openssl.git
2 years agoremove duplicate tests
Dr. Stephen Henson [Thu, 11 May 2017 23:31:18 +0000 (00:31 +0100)]
remove duplicate tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3451)

2 years agoAdd tests
Dr. Stephen Henson [Fri, 12 May 2017 00:11:00 +0000 (01:11 +0100)]
Add tests

Import test data from sha1test.c, sha256t.c and sha512t.c which is
from RFC6234 section 8.5

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3451)

2 years agoAdd support for multiple update calls in evp_test
Dr. Stephen Henson [Thu, 11 May 2017 18:28:09 +0000 (19:28 +0100)]
Add support for multiple update calls in evp_test

Allow multiple "Input" lines to call the update function multiple times.
Add "Ncopy" keyword to copy the input buffer. So for example:

Input = "a"
Ncopy = 1024

Will create a buffer consisting of 1024 "a" characters.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3451)

2 years agoFix return code in tls1_mac
Matt Caswell [Fri, 19 May 2017 09:28:43 +0000 (10:28 +0100)]
Fix return code in tls1_mac

The return code from tls1_mac is supposed to be a boolean 0 for fail, 1 for
success. In one place we returned -1 on error. This would cause code calling
the mac function to erroneously see this as a success (because a non-zero
value is being treated as success in all call sites).

Fortunately, AFAICT, the place that returns -1 can only happen on an
internal error so is not under attacker control. Additionally this code only
appears in master. In 1.1.0 the return codes are treated differently.
Therefore there are no security implications.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3495)

2 years agoReformat the output of BIGNUMS where test cases fail.
Pauli [Sun, 14 May 2017 22:49:36 +0000 (08:49 +1000)]
Reformat the output of BIGNUMS where test cases fail.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3465)

2 years agoFix endless loop on srp app when listing users
Diego Santa Cruz [Wed, 17 May 2017 08:17:59 +0000 (10:17 +0200)]
Fix endless loop on srp app when listing users

With the -list option the srp app loops on the main while() endlessly,
whether users were given on the command line or not. The loop should
be stopped when in list mode and there are no more users.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3489)

2 years agoFix ASN1_TIME_to_generalizedtime to take a const ASN1_TIME
Matt Caswell [Tue, 2 May 2017 10:08:33 +0000 (11:08 +0100)]
Fix ASN1_TIME_to_generalizedtime to take a const ASN1_TIME

Fixes #1526

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3360)

2 years agoMake SSL_is_server() accept a const SSL
Matt Caswell [Tue, 2 May 2017 10:00:50 +0000 (11:00 +0100)]
Make SSL_is_server() accept a const SSL

Fixes #1526

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3360)

2 years agoTry to be more consistent about the alerts we send
Matt Caswell [Tue, 16 May 2017 16:28:23 +0000 (17:28 +0100)]
Try to be more consistent about the alerts we send

We are quite inconsistent about which alerts get sent. Specifically, these
alerts should be used (normally) in the following circumstances:

SSL_AD_DECODE_ERROR = The peer sent a syntactically incorrect message
SSL_AD_ILLEGAL_PARAMETER = The peer sent a message which was syntactically
correct, but a parameter given is invalid for the context
SSL_AD_HANDSHAKE_FAILURE = The peer's messages were syntactically and
semantically correct, but the parameters provided were unacceptable to us
(e.g. because we do not support the requested parameters)
SSL_AD_INTERNAL_ERROR = We messed up (e.g. malloc failure)

The standards themselves aren't always consistent but I think the above
represents the best interpretation.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3480)

2 years agoFix EXT_RETURN usage for add_key_share()
Matt Caswell [Thu, 18 May 2017 09:05:02 +0000 (10:05 +0100)]
Fix EXT_RETURN usage for add_key_share()

add_key_share() is a helper function used during key_share extension
construction. It is expected to be a simple boolean success/fail return.
It shouldn't be using the new EXT_RETURN type but it was partially converted
anyway. This changes it back.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3488)

