openssl.git
3 years agoGH1536: Install empty CT log list
Rich Salz [Fri, 9 Sep 2016 22:05:41 +0000 (18:05 -0400)]
GH1536: Install empty CT log list

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoVMS: Really don't force symbol mixed case when building DSOs
Richard Levitte [Wed, 14 Sep 2016 15:49:21 +0000 (17:49 +0200)]
VMS: Really don't force symbol mixed case when building DSOs

This is an amendment to the september 8 commit titled "VMS: Don't
force symbol mixed case when building DSOs"

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRather than one variable for each passwd type, use one enum variable
Richard Levitte [Wed, 14 Sep 2016 03:06:56 +0000 (05:06 +0200)]
Rather than one variable for each passwd type, use one enum variable

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoTest the new SHA256 and SHA512 based password generation options
Richard Levitte [Wed, 14 Sep 2016 02:07:36 +0000 (04:07 +0200)]
Test the new SHA256 and SHA512 based password generation options

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoDocument the new SHA256 and SHA512 password generation options
Richard Levitte [Wed, 14 Sep 2016 02:07:04 +0000 (04:07 +0200)]
Document the new SHA256 and SHA512 password generation options

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd SHA256 and SHA512 based output for 'openssl passwd'
Richard Levitte [Wed, 14 Sep 2016 01:52:40 +0000 (03:52 +0200)]
Add SHA256 and SHA512 based output for 'openssl passwd'

RT#4674 issue 2

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd -h and -help for c_rehash script and app
Rich Salz [Mon, 12 Sep 2016 15:29:22 +0000 (11:29 -0400)]
Add -h and -help for c_rehash script and app

Resolves GH1515 and GH1509.

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoFix OCSP_RESPID processing bug introduced by WPACKET changes
Matt Caswell [Tue, 13 Sep 2016 22:59:11 +0000 (23:59 +0100)]
Fix OCSP_RESPID processing bug introduced by WPACKET changes

An OCSP_RESPID in a status request extension has 2 bytes for the length
not 1.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd some sanity checks around usage of t_fromb64()
Matt Caswell [Thu, 8 Sep 2016 13:32:27 +0000 (14:32 +0100)]
Add some sanity checks around usage of t_fromb64()

The internal SRP function t_fromb64() converts from base64 to binary. It
does not validate that the size of the destination is sufficiently large -
that is up to the callers. In some places there was such a check, but not
in others.

Add an argument to t_fromb64() to provide the size of the destination
buffer and validate that we don't write too much data. Also add some sanity
checks to the callers where appropriate.

With thanks to Shi Lei for reporting this issue.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoEncourage use of the macros for the various "sub" functions
Matt Caswell [Tue, 13 Sep 2016 14:42:12 +0000 (15:42 +0100)]
Encourage use of the macros for the various "sub" functions

Don't call WPACKET_sub_memcpy(), WPACKET_sub_allocation_bytes() and
WPACKET_start_sub_packet_len() directly.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoMake wpackettest conform to style rules
Matt Caswell [Tue, 13 Sep 2016 13:17:09 +0000 (14:17 +0100)]
Make wpackettest conform to style rules

Remove extra indentation at the start of an "if".

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd a WPACKET_sub_allocate_bytes() function
Matt Caswell [Tue, 13 Sep 2016 10:32:52 +0000 (11:32 +0100)]
Add a WPACKET_sub_allocate_bytes() function

Updated the construction code to use the new function. Also added some
convenience macros for WPACKET_sub_memcpy().

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConvert CKE construction to use the WPACKET API
Matt Caswell [Tue, 13 Sep 2016 10:01:04 +0000 (11:01 +0100)]
Convert CKE construction to use the WPACKET API

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd a test for 'openssl passwd'
Richard Levitte [Tue, 13 Sep 2016 21:23:51 +0000 (23:23 +0200)]
Add a test for 'openssl passwd'

Also, enlarge test group 20 to include openssl commands that aren't
tested otherwise

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix 'openssl passwd' with arguments -1 or -apr1
Richard Levitte [Tue, 13 Sep 2016 20:48:35 +0000 (22:48 +0200)]
Fix 'openssl passwd' with arguments -1 or -apr1

RT#4674

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix some magic values about revocation info type...
FdaSilvaYY [Sat, 6 Aug 2016 12:19:03 +0000 (14:19 +0200)]
Fix some magic values about revocation info type...

