openssl.git
4 years agoUse _NO_INST in some build.info files
Richard Levitte [Fri, 8 Jul 2016 12:52:51 +0000 (14:52 +0200)]
Use _NO_INST in some build.info files

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoAdapt the build files to the new "install" hash table
Richard Levitte [Fri, 8 Jul 2016 12:52:09 +0000 (14:52 +0200)]
Adapt the build files to the new "install" hash table

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoDocument the _NO_INST variants
Richard Levitte [Fri, 8 Jul 2016 12:51:23 +0000 (14:51 +0200)]
Document the _NO_INST variants

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agobuild.info: implement PROGRAM_NO_INST, and dito for ENGINES, SCRIPTS, LIBS
Richard Levitte [Fri, 8 Jul 2016 12:28:58 +0000 (14:28 +0200)]
build.info: implement PROGRAM_NO_INST, and dito for ENGINES, SCRIPTS, LIBS

PROGRAM_NO_INST, ENGINES_NO_INST, SCRIPTS_NO_INST and LIBS_NO_INST are
to be used to specify program, engines, scripts and libraries that are
not to be installed in the system.  Fuzzers, test programs, that sort
of things are of the _NO_INST type, for example.

For the benefit of build file templates and other templates that use
data from configdata.pm, a new hash table $unified_info{install} is
created.  It contains a set of subhashes, one for each type of
installable, each having an array of file names as values.  For
example, it can look like this:

    "install" =>
        {
            "engines" =>
                [
                    "engines/afalg/afalg",
                    "engines/capi",
                    "engines/dasync",
                    "engines/padlock",
                ],
            "libraries" =>
                [
                    "libcrypto",
                    "libssl",
                ],
            "programs" =>
                [
                    "apps/openssl",
                ],
            "scripts" =>
                [
                    "apps/CA.pl",
                    "apps/tsget",
                    "tools/c_rehash",
                ],
        },

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix print of ASN.1 BIGNUM type.
Dr. Stephen Henson [Mon, 18 Jul 2016 16:52:56 +0000 (17:52 +0100)]
Fix print of ASN.1 BIGNUM type.

The ASN.1 BIGNUM type needs to be handled in a custom way as it is
not a generic ASN1_STRING type.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix formatting in statem_srvr.c based on review feedback
Matt Caswell [Mon, 18 Jul 2016 13:17:42 +0000 (14:17 +0100)]
Fix formatting in statem_srvr.c based on review feedback

Also elaborated a comment based on feedback.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoEnsure Travis tests SSLv3
Matt Caswell [Fri, 15 Jul 2016 09:46:01 +0000 (10:46 +0100)]
Ensure Travis tests SSLv3

Switch on Travis testing of SSLv3.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoTry and make the transition tests for CKE message clearer
Matt Caswell [Fri, 15 Jul 2016 09:36:42 +0000 (10:36 +0100)]
Try and make the transition tests for CKE message clearer

The logic testing whether a CKE message is allowed or not was a little
difficult to follow. This tries to clean it up.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoSimplify key_exchange_expected() logic
Matt Caswell [Fri, 15 Jul 2016 09:04:11 +0000 (10:04 +0100)]
Simplify key_exchange_expected() logic

The static function key_exchange_expected() used to return -1 on error.
Commit 361a119127 changed that so that it can never fail. This means that
some tidy up can be done to simplify error handling in callers of that
function.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoFix client auth test_ssl_new failures when enabling/disabling protocols
Matt Caswell [Wed, 22 Jun 2016 22:22:00 +0000 (23:22 +0100)]
Fix client auth test_ssl_new failures when enabling/disabling protocols

If configuring for anything other than the default TLS protocols then
test failures were occuring.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoMake sure we call ssl3_digest_cached_records() when necessary
Matt Caswell [Wed, 22 Jun 2016 13:37:57 +0000 (14:37 +0100)]
Make sure we call ssl3_digest_cached_records() when necessary

Having received a ClientKeyExchange message instead of a Certificate we
know that we are not going to receive a CertificateVerify message. This
means we can free up the handshake_buffer. However we better call
ssl3_digest_cached_records() instead of just freeing it up, otherwise we
later try and use it anyway and a core dump results. This could happen,
for example, in SSLv3 where we send a CertificateRequest but the client
sends no Certificate message at all. This is valid in SSLv3 (in TLS
clients are required to send an empty Certificate message).

