Rich Salz [Fri, 3 Mar 2017 00:16:57 +0000 (19:16 -0500)]
sh_malloc & sh_free prototype change to match POSIX
CLA: trivial
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2823)
Matt Caswell [Fri, 3 Mar 2017 00:03:47 +0000 (00:03 +0000)]
Silence some more clang warnings
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2832)
Matt Caswell [Thu, 2 Mar 2017 23:53:30 +0000 (23:53 +0000)]
Silence some clang warnings
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2831)
Matt Caswell [Thu, 2 Mar 2017 17:40:43 +0000 (17:40 +0000)]
More early data documentation updates following feedback
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 2 Mar 2017 16:05:02 +0000 (16:05 +0000)]
Update the API documentation for the latest early data changes
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 2 Mar 2017 15:49:33 +0000 (15:49 +0000)]
Update early data API for writing to unauthenticated clients
Change the early data API so that the server must use
SSL_write_early_data() to write to an unauthenticated client.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 2 Mar 2017 15:05:36 +0000 (15:05 +0000)]
Rename SSL_write_early() to SSL_write_early_data()
This is for consistency with the rest of the API where all the functions
are called *early_data*.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 2 Mar 2017 14:42:55 +0000 (14:42 +0000)]
Rename SSL_read_early() to SSL_read_early_data()
This is for consistency with the rest of the API where all the functions
are called *early_data*.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Tue, 28 Feb 2017 00:40:24 +0000 (00:40 +0000)]
Updates to the early data documentation
Following on from the latest API changes.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Mon, 27 Feb 2017 20:55:04 +0000 (20:55 +0000)]
Updates to s_server and s_client for the latest early_data API changes
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Mon, 27 Feb 2017 20:54:39 +0000 (20:54 +0000)]
Make SSL_write_early_finish() an internal only function
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Mon, 27 Feb 2017 11:20:22 +0000 (11:20 +0000)]
Add early_data tests
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Mon, 27 Feb 2017 11:19:57 +0000 (11:19 +0000)]
Various fixes required to allow SSL_write/SSL_read during early data
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Sat, 25 Feb 2017 15:59:44 +0000 (15:59 +0000)]
Enable the server to call SSL_write() without stopping the ability to call SSL_read_early()
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Sat, 25 Feb 2017 15:34:07 +0000 (15:34 +0000)]
Enable the client to call SSL_read() without stopping the ability to call SSL_write_early()
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Sat, 25 Feb 2017 00:06:49 +0000 (00:06 +0000)]
Introduce a new early_data state in the state machine
Also simplifies the state machine a bit.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 17:08:41 +0000 (17:08 +0000)]
Improve the early data sanity check in SSL_do_handshake()
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 16:17:00 +0000 (16:17 +0000)]
Add documentation for the new s_client and s_server early_data options
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 16:11:03 +0000 (16:11 +0000)]
Tighten sanity checks when calling early data functions
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 15:38:38 +0000 (15:38 +0000)]
Add documentation for the early data functions
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 14:17:41 +0000 (14:17 +0000)]
Make SSL_get_early_data_status() take a const
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 14:08:59 +0000 (14:08 +0000)]
Make SSL_get_max_early_data() and SSL_CTX_get_max_early_data() take a const
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 14:08:06 +0000 (14:08 +0000)]
Add a SSL_SESSION_get_max_early_data() function
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 13:51:04 +0000 (13:51 +0000)]
Don't attempt to write more early_data than we know the server will accept
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 12:45:37 +0000 (12:45 +0000)]
Only accept early_data if the negotiated ALPN is the same
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 11:40:49 +0000 (11:40 +0000)]
Skip early_data if appropriate after a HelloRetryRequest
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 11:13:25 +0000 (11:13 +0000)]
Don't accept early_data if we are going to issue a HelloRetryRequest
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 10:29:20 +0000 (10:29 +0000)]
Add extra validation parsing the server-to-client early_data extension
Check that we actually resumed the session, and that we selected the first
identity.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 09:34:32 +0000 (09:34 +0000)]
Remove some TLSv1.3 TODOs that are no longer relevant
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 24 Feb 2017 09:30:54 +0000 (09:30 +0000)]
Validate the ticket age for resumed sessions
If the ticket age calcualtions do not check out then we must not accept
early data (it could be a replay).
