Andy Polyakov [Fri, 10 Feb 2017 09:59:45 +0000 (10:59 +0100)]
perlasm/x86_64-xlate.pl: recognize even offset(%reg) in cfa_expression.
This is handy when "offset(%reg)" is a perl variable.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Fri, 10 Feb 2017 11:20:18 +0000 (12:20 +0100)]
ec/asm/ecp_nistz256-x86_64.pl: add CFI directives.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Fri, 10 Feb 2017 10:43:42 +0000 (11:43 +0100)]
ec/asm/ecp_nistz256-x86_64.pl: fix typo-bug in Win64 SE handler.
Thanks to Jun Sun for spotting this.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andrea Grandi [Fri, 10 Feb 2017 10:23:21 +0000 (10:23 +0000)]
Further improvements to ASYNC_WAIT_CTX_clear_fd
Remove call to cleanup function
Use only one loop to find previous element
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2581)
Andrea Grandi [Fri, 3 Feb 2017 05:46:17 +0000 (05:46 +0000)]
Remove fd from the list when the engine clears the wait context before pause
This fixes the num of fds added/removed returned by ASYNC_WAIT_CTX_get_changed_fds
Previously, the numbers were not consistent with the fds actually written in
the buffers since the fds that have been both added and removed are explicitly
ignored in the loop.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2581)
Andrea Grandi [Thu, 26 Jan 2017 03:17:54 +0000 (03:17 +0000)]
Add test to show wrong behavior of ASYNC_WAIT_CTX
This happens when a fd is added and then immediately removed from the
ASYNC_WAIT_CTX before pausing the job.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2581)
Andy Polyakov [Sat, 11 Feb 2017 21:31:47 +0000 (22:31 +0100)]
{md5,rc4}/asm/*-x86_64.pl: add CFI annotations.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Sat, 11 Feb 2017 21:08:12 +0000 (22:08 +0100)]
modes/asm/*-x86_64.pl: add CFI annotations.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Darren Tucker [Sun, 12 Feb 2017 23:36:29 +0000 (10:36 +1100)]
DES keys are not 7 days long.
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2604)
Richard Levitte [Fri, 10 Feb 2017 21:50:24 +0000 (22:50 +0100)]
test_rehash does nothing, have it do something
test/recipes/40-test_rehash.t uses test files from certs/demo, which
doesn't exist any longer. Have it use PEM files from test/ instead.
Because rehash wants only one certificate or CRL per file, we must
also filter those PEM files to produce test files with a single object
each.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2594)
Adam Langley [Fri, 10 Feb 2017 18:19:06 +0000 (10:19 -0800)]
sha/asm/sha1-x86_64.pl: add CFI annotations.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2590)
Dr. Stephen Henson [Fri, 10 Feb 2017 04:23:53 +0000 (04:23 +0000)]
Replace SSL_PKEY_RSA_ENC, SSL_PKEY_RSA_SIGN
The original intent of SSL_PKEY_RSA_SIGN and SSL_PKEY_RSA_ENC was to
support two different keys for RSA signing and decrypt. However this
was never implemented and we only ever set one key and the other was
always NULL. Replace with single SSL_PKEY_RSA type.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2587)
Dr. Stephen Henson [Fri, 10 Feb 2017 04:22:18 +0000 (04:22 +0000)]
Check index >= 0 as 0 is a valid index.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2587)
Andy Polyakov [Fri, 10 Feb 2017 10:27:54 +0000 (11:27 +0100)]
perlasm/x86_64-xlate.pl: fix pair of typo-bugs in the new cfi_directive.
.cfi_{start|end}proc and .cfi_def_cfa were not tracked.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2585)
Adam Langley [Thu, 9 Feb 2017 22:37:01 +0000 (14:37 -0800)]
perlasm/x86_64-xlate.pl: typo fix in comment.
CLA: trivial
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2584)
Adam Langley [Thu, 9 Feb 2017 20:02:08 +0000 (12:02 -0800)]
Fix copy-pasteism in CFI directives.
I don't think this actually affects anything since the cfi_restore
directives aren't strictly needed anyway. (The old values are still in
memory so either will do.)