Found using the BoringSSL test suite.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoFix SSLv3 alert if no Client Ceritifcate sent after a request for one
Matt Caswell [Wed, 22 Jun 2016 18:43:46 +0000 (19:43 +0100)]
Fix SSLv3 alert if no Client Ceritifcate sent after a request for one

In TLS if the server sends a CertificateRequest and the client does not
provide one, if the server cannot continue it should send a
HandshakeFailure alert. In SSLv3 the same should happen, but instead we
were sending an UnexpectedMessage alert. This is incorrect - the message
isn't unexpected - it is valid for the client not to send one - its just
that we cannot continue without one.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoFix SSLv3 ClientAuth alert checking
Matt Caswell [Wed, 22 Jun 2016 18:41:03 +0000 (19:41 +0100)]
Fix SSLv3 ClientAuth alert checking

In TLS during ClientAuth if the CA is not recognised you should get an
UnknownCA alert. In SSLv3 this does not exist and you should get a
BadCertificate alert.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoFix Client Auth tests
Matt Caswell [Wed, 22 Jun 2016 15:34:26 +0000 (16:34 +0100)]
Fix Client Auth tests

The Client Auth tests were not correctly setting the Protocol, so that this
aspect had no effect. It was testing the same thing lots of times for
TLSv1.2 every time.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoPrepare the client certificate earlier
Matt Caswell [Wed, 22 Jun 2016 13:31:32 +0000 (14:31 +0100)]
Prepare the client certificate earlier

Move the preparation of the client certificate to be post processing work
after reading the CertificateRequest message rather than pre processing
work prior to writing the Certificate message. As part of preparing the
client certificate we may discover that we do not have one available. If
we are also talking SSLv3 then we won't send the Certificate message at
all. However, if we don't discover this until we are about to send the
Certificate message it is too late and we send an empty one anyway. This
is wrong for SSLv3.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoFix mingw build
Matt Caswell [Mon, 18 Jul 2016 09:29:46 +0000 (10:29 +0100)]
Fix mingw build

Mingw builds on Travis were failing because INT_MAX was undeclared.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix strict-warnings build
Matt Caswell [Mon, 18 Jul 2016 09:28:45 +0000 (10:28 +0100)]
Fix strict-warnings build

The i2d_SCT_LIST function is declared as __owur, therefore we need to check
the result or a --strict-warnings build will fail.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoaes/asm/aesfx-sparcv9.pl: switch to fshiftorx to improve single-block
Andy Polyakov [Sun, 3 Jul 2016 14:53:14 +0000 (16:53 +0200)]
aes/asm/aesfx-sparcv9.pl: switch to fshiftorx to improve single-block
and short-input performance.

[Fix bug in misaligned output handling.]

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoSPARC assembly pack: enforce V8+ ABI constraints.
Andy Polyakov [Fri, 1 Jul 2016 16:10:10 +0000 (18:10 +0200)]
SPARC assembly pack: enforce V8+ ABI constraints.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoevp/e_aes.c: wire new CBC and CTR subroutines from aesfx-sparcv9.
Andy Polyakov [Sat, 23 Apr 2016 17:22:53 +0000 (19:22 +0200)]
evp/e_aes.c: wire new CBC and CTR subroutines from aesfx-sparcv9.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoaes/asm/aesfx-sparcv9.pl: add "teaser" CBC and CTR subroutines.
Andy Polyakov [Sat, 23 Apr 2016 17:21:18 +0000 (19:21 +0200)]
aes/asm/aesfx-sparcv9.pl: add "teaser" CBC and CTR subroutines.

[Also optimize aligaddr usage in single-block subroutines.]

