oweals/openssl.git
9 years agoMove certificate request and CRL routines to x509 dir.
Dr. Stephen Henson [Tue, 22 Sep 2015 15:20:09 +0000 (16:20 +0100)]
Move certificate request and CRL routines to x509 dir.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoMove functions.
Dr. Stephen Henson [Tue, 22 Sep 2015 15:05:33 +0000 (16:05 +0100)]
Move functions.

Move various functions tagged onto t_x509.c to more appropriate places.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoUpdate SEE ALSO sections.
Dr. Stephen Henson [Mon, 21 Sep 2015 20:25:52 +0000 (21:25 +0100)]
Update SEE ALSO sections.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoDocument signature accessors.
Dr. Stephen Henson [Mon, 21 Sep 2015 12:03:42 +0000 (13:03 +0100)]
Document signature accessors.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoExtension parsing and encoding docs.
Dr. Stephen Henson [Fri, 4 Jul 2014 22:03:17 +0000 (23:03 +0100)]
Extension parsing and encoding docs.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoDocument i2d_re_X509_REQ_tbs() and i2d_re_X509_CRL_tbs().
Dr. Stephen Henson [Fri, 18 Sep 2015 19:51:02 +0000 (20:51 +0100)]
Document i2d_re_X509_REQ_tbs() and i2d_re_X509_CRL_tbs().

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoDocument X509_REVOKED functions.
Dr. Stephen Henson [Wed, 9 Sep 2015 21:07:24 +0000 (22:07 +0100)]
Document X509_REVOKED functions.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoDocument X509 sign and verify functions.
Dr. Stephen Henson [Mon, 7 Sep 2015 13:27:58 +0000 (14:27 +0100)]
Document X509 sign and verify functions.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoDocument X509 public key functions.
Dr. Stephen Henson [Mon, 7 Sep 2015 12:41:20 +0000 (13:41 +0100)]
Document X509 public key functions.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoDocument X509 name get and set functions.
Dr. Stephen Henson [Sun, 6 Sep 2015 12:43:23 +0000 (13:43 +0100)]
Document X509 name get and set functions.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoDocument X509 version functions.
Dr. Stephen Henson [Sun, 6 Sep 2015 11:48:22 +0000 (12:48 +0100)]
Document X509 version functions.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoUse accessors in X509_REQ_print().
Dr. Stephen Henson [Fri, 18 Sep 2015 01:54:59 +0000 (02:54 +0100)]
Use accessors in X509_REQ_print().

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoUse accessor functions in X509_CRL_print().
Dr. Stephen Henson [Fri, 18 Sep 2015 01:38:49 +0000 (02:38 +0100)]
Use accessor functions in X509_CRL_print().

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoNew accessor X509_REQ_get_X509_PUBKEY()
Dr. Stephen Henson [Fri, 18 Sep 2015 02:06:55 +0000 (03:06 +0100)]
New accessor X509_REQ_get_X509_PUBKEY()

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdditional X509_CRL accessors.
Dr. Stephen Henson [Fri, 18 Sep 2015 01:39:44 +0000 (02:39 +0100)]
Additional X509_CRL accessors.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agotypo
Dr. Stephen Henson [Tue, 22 Sep 2015 12:00:03 +0000 (13:00 +0100)]
typo

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoAdd comments to x509_int.h
Dr. Stephen Henson [Thu, 10 Sep 2015 23:06:37 +0000 (00:06 +0100)]
Add comments to x509_int.h

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
9 years agoAdd accessors for X509_REVOKED.
Dr. Stephen Henson [Mon, 7 Sep 2015 22:32:58 +0000 (23:32 +0100)]
Add accessors for X509_REVOKED.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
9 years agoAdd accessors for request and CRL signatures
Dr. Stephen Henson [Mon, 7 Sep 2015 15:51:05 +0000 (16:51 +0100)]
Add accessors for request and CRL signatures

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
9 years agoRemove "noise" comments from TS files.
Rich Salz [Fri, 8 May 2015 03:41:07 +0000 (23:41 -0400)]
Remove "noise" comments from TS files.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoRT3479: Add UTF8 support to BIO_read_filename()
David Woodhouse [Wed, 9 Sep 2015 19:49:01 +0000 (15:49 -0400)]
RT3479: Add UTF8 support to BIO_read_filename()

If we use BIO_new_file(), on Windows it'll jump through hoops to work
around their unusual charset/Unicode handling. it'll convert a UTF-8
filename to UCS-16LE and attempt to use _wfopen().

