openssl.git
3 years agoRework error handling from asn1_do_lock method.
FdaSilvaYY [Sun, 29 May 2016 12:32:23 +0000 (14:32 +0200)]
Rework error handling from asn1_do_lock method.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoFix generation of expired CA certificate.
Dr. Stephen Henson [Wed, 22 Jun 2016 17:09:42 +0000 (18:09 +0100)]
Fix generation of expired CA certificate.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoOpenSSL::Test: Fix directory calculations in __cwd()
Richard Levitte [Wed, 22 Jun 2016 11:39:46 +0000 (13:39 +0200)]
OpenSSL::Test: Fix directory calculations in __cwd()

The previous fix contained a mistake, where any absolute path in
%directories would be cleared away instead of just being left alone.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agorand/randfile.c: make it non-ASCII-savvy.
Andy Polyakov [Tue, 21 Jun 2016 13:28:23 +0000 (15:28 +0200)]
rand/randfile.c: make it non-ASCII-savvy.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoMove OS-specific fopen quirks to o_fopen.c.
Andy Polyakov [Tue, 21 Jun 2016 13:26:18 +0000 (15:26 +0200)]
Move OS-specific fopen quirks to o_fopen.c.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agocrypto/cryptlib.c: omit OPENSSL_ia32cap_loc().
Andy Polyakov [Fri, 17 Jun 2016 14:09:38 +0000 (16:09 +0200)]
crypto/cryptlib.c: omit OPENSSL_ia32cap_loc().

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoSpelling... and more spelling
FdaSilvaYY [Sun, 19 Jun 2016 17:39:01 +0000 (19:39 +0200)]
Spelling... and more spelling

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1245)

3 years agosegmentation fault with 'openssl s_client -prexit -keymatexport'
mmiyashita [Tue, 21 Jun 2016 18:01:30 +0000 (11:01 -0700)]
segmentation fault with 'openssl s_client -prexit -keymatexport'

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1243)

3 years agoAvoid creating an illegal pointer.
Kurt Roeckx [Sat, 18 Jun 2016 17:50:11 +0000 (19:50 +0200)]
Avoid creating an illegal pointer.

Found by tis-interpreter

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1230

3 years agoMake RSA key exchange code actually constant-time.
David Benjamin [Thu, 16 Jun 2016 18:15:19 +0000 (14:15 -0400)]
Make RSA key exchange code actually constant-time.

Using RSA_PKCS1_PADDING with RSA_private_decrypt is inherently unsafe.
The API requires writing output on success and touching the error queue
on error. Thus, although the padding check itself is constant-time as of
294d1e36c2495ff00e697c9ff622856d3114f14f, and the logic after the
decryption in the SSL code is constant-time as of
adb46dbc6dd7347750df2468c93e8c34bcb93a4b, the API boundary in the middle
still leaks whether the padding check succeeded, giving us our
much-loved Bleichenbacher padding oracle.

Instead, PKCS#1 padding must be handled by the caller which uses
RSA_NO_PADDING, in timing-sensitive code integrated with the
Bleichenbacher mitigation. Removing PKCS#1 padding in constant time is
actually much simpler when the expected length is a constant (and if
it's not a constant, avoiding a padding oracle seems unlikely), so just
do it inline.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1222

3 years agobuf2hexstr: properly deal with empty string
Kurt Roeckx [Sun, 19 Jun 2016 12:16:16 +0000 (14:16 +0200)]
buf2hexstr: properly deal with empty string

It wrote before the start of the string

found by afl

Reviewed-by: Richard Levitte <levitte@openssl.org>
MR: #2994

3 years agoFix typo
Petr Vaněk [Tue, 21 Jun 2016 11:30:54 +0000 (13:30 +0200)]
Fix typo

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1241)

3 years agoAppveyor: test install as well, via a fake deploy_script
Richard Levitte [Thu, 2 Jun 2016 15:37:26 +0000 (17:37 +0200)]
Appveyor: test install as well, via a fake deploy_script

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoTravis: When testing install, install docs as well
Richard Levitte [Thu, 2 Jun 2016 15:37:03 +0000 (17:37 +0200)]
Travis: When testing install, install docs as well

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoOpenSSL::Test: Fix directory calculations in __cwd()
Richard Levitte [Mon, 20 Jun 2016 12:03:12 +0000 (14:03 +0200)]
OpenSSL::Test: Fix directory calculations in __cwd()

We recalculate the location of the directories we keep track of.
However, we did so after having moved to the new directory already, so
the data we did the calculations from were possibly not quite correct.

