oweals/openssl.git
8 years agoNo -fno-common for Darwin
Richard Levitte [Fri, 4 Mar 2016 12:48:59 +0000 (13:48 +0100)]
No -fno-common for Darwin

When object files with common block symbols are added to static
libraries on Darwin, those symbols are invisible to the linker that
tries to use them.  Our solution was to use -fno-common when compiling
C source.

Unfortunately, there is assembler code that defines OPENSSL_ia32cap_P
as a common block symbol, unconditionally, and in some cases, there is
no other definition.  -fno-common doesn't help in this case.

However, 'ranlib -c' adds common block symbols to the index of the
static library, which makes them visible to the linker using it, and
that solves the problem we've seen.

The common conclusion is, either use -fno-common or ranlib -c on
Darwin.  Since we have common block symbols unconditionally, choosing
the method for our source is easy.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
8 years agoNew ordinal files, recreated from scratch
Richard Levitte [Thu, 3 Mar 2016 11:42:37 +0000 (12:42 +0100)]
New ordinal files, recreated from scratch

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoChange names of ordinals and libs, libeay => libcrypto and ssleay => libssl
Richard Levitte [Thu, 3 Mar 2016 11:42:01 +0000 (12:42 +0100)]
Change names of ordinals and libs, libeay => libcrypto and ssleay => libssl

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRemove the old ordinals
Richard Levitte [Thu, 3 Mar 2016 11:24:09 +0000 (12:24 +0100)]
Remove the old ordinals

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agouse saner default parameters for scrypt
Dr. Stephen Henson [Fri, 4 Mar 2016 23:28:45 +0000 (23:28 +0000)]
use saner default parameters for scrypt

Thanks to Colin Percival for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDisable SSLv3 by default
Kurt Roeckx [Thu, 3 Mar 2016 21:45:57 +0000 (22:45 +0100)]
Disable SSLv3 by default

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Kasper <emilia@openssl.org>
MR: #2203

8 years agoDon't mark the eNULL ciphers as non-default.
Kurt Roeckx [Thu, 3 Mar 2016 21:02:58 +0000 (22:02 +0100)]
Don't mark the eNULL ciphers as non-default.

They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT

Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #2202

8 years agoCurve25519: fix const-initialization
Emilia Kasper [Fri, 4 Mar 2016 17:05:35 +0000 (18:05 +0100)]
Curve25519: fix const-initialization

Clang is permissive of this, but gcc fails.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd ASN.1 ADB callback.
Dr. Stephen Henson [Fri, 4 Mar 2016 14:55:24 +0000 (14:55 +0000)]
Add ASN.1 ADB callback.

Add support for application supplied any defined by callback. An
application can change the selector value if it wishes. This is
mainly intended for values which are only known at runtime, for
example dynamically created OIDs.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoGH784: Better variable name
Dmitry-Me [Fri, 4 Mar 2016 07:34:47 +0000 (10:34 +0300)]
GH784: Better variable name

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoMake formatting consistent in apps/Makefile.in
Rob Percival [Fri, 4 Mar 2016 15:30:33 +0000 (15:30 +0000)]
Make formatting consistent in apps/Makefile.in

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRemove redundant semi-colons from apps/Makefile.in
Rob Percival [Fri, 4 Mar 2016 13:18:24 +0000 (13:18 +0000)]
Remove redundant semi-colons from apps/Makefile.in

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDocumentation for new CT s_client flags
Rob Percival [Thu, 3 Mar 2016 14:07:28 +0000 (14:07 +0000)]
Documentation for new CT s_client flags

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDocumentation for new SSL functions
Rob Percival [Thu, 3 Mar 2016 18:39:30 +0000 (18:39 +0000)]
Documentation for new SSL functions

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoHandle empty log name in "enable_logs" line of the CT log file
Rob Percival [Thu, 3 Mar 2016 16:08:55 +0000 (16:08 +0000)]
Handle empty log name in "enable_logs" line of the CT log file

e.g. "enabled_logs = foo,,bar"

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoHandle missing "enabled_logs" line in CT log file
Rob Percival [Thu, 3 Mar 2016 16:08:01 +0000 (16:08 +0000)]
Handle missing "enabled_logs" line in CT log file

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoIf a CT log entry in CTLOG_FILE is invalid, skip it and continue loading
Rob Percival [Thu, 3 Mar 2016 16:06:59 +0000 (16:06 +0000)]
If a CT log entry in CTLOG_FILE is invalid, skip it and continue loading

Previously, the remaining CT log entries would not be loaded.
Also, CTLOG_STORE_load_file would return 1 even if a log entry was
invalid, resulting in no errors being shown.

