok 80-test_pkcs12.t ... ok 80-test_ssl_new.t .. ok 80-test_ssl_old.t .. ok 80-test_ssl_test_ctx.t . ok 80-test_sslcorrupt.t ... ok 80-test_tsa.t .. ok 80-test_x509aux.t .. ok 81-test_cmp_cli.t .. ok 90-test_asn1_time.t ok 90-test_async.t ok 90-test_bio_enc.t .. ok 90-test_bio_memleak.t .. ok 90-test_constant_time.t ok 90-test_fatalerr.t . ok 90-test_fipsload.t . ok 90-test_gmdiff.t ... ok 90-test_gost.t . ok 90-test_ige.t .. ok 90-test_includes.t . ok 90-test_memleak.t .. ok 90-test_overhead.t . ok 90-test_secmem.t ... ok 90-test_shlibload.t ok 90-test_srp.t .. ok 90-test_sslapi.t ... ok 90-test_sslbuffers.t ... ok 90-test_store.t ok 90-test_sysdefault.t ... ok 90-test_threads.t .. ok 90-test_time_offset.t .. ok 90-test_tls13ccs.t . ok 90-test_tls13encryption.t .. ok 90-test_tls13secrets.t . ok 90-test_v3name.t ... ok 91-test_pkey_check.t ... ok 95-test_external_boringssl.t ... skipped: No external tests in this config
Still FAILED build of OpenSSL branch master with options -d --strict-warnings no-autoalginit
Platform and configuration command: $ uname -a Linux run 5.4.0-65-generic #73-Ubuntu SMP Mon Jan 18 17:25:17 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux $ CC=clang ../openssl/config -d --strict-warnings no-autoalginit Commit log since last time: 9a48544058 Make EVP_PKEY_missing_parameters work properly on provided RSA keys e08993eab6 evp_keymgmt_util_copy: Fix possible leak on copy failure 48fad58f7b apps/crl: Print just the hash value if printing just hash 50864bd2f7 Convert some TODO(3.0) comments in init.c to normal comments 19ad1e9d37 Remove a TODO(3.0) from EVP_PKEY_derive_set_peer() d11f644ba5 Fix up issues found when running evp_extra_test with a non-default library context 062490dbd0 Add testing for non-default library context into evp_extra_test 4139a0c6ec EVP_KDF-KB man page: fixup ABI/API change 1f79baa55e Remove TODOs from digest.c 7128458b8a params: clean up TODO 8f391c7d1b doc: remove TODOs about redesigning the AEAD API 95856e34bb prov: remove todos in rsa_keymgmt.c cc32fbdca1 prov: remove TODO in der_rsa_key.c d1f790de0c Add some encoder and decoder code examples 5db682733d Fix a TODO(3.0) in the siphash code 37cddb2e2d p_lib.c: Remove TODO comments a289d3a427 property_test: use property values that are not used elsewhere 2217d4c9cc core_get_libctx: use assert() instead of ossl_assert() a23deef281 provider_core: Remove two TODO 3.0 a8275fbc4a decoder_process: data_structure can be NULL 1e08f3ba9e property: default queries create the property values. bd55a0be1b Use --debug with no-caching build as sanitizers need it 92a36b3705 Add a CHANGES entry for EVP_PKEY_public_check() and EVP_KEY_param_check() 2cf8bb46fc Ensure that ECX keys pass EVP_PKEY_param_check() 2db5834c43 Add a CHANGES entry for the cosmetic differences in textual output d8a809db4b apps: Make load_key_certs_crls to read only what is expected ea51096e51 apps: Add maybe_stdin argument to load_certs and set it in pkcs12 8287a4c3b2 Tiny clarification of comment for RSA_sign 3a37ddde91 Fix DSA EVP_PKEY_param_check() when defaults are used for param generation. Build log ended with (last 100 lines): clang -I. -Icrypto -Iinclude -Iproviders/implementations/include -Iproviders/common/include -I../openssl -I../openssl/crypto -I../openssl/include -I../openssl/providers/implementations/include -I../openssl/providers/common/include -DMD5_ASM -DOPENSSL_BN_ASM_GF2m -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -fPIC -pthread -m64 -Wa,--noexecstack -Qunused-arguments -Wall -O0 -g -DDEBUG_UNUSED -DPEDANTIC -pedantic -Wno-long-long -Wall -Wextra -Wno-unused-parameter -Wno-missing-field-initializers -Wswitch -Wsign-compare -Wshadow -Wformat -Wtype-limits -Wundef -Werror -Wmissing-prototypes -Wstrict-prototypes -Wno-unknown-warning-option -Wswitch-default -Wno-parentheses-equality -Wno-language-extension-token -Wno-extended-offsetof -Wconditional-uninitialized -Wincompatible-pointer-types-discards-qualifiers -Wmissing-variable-declarations -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib/ engines-3\"" -DMODULESDIR="\"/usr/local/lib/ossl-modules\"" -DOPENSSL_BUILDING_OPENSSL -MMD -MF providers/implementations/ciphers/liblegacy-lib-cipher_rc4_hmac_md5.d.tmp -MT providers/implementations/ciphers/liblegacy-lib-cipher_rc4_hmac_md5.o -c -o providers/implementations/ciphers/liblegacy-lib-cipher_rc4_hmac_md5.o ../openssl/providers/implementations/ciphers/cipher_rc4_hmac_md5.c clang -I. -Icrypto -Iinclude -Iproviders/implementations/include -Iproviders/common/include -I../openssl -I../openssl/crypto -I../openssl/include -I../openssl/providers/implementations/include -I../openssl/providers/common/include -DMD5_ASM -DOPENSSL_BN_ASM_GF2m -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -fPIC -pthread -m64 -Wa,--noexecstack -Qunused-arguments -Wall -O0 -g -DDEBUG_UNUSED -DPEDANTIC -pedantic -Wno-long-long -Wall -Wextra -Wno-unused-parameter -Wno-missing-field-initializers -Wswitch -Wsign-compare -Wshadow -Wformat -Wtype-limits -Wundef -Werror -Wmissing-prototypes -Wstrict-prototypes -Wno-unknown-warning-option -Wswitch-default -Wno-parentheses-equality -Wno-language-extension-token -Wno-extended-offsetof -Wconditional-uninitialized -Wincompatible-pointer-types-discards-qualifiers -Wmissing-variable-declarations -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib/ engines-3\"" -DMODULESDIR="\"/usr/local/lib/ossl-modules\"" -DOPENSSL_BUILDING_OPENSSL -MMD -MF providers/implementations/ciphers/liblegacy-lib-cipher_rc4_hmac_md5_hw.d.tmp -MT providers/implementations/ciphers/liblegacy-lib-cipher_rc4_hmac_md5_hw.o -c -o providers/implementations/ciphers/liblegacy-lib-cipher_rc4_hmac_md5_hw.o ../openssl/providers/implementations/ciphers/cipher_rc4_hmac_md5_hw.c clang -I. -Icrypto -Iinclude -Iproviders/implementations/inc
Still FAILED build of OpenSSL branch master with options -d --strict-warnings no-asm
Platform and configuration command: $ uname -a Linux run 5.4.0-65-generic #73-Ubuntu SMP Mon Jan 18 17:25:17 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux $ CC=clang ../openssl/config -d --strict-warnings no-asm Commit log since last time: 9a48544058 Make EVP_PKEY_missing_parameters work properly on provided RSA keys e08993eab6 evp_keymgmt_util_copy: Fix possible leak on copy failure 48fad58f7b apps/crl: Print just the hash value if printing just hash 50864bd2f7 Convert some TODO(3.0) comments in init.c to normal comments 19ad1e9d37 Remove a TODO(3.0) from EVP_PKEY_derive_set_peer() d11f644ba5 Fix up issues found when running evp_extra_test with a non-default library context 062490dbd0 Add testing for non-default library context into evp_extra_test 4139a0c6ec EVP_KDF-KB man page: fixup ABI/API change 1f79baa55e Remove TODOs from digest.c 7128458b8a params: clean up TODO 8f391c7d1b doc: remove TODOs about redesigning the AEAD API 95856e34bb prov: remove todos in rsa_keymgmt.c cc32fbdca1 prov: remove TODO in der_rsa_key.c d1f790de0c Add some encoder and decoder code examples 5db682733d Fix a TODO(3.0) in the siphash code 37cddb2e2d p_lib.c: Remove TODO comments a289d3a427 property_test: use property values that are not used elsewhere 2217d4c9cc core_get_libctx: use assert() instead of ossl_assert() a23deef281 provider_core: Remove