This change moves the calculations to happen before moving to the new
directory.

This issue is sporadic, and possibly dependent on the platform.

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoMore doc cleanup
Rich Salz [Tue, 21 Jun 2016 11:03:34 +0000 (07:03 -0400)]
More doc cleanup

Add missing entries to NAME section
Add SYNOPSIS lines, remove old NAME entries
Update find-doc-nits; better regexp's for parsing SYNOPSIS sections.
Rename a couple of files to have an API name.
Remove RSA_private_decrypt; it was duplicate content
Update for recent doc additions

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoAvoid using latest clang since repo not available
Rich Salz [Mon, 20 Jun 2016 14:06:25 +0000 (10:06 -0400)]
Avoid using latest clang since repo not available

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoMake arm-xlate.pl set use strict.
David Benjamin [Mon, 20 Jun 2016 19:05:06 +0000 (15:05 -0400)]
Make arm-xlate.pl set use strict.

It was already nearly clean. Just one undeclared variable.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1240)

3 years agoAdd verification of proxy certs to 25-test_verify.t
Richard Levitte [Sun, 19 Jun 2016 08:56:37 +0000 (10:56 +0200)]
Add verification of proxy certs to 25-test_verify.t

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoCreate some proxy certificates
Richard Levitte [Sun, 19 Jun 2016 08:56:23 +0000 (10:56 +0200)]
Create some proxy certificates

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoMake it possible to generate proxy certs with test/certs/mkcert.sh
Richard Levitte [Sun, 19 Jun 2016 08:56:09 +0000 (10:56 +0200)]
Make it possible to generate proxy certs with test/certs/mkcert.sh

This extends 'req' to take more than one DN component, and to take
them as full DN components and not just CN values.  All other commands
are changed to pass "CN = $cn" instead of just a CN value.

This adds 'genpc', which differs from the other 'gen*' commands by not
calling 'req', and expect the result from 'req' to come through stdin.

Finally, test/certs/setup.sh gets the commands needed to generate a
few proxy certificates.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agomake update
Richard Levitte [Sun, 19 Jun 2016 08:55:59 +0000 (10:55 +0200)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoAllow proxy certs to be present when verifying a chain
Richard Levitte [Sun, 19 Jun 2016 08:55:43 +0000 (10:55 +0200)]
Allow proxy certs to be present when verifying a chain

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoFix proxy certificate pathlength verification
Richard Levitte [Sun, 19 Jun 2016 08:55:29 +0000 (10:55 +0200)]
Fix proxy certificate pathlength verification

While travelling up the certificate chain, the internal
proxy_path_length must be updated with the pCPathLengthConstraint
value, or verification will not work properly.  This corresponds to
RFC 3820, 4.1.4 (a).

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoCheck that the subject name in a proxy cert complies to RFC 3820
Richard Levitte [Sun, 19 Jun 2016 08:55:16 +0000 (10:55 +0200)]
Check that the subject name in a proxy cert complies to RFC 3820

The subject name MUST be the same as the issuer name, with a single CN
entry added.

