huangqinjin [Sun, 19 Jun 2016 16:17:51 +0000 (00:17 +0800)]
doc and comment fixes
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1233)
Kurt Cancemi [Sat, 28 May 2016 11:05:15 +0000 (07:05 -0400)]
crypto/evp/e_aes_cbc_hmac_sha256.c: Remove spurious memset
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1231)
Jiri Horky [Sun, 12 Jun 2016 18:02:20 +0000 (14:02 -0400)]
RT3136: Remove space after issuer/subject
Reviewed-by: Richard Levitte <levitte@openssl.org>
Emilia Kasper [Thu, 9 Jun 2016 21:09:48 +0000 (23:09 +0200)]
Make DSA_SIG and ECDSA_SIG getters const.
Reorder arguments to follow convention.
Also allow r/s to be NULL in DSA_SIG_get0, similarly to ECDSA_SIG_get0.
This complements GH1193 which adds non-const setters.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Mon, 20 Jun 2016 11:22:46 +0000 (13:22 +0200)]
rand/randfile.c: remove obsolete commentary.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Rob Percival [Tue, 7 Jun 2016 16:56:02 +0000 (17:56 +0100)]
Tests should check validation status directly
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Rob Percival [Tue, 7 Jun 2016 16:38:14 +0000 (17:38 +0100)]
Test SCT lists
This encompasses what was previously tested.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Andy Polyakov [Sat, 18 Jun 2016 13:49:57 +0000 (15:49 +0200)]
aes/asm/bsaes-armv7.pl: omit redundant stores in XTS subroutines.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Sat, 18 Jun 2016 13:37:25 +0000 (15:37 +0200)]
aes/asm/bsaes-armv7.pl: fix XTS decrypt test failure.
RT#4578
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Mon, 20 Jun 2016 06:11:50 +0000 (08:11 +0200)]
Change the RAND_file_name documentation accordingly
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Richard Levitte [Mon, 20 Jun 2016 05:56:32 +0000 (07:56 +0200)]
Change default directory for the .rnd file on Windows and VMS
The previous change for Windows wasn't quite right. Corrected to use
%HOME%, %USERPROFILE% and %SYSTEMPROFILE%, in that order.
Also adding the default home for VMS, SYS$LOGIN:
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
FdaSilvaYY [Fri, 10 Jun 2016 20:37:32 +0000 (22:37 +0200)]
Add a comment after some #endif at end of apps source code.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)
FdaSilvaYY [Sat, 4 Jun 2016 22:35:42 +0000 (00:35 +0200)]
Useless header include of openssl/rand.h
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)
FdaSilvaYY [Fri, 25 Mar 2016 19:04:12 +0000 (20:04 +0100)]
Useless includes
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)
FdaSilvaYY [Fri, 3 Jun 2016 22:14:52 +0000 (00:14 +0200)]
Missing NULL check on OBJ_dup result in x509_name_canon
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)
FdaSilvaYY [Tue, 10 May 2016 20:20:23 +0000 (22:20 +0200)]
Fix an MSVC warning.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)
Matt Caswell [Wed, 15 Jun 2016 15:25:21 +0000 (16:25 +0100)]
Use a STACK_OF(OPENSSL_CSTRING) for const char * stacks
Better than losing the const qualifier.
RT4378
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Wed, 15 Jun 2016 15:06:44 +0000 (16:06 +0100)]
OpenBSD has intypes.h
Update e_os2.h so that inttypes.h is included.
RT4378
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Wed, 15 Jun 2016 14:59:46 +0000 (15:59 +0100)]
Replace 4 casts with 1
Changing the type of the |str| variable in asn1pars enables us to remove
4 casts with just 1. This silences an OpenBSD warning along the way.
RT4378
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Wed, 15 Jun 2016 14:32:38 +0000 (15:32 +0100)]
Improve const correctness for stacks of EVP_MD
EVP_MDs are always const, so stacks of them should be too. This silences
a warning about type punning on OpenBSD.