2 years agoFix typo in INSTALL file
Paul Yang [Mon, 15 May 2017 13:01:53 +0000 (21:01 +0800)]
Fix typo in INSTALL file

recocognised -> recognised

CLA: trivial

Signed-off-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3470)

2 years agoFix compile error/warning in packettest.c
Todd Short [Tue, 9 May 2017 14:19:10 +0000 (10:19 -0400)]
Fix compile error/warning in packettest.c

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3416)

2 years agoAdd a test for a missing sig algs extension
Matt Caswell [Tue, 16 May 2017 11:05:57 +0000 (12:05 +0100)]
Add a test for a missing sig algs extension

Check that a missing sig algs extension succeeds if we are resuming.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3478)

2 years agoAllow a missing sig algs extension if resuming
Matt Caswell [Tue, 16 May 2017 11:04:00 +0000 (12:04 +0100)]
Allow a missing sig algs extension if resuming

The current TLSv1.3 spec says:

'If a server is authenticating via a certificate and the client has not
sent a "signature_algorithms" extension, then the server MUST abort the
handshake with a "missing_extension" alert (see Section 8.2).'

If we are resuming then we are not "authenticating via a certificate" but
we were still aborting with the missing_extension alert if sig algs was
missing.

This commit ensures that we only send the alert if we are not resuming.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3478)

2 years agoAdd a new unsolicited extension error code and add enum tag
Matt Caswell [Wed, 17 May 2017 09:31:46 +0000 (10:31 +0100)]
Add a new unsolicited extension error code and add enum tag

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3418)

2 years agoAdd tests for unsolicited extensions
Matt Caswell [Tue, 9 May 2017 15:42:01 +0000 (16:42 +0100)]
Add tests for unsolicited extensions

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3418)

2 years agoFail if we receive a response to an extension that we didn't request
Matt Caswell [Tue, 9 May 2017 12:44:25 +0000 (13:44 +0100)]
Fail if we receive a response to an extension that we didn't request

We already did this on an ad-hoc per extension basis (for some extensions).
This centralises it and makes sure we do it for all extensions.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3418)

2 years agoRemove notification settings from appveyor.yml
Richard Levitte [Wed, 17 May 2017 06:28:55 +0000 (08:28 +0200)]
Remove notification settings from appveyor.yml

Notifications can be (and should be) configured on account basis on
the CI web site.  This avoids getting emails to openssl-commits for
personal accounts that also build OpenSSL stuff.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3484)

2 years agoDon't allow fragmented alerts
Matt Caswell [Mon, 15 May 2017 10:24:24 +0000 (11:24 +0100)]
Don't allow fragmented alerts

An alert message is 2 bytes long. In theory it is permissible in SSLv3 -
TLSv1.2 to fragment such alerts across multiple records (some of which
could be empty). In practice it make no sense to send an empty alert
record, or to fragment one. TLSv1.3 prohibts this altogether and other
libraries (BoringSSL, NSS) do not support this at all. Supporting it adds
significant complexity to the record layer, and its removal is unlikely
to cause inter-operability issues.

The DTLS code for this never worked anyway and it is not supported at a
protocol level for DTLS. Similarly fragmented DTLS handshake records only
work at a protocol level where at least the handshake message header
exists within the record. DTLS code existed for trying to handle fragmented
handshake records smaller than this size. This code didn't work either so
has also been removed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3476)

2 years agoUse BIO not FILE for test file
Rich Salz [Mon, 15 May 2017 18:49:37 +0000 (14:49 -0400)]
Use BIO not FILE for test file

Allow multiple file arguments.
Split bntests.txt into separate files.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3471)

2 years agoDocument the history of BIO_gets() on BIO_fd().
Tomas Mraz [Fri, 12 May 2017 08:26:13 +0000 (10:26 +0200)]
Document the history of BIO_gets() on BIO_fd().