two TODO 3.0 a8275fbc4a decoder_process: data_structure can be NULL 1e08f3ba9e property: default queries create the property values. bd55a0be1b Use --debug with no-caching build as sanitizers need it 92a36b3705 Add a CHANGES entry for EVP_PKEY_public_check() and EVP_KEY_param_check() 2cf8bb46fc Ensure that ECX keys pass EVP_PKEY_param_check() 2db5834c43 Add a CHANGES entry for the cosmetic differences in textual output d8a809db4b apps: Make load_key_certs_crls to read only what is expected ea51096e51 apps: Add maybe_stdin argument to load_certs and set it in pkcs12 8287a4c3b2 Tiny clarification of comment for RSA_sign 3a37ddde91 Fix DSA EVP_PKEY_param_check() when defaults are used for param generation. Build log ended with (last 100 lines): X963KDF : (KAT_KDF) : Pass X942KDF : (KAT_KDF) : Pass HASH : (DRBG) : Pass CTR : (DRBG) : Pass HMAC : (DRBG) : Pass DH : (KAT_KA) : Pass ECDH : (KAT_KA) : Pass RSA_Encrypt : (KAT_AsymmetricCipher) : Pass RSA_Decrypt : (KAT_AsymmetricCipher) : Pass RSA_Decrypt : (KAT_AsymmetricCipher) : Pass INSTALL PASSED make depend && make _tests make[1]: Entering directory '/home/openssl/run-checker/no-asm' make[1]: Leaving directory '/home/openssl/run-checker/no-asm' make[1]: Entering directory '/home/openssl/run-checker/no-asm' ( SRCTOP=../openssl \ BLDTOP=. \ PERL="/usr/bin/perl" \ FIPSKEY="f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813" \ EXE_EXT= \ /usr/bin/perl ../openssl/test/run_tests.pl ) 01-test_abort.t ok 01-test_fipsmodule_cnf.t ... ok 01-test_sanity.t ... ok 01-test_symbol_presence.t .. ok 01-test_test.t . ok 02-test_errstr.t ... ok 02-test_internal_context.t . ok 02-test_internal_ctype.t ... ok 02-test_internal_keymgmt.t . ok 02-test_internal_provider.t ok 02-test_lhash.t ok 02-test_ordinals.t . ok 02-test_sparse_array.t . ok 02-test_stack.t ok 03-test_exdata.t ... ok 03-test_fipsinstall.t .. ok 03-test_internal_asn1.t ok 03-test_internal_asn1_dsa.t ok 03-test_internal_bn.t .. ok 03-test_internal_chacha.t .. ok 03-test_internal_curve448.t ok 03-test_internal_ec.t .. ok 03-test_internal_ffc.t . ok 03-test_internal_mdc2.t ok 03-test_internal_modes.t ... ok 03-test_internal_namemap.t . ok 03-test_internal_poly1305.t ok 03-test_internal_rsa_sp800_56b.t ... ok 03-test_internal_siphash.t . ok 03-test_internal_sm2.t . ok 03-test_internal_sm4.t . ok 03-test_internal_ssl_cert_table.t .. ok 03-test_internal_x509.t ok 03-test_params_api.t ... ok 03-test_property.t . ok 03-test_ui.t ... ok 04-test_asn1_decode.t .. ok 04-test_asn1_encode.t .. ok 04-test_asn1_string_table.t ok 04-test_bio_callback.t . ok 04-test_bioprint.t . ok 04-test_conf.t . ok 04-test_encoder_decoder.t .. ok 04-test_encoder_decoder_legacy.t ... ok 04-test_err.t .. ok 04-test_hexstring.t ok 04-test_param_build.t .. ok 04-test_params.t ... ok 04-test_params_conversion.t ok 04-test_pem.t .. ok 04-test_pem_read_depr.t ok 04-test_provider.t . ok 04-test_provider_fallback.t ok 05-test_bf.t ... ok 05-test_cas
Build failed: openssl master.40766
Build openssl master.40766 failed Commit ffcd925a8c by Dr. David von Oheimb on 3/16/2021 2:32 PM: fixup! fixup! TS and CMS CAdES-BES: Refactor check_signing_certs() funcs into common ESS func Configure your notification preferences
[openssl] master update
The branch master has been updated
via 11c7874d0c055450783252e68d97dc1de7151dc3 (commit)
from 9a4854405869158bd87ee90345b933815882a24d (commit)
- Log -
commit 11c7874d0c055450783252e68d97dc1de7151dc3
Author: Pauli
Date: Tue Mar 16 08:29:35 2021 +1000
ci: add a no-legacy build
Fixes #12091
Reviewed-by: Tomas Mraz
Reviewed-by: Shane Lontis
(Merged from https://github.com/openssl/openssl/pull/14563)