RT4378
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Wed, 15 Jun 2016 14:17:50 +0000 (15:17 +0100)]
constify SRP
Add const qualifiers to lots of SRP stuff. This started out as an effort
to silence some "type-punning" warnings on OpenBSD...but the fix was to
have proper const correctness in SRP.
RT4378
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Wed, 15 Jun 2016 10:50:09 +0000 (11:50 +0100)]
Avoid type punning warnings in b_addr.c
RT4378
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Wed, 15 Jun 2016 15:14:30 +0000 (11:14 -0400)]
Change default directory for storing the .rnd file on Windows
Previously we would try %RANDFILE%, then %HOME% and finally "C:".
Unfortunately this often ends up being "C:" which the user may not
have write permission for.
Now we try %RANDFILE% first, and then the same set of environment vars
as GetTempFile() uses, i.e. %TMP%, then %TEMP%, %USERPROFILE% and
%SYSTEMROOT%. If all else fails we fall back to %HOME% and only then "C:".
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Thu, 16 Jun 2016 22:23:43 +0000 (00:23 +0200)]
Harmonise the different build files
- User targets are now the same and generally do the same things
- configdata.pm depends on exactly the same files on all platforms
- VMS production of shared libraries is simplified
- VMS automatic dependency files get the extension .D rather than .MMS
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Thu, 16 Jun 2016 18:49:37 +0000 (14:49 -0400)]
Fix GCC build; make update; fix number re-use
Reviewed-by: Richard Levitte <levitte@openssl.org>
FdaSilvaYY [Tue, 14 Jun 2016 21:02:16 +0000 (23:02 +0200)]
Spelling fixes
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1219)
Matt Caswell [Thu, 16 Jun 2016 10:45:24 +0000 (11:45 +0100)]
no-ripemd is an alias for no-rmd160
mkdef.pl was failing to understand no-ripemd. This is a deprecated option
which should act as an alias for no-rmd160.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Rich Salz [Thu, 16 Jun 2016 16:58:57 +0000 (12:58 -0400)]
Fix build break.
Aggregate local initializers are rarely portable (:
Reviewed-by: Richard Levitte <levitte@openssl.org>
Nathaniel McCallum [Wed, 15 Jun 2016 18:02:04 +0000 (14:02 -0400)]
Add EVP_PKEY_get0_hmac() function
Before the addition of this function, it was impossible to read the
symmetric key from an EVP_PKEY_HMAC type EVP_PKEY.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1217)
Matt Caswell [Thu, 16 Jun 2016 14:59:42 +0000 (15:59 +0100)]
Revert "RT4526: Call TerminateProcess, not ExitProcess"
This reverts commit
9c1a9ccf65d0ea1912675d3a622fa8e51b524b9e.
TerminateProcess is asynchronous, so the code as written in the above
commit is not correct. It is also probably not needed in the speed
case. Reverting in order to figure out the correct solution.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Tue, 14 Jun 2016 13:35:26 +0000 (14:35 +0100)]
Skip the TLSProxy tests if environmental problems are an issue
On some platforms we can't startup the TLSProxy due to environmental
problems (e.g. network set up on the build machine). These aren't OpenSSL
problems so we shouldn't treat them as test failures. Just visibly
indicate that we are skipping the test.
We only skip the first time we attempt to start up the proxy. If that works
then everything else should do...if not we should probably investigate and
so report as a failure.
This also removes test_networking...there is a danger that this turns into
a test of user's environmental set up rather than OpenSSL.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Thu, 16 Jun 2016 09:07:32 +0000 (10:07 +0100)]
Fix the build and tests following constification of DH, DSA, RSA
Misc fixes following the constification of the DH, DSA and RSA
getters.
