oweals/openssl.git
8 years agoRevert "Include progs.h directly in openssl.c instead of via apps.h"
Viktor Dukhovni [Sat, 19 Mar 2016 02:10:33 +0000 (22:10 -0400)]
Revert "Include progs.h directly in openssl.c instead of via apps.h"

This reverts commit a45d7d5388c6774a484cff4af13f188240d3d50b.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoGH36: Add casts to match the documentation
Alex Gaynor [Sat, 19 Mar 2016 16:17:31 +0000 (12:17 -0400)]
GH36: Add casts to match the documentation

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoCorrect faulty L<> links in .pods
Richard Levitte [Sat, 19 Mar 2016 10:39:47 +0000 (11:39 +0100)]
Correct faulty L<> links in .pods

Closes RT#4450

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd a few more quotes for Windows (install_ssldirs)
Richard Levitte [Sat, 19 Mar 2016 10:25:10 +0000 (11:25 +0100)]
Add a few more quotes for Windows (install_ssldirs)

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoThe command source are files, not directories
Richard Levitte [Sat, 19 Mar 2016 10:24:00 +0000 (11:24 +0100)]
The command source are files, not directories

Therefore, they should be concatenated with the source directory using
catfile(), not catdir()

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoReplace sed command with perl
Richard Levitte [Sat, 19 Mar 2016 10:18:56 +0000 (11:18 +0100)]
Replace sed command with perl

Some implementations of sed require a newline before an ending '}'.
The easier method is to replace that sed command with the
corresponding perl command.

Closes RT#4448

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoClear the exit code from 'find' in 'make depend'
Richard Levitte [Sat, 19 Mar 2016 10:15:00 +0000 (11:15 +0100)]
Clear the exit code from 'find' in 'make depend'

Depending on what has been built so far, all .d files may not be
present and 'find' will exit with non-zero exit code.  This isn't a
bother for us but may break make, so clear the exit code with an added
'exit 0'.

Closes RT#4444

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoShut find up about files not found
Richard Levitte [Sat, 19 Mar 2016 01:11:31 +0000 (02:11 +0100)]
Shut find up about files not found

Some of the files in $(DEPS) might not exist.  We don't need to know.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDon't free up EVP_MD_CTX.
Schüller Felix [Fri, 18 Mar 2016 19:20:34 +0000 (19:20 +0000)]
Don't free up EVP_MD_CTX.

Don't free up passed EVP_MD_CTX in ASN1_item_sign_ctx(). This
simplifies handling and retains compatiblity with previous behaviour.

PR#4446

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoUse the dependencies received in generatesrc()
Richard Levitte [Fri, 18 Mar 2016 23:57:35 +0000 (00:57 +0100)]
Use the dependencies received in generatesrc()

generatesrc() did already receive dependency information, but never
used it, and never really needed to...  until now.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoIgnore the generated apps/progs.h
Richard Levitte [Fri, 18 Mar 2016 23:51:51 +0000 (00:51 +0100)]
Ignore the generated apps/progs.h

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoGenerate apps/progs.h on the fly
Richard Levitte [Fri, 18 Mar 2016 23:50:49 +0000 (00:50 +0100)]
Generate apps/progs.h on the fly

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoInclude progs.h directly in openssl.c instead of via apps.h
Richard Levitte [Fri, 18 Mar 2016 23:43:43 +0000 (00:43 +0100)]
Include progs.h directly in openssl.c instead of via apps.h

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMake apps/progs.pl more flexible
Richard Levitte [Fri, 18 Mar 2016 23:41:14 +0000 (00:41 +0100)]
Make apps/progs.pl more flexible

Make Configure write @disablables to configdata.pm and have
apps/progs.pl use that data.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoCorrect the export list when writing configdata.pm
Richard Levitte [Sat, 19 Mar 2016 00:31:48 +0000 (01:31 +0100)]
Correct the export list when writing configdata.pm

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoCorrect the check of files to depend on against known generated ones
Richard Levitte [Sat, 19 Mar 2016 00:29:01 +0000 (01:29 +0100)]
Correct the check of files to depend on against known generated ones