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agofuzzers: print and convert it back
Kurt Roeckx [Sat, 16 Jul 2016 11:41:33 +0000 (13:41 +0200)]
fuzzers: print and convert it back

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1323

4 years agoReturn error when trying to print invalid ASN1 integer
Kurt Roeckx [Sat, 16 Jul 2016 14:56:54 +0000 (16:56 +0200)]
Return error when trying to print invalid ASN1 integer

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1322

4 years agoINSTALL: clarify --cross-compile-prefix.
Andy Polyakov [Fri, 15 Jul 2016 11:11:52 +0000 (13:11 +0200)]
INSTALL: clarify --cross-compile-prefix.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agocrypto/LPdir_win.c: rationalize temporary allocations.
Andy Polyakov [Sat, 16 Jul 2016 11:10:02 +0000 (13:10 +0200)]
crypto/LPdir_win.c: rationalize temporary allocations.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agocrypto/LPdir_win.c: harmonize with o_fopen.c.
Andy Polyakov [Fri, 15 Jul 2016 13:21:00 +0000 (15:21 +0200)]
crypto/LPdir_win.c: harmonize with o_fopen.c.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoMake fuzzer and fuzz tester builds less magic
Richard Levitte [Fri, 8 Jul 2016 16:13:17 +0000 (18:13 +0200)]
Make fuzzer and fuzz tester builds less magic

Instead of having fuzz/build.info.fuzz magically and conditionally
included along with the other build.info files, incorporate it in
fuzz/build.info and add the conditions there instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agofix memory leaks
Miroslav Franc [Thu, 14 Jul 2016 15:14:08 +0000 (17:14 +0200)]
fix memory leaks

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1313)

4 years agoRemove the silly CVS markers from LPdir_*.c
Richard Levitte [Fri, 15 Jul 2016 16:41:37 +0000 (18:41 +0200)]
Remove the silly CVS markers from LPdir_*.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoAdd back lost copyright and license text in LPdir_win.c
Richard Levitte [Fri, 15 Jul 2016 16:40:53 +0000 (18:40 +0200)]
Add back lost copyright and license text in LPdir_win.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix: dummy definition of rand_hw_seed() should also return int
Richard Levitte [Fri, 15 Jul 2016 15:57:35 +0000 (17:57 +0200)]
Fix: dummy definition of rand_hw_seed() should also return int

Reviewed-by: Stephen Henson <steve@openssl.org>
4 years agoFix ASN.1 private encode of EC_KEY to not change the input key
Richard Levitte [Fri, 15 Jul 2016 11:31:26 +0000 (13:31 +0200)]
Fix ASN.1 private encode of EC_KEY to not change the input key

RT#4611

Reviewed-by: Stephen Henson <steve@openssl.org>
4 years agocheck return values for EVP_Digest*() APIs
Dr. Stephen Henson [Sat, 18 Jun 2016 14:46:13 +0000 (15:46 +0100)]
check return values for EVP_Digest*() APIs

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoWindows: allow input and output flags to end with a space, or not
Richard Levitte [Fri, 15 Jul 2016 10:57:27 +0000 (12:57 +0200)]
Windows: allow input and output flags to end with a space, or not

With a number of tools, especially those coming with Visual Studio,
some command options are separated from their argument with a space,
others with a space.  Since we parametrise them, we can't know
beforehand which it will be, so we must allow the input and output
options to have either.

However, spaces at the end of nmake macro values are trimmed, so allow
spaces to exist by adding a reference to an undefined macro at the end.

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agocrypto/x86[_64]cpuid.pl: add OPENSSL_ia32_rd[rand|seed]_bytes.
Andy Polyakov [Sun, 10 Jul 2016 10:05:43 +0000 (12:05 +0200)]
crypto/x86[_64]cpuid.pl: add OPENSSL_ia32_rd[rand|seed]_bytes.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoSmall fixes in unix-Makefile.tmpl
Richard Levitte [Thu, 14 Jul 2016 19:13:24 +0000 (21:13 +0200)]
Small fixes in unix-Makefile.tmpl

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoInstall applink.c with the public header files.
Richard Levitte [Thu, 14 Jul 2016 19:11:46 +0000 (21:11 +0200)]
Install applink.c with the public header files.

This is only done for the platforms where 'OPENSSL_USE_APPLINK' is defined.