Reviewed-by: Stephen Henson <steve@openssl.org>
Matt Caswell [Mon, 25 Apr 2016 12:56:44 +0000 (13:56 +0100)]
Change the return type of EVP_EncodeUpdate
Previously EVP_EncodeUpdate returned a void. However there are a couple
of error conditions that can occur. Therefore the return type has been
changed to an int, with 0 indicating error and 1 indicating success.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Tue, 14 Jun 2016 13:49:05 +0000 (15:49 +0200)]
Deal with the consequences of constifying getters
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Richard Levitte [Tue, 14 Jun 2016 13:48:16 +0000 (15:48 +0200)]
Constify the parameter getters for RSA, DSA and DH
Including documentation changes
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Rich Salz [Tue, 14 Jun 2016 20:19:37 +0000 (16:19 -0400)]
RT4526: Call TerminateProcess, not ExitProcess
Reviewed-by: Richard Levitte <levitte@openssl.org>
FdaSilvaYY [Sun, 12 Jun 2016 16:20:40 +0000 (18:20 +0200)]
Constify input buffers of some X509V3 and X509_PURPOSE -related methods
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)
FdaSilvaYY [Tue, 7 Jun 2016 22:05:05 +0000 (00:05 +0200)]
Constify X509_TRUST_add method.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)
FdaSilvaYY [Sun, 12 Jun 2016 09:13:57 +0000 (11:13 +0200)]
Constify asn1/asn_mime.c
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)
FdaSilvaYY [Sun, 12 Jun 2016 09:17:50 +0000 (11:17 +0200)]
Constify some input buffers in asn1
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)
FdaSilvaYY [Sun, 12 Jun 2016 09:18:13 +0000 (11:18 +0200)]
Constify CMS_get0_type input
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)
FdaSilvaYY [Tue, 7 Jun 2016 22:03:08 +0000 (00:03 +0200)]
Constify UI
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)
FdaSilvaYY [Tue, 7 Jun 2016 22:01:33 +0000 (00:01 +0200)]
Constify PKCS12_create, PKCS12_add_key, PKCS12_add_safe.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)
FdaSilvaYY [Tue, 7 Jun 2016 21:29:28 +0000 (23:29 +0200)]
Constify some conf_mod.c internal methods
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)
Richard Levitte [Tue, 14 Jun 2016 23:31:14 +0000 (01:31 +0200)]
Change (!seqtt) to (seqtt == NULL)
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Richard Levitte [Tue, 14 Jun 2016 21:54:56 +0000 (23:54 +0200)]
Always check that the value returned by asn1_do_adb() is non-NULL
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Andy Polyakov [Sun, 12 Jun 2016 14:21:37 +0000 (16:21 +0200)]
perlasm/x86*.pl: add endbranch instruction.
For further information see "Control-flow Enforcement Technology
Preview" by Intel.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Mon, 23 May 2016 18:34:11 +0000 (20:34 +0200)]
modes/asm/ghashp8-ppc.pl: improve performance by 2.7x.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Sat, 4 Jun 2016 17:24:57 +0000 (19:24 +0200)]
aes/asm/aesp8-ppc.pl: implement "tweak chaining".
This is useful in Linux kernel context, in cases data happens
to be fragmented and processing can take multiple calls.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Mon, 30 May 2016 21:58:40 +0000 (23:58 +0200)]
test/evptests.txt: add more XTS tests.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Mon, 30 May 2016 19:33:52 +0000 (21:33 +0200)]
evp/e_aes.c: wire hardware-assisted XTS subroutines.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Mon, 30 May 2016 19:33:29 +0000 (21:33 +0200)]
aes/asm/aesp8-ppc.pl: add XTS subroutines.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Tue, 14 Jun 2016 18:00:22 +0000 (14:00 -0400)]
(Temporarily) don't download clang package
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Andy Polyakov [Wed, 8 Jun 2016 13:55:35 +0000 (15:55 +0200)]
perlasm/x86_64-xlate.pl: add commentary.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Wed, 8 Jun 2016 13:37:46 +0000 (15:37 +0200)]
perlasm/x86_64-xlate.pl: refactor argument parsing loop.