Add comments, document -valid option.
Add some const qualifiers.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1560)

3 years agoAdd --missing-help to list command
Rich Salz [Sat, 10 Sep 2016 19:46:48 +0000 (15:46 -0400)]
Add --missing-help to list command

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoRemove -xtarget=ultra from solaris(64)-sparcv9-cc builds.
Andy Grundman [Tue, 30 Aug 2016 21:25:10 +0000 (17:25 -0400)]
Remove -xtarget=ultra from solaris(64)-sparcv9-cc builds.

This flag got moved after -xarch=v9 in 1.1.0 and had the unexpected
side effect of the compiler building for 32-bit v8plusa instead of v9.

GH#1521
CLA: none; trivial

Signed-off-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
3 years agobio.h: fix number of arguments passed to BIO_ptr_ctrl()
Viktor Szakats [Tue, 30 Aug 2016 16:56:49 +0000 (18:56 +0200)]
bio.h: fix number of arguments passed to BIO_ptr_ctrl()
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1520)

3 years agos_client: avoid warning on Windows/MS-DOS systems
Viktor Szakats [Tue, 30 Aug 2016 01:01:16 +0000 (03:01 +0200)]
s_client: avoid warning on Windows/MS-DOS systems

it appears when using gcc/mingw:
```
apps/s_client.c:815:9: warning: variable 'at_eof' set but not used [-Wunused-but-set-variable]
     int at_eof = 0;
         ^~~~~~
```
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1512)

3 years agoConfigure: detect gcc's dependency generation capability more accurately.
Andy Polyakov [Sat, 10 Sep 2016 19:12:56 +0000 (21:12 +0200)]
Configure: detect gcc's dependency generation capability more accurately.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agobn/bn_lcl.h: improve interoperability with clang and Android NDK.
Andy Polyakov [Sat, 10 Sep 2016 16:57:14 +0000 (18:57 +0200)]
bn/bn_lcl.h: improve interoperability with clang and Android NDK.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConfigure: impose ^X on whole build procedure.
Andy Polyakov [Fri, 9 Sep 2016 21:45:57 +0000 (23:45 +0200)]
Configure: impose ^X on whole build procedure.

Traditionally Configure passed $ENV{PERL} to Makefile. But this
resulted in ambiguilty as Configure script could be executed by
interpreter different from one executing remaining scripts. Since
we separate compile- and run-time interpreters with HASHBANGPERL
variable, there is no reason to segment the build procedure.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAbort on unrecognised warning alerts
Matt Caswell [Mon, 12 Sep 2016 10:04:51 +0000 (11:04 +0100)]
Abort on unrecognised warning alerts

A peer continually sending unrecognised warning alerts could mean that we
make no progress on a connection. We should abort rather than continuing if
we receive an unrecognised warning alert.

Thanks to Shi Lei for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix a few style nits in the wpacket code
Matt Caswell [Tue, 13 Sep 2016 08:40:38 +0000 (09:40 +0100)]
Fix a few style nits in the wpacket code

Addressing more feedback comments.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRemove else after a return in packet code
Matt Caswell [Mon, 12 Sep 2016 08:41:01 +0000 (09:41 +0100)]
Remove else after a return in packet code

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoPull out some common packet code into a function
Matt Caswell [Mon, 12 Sep 2016 08:39:10 +0000 (09:39 +0100)]
Pull out some common packet code into a function

Two locations had the same loop for writing out a value. Pull it out into
a function.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd some soft asserts where applicable
Matt Caswell [Fri, 9 Sep 2016 08:49:16 +0000 (09:49 +0100)]
Add some soft asserts where applicable