Also, change the docs of OPENSSL_Applink to say where to find applink.c
in the installation directory.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoWindows: take care of manifest files
Richard Levitte [Thu, 14 Jul 2016 07:23:36 +0000 (09:23 +0200)]
Windows: take care of manifest files

The easiest way to take care of manifest files is to integrate them
into the associated binary (.exe or .dll).  MT (the Manifest Tool) is
the utility to use for this.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agomake update
Dr. Stephen Henson [Wed, 13 Jul 2016 13:20:49 +0000 (14:20 +0100)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoAdd OCSP accessors.
Dr. Stephen Henson [Wed, 13 Jul 2016 13:20:15 +0000 (14:20 +0100)]
Add OCSP accessors.

RT#4605

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix DH error-handling in tls_process_key_exchange.
David Benjamin [Mon, 11 Jul 2016 03:35:04 +0000 (23:35 -0400)]
Fix DH error-handling in tls_process_key_exchange.

The set0 setters take ownership of their arguments, so the values should
be set to NULL to avoid a double-free in the cleanup block should
ssl_security(SSL_SECOP_TMP_DH) fail. Found by BoringSSL's WeakDH test.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1299)

4 years agoMake update
Viktor Dukhovni [Tue, 12 Jul 2016 15:10:05 +0000 (11:10 -0400)]
Make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoPerform DANE-EE(3) name checks by default
Viktor Dukhovni [Mon, 11 Jul 2016 00:36:02 +0000 (20:36 -0400)]
Perform DANE-EE(3) name checks by default

In light of potential UKS (unknown key share) attacks on some
applications, primarily browsers, despite RFC761, name checks are
by default applied with DANE-EE(3) TLSA records.  Applications for
which UKS is not a problem can optionally disable DANE-EE(3) name
checks via the new SSL_CTX_dane_set_flags() and friends.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoExtend mkcert.sh to support nameConstraints generation and more complex
Dr. Stephen Henson [Wed, 22 Jun 2016 12:36:08 +0000 (13:36 +0100)]
Extend mkcert.sh to support nameConstraints generation and more complex
subject alternate names.

Add nameConstraints tests incluing DNS, IP and email tests both in
subject alt name extension and subject name.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agomake update
Dr. Stephen Henson [Mon, 4 Jul 2016 13:46:08 +0000 (14:46 +0100)]
make update

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoAdd nameConstraints commonName checking.
Dr. Stephen Henson [Sun, 3 Jul 2016 20:41:57 +0000 (21:41 +0100)]
Add nameConstraints commonName checking.

New hostname checking function asn1_valid_host()

Check commonName entries against nameConstraints: any CN components in
EE certificate which look like hostnames are checked against
nameConstraints.

Note that RFC5280 et al only require checking subject alt name against
DNS name constraints.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoDon't rely on implicit rsa.h inclusion
Viktor Dukhovni [Mon, 11 Jul 2016 01:09:38 +0000 (21:09 -0400)]
Don't rely on implicit rsa.h inclusion

With no-deprecated, some nested includes don't happen by default.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoVMS: Adjust the engines directory by adding the pointer size to its name
Richard Levitte [Sat, 9 Jul 2016 09:06:44 +0000 (11:06 +0200)]
VMS: Adjust the engines directory by adding the pointer size to its name

With OpenSSL 1.1 and on, the engines are tightly tied to the shared
library they're to be used with.  That makes them depend on the
pointer size as well as the shared library version, and this gets
reflected in the name of the directory they're installed in.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoVMS: Small cleanups
Richard Levitte [Fri, 8 Jul 2016 16:38:31 +0000 (18:38 +0200)]
VMS: Small cleanups

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoVMS: OSSL$EXE: needs to reflect that programs are installed in two places
Richard Levitte [Fri, 8 Jul 2016 16:35:38 +0000 (18:35 +0200)]
VMS: OSSL$EXE: needs to reflect that programs are installed in two places

We're installing architecture dependent (compiled) programs in
architecture specific directories, while architecture independent
programs (scripts) get installed in the general programs directory.
OSSL$EXE: reflects that by having two values.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoVMS: Document the changed logical names in VMS/openssl_staryup.com.in
Richard Levitte [Fri, 8 Jul 2016 16:34:21 +0000 (18:34 +0200)]
VMS: Document the changed logical names in VMS/openssl_staryup.com.in

Since there's been quite some changes, documentation needs updating

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoVMS: Present OPENSSLDIR according to the VMS setup.
Richard Levitte [Fri, 8 Jul 2016 16:30:43 +0000 (18:30 +0200)]
VMS: Present OPENSSLDIR according to the VMS setup.

