oweals/openssl.git
8 years agoDeal with DSA_SIG opaqueness.
Ben Laurie [Sat, 12 Mar 2016 17:41:03 +0000 (17:41 +0000)]
Deal with DSA_SIG opaqueness.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoPrepare for 1.1.0-pre5-dev
Richard Levitte [Wed, 16 Mar 2016 17:21:46 +0000 (18:21 +0100)]
Prepare for 1.1.0-pre5-dev

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoPrepare for 1.1.0-pre4 release OpenSSL_1_1_0-pre4
Richard Levitte [Wed, 16 Mar 2016 17:21:17 +0000 (18:21 +0100)]
Prepare for 1.1.0-pre4 release

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoSome platforms provide getcontext() but it does not work
Matt Caswell [Wed, 16 Mar 2016 10:38:39 +0000 (10:38 +0000)]
Some platforms provide getcontext() but it does not work

Some platforms claim to be POSIX but their getcontext() implementation
does not work. Therefore we update the ASYNC_is_capable() function to test
for this.

RT#4366

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoWhen building DLLs, hack the library name in the .def file
Richard Levitte [Wed, 16 Mar 2016 15:50:18 +0000 (16:50 +0100)]
When building DLLs, hack the library name in the .def file

util/mkdef.pl assumes it knows what the resulting library name will
be.  Really, it shouldn't, but changing it will break classic native
Windows builds, so we leave it for now and change the LIBRARY line
externally when needed instead.

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoDLL object files should not be built with /Zl"
Richard Levitte [Wed, 16 Mar 2016 14:32:44 +0000 (15:32 +0100)]
DLL object files should not be built with /Zl"

When building the DLLs, we depend on the correct default C RTL info.

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoAppveyor - make sure to actually build "shared" in the shared configuration
Richard Levitte [Wed, 16 Mar 2016 13:58:17 +0000 (14:58 +0100)]
Appveyor - make sure to actually build "shared" in the shared configuration

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoFix up CHANGES
Emilia Kasper [Wed, 16 Mar 2016 14:06:01 +0000 (15:06 +0100)]
Fix up CHANGES

- Remove duplicate entry
- Add author for SSL_CIPHER query functions
- Note HKDF support in CHANGES and NEWS

[ci skip]

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoWe should use $SRCDIR in Makefiles
Matt Caswell [Wed, 16 Mar 2016 11:16:11 +0000 (11:16 +0000)]
We should use $SRCDIR in Makefiles

Normally we always refer to source files relative to $SRCDIR in Makefiles.
However the reference to unix-Makefile.tmpl was using a fully expanded
absolute path. This can cause problems for Mingw.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoDisable AFALG when cross-compiling
Matt Caswell [Wed, 16 Mar 2016 10:08:53 +0000 (10:08 +0000)]
Disable AFALG when cross-compiling

We don't currently support cross-compiling of the afalg engine. However
we were failing to explicitly mark it as disabled during Configure leading
to a failed build.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix a TLSProxy race condition
Matt Caswell [Tue, 15 Mar 2016 16:44:26 +0000 (16:44 +0000)]
Fix a TLSProxy race condition

TLSProxy starts s_server and specifies the number of client connects
it should expect. After that s_server is supposed to close down
automatically. However, if another test is then run then TLSProxy
will start a new instance of s_server. If the previous instance
hasn't closed down yet then the new instance can fail to bind to
the socket.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agopoly1305/asm/poly1305-x86_64.pl: make it work with linux-x32.
Andy Polyakov [Tue, 15 Mar 2016 22:39:07 +0000 (23:39 +0100)]
poly1305/asm/poly1305-x86_64.pl: make it work with linux-x32.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoOn Windows, page walking is known as __chkstk.
Emilia Kasper [Tue, 15 Mar 2016 22:04:14 +0000 (23:04 +0100)]
On Windows, page walking is known as __chkstk.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoExplain *cough*-dows
Emilia Kasper [Tue, 15 Mar 2016 20:52:31 +0000 (21:52 +0100)]
Explain *cough*-dows

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoMake the perl dependency post-processor into just one line
Richard Levitte [Tue, 15 Mar 2016 21:16:35 +0000 (22:16 +0100)]
Make the perl dependency post-processor into just one line

Make doesn't always treat multiline quoted strings as nicely as one
would wish.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoNot all shells understand !
Richard Levitte [Tue, 15 Mar 2016 08:05:20 +0000 (09:05 +0100)]
Not all shells understand !