This is an internal API. Some of the tests were for programmer erorr and
"should not happen" situations, so a soft assert is reasonable.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAddress WPACKET review comments
Matt Caswell [Thu, 8 Sep 2016 23:13:41 +0000 (00:13 +0100)]
Address WPACKET review comments

A few style tweaks here and there. The main change is that curr and
packet_len are now offsets into the buffer to account for the fact that
the pointers can change if the buffer grows. Also dropped support for the
WPACKET_set_packet_len() function. I thought that was going to be needed
but so far it hasn't been. It doesn't really work any more due to the
offsets change.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoSimplify the overflow checks in WPACKET_allocate_bytes()
Matt Caswell [Thu, 8 Sep 2016 22:08:53 +0000 (23:08 +0100)]
Simplify the overflow checks in WPACKET_allocate_bytes()

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoMove the WPACKET documentation comments to packet_locl.h
Matt Caswell [Thu, 8 Sep 2016 10:44:25 +0000 (11:44 +0100)]
Move the WPACKET documentation comments to packet_locl.h

The PACKET documentation is already in packet_locl.h so it makes sense to
have the WPACKET documentation there as well.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd tests for the WPACKET implementation
Matt Caswell [Thu, 8 Sep 2016 09:01:24 +0000 (10:01 +0100)]
Add tests for the WPACKET implementation

The tests will only work in no-shared builds because WPACKET is an
internal only API that does not get exported by the shared library.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoEnsure the WPACKET gets cleaned up in the event of an error
Matt Caswell [Thu, 8 Sep 2016 09:00:56 +0000 (10:00 +0100)]
Ensure the WPACKET gets cleaned up in the event of an error

Otherwise a mem leak can occur.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoVarious bug fixes and tweaks to WPACKET implementation
Matt Caswell [Thu, 8 Sep 2016 08:58:29 +0000 (09:58 +0100)]
Various bug fixes and tweaks to WPACKET implementation

Also added the WPACKET_cleanup() function to cleanup a WPACKET if we hit
an error.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd WPACKET_sub_memcpy() function
Matt Caswell [Tue, 6 Sep 2016 14:19:32 +0000 (15:19 +0100)]
Add WPACKET_sub_memcpy() function

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoMove from explicit sub-packets to implicit ones
Matt Caswell [Tue, 6 Sep 2016 14:09:51 +0000 (15:09 +0100)]
Move from explicit sub-packets to implicit ones

No need to declare an explicit sub-packet. Just start one.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRename PACKETW to WPACKET
Matt Caswell [Mon, 5 Sep 2016 16:34:04 +0000 (17:34 +0100)]
Rename PACKETW to WPACKET

To avoid confusion with the read PACKET structure.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConvert tls_construct_client_hello() to use PACKETW
Matt Caswell [Wed, 3 Aug 2016 19:57:52 +0000 (20:57 +0100)]
Convert tls_construct_client_hello() to use PACKETW

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFirst pass at writing a writeable packets API
Matt Caswell [Wed, 3 Aug 2016 16:06:39 +0000 (17:06 +0100)]
First pass at writing a writeable packets API

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd enginesdir to libcrypto.pc pkg-config file
David Woodhouse [Sat, 27 Aug 2016 19:33:23 +0000 (20:33 +0100)]
Add enginesdir to libcrypto.pc pkg-config file

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoVMS: Don't force symbol mixed case when building DSOs
Richard Levitte [Thu, 8 Sep 2016 18:54:34 +0000 (20:54 +0200)]
VMS: Don't force symbol mixed case when building DSOs

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoVMS: be less picky when loading DSOs
Richard Levitte [Thu, 8 Sep 2016 18:48:30 +0000 (20:48 +0200)]
VMS: be less picky when loading DSOs

The DSO API was picky about casing of symbol names on VMS.

