oweals/openssl.git
7 years agoReformat M_check_autoarg to match our coding style
Richard Levitte [Tue, 20 Dec 2016 18:21:00 +0000 (19:21 +0100)]
Reformat M_check_autoarg to match our coding style

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2121)

7 years agoM_check_autoarg: sanity check the key
Richard Levitte [Tue, 20 Dec 2016 11:56:14 +0000 (12:56 +0100)]
M_check_autoarg: sanity check the key

For now, checking that the size is non-zero will suffice.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2120)

7 years agoAdd bwrite_conv and bread_conv values to methods_dgramp_sctp
Richard Levitte [Mon, 19 Dec 2016 13:08:18 +0000 (14:08 +0100)]
Add bwrite_conv and bread_conv values to methods_dgramp_sctp

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2116)

7 years agoFix erroneous goto lable
Richard Levitte [Mon, 19 Dec 2016 13:07:52 +0000 (14:07 +0100)]
Fix erroneous goto lable

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2116)

7 years agox86 assembly pack: update performance results.
Andy Polyakov [Sat, 17 Dec 2016 18:10:00 +0000 (19:10 +0100)]
x86 assembly pack: update performance results.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoUpdate fuzz corpora
Kurt Roeckx [Thu, 15 Dec 2016 19:21:33 +0000 (20:21 +0100)]
Update fuzz corpora

Reviewed-by: Richard Levitte <levitte@openssl.org>
GH: #2090

7 years agoFix memory leak in tls_parse_stoc_key_share
Kurt Roeckx [Sun, 18 Dec 2016 11:48:49 +0000 (12:48 +0100)]
Fix memory leak in tls_parse_stoc_key_share

Found by oss-fuzz

Reviewed-by: Richard Levitte <levitte@openssl.org>
GH: #2102

7 years agoFix typo.
Finn Hakansson [Thu, 15 Dec 2016 17:58:19 +0000 (12:58 -0500)]
Fix typo.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
CLA: trivial
(Merged from https://github.com/openssl/openssl/pull/2086)

7 years agotest/ssl_test: give up if both client and server wait on read
Richard Levitte [Fri, 16 Dec 2016 10:18:47 +0000 (11:18 +0100)]
test/ssl_test: give up if both client and server wait on read

In some cases, both client and server end of the test can end up in
SSL_ERROR_WANT_READ and never get out of it, making the test spin.
Detect it and give up instead of waiting endlessly.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2096)

7 years agoFix no-ct, skip tests recipes that try to test CT
Richard Levitte [Fri, 16 Dec 2016 09:29:43 +0000 (10:29 +0100)]
Fix no-ct, skip tests recipes that try to test CT

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2096)

7 years agoe_afalg: Don't warn about kernel version when pedantic
Richard Levitte [Fri, 16 Dec 2016 08:24:00 +0000 (09:24 +0100)]
e_afalg: Don't warn about kernel version when pedantic

When built with --strict-warnings and the Linux kernel headers don't
match the kernel version, the preprocessor warnings in
engines/afalg/e_afalg.c cause compilation errors.  Use the macro
PEDANTIC to avoid those warnings in that case.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2095)

7 years agoevp_test: when function and reason strings aren't available, just skip
Richard Levitte [Fri, 16 Dec 2016 03:15:02 +0000 (04:15 +0100)]
evp_test: when function and reason strings aren't available, just skip

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2093)

7 years agoHP-UX doesn't have hstrerror(), so make our own for that platform
Richard Levitte [Fri, 16 Dec 2016 02:50:40 +0000 (03:50 +0100)]
HP-UX doesn't have hstrerror(), so make our own for that platform

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2092)
(cherry picked from commit 46766d003666da5f90346da7e6d09e109355f5c6)

7 years agoMake client and server fuzzer support all ciphers
Kurt Roeckx [Thu, 15 Dec 2016 19:11:18 +0000 (20:11 +0100)]
Make client and server fuzzer support all ciphers

Also send a SNI extension in the client so the fuzzer can react to it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2088

7 years agoDocument the recommended parameters for fuzzing
Kurt Roeckx [Thu, 15 Dec 2016 19:06:51 +0000 (20:06 +0100)]
Document the recommended parameters for fuzzing

We use those parameters for calculating the coverage.