In unix-Makefile.tmpl, this construction has been used a few times

if ! something; then ...

It seems, though, that some shells do not understand !, so these need
to be changed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoGeneral verify options to openssl ts
fbroda [Tue, 15 Mar 2016 09:08:49 +0000 (10:08 +0100)]
General verify options to openssl ts

This commit adds the general verify options of ocsp, verify,
cms, etc. to the openssl timestamping app as suggested by
Stephen N. Henson in [openssl.org #4287]. The conflicting
"-policy" option of "openssl ts" has been renamed to
"-tspolicy". Documentation and tests have been updated.

CAVE: This will break code, which currently uses the "-policy"
option.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix CRYPTO_THREAD_run_once return value checks
Emilia Kasper [Tue, 15 Mar 2016 14:37:51 +0000 (15:37 +0100)]
Fix CRYPTO_THREAD_run_once return value checks

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoCygwin configs were missing thread_scheme settings, add them
Richard Levitte [Tue, 15 Mar 2016 14:30:43 +0000 (15:30 +0100)]
Cygwin configs were missing thread_scheme settings, add them

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoSmall typo
Richard Levitte [Tue, 15 Mar 2016 13:06:34 +0000 (14:06 +0100)]
Small typo

OPENSSL_INIT_ONCE and OPENSSL_INIT_ONCE_STATIC_INIT are really
CRYPTO_ONCE and CRYPTO_ONCE_STATIC_INIT.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agostatic-engine is no longer an internal keyword, remove it from %disabled
Richard Levitte [Tue, 15 Mar 2016 13:05:35 +0000 (14:05 +0100)]
static-engine is no longer an internal keyword, remove it from %disabled

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoClarify NOTES.WIN.
Andy Polyakov [Mon, 14 Mar 2016 17:04:21 +0000 (18:04 +0100)]
Clarify NOTES.WIN.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoUpdate and clarify ECDSA documentation.
Dr. Stephen Henson [Mon, 14 Mar 2016 16:45:51 +0000 (16:45 +0000)]
Update and clarify ECDSA documentation.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoDisable afalg when engine is disabled.
Emilia Kasper [Mon, 14 Mar 2016 11:21:44 +0000 (12:21 +0100)]
Disable afalg when engine is disabled.

Also make it possible to disable afalg separately.

we still need to update config again

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix typo in manual, missing ending '>'
Richard Levitte [Mon, 14 Mar 2016 15:52:54 +0000 (16:52 +0100)]
Fix typo in manual, missing ending '>'

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoTravis: build tests in BUILDONLY mode
Emilia Kasper [Mon, 14 Mar 2016 11:47:47 +0000 (12:47 +0100)]
Travis: build tests in BUILDONLY mode

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoconfig: fix HP-UX PA-RISC detection.
Andy Polyakov [Mon, 14 Mar 2016 12:42:48 +0000 (13:42 +0100)]
config: fix HP-UX PA-RISC detection.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agos390x assembly pack: 32-bit fixups.
Andy Polyakov [Fri, 11 Mar 2016 15:47:02 +0000 (16:47 +0100)]
s390x assembly pack: 32-bit fixups.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agobuild.info/Makefile.in: Itanium fixups.
Andy Polyakov [Sun, 13 Mar 2016 20:54:49 +0000 (21:54 +0100)]
build.info/Makefile.in: Itanium fixups.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoengines/Makefile.in: some [older] shell complain about 'for i ;',
Andy Polyakov [Sun, 13 Mar 2016 20:49:15 +0000 (21:49 +0100)]
engines/Makefile.in: some [older] shell complain about 'for i ;',
but not if there is reference to empty variable.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix the init cleanup order
Matt Caswell [Mon, 14 Mar 2016 10:34:59 +0000 (10:34 +0000)]
Fix the init cleanup order

There are internal dependencies between the various cleanup functions.
This re-orders things to try and get that right.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoAdd some missing cleanup calls to de-init
Matt Caswell [Mon, 14 Mar 2016 10:26:28 +0000 (10:26 +0000)]
Add some missing cleanup calls to de-init

OBJ_cleanup() doesn't always get called from EVP_cleanup() so needs to be
explicitly called in de-init. Also BIO_sock_cleanup() also needs to be
called.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix freeze in config's interrupt trap with some shells
Richard Levitte [Sun, 13 Mar 2016 10:31:04 +0000 (11:31 +0100)]
Fix freeze in config's interrupt trap with some shells

With bash and zsh, the trap on the 5 second read does respond, but
doesn't break out of the read.  What's worse is that it takes away the
5 second timer, and therefore has the read hang indefinitely and
(almost) unbreakable.