There's really no reason to be that picky, it's mostly just annoying.
Therefore, we take away the possibility to flag for a choice, and will
instead first try to find a symbol with exact case, and failing that,
we try to find it in upper case.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoutil/shlib_wrap.sh is now auto-generated so tell git to ignore it
Matt Caswell [Sun, 11 Sep 2016 16:47:39 +0000 (12:47 -0400)]
util/shlib_wrap.sh is now auto-generated so tell git to ignore it

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoFix EC_KEY_print so it prints out private key information
Tim Hudson [Fri, 9 Sep 2016 20:53:33 +0000 (06:53 +1000)]
Fix EC_KEY_print so it prints out private key information
even when the public key is not present in an EC_KEY

Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoTrim config output
Rich Salz [Tue, 6 Sep 2016 16:26:38 +0000 (12:26 -0400)]
Trim config output

With extensive help and feedback from Richard and Andy.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoVMS: Use different C flags for programs that aren't to be installed
Richard Levitte [Thu, 8 Sep 2016 17:23:38 +0000 (19:23 +0200)]
VMS: Use different C flags for programs that aren't to be installed

This is generalised by having the following macros for stuff that won't
be installed:

    NO_INST_LIB_CFLAGS, used instead of LIB_CFLAGS
    NO_INST_DSO_CFLAGS, used instead of DSO_CFLAGS
    NO_INST_BIN_CFLAGS, used instead of BIN_CFLAGS

They take values from corresponding target config fields if those are
defined, otherwise they take the respective values from LIB_CFLAGS,
DSO_CFLAGS and BIN_CFLAGS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoBuild file templates: additional information to build file template functions
Richard Levitte [Thu, 8 Sep 2016 16:09:47 +0000 (18:09 +0200)]
Build file templates: additional information to build file template functions

Send a bit information to the build file template functions.  For
src2obj(), the additional option 'product' holds the name of the final
file that the object file will go into.  Additionally, the diverse
functions will get the option 'installed', with a value that evaluates
true if the final product is to be installed, otherwise false.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoIf errno is ENXIO in BSS_new_file(), set BIO_R_NO_SUCH_FILE
Richard Levitte [Thu, 8 Sep 2016 21:39:26 +0000 (23:39 +0200)]
If errno is ENXIO in BSS_new_file(), set BIO_R_NO_SUCH_FILE

VMS sets that errno when the device part of a file spec is malformed
or a logical name that doesn't exist.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoTravis: Do asan and msan with shared libraries
Richard Levitte [Thu, 8 Sep 2016 08:57:31 +0000 (10:57 +0200)]
Travis: Do asan and msan with shared libraries

Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoFix mem leaks during auto-deinit
Matt Caswell [Mon, 5 Sep 2016 13:12:58 +0000 (14:12 +0100)]
Fix mem leaks during auto-deinit

Certain functions are automatically called during auto-deinit in order
to deallocate resources. However, if we have never entered a function which
marks lib crypto as inited then they never get called. This can happen if
the user only ever makes use of a small sub-set of functions that don't hit
the auto-init code.

This commit ensures all such resources deallocated by these functions also
init libcrypto when they are initially allocated.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Ben Laurie <ben@openssl.org>
3 years agoEnsure trace recognises X25519
Matt Caswell [Fri, 2 Sep 2016 09:42:36 +0000 (10:42 +0100)]
Ensure trace recognises X25519

Using the -trace option to s_server or s_client was incorrectly printing
UNKNOWN for the X25519 curve.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoengines/afalg: make it compile with backward compatibility headers.
Andy Polyakov [Sun, 4 Sep 2016 20:53:22 +0000 (22:53 +0200)]
engines/afalg: make it compile with backward compatibility headers.

Reviewed-by: Tim Hudson <tjh@openssl.org>
3 years agoConfigurations/10-main.cf: AIX "facelift".
Andy Polyakov [Sat, 3 Sep 2016 20:03:55 +0000 (22:03 +0200)]
Configurations/10-main.cf: AIX "facelift".

Improve interchangeability of aix*-gcc targets by linking shared
libraries with -static-libgcc, and address linking problems with
vendor compiler.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agochacha/asm/chacha-ppc.pl: add missing .text directive.
Andy Polyakov [Fri, 2 Sep 2016 22:46:01 +0000 (00:46 +0200)]
chacha/asm/chacha-ppc.pl: add missing .text directive.

