openssl.git
2 years agoAllow Ed25519 in TLS 1.2
Dr. Stephen Henson [Fri, 16 Jun 2017 17:55:28 +0000 (18:55 +0100)]
Allow Ed25519 in TLS 1.2

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3585)

2 years agoConvert key exchange to one shot call
Dr. Stephen Henson [Fri, 16 Jun 2017 18:23:47 +0000 (19:23 +0100)]
Convert key exchange to one shot call

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3585)

2 years agoPrint Ed25519 in s_client/s_server
Dr. Stephen Henson [Wed, 24 May 2017 13:56:17 +0000 (14:56 +0100)]
Print Ed25519 in s_client/s_server

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3585)

2 years agoAdd Ed25519 to trace output
Dr. Stephen Henson [Wed, 24 May 2017 14:28:40 +0000 (15:28 +0100)]
Add Ed25519 to trace output

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3585)

2 years agoHandle signature algorithms with no associated digest
Dr. Stephen Henson [Wed, 14 Jun 2017 15:54:08 +0000 (16:54 +0100)]
Handle signature algorithms with no associated digest

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3585)

2 years agoAdd Ed25519 signature algorithm
Dr. Stephen Henson [Wed, 24 May 2017 20:56:38 +0000 (21:56 +0100)]
Add Ed25519 signature algorithm

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3585)

2 years agoAdd Ed25519 to signature algorithm table
Dr. Stephen Henson [Wed, 24 May 2017 14:28:26 +0000 (15:28 +0100)]
Add Ed25519 to signature algorithm table

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3585)

2 years agoAdd index for ED25519
Dr. Stephen Henson [Wed, 24 May 2017 20:54:03 +0000 (21:54 +0100)]
Add index for ED25519

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3585)

2 years agoUse X509_get_signature_info to get signature strength.
Dr. Stephen Henson [Wed, 24 May 2017 21:01:00 +0000 (22:01 +0100)]
Use X509_get_signature_info to get signature strength.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3585)

2 years agoRecognise Ed25519 in X509_certificate_type
Dr. Stephen Henson [Wed, 24 May 2017 20:52:31 +0000 (21:52 +0100)]
Recognise Ed25519 in X509_certificate_type

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3585)

2 years agoMerge Nokia copyright notice into standard
Rich Salz [Tue, 20 Jun 2017 14:14:36 +0000 (10:14 -0400)]
Merge Nokia copyright notice into standard

This is done with the kind permission of Nokia.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3722)

2 years agoReformat progs.pl; add ARIA support
Rich Salz [Tue, 20 Jun 2017 18:28:50 +0000 (14:28 -0400)]
Reformat progs.pl; add ARIA support

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/3726)

2 years agoRemove OSSLzu macros and use %zu in the test framework (via BIO_printf).
Pauli [Tue, 20 Jun 2017 22:39:54 +0000 (08:39 +1000)]
Remove OSSLzu macros and use %zu in the test framework (via BIO_printf).

Convert the debug prints in dtls_mtu_test.c to use the framework.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3730)

2 years agoEnsure a space after colon in enc -v
Rich Salz [Tue, 20 Jun 2017 18:14:48 +0000 (14:14 -0400)]
Ensure a space after colon in enc -v

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3725)

2 years agoAdd parentheses around macro argument of OSSL_NELEM.
Bernd Edlinger [Sun, 26 Mar 2017 21:29:41 +0000 (23:29 +0200)]
Add parentheses around macro argument of OSSL_NELEM.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3039)

2 years agoModify Sun copyright to follow OpenSSL style
Rich Salz [Thu, 15 Jun 2017 14:16:46 +0000 (10:16 -0400)]
Modify Sun copyright to follow OpenSSL style

Approved by Oracle.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/3585)

2 years agoDeclare a new x509v3 extension: x509ExtAdmission
FdaSilvaYY [Tue, 20 Jun 2017 13:24:53 +0000 (09:24 -0400)]
Declare a new x509v3 extension: x509ExtAdmission

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2759)

2 years agoFix typo (note by oneton@users.github)
Rich Salz [Tue, 20 Jun 2017 02:48:25 +0000 (22:48 -0400)]
Fix typo (note by oneton@users.github)

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3716)