If you use BIO_read_filename(), it doesn't do this. Shouldn't it be
consistent?

It would certainly be nice if SSL_use_certificate_chain_file() worked.

Also made BIO_C_SET_FILENAME work (rsalz)

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Andy Polyakov <appro@openssl.org>
9 years agoRT3823: Improve the robustness of event logging
Gunnar Kudrjavets [Mon, 27 Apr 2015 18:14:45 +0000 (11:14 -0700)]
RT3823: Improve the robustness of event logging

There are a couple of minor fixes here:

1) Handle the case when RegisterEventSource() fails (which it may for
various reasons) and do the work of logging the event only if it succeeds.

2) Handle the case when ReportEvent() fails and do our best in debug builds
to at least attempt somehow indicate that something has gone wrong. The
typical situation would be someone running tools like DbMon, DBWin32,
DebugView or just having the debugger attached. The intent is to make sure
that at least some data will be captured so that we can save hours and days
of debugging time.

3) Minor fix to change the MessageBox() flag to MB_ICONERROR. Though the
value of MB_ICONERROR is the same value as MB_ICONSTOP, the intent is
better conveyed by using MB_ICONERROR.

Testing performed:

1) Clean compilation for debug-VC-WIN32 and VC-WIN32.

2) Good test results (nmake -f ms\ntdll.mak test) for debug-VC-WIN32 and
VC-WIN32.

3) Stepped through relevant changes using WinDBG and exercised the impacted
code paths.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoGOST PKCS12 support
Matt Caswell [Wed, 2 Sep 2015 10:27:31 +0000 (11:27 +0100)]
GOST PKCS12 support

Changes required to add GOST support to PKCS12

Based on a patch provided by Dmitry Belyavsky <beldmit@gmail.com>

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoAdd GOST extensions to PKCS#5
Matt Caswell [Wed, 2 Sep 2015 09:55:57 +0000 (10:55 +0100)]
Add GOST extensions to PKCS#5

GOST extends PKCS5 PBES2/PBKDF2 with some additional GOST specific PRFs.

Based on a patch provided by Dmitry Belyavsky <beldmit@gmail.com>

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoFix SRP memory leaks
Matt Caswell [Wed, 16 Sep 2015 09:24:37 +0000 (10:24 +0100)]
Fix SRP memory leaks

There were some memory leaks in the creation of an SRP verifier (both on
successful completion and also on some error paths).

Reviewed-by: Emilia Käsper <emilia@openssl.org>
9 years agoFix -srpvfile option in srp command line
Matt Caswell [Wed, 16 Sep 2015 08:50:33 +0000 (09:50 +0100)]
Fix -srpvfile option in srp command line

The -srpvfile option was broken in the srp command line app. Using it would
always result in "-dbfile and -configfile cannot be specified together."
The error message is also wrong because the option is "-srpvfile" not
"-dbfile", so that has been fixed too.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
9 years agoMake SRP work with -www
Dr. Stephen Henson [Sat, 12 Sep 2015 01:37:48 +0000 (02:37 +0100)]
Make SRP work with -www

PR#3817

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoHandle SSL_ERROR_WANT_X509_LOOKUP
Dr. Stephen Henson [Sun, 13 Sep 2015 18:04:58 +0000 (19:04 +0100)]
Handle SSL_ERROR_WANT_X509_LOOKUP

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoremove unneeded includes
Dr. Stephen Henson [Sun, 20 Sep 2015 11:48:29 +0000 (12:48 +0100)]
remove unneeded includes

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agomake no-dh work
Dr. Stephen Henson [Sat, 19 Sep 2015 21:03:15 +0000 (22:03 +0100)]
make no-dh work

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoMove EVP_PKEY_METHOD into private headers.
Dr. Stephen Henson [Sat, 19 Sep 2015 21:13:22 +0000 (22:13 +0100)]
Move EVP_PKEY_METHOD into private headers.