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoExtends s_client to allow a basic CT policy to be enabled
Rob Percival [Wed, 2 Mar 2016 13:34:05 +0000 (13:34 +0000)]
Extends s_client to allow a basic CT policy to be enabled

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoChange default CT log list filename to "ct_log_list.cnf"
Rob Percival [Fri, 4 Mar 2016 13:18:54 +0000 (13:18 +0000)]
Change default CT log list filename to "ct_log_list.cnf"

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdds CT validation to SSL connections
Rob Percival [Thu, 3 Mar 2016 16:19:23 +0000 (16:19 +0000)]
Adds CT validation to SSL connections

Disabled by default, but can be enabled by setting the
ct_validation_callback on a SSL or SSL_CTX.

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoChanges to DEFAULT curves
Rich Salz [Sun, 3 Jan 2016 18:24:32 +0000 (13:24 -0500)]
Changes to DEFAULT curves

Change the ECC default curve list to be this, in order: x25519, secp256r1,
secp521r1, secp384r1, brainpoolP256r1, brainpoolP384r1, and brainpool512r1.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoCurve25519: avoid undefined behaviour
Emilia Kasper [Wed, 2 Mar 2016 22:50:58 +0000 (23:50 +0100)]
Curve25519: avoid undefined behaviour

Appease the sanitizer: avoid left shifts of negative values.

This could've been done entirely with casts to uint and back,
but using masks seemed slightly more readable.

There are also implementation-defined signed right shifts in this
code. Those remain.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agochacha/asm/chacha-ppc.pl: fix typo.
Andy Polyakov [Wed, 2 Mar 2016 11:43:09 +0000 (12:43 +0100)]
chacha/asm/chacha-ppc.pl: fix typo.

RT#4365

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDon't build RC4 ciphersuites into libssl by default
Matt Caswell [Thu, 3 Mar 2016 15:40:51 +0000 (15:40 +0000)]
Don't build RC4 ciphersuites into libssl by default

RC4 based ciphersuites in libssl have been disabled by default. They can
be added back by building OpenSSL with the "enable-weak-ssl-ciphers"
Configure option at compile time.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoImproved HKDF and TLS1-PRF documentation
Viktor Dukhovni [Fri, 4 Mar 2016 04:30:42 +0000 (23:30 -0500)]
Improved HKDF and TLS1-PRF documentation

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoCorrection, $disabled{shared} rather than $config{no_shared}
Richard Levitte [Fri, 4 Mar 2016 04:43:15 +0000 (05:43 +0100)]
Correction, $disabled{shared} rather than $config{no_shared}

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRestore the zlib / zlib-dynamic logic
Richard Levitte [Thu, 3 Mar 2016 09:07:29 +0000 (10:07 +0100)]
Restore the zlib / zlib-dynamic logic

The proper logic is that both zlib and zlib-dynamic are disabled by
default and that enabling zlib-dynamic would enable zlib.  Somewhere
along the way, the logic got changed, zlib-dynamic was enabled by
default and zlib didn't get automatically enabled.

This change restores the original logic.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoSanity check PVK file fields.
Dr. Stephen Henson [Thu, 3 Mar 2016 23:37:36 +0000 (23:37 +0000)]
Sanity check PVK file fields.

PVK files with abnormally large length or salt fields can cause an
integer overflow which can result in an OOB read and heap corruption.
However this is an rarely used format and private key files do not
normally come from untrusted sources the security implications not
significant.

Fix by limiting PVK length field to 100K and salt to 10K: these should be
more than enough to cover any files encountered in practice.

Issue reported by Guido Vranken.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoGH773: Possible leak on CRYPTO_THREAD_lock_new failure
FdaSilvaYY [Tue, 1 Mar 2016 20:59:48 +0000 (21:59 +0100)]
GH773: Possible leak on CRYPTO_THREAD_lock_new failure

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoGH781: openssl.spec: use secure urls
Viktor Szakats [Thu, 3 Mar 2016 09:56:30 +0000 (10:56 +0100)]
GH781: openssl.spec: use secure urls

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoGH769: Reuse strndup()
Dmitry-Me [Tue, 1 Mar 2016 08:48:15 +0000 (11:48 +0300)]
GH769: Reuse strndup()

Reviewed-by: Matt Caswell <matt@openssl.org>
Signed-off-by: Rich Salz <rsalz@akamai.com>
8 years agoGH355: Implement HKDF
Alessandro Ghedini [Wed, 2 Mar 2016 23:58:27 +0000 (23:58 +0000)]
GH355: Implement HKDF

This patch implements the HMAC-based Extract-and-Expand Key Derivation
Function (HKDF) as defined in RFC 5869.