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3442)

2 years agoDocument that BIO_gets() preserves '\n'.
Tomas Mraz [Wed, 23 Nov 2016 08:33:55 +0000 (09:33 +0100)]
Document that BIO_gets() preserves '\n'.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3442)

2 years agoDo not eat trailing '\n' in BIO_gets for fd BIO.
Tomas Mraz [Tue, 15 Nov 2016 09:10:32 +0000 (10:10 +0100)]
Do not eat trailing '\n' in BIO_gets for fd BIO.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3442)

2 years agoINSTALL: Remind people to read more if they added configuration options
Richard Levitte [Mon, 15 May 2017 12:59:38 +0000 (14:59 +0200)]
INSTALL: Remind people to read more if they added configuration options

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3469)

2 years agoINSTALL: clarify a bit more how Configure treats "unknown" options
Richard Levitte [Mon, 15 May 2017 12:16:17 +0000 (14:16 +0200)]
INSTALL: clarify a bit more how Configure treats "unknown" options

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3468)

2 years agoUpdate one CI test to use randomised ordering.
Pauli [Mon, 8 May 2017 22:13:35 +0000 (08:13 +1000)]
Update one CI test to use randomised ordering.

[extended tests]

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3393)

2 years agoRandomise the ordering of the C unit tests.
Pauli [Fri, 5 May 2017 03:29:40 +0000 (13:29 +1000)]
Randomise the ordering of the C unit tests.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3393)

2 years agoReview feedback; use single main, #ifdef ADD_TEST
Rich Salz [Sat, 6 May 2017 11:59:18 +0000 (07:59 -0400)]
Review feedback; use single main, #ifdef ADD_TEST

Suppose OPENSSL_USE_NODELETE (via Nick Reilly)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3399)

2 years agoConvert shlibloadtest to new framework
Rich Salz [Fri, 5 May 2017 21:39:13 +0000 (17:39 -0400)]
Convert shlibloadtest to new framework

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3399)

2 years agoAdd "Title" directive to evp_test
Rich Salz [Fri, 12 May 2017 14:03:09 +0000 (10:03 -0400)]
Add "Title" directive to evp_test

Reviewed-by: Stephen Henson <steve@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3454)

2 years agoClean up SSL_OP_* a bit
Todd Short [Wed, 10 May 2017 15:44:55 +0000 (11:44 -0400)]
Clean up SSL_OP_* a bit

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3439)

2 years agoUse scalar, not length; fixes test_evp
Rich Salz [Fri, 12 May 2017 00:42:32 +0000 (20:42 -0400)]
Use scalar, not length; fixes test_evp

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3452)

2 years agoRemove filename argument to x86 asm_init.
David Benjamin [Wed, 10 May 2017 18:24:56 +0000 (14:24 -0400)]
Remove filename argument to x86 asm_init.

The assembler already knows the actual path to the generated file and,
in other perlasm architectures, is left to manage debug symbols itself.
Notably, in OpenSSL 1.1.x's new build system, which allows a separate
build directory, converting .pl to .s as the scripts currently do result
in the wrong paths.

This also avoids inconsistencies from some of the files using $0 and
some passing in the filename.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3431)

2 years agoRename evptests.txt to evppkey.txt
Rich Salz [Thu, 11 May 2017 16:43:49 +0000 (12:43 -0400)]
Rename evptests.txt to evppkey.txt

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3443)

2 years agoSplit test/evptests.txt into separate files.
Rich Salz [Thu, 11 May 2017 16:17:38 +0000 (12:17 -0400)]
Split test/evptests.txt into separate files.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3443)

2 years agoFix infinite loops in secure memory allocation.
Todd Short [Thu, 11 May 2017 19:48:10 +0000 (15:48 -0400)]
Fix infinite loops in secure memory allocation.

Issue 1:

sh.bittable_size is a size_t but i is and int, which can result in
freelist == -1 if sh.bittable_size exceeds an int.

This seems to result in an OPENSSL_assert due to invalid allocation
size, so maybe that is "ok."

Worse, if sh.bittable_size is exactly 1<<31, then this becomes an
infinite loop (because 1<<31 is a negative int, so it can be shifted
right forever and sticks at -1).

Issue 2:

CRYPTO_secure_malloc_init() sets secure_mem_initialized=1 even when
sh_init() returns 0.