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoSimplify Simple.pm further, and make it more verbose
Richard Levitte [Sun, 20 Sep 2015 00:15:49 +0000 (02:15 +0200)]
Simplify Simple.pm further, and make it more verbose

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoCorrect srp test
Richard Levitte [Sun, 20 Sep 2015 00:05:35 +0000 (02:05 +0200)]
Correct srp test

There actually is a "srp" feature to check the availability on

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoCorrect jpake test
Richard Levitte [Sun, 20 Sep 2015 00:04:47 +0000 (02:04 +0200)]
Correct jpake test

There actually is a "jpake" feature to check the availability on

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoCorrect sha tests
Richard Levitte [Sun, 20 Sep 2015 00:03:19 +0000 (02:03 +0200)]
Correct sha tests

These tests were checking for specific sha variants, when they should
just check if "sha" is disabled.

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoCorrect whirlpool test
Richard Levitte [Sat, 19 Sep 2015 22:34:16 +0000 (00:34 +0200)]
Correct whirlpool test

It depended on 'openssl no-wp', which always exited with code 0, so
this test would never be performed, and this, I never discovered that
the program it's supposed to run was misspellt.  Furthermore, the
feature to check is 'whirlpool', not 'wp'.

All corrected.

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoFinally, remove a possibly disabled feature
Richard Levitte [Sat, 19 Sep 2015 23:50:11 +0000 (01:50 +0200)]
Finally, remove a possibly disabled feature

I have no clue why MD_GHOST94 was checked on, there is no
OPENSSL_NO_MD_GHOST94 in sight anywhere

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoAdd more features that may be disabled
Richard Levitte [Sat, 19 Sep 2015 23:42:14 +0000 (01:42 +0200)]
Add more features that may be disabled

Have a look at the directories in crypto/, I found reason to add
checks on CMAC and HMAC.  This might be completely irrelevant, but I
prefered covering too much than not enough.

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoAdd more features that may be disabled
Richard Levitte [Sat, 19 Sep 2015 23:31:47 +0000 (01:31 +0200)]
Add more features that may be disabled

A grep of OPENSSL_NO_ in the rest of the source tree revealed a few
more features to check.

NOTE: there are some of those macros that I ignore because a check of
them doesn't seem useful to external apps.  This might change later on.

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoAdd more features that may be disabled
Richard Levitte [Sat, 19 Sep 2015 22:54:03 +0000 (00:54 +0200)]
Add more features that may be disabled

After a grep of OPENSSL_NO_ in apps/*.c, a few more features that may
be interesting to check the availability of came up.

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoAdd more features that may be disabled
Richard Levitte [Sat, 19 Sep 2015 22:26:14 +0000 (00:26 +0200)]
Add more features that may be disabled

I've tried to make this list as complete as possible, based on
information found in apps/progs.pl.

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoSort the disabled features alphabetically
Richard Levitte [Sat, 19 Sep 2015 22:25:14 +0000 (00:25 +0200)]
Sort the disabled features alphabetically

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agotypo
Dr. Stephen Henson [Sat, 19 Sep 2015 22:50:02 +0000 (23:50 +0100)]
typo

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoUpdate Simple.pm to use disabled()
Dr. Stephen Henson [Sat, 19 Sep 2015 22:49:26 +0000 (23:49 +0100)]
Update Simple.pm to use disabled()

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoChange test recipes to use disabled()
Dr. Stephen Henson [Sat, 19 Sep 2015 21:19:14 +0000 (22:19 +0100)]
Change test recipes to use disabled()

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoAdd Utils.pm
Dr. Stephen Henson [Sat, 19 Sep 2015 16:10:34 +0000 (17:10 +0100)]
Add Utils.pm

Add Utils.pm for test utilities. This currently just contains one function:
disabled which checks if a feature is disabled based on the output of
openssl list -disabled

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoSmall typo
Richard Levitte [Sat, 19 Sep 2015 22:46:44 +0000 (00:46 +0200)]
Small typo

OPENSSL_NO_ECA changed to OPENSSL_NO_EC

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoMake sure to actually use @smime_cms_comp_test when testing it...
Richard Levitte [Sat, 19 Sep 2015 20:55:55 +0000 (22:55 +0200)]
Make sure to actually use @smime_cms_comp_test when testing it...

