openssl.git
3 years agoVMS: Document the changed logical names in VMS/openssl_staryup.com.in
Richard Levitte [Fri, 8 Jul 2016 16:34:21 +0000 (18:34 +0200)]
VMS: Document the changed logical names in VMS/openssl_staryup.com.in

Since there's been quite some changes, documentation needs updating

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoVMS: Present OPENSSLDIR according to the VMS setup.
Richard Levitte [Fri, 8 Jul 2016 16:30:43 +0000 (18:30 +0200)]
VMS: Present OPENSSLDIR according to the VMS setup.

This mostly affects 'openssl version -a', which might as well display
what we're actually looking at.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoVMS: Simplify the spec of the default certs & keys area.
Richard Levitte [Fri, 8 Jul 2016 16:27:56 +0000 (18:27 +0200)]
VMS: Simplify the spec of the default certs & keys area.

We previously had a number of logical names for the different parts.
There's really no need for that, the default directories are in one
directory tree.  So we only define OSSL$DATAROOT: and make everything
related to that one.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoUpdate ordinals
Rich Salz [Fri, 8 Jul 2016 20:19:38 +0000 (16:19 -0400)]
Update ordinals

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoPlatform sanity test
Rich Salz [Tue, 28 Jun 2016 17:05:24 +0000 (13:05 -0400)]
Platform sanity test

Replace nptest with sanity test.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoGH1278: Removed error code for alerts
Rich Salz [Sat, 2 Jul 2016 00:10:03 +0000 (20:10 -0400)]
GH1278: Removed error code for alerts

Commit aea145e removed some error codes that are generated
algorithmically: mapping alerts to error texts.  Found by
Andreas Karlsson.  This restores them, and adds two missing ones.

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoReplace all #define's in pod pages.
Rich Salz [Fri, 8 Jul 2016 16:55:45 +0000 (12:55 -0400)]
Replace all #define's in pod pages.

Function-like macros are replaced with prototypes and a note
that they are implemented as macros.  Constants are just
referenced in-line in the text.

Tweak BIO_TYPE_... documentation.

Also fix RT4592.

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoVMS: openssl_ivp must call versioned openssl_startup and openssl_utils
Richard Levitte [Fri, 8 Jul 2016 13:01:04 +0000 (15:01 +0200)]
VMS: openssl_ivp must call versioned openssl_startup and openssl_utils

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoDisallow multiple protocol flags to s_server and s_client
Matt Caswell [Thu, 7 Jul 2016 10:05:31 +0000 (11:05 +0100)]
Disallow multiple protocol flags to s_server and s_client

We shouldn't allow both "-tls1" and "-tls1_2", or "-tls1" and "-no_tls1_2".
The only time multiple flags are allowed is where they are all "-no_<prot>".

This fixes Github Issue #1268

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoUnix: Set the execute permission on installed shared libraries
Richard Levitte [Fri, 8 Jul 2016 11:33:27 +0000 (13:33 +0200)]
Unix: Set the execute permission on installed shared libraries

Some Unix variants require shared libraries to have the execute
permissions set, or they won't be loadable or executable when loaded.
Among others, cygwin has this requirement.

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoReorganize .gitignore to make better use of its features
Richard Levitte [Fri, 8 Jul 2016 12:11:43 +0000 (14:11 +0200)]
Reorganize .gitignore to make better use of its features

It's possible to have a very few rules for some directories and trust
that other patterns further along will take care of whatever is left.
.gitignore should therefore be loosely organised from least generic to
most generic, allowing things like this:

    # Keep any file with extensions, such as foo.c, bar.h, ...
    !/dir/*.*

    # ....

    # Remove all object files
    *.o
    *.obj

With this change, we implement some very generic rules for what will
and will not be ignored in the fuzz subdirectory, and truse that
patterns later on (such as *.o, *.obj, *.exe) will take care of
everything we didn't specifically specify for the fuzz subdirectory.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoinclude/openssl: don't include <windows.h> in public headers.
Andy Polyakov [Sun, 26 Jun 2016 11:40:15 +0000 (13:40 +0200)]
include/openssl: don't include <windows.h> in public headers.