It is required to implement the QUIC and TLS 1.3 protocols (among others).

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoRemove overzealous echoing
Richard Levitte [Thu, 3 Mar 2016 16:45:14 +0000 (17:45 +0100)]
Remove overzealous echoing

This construct in a Makefile is a bit overzealous:

@echo FOO
@FOO

Cleaned up.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd KDF support to pkeyutl. Update documentation.
Dr. Stephen Henson [Tue, 1 Mar 2016 16:29:47 +0000 (16:29 +0000)]
Add KDF support to pkeyutl. Update documentation.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoClean up curve25519 build
Emilia Kasper [Thu, 3 Mar 2016 15:36:06 +0000 (16:36 +0100)]
Clean up curve25519 build

- Remove OPENSSL_X25519_X86_64 which never worked, because we don't have
  the assembly.
- Also remove OPENSSL_SMALL (which should have been
  OPENSSL_SMALL_FOOTPRINT) which isn't a priority at the moment.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoupdate NEWS
Dr. Stephen Henson [Thu, 3 Mar 2016 13:35:02 +0000 (13:35 +0000)]
update NEWS

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agofix no-ec build
Dr. Stephen Henson [Thu, 3 Mar 2016 13:27:34 +0000 (13:27 +0000)]
fix no-ec build

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRefactor ClientHello extension parsing
Emilia Kasper [Tue, 22 Sep 2015 13:20:26 +0000 (15:20 +0200)]
Refactor ClientHello extension parsing

1) Simplify code with better PACKET methods.

2) Make broken SNI parsing explicit. SNI was intended to be extensible
to new name types but RFC 4366 defined the syntax inextensibly, and
OpenSSL has never parsed SNI in a way that would allow adding a new name
type. RFC 6066 fixed the definition but due to broken implementations
being widespread, it appears impossible to ever extend SNI.

3) Annotate resumption behaviour. OpenSSL doesn't currently handle all
extensions correctly upon resumption. Annotate for further clean-up.

4) Send an alert on ALPN protocol mismatch.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
8 years agomake update
Dr. Stephen Henson [Wed, 2 Mar 2016 21:32:40 +0000 (21:32 +0000)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoadd kdf.h to mkdef.pl
Dr. Stephen Henson [Wed, 2 Mar 2016 21:32:30 +0000 (21:32 +0000)]
add kdf.h to mkdef.pl

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd KDF error codes
Dr. Stephen Henson [Wed, 2 Mar 2016 04:11:02 +0000 (04:11 +0000)]
Add KDF error codes

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agomake update
Dr. Stephen Henson [Tue, 1 Mar 2016 22:15:02 +0000 (22:15 +0000)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoGeneralise KDF test in evp_test.c
Dr. Stephen Henson [Tue, 1 Mar 2016 18:04:42 +0000 (18:04 +0000)]
Generalise KDF test in evp_test.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConvert PRF tests to use Ctrl
Dr. Stephen Henson [Tue, 1 Mar 2016 16:22:25 +0000 (16:22 +0000)]
Convert PRF tests to use Ctrl

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd Ctrl keyword to KDF test in evp_test
Dr. Stephen Henson [Tue, 1 Mar 2016 15:08:18 +0000 (15:08 +0000)]
Add Ctrl keyword to KDF test in evp_test

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd string ctrl operations to TLS1 PRF, update documentation.
Dr. Stephen Henson [Tue, 1 Mar 2016 14:58:33 +0000 (14:58 +0000)]
Add string ctrl operations to TLS1 PRF, update documentation.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoUse utility functions for HMAC and CMAC.
Dr. Stephen Henson [Tue, 1 Mar 2016 14:56:02 +0000 (14:56 +0000)]
Use utility functions for HMAC and CMAC.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoEVP_PKEY_CTX utility functions.
Dr. Stephen Henson [Tue, 1 Mar 2016 14:47:15 +0000 (14:47 +0000)]
EVP_PKEY_CTX utility functions.