Obvious typo, and it took configuring with 'zlib' to discover it,
otherwise there was a previous skip that bypassed this section
entirely.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoFix some test failures when Configured with zlib
Matt Caswell [Sat, 19 Sep 2015 19:07:33 +0000 (20:07 +0100)]
Fix some test failures when Configured with zlib

TLSProxy was failing if we are Configured with compression because it
doesn't support it. This fix simply switches compression off for the
purposes of the test.

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoPrint out a list of disabled features.
Dr. Stephen Henson [Tue, 15 Sep 2015 14:29:02 +0000 (15:29 +0100)]
Print out a list of disabled features.

New option "openssl list -disabled" this lists a set of disabled features
in a form which can be conveniently parsed by the test framework so it
knows which tests to skip.

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoReturn shared OIDs when decoding.
Dr. Stephen Henson [Thu, 17 Sep 2015 22:50:13 +0000 (23:50 +0100)]
Return shared OIDs when decoding.

When an OID is decoded see if it exists in the registered OID table
and if so return the shared OID instead of dynamically allocating
an ASN1_OBJECT.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoFix indentation
Viktor Dukhovni [Sat, 19 Sep 2015 01:15:42 +0000 (21:15 -0400)]
Fix indentation

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoCheck if test_rehash is run as root
Richard Levitte [Fri, 18 Sep 2015 19:27:29 +0000 (21:27 +0200)]
Check if test_rehash is run as root

If test/recipes/40-test_rehash.t is executed as root, the last test
will fail, since the created directory will remain writable no matter
what.  Make sure it complains loudly about being run as root.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoRemove PACKET_back
Emilia Kasper [Thu, 17 Sep 2015 16:55:19 +0000 (18:55 +0200)]
Remove PACKET_back

It's unused, and the same functionality can be achieved with saving a
copy of the struct.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoMake sure OPENSSL_cleanse checks for NULL
Matt Caswell [Wed, 16 Sep 2015 09:47:15 +0000 (10:47 +0100)]
Make sure OPENSSL_cleanse checks for NULL

In master we have the function OPENSSL_clear_free(x,y), which immediately
returns if x == NULL. In <=1.0.2 this function does not exist so we have to
do:
OPENSSL_cleanse(x, y);
OPENSSL_free(x);

However, previously, OPENSSL_cleanse did not check that if x == NULL, so
the real equivalent check would have to be:
if (x != NULL)
    OPENSSL_cleanse(x, y);
OPENSSL_free(x);

It would be easy to get this wrong during cherry-picking to other branches
and therefore, for safety, it is best to just ensure OPENSSL_cleanse also
checks for NULL.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agobase64 decode: check for high bit
Emilia Kasper [Thu, 17 Sep 2015 18:08:48 +0000 (20:08 +0200)]
base64 decode: check for high bit

Previously, the conversion would silently coerce to ASCII. Now, we error
out.

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoRT3757: base64 encoding bugs
Emilia Kasper [Wed, 2 Sep 2015 13:31:28 +0000 (15:31 +0200)]
RT3757: base64 encoding bugs

Rewrite EVP_DecodeUpdate.

In particular: reject extra trailing padding, and padding in the middle
of the content. Don't limit line length. Add tests.

Previously, the behaviour was ill-defined, and depended on the position
of the padding within the input.

In addition, this appears to fix a possible two-byte oob read.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Dr Stephen Henson <steve@openssl.org>
9 years agoRemove PACKET_(get|goto)_bookmark
Emilia Kasper [Thu, 17 Sep 2015 16:11:46 +0000 (18:11 +0200)]
Remove PACKET_(get|goto)_bookmark

The bookmark API results in a lot of boilerplate error checking that can
be much more easily achieved with a simple struct copy. It also lays the
path for removing the third PACKET field.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoEmbed various signature algorithms.
Dr. Stephen Henson [Thu, 17 Sep 2015 13:44:19 +0000 (14:44 +0100)]
Embed various signature algorithms.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoRT4033: Use OPENSSL_SYS_UNIX not "unix"
Rich Salz [Thu, 17 Sep 2015 02:17:55 +0000 (22:17 -0400)]
RT4033: Use OPENSSL_SYS_UNIX not "unix"

Real fix for RT 4033

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoRT4047: Set reference count earlier
Filipe DA SILVA [Thu, 17 Sep 2015 02:25:31 +0000 (22:25 -0400)]
RT4047: Set reference count earlier

Make sure it's valid very early.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoDisentangle RSA premaster secret parsing
Emilia Kasper [Wed, 9 Sep 2015 12:45:00 +0000 (14:45 +0200)]
Disentangle RSA premaster secret parsing

Simplify encrypted premaster secret reading by using new methods in the
PACKET API.