CLA: trivial
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2582)
Lukasz Pawelczyk [Thu, 17 Nov 2016 09:31:39 +0000 (10:31 +0100)]
Restore EVP_CIPH_FLAG_LENGTH_BITS working properly
EVP_CIPH_FLAG_LENGTH_BITS flag for CFB1 has been broken with the
introduction of the is_partially_overlapping() check that did not take
it into the account (treating number of bits passed as bytes). This
remedies that and allows this flag to work as intended.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1942)
Cristian Stoica [Tue, 2 Aug 2016 08:41:30 +0000 (11:41 +0300)]
speed.c: simplify aggregation of ecdh --multi results
CLA: trivial
Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1377)
Cristian Stoica [Tue, 2 Aug 2016 08:38:45 +0000 (11:38 +0300)]
speed.c: simplify aggregation of ecdsa --multi results
CLA: trivial
Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1377)
Cristian Stoica [Tue, 2 Aug 2016 08:22:27 +0000 (11:22 +0300)]
speed.c: simplify aggregation of dsa --multi results
CLA: trivial
Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1377)
Cristian Stoica [Tue, 2 Aug 2016 08:13:00 +0000 (11:13 +0300)]
speed.c: simplify aggregation of rsa --multi results
CLA: trivial
Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1377)
David Benjamin [Thu, 9 Feb 2017 20:13:13 +0000 (15:13 -0500)]
Don't read uninitialised data for short session IDs.
While it's always safe to read |SSL_MAX_SSL_SESSION_ID_LENGTH| bytes
from an |SSL_SESSION|'s |session_id| array, the hash function would do
so with without considering if all those bytes had been written to.
This change checks |session_id_length| before possibly reading
uninitialised memory. Since the result of the hash function was already
attacker controlled, and since a lookup of a short session ID will
always fail, it doesn't appear that this is anything more than a clean
up.
In particular, |ssl_get_prev_session| uses a stack-allocated placeholder
|SSL_SESSION| as a lookup key, so the |session_id| array may be
uninitialised.
This was originally found with libFuzzer and MSan in
https://boringssl.googlesource.com/boringssl/+/
e976e4349d693b4bbb97e1694f45be5a1b22c8c7,
then by Robert Swiecki with honggfuzz and MSan here. Thanks to both.
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2583)
Andy Polyakov [Wed, 8 Feb 2017 09:12:28 +0000 (10:12 +0100)]
bn/asm/x86_64*: add DWARF CFI directives.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Mon, 6 Feb 2017 07:58:34 +0000 (08:58 +0100)]
perlasm/x86_64-xlate.pl: recognize DWARF CFI directives.
CFI directives annotate instructions that are significant for stack
unwinding procedure. In addition to directives recognized by GNU
assembler this module implements three synthetic ones:
- .cfi_push annotates push instructions in prologue and translates to
.cfi_adjust_cfa_offset (if needed) and .cfi_offset;
- .cfi_pop annotates pop instructions in epilogue and translates to
.cfi_adjust_cfs_offset (if needed) and .cfi_restore;
- .cfi_cfa_expression encodes DW_CFA_def_cfa_expression and passes it
to .cfi_escape as byte vector;
CFA expression syntax is made up mix of DWARF operator suffixes [subset
of] and references to registers with optional bias. Following example
describes offloaded original stack pointer at specific offset from
current stack pointer:
.cfi_cfa_expression %rsp+40,deref,+8
Final +8 has everything to do with the fact that CFA, Canonical Frame
Address, is reference to top of caller's stack, and on x86_64 call to
subroutine pushes 8-byte return address.
Triggered by request from Adam Langley.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Sat, 4 Feb 2017 12:26:15 +0000 (13:26 +0100)]
perlasm/x86_64-xlate.pl: remove obsolete .picmeup synthetic directive.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Sat, 4 Feb 2017 12:24:42 +0000 (13:24 +0100)]
perlasm/x86_64-xlate.pl: minor readability updates.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Wed, 8 Feb 2017 09:09:21 +0000 (10:09 +0100)]
bn/asm/rsaz-avx2.pl: refine Win64 SE handler.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Tue, 7 Feb 2017 14:17:57 +0000 (14:17 +0000)]
Fix a typo in the X509_get0_subject_key_id() documentation
Fixes a copy&paste error
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2568)
Richard Levitte [Thu, 9 Feb 2017 09:30:44 +0000 (10:30 +0100)]
Add needed module in 25-test_sid.t
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2579)
Peter Wu [Thu, 2 Feb 2017 11:11:10 +0000 (12:11 +0100)]
SSL_get_shared_sigalgs: handle negative idx parameter
When idx is negative (as is the case with do_print_sigalgs in
apps/s_cb.c), AddressSanitizer complains about a buffer overflow (read).