2 years agoAdd RAND_UNIMPLEMENTED error code
Rich Salz [Mon, 19 Jun 2017 16:58:06 +0000 (12:58 -0400)]
Add RAND_UNIMPLEMENTED error code

See old GitHub PR 38.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3714)

2 years agoMake clear error message if opt_<number> fails
Paul Yang [Mon, 19 Jun 2017 17:28:37 +0000 (01:28 +0800)]
Make clear error message if opt_<number> fails

for opt_long(opt_int)/opt_ulong/opt_imax/opt_umax

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3653)

2 years agoAddress style issues.
Pauli [Mon, 19 Jun 2017 21:58:51 +0000 (07:58 +1000)]
Address style issues.
Refactor count -> c which makes the for loop more readable.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3710)

2 years agoAddress double error and OSSLzu comments.
Pauli [Mon, 19 Jun 2017 21:58:14 +0000 (07:58 +1000)]
Address double error and OSSLzu comments.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3710)

2 years agoPut error output back.
Pauli [Mon, 19 Jun 2017 01:49:27 +0000 (11:49 +1000)]
Put error output back.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3710)

2 years agoUpdate tests to avoid printf to stdout/stderr when running as test cases.
Pauli [Mon, 19 Jun 2017 01:21:22 +0000 (11:21 +1000)]
Update tests to avoid printf to stdout/stderr when running as test cases.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3710)

2 years agoRemove bsd_cryptodev engine
Rich Salz [Tue, 13 Jun 2017 20:33:33 +0000 (16:33 -0400)]
Remove bsd_cryptodev engine

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3699)

2 years agoFix the fall-out in 04-test_bioprint.t
Bernd Edlinger [Mon, 19 Jun 2017 11:33:41 +0000 (13:33 +0200)]
Fix the fall-out in 04-test_bioprint.t

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3712)

2 years agoFix the error handling in ERR_get_state:
Bernd Edlinger [Mon, 19 Jun 2017 09:18:44 +0000 (11:18 +0200)]
Fix the error handling in ERR_get_state:
- Ignoring the return code of ossl_init_thread_start created a memory leak.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3712)

2 years agoFix preprocessor indentation.
Pauli [Mon, 19 Jun 2017 01:35:25 +0000 (11:35 +1000)]
Fix preprocessor indentation.
Rework main() to be in the style of the other conditional tests.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3711)

2 years agos_client accepts host/port as positional argument.
Cory Benfield [Sun, 5 Jun 2016 03:46:38 +0000 (20:46 -0700)]
s_client accepts host/port as positional argument.

This allows the user to provide the target host and optional port to
openssl s_client as an optional positional argument, rather than as the
argument to the -connect flag. This rationalises the user experience of
s_client: given that the only logical purpose of s_client is to connect
to a host, it is difficult to understand why there is an (effectively
mandatory) command option to pass to make that happen.

This patch forbids providing *both* -connect and the positional
argument, because it would likely be too difficult to reconcile.
Otherwise, using the positional argument behaves exactly the same as
using -connect does.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1171)

2 years agoRemove non-accurate description in Configure script
Paul Yang [Sat, 17 Jun 2017 14:17:44 +0000 (22:17 +0800)]
Remove non-accurate description in Configure script

For DES and 3DES based ciphers are also enabled by this option.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3707)

2 years agoFix va_list processing in test_note()
Richard Levitte [Sat, 17 Jun 2017 07:54:54 +0000 (09:54 +0200)]
Fix va_list processing in test_note()

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3704)

2 years agoRemove a pointless "#if 0" block from BN_mul.
Bernd Edlinger [Wed, 14 Jun 2017 19:54:15 +0000 (21:54 +0200)]
Remove a pointless "#if 0" block from BN_mul.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3683)

2 years agoReorder Configure output
Richard Levitte [Mon, 3 Oct 2016 15:39:11 +0000 (17:39 +0200)]
Reorder Configure output

"Configuring..." was displayed with './Configure LIST'.  This reorders
the display of that line to happen after the "targets" LIST, TABLE and
HASH have been checked.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3702)

2 years agoForbid to specify -nextprotoneg if -tls1_3 is enabled
Paul Yang [Fri, 16 Jun 2017 10:12:02 +0000 (18:12 +0800)]
Forbid to specify -nextprotoneg if -tls1_3 is enabled

This applies both to s_client and s_server app.