If application uses any of Windows-specific interfaces, make it
application developer's respondibility to include <windows.h>.
Rationale is that <windows.h> is quite "toxic" and is sensitive
to inclusion order (most notably in relation to <winsock2.h>).
It's only natural to give complete control to the application developer.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoSupport PKCS v2.0 print in pkcs12 utility.
Dr. Stephen Henson [Thu, 7 Jul 2016 14:56:26 +0000 (15:56 +0100)]
Support PKCS v2.0 print in pkcs12 utility.

Extended alg_print() in pkcs12 utility to support PBES2 algorithms.

RT#4588

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoVMS: correct post-install instructions
Richard Levitte [Wed, 6 Jul 2016 19:54:47 +0000 (21:54 +0200)]
VMS: correct post-install instructions

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoWindows: make some vars in windows-makefile.tmpl reachable again
Richard Levitte [Wed, 6 Jul 2016 17:43:59 +0000 (19:43 +0200)]
Windows: make some vars in windows-makefile.tmpl reachable again

$openssldir and $enginesdir were mistakenly made unavailable to other
perl fragments.  They are still needed in the definition of CFLAGS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoVMS: defined the logical name OPENSSL at all times
Richard Levitte [Wed, 6 Jul 2016 17:04:55 +0000 (19:04 +0200)]
VMS: defined the logical name OPENSSL at all times

This logical names permits '#include <openssl/foo.h>' to work properly.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoVersioning engines default location: the VMS case
Richard Levitte [Wed, 6 Jul 2016 16:53:56 +0000 (18:53 +0200)]
Versioning engines default location: the VMS case

OpenSSL engines are tied to the OpenSSL shared library versions,
starting with OpenSSL 1.1.  We therefore need to install them in
directories which have the shared library version in it's name, to
easily allow multiple OpenSSL versions to be installed at the same
time.

For VMS, the change is a bit more involved, primarly because the top
installation directory was already versioned, *as well as* some of the
files inside.  That's a bit too much.  Version numbering in files is
also a bit different on VMS.  The engines for shared library version
1.1 will therefore end up in OSSL$INSTROOT:[ENGINES0101.'arch']

('arch' is the architecture we build for)

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoVersioning engines default location: the Unix case
Richard Levitte [Wed, 6 Jul 2016 16:50:47 +0000 (18:50 +0200)]
Versioning engines default location: the Unix case

OpenSSL engines are tied to the OpenSSL shared library versions,
starting with OpenSSL 1.1.  We therefore need to install them in
directories which have the shared library version in it's name, to
easily allow multiple OpenSSL versions to be installed at the same
time.

For Unix, the default installation directory is changed from
$PREFIX/lib/engines to $PREFIX/lib/engines-${major}_${minor} (mingw)
or $PREFIX/lib/engines-${major}.${minor} (all but mingw)

($PREFIX is the directory given for the configuration option --prefix,
and ${major} and ${minor} are the major and minor shared library
version numbers)

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoVersioning engines default location: the Windows case
Richard Levitte [Wed, 6 Jul 2016 16:37:52 +0000 (18:37 +0200)]
Versioning engines default location: the Windows case

OpenSSL engines are tied to the OpenSSL shared library versions,
starting with OpenSSL 1.1.  We therefore need to install them in
directories which have the shared library version in it's name, to
easily allow multiple OpenSSL versions to be installed at the same
time.

For windows, the default installation directory is changed from
$PREFIX/lib/engines to $PREFIX/lib/engines-${major}_${minor}

($PREFIX is the directory given for the configuration option --prefix,
and ${major} and ${minor} are the major and minor shared library
version numbers)

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd OPENSSL_NO_EC wrapper
Rich Salz [Tue, 5 Jul 2016 15:51:04 +0000 (11:51 -0400)]
Add OPENSSL_NO_EC wrapper

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoMake 'build_libs' build shared libraries as well
Richard Levitte [Wed, 6 Jul 2016 01:07:16 +0000 (03:07 +0200)]
Make 'build_libs' build shared libraries as well

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoDon't indicate errors during initial adb decode.
Dr. Stephen Henson [Tue, 5 Jul 2016 22:24:26 +0000 (23:24 +0100)]
Don't indicate errors during initial adb decode.