Even if the pointer is not dereferenced, this is undefined behavior.
Change the user not to use "-1" as index since the function is
documented to return 0 on out-of-range values.
Tested with `openssl s_server` and `curl -k https://localhost:4433`.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2349)
Richard Levitte [Mon, 6 Feb 2017 16:49:41 +0000 (17:49 +0100)]
Because our test sid file contains EC, don't try it when configured no-ec
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2564)
Matt Caswell [Wed, 8 Feb 2017 09:33:44 +0000 (09:33 +0000)]
Fix crash in tls13_enc
If s->s3->tmp.new_cipher is NULL then a crash can occur. This can happen
if an alert gets sent after version negotiation (i.e. we have selected
TLSv1.3 and ended up in tls13_enc), but before a ciphersuite has been
selected.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2575)
Dr. Stephen Henson [Sat, 4 Feb 2017 13:12:49 +0000 (13:12 +0000)]
Update documentation
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Sat, 4 Feb 2017 18:25:09 +0000 (18:25 +0000)]
update test
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Thu, 2 Feb 2017 23:11:07 +0000 (23:11 +0000)]
Add remaining TLS1.3 ciphersuites
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Fri, 3 Feb 2017 02:49:26 +0000 (02:49 +0000)]
Call EVP_CipherFinal in CCM mode for tests.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Fri, 3 Feb 2017 02:47:56 +0000 (02:47 +0000)]
Make EVP_*Final work for CCM ciphers
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Mon, 6 Feb 2017 19:25:34 +0000 (19:25 +0000)]
Use contants for Chacha/Poly, redo algorithm expressions.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Fri, 3 Feb 2017 02:44:15 +0000 (02:44 +0000)]
Add CCM mode support for TLS 1.3
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Fri, 3 Feb 2017 02:43:03 +0000 (02:43 +0000)]
Add constants to CCM and TLS.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Sat, 4 Feb 2017 12:42:57 +0000 (12:42 +0000)]
Add NID_auth_any and NID_kx_any NIDs.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Sat, 4 Feb 2017 03:17:32 +0000 (03:17 +0000)]
Add SSL_kANY and SSL_aANY
Add SSL_kANY and SSL_aANY contants for TLS 1.3 ciphersuites. Return
appropriate text strings when they are used.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Rich Salz [Tue, 7 Feb 2017 16:33:21 +0000 (11:33 -0500)]
Centralize documentation about config file location
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2569)
Peter Wu [Wed, 1 Feb 2017 18:14:27 +0000 (19:14 +0100)]
apps: Add support for writing a keylog file
The server and client demos (s_client and s_server) are extended with a
-keylogfile option. This is similar as setting the SSLKEYLOGFILE
environment variable for NSS and creates a keylog file which is suitable
for Wireshark.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2343)
Pauli [Mon, 6 Feb 2017 19:38:20 +0000 (14:38 -0500)]
Remove unused variable
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2566)
Bernd Edlinger [Mon, 6 Feb 2017 12:37:42 +0000 (13:37 +0100)]
Fix a crash in EVP_CIPHER_CTX_cleanup due to cipher_data may be NULL
or EVP_CTRL_INIT/EVP_CTRL_COPY was not called or failed.
If that happens in EVP_CipherInit_ex/EVP_CIPHER_CTX_copy set cipher = NULL,
aes_gcm_cleanup should check that gctx != NULL before calling OPENSSL_cleanse.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2562)
Rich Salz [Sun, 5 Feb 2017 15:24:54 +0000 (10:24 -0500)]
Fix parsing of serial# in req
Reported by Jakub Wilk.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2556)
Rich Salz [Sun, 5 Feb 2017 15:29:22 +0000 (10:29 -0500)]
Doc fix
Reported by Alexander Köppe
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2557)
Andy Polyakov [Fri, 3 Feb 2017 13:00:22 +0000 (14:00 +0100)]
Rename 90-test_fuzz.t to 99-test_fuzz.t to ensure that it's executed last.