Reaction to Issue #3665.

Signed-off-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3697)

2 years agoModify type of variable in OPENSSL_cpuid_setup function
komainu8 [Sun, 11 Jun 2017 13:38:05 +0000 (22:38 +0900)]
Modify type of variable in OPENSSL_cpuid_setup function

CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3651)

2 years agoAdd output routines to allow consistent formatting of memory, strings
Pauli [Mon, 12 Jun 2017 00:01:17 +0000 (10:01 +1000)]
Add output routines to allow consistent formatting of memory, strings
and bignums.  These have been refactored into their own file, along with
their error displays.  The formatting follows the output format used
on error, except that bignums of sixty four bits or less are displayed
in a more compact one line form.

Added a TEST_note function for producing output without file and line
information.

Update the three tests that call BN_print so they use the new test
infrastructure instead.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3655)

2 years agoAdd a missing break in test/shlibloadtest.c
Bernd Edlinger [Fri, 16 Jun 2017 20:10:11 +0000 (16:10 -0400)]
Add a missing break in test/shlibloadtest.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3661)

2 years agoFix the comment about default OPENSSLDIR in windows.
Bernd Edlinger [Sun, 11 Jun 2017 11:10:15 +0000 (13:10 +0200)]
Fix the comment about default OPENSSLDIR in windows.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3650)

2 years agoTweak the check that a ciphersuite has not changed since the HRR
Matt Caswell [Fri, 16 Jun 2017 09:56:40 +0000 (10:56 +0100)]
Tweak the check that a ciphersuite has not changed since the HRR

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3623)

2 years agoAdd comments to test_ciphersuite_change()
Matt Caswell [Thu, 15 Jun 2017 12:44:24 +0000 (13:44 +0100)]
Add comments to test_ciphersuite_change()

Make it clear that we are pausing one of the connections and then
restarting it again.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3623)

2 years agoFix an uninitialised variable warning
Matt Caswell [Mon, 12 Jun 2017 12:57:13 +0000 (13:57 +0100)]
Fix an uninitialised variable warning

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3623)

2 years agoMove ciphersuite selection before session resumption in TLSv1.3
Matt Caswell [Tue, 6 Jun 2017 16:19:32 +0000 (17:19 +0100)]
Move ciphersuite selection before session resumption in TLSv1.3

This does things as per the recommendation in the TLSv1.3 spec. It also
means that the server will always choose its preferred ciphersuite.
Previously the server would only select ciphersuites compatible with the
session.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3623)

2 years agoAdd a test for a server changing the ciphersuite
Matt Caswell [Fri, 2 Jun 2017 12:10:50 +0000 (13:10 +0100)]
Add a test for a server changing the ciphersuite

Test that if a server selects a differenct ciphersuite with the same hash
in TLSv1.3 then this is accepted by the client.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3623)

2 years agoAllow the server to change the ciphersuite on resume
Matt Caswell [Fri, 26 May 2017 16:59:34 +0000 (17:59 +0100)]
Allow the server to change the ciphersuite on resume

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3623)

2 years agoAdd the target 'build_all_generated'
Richard Levitte [Fri, 16 Jun 2017 01:46:41 +0000 (03:46 +0200)]
Add the target 'build_all_generated'

This new target is used to build all generated files and only that.
This can be used to prepare everything that requires things like perl
for a system that lacks perl and then move everything to that system
and do the rest of the build there.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3695)

2 years agoFix no-ec
Benjamin Kaduk [Thu, 15 Jun 2017 21:01:04 +0000 (17:01 -0400)]
Fix no-ec

Also remove nested OPENSSL_NO_EC conditional; it was properly indented,
but a no-op.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3693)

2 years agoAdd apps/progs.h to gitignore
Todd Short [Thu, 15 Jun 2017 19:24:19 +0000 (15:24 -0400)]
Add apps/progs.h to gitignore

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3692)

2 years agoAdd sha/asm/keccak1600-armv8.pl.
Andy Polyakov [Wed, 14 Jun 2017 11:35:17 +0000 (13:35 +0200)]
Add sha/asm/keccak1600-armv8.pl.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2 years agoStandardize Levitte's dual-license
Rich Salz [Thu, 15 Jun 2017 17:15:26 +0000 (13:15 -0400)]
Standardize Levitte's dual-license