Reviewed-by: Tim Hudson <tjh@openssl.org>
3 years agoVMS: make sure there's a file extension when creating files
Richard Levitte [Wed, 6 Jul 2016 00:08:53 +0000 (02:08 +0200)]
VMS: make sure there's a file extension when creating files

When creating the library $lib.olb, make sure the extension is there.
Otherwise, a logical name with the same name as the file in question
will redirect the creation elsewhere.

Reviewed-by: Tim Hudson <tjh@openssl.org>
3 years agoVMS: arch in config.com was mistakenly made process global
Richard Levitte [Tue, 5 Jul 2016 23:23:41 +0000 (01:23 +0200)]
VMS: arch in config.com was mistakenly made process global

Reviewed-by: Tim Hudson <tjh@openssl.org>
3 years agomake update
Richard Levitte [Tue, 5 Jul 2016 21:05:54 +0000 (23:05 +0200)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoStop using and deprecate ENGINE_setup_bsd_cryptodev
Richard Levitte [Tue, 5 Jul 2016 11:54:49 +0000 (13:54 +0200)]
Stop using and deprecate ENGINE_setup_bsd_cryptodev

The calls we made to it were redundant, as the same initialization is
done later in OPENSSL_init_crypto() anyway.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix mem error handling in PKCS7_simple_smimecap
FdaSilvaYY [Sun, 26 Jun 2016 19:20:52 +0000 (21:20 +0200)]
Fix mem error handling in PKCS7_simple_smimecap

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoImprove some error management code in CT
FdaSilvaYY [Mon, 27 Jun 2016 20:42:25 +0000 (22:42 +0200)]
Improve some error management code in CT

Separate invalid input case from any internal (malloc) failure

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoFix some memory error handling in CT
FdaSilvaYY [Mon, 27 Jun 2016 19:58:32 +0000 (21:58 +0200)]
Fix some memory error handling in CT

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoAdd checks on sk_TYPE_push() returned value
FdaSilvaYY [Mon, 27 Jun 2016 19:57:58 +0000 (21:57 +0200)]
Add checks on sk_TYPE_push() returned value

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoReorganise asn1.h and add comments.
Dr. Stephen Henson [Wed, 27 Apr 2016 13:47:45 +0000 (14:47 +0100)]
Reorganise asn1.h and add comments.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoUpdate fuzz/README.md
Rich Salz [Mon, 4 Jul 2016 00:00:47 +0000 (20:00 -0400)]
Update fuzz/README.md

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoperl: Separate compile-time environment from runtime environment
Richard Levitte [Sat, 2 Jul 2016 14:39:15 +0000 (16:39 +0200)]
perl: Separate compile-time environment from runtime environment

Make it possible to have a separate and different perl command string
for installable scripts than we use when building, with the
environment variable HASHBANGPERL.  Its value default to the same as
the environment PERL if it's defined, otherwise '/usr/bin/env perl'.

Note: this is only relevant for Unix-like environments.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
3 years agoFix broken loading of client CAs
Andreas Karlsson [Fri, 1 Jul 2016 23:19:39 +0000 (01:19 +0200)]
Fix broken loading of client CAs

The SSL_load_client_CA_file() failed to load any CAs due to an
inccorrect assumption about the return value of lh_*_insert(). The
return value when inserting into a hash is the old value of the key.

The bug was introduced in 3c82e437bb3af822ea13cd5a24bab0745c556246.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1279)

3 years agoVMS: Add installation verification procedure
Richard Levitte [Sat, 2 Jul 2016 08:28:39 +0000 (10:28 +0200)]
VMS: Add installation verification procedure

On VMS, it's customary to have a procedure to check that the software
was installed correctly and can run as advertised.