RT#4667

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd missing debug strings.
Rich Salz [Wed, 7 Sep 2016 19:40:16 +0000 (15:40 -0400)]
Add missing debug strings.

Found by turning -Wswitch-enum on.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoAllow asan, msan and ubsan to be configured with shared libraries
Richard Levitte [Wed, 7 Sep 2016 18:56:20 +0000 (20:56 +0200)]
Allow asan, msan and ubsan to be configured with shared libraries

The background story is that util/shlib_wrap.sh was setting LD_PRELOAD
or similar platform dependent variables, just in case the shared
libraries were built with -rpath.  Unfortunately, this doesn't work
too well with asan, msan or ubsan.

So, the solution is to forbid the combination of shared libraries,
-rpath and any of the sanity analyzers we can configure.

This changes util/shlib_wrap.sh so it only contains the code that sets
LD_PRELOAD when -rpath has been used when configuring.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAvoid EVP_PKEY_cmp() crash on EC keys without public component
David Woodhouse [Wed, 7 Sep 2016 15:53:18 +0000 (16:53 +0100)]
Avoid EVP_PKEY_cmp() crash on EC keys without public component

Some hardware devices don't provide the public EC_POINT data. The only
way for X509_check_private_key() to validate that the key matches a
given certificate is to actually perform a sign operation and then
verify it using the public key in the certificate.

Maybe that can come later, as discussed in issue 1532. But for now let's
at least make it fail gracefully and not crash.

GH: 1532

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1547)
(cherry picked from commit 92ed7fa575a80955f3bb6efefca9bf576a953586)

3 years agoConfigure: Reorganise the checking of disabled options
Richard Levitte [Tue, 6 Sep 2016 18:14:33 +0000 (20:14 +0200)]
Configure: Reorganise the checking of disabled options

The way we figured out what options are crypto algorithms and what are
something other was somewhat sketchy.  This change bases the
distinction on available sdirs instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoGH1537: Avoid double-free in the EVP_PKEY API
Alex Gaynor [Wed, 7 Sep 2016 13:41:20 +0000 (09:41 -0400)]
GH1537: Avoid double-free in the EVP_PKEY API

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoMisc BN fixes
Rich Salz [Mon, 5 Sep 2016 22:08:43 +0000 (18:08 -0400)]
Misc BN fixes

Never output -0; make "negative zero" an impossibility.
Do better checking on BN_rand top/bottom requirements and #bits.
Update doc.
Ignoring trailing garbage in BN_asc2bn.

Port this commit from boringSSL: https://boringssl.googlesource.com/boringssl/+/899b9b19a4cd3fe526aaf5047ab9234cdca19f7d%5E!/
        Ensure |BN_div| never gives negative zero in the no_branch code.

        Have |bn_correct_top| fix |bn->neg| if the input is zero so that we
        don't have negative zeros lying around.

        Thanks to Brian Smith for noticing.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoCorrect detection of group end in map file when testing symbol presence
Richard Levitte [Mon, 5 Sep 2016 22:48:13 +0000 (00:48 +0200)]
Correct detection of group end in map file when testing symbol presence

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoUnix build: have the makedepend and cc actions in one recipe
Richard Levitte [Sun, 4 Sep 2016 06:10:22 +0000 (08:10 +0200)]
Unix build: have the makedepend and cc actions in one recipe

In the case of using an independent makedepend, we had split that into
two separate recipes, one depending on the other.  However, there are
cases where the makedepend recipe was always trying, but doesn't
update the time stamp of the .d file because there are no actual
changes, and thereby causing constant updates of the object files.

This change makes one recipe that takes care of both makedepend och
cc, thereby avoiding these extra updates.

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agomodes/asm/ghash-armv4.pl: improve interoperability with Android NDK.
Andy Polyakov [Sat, 27 Aug 2016 18:22:03 +0000 (20:22 +0200)]
modes/asm/ghash-armv4.pl: improve interoperability with Android NDK.