Idea is to keep it last for all eternity, so that if you find yourself
in time-pressed situation and deem that fuzz test can be temporarily
skipped, you can terminate the test suite with less hesitation about
following tests that you would have originally missed.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Fri, 3 Feb 2017 11:07:16 +0000 (12:07 +0100)]
x86_64 assembly pack: Win64 SEH face-lift.
- harmonize handlers with guidelines and themselves;
- fix some bugs in handlers;
- add missing handlers in chacha and ecp_nistz256 modules;
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Fri, 3 Feb 2017 11:05:52 +0000 (12:05 +0100)]
perlasm/x86_64-xlate.pl: clarify SEH coding guidelines.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Bernd Edlinger [Thu, 2 Feb 2017 12:36:10 +0000 (13:36 +0100)]
Fix a crash with malformed user notice policy numbers
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2352)
Bernd Edlinger [Wed, 1 Feb 2017 17:29:47 +0000 (18:29 +0100)]
Combined patch against master branch for the following issues:
Fixed a memory leak in ASN1_digest and ASN1_item_digest.
Reworked error handling in asn1_item_embed_new.
Fixed error handling in int_ctx_new and EVP_PKEY_CTX_dup.
Fixed a memory leak in CRYPTO_free_ex_data.
Reworked error handing in x509_name_ex_d2i, x509_name_encode and x509_name_canon.
Check for null pointer in tls_process_cert_verify.
Fixes #2103 #2104 #2105 #2109 #2111 #2115
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2342)
Richard Levitte [Fri, 3 Feb 2017 12:56:54 +0000 (13:56 +0100)]
Fix "no-ec"
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2547)
Robert Scheck [Fri, 27 Jan 2017 23:52:27 +0000 (00:52 +0100)]
Add NNTP support (RFC 4642) to s_client ("-starttls nntp")
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2310)
Dmitry Kostjuchenko [Wed, 1 Feb 2017 10:51:34 +0000 (12:51 +0200)]
Grouped data declarations [skip ci]
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1981)
Dmitry Kostjuchenko [Mon, 28 Nov 2016 18:16:34 +0000 (20:16 +0200)]
Removed tab spaces.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1981)
Dmitry Kostjuchenko [Mon, 28 Nov 2016 17:54:43 +0000 (19:54 +0200)]
Corrections according the review comments.
Updated indentations according project rules, renamed file-local define to the shorter version - USE_RWLOCK, fixed declaration after the if statement in CRYPTO_THREAD_lock_new().
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1981)
Dmitry Kostjuchenko [Tue, 22 Nov 2016 16:37:43 +0000 (18:37 +0200)]
Compile fix on platforms with missing pthread_rwlock_t.
Fix compilation on platforms with missing pthread_rwlock_t implementation by replacing it with pthread_mutex_t. An example of such platform can be Android OS 2.0 - 2.1, API level 5 (Eclair), Android NDK platform - android-5 where pthread_rwlock_t is not implemented and is missing in pthread.h.
In case of missing pthread_rwlock_t implementation CRYPTO_RWLOCK will work as exclusive lock in write-only mode of pthread_rwlock_t lock.
The implementation based on pthread_mutex_t must be using PTHREAD_MUTEX_RECURSIVE mode to be compatible with recursive behavior of pthread_rwlock_rdlock.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1981)
Andy Polyakov [Fri, 27 Jan 2017 18:03:37 +0000 (19:03 +0100)]
crypto/x86_64cpuid.pl: detect if kernel preserves %zmm registers.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Thu, 2 Feb 2017 22:45:38 +0000 (23:45 +0100)]
Initialise alg_k and alg_a
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2543)
Dr. Stephen Henson [Thu, 2 Feb 2017 12:34:22 +0000 (12:34 +0000)]
Add missing MinProtocol/MaxProtocol
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2339)
Dr. Stephen Henson [Wed, 1 Feb 2017 13:29:45 +0000 (13:29 +0000)]
Add TLS 1.3 certificate selection tests.