The procedure added here is fairly simple, it checks that all
libraries are in place, that the header crypto.h is in place, and that
the command 'openssl version -a' runs without trouble.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix some VMS inconsistencies
Richard Levitte [Sat, 2 Jul 2016 06:47:08 +0000 (08:47 +0200)]
Fix some VMS inconsistencies

- The install top is versioned by default.  However, only the major
  version should be used.
- the default areas for certs, private keys an config files have
  changed, now all prefixed with 'OSSL$'.  This gets reflected in
  cryptlib.h.
- [.VMS]openssl_startup.com.in had some faults regarding creating
  rooted concealed logical names.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoInstall the openssl app with version number on VMS
Richard Levitte [Sat, 2 Jul 2016 07:51:06 +0000 (09:51 +0200)]
Install the openssl app with version number on VMS

This makes it possible for script writers to lock on to a specific
version if they need to.  Note that only the major version number is
used.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoHave the VMS shared library file names contain the shared version
Richard Levitte [Sat, 2 Jul 2016 06:35:12 +0000 (08:35 +0200)]
Have the VMS shared library file names contain the shared version

Also, have the static library file names contain the pointer size when
applicable.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoPass down correct information to the VMS startup script templates
Richard Levitte [Sat, 2 Jul 2016 06:31:00 +0000 (08:31 +0200)]
Pass down correct information to the VMS startup script templates

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd the missing pointer_size information on VMS configs
Richard Levitte [Sat, 2 Jul 2016 07:50:24 +0000 (09:50 +0200)]
Add the missing pointer_size information on VMS configs

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoEnsure that global dependencies are built first, even for parallell builds
Ben Laurie [Sun, 26 Jun 2016 12:09:23 +0000 (13:09 +0100)]
Ensure that global dependencies are built first, even for parallell builds

Also, make sure that per-file deps are included in the build, even if previous
builds have failed.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoUse the SSL_METHODs passed to create_ssl_ctx_pair()
Matt Caswell [Fri, 1 Jul 2016 18:15:05 +0000 (19:15 +0100)]
Use the SSL_METHODs passed to create_ssl_ctx_pair()

Don't use hardcoded SSL_METHODs!

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoAvoid an overflow in constructing the ServerKeyExchange message
Matt Caswell [Fri, 1 Jul 2016 10:58:05 +0000 (11:58 +0100)]
Avoid an overflow in constructing the ServerKeyExchange message

We calculate the size required for the ServerKeyExchange message and then
call BUF_MEM_grow_clean() on the buffer. However we fail to take account of
2 bytes required for the signature algorithm and 2 bytes for the signature
length, i.e. we could overflow by 4 bytes. In reality this won't happen
because the buffer is pre-allocated to a large size that means it should be
big enough anyway.

Addresses an OCAP Audit issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoCleanup obj_dat.h, obj_dat.pl
Rich Salz [Wed, 29 Jun 2016 16:23:16 +0000 (12:23 -0400)]
Cleanup obj_dat.h, obj_dat.pl

The recent merge of https://github.com/openssl/openssl/pull/1264
removed some trailing whitespace from the generated file obj_dat.h.
Unfortunately obj_dat.pl kept re-adding it.  Clean up the
script and the output it generates.

Add 'use strict / use warnings'

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoDeal with pod2html issues, in this case the lack of .html suffix in links
Richard Levitte [Fri, 1 Jul 2016 17:06:37 +0000 (19:06 +0200)]
Deal with pod2html issues, in this case the lack of .html suffix in links

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoSimplify INCLUDE statements in build.info files
Richard Levitte [Wed, 29 Jun 2016 20:59:50 +0000 (22:59 +0200)]
Simplify INCLUDE statements in build.info files

Now that INCLUDE considers both the source and build trees, no need
for the rel2abs perl fragment hacks any more.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoMake build.info INCLUDE stmts be both source and build tree relative
Richard Levitte [Wed, 29 Jun 2016 20:51:42 +0000 (22:51 +0200)]
Make build.info INCLUDE stmts be both source and build tree relative

INCLUDE statements in build.info files were source tree centric.  That
meant that to get include directory specs in the build tree, we had to
resort to perl fragments that specified the build tree include paths
as absolute ones.