The check was erroneously inversed

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDon't perform tsa tests if configured "no-ts"
Richard Levitte [Sat, 19 Mar 2016 00:01:52 +0000 (01:01 +0100)]
Don't perform tsa tests if configured "no-ts"

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoCorrect incorrect path
Richard Levitte [Sat, 19 Mar 2016 00:01:07 +0000 (01:01 +0100)]
Correct incorrect path

In crypto, buildinf.h depends on ../configdata.pm, not ./configdata.pm

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoBetter 'make depend' mechanism
Richard Levitte [Fri, 18 Mar 2016 19:52:29 +0000 (20:52 +0100)]
Better 'make depend' mechanism

Instead of relying on the '-nt' test operator, which doesn't exist
everywhere, use find's '-newer' to find out if any of the known .d
files is newer than Makefile.

Closes RT#4444

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agomake update
Richard Levitte [Fri, 18 Mar 2016 19:06:45 +0000 (20:06 +0100)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoImplement support for no-ts
Richard Levitte [Fri, 18 Mar 2016 19:06:29 +0000 (20:06 +0100)]
Implement support for no-ts

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoapps/progs.pl: more consistent output for digests
Richard Levitte [Fri, 18 Mar 2016 19:01:58 +0000 (20:01 +0100)]
apps/progs.pl: more consistent output for digests

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix no-des
Matt Caswell [Fri, 18 Mar 2016 15:56:06 +0000 (15:56 +0000)]
Fix no-des

Numerous fixes for no-des.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix no-dgram
Matt Caswell [Fri, 18 Mar 2016 14:17:03 +0000 (14:17 +0000)]
Fix no-dgram

A few places in s_client needed some OPENSSL_NO_DTLS guards which fixes
no-dgram.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix no-deprecated
Matt Caswell [Fri, 18 Mar 2016 14:07:31 +0000 (14:07 +0000)]
Fix no-deprecated

The no-deprecated build was failing because afalg was relying on a
transitive include that does not exist in a no-deprecated build.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix no-cmac
Matt Caswell [Fri, 18 Mar 2016 13:49:25 +0000 (13:49 +0000)]
Fix no-cmac

There were a couple of CMAC references without OPENSSL_NO_CMAC guards.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd a test to see that signals are caught as failures
Richard Levitte [Fri, 18 Mar 2016 11:16:53 +0000 (12:16 +0100)]
Add a test to see that signals are caught as failures

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoMake OpenSSL::Test::run() sensitive to signals
Richard Levitte [Fri, 18 Mar 2016 07:57:52 +0000 (08:57 +0100)]
Make OpenSSL::Test::run() sensitive to signals

$? in perl gets the status value from wait(2), which is a word with
the exit code in the upper half and the number of a raised signal in
the lower half.  OpenSSL::Test::run() ignored the signal half up until
now.

With this change, we recalculate an exit code the same way the Unix
shells do, using this formula:

    ($? & 0x7f) ? ($? & 0x7f)|0x80 : ($? >> 8);

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoRemove more unused things.
Rich Salz [Sat, 12 Mar 2016 16:04:10 +0000 (11:04 -0500)]
Remove more unused things.

Moved doc/standards.txt to the web.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoResolved unresolved symbols with no-hw
Matt Caswell [Thu, 17 Mar 2016 12:20:56 +0000 (12:20 +0000)]
Resolved unresolved symbols with no-hw

Compiling on Windows with no-hw was resulting in unresolved symbols
in the padlock engine.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoEnsure that no-comp functions are flagged as such
Matt Caswell [Thu, 17 Mar 2016 11:50:23 +0000 (11:50 +0000)]
Ensure that no-comp functions are flagged as such

mkdef.pl was not detecting no-comp functions. This updates the header file
so that mkdef.pl detects that no-comp applies, and the functions are marked
accordingly.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix no-rc2 in the CMS test
Matt Caswell [Thu, 17 Mar 2016 10:14:30 +0000 (10:14 +0000)]
Fix no-rc2 in the CMS test