If sh_init() fails, we end up with secure_mem_initialized=1 but
sh.minsize=0. If you then call secure_malloc(), which then calls,
sh_malloc(), this then enters an infite loop since 0 << anything will
never be larger than size.

Issue 3:

That same sh_malloc loop will loop forever for a size greater
than size_t/2 because i will proceed (assuming sh.minsize=16):
i=16, 32, 64, ..., size_t/8, size_t/4, size_t/2, 0, 0, 0, 0, ....
This sequence will never be larger than "size".

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3449)

2 years agoClean away needless VMS check
Richard Levitte [Thu, 11 May 2017 18:34:08 +0000 (20:34 +0200)]
Clean away needless VMS check

BIO_socket_ioctl is only implemented on VMS for VMS version 7.0 and
up, but since we only support version 7.1 and up, there's no need to
check the VMS version.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3448)

2 years agoCleanup - use e_os2.h rather than stdint.h
Richard Levitte [Thu, 11 May 2017 18:20:07 +0000 (20:20 +0200)]
Cleanup - use e_os2.h rather than stdint.h

Not exactly everywhere, but in those source files where stdint.h is
included conditionally, or where it will be eventually

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3447)

2 years agotestutil: Fix non-standard subtest output
Richard Levitte [Thu, 11 May 2017 17:32:43 +0000 (19:32 +0200)]
testutil: Fix non-standard subtest output

In some cases, testutil outputs subtests like this:

    1..6 # Subtest: progname

The standard set by Test::More (because there really is no actual
standard yet) gives this display:

    # Subtest: progname
    1..6

Until the standard is actually agreed upon, let's do it like
Test::More.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3446)

2 years agoevp_test: use the test file name as the test title
Richard Levitte [Thu, 11 May 2017 17:13:49 +0000 (19:13 +0200)]
evp_test: use the test file name as the test title

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3445)

2 years agotestutil: add the possibility to set the current test title
Richard Levitte [Thu, 11 May 2017 17:12:48 +0000 (19:12 +0200)]
testutil: add the possibility to set the current test title

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3445)

2 years agoFix gcc-7 warnings.
Bernd Edlinger [Thu, 11 May 2017 14:21:37 +0000 (16:21 +0200)]
Fix gcc-7 warnings.
- Mostly missing fall thru comments
- And uninitialized value used in sslapitest.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3440)

2 years agoUnclash clashing reason codes in ssl.h
Richard Levitte [Thu, 11 May 2017 15:29:47 +0000 (17:29 +0200)]
Unclash clashing reason codes in ssl.h

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3441)

2 years agoUse compare_mem wrapper
Rich Salz [Mon, 8 May 2017 18:46:57 +0000 (14:46 -0400)]
Use compare_mem wrapper

Add file/line# to test error message.
Also remove expected/got fields since TEST structure prints them.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3324)

2 years agoAddress some feedback
Rich Salz [Mon, 1 May 2017 00:38:39 +0000 (20:38 -0400)]
Address some feedback

Report test detail error.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3324)

2 years agoConvert of evp_test to framework
Rich Salz [Wed, 26 Apr 2017 19:33:43 +0000 (15:33 -0400)]
Convert of evp_test to framework

Also, allow multiple files on commandline (for future splitup of
evptests.txt)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3324)

2 years agoFix regression in openssl req -x509 behaviour.
Tomas Mraz [Thu, 11 May 2017 12:25:17 +0000 (14:25 +0200)]
Fix regression in openssl req -x509 behaviour.

Allow conversion of existing requests to certificates again.
Fixes the issue #3396

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3437)

2 years agoRemove dead code.
Pauli [Thu, 11 May 2017 00:45:38 +0000 (10:45 +1000)]
Remove dead code.