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2088

7 years agoEnable TLS1.3 and PEDANTIC in the coverage target
Kurt Roeckx [Thu, 15 Dec 2016 19:03:15 +0000 (20:03 +0100)]
Enable TLS1.3 and PEDANTIC in the coverage target

This make sure that the coverage is the same for the fuzzers and this
coverage target

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2088

7 years agoDon't call memcpy with NULL as source
Kurt Roeckx [Thu, 15 Dec 2016 19:23:52 +0000 (20:23 +0100)]
Don't call memcpy with NULL as source

Calling it with lenght 0 and NULL as source is undefined behaviour.

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2089

7 years agopoly1305/asm/poly1305-x86_64.pl: allow nasm to assemble AVX512 code.
Andy Polyakov [Wed, 14 Dec 2016 12:38:04 +0000 (13:38 +0100)]
poly1305/asm/poly1305-x86_64.pl: allow nasm to assemble AVX512 code.
chacha/asm/chacha-x86_64.pl: refine nasm version detection logic.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoperlasm/x86_64-xlate.pl: add support for AVX512 OPMASK-ing.
Andy Polyakov [Wed, 14 Dec 2016 12:34:47 +0000 (13:34 +0100)]
perlasm/x86_64-xlate.pl: add support for AVX512 OPMASK-ing.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoman3/OPENSSL_ia32cap.pod: clarify AVX512 support in clang context.
Andy Polyakov [Wed, 14 Dec 2016 12:33:40 +0000 (13:33 +0100)]
man3/OPENSSL_ia32cap.pod: clarify AVX512 support in clang context.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoCRL critical extension bugfix
Rich Salz [Mon, 28 Nov 2016 20:33:40 +0000 (15:33 -0500)]
CRL critical extension bugfix

More importantly, port CRL test from boringSSL crypto/x509/x509_test.cc

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1775)

7 years agoAdd function and reason checking to evp_test
Dr. Stephen Henson [Sat, 10 Dec 2016 19:21:01 +0000 (19:21 +0000)]
Add function and reason checking to evp_test

Add options to check the function and reason code matches expected values.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd X509_VERIFY_PARAM inheritance flag set/get
Rich Salz [Tue, 13 Dec 2016 16:52:22 +0000 (11:52 -0500)]
Add X509_VERIFY_PARAM inheritance flag set/get

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2079)

7 years agoFix various doc nits.
Rich Salz [Mon, 12 Dec 2016 16:14:40 +0000 (11:14 -0500)]
Fix various doc nits.

find-doc-nits warns if you don't give a "what to do flag"
Don't use regexps for section names, just strings:  More consistency.
Rename "COMMAND OPTIONS" to OPTIONS.
Fix a couple of other nit-level things.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2076)

7 years agoRemove ENGINE_load_dasync() (no OPENSSL_INIT_ENGINE_DASYNC already)
Azat Khuzhin [Tue, 1 Nov 2016 14:35:35 +0000 (17:35 +0300)]
Remove ENGINE_load_dasync() (no OPENSSL_INIT_ENGINE_DASYNC already)

Fixes: 8d00e30f96fb86b20bc992f626b188c3548fc58c ("Don't try to init
dasync internally")

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
CLA: trivial

7 years agoTypo fixed
Dmitry Belyavskiy [Mon, 12 Dec 2016 12:35:09 +0000 (15:35 +0300)]
Typo fixed

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2075)

7 years agoupdated macro spacing for styling purposes
Paul Hovey [Mon, 5 Dec 2016 22:17:11 +0000 (17:17 -0500)]
updated macro spacing for styling purposes