The CMS test uses some RC2 keys which should be skipped if the RC2 is
disabled.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoMark OCB as an AEAD cipher
Matt Caswell [Tue, 15 Mar 2016 12:05:16 +0000 (12:05 +0000)]
Mark OCB as an AEAD cipher

OCB is AEAD capable but was not marked as such with the
EVP_CIPH_FLAG_AEAD_CIPHER flag.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoEnsure that memory allocated for the ticket is freed
Matt Caswell [Tue, 15 Mar 2016 11:38:56 +0000 (11:38 +0000)]
Ensure that memory allocated for the ticket is freed

If a call to EVP_DecryptUpdate fails then a memory leak could occur.
Ensure that the memory is freed appropriately.

Issue reported by Guido Vranken.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix a potential double free in EVP_DigestInit_ex
Matt Caswell [Mon, 14 Mar 2016 17:06:19 +0000 (17:06 +0000)]
Fix a potential double free in EVP_DigestInit_ex

There is a potential double free in EVP_DigestInit_ex. This is believed
to be reached only as a result of programmer error - but we should fix it
anyway.

Issue reported by Guido Vranken.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix build; CPP syntax error.
Rich Salz [Fri, 18 Mar 2016 11:35:18 +0000 (07:35 -0400)]
Fix build; CPP syntax error.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoUpdate EVP_CIPHER_CTX_set_padding documentation.
Conrado Porto Lopes Gouvêa [Tue, 15 Mar 2016 16:32:38 +0000 (13:32 -0300)]
Update EVP_CIPHER_CTX_set_padding documentation.

Add note about when EVP_CIPHER_CTX_set_padding should be called.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoREADME: small fixups
Richard Levitte [Thu, 17 Mar 2016 20:13:23 +0000 (21:13 +0100)]
README: small fixups

Don't refer to INSTALL files that don't exist any more.
Make it clear that the libssl and libcrypto libraries may be named
differently on different platforms.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMake picker, thread and combine standard config helper functions
Richard Levitte [Thu, 17 Mar 2016 08:09:31 +0000 (09:09 +0100)]
Make picker, thread and combine standard config helper functions

Document them as well

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoRemove Netware and OS/2
Rich Salz [Thu, 17 Mar 2016 16:53:11 +0000 (12:53 -0400)]
Remove Netware and OS/2

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoDisallow --classic for Windows
Richard Levitte [Thu, 17 Mar 2016 17:38:05 +0000 (18:38 +0100)]
Disallow --classic for Windows

With all the config changes, mk1mf is broken on Windows.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agowindows-makefile.tmpl: Stop keeping temporary files
Richard Levitte [Thu, 17 Mar 2016 13:17:42 +0000 (14:17 +0100)]
windows-makefile.tmpl: Stop keeping temporary files

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoAdd install targets for Windows
Richard Levitte [Thu, 17 Mar 2016 09:08:25 +0000 (10:08 +0100)]
Add install targets for Windows

On Windows, we set INSTALLTOP to default as follows:

  VC-WIN32:

    PREFIX:     %ProgramFiles(x86)%\OpenSSL
    OPENSSLDIR: %CommonProgramFiles(x86)%\SSL

  VC-WIN64*:

    PREFIX:     %ProgramW6432%\OpenSSL
    OPENSSLDIR: %CommonProgramW6432%\SSL

Should those environment variables be missing, the following is used
as fallback:

    PREFIX:     %ProgramFiles%\OpenSSL
    OPENSSLDIR: %CommonProgramFiles%\SSL

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoReport TLS 1.0 as backwards-compatible TLSv1
Viktor Dukhovni [Thu, 17 Mar 2016 00:47:52 +0000 (20:47 -0400)]
Report TLS 1.0 as backwards-compatible TLSv1

The TLSv1.0 form is retained for reporting the first protocol version
that supports a given cupher.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRemove ultrix/mips support.
Rich Salz [Thu, 17 Mar 2016 18:47:49 +0000 (14:47 -0400)]
Remove ultrix/mips support.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoRemove support for Borland C++
Richard Levitte [Thu, 17 Mar 2016 18:34:56 +0000 (19:34 +0100)]
Remove support for Borland C++