RT#1852

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoRT3925: Remove trailing semi from macro
Dr. Matthias St. Pierre [Mon, 20 Jun 2016 17:39:28 +0000 (13:39 -0400)]
RT3925: Remove trailing semi from macro

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoapps/req.c: Increment the right variable when parsing '+'
Richard Levitte [Mon, 20 Jun 2016 18:07:13 +0000 (20:07 +0200)]
apps/req.c: Increment the right variable when parsing '+'

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRemove pointless free loop in X509_TRUST_cleanup()
Kurt Cancemi [Fri, 10 Jun 2016 01:57:36 +0000 (21:57 -0400)]
Remove pointless free loop in X509_TRUST_cleanup()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1194)

3 years agoRemove pointless free loop in X509_PURPOSE_cleanup()
Kurt Cancemi [Wed, 8 Jun 2016 23:15:38 +0000 (19:15 -0400)]
Remove pointless free loop in X509_PURPOSE_cleanup()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1194)

3 years agodoc and comment fixes
huangqinjin [Sun, 19 Jun 2016 16:17:51 +0000 (00:17 +0800)]
doc and comment fixes

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1233)

3 years agocrypto/evp/e_aes_cbc_hmac_sha256.c: Remove spurious memset
Kurt Cancemi [Sat, 28 May 2016 11:05:15 +0000 (07:05 -0400)]
crypto/evp/e_aes_cbc_hmac_sha256.c: Remove spurious memset

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1231)

3 years agoRT3136: Remove space after issuer/subject
Jiri Horky [Sun, 12 Jun 2016 18:02:20 +0000 (14:02 -0400)]
RT3136: Remove space after issuer/subject

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoMake DSA_SIG and ECDSA_SIG getters const.
Emilia Kasper [Thu, 9 Jun 2016 21:09:48 +0000 (23:09 +0200)]
Make DSA_SIG and ECDSA_SIG getters const.

Reorder arguments to follow convention.

Also allow r/s to be NULL in DSA_SIG_get0, similarly to ECDSA_SIG_get0.

This complements GH1193 which adds non-const setters.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agorand/randfile.c: remove obsolete commentary.
Andy Polyakov [Mon, 20 Jun 2016 11:22:46 +0000 (13:22 +0200)]
rand/randfile.c: remove obsolete commentary.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoTests should check validation status directly
Rob Percival [Tue, 7 Jun 2016 16:56:02 +0000 (17:56 +0100)]
Tests should check validation status directly

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoTest SCT lists
Rob Percival [Tue, 7 Jun 2016 16:38:14 +0000 (17:38 +0100)]
Test SCT lists

This encompasses what was previously tested.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoaes/asm/bsaes-armv7.pl: omit redundant stores in XTS subroutines.
Andy Polyakov [Sat, 18 Jun 2016 13:49:57 +0000 (15:49 +0200)]
aes/asm/bsaes-armv7.pl: omit redundant stores in XTS subroutines.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoaes/asm/bsaes-armv7.pl: fix XTS decrypt test failure.
Andy Polyakov [Sat, 18 Jun 2016 13:37:25 +0000 (15:37 +0200)]
aes/asm/bsaes-armv7.pl: fix XTS decrypt test failure.

RT#4578

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoChange the RAND_file_name documentation accordingly
Richard Levitte [Mon, 20 Jun 2016 06:11:50 +0000 (08:11 +0200)]
Change the RAND_file_name documentation accordingly

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoChange default directory for the .rnd file on Windows and VMS
Richard Levitte [Mon, 20 Jun 2016 05:56:32 +0000 (07:56 +0200)]
Change default directory for the .rnd file on Windows and VMS

The previous change for Windows wasn't quite right.  Corrected to use
%HOME%, %USERPROFILE% and %SYSTEMPROFILE%, in that order.

Also adding the default home for VMS, SYS$LOGIN:

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoAdd a comment after some #endif at end of apps source code.
FdaSilvaYY [Fri, 10 Jun 2016 20:37:32 +0000 (22:37 +0200)]
Add a comment after some #endif at end of apps source code.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)

3 years agoUseless header include of openssl/rand.h
FdaSilvaYY [Sat, 4 Jun 2016 22:35:42 +0000 (00:35 +0200)]
Useless header include of openssl/rand.h

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)

3 years agoUseless includes
FdaSilvaYY [Fri, 25 Mar 2016 19:04:12 +0000 (20:04 +0100)]
Useless includes

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)

3 years agoMissing NULL check on OBJ_dup result in x509_name_canon
FdaSilvaYY [Fri, 3 Jun 2016 22:14:52 +0000 (00:14 +0200)]
Missing NULL check on OBJ_dup result in x509_name_canon