Reviewed-by: Rich Salz <rsalz@openssl.org>
David Benjamin [Sun, 20 Mar 2016 18:47:36 +0000 (14:47 -0400)]
Make x86_64-xlate.pl 'use strict' clean.
use strict would have caught a number of historical bugs in the perlasm
code, some in the repository and some found during review. It even found
a fresh masm-only bug (see below).
This required some tweaks. The "single instance is enough" globals got
switched to proper blessed objects rather than relying on symbolic refs.
A few types need $opcode passed in as a result.
The $$line thing is a little bit of a nuisance. There may be a clearer
pattern to use instead.
This even a bug in the masm code.
9b634c9b37afc482a8dc8868e367bdd1b650e507 added logic to make labels
global or function-global based on whether something starts with a $,
seemingly intended to capture the $decor setting of '$L$'. However, it
references $ret which is not defined in label::out. label::out is always
called after label::re, so $ret was always the label itself, so the line
always ran.
I've removed the regular expression so as not to change the behavior of
the script. A number of the assembly files now routinely jump across
functions, so this seems to be the desired behavior now.
GH#1165
Signed-off-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Tue, 14 Jun 2016 20:03:08 +0000 (22:03 +0200)]
VMS: use BLDDIR rather than BUILDDIR in descrip.mms.tmpl
Just like in the other build file templates
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Tue, 14 Jun 2016 19:39:13 +0000 (21:39 +0200)]
Add a developer target 'build_generated' to rebuild mandatory headers
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Mon, 13 Jun 2016 20:02:11 +0000 (22:02 +0200)]
Build file templates: make sure to depend on generated header files
As well as properly generating those that are made from .in files.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Mon, 13 Jun 2016 20:01:08 +0000 (22:01 +0200)]
Move the Configure generated header files to the top build.info
This turns these headers into build file generated ones.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Mon, 13 Jun 2016 19:57:51 +0000 (21:57 +0200)]
Configure: Make it possible to generate mandatory header files
'DEPEND[]=file.h' becomes a special way to say that 'file.h' must be
generated before anything else is built. It's likely that a number
of source files depend on these header files, this provides a simple
way to make sure they are always generated even it the dependency data
hasn't been added to the build file yet.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Tue, 14 Jun 2016 16:44:22 +0000 (17:44 +0100)]
Fix omitted selector handling.
The selector field could be omitted because it has a DEFAULT value.
In this case *sfld == NULL (sfld can never be NULL). This was not
noticed because this was never used in existing ASN.1 modules.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Kurt Roeckx [Sun, 12 Jun 2016 11:27:56 +0000 (13:27 +0200)]
Update fuzz corpora
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #2949
Kurt Roeckx [Sun, 5 Jun 2016 21:34:57 +0000 (23:34 +0200)]
Initialize the session_id
ssl_session_hash() always looks at the first 4 bytes, regardless of the length.
A client can send a session id that's shorter, and the callback could also
generate one that's shorter. So we make sure that the rest of the buffer is
initliazed to 0 so that we always calculate the same hash.
Found by tis-interpreter, also previously reported as RT #2871
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #2911
Matt Caswell [Tue, 14 Jun 2016 15:54:08 +0000 (16:54 +0100)]
Remove an unused variable assignment
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Mon, 13 Jun 2016 01:49:40 +0000 (21:49 -0400)]
RT4562: Fix misleading doc on OPENSSL_config
Also changed the code to use "appname" not "filename"
Reviewed-by: Matt Caswell <matt@openssl.org>
Matt Caswell [Tue, 14 Jun 2016 10:45:34 +0000 (11:45 +0100)]
Free memory on an error path
The function a2i_ASN1_STRING can encounter an error after already
allocating a buffer. It wasn't always freeing that buffer on error.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 14 Jun 2016 10:27:10 +0000 (11:27 +0100)]
Avoid a double-free in crl2pl7
The variable |crtflst| could get double freed in an error path.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 14 Jun 2016 10:21:44 +0000 (11:21 +0100)]
Add missing break statement
The -psk option processing was falling through to the -srp option
processing in the ciphers app.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 14 Jun 2016 09:41:00 +0000 (10:41 +0100)]
Fix comment
Fix a comment following commit
c2c49969e23605.