Don't overwrite the packet buffer. RSA decrypt accepts truncated
ciphertext with leading zeroes omitted, so it's even possible that by
crafting a valid ciphertext with several leading zeroes, this could
cause a few bytes out-of-bounds write. The write is harmless because of
the size of the underlying message buffer, but nevertheless we shouldn't
write into the packet.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoEmbed X509_REQ_INFO
Dr. Stephen Henson [Wed, 16 Sep 2015 17:46:16 +0000 (18:46 +0100)]
Embed X509_REQ_INFO

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoEmbed X509_CINF
Dr. Stephen Henson [Wed, 16 Sep 2015 17:40:26 +0000 (18:40 +0100)]
Embed X509_CINF

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoX509_CRL_INFO embed
Dr. Stephen Henson [Tue, 15 Sep 2015 23:24:43 +0000 (00:24 +0100)]
X509_CRL_INFO embed

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoChange X509_VAL in X509 structure to embedded.
Dr. Stephen Henson [Tue, 15 Sep 2015 16:10:51 +0000 (17:10 +0100)]
Change X509_VAL in X509 structure to embedded.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoNew ASN.1 embed macro.
Dr. Stephen Henson [Tue, 15 Sep 2015 14:54:19 +0000 (15:54 +0100)]
New ASN.1 embed macro.

New ASN.1 macro ASN1_EMBED. This is the same as ASN1_SIMPLE except the
structure is not allocated: it is part of the parent. That is instead of

FOO *x;

it must be:

FOO x;

This reduces memory fragmentation and make it impossible to accidentally
set a mandatory field to NULL.

This currently only works for SEQUENCE and since it is equivalent to
ASN1_SIMPLE it cannot be tagged, OPTIONAL, SET OF or SEQUENCE OF.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoFix build on mingw
Alessandro Ghedini [Wed, 16 Sep 2015 19:53:58 +0000 (21:53 +0200)]
Fix build on mingw

When OPENSSL_EXPORT_VAR_AS_FUNCTION is defined, the static_ASN1_ITEM_start
macro doesn't exist so the build fails. This problem was introduced in
commit df2ee0e.

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoFix return values when adding serverinfo fails.
Kurt Roeckx [Tue, 15 Sep 2015 19:26:32 +0000 (21:26 +0200)]
Fix return values when adding serverinfo fails.

Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1128

9 years agomake update
Matt Caswell [Wed, 16 Sep 2015 11:40:55 +0000 (12:40 +0100)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoExtend the notes on how to do testing
Richard Levitte [Tue, 15 Sep 2015 12:07:46 +0000 (14:07 +0200)]
Extend the notes on how to do testing

These notes include the use of HARNESS_VERBOSE (see the manual for
Test::Harness) and the method to enumerate specific tests to run.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
9 years agoAdd a method to list available tests
Richard Levitte [Tue, 15 Sep 2015 12:07:10 +0000 (14:07 +0200)]
Add a method to list available tests

Reviewed-by: Emilia Käsper <emilia@openssl.org>
9 years agoAdd a few notes on perl
Richard Levitte [Thu, 10 Sep 2015 11:02:42 +0000 (13:02 +0200)]
Add a few notes on perl

Reviewed-by: Emilia Käsper <emilia@openssl.org>
9 years agod2i: don't update input pointer on failure
Kurt Roeckx [Mon, 17 Aug 2015 14:02:18 +0000 (16:02 +0200)]
d2i: don't update input pointer on failure

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
MR #1005

9 years agoFix PSK identity hint handling.
Dr. Stephen Henson [Mon, 14 Sep 2015 16:58:04 +0000 (17:58 +0100)]
Fix PSK identity hint handling.

For server use a PSK identity hint value in the CERT structure which
is inherited when SSL_new is called and which allows applications to
set hints on a per-SSL basis. The previous version of
SSL_use_psk_identity_hint tried (wrongly) to use the SSL_SESSION structure.

PR#4039

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoConstify ECDSA_METHOD_new.
Dr. Stephen Henson [Sat, 12 Sep 2015 00:53:52 +0000 (01:53 +0100)]
Constify ECDSA_METHOD_new.