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 23 Feb 2017 16:54:11 +0000 (16:54 +0000)]
Ensure the max_early_data option to s_server can be 0
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 23 Feb 2017 16:41:15 +0000 (16:41 +0000)]
Provide a default value for max_early_data
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 23 Feb 2017 14:29:36 +0000 (14:29 +0000)]
Check max_early_data against the amount of early data we actually receive
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 23 Feb 2017 16:05:57 +0000 (16:05 +0000)]
Make sure we reset the read sequence when skipping records
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 23 Feb 2017 12:36:35 +0000 (12:36 +0000)]
Disallow handshake messages in the middle of early_data
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 23 Feb 2017 12:25:21 +0000 (12:25 +0000)]
Fix seg fault when sending early_data using CCM ciphersuites
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 23 Feb 2017 11:52:43 +0000 (11:52 +0000)]
Get s_client to report on whether early data was accepted or not
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Thu, 23 Feb 2017 11:53:12 +0000 (11:53 +0000)]
Implement client side parsing of the early_data extension
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Wed, 22 Feb 2017 15:24:11 +0000 (15:24 +0000)]
Add a "-early_data" option to s_server
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Wed, 22 Feb 2017 14:09:42 +0000 (14:09 +0000)]
Fix changing of the cipher state when dealing with early data
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Wed, 22 Feb 2017 13:01:48 +0000 (13:01 +0000)]
Construct the server side early_data extension
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Tue, 21 Feb 2017 17:14:42 +0000 (17:14 +0000)]
Provide an SSL_read_early() function for reading early data
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Tue, 21 Feb 2017 16:40:16 +0000 (16:40 +0000)]
Change the cipher state when sending early data
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Tue, 21 Feb 2017 16:39:43 +0000 (16:39 +0000)]
Implement the early data changes required in tls13_change_cipher_state()
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Mon, 20 Feb 2017 16:00:20 +0000 (16:00 +0000)]
Add an option to s_client to send early_data
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Mon, 20 Feb 2017 16:35:03 +0000 (16:35 +0000)]
Parse the early_data extension
We also skip any early_data that subsequently gets sent. Later commits will
process it if we can.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Mon, 20 Feb 2017 15:44:42 +0000 (15:44 +0000)]
Construct the early_data extension
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Tue, 21 Feb 2017 09:22:22 +0000 (09:22 +0000)]
Provide functions to write early data
We provide SSL_write_early() which *must* be called first on a connection
(prior to any other IO function including SSL_connect()/SSL_do_handshake()).
Also SSL_write_early_finish() which signals the end of early data.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Mon, 20 Feb 2017 14:56:51 +0000 (14:56 +0000)]
Parse the ticket_early_data_info extension
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 17 Feb 2017 17:41:46 +0000 (17:41 +0000)]
Teach SSL_trace() about the early_data_info extension
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 17 Feb 2017 17:01:16 +0000 (17:01 +0000)]
Add a -max_early_data option to s_server
Allows you to set the number of bytes that can be sent as early data
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Matt Caswell [Fri, 17 Feb 2017 16:52:12 +0000 (16:52 +0000)]
Construct the ticket_early_data_info extension
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)
Rich Salz [Thu, 2 Mar 2017 15:07:21 +0000 (10:07 -0500)]
Remove ref to err(7), update copyright.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2825)
Richard Levitte [Thu, 2 Mar 2017 17:27:17 +0000 (18:27 +0100)]
-precert doesn't work when configured no-ct, don't try to test it then
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2827)
Richard Levitte [Thu, 2 Mar 2017 17:26:26 +0000 (18:26 +0100)]
Fix the skip numbers in 80-test_ca.t
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2827)
Matt Caswell [Thu, 2 Mar 2017 13:41:10 +0000 (13:41 +0000)]
Use the built in boolean type for CompressionExpected
Don't create a custom boolean type for parsing CompressionExpected. Use
the existing one instead.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2814)
Matt Caswell [Wed, 1 Mar 2017 12:11:51 +0000 (12:11 +0000)]
Add compression tests
Check whether we negotiate compression in various scenarios.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2814)
Matt Caswell [Wed, 1 Mar 2017 11:20:30 +0000 (11:20 +0000)]
Fix a compression bug
do_ssl3_write() was crashing when compression was enabled. We calculate
the maximum length that a record will be after compression and reserve
those bytes in the WPACKET. Unfortunately we were adding the maximum
compression overhead onto the wrong variable resulting in a corrupted
record.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2814)
Matt Caswell [Wed, 1 Mar 2017 10:36:38 +0000 (10:36 +0000)]
Ensure that we never select compression in TLSv1.3
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2814)
Robert Scheck [Sun, 26 Feb 2017 23:44:14 +0000 (00:44 +0100)]
Add LDAP support (RFC 4511) to s_client ("-starttls ldap")
Based on initial patch by Alex Bergmann <alex@linlab.net> and new function
ldap_ExtendedResponse_parse() by Andy Polyakov <appro@openssl.org>. Thanks
very much to both.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2293)
Andy Polyakov [Wed, 1 Mar 2017 20:40:02 +0000 (21:40 +0100)]
Configurations/10-main.conf: omit redundant -lresolv from Solaris configs.