The second BN_is_zero test can never be true.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3434)

2 years agoAdd some extra comments following alert changes
Matt Caswell [Thu, 11 May 2017 11:45:16 +0000 (12:45 +0100)]
Add some extra comments following alert changes

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agoAdd some checks for trailing data after extension blocks
Matt Caswell [Thu, 11 May 2017 10:31:57 +0000 (11:31 +0100)]
Add some checks for trailing data after extension blocks

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agoSend a missing_extension alert if key_share/supported groups not present
Matt Caswell [Thu, 11 May 2017 09:55:54 +0000 (10:55 +0100)]
Send a missing_extension alert if key_share/supported groups not present

Only applies if we're not doing psk.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agoTLSv1.3 alert and handshake messages can never be 0 length
Matt Caswell [Thu, 11 May 2017 09:34:25 +0000 (10:34 +0100)]
TLSv1.3 alert and handshake messages can never be 0 length

We abort if we read a message like this.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agoTLSv1.3 alerts cannot be fragmented and only one per record
Matt Caswell [Thu, 11 May 2017 09:16:34 +0000 (10:16 +0100)]
TLSv1.3 alerts cannot be fragmented and only one per record

We should be validating that.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agoCheck that a TLSv1.3 encrypted message has an app data content type
Matt Caswell [Thu, 11 May 2017 09:16:08 +0000 (10:16 +0100)]
Check that a TLSv1.3 encrypted message has an app data content type

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agoSend an illegal parameter alert if the update type in a KeyUpdate is wrong
Matt Caswell [Thu, 11 May 2017 09:14:17 +0000 (10:14 +0100)]
Send an illegal parameter alert if the update type in a KeyUpdate is wrong

Previously we sent a decode_error alert.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agoEnsure we fail with a decode error alert if the server sends and empty Cert
Matt Caswell [Thu, 11 May 2017 07:38:21 +0000 (08:38 +0100)]
Ensure we fail with a decode error alert if the server sends and empty Cert

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agoFix more alert codes
Matt Caswell [Wed, 10 May 2017 15:47:24 +0000 (16:47 +0100)]
Fix more alert codes

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agoVerify that there is no trailing data after the extensions block
Matt Caswell [Mon, 8 May 2017 14:18:25 +0000 (15:18 +0100)]
Verify that there is no trailing data after the extensions block

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agoFix some alert codes
Matt Caswell [Mon, 8 May 2017 12:45:18 +0000 (13:45 +0100)]
Fix some alert codes

Make sure we are using the correct alert codes as per the spec.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agoReject unknown warning alerts in TLSv1.3
Matt Caswell [Mon, 8 May 2017 12:10:26 +0000 (13:10 +0100)]
Reject unknown warning alerts in TLSv1.3

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)

2 years agomake update
Dr. Stephen Henson [Wed, 10 May 2017 14:22:56 +0000 (15:22 +0100)]
make update

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3409)

2 years agoAdd EVP_DigestSign and EVP_DigesVerify
Dr. Stephen Henson [Mon, 8 May 2017 11:50:13 +0000 (12:50 +0100)]
Add EVP_DigestSign and EVP_DigesVerify

Add "single part" digest sign and verify functions. These sign and verify
a message in one function. This simplifies some operations and it will later
be used as the API for algorithms which do not support the update/final
mechanism (e.g. PureEdDSA).

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3409)

2 years agoClarify that a test failed
Richard Levitte [Wed, 10 May 2017 08:01:41 +0000 (10:01 +0200)]
Clarify that a test failed

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3423)

2 years agoAdd a descriptive header to diff output from failed tests.
Pauli [Wed, 10 May 2017 22:40:12 +0000 (08:40 +1000)]
Add a descriptive header to diff output from failed tests.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3433)

2 years agoIgnore MSVC warnings (via Gisle Vanem)
Rich Salz [Tue, 9 May 2017 17:27:30 +0000 (13:27 -0400)]
Ignore MSVC warnings (via Gisle Vanem)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3420)

2 years agoAdd a test for SNI in conjunction with custom extensions
Matt Caswell [Wed, 10 May 2017 09:54:18 +0000 (10:54 +0100)]
Add a test for SNI in conjunction with custom extensions

Test that custom extensions still work even after a change in SSL_CTX due
to SNI. See #2180.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3425)