Borland C++ 4.5 is very old and our "support" for it is already
non-existent, we might as well remove it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoUse correct C format for keysets.pl
Dr. Stephen Henson [Thu, 17 Mar 2016 18:16:09 +0000 (18:16 +0000)]
Use correct C format for keysets.pl

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoStart documenting Configure internals
Richard Levitte [Thu, 10 Mar 2016 00:10:54 +0000 (01:10 +0100)]
Start documenting Configure internals

This is a living document, everyone is encouraged to add to it.
Implementation details as well as broader implementation philosophy
has a place here.

I'm starting with documentation of the how conditions in build.info
files are treated.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdded build.info debugging capability to Configure
Richard Levitte [Wed, 9 Mar 2016 23:04:04 +0000 (00:04 +0100)]
Added build.info debugging capability to Configure

This is only enabled when the environment variable
CONFIGURE_DEBUG_BUILDINFO is defined.  This will cause every line in
every build.info file to be displayed, along with the content of the
skip stack before and after parsing.  This can be a very powerful tool
to see that all conditions are working as expected.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoSimplify define as we don't support MS-DOS anymore.
Dr. Stephen Henson [Thu, 17 Mar 2016 00:29:57 +0000 (00:29 +0000)]
Simplify define as we don't support MS-DOS anymore.

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoDon't define OPENSSL_ENGINES in test recipes, do it in Makefiles instead
Richard Levitte [Sat, 5 Mar 2016 12:11:37 +0000 (13:11 +0100)]
Don't define OPENSSL_ENGINES in test recipes, do it in Makefiles instead

In most builds, we can assume that engines live in the build tree
subdirectory "engines".  This was hard coded into the tests that use
the engine ossltest.

However, that hard coding is tedious, it would need to be done in
every test recipe, and it's an incorrect assumption in some cases.

This change has us play it safe and let the build files tell the
testing framework where the engines are.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoHave 'openssl version -a' output the default engines directory as well
Richard Levitte [Wed, 16 Mar 2016 22:55:48 +0000 (23:55 +0100)]
Have 'openssl version -a' output the default engines directory as well

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoBugfix: Encode the requested length in s_cb.c:hexencode()
Viktor Dukhovni [Thu, 17 Mar 2016 03:58:58 +0000 (23:58 -0400)]
Bugfix: Encode the requested length in s_cb.c:hexencode()

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoSort cipher-list at runtime.
Rich Salz [Wed, 16 Mar 2016 16:33:00 +0000 (12:33 -0400)]
Sort cipher-list at runtime.

Reduces #ifdef complexity.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agounix-Makefile template: use $(PERL) everywhere
Richard Levitte [Wed, 16 Mar 2016 19:11:25 +0000 (20:11 +0100)]
unix-Makefile template: use $(PERL) everywhere

There was one spot that had hard-coded 'perl'

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDeal with DSA_SIG opaqueness.
Ben Laurie [Sat, 12 Mar 2016 17:41:03 +0000 (17:41 +0000)]
Deal with DSA_SIG opaqueness.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoPrepare for 1.1.0-pre5-dev
Richard Levitte [Wed, 16 Mar 2016 17:21:46 +0000 (18:21 +0100)]
Prepare for 1.1.0-pre5-dev

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoPrepare for 1.1.0-pre4 release OpenSSL_1_1_0-pre4
Richard Levitte [Wed, 16 Mar 2016 17:21:17 +0000 (18:21 +0100)]
Prepare for 1.1.0-pre4 release

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoSome platforms provide getcontext() but it does not work
Matt Caswell [Wed, 16 Mar 2016 10:38:39 +0000 (10:38 +0000)]
Some platforms provide getcontext() but it does not work

Some platforms claim to be POSIX but their getcontext() implementation
does not work. Therefore we update the ASYNC_is_capable() function to test
for this.