This change has the INCLUDE statement consider both the source and
build tree for any include directory.  It means that there may be some
extra unnecessary include paths, but it also makes life simpler for
anyone who makes changes in the build.info files.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agofix 'set but not used' warning
Dr. Stephen Henson [Fri, 1 Jul 2016 14:52:52 +0000 (15:52 +0100)]
fix 'set but not used' warning

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRe-add x509 and crl fuzzer
Kurt Roeckx [Fri, 1 Jul 2016 14:42:15 +0000 (16:42 +0200)]
Re-add x509 and crl fuzzer

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1276

3 years agoAdd old locking constants back
Kurt Roeckx [Wed, 29 Jun 2016 09:45:51 +0000 (11:45 +0200)]
Add old locking constants back

Fixes #1260

Reviewed-by: Matt Caswell <matt@openssl.org>
GH: #1266

3 years agoMake CRYPTO_num_locks() return 1
Kurt Roeckx [Wed, 29 Jun 2016 09:46:39 +0000 (11:46 +0200)]
Make CRYPTO_num_locks() return 1

malloc(0) might return NULL and code for the old callbacks might fail,
instead just say they should allocate 1 entry.

Reviewed-by: Matt Caswell <matt@openssl.org>
GH: #1266

3 years agofix code formatting
mrpre [Fri, 1 Jul 2016 00:55:18 +0000 (08:55 +0800)]
fix code formatting

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1223)

3 years agoadd return value for expand
mrpre [Thu, 16 Jun 2016 10:00:38 +0000 (18:00 +0800)]
add return value for expand

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1223)

3 years agoFix printing private EC_KEY
Alessandro Ghedini [Thu, 30 Jun 2016 22:51:48 +0000 (23:51 +0100)]
Fix printing private EC_KEY

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1273)

3 years agossl.h: spelling in comment
Viktor Szakats [Fri, 1 Jul 2016 11:40:33 +0000 (13:40 +0200)]
ssl.h: spelling in comment
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1275)

3 years agoRun the fuzzing corpora as tests.
Ben Laurie [Sat, 4 Jun 2016 15:10:49 +0000 (16:10 +0100)]
Run the fuzzing corpora as tests.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoSPARC assembly pack: enforce V8+ ABI constraints.
Andy Polyakov [Thu, 30 Jun 2016 14:06:48 +0000 (16:06 +0200)]
SPARC assembly pack: enforce V8+ ABI constraints.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoSPARC assembly pack: enforce V8+ ABI constraints.
Andy Polyakov [Thu, 30 Jun 2016 13:57:57 +0000 (15:57 +0200)]
SPARC assembly pack: enforce V8+ ABI constraints.

Even though it's hard to imagine, it turned out that upper half of
arguments passed to V8+ subroutine can be non-zero.

["n" pseudo-instructions, such as srln being srl in 32-bit case and
srlx in 64-bit one, were implemented in binutils 2.10. It's assumed
that Solaris assembler implemented it around same time, i.e. 2000.]

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoWindows: Recreate the $prefix variable
Richard Levitte [Wed, 29 Jun 2016 22:10:21 +0000 (00:10 +0200)]
Windows: Recreate the $prefix variable

$prefix was removed as part of the DESTDIR work.  However, it was
still used to create the ENGINESDIR_dev and ENGINESDIR_dir variables,
so a restoration is needed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConstify a bit more OPENSSL_sk_ API
FdaSilvaYY [Sat, 18 Jun 2016 13:05:24 +0000 (15:05 +0200)]
Constify a bit more OPENSSL_sk_ API

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1244)

3 years agoUse directly zalloc in OPENSSL_sk_dup and OPENSSL_sk_deep_copy
FdaSilvaYY [Wed, 1 Jun 2016 22:59:34 +0000 (00:59 +0200)]
Use directly zalloc in OPENSSL_sk_dup and OPENSSL_sk_deep_copy

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1244)

3 years agoConvert memset calls to OPENSSL_cleanse
Matt Caswell [Fri, 24 Jun 2016 22:37:27 +0000 (23:37 +0100)]
Convert memset calls to OPENSSL_cleanse

Ensure things really do get cleared when we intend them to.