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
CLA: trivial

7 years agofix undoes errors introduced by https://github.com/openssl/openssl/commit/fc6076ca272...
Paul Hovey [Mon, 5 Dec 2016 21:57:25 +0000 (16:57 -0500)]
fix undoes errors introduced by https://github.com/openssl/openssl/commit/fc6076ca272f74eb1364c29e6974ad5da5ef9777?diff=split#diff-1014acebaa2c13d44ca196b9a433ef2eR184

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
CLA: trivial

7 years agoRestore the ERR_FATAL_ERROR() macro
Benjamin Kaduk [Thu, 8 Dec 2016 18:01:31 +0000 (12:01 -0600)]
Restore the ERR_FATAL_ERROR() macro

Commit 0cd0a820abc6124cf8e176fa92d620a2abf9e419 removed this macro
along with many unused function and reason codes; ERR_FATAL_ERROR()
was not used in the tree, but did have external consumers.

Add it back to restore the API compatibility and avoid breaking
applications for no internal benefit.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2049)

7 years agoFix a leak in SSL_clear()
Matt Caswell [Tue, 6 Dec 2016 10:49:01 +0000 (10:49 +0000)]
Fix a leak in SSL_clear()

SSL_clear() was resetting numwpipes to 0, but not freeing any allocated
memory for existing write buffers.

Fixes #2026

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoperlasm/x86_64-xlate.pl: refine sign extension in ea package.
Andy Polyakov [Fri, 9 Dec 2016 14:26:19 +0000 (15:26 +0100)]
perlasm/x86_64-xlate.pl: refine sign extension in ea package.

$1<<32>>32 worked fine with either 32- or 64-bit perl for a good while,
relying on quirk that [pure] 32-bit perl performed it as $1<<0>>0. But
this apparently changed in some version past minimally required 5.10,
and operation result became 0. Yet, it went unnoticed for another while,
because most perl package providers configure their packages with
-Duse64bitint option.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agox86_64 assembly pack: add AVX512 ChaCha20 and Poly1305 code paths.
Andy Polyakov [Fri, 9 Dec 2016 14:55:17 +0000 (15:55 +0100)]
x86_64 assembly pack: add AVX512 ChaCha20 and Poly1305 code paths.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agopoly1305/poly1305_base2_44.c: add reference base 2^44 implementation.
Andy Polyakov [Fri, 9 Dec 2016 15:01:07 +0000 (16:01 +0100)]
poly1305/poly1305_base2_44.c: add reference base 2^44 implementation.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoAvoid the call to OPENSSL_malloc with a negative value (then casted to unsigned)
Davide Galassi [Fri, 2 Dec 2016 16:10:37 +0000 (17:10 +0100)]
Avoid the call to OPENSSL_malloc with a negative value (then casted to unsigned)

CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2021)

7 years agoFix reference to SSL_set_max_proto_version.
Markus Triska [Fri, 9 Dec 2016 17:07:09 +0000 (18:07 +0100)]
Fix reference to SSL_set_max_proto_version.

CLA: trivial
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2059)

7 years agoAdditional error tests in evp_test.c
Dr. Stephen Henson [Sat, 10 Dec 2016 13:59:29 +0000 (13:59 +0000)]
Additional error tests in evp_test.c

Support checking for errors during test initialisation and parsing.

Add errors and tests for key operation initalisation and ctrl errors.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoVMS UI_OpenSSL: generate OpenSSL errors when things go wrong.
Richard Levitte [Fri, 9 Dec 2016 22:35:53 +0000 (23:35 +0100)]
VMS UI_OpenSSL: generate OpenSSL errors when things go wrong.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2063)

7 years agoVMS UI_OpenSSL: if the TT device isn't a tty, flag instead of error
Richard Levitte [Fri, 9 Dec 2016 22:32:09 +0000 (23:32 +0100)]
VMS UI_OpenSSL: if the TT device isn't a tty, flag instead of error