For TLS 1.3 we select certificates with signature algorithms extension
only. For ECDSA+SHA384 there is the additional restriction that the
curve must be P-384: since the test uses P-256 this should fail.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2339)
Dr. Stephen Henson [Tue, 31 Jan 2017 18:59:31 +0000 (18:59 +0000)]
Don't filter TLS 1.3 ciphersuites by signing or key exchange algorithm
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2339)
Dr. Stephen Henson [Tue, 31 Jan 2017 14:10:36 +0000 (14:10 +0000)]
Update cipher definition
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2339)
Dr. Stephen Henson [Tue, 31 Jan 2017 18:33:14 +0000 (18:33 +0000)]
Remove special case for TLS 1.3.
We now set the server certificate in tls_choose_sigalg() so there is
no need for a special case for TLS 1.3 any more.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2339)
Dr. Stephen Henson [Tue, 31 Jan 2017 18:32:41 +0000 (18:32 +0000)]
For TLS 1.3 retrieve previously set certificate index
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2339)
Dr. Stephen Henson [Tue, 31 Jan 2017 18:01:55 +0000 (18:01 +0000)]
make errors
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2339)
Dr. Stephen Henson [Tue, 31 Jan 2017 18:00:55 +0000 (18:00 +0000)]
Set signature algorithm when choosing cipher
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2339)
Dr. Stephen Henson [Tue, 31 Jan 2017 17:45:00 +0000 (17:45 +0000)]
Add function tls_choose_sigalg().
New function tls_choose_sigalg(). This is a signature algorithm version
of ssl3_choose_cipher(): it picks and sets the appropriate signature
algorithm and certificate based on shared signature algorithms.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2339)
Dr. Stephen Henson [Tue, 31 Jan 2017 16:39:53 +0000 (16:39 +0000)]
Cosmetic change
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2339)
Cory Benfield [Tue, 31 Jan 2017 14:56:31 +0000 (14:56 +0000)]
Test logging TLSv1.3 secrets.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2287)
Cory Benfield [Tue, 31 Jan 2017 14:56:15 +0000 (14:56 +0000)]
Add support for logging out TLSv1.3 secrets
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2287)
Todd Short [Wed, 11 Jan 2017 21:38:44 +0000 (16:38 -0500)]
Add support for parameterized SipHash
The core SipHash supports either 8 or 16-byte output and a configurable
number of rounds.
The default behavior, as added to EVP, is to use 16-byte output and
2,4 rounds, which matches the behavior of most implementations.
There is an EVP_PKEY_CTRL that can control the output size.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2216)
Bernd Edlinger [Wed, 1 Feb 2017 18:10:03 +0000 (19:10 +0100)]
remove test/.rnd on make clean
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2344)
Todd Short [Tue, 31 Jan 2017 20:32:50 +0000 (15:32 -0500)]
Majority rules, use session_ctx vs initial_ctx
session_ctx and initial_ctx are aliases of each other, and with the
opaque data structures, there's no need to keep both around. Since
there were more references of session_ctx, replace all instances of
initial_ctx with session_ctx.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2334)
Richard Levitte [Wed, 1 Feb 2017 01:29:46 +0000 (02:29 +0100)]
bn: fix occurance of negative zero in BN_rshift1()
Reviewed-by: Rich Salz <rsalz@openssl.org>
Geoff Thorpe [Thu, 6 Oct 2016 15:04:56 +0000 (10:04 -0500)]
bn: fix occurances of negative zero
The BIGNUM behaviour is supposed to be "consistent" when going into and
out of APIs, where "consistent" means 'top' is set minimally and that
'neg' (negative) is not set if the BIGNUM is zero (which is iff 'top' is
zero, due to the previous point).
The BN_DEBUG testing (make test) caught the cases that this patch
corrects.
Note, bn_correct_top() could have been used instead, but that is intended
for where 'top' is expected to (sometimes) require adjustment after direct
word-array manipulation, and so is heavier-weight. Here, we are just
catching the negative-zero case, so we test and correct for that
explicitly, in-place.