2 years agoCopy custom extension flags in a call to SSL_set_SSL_CTX()
Matt Caswell [Wed, 10 May 2017 10:28:53 +0000 (11:28 +0100)]
Copy custom extension flags in a call to SSL_set_SSL_CTX()

The function SSL_set_SSL_CTX() can be used to swap the SSL_CTX used for
a connection as part of an SNI callback. One result of this is that the
s->cert structure is replaced. However this structure contains information
about any custom extensions that have been loaded. In particular flags are
set indicating whether a particular extension has been received in the
ClientHello. By replacing the s->cert structure we lose the custom
extension flag values, and it appears as if a client has not sent those
extensions.

SSL_set_SSL_CTX() should copy any flags for custom extensions that appear
in both the old and the new cert structure.

Fixes #2180

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3425)

2 years agoFix 'no-ec'
Richard Levitte [Wed, 10 May 2017 15:09:35 +0000 (17:09 +0200)]
Fix 'no-ec'

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3430)

2 years agoPrefer TAP::Harness over Test::Harness
Richard Levitte [Wed, 10 May 2017 10:58:36 +0000 (12:58 +0200)]
Prefer TAP::Harness over Test::Harness

TAP:Harness came along in perl 5.10.1, and since we claim to support
perl 5.10.0 in configuration and testing, we can only load it
conditionally.

The main reason to use TAP::Harness rather than Test::Harness is its
capability to merge stdout and stderr output from the test recipes,
which Test::Harness can't.  The merge gives much more comprehensible
output when testing verbosely.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3424)

2 years agoAdd test_test tests for bignums.
Pauli [Mon, 8 May 2017 21:58:55 +0000 (07:58 +1000)]
Add test_test tests for bignums.
Add relative tests for bignums.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3405)

2 years agoAdd BN support to the test infrastructure.
Pauli [Mon, 8 May 2017 02:09:41 +0000 (12:09 +1000)]
Add BN support to the test infrastructure.

This includes support for:

- comparisions between pairs of BIGNUMs
- comparisions between BIGNUMs and zero
- equality comparison between BIGNUMs and one
- equality comparisons between BIGNUMs and constants
- parity checks for BIGNUMs

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3405)

2 years agoAdd test for no change following an HRR
Matt Caswell [Mon, 8 May 2017 15:05:49 +0000 (16:05 +0100)]
Add test for no change following an HRR

Verify that we fail if we receive an HRR but no change will result in
ClientHello2.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3414)

2 years agoVerify that if we have an HRR then something will change
Matt Caswell [Mon, 8 May 2017 15:05:16 +0000 (16:05 +0100)]
Verify that if we have an HRR then something will change

It is invalid if we receive an HRR but no change will result in
ClientHello2.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3414)

2 years agoMore TLSv1.3 cookie tests
Matt Caswell [Tue, 9 May 2017 07:52:48 +0000 (08:52 +0100)]
More TLSv1.3 cookie tests

Test sending a cookie without a key_share

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3414)

2 years agoFix HRR bug
Matt Caswell [Tue, 9 May 2017 07:52:04 +0000 (08:52 +0100)]
Fix HRR bug

If an HRR gets sent without a key_share (e.g. cookie only) then the code
fails when it should not.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3414)

2 years agoDon't do the final key_share checks if we are in an HRR
Matt Caswell [Mon, 8 May 2017 15:51:47 +0000 (16:51 +0100)]
Don't do the final key_share checks if we are in an HRR

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3414)

2 years agoFix some copy&paste errors and update following review feedback
Matt Caswell [Tue, 9 May 2017 09:32:48 +0000 (10:32 +0100)]
Fix some copy&paste errors and update following review feedback

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3410)

2 years agoAdd some badly formatted compression methods tests
Matt Caswell [Mon, 8 May 2017 13:48:35 +0000 (14:48 +0100)]
Add some badly formatted compression methods tests

Test that sending a non NULL compression method fails in TLSv1.3 as well
as other similar tests.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3410)