RT2388
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Mon, 13 Jun 2016 22:30:27 +0000 (23:30 +0100)]
make update
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Mon, 13 Jun 2016 22:44:29 +0000 (00:44 +0200)]
Shorten some symbol names
VMS C doesn't allow symbols longer than 31 characters. We do the
automatic shortening with the library files, but not otherwise (to
make sure to work the VMS C magic).
For consistency, I shortened other similar symbols in the same manner.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Mon, 13 Jun 2016 13:51:12 +0000 (09:51 -0400)]
GH1141: Different fix, preferred by Richard.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Peter Mosmans [Mon, 13 Jun 2016 19:04:33 +0000 (15:04 -0400)]
RT3454: Re-enable nistp-64_gcc_128 on windows
Reviewed-by: Andy Polyakov <appro@openssl.org>
Rich Salz [Mon, 13 Jun 2016 18:59:57 +0000 (14:59 -0400)]
Missed some copyright merge
Reviewed-by: Tim Hudson <tjh@openssl.org>
TJ Saunders [Fri, 10 Jun 2016 07:36:45 +0000 (00:36 -0700)]
Ensure that NULL r and s parameters cannot be set on DSA_SIG/ECDSA_SIGs.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1193)
TJ Saunders [Thu, 9 Jun 2016 21:53:23 +0000 (14:53 -0700)]
Forgot to update the setter argument ordering in the public headers.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1193)
TJ Saunders [Thu, 9 Jun 2016 21:52:04 +0000 (14:52 -0700)]
Reorder the setter arguments to more consistently match that of other APIs,
per review comments.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1193)
TJ Saunders [Wed, 8 Jun 2016 20:54:22 +0000 (13:54 -0700)]
Implement DSA_SIG_set0() and ECDSA_SIG_set0(), for setting signature values.
SSH2 implementations which use DSA_do_verify() and ECDSA_do_verify() are given
the R and S values, and the data to be signed, by the client. Thus in order
to validate these signatures, SSH2 implementations will digest and sign
the data -- and then pass in properly provisioned DSA_SIG and ECDSA_SIG objects.
Unfortunately, the existing OpenSSL-1.1.0 APIs do not allow for directly setting
those R and S values in these objects, which makes using OpenSSL for such
SSH2 implementations much more difficult.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1193)
Matt Caswell [Fri, 10 Jun 2016 15:51:39 +0000 (16:51 +0100)]
Add some missing return value checks
Some misc return value checks
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Mon, 13 Jun 2016 10:55:29 +0000 (11:55 +0100)]
Update sslapitest to use the test framework
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Thu, 9 Jun 2016 12:46:34 +0000 (13:46 +0100)]
Update the SSL_set_session() documentation
Update the SSL_set_session() documentation to reflect the fact that old
bad sessions are removed from the cache if necessary.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Thu, 9 Jun 2016 12:33:27 +0000 (13:33 +0100)]
Add some session API tests
This commit adds some session API tests, and in particular tests the
modified behaviour of SSL_set_session() introduced in the last commit. To
do this I have factored out some common code from the asynciotest into a
new ssltestlib.c file. I've also renamed getsettest to sslapitest as this
more closely matches what it now is!
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Thu, 9 Jun 2016 12:24:54 +0000 (13:24 +0100)]
Ensure SSL_set_session clears the old session from cache if it is bad
SSL_clear() and SSL_free() will remove a session from the cache if it is
considered "bad". However SSL_set_session() does not do this for the session
it is replacing.
SSL_clear() clears an SSL object ready for reuse. It does not clear the
session though. This means that:
SSL_clear(s)
SSL_set_session(s, sess);
and
SSL_set_session(s, sess);
SSL_clear(s);
do not do the same thing, although logically you would expect that they
would.
The failure of SSL_set_session() to remove bad sessions from the cache
should be considered a bug, so this commit fixes it.