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)

3 years agoFix an MSVC warning.
FdaSilvaYY [Tue, 10 May 2016 20:20:23 +0000 (22:20 +0200)]
Fix an MSVC warning.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)

3 years agoUse a STACK_OF(OPENSSL_CSTRING) for const char * stacks
Matt Caswell [Wed, 15 Jun 2016 15:25:21 +0000 (16:25 +0100)]
Use a STACK_OF(OPENSSL_CSTRING) for const char * stacks

Better than losing the const qualifier.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoOpenBSD has intypes.h
Matt Caswell [Wed, 15 Jun 2016 15:06:44 +0000 (16:06 +0100)]
OpenBSD has intypes.h

Update e_os2.h so that inttypes.h is included.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoReplace 4 casts with 1
Matt Caswell [Wed, 15 Jun 2016 14:59:46 +0000 (15:59 +0100)]
Replace 4 casts with 1

Changing the type of the |str| variable in asn1pars enables us to remove
4 casts with just 1. This silences an OpenBSD warning along the way.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoImprove const correctness for stacks of EVP_MD
Matt Caswell [Wed, 15 Jun 2016 14:32:38 +0000 (15:32 +0100)]
Improve const correctness for stacks of EVP_MD

EVP_MDs are always const, so stacks of them should be too. This silences
a warning about type punning on OpenBSD.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoconstify SRP
Matt Caswell [Wed, 15 Jun 2016 14:17:50 +0000 (15:17 +0100)]
constify SRP

Add const qualifiers to lots of SRP stuff. This started out as an effort
to silence some "type-punning" warnings on OpenBSD...but the fix was to
have proper const correctness in SRP.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoAvoid type punning warnings in b_addr.c
Matt Caswell [Wed, 15 Jun 2016 10:50:09 +0000 (11:50 +0100)]
Avoid type punning warnings in b_addr.c

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoChange default directory for storing the .rnd file on Windows
Matt Caswell [Wed, 15 Jun 2016 15:14:30 +0000 (11:14 -0400)]
Change default directory for storing the .rnd file on Windows

Previously we would try %RANDFILE%, then %HOME% and finally "C:".
Unfortunately this often ends up being "C:" which the user may not
have write permission for.

Now we try %RANDFILE% first, and then the same set of environment vars
as GetTempFile() uses, i.e. %TMP%, then %TEMP%, %USERPROFILE% and
%SYSTEMROOT%. If all else fails we fall back to %HOME% and only then "C:".

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoHarmonise the different build files
Richard Levitte [Thu, 16 Jun 2016 22:23:43 +0000 (00:23 +0200)]
Harmonise the different build files

- User targets are now the same and generally do the same things
- configdata.pm depends on exactly the same files on all platforms
- VMS production of shared libraries is simplified
- VMS automatic dependency files get the extension .D rather than .MMS

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix GCC build; make update; fix number re-use
Rich Salz [Thu, 16 Jun 2016 18:49:37 +0000 (14:49 -0400)]
Fix GCC build; make update; fix number re-use

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoSpelling fixes
FdaSilvaYY [Tue, 14 Jun 2016 21:02:16 +0000 (23:02 +0200)]
Spelling fixes

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1219)

3 years agono-ripemd is an alias for no-rmd160
Matt Caswell [Thu, 16 Jun 2016 10:45:24 +0000 (11:45 +0100)]
no-ripemd is an alias for no-rmd160

mkdef.pl was failing to understand no-ripemd. This is a deprecated option
which should act as an alias for no-rmd160.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoFix build break.
Rich Salz [Thu, 16 Jun 2016 16:58:57 +0000 (12:58 -0400)]
Fix build break.