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3689)

2 years agoBuild apps/progs.h dynamically
Richard Levitte [Thu, 15 Jun 2017 17:31:01 +0000 (19:31 +0200)]
Build apps/progs.h dynamically

Because apps/progs.h isn't configuration agnostic, it's not at all
suited for 'make update' or being versioned, so change it to be
dynamically generated.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3688)

2 years agoMove bn and evp test programs input data to their respective data dir
Richard Levitte [Tue, 16 May 2017 06:57:33 +0000 (08:57 +0200)]
Move bn and evp test programs input data to their respective data dir

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3472)

2 years ago.travis.yml: Detect if 'make update' updated something
Richard Levitte [Thu, 15 Jun 2017 14:52:18 +0000 (16:52 +0200)]
.travis.yml: Detect if 'make update' updated something

If it did, it really is something that should be checked in, and should
therefore make a CI build fail.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3686)

2 years agoCorrect Oracle copyrights & clarify.
Pauli [Thu, 15 Jun 2017 03:34:28 +0000 (13:34 +1000)]
Correct Oracle copyrights & clarify.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3684)

2 years agoRemove OLD_STR_TO_KEY compile option
Rich Salz [Wed, 14 Jun 2017 16:05:25 +0000 (12:05 -0400)]
Remove OLD_STR_TO_KEY compile option

This flag was added in 1992 and only documented in the CHANGES file.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3681)

2 years agoFix possible crash in X931 code.
Bernd Edlinger [Tue, 13 Jun 2017 20:34:30 +0000 (22:34 +0200)]
Fix possible crash in X931 code.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3675)

2 years agoFix another possible crash in rsa_ossl_mod_exp.
Bernd Edlinger [Tue, 13 Jun 2017 20:08:03 +0000 (22:08 +0200)]
Fix another possible crash in rsa_ossl_mod_exp.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3675)

2 years agoFix a possible crash in dsa_builtin_paramgen2.
Bernd Edlinger [Tue, 13 Jun 2017 19:22:45 +0000 (21:22 +0200)]
Fix a possible crash in dsa_builtin_paramgen2.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3675)

2 years agoFix crash in ecdh_simple_compute_key.
Bernd Edlinger [Tue, 13 Jun 2017 16:08:40 +0000 (18:08 +0200)]
Fix crash in ecdh_simple_compute_key.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3671)

2 years agoFix a possible crash in the error handling.
Bernd Edlinger [Tue, 13 Jun 2017 17:00:35 +0000 (19:00 +0200)]
Fix a possible crash in the error handling.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3672)

2 years agoUpdate copyright on progs.h
Rich Salz [Tue, 13 Jun 2017 12:51:13 +0000 (08:51 -0400)]
Update copyright on progs.h

The generating script got updated, but the generated file did not.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3668)

2 years agoFix a memleak in ec_copy_parameters.
Bernd Edlinger [Tue, 13 Jun 2017 05:22:50 +0000 (07:22 +0200)]
Fix a memleak in ec_copy_parameters.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3666)

2 years agoperlasm/ppc-xlate.pl: add PowerISA 3.0B instructions.
Andy Polyakov [Fri, 9 Jun 2017 20:07:38 +0000 (22:07 +0200)]
perlasm/ppc-xlate.pl: add PowerISA 3.0B instructions.

[As well as few extra instructions from earlier spec.]

Reviewed-by: Rich Salz <rsalz@openssl.org>
2 years agoMake SNI behavior more clear in s_client doc & help
Paul Yang [Tue, 13 Jun 2017 12:18:55 +0000 (20:18 +0800)]
Make SNI behavior more clear in s_client doc & help

Update s_client -help and pod file.

Signed-off-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3654)

2 years agoRework writing crypto/err/openssl.txt
Richard Levitte [Mon, 12 Jun 2017 22:32:05 +0000 (00:32 +0200)]
Rework writing crypto/err/openssl.txt

Reading the prologue of this file conserved the "# Function codes"
line, and then duplicated it when rewriting this file, adding a new
"# Function codes" line everytime there's an update.