Addresses an OCAP Audit issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoCleanup documentation for removed functionality
Matt Caswell [Mon, 27 Jun 2016 13:35:35 +0000 (14:35 +0100)]
Cleanup documentation for removed functionality

Remove some lingering references to removed functionality from docs.

Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoAdd some compat macros for removed tmp RSA functions/macros
Matt Caswell [Mon, 27 Jun 2016 11:28:32 +0000 (12:28 +0100)]
Add some compat macros for removed tmp RSA functions/macros

Commit 361a119 removed all ciphersuites that could support temporary
RSA keys, therefore the associated functions were removed. We should have
"no-op" compatibility macros for these.

Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoFix hmac test case 6
Kurt Cancemi [Wed, 29 Jun 2016 11:03:28 +0000 (07:03 -0400)]
Fix hmac test case 6

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1267)

3 years agoRestore clang builds in travis.yml
Rich Salz [Thu, 30 Jun 2016 12:51:16 +0000 (08:51 -0400)]
Restore clang builds in travis.yml

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoRemove the envvar hack to enable proxy cert processing
Richard Levitte [Wed, 29 Jun 2016 23:23:36 +0000 (01:23 +0200)]
Remove the envvar hack to enable proxy cert processing

When the proxy cert code was initially added, some application authors
wanted to get them verified without having to change their code, so a
check of the env var OPENSSL_ALLOW_PROXY_CERTS was added.

Since then, the use of this variable has become irrelevant, as it's
likely that code has been changed since, so it's time it gets removed.

Reviewed-by: Tim Hudson <tjh@openssl.org>
3 years agoWhitespace cleanup in apps
FdaSilvaYY [Tue, 28 Jun 2016 20:51:51 +0000 (22:51 +0200)]
Whitespace cleanup in apps

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1264)

3 years agoWhitespace cleanup in ssl folder
FdaSilvaYY [Tue, 28 Jun 2016 20:51:27 +0000 (22:51 +0200)]
Whitespace cleanup in ssl folder

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1264)

3 years agoWhitespace cleanup in crypto
FdaSilvaYY [Tue, 28 Jun 2016 20:51:01 +0000 (22:51 +0200)]
Whitespace cleanup in crypto

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1264)

3 years agoWhitespace cleanup in docs
FdaSilvaYY [Tue, 28 Jun 2016 20:50:03 +0000 (22:50 +0200)]
Whitespace cleanup in docs

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1264)

3 years agoSpelling
FdaSilvaYY [Tue, 28 Jun 2016 20:39:55 +0000 (22:39 +0200)]
Spelling

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1264)

3 years agoSome interfaces may have IPv6 addresses even if an IPv6 address is not
Ben Laurie [Sat, 25 Jun 2016 16:42:14 +0000 (17:42 +0100)]
Some interfaces may have IPv6 addresses even if an IPv6 address is not
"configured on the local system". Whatever that means. Example that is biting
me is loopback has ::1 as an address, but the network interface is v4 only.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoAdd comment about X509_print
Alex Gaynor [Sun, 26 Jun 2016 14:37:03 +0000 (10:37 -0400)]
Add comment about X509_print

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Emilia Kasper <emilia@openssl.org>
GH: #1255

3 years agoSSL test framework: port SNI tests
Emilia Kasper [Mon, 20 Jun 2016 15:20:25 +0000 (17:20 +0200)]
SSL test framework: port SNI tests

Observe that the old tests were partly ill-defined:
setting sn_server1 but not sn_server2 in ssltest_old.c does not enable
the SNI callback.

Fix this, and also explicitly test both flavours of SNI mismatch (ignore
/ fatal alert). Tests still pass.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agobase64 macro: parenthesize for clarity
Emilia Kasper [Tue, 28 Jun 2016 11:28:57 +0000 (13:28 +0200)]
base64 macro: parenthesize for clarity

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoWindows: Make DESTDIR work
Richard Levitte [Tue, 28 Jun 2016 11:20:21 +0000 (13:20 +0200)]
Windows: Make DESTDIR work

DESTDIR can't be used on Windows the same way as on Unix, the device
part of the installation paths get in the way.