On all platforms, if the controlling tty isn't an actual tty, this is
flagged by setting is_a_tty to zero...  except on VMS, where this was
treated as an error.  Change this to behave like the other platforms.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2063)

7 years agoAdd RSA PSS tests
Dr. Stephen Henson [Wed, 7 Dec 2016 23:03:47 +0000 (23:03 +0000)]
Add RSA PSS tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2065)

7 years agoCheck input length to pkey_rsa_verify()
Dr. Stephen Henson [Thu, 8 Dec 2016 12:16:02 +0000 (12:16 +0000)]
Check input length to pkey_rsa_verify()

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2065)

7 years agoUpdate client fuzz corpus
Kurt Roeckx [Fri, 9 Dec 2016 19:14:02 +0000 (20:14 +0100)]
Update client fuzz corpus

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2060

7 years agoTest framework: Add the possibility to have a test specific data dir
Richard Levitte [Mon, 5 Dec 2016 14:13:26 +0000 (15:13 +0100)]
Test framework: Add the possibility to have a test specific data dir

This data directory is formed automatically by taking the recipe name
and changing '.t' to '_data'.  Files in there can be reached with the
new function data_file()

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2027)

7 years agoUpdate client fuzzer corpus
Kurt Roeckx [Thu, 8 Dec 2016 23:56:12 +0000 (00:56 +0100)]
Update client fuzzer corpus

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2053

7 years agoRemove extra bang
Richard Levitte [Thu, 8 Dec 2016 19:51:21 +0000 (20:51 +0100)]
Remove extra bang

A bang (!) slipped through in the recent UI cleanup

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2051)

7 years agoOnly call memcpy when the length is larger than 0.
Kurt Roeckx [Thu, 8 Dec 2016 18:20:55 +0000 (19:20 +0100)]
Only call memcpy when the length is larger than 0.

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2050

7 years agoUI code style cleanup
Richard Levitte [Thu, 8 Dec 2016 17:01:04 +0000 (18:01 +0100)]
UI code style cleanup

Mostly condition check changes.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2047)

7 years agoFuzz corpora update
Kurt Roeckx [Wed, 7 Dec 2016 23:40:03 +0000 (00:40 +0100)]
Fuzz corpora update

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2041

7 years agoAnd client fuzzer
Kurt Roeckx [Wed, 7 Dec 2016 22:12:04 +0000 (23:12 +0100)]
And client fuzzer

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2041

7 years agoMake the predictable numbers start from 1
Kurt Roeckx [Wed, 7 Dec 2016 22:05:16 +0000 (23:05 +0100)]
Make the predictable numbers start from 1

There is code that retries calling RAND_bytes() until it gets something
other than 0, which just hangs if we always return 0.

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2041

7 years agoMake asn1 fuzzer more reproducible
Kurt Roeckx [Wed, 7 Dec 2016 22:04:35 +0000 (23:04 +0100)]
Make asn1 fuzzer more reproducible

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2041

7 years agoFix the declaration of tls_parse_extension in statem_locl.h
Matt Caswell [Thu, 8 Dec 2016 11:42:38 +0000 (11:42 +0000)]
Fix the declaration of tls_parse_extension in statem_locl.h

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoFix a travis failure
Matt Caswell [Thu, 8 Dec 2016 09:48:29 +0000 (09:48 +0000)]
Fix a travis failure

Travis was indicating a bogus uninit var warning. This fixes it.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoFix various indentation
Matt Caswell [Thu, 8 Dec 2016 09:44:06 +0000 (09:44 +0000)]
Fix various indentation

The indentation was a bit off in some of the perl files following the
extensions refactor.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoMove the checkhandshake.pm module into test/testlib
Matt Caswell [Thu, 8 Dec 2016 00:03:53 +0000 (00:03 +0000)]
Move the checkhandshake.pm module into test/testlib

Move this module into the same place as other test helper modules. It
simplifies the code and keeps like things together.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoFix make update issues
Matt Caswell [Wed, 7 Dec 2016 23:50:55 +0000 (23:50 +0000)]
Fix make update issues