Having the trap do 'exit 0' after reseting the tty params has it break
out of read and continue with the configuration.

Other shells do not appear to have the issue described here, but
neither does the extra 'exit 0' appear to harm them.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoEnforce the demand for Perl 5.10.0 as a minimum.
Richard Levitte [Mon, 14 Mar 2016 09:03:14 +0000 (10:03 +0100)]
Enforce the demand for Perl 5.10.0 as a minimum.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoFix a few Configure errors
Richard Levitte [Mon, 14 Mar 2016 09:02:13 +0000 (10:02 +0100)]
Fix a few Configure errors

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoDocument X509_get_serialNumber and X509_set_serialNumber.
Dr. Stephen Henson [Mon, 14 Mar 2016 00:23:13 +0000 (00:23 +0000)]
Document X509_get_serialNumber and X509_set_serialNumber.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoAdd EVP_PKEY documentation.
Dr. Stephen Henson [Sun, 13 Mar 2016 15:49:09 +0000 (15:49 +0000)]
Add EVP_PKEY documentation.

Document EVP_PKEY_id() and EVP_PKEY_base_id().

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoChange an function macro for ERR match the function it's used in.
Richard Levitte [Sun, 13 Mar 2016 13:54:51 +0000 (14:54 +0100)]
Change an function macro for ERR match the function it's used in.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
8 years agoComplete incomplete makefile variable referenses
Richard Levitte [Sun, 13 Mar 2016 10:07:12 +0000 (11:07 +0100)]
Complete incomplete makefile variable referenses

A couple of '$(PERLASM_SCHEM' had sneaked in.

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoCollect the names of generated files and clean them away at target clean:
Richard Levitte [Sat, 12 Mar 2016 11:42:49 +0000 (12:42 +0100)]
Collect the names of generated files and clean them away at target clean:

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd $(LIB_CFLAGS) for any build.info generator that uses $(CFLAGS)
Richard Levitte [Sat, 12 Mar 2016 08:46:28 +0000 (09:46 +0100)]
Add $(LIB_CFLAGS) for any build.info generator that uses $(CFLAGS)

The reason to do so is that some of the generators detect PIC flags
like -fPIC and -KPIC, and those are normally delivered in LD_CFLAGS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoUse single quotes rather than double quotes when needed
Richard Levitte [Sat, 12 Mar 2016 09:46:14 +0000 (10:46 +0100)]
Use single quotes rather than double quotes when needed

When passing down values to Makefile.shared, do so with single quotes
as much as possible to avoid having the shell create a mess of quotes.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoHarmonize Unix Makefile template with Windows dito
Richard Levitte [Sat, 12 Mar 2016 08:38:20 +0000 (09:38 +0100)]
Harmonize Unix Makefile template with Windows dito

The variable SHARED_CFLAGS and SHARD_LDFLAGS were used in the Unix
template because they normally contain options used when building
"shared".  The Windows template, on the other hand, uses LIB_CFLAGS,
to express the intended use of those flags rather than their content.
The Windows template still used SHARED_LDFLAGS, which seems
inconsistent.

To harmonize the two, any SHARED_CFLAGS gets renamed to LIB_CFLAGS and
SHARED_LDFLAGS to LIB_LDFLAGS.  That makes the intent consistent along
with BIN_{C,LD}FLAGS and DSO_{C,LD}FLAGS.

Finally, make sure to pass down $(LIB_CFLAGS) or $(DSO_CFLAGS) along
with $(CFLAGS) when using Makefile.shared.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix memory leak in library deinit
Emilia Kasper [Sat, 12 Mar 2016 19:46:13 +0000 (20:46 +0100)]
Fix memory leak in library deinit

ENGINE_cleanup calls CRYPTO_free_ex_data and therefore,
CRYPTO_cleanup_all_ex_data - which cleans up the method pointers - must
run after ENGINE_cleanup.

Additionally, don't needlessly initialize the EX_CALLBACKS stack during
e.g. CRYPTO_free_ex_data. The only time this is actually needed is when
reserving the first ex data index. Specifically, since sk_num returns -1
on NULL input, the rest of the code already handles a NULL method stack
correctly.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd doc on when to use SCT callback.
Rich Salz [Thu, 10 Mar 2016 15:37:31 +0000 (10:37 -0500)]
Add doc on when to use SCT callback.