Reviewed-by: Tim Hudson <tjh@openssl.org>
3 years agoConfigure: clarify and refine -static.
Andy Polyakov [Thu, 1 Sep 2016 19:36:13 +0000 (21:36 +0200)]
Configure: clarify and refine -static.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoConfigurations/10-main.conf: add android64-mips64 target.
Andy Polyakov [Thu, 1 Sep 2016 08:46:08 +0000 (10:46 +0200)]
Configurations/10-main.conf: add android64-mips64 target.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoMIPS assembly pack: adapt it for MIPS[32|64]R6.
Andy Polyakov [Thu, 1 Sep 2016 08:39:15 +0000 (10:39 +0200)]
MIPS assembly pack: adapt it for MIPS[32|64]R6.

MIPS[32|64]R6 is binary and source incompatible with previous MIPS ISA
specifications. Fortunately it's still possible to resolve differences
in source code with standard pre-processor and switching to trap-free
version of addition and subtraction instructions.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoConfigurations/10-main.conf: add android64-x86_64 target.
Andy Polyakov [Wed, 31 Aug 2016 18:50:56 +0000 (20:50 +0200)]
Configurations/10-main.conf: add android64-x86_64 target.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConfigurations/10-main.conf: fix omittions in commentary.
Andy Polyakov [Wed, 31 Aug 2016 18:50:08 +0000 (20:50 +0200)]
Configurations/10-main.conf: fix omittions in commentary.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConfigurations/10-main.conf: remove solaris-x86-cc target.
Andy Polyakov [Wed, 31 Aug 2016 14:13:10 +0000 (16:13 +0200)]
Configurations/10-main.conf: remove solaris-x86-cc target.

Since vendor assembler can't assemble our modules with -KPIC flag,
it, assembly support, was not available as an option. But this
means lack of side-channel resistant code, which is incompatible
with security by todays standards.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoMove 05-test_fuzz.t to 90-test_fuzz.t
Richard Levitte [Thu, 1 Sep 2016 19:05:34 +0000 (21:05 +0200)]
Move 05-test_fuzz.t to 90-test_fuzz.t

This adheres much better to the documentation in test/README

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoDocument the enhanced tests specification
Richard Levitte [Thu, 1 Sep 2016 16:48:19 +0000 (18:48 +0200)]
Document the enhanced tests specification

Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoRevert "INSTALL: add information on option no-fuzz-test"
Richard Levitte [Thu, 1 Sep 2016 11:44:05 +0000 (13:44 +0200)]
Revert "INSTALL: add information on option no-fuzz-test"

This reverts commit 7f9ae88817ddf0aac5c6bd95d9a5af1c54ed5bbf.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoRevert "Make it possible to disable fuzz testing"
Richard Levitte [Thu, 1 Sep 2016 11:43:40 +0000 (13:43 +0200)]
Revert "Make it possible to disable fuzz testing"

This reverts commit eb40eaed727500bf4a15f848c99e37edd18e142e.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoAdd a more versatile test chooser
Richard Levitte [Thu, 1 Sep 2016 11:34:32 +0000 (13:34 +0200)]
Add a more versatile test chooser

So far, the test runner (test/run_tests.pl) could get a list of tests
to run, and if non were given, it assumes all available tests should
be performed.

However, that makes skipping just one or two tests a bit of a pain.
This change makes the possibilities more versatile, run_checker.pl
takes these arguments and will process them in the given order,
starting with an empty set of tests to perform:

    alltests            The current set becomes the whole set of
                        available tests.
    test_xxx            Adds 'test_xxx' to the current set.
    -test_xxx           Removes 'test_xxx' from the current set.  If
                        nothing has been added to the set before this
                        argument, the current set is first initialised
                        to the whole set of available tests, then
                        'test_xxx' is removed from the current set.
    list                Display all available tests, then stop.