2 years agoVerify that only NULL compression is sent in TLSv1.3 ClientHello
Matt Caswell [Mon, 8 May 2017 13:47:33 +0000 (14:47 +0100)]
Verify that only NULL compression is sent in TLSv1.3 ClientHello

It is illegal in a TLSv1.3 ClientHello to send anything other than the
NULL compression method. We should send an alert if we find anything else
there. Previously we were ignoring this error.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3410)

2 years agoFix an s_server infinite loop
Matt Caswell [Wed, 26 Apr 2017 13:00:35 +0000 (14:00 +0100)]
Fix an s_server infinite loop

Commit c4666bfa changed s_server so that it asked libssl rather than the
underlying socket whether an error is retryable or not on the basis that
libssl has more information. That is true unfortunately the method used
was wrong - it only checks libssl's own internal state rather than both
libssl and the BIO. Should use SSL_get_error() instead.

This issue can cause an infinite loop because some errors could appear as
retryable when in fact they are not.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3317)

2 years agoAdd unit test for PEM_FLAG_ONLY_B64
Benjamin Kaduk [Wed, 12 Apr 2017 21:24:43 +0000 (16:24 -0500)]
Add unit test for PEM_FLAG_ONLY_B64

Get some trivial test coverage that this flag does what it claims to.

[extended tests]

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1700)

2 years agoMake PEM_read_{,bio_}PrivateKey use secmem
Benjamin Kaduk [Fri, 19 Feb 2016 23:36:52 +0000 (17:36 -0600)]
Make PEM_read_{,bio_}PrivateKey use secmem

We now have a version of PEM_read_bytes that can use temporary
buffers allocated from the secure heap; use them to handle this
sensitive information.

Note that for PEM_read_PrivateKey, the i/o still goes through
stdio since the input is a FILE pointer.  Standard I/O performs
additional buffering, which cannot be changed to use the OpenSSL
secure heap for temporary storage.  As such, it is recommended
to use BIO_new_file() and PEM_read_bio_PrivateKey() instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1700)

2 years agoAdd PEM_bytes_read_bio_secmem()
Benjamin Kaduk [Mon, 29 Feb 2016 21:47:12 +0000 (15:47 -0600)]
Add PEM_bytes_read_bio_secmem()

Split the PEM_bytes_read_bio() implementation out into a
pem_bytes_read_bio_flags() helper, to allow it to pass PEM_FLAG_SECURE
as needed.  Adjust the cleanup to properly use OPENSSL_secure_free()
when needed, and reimplement PEM_bytes_read() as a wrapper around
the _flags helper.

Add documentation for PEM_bytes_read_bio() and the new secmem variant.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1700)

2 years agoAdd PEM_read_bio_ex
Benjamin Kaduk [Fri, 19 Feb 2016 03:24:27 +0000 (21:24 -0600)]
Add PEM_read_bio_ex

The extended function includes a 'flags' argument to allow callers
to specify different requested behaviors.  In particular, callers can
request that temporary storage buffers are allocated from the secure heap,
which could be relevant when loading private key material.

Refactor PEM_read_bio to use BIO_mems instead of BUFs directly,
use some helper routines to reduce the overall function length, and make
some of the checks more reasonable.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1700)

2 years agoAdded a new Makefile in demos/evp directory
Meena Vyas [Mon, 8 May 2017 13:23:01 +0000 (23:23 +1000)]
Added a new Makefile in demos/evp directory
Fixed compilation warning in file aesgcm.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3406)

2 years agoUpdate the message callback documentation
Matt Caswell [Fri, 5 May 2017 10:56:45 +0000 (11:56 +0100)]
Update the message callback documentation

Update the message callback documentation to cover the new inner content
type capability. Also major update of the documentation which was very out
of date.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3408)

2 years agoAdd support to SSL_trace() for inner content types
Matt Caswell [Fri, 5 May 2017 10:55:55 +0000 (11:55 +0100)]
Add support to SSL_trace() for inner content types

When using the -trace option with TLSv1.3 all records appear as "application
data". This adds the ability to see the inner content type too.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3408)