GH#2816
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Wed, 1 Mar 2017 20:28:05 +0000 (21:28 +0100)]
bio/b_addr.c: omit private hstrerror.
Private hstrerror was introduced to address linking problem on HP-UX,
but truth be told conemporary systems, HP-UX included, wouldn't come
to that call, they would use getaddrinfo and gai_strerror, while
gethostbyname and h_errno are there to serve legacy systems. Since
legacy systems are naturally disappearing breed, we can as well just
let user interpret number.
GH#2816
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Wed, 1 Mar 2017 10:41:09 +0000 (11:41 +0100)]
aes/aes_x86core.c: clarify reference implementation status.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Wed, 1 Mar 2017 10:40:41 +0000 (11:40 +0100)]
evp/e_aes_cbc_hmac_{sha1|sha256}.c: tag reference code.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Sun, 26 Feb 2017 20:37:50 +0000 (21:37 +0100)]
CHANGES: mention CFI annotations.
[skip ci]
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Tue, 28 Feb 2017 22:25:36 +0000 (23:25 +0100)]
bn/asm: clean up unused PA-RISC modules.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Tue, 28 Feb 2017 21:54:28 +0000 (22:54 +0100)]
des/des_locl.h: clean up unused/irrelevant macros.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Jon Spillett [Thu, 2 Mar 2017 02:54:06 +0000 (12:54 +1000)]
Check for zero records and return immediately
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2822)
Andy Polyakov [Wed, 1 Mar 2017 13:33:34 +0000 (14:33 +0100)]
appveyor.yml: streamline pull requests.
For pull requests not tagged with [extended tests]:
- short-curcuit most expensive fuzz and install tests;
- skip over non-shared builds;
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2810)
Andy Polyakov [Wed, 1 Mar 2017 13:32:25 +0000 (14:32 +0100)]
Configurations/50-masm.conf: add /nologo to ml64 command line.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2810)
Richard Levitte [Wed, 1 Mar 2017 22:43:03 +0000 (23:43 +0100)]
Add NOTES.UNIX, with a description on how to deal with runpaths
[skip ci]
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2818)
Bernd Edlinger [Tue, 21 Feb 2017 05:58:04 +0000 (06:58 +0100)]
Check that async_jobs is not negative and not too high.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2693)
Andy [Wed, 1 Mar 2017 01:07:01 +0000 (01:07 +0000)]
Code health: ssl/ssl_locl.h unused macros
CLA: trivial
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2806)
Richard Levitte [Wed, 1 Mar 2017 09:33:20 +0000 (10:33 +0100)]
VMS: compensate for gmtime_r() parameter pointer size
With VMS C, the second parameter takes a 32-bit pointer. When
building with 64-bit pointer size default, we must compensate.
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2811)
Richard Levitte [Wed, 1 Mar 2017 09:48:34 +0000 (10:48 +0100)]
Don't use deprecated EVP_CIPHER_CTX_cleanup() internally
Use EVP_CIPHER_CTX_reset() instead
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2812)
Emilia Kasper [Tue, 28 Feb 2017 13:13:40 +0000 (14:13 +0100)]
Remove some obsolete/obscure internal define switches:
- FLAT_INC
- PKCS1_CHECK (the SSL_OP_PKCS1_CHECK options have been
no-oped)
- PKCS_TESTVECT (debugging leftovers)
- SSL_AD_MISSING_SRP_USERNAME (unfinished feature)
- DTLS_AD_MISSING_HANDSHAKE_MESSAGE (unfinished feature)
- USE_OBJ_MAC (note this removes a define from the public header but
very unlikely someone would be depending on it)
- SSL_FORBID_ENULL
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Benjamin Kaduk [Tue, 28 Feb 2017 22:32:51 +0000 (16:32 -0600)]
Remove OPENSSL_indirect_call()
It's undocumented and unused in the tree. The idea seems to have
never gained much traction, and can be removed without breaking
ABI compatibility.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2800)
Benjamin Kaduk [Tue, 28 Feb 2017 22:09:53 +0000 (16:09 -0600)]
Don't free in cleanup routine
Cleanse instead, and free in the free routine.