RT#597
Reviewed-by: Rich Salz <rsalz@openssl.org>
Emilia Kasper [Mon, 13 Jun 2016 15:46:12 +0000 (17:46 +0200)]
SSL test: only write out server2 when testing SNI
The SNI tests introduced a redundant "server2" section into every test
configuration. Copy this automatically from "server" unless testing SNI,
to reduce noise in the generated confs.
Also remove duplicate SSL_TEST_CTX_create (merge conflict error).
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Wed, 1 Jun 2016 22:15:12 +0000 (23:15 +0100)]
Handle inability to create AFALG socket
Some Linux platforms have a suitably recent kernel to support AFALG, but
apparently you still can't actually create an afalg socket. This extends
the afalg_chk_platform() function to additionally check whether we can
create an AFALG socket. We also amend the afalgtest to not report a
failure to load the engine as a test failure. A failure to load is almost
certainly due to platform environmental issues, and not an OpenSSL problem.
RT 4434
Reviewed-by: Andy Polyakov <appro@openssl.org>
Emilia Kasper [Fri, 3 Jun 2016 15:49:04 +0000 (17:49 +0200)]
Port DTLS version negotiation tests
Reviewed-by: Rich Salz <rsalz@openssl.org>
Emilia Kasper [Thu, 9 Jun 2016 22:39:22 +0000 (00:39 +0200)]
Clean up following new SNI tests
- Only send SNI in SNI tests. This allows us to test handshakes without
the SNI extension as well.
- Move all handshake-specific machinery to handshake_helper.c
- Use enum types to represent the enum everywhere
(Resorting to plain ints can end in sign mismatch when the enum is
represented by an unsigned type.)
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Mon, 13 Jun 2016 02:21:54 +0000 (22:21 -0400)]
RT3809: basicConstraints is critical
This is really a security bugfix, not enhancement any more.
Everyone knows critical extensions.
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Andy Polyakov [Sun, 12 Jun 2016 10:34:46 +0000 (12:34 +0200)]
bn/bn_add.c: favour counted loops over ifs and breaks.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Sun, 12 Jun 2016 10:31:40 +0000 (12:31 +0200)]
doc/crypto/OPENSSL_ia32cap.pod update.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Wed, 8 Jun 2016 18:01:42 +0000 (19:01 +0100)]
Don't skip leading zeroes in PSK keys.
Don't use BN_hex2bn() for PSK key conversion as the conversion to
BN and back removes leading zeroes, use OPENSSL_hexstr2buf() instead.
RT#4554
Reviewed-by: Matt Caswell <matt@openssl.org>
John Denker [Fri, 10 Jun 2016 18:46:07 +0000 (14:46 -0400)]
RT2759: Don't read TTY when already at EOF.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Rich Salz [Fri, 10 Jun 2016 15:40:32 +0000 (11:40 -0400)]
Avoid memory leaks if options repeated.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Phillip Hellewell [Sun, 12 Jun 2016 00:04:21 +0000 (20:04 -0400)]
RT3053: Check for NULL before dereferencing
Reviewed-by: Tim Hudson <tjh@openssl.org>
TJ Saunders [Fri, 10 Jun 2016 20:10:51 +0000 (13:10 -0700)]
Ensure that the EVP_MD_meth_new docs properly match the declared functions;
it looks like these names have shifted a little over time.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1203)
Kurt Roeckx [Mon, 6 Jun 2016 20:50:25 +0000 (22:50 +0200)]
Avoid creating illegal pointers
Found by tis-interpreter
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1179
Kurt Roeckx [Sun, 5 Jun 2016 18:51:04 +0000 (20:51 +0200)]
include stdlib for malloc() and free()
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1174
Kurt Roeckx [Sun, 5 Jun 2016 18:48:08 +0000 (20:48 +0200)]
Don't compare a just free()d pointer
Found by tis-interpreter
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1173
Kurt Roeckx [Sun, 5 Jun 2016 12:13:33 +0000 (14:13 +0200)]
Specify array sizes
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1172