Aggregate local initializers are rarely portable (:

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoAdd EVP_PKEY_get0_hmac() function
Nathaniel McCallum [Wed, 15 Jun 2016 18:02:04 +0000 (14:02 -0400)]
Add EVP_PKEY_get0_hmac() function

Before the addition of this function, it was impossible to read the
symmetric key from an EVP_PKEY_HMAC type EVP_PKEY.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1217)

3 years agoRevert "RT4526: Call TerminateProcess, not ExitProcess"
Matt Caswell [Thu, 16 Jun 2016 14:59:42 +0000 (15:59 +0100)]
Revert "RT4526: Call TerminateProcess, not ExitProcess"

This reverts commit 9c1a9ccf65d0ea1912675d3a622fa8e51b524b9e.

TerminateProcess is asynchronous, so the code as written in the above
commit is not correct. It is also probably not needed in the speed
case. Reverting in order to figure out the correct solution.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoSkip the TLSProxy tests if environmental problems are an issue
Matt Caswell [Tue, 14 Jun 2016 13:35:26 +0000 (14:35 +0100)]
Skip the TLSProxy tests if environmental problems are an issue

On some platforms we can't startup the TLSProxy due to environmental
problems (e.g. network set up on the build machine). These aren't OpenSSL
problems so we shouldn't treat them as test failures. Just visibly
indicate that we are skipping the test.

We only skip the first time we attempt to start up the proxy. If that works
then everything else should do...if not we should probably investigate and
so report as a failure.

This also removes test_networking...there is a danger that this turns into
a test of user's environmental set up rather than OpenSSL.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoFix the build and tests following constification of DH, DSA, RSA
Matt Caswell [Thu, 16 Jun 2016 09:07:32 +0000 (10:07 +0100)]
Fix the build and tests following constification of DH, DSA, RSA

Misc fixes following the constification of the DH, DSA and RSA
getters.

Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoChange the return type of EVP_EncodeUpdate
Matt Caswell [Mon, 25 Apr 2016 12:56:44 +0000 (13:56 +0100)]
Change the return type of EVP_EncodeUpdate

Previously EVP_EncodeUpdate returned a void. However there are a couple
of error conditions that can occur. Therefore the return type has been
changed to an int, with 0 indicating error and 1 indicating success.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoDeal with the consequences of constifying getters
Richard Levitte [Tue, 14 Jun 2016 13:49:05 +0000 (15:49 +0200)]
Deal with the consequences of constifying getters

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoConstify the parameter getters for RSA, DSA and DH
Richard Levitte [Tue, 14 Jun 2016 13:48:16 +0000 (15:48 +0200)]
Constify the parameter getters for RSA, DSA and DH

Including documentation changes

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoRT4526: Call TerminateProcess, not ExitProcess
Rich Salz [Tue, 14 Jun 2016 20:19:37 +0000 (16:19 -0400)]
RT4526: Call TerminateProcess, not ExitProcess

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoConstify input buffers of some X509V3 and X509_PURPOSE -related methods
FdaSilvaYY [Sun, 12 Jun 2016 16:20:40 +0000 (18:20 +0200)]
Constify input buffers of some X509V3 and X509_PURPOSE -related methods

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

3 years agoConstify X509_TRUST_add method.
FdaSilvaYY [Tue, 7 Jun 2016 22:05:05 +0000 (00:05 +0200)]
Constify X509_TRUST_add method.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

3 years agoConstify asn1/asn_mime.c
FdaSilvaYY [Sun, 12 Jun 2016 09:13:57 +0000 (11:13 +0200)]
Constify asn1/asn_mime.c

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

3 years agoConstify some input buffers in asn1
FdaSilvaYY [Sun, 12 Jun 2016 09:17:50 +0000 (11:17 +0200)]
Constify some input buffers in asn1

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

3 years agoConstify CMS_get0_type input
FdaSilvaYY [Sun, 12 Jun 2016 09:18:13 +0000 (11:18 +0200)]
Constify CMS_get0_type input

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

3 years agoConstify UI
FdaSilvaYY [Tue, 7 Jun 2016 22:03:08 +0000 (00:03 +0200)]
Constify UI

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

3 years agoConstify PKCS12_create, PKCS12_add_key, PKCS12_add_safe.
FdaSilvaYY [Tue, 7 Jun 2016 22:01:33 +0000 (00:01 +0200)]
Constify PKCS12_create, PKCS12_add_key, PKCS12_add_safe.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