Seems to have been introduced in commit
846ec07d904f9cc81d486db0db14fb84f61ff6e5 when EVP_CIPHER_CTX was made
opaque.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2798)
Andy Polyakov [Tue, 28 Feb 2017 13:15:30 +0000 (14:15 +0100)]
crypto/des: remove unreferenced rcp_enc.c module.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
Richard Levitte [Tue, 28 Feb 2017 17:24:02 +0000 (18:24 +0100)]
Code health: Remove base address setting for mingw
Base address setting was done for the sake of FIPS. Since FIPS references
have been removed, we clean away this one as well.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2791)
Bernd Edlinger [Tue, 28 Feb 2017 08:48:32 +0000 (09:48 +0100)]
Fix handling of EVP_PKEY_CTRL_PKCS7_ENCRYPT/DECRYPT with OPENSSL_NO_CMS.
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2764)
Benjamin Kaduk [Thu, 23 Feb 2017 22:22:10 +0000 (16:22 -0600)]
Add AGL's "beer mug" PEM file as another test input
AGL has a history of pointing out the idiosynchronies/laxness of the
openssl PEM parser in amusing ways. If we want this functionality to
stay present, we should test that it works.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2756)
Benjamin Kaduk [Thu, 23 Feb 2017 20:28:32 +0000 (14:28 -0600)]
Add test corpus for PEM reading
Generate a fresh certificate and DSA private key in their respective PEM
files. Modify the resulting ASCII in various ways so as to produce input
files that might be generated by non-openssl programs (openssl always
generates "standard" PEM files, with base64 data in 64-character lines
except for a possible shorter last line).
Exercise various combinations of line lengths, leading/trailing
whitespace, non-base64 characters, comments, and padding, for both
unencrypted and encrypted files. (We do not have any other test coverage
that uses encrypted files, as far as I can see, and the parser enforces
different rules for the body of encrypted files.)
Add a recipe to parse these test files and verify that they contain the
expected string or are rejected, according to the expected status.
Some of the current behavior is perhaps suboptimal and could be revisited.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2756)
Richard Levitte [Tue, 28 Feb 2017 16:36:02 +0000 (17:36 +0100)]
Code health: Quick note in changes and the OPENSSL_GLOBAL et al changes
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2785)
Richard Levitte [Tue, 28 Feb 2017 16:27:20 +0000 (17:27 +0100)]
Code health: With the VAX C-ism gone, OPENSSL_GLOBAL can be removed too
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2785)
Richard Levitte [Tue, 28 Feb 2017 15:43:09 +0000 (16:43 +0100)]
Code health: Remove another VAX C-ism, globaldef and globalref
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2785)
Richard Levitte [Tue, 28 Feb 2017 19:00:56 +0000 (20:00 +0100)]
Code health: make update
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2793)
Richard Levitte [Tue, 28 Feb 2017 19:00:42 +0000 (20:00 +0100)]
Code health: Remove VAX exceptions in util/mkdef.pl
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2793)
Richard Levitte [Tue, 28 Feb 2017 18:57:33 +0000 (19:57 +0100)]
Code health: Remove unused VAX transfer vector for engines
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2793)
Rich Salz [Tue, 28 Feb 2017 15:53:28 +0000 (10:53 -0500)]
Exdata test was never enabled.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2787)
Emilia Kasper [Tue, 28 Feb 2017 17:12:25 +0000 (18:12 +0100)]
Remove memcpy unrolling in bn_lib.c
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Emilia Kasper [Tue, 28 Feb 2017 15:53:35 +0000 (16:53 +0100)]
Remove support for HMAC_TEST_PRIVATE_KEY_FORMAT
This is a bogus, undocumented format that was intended for testing; I
don't think anyone is using it.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Rich Salz [Tue, 28 Feb 2017 17:08:54 +0000 (12:08 -0500)]
Remove GENCB_TEST compile flag
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2790)
Matt Caswell [Tue, 28 Feb 2017 15:53:55 +0000 (15:53 +0000)]
Fix test_ssl_new when compiled with no-tls1_2 or no-dtls1_2
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2788)
Matt Caswell [Tue, 28 Feb 2017 15:53:35 +0000 (15:53 +0000)]
Fix sslapitest when compiled with no-tls1_2
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2788)
Dr. Stephen Henson [Tue, 28 Feb 2017 15:58:46 +0000 (15:58 +0000)]
Revert rc4test removal, it performs additional tests not in evptests.txt
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2789)
Matt Caswell [Tue, 28 Feb 2017 12:47:42 +0000 (12:47 +0000)]
Remove some commented out code in the tests
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2774)
Matt Caswell [Tue, 28 Feb 2017 12:47:22 +0000 (12:47 +0000)]
Remove some commented out code in libssl
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2774)
Matt Caswell [Tue, 28 Feb 2017 14:55:35 +0000 (14:55 +0000)]
Remove some commented out code in libcrypto
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2774)
Matt Caswell [Tue, 28 Feb 2017 12:46:56 +0000 (12:46 +0000)]
Remove some commented out code in the apps
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2774)