Better then to skip over all comment lines and have the prologue
defined in mkerr.pl, just the same as we do with the other affected
files.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3664)

2 years agoAdd -module option to util/mkerr.pl
Richard Levitte [Mon, 12 Jun 2017 18:06:56 +0000 (20:06 +0200)]
Add -module option to util/mkerr.pl

Sometimes, one might only want to rework a subset of all the internal
error codes.  -module allows the caller to specify exactly which
library modules to rewrite.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3662)

2 years agoClean up a bundle of codingstyle stuff in apps directory
Paul Yang [Mon, 12 Jun 2017 17:24:02 +0000 (01:24 +0800)]
Clean up a bundle of codingstyle stuff in apps directory

Mostly braces and NULL pointer check and also copyright year bump

Signed-off-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3657)

2 years agoFix a memleak in tls13_generate_secret.
Bernd Edlinger [Mon, 12 Jun 2017 17:30:10 +0000 (19:30 +0200)]
Fix a memleak in tls13_generate_secret.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3660)

2 years agoPut message strings in state files
Rich Salz [Wed, 7 Jun 2017 20:29:15 +0000 (16:29 -0400)]
Put message strings in state files

Add "*" as indicator meaning the function/reason is removed, so put an
empty string in the function/reason string table; this preserves backward
compatibility by keeping the #define's.

In state files, trailing backslash means text is on the next line.

Add copyright to state files

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3640)

2 years agoFix memleak in EVP_DigestSignFinal/VerifyFinal.
Bernd Edlinger [Mon, 12 Jun 2017 16:05:19 +0000 (18:05 +0200)]
Fix memleak in EVP_DigestSignFinal/VerifyFinal.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3658)

2 years agoRefactor functions in testdsa.h
Paul Yang [Mon, 12 Jun 2017 02:38:15 +0000 (10:38 +0800)]
Refactor functions in testdsa.h

To reduce duplicate code

Signed-off-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3656)

2 years agoAdd sslapitest for SSL_early_get1_extensions_present()
Benjamin Kaduk [Fri, 17 Mar 2017 14:39:01 +0000 (09:39 -0500)]
Add sslapitest for SSL_early_get1_extensions_present()

Call it from the early callback used for testing these functions, and verify
the expected contents of the ClientHello

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2976)

2 years agoAdd SSL_early_get1_extensions_present()
Benjamin Kaduk [Thu, 16 Mar 2017 22:17:16 +0000 (17:17 -0500)]
Add SSL_early_get1_extensions_present()

It is an API to be used from the early callback that indicates what
extensions were present in the ClientHello, and in what order.
This can be used to eliminate unneeded calls to SSL_early_get0_ext()
(which itself scales linearly in the number of extensions supported
by the library).

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2976)

2 years agoTLS 1.3 client sigalgs test no longer needs TLS 1.2
Benjamin Kaduk [Wed, 5 Apr 2017 18:32:18 +0000 (13:32 -0500)]
TLS 1.3 client sigalgs test no longer needs TLS 1.2

Per the TODO comment, we now have proper certificate selection for
TLS 1.3 client certificates, so this test can move into its own
block.  (It cannot merge with the previous block, as it requires EC.)

Verified that the test passes when configured with enable-tls1_3
no-tls1 no-tls1_1 no-tls1_2.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3131)

2 years agodrop some no-longer-relevant TODO(TLS1.3) entries
Benjamin Kaduk [Thu, 23 Mar 2017 16:00:08 +0000 (11:00 -0500)]
drop some no-longer-relevant TODO(TLS1.3) entries

We prevent compression both when the server is parsing the ClientHello
and when the client is constructing the ClientHello.  A 1.3 ServerHello
has no way to hand us back a compression method, and we already check
that the server does not try to give us back a compression method that
we did not request, so these checks seem sufficient.

Weaken the INSTALL note slightly, as we do now expect to interoperate
with other implementations.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3131)

2 years agoRemove leading space-before-tab
Rich Salz [Sun, 11 Jun 2017 21:10:30 +0000 (17:10 -0400)]
Remove leading space-before-tab

Reviewed-by: Kurt Roceckx <kurt@openssl.org>
2 years agoimprove comment: use "optimization" for clarity
Josh Soref [Sun, 14 May 2017 09:17:30 +0000 (09:17 +0000)]
improve comment: use "optimization" for clarity
The previous word was a misspelling of nicety

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3464)

2 years agoIntroduce ASN1_TIME_set_string_X509 API
Rich Salz [Sun, 11 Jun 2017 20:36:07 +0000 (16:36 -0400)]
Introduce ASN1_TIME_set_string_X509 API

Make funcs to deal with non-null-term'd string
in both asn1_generalizedtime_to_tm() and asn1_utctime_to_tm().