This mostly affects 'openssl version -a', which might as well display
what we're actually looking at.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoVMS: Simplify the spec of the default certs & keys area.
Richard Levitte [Fri, 8 Jul 2016 16:27:56 +0000 (18:27 +0200)]
VMS: Simplify the spec of the default certs & keys area.

We previously had a number of logical names for the different parts.
There's really no need for that, the default directories are in one
directory tree.  So we only define OSSL$DATAROOT: and make everything
related to that one.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoUpdate ordinals
Rich Salz [Fri, 8 Jul 2016 20:19:38 +0000 (16:19 -0400)]
Update ordinals

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoPlatform sanity test
Rich Salz [Tue, 28 Jun 2016 17:05:24 +0000 (13:05 -0400)]
Platform sanity test

Replace nptest with sanity test.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoGH1278: Removed error code for alerts
Rich Salz [Sat, 2 Jul 2016 00:10:03 +0000 (20:10 -0400)]
GH1278: Removed error code for alerts

Commit aea145e removed some error codes that are generated
algorithmically: mapping alerts to error texts.  Found by
Andreas Karlsson.  This restores them, and adds two missing ones.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoReplace all #define's in pod pages.
Rich Salz [Fri, 8 Jul 2016 16:55:45 +0000 (12:55 -0400)]
Replace all #define's in pod pages.

Function-like macros are replaced with prototypes and a note
that they are implemented as macros.  Constants are just
referenced in-line in the text.

Tweak BIO_TYPE_... documentation.

Also fix RT4592.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoVMS: openssl_ivp must call versioned openssl_startup and openssl_utils
Richard Levitte [Fri, 8 Jul 2016 13:01:04 +0000 (15:01 +0200)]
VMS: openssl_ivp must call versioned openssl_startup and openssl_utils

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoDisallow multiple protocol flags to s_server and s_client
Matt Caswell [Thu, 7 Jul 2016 10:05:31 +0000 (11:05 +0100)]
Disallow multiple protocol flags to s_server and s_client

We shouldn't allow both "-tls1" and "-tls1_2", or "-tls1" and "-no_tls1_2".
The only time multiple flags are allowed is where they are all "-no_<prot>".

This fixes Github Issue #1268

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoUnix: Set the execute permission on installed shared libraries
Richard Levitte [Fri, 8 Jul 2016 11:33:27 +0000 (13:33 +0200)]
Unix: Set the execute permission on installed shared libraries

Some Unix variants require shared libraries to have the execute
permissions set, or they won't be loadable or executable when loaded.
Among others, cygwin has this requirement.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoReorganize .gitignore to make better use of its features
Richard Levitte [Fri, 8 Jul 2016 12:11:43 +0000 (14:11 +0200)]
Reorganize .gitignore to make better use of its features

It's possible to have a very few rules for some directories and trust
that other patterns further along will take care of whatever is left.
.gitignore should therefore be loosely organised from least generic to
most generic, allowing things like this:

    # Keep any file with extensions, such as foo.c, bar.h, ...
    !/dir/*.*

    # ....

    # Remove all object files
    *.o
    *.obj

With this change, we implement some very generic rules for what will
and will not be ignored in the fuzz subdirectory, and truse that
patterns later on (such as *.o, *.obj, *.exe) will take care of
everything we didn't specifically specify for the fuzz subdirectory.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoinclude/openssl: don't include <windows.h> in public headers.
Andy Polyakov [Sun, 26 Jun 2016 11:40:15 +0000 (13:40 +0200)]
include/openssl: don't include <windows.h> in public headers.

If application uses any of Windows-specific interfaces, make it
application developer's respondibility to include <windows.h>.
Rationale is that <windows.h> is quite "toxic" and is sensitive
to inclusion order (most notably in relation to <winsock2.h>).
It's only natural to give complete control to the application developer.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoSupport PKCS v2.0 print in pkcs12 utility.
Dr. Stephen Henson [Thu, 7 Jul 2016 14:56:26 +0000 (15:56 +0100)]
Support PKCS v2.0 print in pkcs12 utility.