Utility functions to pass a string or hex string to EVP_PKEY_CTX_ctrl().

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agomake errors
Dr. Stephen Henson [Tue, 1 Mar 2016 19:16:21 +0000 (19:16 +0000)]
make errors

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoHandle KDF internally.
Dr. Stephen Henson [Mon, 29 Feb 2016 14:12:11 +0000 (14:12 +0000)]
Handle KDF internally.

Handle KDF in ECDH_compute_key instead of requiring each implementation
support it. This modifies the compute_key method: now it allocates and
populates a buffer containing the shared secret.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDocument the changes in config settings
Richard Levitte [Sat, 27 Feb 2016 16:14:44 +0000 (17:14 +0100)]
Document the changes in config settings

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoDon't copy from %target to %config so much, see %config as a complement
Richard Levitte [Wed, 2 Mar 2016 09:57:05 +0000 (10:57 +0100)]
Don't copy from %target to %config so much, see %config as a complement

We copied $target{cflags}, $target{defines} and a few more to %config,
just to add to the entries.  Avoid doing so, and let the build templates
deal with combining the two.

There are a few cases where we still fiddle with %target, but that's
acceptable.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoConfigure - Get rid of the special thread_cflag, replace with thread_scheme
Richard Levitte [Sat, 27 Feb 2016 15:51:34 +0000 (16:51 +0100)]
Configure - Get rid of the special thread_cflag, replace with thread_scheme

The thread_cflag setting filled a double role, as kinda sorta an
indicator of thread scheme, and as cflags.  Some configs also added
lflags and ex_libs for multithreading regardless of if threading would
be enabled or not.

Instead of this, add threading cflags among in the cflag setting,
threading lflags in the lflag setting and so on if and only if threads
are enabled (which they are by default).

Also, for configs where there are no special cflags for threading (the
VMS configs are of that kind), this makes it possible to still clearly
mention what thread scheme is used.

The exact value of thread scheme is currently ignored except when it's
"(unknown)", and thereby only serves as a flag to tell if we know how
to build for multi-threading in a particular config.  Yet, the
currently used values are "(unknown)", "pthreads", "uithreads" (a.k.a
solaris threads) and "winthreads".

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoConfigure - get rid of the special debug_ and release_ settings
Richard Levitte [Wed, 2 Mar 2016 18:13:26 +0000 (19:13 +0100)]
Configure - get rid of the special debug_ and release_ settings

Instead, make the build type ("debug" or "release") available through
$config{build_type} and let the configs themselves figure out what the
usual settings (such as "cflags", "lflags" and so on) should be
accordingly.

The benefit with this is that we can now have debug and release
variants of any setting, not just those Configure supports, and may
also involve other factors (the MSVC flags /MD[d] and /MT[d] involve
both build type and whether threading is enabled or not)

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoMinimize copied config settings
Richard Levitte [Sat, 27 Feb 2016 10:42:13 +0000 (11:42 +0100)]
Minimize copied config settings

$target{lflags} and $target{plib_flag} were copied to %config for no
good reason.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoConfigure - move the addition of the zlib / libz lib to configs
Richard Levitte [Sat, 27 Feb 2016 10:37:33 +0000 (11:37 +0100)]
Configure - move the addition of the zlib / libz lib to configs

Configure had the Unix centric addition of -lz when linking with zlib
is enabled, which doesn't work on other platforms.  Therefore, we move
it to the BASE_unix config template and add corresponding ones in the
other BASE_* config templates.  The Windows one is probably incomplete,
but that doesn't matter for the moment, as mk1mf does it's own thing
anyway.

This required making the %withargs table global, so perl snippets in
the configs can use it.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoConfigure - Rename BASE to DEFAULTS and add a few inheritable BASEs
Richard Levitte [Sat, 27 Feb 2016 10:25:33 +0000 (11:25 +0100)]
Configure - Rename BASE to DEFAULTS and add a few inheritable BASEs

These BASE templates are intended to hold values that are common for
all configuration variants for whole families of configurations.