---
Summary of changes:
.github/workflows/ci.yml | 11 +++
1 file changed, 11 insertions(+)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6a2e47cbbd..7adc2ab746 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -124,6 +124,17 @@ jobs:
- name: make test
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
+ no-legacy:
+runs-on: ubuntu-latest
+steps:
+- uses: actions/checkout@v2
+- name: config
+ run: ./config --strict-warnings no-legacy && perl configdata.pm --dump
+- name: make
+ run: make -s -j4
+- name: make test
+ run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
+
legacy:
runs-on: ubuntu-latest
steps:
[openssl] master update
The branch master has been updated
via 9a4854405869158bd87ee90345b933815882a24d (commit)
via e08993eab65cdc67a3f2078e99f366c155eed49d (commit)
from 48fad58f7b170ee9b81231d6aa65d39e13fbe09b (commit)
- Log -
commit 9a4854405869158bd87ee90345b933815882a24d
Author: Tomas Mraz
Date: Thu Mar 11 13:31:13 2021 +0100
Make EVP_PKEY_missing_parameters work properly on provided RSA keys
This requires changing semantics of the keymgmt_has()
function a little in the sense that it now returns 1
if the selection has no meaning for the key type. It
was already doing so for ECX keys for example.
The keymgmt_validate function semantics is changed
similarly to allow passing validation on the same
selection that the key returns 1 for.
Fixes #14509
Reviewed-by: Matt Caswell
(Merged from https://github.com/openssl/openssl/pull/14511)
commit e08993eab65cdc67a3f2078e99f366c155eed49d
Author: Tomas Mraz
Date: Thu Mar 11 13:29:42 2021 +0100
evp_keymgmt_util_copy: Fix possible leak on copy failure
Reviewed-by: Matt Caswell
(Merged from https://github.com/openssl/openssl/pull/14511)
---
Summary of changes:
crypto/evp/keymgmt_lib.c | 8 ++--
doc/man7/provider-keymgmt.pod | 10 -
providers/implementations/keymgmt/dh_kmgmt.c | 32 +++
providers/implementations/keymgmt/dsa_kmgmt.c | 32 +++
providers/implementations/keymgmt/ec_kmgmt.c | 48 +++---
providers/implementations/keymgmt/ecx_kmgmt.c | 20 -
.../implementations/keymgmt/kdf_legacy_kmgmt.c | 2 +-
providers/implementations/keymgmt/rsa_kmgmt.c | 48 +-
test/evp_pkey_provided_test.c | 18 +---
9 files changed, 111 insertions(+), 107 deletions(-)
diff --git a/crypto/evp/keymgmt_lib.c b/crypto/evp/keymgmt_lib.c
index 4f0dc2d4a7..872a63ae47 100644
--- a/crypto/evp/keymgmt_lib.c
+++ b/crypto/evp/keymgmt_lib.c
@@ -455,8 +455,10 @@ int evp_keymgmt_util_copy(EVP_PKEY *to, EVP_PKEY *from,
int selection)
* implemented, so just copy and be done
*/
if (!evp_keymgmt_copy(to_keymgmt, to_keydata, from->keydata,
- selection))
+ selection)) {
+evp_keymgmt_freedata(to_keymgmt, alloc_keydata);
return 0;
+}
} else if (match_type(to_keymgmt, from->keymgmt)) {
struct evp_keymgmt_util_try_import_data_st import_data;
@@ -466,10 +468,8 @@ int evp_keymgmt_util_copy(EVP_PKEY *to, EVP_PKEY *from,
int selection)
if (!evp_keymgmt_util_export(from, selection,
&evp_keymgmt_util_try_import,
- &import_data)) {
-evp_keymgmt_freedata(to_keymgmt, alloc_keydata);
+ &import_data))
return 0;
-}
/*
* In case to_keydata was previously unallocated,
diff --git a/doc/man7/provider-keymgmt.pod b/doc/man7/provider-keymgmt.pod
index fa901b2742..ce24cc485f 100644
--- a/doc/man7/provider-keymgmt.pod
+++ b/doc/man7/provider-keymgmt.pod
@@ -294,7 +294,10 @@ OSSL_FUNC_keymgmt_has() should check whether the given
I contains the s
of data indicated by the I. A combination of several
selector bits must consider all those subsets, not just one. An
implementation is, however, free to consider an empty subset of data
-to still be a valid subset.