To remedy this, have INSTALLTOP, OPENSSLDIR and ENGINESDIR get
different values depending on if $(DESTDIR) is empty or not, and use
$(INSTALLTOP), $(OPENSSLDIR) and $(ENGINESDIR) alone.

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoBuild files: don't generate empty action lines in generatedir()
Richard Levitte [Tue, 28 Jun 2016 12:02:44 +0000 (14:02 +0200)]
Build files: don't generate empty action lines in generatedir()

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoUse include paths to our source before any other cflags
Roumen Petrov [Mon, 27 Jun 2016 19:24:07 +0000 (21:24 +0200)]
Use include paths to our source before any other cflags

This is just in case someone passed an inclusion path with the
configuration, and there are OpenSSL headers from another version
in there.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoengines/e_capi.c: accommodate recent DSA_SIG_[get|set]0 changes.
Andy Polyakov [Sun, 26 Jun 2016 20:00:37 +0000 (22:00 +0200)]
engines/e_capi.c: accommodate recent DSA_SIG_[get|set]0 changes.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agorsa/rsa_lib.c: const-ify RSA_get0_engine().
Andy Polyakov [Sun, 26 Jun 2016 19:55:03 +0000 (21:55 +0200)]
rsa/rsa_lib.c: const-ify RSA_get0_engine().

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agounix-Makefile.tmpl: omit lib<rary>.a updates from directory targets.
Andy Polyakov [Sun, 26 Jun 2016 16:20:39 +0000 (18:20 +0200)]
unix-Makefile.tmpl: omit lib<rary>.a updates from directory targets.

Since corresponding rule was removed from windows-makefile.tmpl out
of necessity, question popped if it's appropriate to harmonize even
unix-Makefile.tmpl. Note that as long as you work on single directory
'make lib<rary>.a' is effectively equivalent to 'make <dir/ectory>'
prior this modification.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agowindows-makefile.tmpl: don't use $? in library targets.
Andy Polyakov [Sun, 26 Jun 2016 12:40:35 +0000 (14:40 +0200)]
windows-makefile.tmpl: don't use $? in library targets.

Problem with Microsoft lib.exe is that it doesn't *update* modules
in .lib archive, but creates new one upon every invocation. As result
if a source file was updated and nmake was executed, a useless archive
with only one module was created. In other words one has to always
pass all .obj modules on command line, not only recently recompiled.

[This also creates dilemma for directory targets, e.g. crypto\aes,
that were added to simplify every-day life for developer. Since
whole idea behind those targets is to minimize the re-compile time
upon single file modification, the only sensible thing to do is to
omit intended library update.]

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoAdd a test for fragmented alerts
Matt Caswell [Tue, 21 Jun 2016 15:33:52 +0000 (16:33 +0100)]
Add a test for fragmented alerts

The previous commit fixed a problem where fragmented alerts would cause an
infinite loop. This commit adds a test for these fragmented alerts.

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoEnsure read records are marked as read
Matt Caswell [Tue, 21 Jun 2016 14:25:53 +0000 (15:25 +0100)]
Ensure read records are marked as read

In some situations (such as when we receive a fragment of an alert)
we try to get the next packet but did not mark the current one as read,
meaning that we got the same record back again - leading to an infinite
loop.

Found using the BoringSSL test suite.

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoRT4586: Remove RSA_memory_lock; unused, not needed
Rich Salz [Fri, 24 Jun 2016 13:49:51 +0000 (09:49 -0400)]
RT4586: Remove RSA_memory_lock; unused, not needed

Reviewed-by: Ben Laurie <ben@openssl.org>
3 years agoFix one more instance of incorrect OPENSSL_API_COMPAT value
Matt Caswell [Mon, 27 Jun 2016 10:51:50 +0000 (11:51 +0100)]
Fix one more instance of incorrect OPENSSL_API_COMPAT value

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoFix some OPENSSL_API_COMPAT values
Matt Caswell [Mon, 27 Jun 2016 10:28:29 +0000 (11:28 +0100)]
Fix some OPENSSL_API_COMPAT values

There are 3 OPENSSL_API_COMPAT values that are incorrect in the header
files, and one inconsistency between the header and the .c

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoClarify use of |$end0| in stitched x86-64 AES-GCM code.
Brian Smith [Wed, 2 Mar 2016 06:16:26 +0000 (20:16 -1000)]
Clarify use of |$end0| in stitched x86-64 AES-GCM code.