So far, three "families" are identified: Unix, Windows and VMS, mostly
characterised by the build system they currently use.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoConfigure - Allow CODErefs and ARRAYrefs in configuration setting arrays
Richard Levitte [Sat, 27 Feb 2016 10:08:21 +0000 (11:08 +0100)]
Configure - Allow CODErefs and ARRAYrefs in configuration setting arrays

This provides for more powerful lazy evaluation and buildup of the
setting contents.  For example, something like this becomes possible:

    defines => [ sub { $config{thisorthat} ? "FOO" : () } ]

Any undefined result of such functions (such as 'undef' or the empty
list) will be ignored.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoEnsure Async is deinited properly
Matt Caswell [Wed, 2 Mar 2016 16:52:43 +0000 (16:52 +0000)]
Ensure Async is deinited properly

The global thread local keys were not being deinited properly in async.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConvert ASYNC code to use new Thread API
Matt Caswell [Wed, 2 Mar 2016 16:15:52 +0000 (16:15 +0000)]
Convert ASYNC code to use new Thread API

The async code uses thread local variables. We should convert to using
the new Thread API for doing this.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoProvide getters for default_passwd_cb and userdata
Christian Heimes [Wed, 2 Mar 2016 11:53:40 +0000 (12:53 +0100)]
Provide getters for default_passwd_cb and userdata

This patch provides getters for default_passwd_cb and userdata for SSL
and SSL_CTX. The getter functions are required to port Python's ssl module
to OpenSSL 1.1.0.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agocurve25519: add missing const-qualifier
Emilia Kasper [Wed, 2 Mar 2016 16:23:36 +0000 (17:23 +0100)]
curve25519: add missing const-qualifier

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
8 years agoAdd a shared_target to the VC-common config
Richard Levitte [Wed, 2 Mar 2016 13:10:21 +0000 (14:10 +0100)]
Add a shared_target to the VC-common config

This has no real meaning, except it gives Configure a hint that VC
targets are indeed capable of producing shared objects.

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoConfigure - make the use of environment variables for overrides consistent
Richard Levitte [Wed, 2 Mar 2016 11:22:15 +0000 (12:22 +0100)]
Configure - make the use of environment variables for overrides consistent

We allow some commands to be overriden, but didn't handle that in a
consistent manner.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoMake uplink auxiliary source separate from cpuid source
Richard Levitte [Wed, 2 Mar 2016 08:34:26 +0000 (09:34 +0100)]
Make uplink auxiliary source separate from cpuid source

There are cases, for example when configuring no-asm, that the added
uplink source files got in the way of the cpuid ones.  The best way to
solve this is to separate the two.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoMake k25519Precomp const
Kurt Roeckx [Wed, 2 Mar 2016 12:29:49 +0000 (13:29 +0100)]
Make k25519Precomp const

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
MR: #2184

8 years agopoly1305/asm/poly1305-*.pl: flip horizontal add and reduction.
Andy Polyakov [Sun, 28 Feb 2016 20:48:43 +0000 (21:48 +0100)]
poly1305/asm/poly1305-*.pl: flip horizontal add and reduction.

Formally only 32-bit AVX2 code path needs this, but I choose to
harmonize all vector code paths.

RT#4346
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoConsistently use arm_arch.h constants in armcap assembly code.
David Benjamin [Tue, 23 Feb 2016 16:41:55 +0000 (11:41 -0500)]
Consistently use arm_arch.h constants in armcap assembly code.

Most of the assembly uses constants from arm_arch.h, but a few references to
ARMV7_NEON don't. Consistently use the macros everywhere.

Signed-off-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoremove old unused oneline name field
Dr. Stephen Henson [Tue, 1 Mar 2016 21:04:41 +0000 (21:04 +0000)]
remove old unused oneline name field

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agomake errors
Dr. Stephen Henson [Mon, 29 Feb 2016 13:06:45 +0000 (13:06 +0000)]
make errors

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd default operations to EC_METHOD
Dr. Stephen Henson [Sun, 28 Feb 2016 17:48:48 +0000 (17:48 +0000)]
Add default operations to EC_METHOD

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoReplace overrides.
Dr. Stephen Henson [Sun, 28 Feb 2016 17:47:06 +0000 (17:47 +0000)]
Replace overrides.

Instead of overriding a default operation move default operation to a
separate function which is then explicitly included in any EC_METHOD
that uses it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoCT policy validation
Rob Percival [Mon, 29 Feb 2016 17:33:02 +0000 (17:33 +0000)]
CT policy validation

Specifies a callback that will, in the future, be used by the SSL code to
decide whether to abort a connection on Certificate Transparency grounds.