+to still be a valid subset. For algorithms where some selection is
+not meaningful such as B for
+RSA keys the function should just return 1 as the selected subset
+is not really missing in the key.
OSSL_FUNC_keymgmt_validate() should check if the I contains valid
data subsets indicated by I. Some combined selections of
@@ -307,7 +310,10 @@ performed on the subset of data. Two types of check are
defined:
B and B.
The interpretation of how much checking is performed in a full check versus a
quick check is key type specific. Some providers may have no distinction
-between a full check and a quick check.
+between a full check and a quick check. For algorithms where some selection is
+not meaningful such as B for
+RSA keys the function should just return 1 as there is nothing to validate for
+that selection.
OSSL_FUNC_keymgmt_match() should check if the data subset indicated by
I in I and I match. It is assumed that
diff --git a/providers/implementations/keymgmt/dh_kmgmt.c
b/providers/implementations/keymgmt/dh_kmgmt.c
index da111c2cd7..abaf6c9ce8 100644
--- a/providers/implementations/keymgmt/dh_kmgmt.c
+++ b/providers/implementations/keymgmt/dh_kmgmt.c
@@ -128,19 +128,19 @@ static void dh_freedata(void *keydata)
static int dh_has(const void *keydata,
[openssl] master update
The branch master has been updated
via 48fad58f7b170ee9b81231d6aa65d39e13fbe09b (commit)
from 50864bd2f7bcbc76cb68c46c4f4c6ce57c683a5f (commit)
- Log -
commit 48fad58f7b170ee9b81231d6aa65d39e13fbe09b
Author: Tomas Mraz
Date: Mon Mar 15 13:53:10 2021 +0100
apps/crl: Print just the hash value if printing just hash
This partially reverts the output format change for
openssl crl -hash output.
Fixes #14546
Reviewed-by: David von Oheimb
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/14553)
---
Summary of changes:
apps/crl.c | 12
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/apps/crl.c b/apps/crl.c
index 1f12e24a4b..e2ed9588e6 100644
--- a/apps/crl.c
+++ b/apps/crl.c
@@ -308,15 +308,19 @@ int crl_main(int argc, char **argv)
X509_NAME_hash_ex(X509_CRL_get_issuer(x),
app_get0_libctx(),
app_get0_propq(), &ok);
-BIO_printf(bio_out, "issuer name hash=");
-if (ok)
+if (num > 1)
+BIO_printf(bio_out, "issuer name hash=");
+if (ok) {
BIO_printf(bio_out, "%08lx\n", hash_value);
-else
+} else {
BIO_puts(bio_out, "");
+goto end;
+}
}
#ifndef OPENSSL_NO_MD5
if (hash_old == i) {
-BIO_printf(bio_out, "issuer name old hash=");
+if (num > 1)
+BIO_printf(bio_out, "issuer name old hash=");
BIO_printf(bio_out, "%08lx\n",
X509_NAME_hash_old(X509_CRL_get_issuer(x)));
}
[openssl] master update
The branch master has been updated
via 50864bd2f7bcbc76cb68c46c4f4c6ce57c683a5f (commit)
from 19ad1e9d3737f48c0e1c5cc5397ff1827b6946b8 (commit)
- Log -
commit 50864bd2f7bcbc76cb68c46c4f4c6ce57c683a5f
Author: Matt Caswell
Date: Mon Mar 15 16:55:46 2021 +
Convert some TODO(3.0) comments in init.c to normal comments
There is no need to make the suggested changes in the 3.0 timescale.
These are just suggested improvements for the future.
Fixes #14375
Reviewed-by: Tomas Mraz
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/14556)
---
Summary of changes:
crypto/init.c | 8
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/crypto/init.c b/crypto/init.c
index 3b6a16a76d..09be58ea12 100644
--- a/crypto/init.c
+++ b/crypto/init.c
@@ -347,8 +347,8 @@ void OPENSSL_cleanup(void)
OPENSSL_INIT_STOP *currhandler, *lasthandler;
/*
- * TODO(3.0): This function needs looking at with a view to moving most/all
- * of this into onfree handlers in OSSL_LIB_CTX.