There was some uncertainty about what the code is doing with |$end0|
and whether it was necessary for |$len| to be a multiple of 16 or 96.
Hopefully these added comments make it clear that the code is correct
except for the caveat regarding low memory addresses.

Change-Id: Iea546a59dc7aeb400f50ac5d2d7b9cb88ace9027
Reviewed-on: https://boringssl-review.googlesource.com/7194
Reviewed-by: Adam Langley <agl@google.com>
Signed-off-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConfigurations/10-main.conf: fix PA-RISC commentary.
Andy Polyakov [Sun, 26 Jun 2016 17:08:51 +0000 (19:08 +0200)]
Configurations/10-main.conf: fix PA-RISC commentary.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoevp/evp_enc.c: refine partial buffer overlap detection.
Andy Polyakov [Mon, 20 Jun 2016 09:11:25 +0000 (11:11 +0200)]
evp/evp_enc.c: refine partial buffer overlap detection.

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoevp/evp_enc.c: check for partially[!] overlapping buffers
Andy Polyakov [Fri, 17 Jun 2016 11:55:01 +0000 (13:55 +0200)]
evp/evp_enc.c: check for partially[!] overlapping buffers
in EVP_EncryptUpdate and EVP_DecryptUpdate. It is argued that in
general case it's impossible to provide guarantee that partially[!]
overlapping buffers can be tolerated.

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoRT2680: Public EC key is shown as private
Rich Salz [Sun, 26 Jun 2016 18:34:00 +0000 (14:34 -0400)]
RT2680: Public EC key is shown as private

Re-implemented as suggested by Steve Henson.
Also change ECParameters_print the same way.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
3 years agoRT2964: Fix it via doc
Rich Salz [Sun, 26 Jun 2016 13:24:49 +0000 (09:24 -0400)]
RT2964: Fix it via doc

OBJ_nid2obj() and friends should be treated as const.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
3 years agoRevert "RT2964: Fix it via doc"
Rich Salz [Sun, 26 Jun 2016 02:08:21 +0000 (22:08 -0400)]
Revert "RT2964: Fix it via doc"

This reverts commit 82f31fe4dd0dac30229fa8684229b49d2bcef404.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
3 years agoRT2964: Fix it via doc
Rich Salz [Sat, 25 Jun 2016 18:51:53 +0000 (14:51 -0400)]
RT2964: Fix it via doc

OBJ_nid2obj() and friends should be treated as const.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
3 years agoHandle BN_mod_word failures.
David Benjamin [Fri, 24 Jun 2016 15:07:52 +0000 (11:07 -0400)]
Handle BN_mod_word failures.

As of 37258dadaa9e36db4b96a3aa54aa6c67136160cc and the corresponding upstream
change, BN_mod_word may fail, like BN_div_word. Handle this properly. Thanks to
Brian Smith for pointing this out. See BoringSSL's
44bedc348d9491e63c7ed1438db100a4b8a830be.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1251

3 years agoFix BN_is_prime* calls.
David Benjamin [Fri, 24 Jun 2016 15:05:48 +0000 (11:05 -0400)]
Fix BN_is_prime* calls.

This function returns a tri-state -1 on error. See BoringSSL's
53409ee3d7595ed37da472bc73b010cd2c8a5ffd.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1251

3 years agoAdd x509 and crl corpora
Kurt Roeckx [Tue, 21 Jun 2016 19:38:06 +0000 (21:38 +0200)]
Add x509 and crl corpora

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1229

3 years agoAdd X509 and CRL fuzzer
Kurt Roeckx [Sat, 18 Jun 2016 13:56:49 +0000 (15:56 +0200)]
Add X509 and CRL fuzzer

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1229