PR#3920.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoFix zlib CMS compilation.
Dr. Stephen Henson [Fri, 11 Sep 2015 22:10:29 +0000 (23:10 +0100)]
Fix zlib CMS compilation.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoUse default field separator.
Dr. Stephen Henson [Fri, 11 Sep 2015 15:13:52 +0000 (16:13 +0100)]
Use default field separator.

If the field separator isn't specified through -nameopt then use
XN_FLAG_SEP_CPLUS_SPC instead of printing nothing and returing an error.

PR#2397

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoFix "defined but not used" warnings.
Dr. Stephen Henson [Fri, 11 Sep 2015 17:16:23 +0000 (18:16 +0100)]
Fix "defined but not used" warnings.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoEnable -Wmissing-variable-declarations and
Ben Laurie [Sat, 5 Sep 2015 12:32:58 +0000 (13:32 +0100)]
Enable -Wmissing-variable-declarations and
-Wincompatible-pointer-types-discards-qualifiers (the latter did not require
any code changes).

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoUnwriteable directories are errors
Rich Salz [Thu, 10 Sep 2015 15:46:13 +0000 (11:46 -0400)]
Unwriteable directories are errors

Make the script and app match the documentation.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoEVP_PKEY_METHOD accessor functions.
Dr. Stephen Henson [Mon, 20 Jul 2015 21:05:10 +0000 (22:05 +0100)]
EVP_PKEY_METHOD accessor functions.

Functions to retrieve the function pointer of an existing method: this
can be used to create a method which intercepts or modifies the behaviour
of an existing method while retaining most of the existing behaviour.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoRT3754: check for NULL pointer
Emilia Kasper [Tue, 1 Sep 2015 14:31:55 +0000 (16:31 +0200)]
RT3754: check for NULL pointer

Fix both the caller to error out on malloc failure, as well as the
eventual callee to handle a NULL gracefully.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
9 years agoRestore SSLerr on PACKET_strndup failure.
Emilia Kasper [Thu, 10 Sep 2015 12:47:04 +0000 (14:47 +0200)]
Restore SSLerr on PACKET_strndup failure.

Reviewed-by: Dr Stephen Henson <steve@openssl.org>
9 years agoRT3992: Make SCT #ifdeffable.
David Woodhouse [Wed, 9 Sep 2015 19:29:44 +0000 (15:29 -0400)]
RT3992: Make SCT #ifdeffable.

This code does open-coded division on 64-bit quantities and thus when
building with GCC on 32-bit platforms will require functions such as
__umoddi3 and __udivdi3 from libgcc.

In constrained environments such as firmware, those functions may not
be available. So make it possible to compile out SCT support, which in
fact (in the case of UEFI) we don't need anyway.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoAdd a simple test for the new rehash command
Richard Levitte [Wed, 9 Sep 2015 15:36:21 +0000 (17:36 +0200)]
Add a simple test for the new rehash command

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoMake sure the temporary error log resides in a well defined location
Richard Levitte [Wed, 9 Sep 2015 15:29:06 +0000 (17:29 +0200)]
Make sure the temporary error log resides in a well defined location

If a test recipe does something like this:

    indir "foo.$$" => sub {
        chmod 0500, File::Spec->curdir();
        ok(run(app(["something"])));
    }

we get a problem, because we were storing the temporary stderr file in
the current directory at all times (so while inside the 'indir', we
would attemp to store it in "foo.$$").

So, change our ways to always store that temporary file in the exact
same location, defined by the environment variable RESULT_D, or
failing that TEST_D, or failing that $TOP/test.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoFix warning about mixed declarations and code.
Dr. Stephen Henson [Wed, 9 Sep 2015 16:28:17 +0000 (17:28 +0100)]
Fix warning about mixed declarations and code.

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoPACKET: add PACKET_memdup and PACKET_strndup
Emilia Kasper [Tue, 1 Sep 2015 16:19:14 +0000 (18:19 +0200)]
PACKET: add PACKET_memdup and PACKET_strndup

Use each once in s3_srvr.c to show how they work.