+ * At some point we should consider looking at this function with a view to
+ * moving most/all of this into onfree handlers in OSSL_LIB_CTX.
*/
/* If we've not been inited then no need to deinit */
@@ -488,8 +488,8 @@ int OPENSSL_init_crypto(uint64_t opts, const
OPENSSL_INIT_SETTINGS *settings)
}
/*
- * TODO(3.0): This function needs looking at with a view to moving most/all
- * of this into OSSL_LIB_CTX.
+ * At some point we should look at this function with a view to moving
+ * most/all of this into OSSL_LIB_CTX.
*/
if (stopped) {
[openssl] master update
The branch master has been updated
via 19ad1e9d3737f48c0e1c5cc5397ff1827b6946b8 (commit)
from d11f644ba5f5c7a6e925e625899589d0cdd2c84b (commit)
- Log -
commit 19ad1e9d3737f48c0e1c5cc5397ff1827b6946b8
Author: Matt Caswell
Date: Mon Mar 15 16:21:45 2021 +
Remove a TODO(3.0) from EVP_PKEY_derive_set_peer()
The TODO described a case where a legacy derive operation is called, but
the peer key is provider based. In practice this will almost never be a
problem. We should never end up in our own legacy EVP_PKEY_METHOD
implementations if no ENGINE has been configured. If an ENGINE has been
configured then we we will be using a third party EVP_PKEY_METHOD
implementation and public APIs will be used to obtain the key data from the
peer key so there will be no "reaching inside" the pkey.
There is a theoretical case where a third party ENGINE wraps our own
internal EVP_PKEY_METHODs using EVP_PKEY_meth_find() or
EVP_PKEY_meth_get0(). For these cases we just ensure all our
EVP_PKEY_METHODs never reach "inside" the implementation of a peer key. We
can never assume that it is a legacy key.
Fixes #14399
Reviewed-by: Tomas Mraz
(Merged from https://github.com/openssl/openssl/pull/14555)
---
Summary of changes:
crypto/dh/dh_pmeth.c | 19 +--
crypto/ec/ec_pmeth.c | 11 +--
crypto/ec/ecx_meth.c | 2 +-
crypto/evp/exchange.c | 4
4 files changed, 23 insertions(+), 13 deletions(-)
diff --git a/crypto/dh/dh_pmeth.c b/crypto/dh/dh_pmeth.c
index fdd9194f1a..584a174ae2 100644
--- a/crypto/dh/dh_pmeth.c
+++ b/crypto/dh/dh_pmeth.c
@@ -421,23 +421,30 @@ static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned
char *key,
{
int ret;
DH *dh;
+const DH *dhpub;
DH_PKEY_CTX *dctx = ctx->data;
-BIGNUM *dhpub;
-if (!ctx->pkey || !ctx->peerkey) {
+BIGNUM *dhpubbn;
+
+if (ctx->pkey == NULL || ctx->peerkey == NULL) {
ERR_raise(ERR_LIB_DH, DH_R_KEYS_NOT_SET);
return 0;
}
dh = ctx->pkey->pkey.dh;
-dhpub = ctx->peerkey->pkey.dh->pub_key;
+dhpub = EVP_PKEY_get0_DH(ctx->peerkey);
+if (dhpub == NULL) {
+ERR_raise(ERR_LIB_DH, DH_R_KEYS_NOT_SET);
+return 0;
+}
+dhpubbn = dhpub->pub_key;
if (dctx->kdf_type == EVP_PKEY_DH_KDF_NONE) {
if (key == NULL) {
*keylen = DH_size(dh);
return 1;
}
if (dctx->pad)
-ret = DH_compute_key_padded(key, dhpub, dh);
+ret = DH_compute_key_padded(key, dhpubbn, dh);
else
-ret = DH_compute_key(key, dhpub, dh);
+ret = DH_compute_key(key, dhpubbn, dh);
if (ret < 0)
return ret;
*keylen = ret;