Change-Id: Iddefbd3c28a13d935648932beebcc765d5b85ae7
Signed-off-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1672)
Geoff Thorpe [Thu, 6 Oct 2016 14:02:38 +0000 (09:02 -0500)]
bn: catch negative zero as an error
Change-Id: I5ab72ad0aae9069b47d5b7b7b9e25bd1b7afa251
Signed-off-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1672)
Geoff Thorpe [Thu, 6 Oct 2016 13:25:22 +0000 (08:25 -0500)]
bn: fix BN_DEBUG + BN_DEBUG_RAND support
Couple of updates to make this code work properly again;
* use OPENSSL_assert() instead of assert() (and #include <assert.h>)
* the circular-dependency-avoidance uses RAND_bytes() (not pseudo)
Change-Id: Iefb5a9dd73f71fd81c1268495c54a64378955354
Signed-off-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1672)
Richard Levitte [Tue, 31 Jan 2017 23:48:38 +0000 (00:48 +0100)]
bntests.txt: add a couple of checks of possibly negative zero
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2335)
Richard Levitte [Tue, 31 Jan 2017 23:47:30 +0000 (00:47 +0100)]
bntest: do not stop on first fautl encountered
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2335)
Richard Levitte [Tue, 31 Jan 2017 23:46:58 +0000 (00:46 +0100)]
bntest: make sure file_rshift tests BN_rshift1 as well when appropriate
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2335)
Richard Levitte [Tue, 31 Jan 2017 23:46:09 +0000 (00:46 +0100)]
bntest: make sure that equalBN takes note of negative zero
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2335)
Rich Salz [Mon, 30 Jan 2017 21:13:41 +0000 (16:13 -0500)]
Add -Wno-parentheses-equality to dev-warnings.
Also fix a block comment formatting glitch.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2327)
Dr. Stephen Henson [Mon, 30 Jan 2017 22:02:11 +0000 (22:02 +0000)]
Tidy up Suite B logic
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2324)
Dr. Stephen Henson [Mon, 30 Jan 2017 18:10:17 +0000 (18:10 +0000)]
Remove peer_md and use peer_sigalg instead.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2324)
Dr. Stephen Henson [Mon, 30 Jan 2017 17:27:35 +0000 (17:27 +0000)]
Simplify sigalgs code.
Remove unnecessary lookup operations: use the indices and data in the
lookup table directly.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2324)
Dr. Stephen Henson [Mon, 30 Jan 2017 16:05:23 +0000 (16:05 +0000)]
Add digest and key indices to table.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2324)
Dr. Stephen Henson [Mon, 30 Jan 2017 15:34:25 +0000 (15:34 +0000)]
Don't check certificate type against ciphersuite for TLS 1.3
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2324)
Dr. Stephen Henson [Mon, 30 Jan 2017 14:45:20 +0000 (14:45 +0000)]
Add TLS 1.3 signing curve check
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2324)
Dr. Stephen Henson [Mon, 30 Jan 2017 13:53:54 +0000 (13:53 +0000)]
Only allow PSS signatures with RSA keys and TLS 1.3
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2324)
Dr. Stephen Henson [Mon, 30 Jan 2017 13:48:39 +0000 (13:48 +0000)]
Store table entry to peer signature algorithm.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2324)
Matt Caswell [Mon, 30 Jan 2017 19:37:17 +0000 (19:37 +0000)]
Free up the memory for the NewSessionTicket extensions
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2326)
Matt Caswell [Mon, 30 Jan 2017 19:36:51 +0000 (19:36 +0000)]
Make sure we free and cleanse the pms value in all code paths
Otherwise we get a memory leak.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2326)
Dr. Stephen Henson [Sun, 29 Jan 2017 15:12:58 +0000 (15:12 +0000)]
Update macros.
Use TLS_MAX_SIGALGCNT for the maximum number of entries in the
signature algorithms array.
Use TLS_MAX_SIGSTRING_LEN for the maxiumum length of each signature
component instead of a magic number.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2301)
Dr. Stephen Henson [Sun, 29 Jan 2017 13:38:55 +0000 (13:38 +0000)]
fix style issues
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2301)
Dr. Stephen Henson [Sun, 29 Jan 2017 00:43:45 +0000 (00:43 +0000)]
Fix TLS 1.2 and no sigalgs.
For TLS 1.2 if we have no signature algorithms extension then lookup
using the complete table instead of (empty) shared signature algorithms
list so we pick up defaults.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2301)
Dr. Stephen Henson [Sat, 28 Jan 2017 19:45:33 +0000 (19:45 +0000)]
Use PSS for simple test so TLS 1.3 handhake is successful.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2301)
Dr. Stephen Henson [Fri, 27 Jan 2017 15:56:47 +0000 (15:56 +0000)]
Add tests for client and server signature type
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2301)