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix -pkeyopt and fix error check.
Dr. Stephen Henson [Tue, 1 Mar 2016 17:22:51 +0000 (17:22 +0000)]
Fix -pkeyopt and fix error check.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRT4347: Fix GCC unused-value warnings with HOST_c2l()
David Woodhouse [Thu, 25 Feb 2016 23:19:06 +0000 (23:19 +0000)]
RT4347: Fix GCC unused-value warnings with HOST_c2l()

The HOST_c2l() macro assigns the value to the specified variable, but also
evaluates to the same value. Which we ignore, triggering a warning.

To fix this, just cast it to void like we did in commit 08e553644
("Fix some clang warnings.") for a bunch of other instances.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoMove macros for reading/writing integers into ct_locl.h
Rob Percival [Mon, 29 Feb 2016 20:26:36 +0000 (20:26 +0000)]
Move macros for reading/writing integers into ct_locl.h

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAddresses review comments from richsalz
Rob Percival [Mon, 29 Feb 2016 20:25:08 +0000 (20:25 +0000)]
Addresses review comments from richsalz

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFixes potential double free and memory leak in ct_b64.c
Rob Percival [Mon, 22 Feb 2016 14:42:09 +0000 (14:42 +0000)]
Fixes potential double free and memory leak in ct_b64.c

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoVerify SCT signatures
Rob Percival [Thu, 25 Feb 2016 13:33:48 +0000 (13:33 +0000)]
Verify SCT signatures

Tests included in future commit, which adds CT policy validation.

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoUpdates to CHANGES and NEWS for 1.0.2 and 1.0.1 release
Matt Caswell [Tue, 1 Mar 2016 11:12:47 +0000 (11:12 +0000)]
Updates to CHANGES and NEWS for 1.0.2 and 1.0.1 release

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agobn/asm/x86_64-mont5.pl: unify gather procedure in hardly used path
Andy Polyakov [Tue, 26 Jan 2016 15:50:10 +0000 (16:50 +0100)]
bn/asm/x86_64-mont5.pl: unify gather procedure in hardly used path
and reorganize/harmonize post-conditions.

Additional hardening following on from CVE-2016-0702

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agocrypto/bn/x86_64-mont5.pl: constant-time gather procedure.
Andy Polyakov [Mon, 25 Jan 2016 22:41:01 +0000 (23:41 +0100)]
crypto/bn/x86_64-mont5.pl: constant-time gather procedure.

At the same time remove miniscule bias in final subtraction.
Performance penalty varies from platform to platform, and even with
key length. For rsa2048 sign it was observed to be 4% for Sandy
Bridge and 7% on Broadwell.

CVE-2016-0702

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agobn/asm/rsaz-avx2.pl: constant-time gather procedure.
Andy Polyakov [Mon, 25 Jan 2016 22:25:40 +0000 (23:25 +0100)]
bn/asm/rsaz-avx2.pl: constant-time gather procedure.

Performance penalty is 2%.

CVE-2016-0702

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agobn/asm/rsax-x86_64.pl: constant-time gather procedure.
Andy Polyakov [Mon, 25 Jan 2016 22:06:45 +0000 (23:06 +0100)]
bn/asm/rsax-x86_64.pl: constant-time gather procedure.

Performance penalty is 2% on Linux and 5% on Windows.

CVE-2016-0702

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agobn/bn_exp.c: constant-time MOD_EXP_CTIME_COPY_FROM_PREBUF.
Andy Polyakov [Mon, 25 Jan 2016 19:38:38 +0000 (20:38 +0100)]
bn/bn_exp.c: constant-time MOD_EXP_CTIME_COPY_FROM_PREBUF.

Performance penalty varies from platform to platform, and even
key length. For rsa2048 sign it was observed to reach almost 10%.

CVE-2016-0702

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoUnified - have configdata.pm depend on a few more things
Richard Levitte [Sun, 28 Feb 2016 00:13:17 +0000 (01:13 +0100)]
Unified - have configdata.pm depend on a few more things

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoGH762: Reuse strdup()
Dmitry-Me [Mon, 29 Feb 2016 08:55:13 +0000 (11:55 +0300)]
GH762: Reuse strdup()

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoGH764: s_server: trace option fall through
J Mohan Rao Arisankala [Mon, 29 Feb 2016 16:53:18 +0000 (22:23 +0530)]
GH764: s_server: trace option fall through

in s_server cmd:
specifying -trace option, falls through and turn-on security_debug