Various functions got renamed. We need to rename the error codes too.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoFix more style issues following extensions refactor feedback
Matt Caswell [Wed, 7 Dec 2016 23:19:45 +0000 (23:19 +0000)]
Fix more style issues following extensions refactor feedback

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoIntroduce TLSEXT_STATUSTYPE_nothing constant
Matt Caswell [Wed, 7 Dec 2016 17:27:22 +0000 (17:27 +0000)]
Introduce TLSEXT_STATUSTYPE_nothing constant

The existing code used the magic number -1 to represent the absence of
a status_type in the extension. This commit replaces it with a macro.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoChange TLSEXT_IDX_* values into an enum
Matt Caswell [Wed, 7 Dec 2016 17:21:48 +0000 (17:21 +0000)]
Change TLSEXT_IDX_* values into an enum

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoVarious style updates following extensions refactor
Matt Caswell [Wed, 7 Dec 2016 17:04:46 +0000 (17:04 +0000)]
Various style updates following extensions refactor

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoFix travis mixed declarations and code error
Matt Caswell [Wed, 7 Dec 2016 12:30:52 +0000 (12:30 +0000)]
Fix travis mixed declarations and code error

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoSuppress some BoringSSL test failures
Matt Caswell [Tue, 6 Dec 2016 16:37:31 +0000 (16:37 +0000)]
Suppress some BoringSSL test failures

The external BoringSSL tests had some failures as a result of
the extensions refactor. This was due to a deliberate relaxation
of the duplicate extensions checking code. We now only check
known extensions for duplicates. Unknown extensions are ignored.
This is allowed behaviour, so we suppress those BoringSSL tests.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoCorrect imports for checkhandshake module
Matt Caswell [Tue, 6 Dec 2016 15:37:18 +0000 (15:37 +0000)]
Correct imports for checkhandshake module

Ensure the tests can find the checkhandshake module on all platforms

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoFix a memory leak
Matt Caswell [Mon, 5 Dec 2016 17:31:37 +0000 (17:31 +0000)]
Fix a memory leak

When we call tls_collect_extensions() we need to free up the raw
extensions data later.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd some extra key_share tests
Matt Caswell [Thu, 1 Dec 2016 12:54:44 +0000 (12:54 +0000)]
Add some extra key_share tests

Check that the extension framework properly handles extensions specific
to a protocol version

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoRemove some spurious whitespace
Matt Caswell [Wed, 30 Nov 2016 13:46:11 +0000 (13:46 +0000)]
Remove some spurious whitespace

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd a renegotiation test
Matt Caswell [Wed, 30 Nov 2016 12:54:01 +0000 (12:54 +0000)]
Add a renegotiation test

Make sure we did not break the unsafe legacy reneg checks with the extension
work.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd more extension tests to test_sslmessages
Matt Caswell [Wed, 30 Nov 2016 12:04:34 +0000 (12:04 +0000)]
Add more extension tests to test_sslmessages

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoMerge common code between test_tls13messages and test_sslmessages
Matt Caswell [Tue, 29 Nov 2016 17:34:10 +0000 (17:34 +0000)]
Merge common code between test_tls13messages and test_sslmessages

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd extension tests in test_sslmessages
Matt Caswell [Tue, 29 Nov 2016 15:57:42 +0000 (15:57 +0000)]
Add extension tests in test_sslmessages

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoEnable status_request test in test_sslmessages
Matt Caswell [Tue, 29 Nov 2016 14:56:06 +0000 (14:56 +0000)]
Enable status_request test in test_sslmessages

The s_server option -status_file has been added so this test can be
enabled.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoFix a bug in TLSProxy where zero length messages were not being recorded
Matt Caswell [Tue, 22 Nov 2016 16:16:23 +0000 (16:16 +0000)]
Fix a bug in TLSProxy where zero length messages were not being recorded