@@ -461,7 +468,7 @@ static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char
*key,
if (Z == NULL) {
goto err;
}
-if (DH_compute_key_padded(Z, dhpub, dh) <= 0)
+if (DH_compute_key_padded(Z, dhpubbn, dh) <= 0)
goto err;
if (!DH_KDF_X9_42(key, *keylen, Z, Zlen, dctx->kdf_oid,
dctx->kdf_ukm, dctx->kdf_ukmlen, dctx->kdf_md))
diff --git a/crypto/ec/ec_pmeth.c b/crypto/ec/ec_pmeth.c
index 2280189e28..e4f3549d30 100644
--- a/crypto/ec/ec_pmeth.c
+++ b/crypto/ec/ec_pmeth.c
@@ -161,8 +161,15 @@ static int pkey_ec_derive(EVP_PKEY_CTX *ctx, unsigned char
*key, size_t *keylen)
size_t outlen;
const EC_POINT *pubkey = NULL;
EC_KEY *eckey;
+const EC_KEY *eckeypub;
EC_PKEY_CTX *dctx = ctx->data;
-if (!ctx->pkey || !ctx->peerkey) {
+
+if (ctx->pkey == NULL || ctx->peerkey == NULL) {
+ERR_raise(ERR_LIB_EC, EC_R_KEYS_NOT_SET);
+return 0;
+}
+eckeypub = EVP_PKEY_get0_EC_KEY(ctx->peerkey);
+if (eckeypub == NULL) {
ERR_raise(ERR_LIB_EC, EC_R_KEYS_NOT_SET);
return 0;
}
@@ -178,7 +185,7 @@ static int pkey_ec_derive(EVP_PKEY_CTX *ctx, unsigned char
*key, size_t *keylen)
*keylen = (EC_GROUP_get_degree(group) + 7) / 8;
return 1;
}
-pubkey = EC_KEY_get0_public_key(ctx->peerkey->pkey.ec);
+pubkey = EC_KEY_get0_public_key(eckeypub);
/*
* NB: unlike PKCS#3 DH, if *outlen is less than maximum size this is not
diff --git a/crypto/ec/ecx_meth.c b/crypto/ec/ecx_meth.c
index cd73a15847..9a812c875b 100644
--- a/crypto/ec/ecx_meth.c
+++ b/crypto/ec/ecx_meth.c
@@ -766,7 +766,7 @@ static int validate_ecx_derive(EVP_PKEY_CTX *ctx, unsigned
char *key,
return 0;
}
ecxkey = ctx->pkey->pkey.ecx;
-peerkey = ctx->peerkey->pkey.ecx;
+peerkey = EVP_PKEY_get0(ctx->peerkey);
if (ecxkey == NULL || ecxkey->privkey == NULL) {
ERR_raise(ERR_LIB_EC, EC_R_INVALID_PRIVATE_KEY);
return 0;
diff --git a/crypto/evp/exch
[openssl] master update
The branch master has been updated
via d11f644ba5f5c7a6e925e625899589d0cdd2c84b (commit)
via 062490dbd05a205824a239336f6a60bf00a7ca1d (commit)
from 4139a0c6ec4633351929fdde728dc984f562c51c (commit)
- Log -
commit d11f644ba5f5c7a6e925e625899589d0cdd2c84b
Author: Jon Spillett
Date: Mon Mar 15 11:33:21 2021 +1000
Fix up issues found when running evp_extra_test with a non-default library
context
Reviewed-by: Tomas Mraz
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/14478)
commit 062490dbd05a205824a239336f6a60bf00a7ca1d
Author: Jon Spillett
Date: Tue Mar 9 20:42:57 2021 +1000
Add testing for non-default library context into evp_extra_test
Reviewed-by: Tomas Mraz
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/14478)
---
Summary of changes:
crypto/rsa/rsa_chk.c | 8 +-
crypto/rsa/rsa_gen.c | 5 +-
crypto/sm2/sm2_crypt.c | 2 +-
test/evp_extra_test.c| 197 ---
test/recipes/30-test_evp_extra.t | 6 +-
5 files changed, 157 insertions(+), 61 deletions(-)
diff --git a/crypto/rsa/rsa_chk.c b/crypto/rsa/rsa_chk.c
index e61a5df089..0c32e01426 100644
--- a/crypto/rsa/rsa_chk.c
+++ b/crypto/rsa/rsa_chk.c
@@ -47,7 +47,7 @@ static int rsa_validate_keypair_multiprime(const RSA *key,