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoGH758: e_dasync_err.h: honor no-filenames option
Viktor Szakats [Sun, 28 Feb 2016 20:35:22 +0000 (21:35 +0100)]
GH758: e_dasync_err.h: honor no-filenames option

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix BN_hex2bn/BN_dec2bn NULL ptr/heap corruption
Matt Caswell [Mon, 22 Feb 2016 10:27:18 +0000 (10:27 +0000)]
Fix BN_hex2bn/BN_dec2bn NULL ptr/heap corruption

In the BN_hex2bn function the number of hex digits is calculated using
an int value |i|. Later |bn_expand| is called with a value of |i * 4|.
For large values of |i| this can result in |bn_expand| not allocating any
memory because |i * 4| is negative. This leaves ret->d as NULL leading
to a subsequent NULL ptr deref. For very large values of |i|, the
calculation |i * 4| could be a positive value smaller than |i|. In this
case memory is allocated to ret->d, but it is insufficiently sized
leading to heap corruption. A similar issue exists in BN_dec2bn.

This could have security consequences if BN_hex2bn/BN_dec2bn is ever
called by user applications with very large untrusted hex/dec data. This is
anticipated to be a rare occurrence.

All OpenSSL internal usage of this function uses data that is not expected
to be untrusted, e.g. config file data or application command line
arguments. If user developed applications generate config file data based
on untrusted data then it is possible that this could also lead to security
consequences. This is also anticipated to be a rare.

Issue reported by Guido Vranken.

CVE-2016-0797

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoremove unused variables
Dr. Stephen Henson [Mon, 29 Feb 2016 14:33:44 +0000 (14:33 +0000)]
remove unused variables

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoFix use before init warnings in asynctest
Matt Caswell [Mon, 29 Feb 2016 13:07:28 +0000 (13:07 +0000)]
Fix use before init warnings in asynctest

If the tests fail early before an ASYNC_WAIT_CTX is created then there
can be a use before init problem in asynctest.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoClarify ASYNC_WAIT_CTX_clear_fd() docs
Matt Caswell [Mon, 29 Feb 2016 12:15:27 +0000 (12:15 +0000)]
Clarify ASYNC_WAIT_CTX_clear_fd() docs

Clarify that the "cleanup" routing does not get called if you invoke
ASYNC_WAIT_CTX_clear_fd() directly.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoRefactor the async wait fd logic
Matt Caswell [Mon, 25 Jan 2016 15:28:57 +0000 (15:28 +0000)]
Refactor the async wait fd logic

Implementation experience has shown that the original plan for async wait
fds was too simplistic. Originally the async logic created a pipe internally
and user/engine code could then get access to it via API calls. It is more
flexible if the engine is able to create its own fd and provide it to the
async code.

Another issue is that there can be a lot of churn in the fd value within
the context of (say) a single SSL connection leading to continually adding
and removing fds from (say) epoll. It is better if we can provide some
stability of the fd value across a whole SSL connection. This is
problematic because an engine has no concept of an SSL connection.

This commit refactors things to introduce an ASYNC_WAIT_CTX which acts as a
proxy for an SSL connection down at the engine layer.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoWorkaround for VisualStudio 2015 bug
Matt Caswell [Tue, 23 Feb 2016 15:27:05 +0000 (15:27 +0000)]
Workaround for VisualStudio 2015 bug

VisualStudio 2015 has a bug where an internal compiler error was occurring.
By reordering the DEFINE_STACK_OF declarations for SSL_CIPHER and SSL_COMP
until after the ssl3.h include everything seems ok again.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoAdd forgotten change of check of disabled-dynamic-engine
Richard Levitte [Sun, 28 Feb 2016 16:03:26 +0000 (17:03 +0100)]
Add forgotten change of check of disabled-dynamic-engine

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd CHANGES entry for X25519
Dr. Stephen Henson [Sun, 28 Feb 2016 22:43:30 +0000 (22:43 +0000)]
Add CHANGES entry for X25519

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agomake update
Dr. Stephen Henson [Sun, 28 Feb 2016 18:00:46 +0000 (18:00 +0000)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoRemove unused code.
Dr. Stephen Henson [Sun, 21 Feb 2016 16:22:43 +0000 (16:22 +0000)]
Remove unused code.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoChange BORINGSSL defines to OPENSSL
Dr. Stephen Henson [Sat, 20 Feb 2016 14:24:06 +0000 (14:24 +0000)]
Change BORINGSSL defines to OPENSSL

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>