With help from Viktor.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoWorkaround for false -Warray-bounds in Travis
Emilia Kasper [Sat, 12 Mar 2016 16:18:25 +0000 (17:18 +0100)]
Workaround for false -Warray-bounds in Travis

ccache + clang produces a false strcmp warning, see
https://llvm.org/bugs/show_bug.cgi?id=20144

Since this only happens with ccache and --strict-warnings, and
only with certain versions of glibc / clang, disabling
ccache is a reasonable short-term workaround.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix no-comp build
Emilia Kasper [Fri, 11 Mar 2016 20:13:19 +0000 (21:13 +0100)]
Fix no-comp build

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoFix build break; add function declaration
Rich Salz [Sat, 12 Mar 2016 01:36:33 +0000 (20:36 -0500)]
Fix build break; add function declaration

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoWhen creating directory specs, use srctop_dir rather than srctop_file.
Richard Levitte [Sat, 12 Mar 2016 01:06:55 +0000 (02:06 +0100)]
When creating directory specs, use srctop_dir rather than srctop_file.

While insignificant on Unix like systems, this is significant on
systems like VMS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoAvoid sed for dependency post-processing
Richard Levitte [Sat, 12 Mar 2016 00:06:48 +0000 (01:06 +0100)]
Avoid sed for dependency post-processing

It turns out that different sed implementations treat -i differently
to cause issues.  make it simpler by avoiding it entirely and give
perl the trust to be consistent enough.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoBecause bn_expand2 is declared non-static, it must not be static
Richard Levitte [Fri, 11 Mar 2016 18:22:58 +0000 (19:22 +0100)]
Because bn_expand2 is declared non-static, it must not be static

That doesn't change even to make a dummy to hide its unavailability.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRemove some dead code from 1999
Matt Caswell [Fri, 11 Mar 2016 21:05:02 +0000 (21:05 +0000)]
Remove some dead code from 1999

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoDon't clobber the last error
Matt Caswell [Fri, 11 Mar 2016 16:47:42 +0000 (16:47 +0000)]
Don't clobber the last error

On Windows we call WSAGetLastError() to find out the last error that
happened on a socket operation. We use this to find out whether we can
retry the operation or not. You are supposed to call this immediately
however in a couple of places we logged an error first. This can end up
making other Windows system calls to get the thread local error state.
Sometimes that can clobber the error code, so if you call WSAGetLastError()
later on you get a spurious response and the socket operation looks like
a fatal error.

Really we shouldn't be logging an error anyway if its a retryable issue.
Otherwise we could end up with stale errors on the error queue.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoremoved extra define
Mat [Fri, 11 Mar 2016 19:20:20 +0000 (20:20 +0100)]
removed extra define

verified that build succeeds without the extra define
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix no-blake2 for Windows classic build
Mat [Fri, 11 Mar 2016 17:26:57 +0000 (18:26 +0100)]
Fix no-blake2 for Windows classic build

Fix no-blake2 for Windows classic build
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agomake update
Dr. Stephen Henson [Fri, 11 Mar 2016 17:41:24 +0000 (17:41 +0000)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMake X509_SIG opaque.
Dr. Stephen Henson [Thu, 10 Mar 2016 15:04:46 +0000 (15:04 +0000)]
Make X509_SIG opaque.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoSome sed implementations are not greedy enough, use perl instead
Richard Levitte [Fri, 11 Mar 2016 12:25:48 +0000 (13:25 +0100)]
Some sed implementations are not greedy enough, use perl instead

The issue is demonstrated as follows:

  On Linux:

    $ echo ': foo.h /usr/include/stddef.h bar.h' | sed -e 's/ \/\(\\.\|[^ ]\)*//g'
    : foo.h bar.h

  On MacOS X:

    $ echo ': foo.h /usr/include/stddef.h bar.h' | sed -e 's/ \/\(\\.\|[^ ]\)*//g'
    : foo.husr/include/stddef.h bar.h

Perl is more consistent:

  On Linux:

    $ echo ': foo.h /usr/include/stddef.h bar.h' | perl -pe 's/ \/(\\.|[^ ])*//g;'
    : foo.h bar.h

  On MacOS X:

    $ echo ': foo.h /usr/include/stddef.h bar.h' | perl -pe 's/ \/(\\.|[^ ])*//g;'
    : foo.h bar.h

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoMake update to catch function renames.
Rich Salz [Fri, 11 Mar 2016 15:38:45 +0000 (10:38 -0500)]
Make update to catch function renames.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoUse unsigned int instead of just unsigned.
Kurt Roeckx [Fri, 11 Mar 2016 00:19:43 +0000 (01:19 +0100)]
Use unsigned int instead of just unsigned.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoSave leaf_node and node_offset as character array
Kurt Roeckx [Fri, 11 Mar 2016 00:06:51 +0000 (01:06 +0100)]
Save leaf_node and node_offset as character array

They are not numbers in the machine byte order.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoReview comments
Kurt Roeckx [Wed, 9 Mar 2016 23:49:55 +0000 (00:49 +0100)]
Review comments

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd blake2 support.
Bill Cox [Wed, 9 Mar 2016 22:08:31 +0000 (23:08 +0100)]
Add blake2 support.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agomove DSA_SIG definition into C source file
Dr. Stephen Henson [Thu, 10 Mar 2016 14:24:39 +0000 (14:24 +0000)]
move DSA_SIG definition into C source file

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agocrypto/*/build.info: make it work on ARM platforms.
Andy Polyakov [Fri, 11 Mar 2016 12:44:46 +0000 (13:44 +0100)]
crypto/*/build.info: make it work on ARM platforms.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agocrypto/*/build.info: SPARC-specific fixups.
Andy Polyakov [Fri, 11 Mar 2016 11:04:15 +0000 (12:04 +0100)]
crypto/*/build.info: SPARC-specific fixups.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoConfigurations/unix-Makefile.tmpl: don't leave empty .s files behind.
Andy Polyakov [Fri, 11 Mar 2016 10:55:44 +0000 (11:55 +0100)]
Configurations/unix-Makefile.tmpl: don't leave empty .s files behind.

If pre-processor failed, an empty .s file could be left behind,
which could get successfully compiled if one simply re-ran make
and cause linking failures. Not anymore. Remove even intermediate .S
in case of pre-processor failure.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoConfigure: remove dependency on 'head'.
Andy Polyakov [Fri, 11 Mar 2016 11:33:59 +0000 (12:33 +0100)]
Configure: remove dependency on 'head'.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoconstify CT_POLICY_EVAL_CTX getters
Rob Percival [Thu, 10 Mar 2016 23:26:41 +0000 (23:26 +0000)]
constify CT_POLICY_EVAL_CTX getters

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoSurround ctx_set_ctlog_list_file() with #ifndef OPENSSL_NO_CT
Rob Percival [Thu, 10 Mar 2016 23:10:02 +0000 (23:10 +0000)]
Surround ctx_set_ctlog_list_file() with #ifndef OPENSSL_NO_CT

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoSuppress CT warnings in test_ssl
Matt Caswell [Fri, 11 Mar 2016 13:50:55 +0000 (13:50 +0000)]
Suppress CT warnings in test_ssl

Running test_ssl with HARNESS_VERBOSE results in lots of spurious warnings
about an inability to load the CT config file. This fixes it.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoAvoid getting unresolved referense to bn_expand2 in test/bntest.c
Richard Levitte [Fri, 11 Mar 2016 10:38:14 +0000 (11:38 +0100)]
Avoid getting unresolved referense to bn_expand2 in test/bntest.c

Issue identified on Solaris by Erik Forsberg <erik@efca.com>

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoCall CONF_modules_free() before ENGINE_cleanup() in auto-deinit
Matt Caswell [Fri, 11 Mar 2016 09:52:52 +0000 (09:52 +0000)]
Call CONF_modules_free() before ENGINE_cleanup() in auto-deinit

During auto de-init we were calling ENGINE_cleanup(), and then later
CONF_modules_free(). However the latter function can end up calling
engine code, which can lead to a use of the global_engine_lock after it
has already been freed. Therefore we should swap the calling order of
these two functions.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix no-rmd160 classic Windows build
Mat [Fri, 11 Mar 2016 03:52:32 +0000 (04:52 +0100)]
Fix no-rmd160 classic Windows build

no-ripemd was unified a while ago but the change was not done in mk1mf.pl. This commit changes the no-ripemd string to no-rmd160 which fixes the no-rmd160 classic build.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoDon't build dynamic engines unless configured "shared"
Richard Levitte [Fri, 11 Mar 2016 11:58:15 +0000 (12:58 +0100)]
Don't build dynamic engines unless configured "shared"

Experience has shown that dynamic engines with their own copy of
libcrypto is problematic, so we disable that possibility.