3 years agoConstify some conf_mod.c internal methods
FdaSilvaYY [Tue, 7 Jun 2016 21:29:28 +0000 (23:29 +0200)]
Constify some conf_mod.c internal methods

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

3 years agoChange (!seqtt) to (seqtt == NULL)
Richard Levitte [Tue, 14 Jun 2016 23:31:14 +0000 (01:31 +0200)]
Change (!seqtt) to (seqtt == NULL)

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoAlways check that the value returned by asn1_do_adb() is non-NULL
Richard Levitte [Tue, 14 Jun 2016 21:54:56 +0000 (23:54 +0200)]
Always check that the value returned by asn1_do_adb() is non-NULL

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoperlasm/x86*.pl: add endbranch instruction.
Andy Polyakov [Sun, 12 Jun 2016 14:21:37 +0000 (16:21 +0200)]
perlasm/x86*.pl: add endbranch instruction.

For further information see "Control-flow Enforcement Technology
Preview" by Intel.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agomodes/asm/ghashp8-ppc.pl: improve performance by 2.7x.
Andy Polyakov [Mon, 23 May 2016 18:34:11 +0000 (20:34 +0200)]
modes/asm/ghashp8-ppc.pl: improve performance by 2.7x.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoaes/asm/aesp8-ppc.pl: implement "tweak chaining".
Andy Polyakov [Sat, 4 Jun 2016 17:24:57 +0000 (19:24 +0200)]
aes/asm/aesp8-ppc.pl: implement "tweak chaining".

This is useful in Linux kernel context, in cases data happens
to be fragmented and processing can take multiple calls.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agotest/evptests.txt: add more XTS tests.
Andy Polyakov [Mon, 30 May 2016 21:58:40 +0000 (23:58 +0200)]
test/evptests.txt: add more XTS tests.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoevp/e_aes.c: wire hardware-assisted XTS subroutines.
Andy Polyakov [Mon, 30 May 2016 19:33:52 +0000 (21:33 +0200)]
evp/e_aes.c: wire hardware-assisted XTS subroutines.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoaes/asm/aesp8-ppc.pl: add XTS subroutines.
Andy Polyakov [Mon, 30 May 2016 19:33:29 +0000 (21:33 +0200)]
aes/asm/aesp8-ppc.pl: add XTS subroutines.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years ago(Temporarily) don't download clang package
Rich Salz [Tue, 14 Jun 2016 18:00:22 +0000 (14:00 -0400)]
(Temporarily) don't download clang package

Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoperlasm/x86_64-xlate.pl: add commentary.
Andy Polyakov [Wed, 8 Jun 2016 13:55:35 +0000 (15:55 +0200)]
perlasm/x86_64-xlate.pl: add commentary.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoperlasm/x86_64-xlate.pl: refactor argument parsing loop.
Andy Polyakov [Wed, 8 Jun 2016 13:37:46 +0000 (15:37 +0200)]
perlasm/x86_64-xlate.pl: refactor argument parsing loop.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoMake x86_64-xlate.pl 'use strict' clean.
David Benjamin [Sun, 20 Mar 2016 18:47:36 +0000 (14:47 -0400)]
Make x86_64-xlate.pl 'use strict' clean.

use strict would have caught a number of historical bugs in the perlasm
code, some in the repository and some found during review. It even found
a fresh masm-only bug (see below).

This required some tweaks. The "single instance is enough" globals got
switched to proper blessed objects rather than relying on symbolic refs.
A few types need $opcode passed in as a result.

The $$line thing is a little bit of a nuisance. There may be a clearer
pattern to use instead.

This even a bug in the masm code.
9b634c9b37afc482a8dc8868e367bdd1b650e507 added logic to make labels
global or function-global based on whether something starts with a $,
seemingly intended to capture the $decor setting of '$L$'. However, it
references $ret which is not defined in label::out. label::out is always
called after label::re, so $ret was always the label itself, so the line
always ran.

I've removed the regular expression so as not to change the behavior of
the script. A number of the assembly files now routinely jump across
functions, so this seems to be the desired behavior now.