If no arguments are given, 'alltests' is assumed.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoINSTALL: add information on option no-fuzz-test
Richard Levitte [Wed, 31 Aug 2016 19:19:08 +0000 (21:19 +0200)]
INSTALL: add information on option no-fuzz-test

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoINSTALL: add information on the environment variable BUILDFILE
Richard Levitte [Wed, 31 Aug 2016 19:18:52 +0000 (21:18 +0200)]
INSTALL: add information on the environment variable BUILDFILE

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoINSTALL: clarify OPENSSL_LOCAL_CONFIG_DIR
Richard Levitte [Wed, 31 Aug 2016 19:17:33 +0000 (21:17 +0200)]
INSTALL: clarify OPENSSL_LOCAL_CONFIG_DIR

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoHave Configure's HASH or TABLE produce complete lists
Richard Levitte [Wed, 31 Aug 2016 17:47:35 +0000 (19:47 +0200)]
Have Configure's HASH or TABLE produce complete lists

Because some targets execute perl code that might die, we risk
incomplete lists.  Make it so dying doesn't happen when we're listing
targets.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConfigure's print_table_entry printed incorrect information
Richard Levitte [Wed, 31 Aug 2016 17:47:08 +0000 (19:47 +0200)]
Configure's print_table_entry printed incorrect information

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoMake it possible to disable fuzz testing
Richard Levitte [Wed, 31 Aug 2016 15:07:44 +0000 (17:07 +0200)]
Make it possible to disable fuzz testing

These tests take a very long time on some platforms, and arent't
always strictly necessary.  This makes it possible to turn them
off.  The necessary binaries are still built, though, in case
someone still wants to do a manual run.

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agocrypto/bn/*: x86[_64] division instruction doesn't handle constants, change constrain...
Andy Polyakov [Sat, 27 Aug 2016 18:47:57 +0000 (20:47 +0200)]
crypto/bn/*: x86[_64] division instruction doesn't handle constants, change constraint from 'g' to 'r'.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
3 years agoThe Perl interpreter might be in a path with spaces, so maybe quote it
Richard Levitte [Tue, 30 Aug 2016 16:41:00 +0000 (18:41 +0200)]
The Perl interpreter might be in a path with spaces, so maybe quote it

Note: some shells do not like the command verb to be quoted, so we avoid
it unless it's actually necessary.

RT#4665

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoCode cleanup UI
Rich Salz [Tue, 30 Aug 2016 17:31:18 +0000 (13:31 -0400)]
Code cleanup UI

Remove NULL check on parameter, and use NULL not ! on buffer.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoAdd some CertStatus tests
Matt Caswell [Tue, 30 Aug 2016 13:20:18 +0000 (14:20 +0100)]
Add some CertStatus tests

The previous commit revealed a long standing problem where CertStatus
processing was broken in DTLS. This would have been revealed by better
testing - so add some!

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoEnsure the CertStatus message adds a DTLS message header where needed
Matt Caswell [Tue, 30 Aug 2016 10:32:49 +0000 (11:32 +0100)]
Ensure the CertStatus message adds a DTLS message header where needed

The function tls_construct_cert_status() is called by both TLS and DTLS
code. However it only ever constructed a TLS message header for the message
which obviously failed in DTLS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConfigure: save away the value of OPENSSL_LOCAL_CONFIG_DIR for reconf
Richard Levitte [Mon, 29 Aug 2016 20:11:36 +0000 (22:11 +0200)]
Configure: save away the value of OPENSSL_LOCAL_CONFIG_DIR for reconf

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConfigure: Redo the logic for finding build file templates
Richard Levitte [Mon, 29 Aug 2016 19:48:12 +0000 (21:48 +0200)]
Configure: Redo the logic for finding build file templates

Build file templates would be looked up like this if the user gave us
an additional directory to look for configuration files and build file
templates:

    $OPENSSL_LOCAL_CONFIG_DIR/$OSTYPE-Makefile.tmpl
    $SOURCEDIR/Configurations/$OSTYPE-Makefile.tmpl
    $OPENSSL_LOCAL_CONFIG_DIR/Makefile.tmpl
    $SOURCEDIR/Configurations/Makefile.tmpl

So for example, if the user created his own Makefile.tmpl and tried to
use it with a unixly config, it would never be user because we have a
unix-Makefile.tmpl in our Configurations directory.  This is clearly
wrong, and this change makes it look in this order instead:

    $OPENSSL_LOCAL_CONFIG_DIR/$OSTYPE-Makefile.tmpl
    $OPENSSL_LOCAL_CONFIG_DIR/Makefile.tmpl
    $SOURCEDIR/Configurations/$OSTYPE-Makefile.tmpl
    $SOURCEDIR/Configurations/Makefile.tmpl

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConfigure: clean away temporary section of code
Richard Levitte [Mon, 29 Aug 2016 19:46:29 +0000 (21:46 +0200)]
Configure: clean away temporary section of code

We've done away with Makefile as source of information and now use
configdata.pm exclusively.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoMake it possible for the user to specify a different default build file
Richard Levitte [Mon, 29 Aug 2016 19:45:19 +0000 (21:45 +0200)]
Make it possible for the user to specify a different default build file

Make sure the information is kept for reconfiguration too.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd ecp_nistz256-ppc64 module.
Andy Polyakov [Sun, 14 Aug 2016 17:19:11 +0000 (19:19 +0200)]
Add ecp_nistz256-ppc64 module.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoperlasm/ppc-xlate.pl: recognize .type directive.
Andy Polyakov [Sun, 14 Aug 2016 15:31:18 +0000 (17:31 +0200)]
perlasm/ppc-xlate.pl: recognize .type directive.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agobn/asm/ppc.pl: harmonize .size directive in bn_mul_words.
Andy Polyakov [Sun, 14 Aug 2016 15:30:38 +0000 (17:30 +0200)]
bn/asm/ppc.pl: harmonize .size directive in bn_mul_words.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRemove comment tags from structs (coding style)
Rich Salz [Mon, 29 Aug 2016 13:07:38 +0000 (09:07 -0400)]
Remove comment tags from structs (coding style)

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoUse uppercase name for PCT_ enum
Rich Salz [Mon, 29 Aug 2016 12:23:25 +0000 (08:23 -0400)]
Use uppercase name for PCT_ enum

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoVMS: honor --openssldir setting
Richard Levitte [Fri, 26 Aug 2016 20:34:39 +0000 (22:34 +0200)]
VMS: honor --openssldir setting

Because of a perl operator priority mixup, the --openssldir argument
wasn't honored.

Reviewed-by: Tim Hudson <tjh@openssl.org>
3 years agoRemove trailing zeros
Rich Salz [Fri, 26 Aug 2016 17:07:56 +0000 (13:07 -0400)]
Remove trailing zeros

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoImprove the definition of STITCHED_CALL in e_rc4_hmac_md5.c
Richard Levitte [Fri, 26 Aug 2016 07:59:55 +0000 (09:59 +0200)]
Improve the definition of STITCHED_CALL in e_rc4_hmac_md5.c

The definition of STITCHED_CALL relies on OPENSSL_NO_ASM.  However,
when a configuration simply lacks the assembler implementation for RC4
(which is where we have implemented the stitched call), OPENSSL_NO_ASM
isn't implemented.  Better, then, to rely on specific macros that
indicated that RC4 (and MD5) are implemented in assembler.

For this to work properly, we must also make sure Configure adds the
definition of RC4_ASM among the C flags.

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoRemove note from CHANGES about EC DRBG
Matt Caswell [Thu, 25 Aug 2016 20:55:02 +0000 (21:55 +0100)]
Remove note from CHANGES about EC DRBG

EC DRBG support was added in 7fdcb457 in 2011 and then later removed.
However the CHANGES entry for its original addition was left behind.
This just removes the spurious CHANGES entry.

Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoUpdate CHANGES, NEWS, README and opensslv.h on master
Richard Levitte [Thu, 25 Aug 2016 17:07:17 +0000 (19:07 +0200)]
Update CHANGES, NEWS, README and opensslv.h on master

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix uninit read in sslapitest
Matt Caswell [Thu, 25 Aug 2016 14:58:53 +0000 (15:58 +0100)]
Fix uninit read in sslapitest

msan detected an uninit read.

Reviewed-by: Richard Levitte <levitte@openssl.org>