RT#4366

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoWhen building DLLs, hack the library name in the .def file
Richard Levitte [Wed, 16 Mar 2016 15:50:18 +0000 (16:50 +0100)]
When building DLLs, hack the library name in the .def file

util/mkdef.pl assumes it knows what the resulting library name will
be.  Really, it shouldn't, but changing it will break classic native
Windows builds, so we leave it for now and change the LIBRARY line
externally when needed instead.

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoDLL object files should not be built with /Zl"
Richard Levitte [Wed, 16 Mar 2016 14:32:44 +0000 (15:32 +0100)]
DLL object files should not be built with /Zl"

When building the DLLs, we depend on the correct default C RTL info.

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoAppveyor - make sure to actually build "shared" in the shared configuration
Richard Levitte [Wed, 16 Mar 2016 13:58:17 +0000 (14:58 +0100)]
Appveyor - make sure to actually build "shared" in the shared configuration

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoFix up CHANGES
Emilia Kasper [Wed, 16 Mar 2016 14:06:01 +0000 (15:06 +0100)]
Fix up CHANGES

- Remove duplicate entry
- Add author for SSL_CIPHER query functions
- Note HKDF support in CHANGES and NEWS

[ci skip]

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoWe should use $SRCDIR in Makefiles
Matt Caswell [Wed, 16 Mar 2016 11:16:11 +0000 (11:16 +0000)]
We should use $SRCDIR in Makefiles

Normally we always refer to source files relative to $SRCDIR in Makefiles.
However the reference to unix-Makefile.tmpl was using a fully expanded
absolute path. This can cause problems for Mingw.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoDisable AFALG when cross-compiling
Matt Caswell [Wed, 16 Mar 2016 10:08:53 +0000 (10:08 +0000)]
Disable AFALG when cross-compiling

We don't currently support cross-compiling of the afalg engine. However
we were failing to explicitly mark it as disabled during Configure leading
to a failed build.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix a TLSProxy race condition
Matt Caswell [Tue, 15 Mar 2016 16:44:26 +0000 (16:44 +0000)]
Fix a TLSProxy race condition

TLSProxy starts s_server and specifies the number of client connects
it should expect. After that s_server is supposed to close down
automatically. However, if another test is then run then TLSProxy
will start a new instance of s_server. If the previous instance
hasn't closed down yet then the new instance can fail to bind to
the socket.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agopoly1305/asm/poly1305-x86_64.pl: make it work with linux-x32.
Andy Polyakov [Tue, 15 Mar 2016 22:39:07 +0000 (23:39 +0100)]
poly1305/asm/poly1305-x86_64.pl: make it work with linux-x32.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoOn Windows, page walking is known as __chkstk.
Emilia Kasper [Tue, 15 Mar 2016 22:04:14 +0000 (23:04 +0100)]
On Windows, page walking is known as __chkstk.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoExplain *cough*-dows
Emilia Kasper [Tue, 15 Mar 2016 20:52:31 +0000 (21:52 +0100)]
Explain *cough*-dows

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoMake the perl dependency post-processor into just one line
Richard Levitte [Tue, 15 Mar 2016 21:16:35 +0000 (22:16 +0100)]
Make the perl dependency post-processor into just one line

Make doesn't always treat multiline quoted strings as nicely as one
would wish.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoNot all shells understand !
Richard Levitte [Tue, 15 Mar 2016 08:05:20 +0000 (09:05 +0100)]
Not all shells understand !

In unix-Makefile.tmpl, this construction has been used a few times

if ! something; then ...

It seems, though, that some shells do not understand !, so these need
to be changed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoGeneral verify options to openssl ts
fbroda [Tue, 15 Mar 2016 09:08:49 +0000 (10:08 +0100)]
General verify options to openssl ts

This commit adds the general verify options of ocsp, verify,
cms, etc. to the openssl timestamping app as suggested by
Stephen N. Henson in [openssl.org #4287]. The conflicting
"-policy" option of "openssl ts" has been renamed to
"-tspolicy". Documentation and tests have been updated.