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd a test to check messsages sent are the ones we expect
Matt Caswell [Tue, 22 Nov 2016 16:16:11 +0000 (16:16 +0000)]
Add a test to check messsages sent are the ones we expect

Repeat for various handshake types

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoSupport renegotiation in TLSProxy
Matt Caswell [Tue, 22 Nov 2016 13:43:50 +0000 (13:43 +0000)]
Support renegotiation in TLSProxy

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd tests for new extension code
Matt Caswell [Mon, 28 Nov 2016 22:39:23 +0000 (22:39 +0000)]
Add tests for new extension code

Extend test_tls13messages to additionally check the expected extensions
under different options given to s_client/s_server.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoSplit ServerHello extensions
Matt Caswell [Mon, 28 Nov 2016 16:45:52 +0000 (16:45 +0000)]
Split ServerHello extensions

In TLS1.3 some ServerHello extensions remain in the ServerHello, while
others move to the EncryptedExtensions message. This commit performs that
move.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoMove ServerHello extension parsing into the new extension framework
Matt Caswell [Mon, 28 Nov 2016 16:15:51 +0000 (16:15 +0000)]
Move ServerHello extension parsing into the new extension framework

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAvoid repeatedly scanning the list of extensions
Matt Caswell [Mon, 28 Nov 2016 09:31:59 +0000 (09:31 +0000)]
Avoid repeatedly scanning the list of extensions

Because extensions were keyed by type which is sparse, we were continually
scanning the list to find the one we wanted. The way we stored them also
had the side effect that we were running initialisers/finalisers in a
different oder to the parsers. In this commit we change things so that we
instead key on an index value for each extension.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoSimplify ClientHello extension parsing
Matt Caswell [Sat, 26 Nov 2016 11:45:02 +0000 (11:45 +0000)]
Simplify ClientHello extension parsing

Remove some functions that are no longer needed now that we have the new
extension framework.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoMove ALPN processing into an extension finalisation function
Matt Caswell [Sat, 26 Nov 2016 11:22:50 +0000 (11:22 +0000)]
Move ALPN processing into an extension finalisation function

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoProvide server side extension init and finalisation functions
Matt Caswell [Fri, 25 Nov 2016 23:19:56 +0000 (23:19 +0000)]
Provide server side extension init and finalisation functions

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd an extension initilisation and finalisation capability
Matt Caswell [Fri, 25 Nov 2016 17:52:35 +0000 (17:52 +0000)]
Add an extension initilisation and finalisation capability

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoMove client construction of ClientHello extensions into new framework
Matt Caswell [Fri, 25 Nov 2016 16:28:02 +0000 (16:28 +0000)]
Move client construction of ClientHello extensions into new framework

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoMove client parsing of ServerHello extensions into new framework
Matt Caswell [Fri, 25 Nov 2016 12:34:29 +0000 (12:34 +0000)]
Move client parsing of ServerHello extensions into new framework

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoRename some functions
Matt Caswell [Fri, 25 Nov 2016 10:34:35 +0000 (10:34 +0000)]
Rename some functions

The _clienthello_ in the extensions parsing functions is overly specific.
Better to keep the convention to just _client_

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoMove ServerHello extension construction into the new extensions framework
Matt Caswell [Fri, 25 Nov 2016 10:22:02 +0000 (10:22 +0000)]
Move ServerHello extension construction into the new extensions framework

This lays the foundation for a later move to have the extensions built and
placed into the correct message for TLSv1.3 (e.g. ServerHello or
EncryptedExtensions).