Extended alg_print() in pkcs12 utility to support PBES2 algorithms.

RT#4588

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoVMS: correct post-install instructions
Richard Levitte [Wed, 6 Jul 2016 19:54:47 +0000 (21:54 +0200)]
VMS: correct post-install instructions

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoWindows: make some vars in windows-makefile.tmpl reachable again
Richard Levitte [Wed, 6 Jul 2016 17:43:59 +0000 (19:43 +0200)]
Windows: make some vars in windows-makefile.tmpl reachable again

$openssldir and $enginesdir were mistakenly made unavailable to other
perl fragments.  They are still needed in the definition of CFLAGS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoVMS: defined the logical name OPENSSL at all times
Richard Levitte [Wed, 6 Jul 2016 17:04:55 +0000 (19:04 +0200)]
VMS: defined the logical name OPENSSL at all times

This logical names permits '#include <openssl/foo.h>' to work properly.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoVersioning engines default location: the VMS case
Richard Levitte [Wed, 6 Jul 2016 16:53:56 +0000 (18:53 +0200)]
Versioning engines default location: the VMS case

OpenSSL engines are tied to the OpenSSL shared library versions,
starting with OpenSSL 1.1.  We therefore need to install them in
directories which have the shared library version in it's name, to
easily allow multiple OpenSSL versions to be installed at the same
time.

For VMS, the change is a bit more involved, primarly because the top
installation directory was already versioned, *as well as* some of the
files inside.  That's a bit too much.  Version numbering in files is
also a bit different on VMS.  The engines for shared library version
1.1 will therefore end up in OSSL$INSTROOT:[ENGINES0101.'arch']

('arch' is the architecture we build for)

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoVersioning engines default location: the Unix case
Richard Levitte [Wed, 6 Jul 2016 16:50:47 +0000 (18:50 +0200)]
Versioning engines default location: the Unix case

OpenSSL engines are tied to the OpenSSL shared library versions,
starting with OpenSSL 1.1.  We therefore need to install them in
directories which have the shared library version in it's name, to
easily allow multiple OpenSSL versions to be installed at the same
time.

For Unix, the default installation directory is changed from
$PREFIX/lib/engines to $PREFIX/lib/engines-${major}_${minor} (mingw)
or $PREFIX/lib/engines-${major}.${minor} (all but mingw)

($PREFIX is the directory given for the configuration option --prefix,
and ${major} and ${minor} are the major and minor shared library
version numbers)

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoVersioning engines default location: the Windows case
Richard Levitte [Wed, 6 Jul 2016 16:37:52 +0000 (18:37 +0200)]
Versioning engines default location: the Windows case

OpenSSL engines are tied to the OpenSSL shared library versions,
starting with OpenSSL 1.1.  We therefore need to install them in
directories which have the shared library version in it's name, to
easily allow multiple OpenSSL versions to be installed at the same
time.

For windows, the default installation directory is changed from
$PREFIX/lib/engines to $PREFIX/lib/engines-${major}_${minor}

($PREFIX is the directory given for the configuration option --prefix,
and ${major} and ${minor} are the major and minor shared library
version numbers)

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoAdd OPENSSL_NO_EC wrapper
Rich Salz [Tue, 5 Jul 2016 15:51:04 +0000 (11:51 -0400)]
Add OPENSSL_NO_EC wrapper

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoMake 'build_libs' build shared libraries as well
Richard Levitte [Wed, 6 Jul 2016 01:07:16 +0000 (03:07 +0200)]
Make 'build_libs' build shared libraries as well

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoDon't indicate errors during initial adb decode.
Dr. Stephen Henson [Tue, 5 Jul 2016 22:24:26 +0000 (23:24 +0100)]
Don't indicate errors during initial adb decode.

Reviewed-by: Tim Hudson <tjh@openssl.org>
4 years agoVMS: make sure there's a file extension when creating files
Richard Levitte [Wed, 6 Jul 2016 00:08:53 +0000 (02:08 +0200)]
VMS: make sure there's a file extension when creating files

When creating the library $lib.olb, make sure the extension is there.
Otherwise, a logical name with the same name as the file in question
will redirect the creation elsewhere.