Fixes issue #3444.

This one is used to enforce strict format (RFC 5280) check and to
convert GeneralizedTime to UTCTime.

apps/ca has been changed to use the new API.

Test cases and documentation are updated/added

Signed-off-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3566)

2 years agodoc/man3: use the documented coding style in the example code
Beat Bolli [Fri, 18 Nov 2016 23:10:05 +0000 (00:10 +0100)]
doc/man3: use the documented coding style in the example code

Adjust brace placement, whitespace after keywords, indentation and empty
lines after variable declarations according to
https://www.openssl.org/policies/codingstyle.html.

Indent literal sections by exactly one space.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3580)

2 years agoFix spelling errors in manpages
Josh Soref [Fri, 19 May 2017 00:16:38 +0000 (00:16 +0000)]
Fix spelling errors in manpages

spelling: algorithm
spelling: anyway
spelling: assigned
spelling: authenticated
spelling: callback
spelling: certificate
spelling: compatibility
spelling: configuration
spelling: digest
spelling: encrypted
spelling: function
spelling: output
spelling: receive
spelling: renegotiation
spelling: signing
spelling: similar
spelling: string

(Merged from https://github.com/openssl/openssl/pull/3580)Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3580)

2 years agoIf-guard to avoid null ptr deref in statem_srvr.c
Rich Salz [Sun, 11 Jun 2017 17:44:56 +0000 (13:44 -0400)]
If-guard to avoid null ptr deref in statem_srvr.c

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
CLA: trivial
(Merged from https://github.com/openssl/openssl/pull/3419)

2 years agoRemove needless type casting.
Rich Salz [Sat, 10 Jun 2017 19:25:56 +0000 (15:25 -0400)]
Remove needless type casting.

CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3627)

2 years agoFix possible usage of NULL pointers in apps/spkac.c
Paul Yang [Fri, 9 Jun 2017 18:22:22 +0000 (02:22 +0800)]
Fix possible usage of NULL pointers in apps/spkac.c

Check return value of NETSCAPE_SPKI_new() and
NETSCAPE_SPKI_b64_encode(), and also clean up coding style incidentally.

Signed-off-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3647)

2 years agoFix memory leaks in CTLOG_new_from_base64
Benjamin Kaduk [Fri, 9 Jun 2017 17:31:11 +0000 (13:31 -0400)]
Fix memory leaks in CTLOG_new_from_base64

Move the call to ct_base64_decode(), which allocates, until after
the check for NULL output parameter.

Also place a cap on the number of padding characters used to decrement
the output length -- any more than two '='s is not permitted in a
well-formed base64 text.  Prior to this change, ct_base64_decode() would
return a length of -1 along with allocated storage for an input of
"====".

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3379)

2 years agomark V_ASN1_PRIMATIVE_TAG as compat
Josh Soref [Sun, 14 May 2017 14:53:54 +0000 (14:53 +0000)]
mark V_ASN1_PRIMATIVE_TAG as compat

This incorrectly spelled item exists for compatibility purposes

CLA: Trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3460)

2 years agofix check of broken implementations of GOST ciphersuites
Pichulin Dmitrii [Fri, 9 Jun 2017 17:04:00 +0000 (13:04 -0400)]
fix check of broken implementations of GOST ciphersuites

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3642)

2 years agoFix speed command for alternation of ciphers and digests.
Jonathan Protzenko [Wed, 17 May 2017 16:09:01 +0000 (09:09 -0700)]
Fix speed command for alternation of ciphers and digests.

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3487)

2 years agoAdd support for using engine-backed keys in spkac
Luke Faraone [Tue, 16 May 2017 01:23:17 +0000 (18:23 -0700)]
Add support for using engine-backed keys in spkac

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3599)

2 years agoFix a bundle of trailing spaces in several files
Paul Yang [Tue, 6 Jun 2017 15:35:43 +0000 (23:35 +0800)]
Fix a bundle of trailing spaces in several files

Signed-off-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3622)

2 years agoList undocumented macros
Rich Salz [Thu, 8 Jun 2017 19:57:50 +0000 (15:57 -0400)]
List undocumented macros

The search is approximate; look only for those that look like
functions.