GH#1165

Signed-off-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoVMS: use BLDDIR rather than BUILDDIR in descrip.mms.tmpl
Richard Levitte [Tue, 14 Jun 2016 20:03:08 +0000 (22:03 +0200)]
VMS: use BLDDIR rather than BUILDDIR in descrip.mms.tmpl

Just like in the other build file templates

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd a developer target 'build_generated' to rebuild mandatory headers
Richard Levitte [Tue, 14 Jun 2016 19:39:13 +0000 (21:39 +0200)]
Add a developer target 'build_generated' to rebuild mandatory headers

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoBuild file templates: make sure to depend on generated header files
Richard Levitte [Mon, 13 Jun 2016 20:02:11 +0000 (22:02 +0200)]
Build file templates: make sure to depend on generated header files

As well as properly generating those that are made from .in files.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoMove the Configure generated header files to the top build.info
Richard Levitte [Mon, 13 Jun 2016 20:01:08 +0000 (22:01 +0200)]
Move the Configure generated header files to the top build.info

This turns these headers into build file generated ones.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConfigure: Make it possible to generate mandatory header files
Richard Levitte [Mon, 13 Jun 2016 19:57:51 +0000 (21:57 +0200)]
Configure: Make it possible to generate mandatory header files

'DEPEND[]=file.h' becomes a special way to say that 'file.h' must be
generated before anything else is built.  It's likely that a number
of source files depend on these header files, this provides a simple
way to make sure they are always generated even it the dependency data
hasn't been added to the build file yet.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix omitted selector handling.
Dr. Stephen Henson [Tue, 14 Jun 2016 16:44:22 +0000 (17:44 +0100)]
Fix omitted selector handling.

The selector field could be omitted because it has a DEFAULT value.
In this case *sfld == NULL (sfld can never be NULL). This was not
noticed because this was never used in existing ASN.1 modules.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoUpdate fuzz corpora
Kurt Roeckx [Sun, 12 Jun 2016 11:27:56 +0000 (13:27 +0200)]
Update fuzz corpora

Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #2949

3 years agoInitialize the session_id
Kurt Roeckx [Sun, 5 Jun 2016 21:34:57 +0000 (23:34 +0200)]
Initialize the session_id

ssl_session_hash() always looks at the first 4 bytes, regardless of the length.
A client can send a session id that's shorter, and the callback could also
generate one that's shorter.  So we make sure that the rest of the buffer is
initliazed to 0 so that we always calculate the same hash.

Found by tis-interpreter, also previously reported as RT #2871

Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #2911

3 years agoRemove an unused variable assignment
Matt Caswell [Tue, 14 Jun 2016 15:54:08 +0000 (16:54 +0100)]
Remove an unused variable assignment

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRT4562: Fix misleading doc on OPENSSL_config
Rich Salz [Mon, 13 Jun 2016 01:49:40 +0000 (21:49 -0400)]
RT4562: Fix misleading doc on OPENSSL_config

Also changed the code to use "appname" not "filename"

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoFree memory on an error path
Matt Caswell [Tue, 14 Jun 2016 10:45:34 +0000 (11:45 +0100)]
Free memory on an error path

The function a2i_ASN1_STRING can encounter an error after already
allocating a buffer. It wasn't always freeing that buffer on error.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoAvoid a double-free in crl2pl7
Matt Caswell [Tue, 14 Jun 2016 10:27:10 +0000 (11:27 +0100)]
Avoid a double-free in crl2pl7

The variable |crtflst| could get double freed in an error path.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoAdd missing break statement
Matt Caswell [Tue, 14 Jun 2016 10:21:44 +0000 (11:21 +0100)]
Add missing break statement

The -psk option processing was falling through to the -srp option
processing in the ciphers app.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoFix comment
Matt Caswell [Tue, 14 Jun 2016 09:41:00 +0000 (10:41 +0100)]
Fix comment

Fix a comment following commit c2c49969e23605.

RT2388

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agomake update
Matt Caswell [Mon, 13 Jun 2016 22:30:27 +0000 (23:30 +0100)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>