Reviewed-by: Tim Hudson <tjh@openssl.org>
4 years agoVMS: arch in config.com was mistakenly made process global
Richard Levitte [Tue, 5 Jul 2016 23:23:41 +0000 (01:23 +0200)]
VMS: arch in config.com was mistakenly made process global

Reviewed-by: Tim Hudson <tjh@openssl.org>
4 years agomake update
Richard Levitte [Tue, 5 Jul 2016 21:05:54 +0000 (23:05 +0200)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoStop using and deprecate ENGINE_setup_bsd_cryptodev
Richard Levitte [Tue, 5 Jul 2016 11:54:49 +0000 (13:54 +0200)]
Stop using and deprecate ENGINE_setup_bsd_cryptodev

The calls we made to it were redundant, as the same initialization is
done later in OPENSSL_init_crypto() anyway.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix mem error handling in PKCS7_simple_smimecap
FdaSilvaYY [Sun, 26 Jun 2016 19:20:52 +0000 (21:20 +0200)]
Fix mem error handling in PKCS7_simple_smimecap

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoImprove some error management code in CT
FdaSilvaYY [Mon, 27 Jun 2016 20:42:25 +0000 (22:42 +0200)]
Improve some error management code in CT

Separate invalid input case from any internal (malloc) failure

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoFix some memory error handling in CT
FdaSilvaYY [Mon, 27 Jun 2016 19:58:32 +0000 (21:58 +0200)]
Fix some memory error handling in CT

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoAdd checks on sk_TYPE_push() returned value
FdaSilvaYY [Mon, 27 Jun 2016 19:57:58 +0000 (21:57 +0200)]
Add checks on sk_TYPE_push() returned value

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoReorganise asn1.h and add comments.
Dr. Stephen Henson [Wed, 27 Apr 2016 13:47:45 +0000 (14:47 +0100)]
Reorganise asn1.h and add comments.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoUpdate fuzz/README.md
Rich Salz [Mon, 4 Jul 2016 00:00:47 +0000 (20:00 -0400)]
Update fuzz/README.md

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoperl: Separate compile-time environment from runtime environment
Richard Levitte [Sat, 2 Jul 2016 14:39:15 +0000 (16:39 +0200)]
perl: Separate compile-time environment from runtime environment

Make it possible to have a separate and different perl command string
for installable scripts than we use when building, with the
environment variable HASHBANGPERL.  Its value default to the same as
the environment PERL if it's defined, otherwise '/usr/bin/env perl'.

Note: this is only relevant for Unix-like environments.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
4 years agoFix broken loading of client CAs
Andreas Karlsson [Fri, 1 Jul 2016 23:19:39 +0000 (01:19 +0200)]
Fix broken loading of client CAs

The SSL_load_client_CA_file() failed to load any CAs due to an
inccorrect assumption about the return value of lh_*_insert(). The
return value when inserting into a hash is the old value of the key.

The bug was introduced in 3c82e437bb3af822ea13cd5a24bab0745c556246.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1279)

4 years agoVMS: Add installation verification procedure
Richard Levitte [Sat, 2 Jul 2016 08:28:39 +0000 (10:28 +0200)]
VMS: Add installation verification procedure

On VMS, it's customary to have a procedure to check that the software
was installed correctly and can run as advertised.

The procedure added here is fairly simple, it checks that all
libraries are in place, that the header crypto.h is in place, and that
the command 'openssl version -a' runs without trouble.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix some VMS inconsistencies
Richard Levitte [Sat, 2 Jul 2016 06:47:08 +0000 (08:47 +0200)]
Fix some VMS inconsistencies

- The install top is versioned by default.  However, only the major
  version should be used.
- the default areas for certs, private keys an config files have
  changed, now all prefixed with 'OSSL$'.  This gets reflected in
  cryptlib.h.
- [.VMS]openssl_startup.com.in had some faults regarding creating
  rooted concealed logical names.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoInstall the openssl app with version number on VMS
Richard Levitte [Sat, 2 Jul 2016 07:51:06 +0000 (09:51 +0200)]
Install the openssl app with version number on VMS