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoSplit extensions code into core extensions and server extensions code
Matt Caswell [Thu, 24 Nov 2016 22:54:59 +0000 (22:54 +0000)]
Split extensions code into core extensions and server extensions code

Later we will have client extensions code too.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd extensions construction support
Matt Caswell [Thu, 24 Nov 2016 18:25:10 +0000 (18:25 +0000)]
Add extensions construction support

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoContinue the extensions refactor
Matt Caswell [Thu, 24 Nov 2016 18:02:12 +0000 (18:02 +0000)]
Continue the extensions refactor

Add support for construction of extensions

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoRefactor ClientHello extension parsing
Matt Caswell [Thu, 24 Nov 2016 16:59:48 +0000 (16:59 +0000)]
Refactor ClientHello extension parsing

This builds on the work started in 1ab3836b3 and extends is so that
each extension has its own identified parsing functions, as well as an
allowed context identifying which messages and protocols it is relevant for.
Subsequent commits will do a similar job for the ServerHello extensions.
This will enable us to have common functions for processing extension blocks
no matter which of the multiple messages they are received from. In TLSv1.3
a number of different messages have extension blocks, and some extensions
have moved from one message to another when compared to TLSv1.2.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoVerify that extensions are used in the correct context
Matt Caswell [Thu, 24 Nov 2016 11:14:56 +0000 (11:14 +0000)]
Verify that extensions are used in the correct context

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd some missing extensions to SSL_extension_supported()
Matt Caswell [Thu, 24 Nov 2016 11:13:35 +0000 (11:13 +0000)]
Add some missing extensions to SSL_extension_supported()

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoMove tls_collect_extensions() into a separate file
Matt Caswell [Wed, 23 Nov 2016 17:38:31 +0000 (17:38 +0000)]
Move tls_collect_extensions() into a separate file

Subsequent commits will pull other extensions code into this file.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd EncryptedExtensions message
Matt Caswell [Wed, 23 Nov 2016 15:20:22 +0000 (15:20 +0000)]
Add EncryptedExtensions message

At this stage the message is just empty. We need to fill it in with
extension data.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoSend and Receive a TLSv1.3 format ServerHello
Matt Caswell [Mon, 7 Nov 2016 13:50:43 +0000 (13:50 +0000)]
Send and Receive a TLSv1.3 format ServerHello

There are some minor differences in the format of a ServerHello in TLSv1.3.

Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich
Salz

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoUI_OpenSSL()'s session opener fails on MacOS X
Richard Levitte [Wed, 7 Dec 2016 19:28:43 +0000 (20:28 +0100)]
UI_OpenSSL()'s session opener fails on MacOS X

If on a non-tty stdin, TTY_get() will fail with errno == ENODEV.
We didn't catch that.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2039)

7 years agoIn UI_OpenSSL's open(), generate an error on unknown errno
Richard Levitte [Thu, 8 Dec 2016 10:16:37 +0000 (11:16 +0100)]
In UI_OpenSSL's open(), generate an error on unknown errno

TTY_get() sometimes surprises us with new errno values to determine if
we have a controling terminal or not.  This generated error is a
helpful tool to figure out that this was what happened and what the
unknown value is.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2043)

7 years agoMake sure that password_callback exercises UI
Richard Levitte [Thu, 8 Dec 2016 00:27:31 +0000 (01:27 +0100)]
Make sure that password_callback exercises UI

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2040)

7 years agoAdd a test for the UI API
Richard Levitte [Wed, 7 Dec 2016 21:44:47 +0000 (22:44 +0100)]
Add a test for the UI API

The best way to test the UI interface is currently by using an openssl
command that uses password_callback.  The only one that does this is
'genrsa'.
Since password_callback uses a UI method derived from UI_OpenSSL(), it
ensures that one gets tested well enough as well.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2040)

7 years agoUI_process() didn't generate errors
Richard Levitte [Wed, 7 Dec 2016 15:36:44 +0000 (16:36 +0100)]
UI_process() didn't generate errors

Since there are many parts of UI_process() that can go wrong, it isn't
very helpful to only return -1 with no further explanation.  With this
change, the error message will at least show which part went wrong.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2037)

7 years agoAlso set the CXXFLAG to the user supplied flags
Kurt Roeckx [Sat, 3 Dec 2016 15:57:04 +0000 (16:57 +0100)]
Also set the CXXFLAG to the user supplied flags

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2025