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoHarmonise the two methods to generate dependency files
Richard Levitte [Fri, 11 Mar 2016 08:26:49 +0000 (09:26 +0100)]
Harmonise the two methods to generate dependency files

One of them didn't clean away .d.tmp files properly.
The other would overwrite the .d files unconditionally, thereby
causing a possibly unnecessary dependency rebuild, which touches the
date of Makefile, which causes a possibly unnecessary rebuild of
buildinf.h and everything that depends on that.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoMore tweaks to the installation instructions
Matt Caswell [Thu, 10 Mar 2016 11:05:47 +0000 (11:05 +0000)]
More tweaks to the installation instructions

A few things were out of date and a few things were missing. Also some
formatting updates.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix some assembler generating scripts for better unification
Richard Levitte [Thu, 10 Mar 2016 23:49:47 +0000 (00:49 +0100)]
Fix some assembler generating scripts for better unification

Some of these scripts would recognise an output parameter if it looks
like a file path.  That works both in both the classic and new build
schemes.  Some fo these scripts would only recognise it if it's a
basename (i.e. no directory component).  Those need to be corrected,
as the output parameter in the new build scheme is more likely to
contain a directory component than not.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoAdd include directory options for assembler files that include from crypto/
Richard Levitte [Thu, 10 Mar 2016 20:55:12 +0000 (21:55 +0100)]
Add include directory options for assembler files that include from crypto/

A few were missed in the previous commit.

Closes RT#4412

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agocheck reviewer --reviewer=emilia
Rob Percival [Thu, 10 Mar 2016 19:49:34 +0000 (19:49 +0000)]
check reviewer --reviewer=emilia
Use SSL_get_SSL_CTX instead of passing SSL_CTX to s_client.c:print_stuff

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agocheck reviewer --reviewer=emilia
Rob Percival [Thu, 10 Mar 2016 18:21:40 +0000 (18:21 +0000)]
check reviewer --reviewer=emilia
Pass entire CTLOG_STORE to SCT_print, rather than just the SCT's CTLOG

SCT_print now looks up the correct CT log for you.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agocheck reviewer --reviewer=emilia
Rob Percival [Thu, 10 Mar 2016 18:17:23 +0000 (18:17 +0000)]
check reviewer --reviewer=emilia
Remove 'log' field from SCT and related accessors

In order to still have access to an SCT's CTLOG when calling SCT_print,
SSL_CTX_get0_ctlog_store has been added.

Improved documentation for some CT functions in openssl/ssl.h.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd include directory options for assembler files that include from crypto/
Richard Levitte [Thu, 10 Mar 2016 19:05:52 +0000 (20:05 +0100)]
Add include directory options for assembler files that include from crypto/

Closes RT#4406

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoIn the recipe using "makedepend", make sure the object file extension is there
Richard Levitte [Thu, 10 Mar 2016 18:34:21 +0000 (19:34 +0100)]
In the recipe using "makedepend", make sure the object file extension is there

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoConfigure - don't trust $1 to stick around, save its value away
Richard Levitte [Thu, 10 Mar 2016 18:33:11 +0000 (19:33 +0100)]
Configure - don't trust $1 to stick around, save its value away

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoFix a memory leak in the afalg engine
Matt Caswell [Thu, 10 Mar 2016 15:17:20 +0000 (15:17 +0000)]
Fix a memory leak in the afalg engine

The AFALG engine created a global EVP_CIPHER instance but was not freeing
it up when the engine was destroyed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoHarmonize the option processing in 'config' and 'config.com'
Richard Levitte [Thu, 10 Mar 2016 13:20:50 +0000 (14:20 +0100)]
Harmonize the option processing in 'config' and 'config.com'

The help text for -d in 'config' was aged, and the option processing
in 'config.com' was just different.  This harmonizes 'config.com' with
the instructions in INSTALL and both current reality.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd cleaning targets to Configurations/windows-makefile.tmpl
Richard Levitte [Thu, 10 Mar 2016 00:51:53 +0000 (01:51 +0100)]
Add cleaning targets to Configurations/windows-makefile.tmpl

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoThe typedef ECPARAMETERS is already defined, don't define it anew
Richard Levitte [Thu, 10 Mar 2016 10:29:08 +0000 (11:29 +0100)]
The typedef ECPARAMETERS is already defined, don't define it anew

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoAllow OPENSSL_NO_SOCK in e_os.h even for non-Windows/DOS platforms
David Woodhouse [Sat, 20 Feb 2016 15:07:32 +0000 (15:07 +0000)]
Allow OPENSSL_NO_SOCK in e_os.h even for non-Windows/DOS platforms

UEFI needs this too. Don't keep it only in the Windows/DOS ifdef block.