This makes it possible for script writers to lock on to a specific
version if they need to.  Note that only the major version number is
used.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoHave the VMS shared library file names contain the shared version
Richard Levitte [Sat, 2 Jul 2016 06:35:12 +0000 (08:35 +0200)]
Have the VMS shared library file names contain the shared version

Also, have the static library file names contain the pointer size when
applicable.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoPass down correct information to the VMS startup script templates
Richard Levitte [Sat, 2 Jul 2016 06:31:00 +0000 (08:31 +0200)]
Pass down correct information to the VMS startup script templates

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoAdd the missing pointer_size information on VMS configs
Richard Levitte [Sat, 2 Jul 2016 07:50:24 +0000 (09:50 +0200)]
Add the missing pointer_size information on VMS configs

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoEnsure that global dependencies are built first, even for parallell builds
Ben Laurie [Sun, 26 Jun 2016 12:09:23 +0000 (13:09 +0100)]
Ensure that global dependencies are built first, even for parallell builds

Also, make sure that per-file deps are included in the build, even if previous
builds have failed.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoUse the SSL_METHODs passed to create_ssl_ctx_pair()
Matt Caswell [Fri, 1 Jul 2016 18:15:05 +0000 (19:15 +0100)]
Use the SSL_METHODs passed to create_ssl_ctx_pair()

Don't use hardcoded SSL_METHODs!

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoAvoid an overflow in constructing the ServerKeyExchange message
Matt Caswell [Fri, 1 Jul 2016 10:58:05 +0000 (11:58 +0100)]
Avoid an overflow in constructing the ServerKeyExchange message

We calculate the size required for the ServerKeyExchange message and then
call BUF_MEM_grow_clean() on the buffer. However we fail to take account of
2 bytes required for the signature algorithm and 2 bytes for the signature
length, i.e. we could overflow by 4 bytes. In reality this won't happen
because the buffer is pre-allocated to a large size that means it should be
big enough anyway.

Addresses an OCAP Audit issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoCleanup obj_dat.h, obj_dat.pl
Rich Salz [Wed, 29 Jun 2016 16:23:16 +0000 (12:23 -0400)]
Cleanup obj_dat.h, obj_dat.pl

The recent merge of https://github.com/openssl/openssl/pull/1264
removed some trailing whitespace from the generated file obj_dat.h.
Unfortunately obj_dat.pl kept re-adding it.  Clean up the
script and the output it generates.

Add 'use strict / use warnings'

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoDeal with pod2html issues, in this case the lack of .html suffix in links
Richard Levitte [Fri, 1 Jul 2016 17:06:37 +0000 (19:06 +0200)]
Deal with pod2html issues, in this case the lack of .html suffix in links

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoSimplify INCLUDE statements in build.info files
Richard Levitte [Wed, 29 Jun 2016 20:59:50 +0000 (22:59 +0200)]
Simplify INCLUDE statements in build.info files

Now that INCLUDE considers both the source and build trees, no need
for the rel2abs perl fragment hacks any more.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoMake build.info INCLUDE stmts be both source and build tree relative
Richard Levitte [Wed, 29 Jun 2016 20:51:42 +0000 (22:51 +0200)]
Make build.info INCLUDE stmts be both source and build tree relative

INCLUDE statements in build.info files were source tree centric.  That
meant that to get include directory specs in the build tree, we had to
resort to perl fragments that specified the build tree include paths
as absolute ones.

This change has the INCLUDE statement consider both the source and
build tree for any include directory.  It means that there may be some
extra unnecessary include paths, but it also makes life simpler for
anyone who makes changes in the build.info files.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agofix 'set but not used' warning
Dr. Stephen Henson [Fri, 1 Jul 2016 14:52:52 +0000 (15:52 +0100)]
fix 'set but not used' warning

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoRe-add x509 and crl fuzzer
Kurt Roeckx [Fri, 1 Jul 2016 14:42:15 +0000 (16:42 +0200)]
Re-add x509 and crl fuzzer

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1276

4 years agoAdd old locking constants back
Kurt Roeckx [Wed, 29 Jun 2016 09:45:51 +0000 (11:45 +0200)]
Add old locking constants back

Fixes #1260

Reviewed-by: Matt Caswell <matt@openssl.org>
GH: #1266