CAVE: This will break code, which currently uses the "-policy"
option.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix CRYPTO_THREAD_run_once return value checks
Emilia Kasper [Tue, 15 Mar 2016 14:37:51 +0000 (15:37 +0100)]
Fix CRYPTO_THREAD_run_once return value checks

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoCygwin configs were missing thread_scheme settings, add them
Richard Levitte [Tue, 15 Mar 2016 14:30:43 +0000 (15:30 +0100)]
Cygwin configs were missing thread_scheme settings, add them

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoSmall typo
Richard Levitte [Tue, 15 Mar 2016 13:06:34 +0000 (14:06 +0100)]
Small typo

OPENSSL_INIT_ONCE and OPENSSL_INIT_ONCE_STATIC_INIT are really
CRYPTO_ONCE and CRYPTO_ONCE_STATIC_INIT.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agostatic-engine is no longer an internal keyword, remove it from %disabled
Richard Levitte [Tue, 15 Mar 2016 13:05:35 +0000 (14:05 +0100)]
static-engine is no longer an internal keyword, remove it from %disabled

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoClarify NOTES.WIN.
Andy Polyakov [Mon, 14 Mar 2016 17:04:21 +0000 (18:04 +0100)]
Clarify NOTES.WIN.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoUpdate and clarify ECDSA documentation.
Dr. Stephen Henson [Mon, 14 Mar 2016 16:45:51 +0000 (16:45 +0000)]
Update and clarify ECDSA documentation.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoDisable afalg when engine is disabled.
Emilia Kasper [Mon, 14 Mar 2016 11:21:44 +0000 (12:21 +0100)]
Disable afalg when engine is disabled.

Also make it possible to disable afalg separately.

we still need to update config again

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix typo in manual, missing ending '>'
Richard Levitte [Mon, 14 Mar 2016 15:52:54 +0000 (16:52 +0100)]
Fix typo in manual, missing ending '>'

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoTravis: build tests in BUILDONLY mode
Emilia Kasper [Mon, 14 Mar 2016 11:47:47 +0000 (12:47 +0100)]
Travis: build tests in BUILDONLY mode

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoconfig: fix HP-UX PA-RISC detection.
Andy Polyakov [Mon, 14 Mar 2016 12:42:48 +0000 (13:42 +0100)]
config: fix HP-UX PA-RISC detection.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agos390x assembly pack: 32-bit fixups.
Andy Polyakov [Fri, 11 Mar 2016 15:47:02 +0000 (16:47 +0100)]
s390x assembly pack: 32-bit fixups.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agobuild.info/Makefile.in: Itanium fixups.
Andy Polyakov [Sun, 13 Mar 2016 20:54:49 +0000 (21:54 +0100)]
build.info/Makefile.in: Itanium fixups.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoengines/Makefile.in: some [older] shell complain about 'for i ;',
Andy Polyakov [Sun, 13 Mar 2016 20:49:15 +0000 (21:49 +0100)]
engines/Makefile.in: some [older] shell complain about 'for i ;',
but not if there is reference to empty variable.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix the init cleanup order
Matt Caswell [Mon, 14 Mar 2016 10:34:59 +0000 (10:34 +0000)]
Fix the init cleanup order

There are internal dependencies between the various cleanup functions.
This re-orders things to try and get that right.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoAdd some missing cleanup calls to de-init
Matt Caswell [Mon, 14 Mar 2016 10:26:28 +0000 (10:26 +0000)]
Add some missing cleanup calls to de-init

OBJ_cleanup() doesn't always get called from EVP_cleanup() so needs to be
explicitly called in de-init. Also BIO_sock_cleanup() also needs to be
called.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix freeze in config's interrupt trap with some shells
Richard Levitte [Sun, 13 Mar 2016 10:31:04 +0000 (11:31 +0100)]
Fix freeze in config's interrupt trap with some shells

With bash and zsh, the trap on the 5 second read does respond, but
doesn't break out of the read.  What's worse is that it takes away the
5 second timer, and therefore has the read hang indefinitely and
(almost) unbreakable.

Having the trap do 'exit 0' after reseting the tty params has it break
out of read and continue with the configuration.