[skip ci]

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3641)

2 years agoRemove stale note from s_server.pod
Benjamin Kaduk [Thu, 8 Jun 2017 20:55:30 +0000 (15:55 -0500)]
Remove stale note from s_server.pod

Modern browsers are now, well, pretty modern.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3644)

2 years agoIgnore -named_curve auto value to improve backwards compatibility
Tomas Mraz [Mon, 22 May 2017 14:20:21 +0000 (16:20 +0200)]
Ignore -named_curve auto value to improve backwards compatibility

Fixes #3490

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3518)

2 years agoFix a read off the end of the input buffer
Rich Salz [Thu, 8 Jun 2017 20:05:52 +0000 (16:05 -0400)]
Fix a read off the end of the input buffer

when building with OPENSSL_SMALL_FOOTPRINT defined.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3533)

2 years agoUse memset to clear SRP_CTX instead of NULL and zero assignments
Diego Santa Cruz [Tue, 16 May 2017 08:35:49 +0000 (10:35 +0200)]
Use memset to clear SRP_CTX instead of NULL and zero assignments

This uses memset() to clear all of the SRP_CTX when free'ing or
initializing it as well as in error paths instead of having a series
of NULL and zero assignments as it is safer.

It also changes SSL_SRP_CTX_init() to reset all the SRP_CTX to zero
in case or error, previously it could retain pointers to freed
memory, potentially leading to a double free.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3467)

2 years agoMake SRP_CTX.info ownership and lifetime be the same as SRP_CTX.login.
Diego Santa Cruz [Mon, 15 May 2017 08:35:45 +0000 (10:35 +0200)]
Make SRP_CTX.info ownership and lifetime be the same as SRP_CTX.login.

Ownership and lifetime rules of SRP_CTX.info are confusing and different
from those of SRP_CTX.login, making it difficult to use correctly.
This makes the ownership and lifetime be the same as those of SRP_CTX.login,
thet is a copy is made when setting it and is freed when SRP_CTX is freed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3467)

2 years agoClean up s_server documentation
Matt Caswell [Wed, 7 Jun 2017 10:43:03 +0000 (11:43 +0100)]
Clean up s_server documentation

List the options in the same order and in the same style as the output from
"openssl s_server -help"

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3628)

2 years agoRemove doc of non-existent functions
Rich Salz [Thu, 8 Jun 2017 19:18:38 +0000 (15:18 -0400)]
Remove doc of non-existent functions

Fix test for "documenting private functions"
And add -p flag to doc-nits recipe
Mark when things were deprecated, if doc'd as such

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3624)

2 years agosha/asm/keccak1600-armv4.pl: switch to more efficient bit interleaving algorithm.
Andy Polyakov [Wed, 7 Jun 2017 15:57:17 +0000 (17:57 +0200)]
sha/asm/keccak1600-armv4.pl: switch to more efficient bit interleaving algorithm.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2 years agosha/keccak1600.c: switch to more efficient bit interleaving algorithm.
Andy Polyakov [Wed, 7 Jun 2017 15:55:15 +0000 (17:55 +0200)]
sha/keccak1600.c: switch to more efficient bit interleaving algorithm.

[Also bypass sizeof(void *) == 8 check on some platforms.]

Reviewed-by: Rich Salz <rsalz@openssl.org>
2 years agoAdd back support for SHA224 based sig algs
Matt Caswell [Thu, 8 Jun 2017 16:15:45 +0000 (17:15 +0100)]
Add back support for SHA224 based sig algs

This used to work but was inadvertently removed as part of the TLSv1.3
work. This adds it back.

Fixes #3633

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3639)

2 years agoWindows: rearrange programs cleanup
Richard Levitte [Thu, 8 Jun 2017 06:02:26 +0000 (08:02 +0200)]
Windows: rearrange programs cleanup

The list of programs hit nmake's maximum line length, so we split up the
line in smaller chunks.

Fixes #3634

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3636)