Also fix a bug introduced in c3fc7eeab884b6876a1b4006163f190d325aa047
and made apparent by this change:
ssl3_get_next_proto wasn't updating next_proto_negotiated_len

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoRT3993: Fix error found by VS2008
David Woodhouse [Wed, 9 Sep 2015 03:24:36 +0000 (23:24 -0400)]
RT3993: Fix error found by VS2008

Cast and then negate, don't negate an unsigned.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoRT3969: Add OPENSSL_SYS_UEFI
David Woodhouse [Wed, 9 Sep 2015 02:51:17 +0000 (22:51 -0400)]
RT3969: Add OPENSSL_SYS_UEFI

This provides support for building in the EDK II reference implementation
of UEFI. Most UEFI firmware in existence uses OpenSSL for implementing
the core cryptographic functionality needed for Secure Boot.

This has always previously been handled with external patches to OpenSSL
but we are now making a concerted effort to eliminate those.

In this mode, we don't actually use the OpenSSL makefiles; we process
the MINFO file generated by 'make files' and incorporate it into the
EDK2 build system.

Since EDK II builds for various targets with varying word size and we
need to have a single prepackaged configuration, we deliberately don't
hard-code the setting of SIXTY_FOUR_BIT vs. THIRTY_TWO_BIT in
opensslconf.h. We bypass that for OPENSSL_SYS_UEFI and allow EDK II
itself to set those, depending on the architecture.

For x86_64, EDK II sets SIXTY_FOUR_BIT and thus uses 'long long' for the
64-bit type, even when building with GCC where 'long' is also 64-bit. We
do this because the Microsoft toolchain has 32-bit 'long'.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoFix rehash/c_rehash doc and behavior.
Rich Salz [Tue, 8 Sep 2015 02:21:38 +0000 (22:21 -0400)]
Fix rehash/c_rehash doc and behavior.

Both now warn once if directory isn't writeable.
Both now warn on file-write errors (multiple times).
Update manpage to describe both program and script correctly.

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoFix uninit warning. Remove unnecessary casts. Nothing to add is an error.
Ben Laurie [Mon, 7 Sep 2015 17:33:09 +0000 (18:33 +0100)]
Fix uninit warning. Remove unnecessary casts. Nothing to add is an error.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoadd support for apple os/x
Rich Salz [Tue, 8 Sep 2015 01:39:44 +0000 (21:39 -0400)]
add support for apple os/x

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoFix a few tests that depended on the wrong algorithm check
Richard Levitte [Mon, 7 Sep 2015 23:23:49 +0000 (01:23 +0200)]
Fix a few tests that depended on the wrong algorithm check

test_ecdh and test_ecdsa are made to depend on no-ec being false.
test_hmac is made not to depend on algorithm at all.

Based on a contribution by Alessandro Ghedini <alessandro@ghedini.me>

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdjust the general fill-column in doc/dir-locals.example.el
Richard Levitte [Mon, 7 Sep 2015 22:59:50 +0000 (00:59 +0200)]
Adjust the general fill-column in doc/dir-locals.example.el

Having a general fill-column of 78 may look nice at first sight, but
if the edited text gets indented a bit afterward (such as with git
comments in 'git log'), it suddenly turns not so nice on a classic 80
columns terminal.  A fill-column of 70 will serve us better.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdjust the verify_extra test recipe to its executable
Richard Levitte [Mon, 7 Sep 2015 14:26:04 +0000 (16:26 +0200)]
Adjust the verify_extra test recipe to its executable

The verify_extra_test was recently changed to take its parameters as
arguments instead of having them hardcoded.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoGH391: Apple port
Rich Salz [Mon, 7 Sep 2015 14:08:14 +0000 (10:08 -0400)]
GH391: Apple port

Also make internal functions consistently return values, and
add a comment documenting them.

Reviewed-by: Ben Laurie <ben@openssl.org>
9 years agoMake sure that 80-test_ca.t finds all the config files
Richard Levitte [Sun, 6 Sep 2015 23:09:23 +0000 (01:09 +0200)]
Make sure that 80-test_ca.t finds all the config files

This recipe counted too much on being called with test/ as its current
working directory.  That's a mistake on, for example, Windows.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd a recipe for the new null pointer test
Richard Levitte [Sun, 6 Sep 2015 14:04:15 +0000 (16:04 +0200)]
Add a recipe for the new null pointer test

Reviewed-by: Rich Salz <rsalz@openssl.org>