Other shells do not appear to have the issue described here, but
neither does the extra 'exit 0' appear to harm them.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoEnforce the demand for Perl 5.10.0 as a minimum.
Richard Levitte [Mon, 14 Mar 2016 09:03:14 +0000 (10:03 +0100)]
Enforce the demand for Perl 5.10.0 as a minimum.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoFix a few Configure errors
Richard Levitte [Mon, 14 Mar 2016 09:02:13 +0000 (10:02 +0100)]
Fix a few Configure errors

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoDocument X509_get_serialNumber and X509_set_serialNumber.
Dr. Stephen Henson [Mon, 14 Mar 2016 00:23:13 +0000 (00:23 +0000)]
Document X509_get_serialNumber and X509_set_serialNumber.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoAdd EVP_PKEY documentation.
Dr. Stephen Henson [Sun, 13 Mar 2016 15:49:09 +0000 (15:49 +0000)]
Add EVP_PKEY documentation.

Document EVP_PKEY_id() and EVP_PKEY_base_id().

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoChange an function macro for ERR match the function it's used in.
Richard Levitte [Sun, 13 Mar 2016 13:54:51 +0000 (14:54 +0100)]
Change an function macro for ERR match the function it's used in.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
8 years agoComplete incomplete makefile variable referenses
Richard Levitte [Sun, 13 Mar 2016 10:07:12 +0000 (11:07 +0100)]
Complete incomplete makefile variable referenses

A couple of '$(PERLASM_SCHEM' had sneaked in.

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoCollect the names of generated files and clean them away at target clean:
Richard Levitte [Sat, 12 Mar 2016 11:42:49 +0000 (12:42 +0100)]
Collect the names of generated files and clean them away at target clean:

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd $(LIB_CFLAGS) for any build.info generator that uses $(CFLAGS)
Richard Levitte [Sat, 12 Mar 2016 08:46:28 +0000 (09:46 +0100)]
Add $(LIB_CFLAGS) for any build.info generator that uses $(CFLAGS)

The reason to do so is that some of the generators detect PIC flags
like -fPIC and -KPIC, and those are normally delivered in LD_CFLAGS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoUse single quotes rather than double quotes when needed
Richard Levitte [Sat, 12 Mar 2016 09:46:14 +0000 (10:46 +0100)]
Use single quotes rather than double quotes when needed

When passing down values to Makefile.shared, do so with single quotes
as much as possible to avoid having the shell create a mess of quotes.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoHarmonize Unix Makefile template with Windows dito
Richard Levitte [Sat, 12 Mar 2016 08:38:20 +0000 (09:38 +0100)]
Harmonize Unix Makefile template with Windows dito

The variable SHARED_CFLAGS and SHARD_LDFLAGS were used in the Unix
template because they normally contain options used when building
"shared".  The Windows template, on the other hand, uses LIB_CFLAGS,
to express the intended use of those flags rather than their content.
The Windows template still used SHARED_LDFLAGS, which seems
inconsistent.

To harmonize the two, any SHARED_CFLAGS gets renamed to LIB_CFLAGS and
SHARED_LDFLAGS to LIB_LDFLAGS.  That makes the intent consistent along
with BIN_{C,LD}FLAGS and DSO_{C,LD}FLAGS.

Finally, make sure to pass down $(LIB_CFLAGS) or $(DSO_CFLAGS) along
with $(CFLAGS) when using Makefile.shared.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix memory leak in library deinit
Emilia Kasper [Sat, 12 Mar 2016 19:46:13 +0000 (20:46 +0100)]
Fix memory leak in library deinit

ENGINE_cleanup calls CRYPTO_free_ex_data and therefore,
CRYPTO_cleanup_all_ex_data - which cleans up the method pointers - must
run after ENGINE_cleanup.

Additionally, don't needlessly initialize the EX_CALLBACKS stack during
e.g. CRYPTO_free_ex_data. The only time this is actually needed is when
reserving the first ex data index. Specifically, since sk_num returns -1
on NULL input, the rest of the code already handles a NULL method stack
correctly.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd doc on when to use SCT callback.
Rich Salz [Thu, 10 Mar 2016 15:37:31 +0000 (10:37 -0500)]
Add doc on when to use SCT callback.

With help from Viktor.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>