BN_GENCB *cb)
k = BN_new();
l = BN_new();
m = BN_new();
-ctx = BN_CTX_new();
+ctx = BN_CTX_new_ex(key->libctx);
if (i == NULL || j == NULL || k == NULL || l == NULL
|| m == NULL || ctx == NULL) {
ret = -1;
@@ -65,13 +65,13 @@ static int rsa_validate_keypair_multiprime(const RSA *key,
BN_GENCB *cb)
}
/* p prime? */
-if (BN_check_prime(key->p, NULL, cb) != 1) {
+if (BN_check_prime(key->p, ctx, cb) != 1) {
ret = 0;
ERR_raise(ERR_LIB_RSA, RSA_R_P_NOT_PRIME);
}
/* q prime? */
-if (BN_check_prime(key->q, NULL, cb) != 1) {
+if (BN_check_prime(key->q, ctx, cb) != 1) {
ret = 0;
ERR_raise(ERR_LIB_RSA, RSA_R_Q_NOT_PRIME);
}
@@ -79,7 +79,7 @@ static int rsa_validate_keypair_multiprime(const RSA *key,
BN_GENCB *cb)
/* r_i prime? */
for (idx = 0; idx < ex_primes; idx++) {
pinfo = sk_RSA_PRIME_INFO_value(key->prime_infos, idx);
-if (BN_check_prime(pinfo->r, NULL, cb) != 1) {
+if (BN_check_prime(pinfo->r, ctx, cb) != 1) {
ret = 0;
ERR_raise(ERR_LIB_RSA, RSA_R_MP_R_NOT_PRIME);
}
diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c
index ccd07c33fb..a2192df575 100644
--- a/crypto/rsa/rsa_gen.c
+++ b/crypto/rsa/rsa_gen.c
@@ -103,7 +103,7 @@ static int rsa_multiprime_keygen(RSA *rsa, int bits, int
primes,
goto err;
}
-ctx = BN_CTX_new();
+ctx = BN_CTX_new_ex(rsa->libctx);
if (ctx == NULL)
goto err;
BN_CTX_start(ctx);
@@ -187,7 +187,8 @@ static int rsa_multiprime_keygen(RSA *rsa, int bits, int
primes,
for (;;) {
redo:
-if (!BN_generate_prime_ex(prime, bitsr[i] + adj, 0, NULL, NULL,
cb))
+if (!BN_generate_prime_ex2(prime, bitsr[i] + adj, 0, NULL, NULL,
+ cb, ctx))
goto err;
/*
* prime should not be equal to p, q, r_3...
diff --git a/crypto/sm2/sm2_crypt.c b/crypto/sm2/sm2_crypt.c
index cadc8ae201..2b8b10e25d 100644
--- a/crypto/sm2/sm2_crypt.c
+++ b/crypto/sm2/sm2_crypt.c
@@ -187,7 +187,7 @@ int ossl_sm2_encrypt(const EC_KEY *key,
memset(ciphertext_buf, 0, *ciphertext_len);
-if (!BN_priv_rand_range(k, order)) {
+if (!BN_priv_rand_range_ex(k, order, ctx)) {
ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
goto done;
}
diff --git a/test/evp_extra_test.c b/test/evp_extra_test.c
index 9317917303..45ca43aee1 100644
--- a/test/evp_extra_test.c
+++ b/test/evp_extra_test.c
@@ -37,6 +37,11 @@
#include "../e_os.h" /* strcasecmp */
static OSSL_LIB_CTX *testctx = NULL;
+static char *testpropq = NULL;
+
+static OSSL_PROVIDER *nullprov = NULL;
+static OSSL_PROVIDER *deflprov = NULL;
+static OSSL_PROVIDER *lgcyprov = NULL;
/*
* kExampleRSAKeyDER is an RSA private key in ASN.1, DER format. Of course, you
@@ -442,7 +447,7 @@ static EVP_PKEY *load_example_key(const char *keytype,
EVP_PKEY *pkey = NULL;
OSSL_DECODER_CTX *dctx =
OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", NULL, keytype, 0,
- testctx, NULL);
+ testctx, testpropq);
/* |pkey| will be NULL on error */
(void)OSSL_DECODER_from_data(dctx, pdata, &data_len);
@@ -516,7 +521,7 @@ static int test_fromdata(char *keytype, OSSL_PARAM *params)
EVP_PKEY *pkey =