This is a fixed version of what was originally commit 963bb62195 and
subsequently reverted in commit 37b1f8bd62. Somewhere along the way, the
Windows/DOS ifdef actually got removed, leaving it just broken. It should
have been turned into an #elif, not removed.

This one correctly changes the logic from

    # if WINDOWS|DOS
    #  if OPENSSL_NO_SOCK
        ... no-sock ...
    #  elif !DJGPP
        ... native windows ...

to

    # if OPENSSL_NO_SOCK
       ... no-sock ...
    # elif WINDOWS|DOS
    #  if !DJGPP
        ... native windows ...

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoRemove a missed item from the old thread API
Matt Caswell [Thu, 10 Mar 2016 09:21:23 +0000 (09:21 +0000)]
Remove a missed item from the old thread API

A line from cryptlib.h was missed during the old Thread API removal. This
breaks no-deprecated builds.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMark SRP_VBASE_get_by_user() as deprecated
Matt Caswell [Thu, 10 Mar 2016 09:20:06 +0000 (09:20 +0000)]
Mark SRP_VBASE_get_by_user() as deprecated

The function SRP_VBASE_get_by_user() is declared as deprecated but the
implementation was not.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoNo need to call EVP_CIPHER_CTX_init after EVP_CIPHER_CTX_new
Matt Caswell [Thu, 10 Mar 2016 09:18:50 +0000 (09:18 +0000)]
No need to call EVP_CIPHER_CTX_init after EVP_CIPHER_CTX_new

The afalgtest was unnecessarily initing an EVP_CIPHER_CTX. It is not
needed and is deprecated.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoPass down inclusion directories to source file generators
Richard Levitte [Thu, 10 Mar 2016 08:04:09 +0000 (09:04 +0100)]
Pass down inclusion directories to source file generators

The source file generators sometimes use $(CC) to post-process
generated source, and getting the inclusion directories may be
necessary at times, so we pass them down.

RT#4406

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoTravis - add missing semi-colon
Richard Levitte [Thu, 10 Mar 2016 07:36:57 +0000 (08:36 +0100)]
Travis - add missing semi-colon

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoUpdate .gitignore to ignore all cscope files
Todd Short [Sat, 5 Mar 2016 12:29:10 +0000 (07:29 -0500)]
Update .gitignore to ignore all cscope files

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoremove ms/.rnd and add it to .gitignore
Viktor Szakats [Wed, 9 Mar 2016 14:38:06 +0000 (15:38 +0100)]
remove ms/.rnd and add it to .gitignore

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoRT3676 add: Export ASN.1 DHparams
Rich Salz [Thu, 10 Mar 2016 01:56:43 +0000 (20:56 -0500)]
RT3676 add: Export ASN.1 DHparams

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoTravis - don't use ccache with cross compiles
Richard Levitte [Thu, 10 Mar 2016 01:14:55 +0000 (02:14 +0100)]
Travis - don't use ccache with cross compiles

Although theoretically possible, Configure doesn't treat CC variable
set like this very well: CC="ccache i686-w64-mingw32-gcc"
Also, this Travis script doesn't recognise the possibility either.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAvoid negative array index in BIO_debug_callback()
Benjamin Kaduk [Tue, 8 Mar 2016 22:44:57 +0000 (16:44 -0600)]
Avoid negative array index in BIO_debug_callback()

BIO_snprintf() can return -1 on truncation (and overflow as of commit
9cb177301fdab492e4cfef376b28339afe3ef663).  Though neither can
realistically occur while printing a pointer and short fixed string into
a buffer of length 256, the analysis to confirm that this the case goes
somewhat far up the call chain, and not all static analyzers can
successfully follow the chain of logic.

It's easy enough to clamp the returned length to be nonnegative before
continuing, which appeases the static analyzer and does not harm the
subsequent code.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>