2 years agoRemove support for OPENSSL_SSL_TRACE_CRYPTO
Matt Caswell [Mon, 8 May 2017 08:32:58 +0000 (09:32 +0100)]
Remove support for OPENSSL_SSL_TRACE_CRYPTO

This trace option does not appear in Configure as a separate option and is
undocumented. It can be switched on using "-DOPENSSL_SSL_TRACE_CRYPTO",
however this does not compile in master or in any 1.1.0 released version.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3408)

2 years agoUpdates to supported_groups following review feedback
Matt Caswell [Mon, 8 May 2017 09:54:38 +0000 (10:54 +0100)]
Updates to supported_groups following review feedback

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3395)

2 years agoAdd a test for supported_groups in the EE message
Matt Caswell [Fri, 5 May 2017 09:30:07 +0000 (10:30 +0100)]
Add a test for supported_groups in the EE message

Check we send supported_groups in EE if there is a group we prefer instead
of the one sent in the key_share.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3395)

2 years agoSend the supported_groups extension in EE where applicable
Matt Caswell [Fri, 5 May 2017 09:27:14 +0000 (10:27 +0100)]
Send the supported_groups extension in EE where applicable

The TLSv1.3 spec says that a server SHOULD send supported_groups in the
EE message if there is a group that it prefers to the one used in the
key_share. Clients MAY act on that. At the moment we don't do anything
with it on the client side, but that may change in the future.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3395)

2 years agotest/recipes/95-test_*.t : correct skip_all syntax
Richard Levitte [Sat, 6 May 2017 08:29:16 +0000 (10:29 +0200)]
test/recipes/95-test_*.t : correct skip_all syntax

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3400)

2 years agoRearrange test/recipes/95-test_*.t to use skip_all
Richard Levitte [Fri, 5 May 2017 21:08:55 +0000 (23:08 +0200)]
Rearrange test/recipes/95-test_*.t to use skip_all

The conditions to skip these recipes entirely don't show in a
non-verbose test harness output.  We prefer to know, so use skip_all,
as it is a little bit more verbose.

[extended tests]

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3398)

2 years agoConversion of the EC tests to use the framework.
Pauli [Fri, 28 Apr 2017 04:06:11 +0000 (14:06 +1000)]
Conversion of the EC tests to use the framework.
Some refactoring done as well.

The prime_field_tests() function needs splitting and refactoring still.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3340)

2 years agosha/sha512.c: fix formatting.
Andy Polyakov [Tue, 2 May 2017 08:50:58 +0000 (10:50 +0200)]
sha/sha512.c: fix formatting.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2 years agoperlasm/x86_64-xlate.pl: work around problem with hex constants in masm.
Andy Polyakov [Thu, 4 May 2017 13:54:29 +0000 (15:54 +0200)]
perlasm/x86_64-xlate.pl: work around problem with hex constants in masm.

Perl, multiple versions, for some reason occasionally takes issue with
letter b[?] in ox([0-9a-f]+) regex. As result some constants, such as
0xb1 came out wrong when generating code for MASM. Fixes GH#3241.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3385)

2 years agoRemove some out of date text inadvertently left behind
Matt Caswell [Thu, 4 May 2017 15:15:17 +0000 (16:15 +0100)]
Remove some out of date text inadvertently left behind

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3386)

2 years agoRemove outdated and unsupported CHIL engine
Rich Salz [Thu, 4 May 2017 19:45:57 +0000 (15:45 -0400)]
Remove outdated and unsupported CHIL engine

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3389)

2 years agoFix pathname errors in errcode file
Rich Salz [Thu, 4 May 2017 16:45:15 +0000 (12:45 -0400)]
Fix pathname errors in errcode file

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3388)

2 years agoFix tests of TEST tests, as it were
Rich Salz [Thu, 4 May 2017 16:03:57 +0000 (12:03 -0400)]
Fix tests of TEST tests, as it were

Fix warning/bug in rc5test
Remove useless/warning-only test from dsatest.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3387)