oweals/openssl.git
6 years agoVMS: modernise rand_pool_acquire_entropy, step 2
Richard Levitte [Wed, 2 May 2018 04:16:04 +0000 (06:16 +0200)]
VMS: modernise rand_pool_acquire_entropy, step 2

Add more items that could serve as entropy source.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6151)

6 years agoVMS: modernise rand_pool_acquire_entropy, step 1
Richard Levitte [Mon, 30 Apr 2018 16:04:10 +0000 (18:04 +0200)]
VMS: modernise rand_pool_acquire_entropy, step 1

Stop redefining structures that are already defined in system
headers.  This also means we can stop setting the pointer size
globally, because the system structures will have the correct pointer
sizes either way.  The only exception is passing the right pointer
size to a function.

Stop trying to twist things around with rand(), that's the job of the
DRBG that we feed.

Stop assuming the location of the JPI$_FINALEXC item, look it up
instead.

Signal an exception if the sys$getjpiw call fails (it means the item
list isn't set up right, so works as an assertion, but using VMS
methodology).

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6151)

6 years agoReturn an error from BN_mod_inverse if n is 1 (or -1)
Matt Caswell [Fri, 27 Apr 2018 16:36:11 +0000 (17:36 +0100)]
Return an error from BN_mod_inverse if n is 1 (or -1)

Calculating BN_mod_inverse where n is 1 (or -1) doesn't make sense. We
should return an error in that case. Instead we were returning a valid
result with value 0.

Fixes #6004

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6119)

6 years agoMake X509_VERIFY_PARAM_get_hostflags() take a const arg
Matt Caswell [Wed, 2 May 2018 10:32:39 +0000 (11:32 +0100)]
Make X509_VERIFY_PARAM_get_hostflags() take a const arg

Commit 5b748dea5 added this function which should have taken a const
argument.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6154)

6 years agoAdd a test for SSL_get_shared_ciphers()
Matt Caswell [Fri, 27 Apr 2018 11:20:04 +0000 (12:20 +0100)]
Add a test for SSL_get_shared_ciphers()

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6113)

6 years agoFix a bug in create_ssl_ctx_pair()
Matt Caswell [Fri, 27 Apr 2018 11:09:08 +0000 (12:09 +0100)]
Fix a bug in create_ssl_ctx_pair()

The max protocol version was only being set on the server side. It should
have been done on both the client and the server.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6113)

6 years agoAdd some documentation for SSL_get_shared_ciphers()
Matt Caswell [Fri, 27 Apr 2018 10:38:19 +0000 (11:38 +0100)]
Add some documentation for SSL_get_shared_ciphers()

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6113)

6 years agoFix comment in ssl_locl.h
Matt Caswell [Fri, 27 Apr 2018 10:24:01 +0000 (11:24 +0100)]
Fix comment in ssl_locl.h

The ciphers field in a session contains the stack of ciphers offered by
the client.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6113)

6 years agoFix SSL_get_shared_ciphers()
Matt Caswell [Fri, 27 Apr 2018 10:20:52 +0000 (11:20 +0100)]
Fix SSL_get_shared_ciphers()

The function SSL_get_shared_ciphers() is supposed to return ciphers shared
by the client and the server. However it only ever returned the client
ciphers.

Fixes #5317

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6113)

6 years agoopensslconf.h inclusion cleanup
FdaSilvaYY [Tue, 1 May 2018 21:25:16 +0000 (23:25 +0200)]
opensslconf.h inclusion cleanup
No need to buildtest on opensslconf.h

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6149)

6 years agobn/asm/*-mont.pl: harmonize with BN_from_montgomery_word.
Andy Polyakov [Mon, 30 Apr 2018 20:59:51 +0000 (22:59 +0200)]
bn/asm/*-mont.pl: harmonize with BN_from_montgomery_word.

Montgomery multiplication post-conditions in some of code paths were
formally non-constant time. Cache access pattern was result-neutral,
but a little bit asymmetric, which might have produced a signal [if
processor reordered load and stores at run-time].

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6141)

6 years agoapps/speed.c: merge parameters defining EC curves to test ...
FdaSilvaYY [Mon, 28 Nov 2016 22:36:50 +0000 (23:36 +0100)]
apps/speed.c: merge parameters defining EC curves to test ...

... and unify 'bits' declarations and printing format.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6132)

6 years agoa_strex.c: prevent out of bound read in do_buf()
Dr. Matthias St. Pierre [Thu, 26 Apr 2018 18:36:41 +0000 (20:36 +0200)]
a_strex.c: prevent out of bound read in do_buf()

which is used for ASN1_STRING_print_ex*() and X509_NAME_print_ex*().

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6105)

6 years agoChange rand_pool_bytes_needed to handle less entropy than 1 per 8 bits
Richard Levitte [Wed, 2 May 2018 04:24:20 +0000 (06:24 +0200)]
Change rand_pool_bytes_needed to handle less entropy than 1 per 8 bits

rand_pool_bytes_needed() was constructed in such a way that the
smallest acceptable entropy factor was 1 entropy bits per 8 bits of
data.  At the same time, we have a DRBG_MINMAX_FACTOR that allows
weaker source, as small as 1 bit of entropy per 128 bits of data.
The conclusion is that rand_pool_bytes_needed() needs to change to
support weaker entropy sources.  We therefore change the input of
entropy per byte to be an entropy factor instead.  This entropy factor
expresses how many bits of data it takes (on average) to get 1 bit of
entropy.

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6150)

6 years agoAdd a note about Nagle's algorithm on the SSL_connect man page
Matt Caswell [Tue, 1 May 2018 10:46:58 +0000 (11:46 +0100)]
Add a note about Nagle's algorithm on the SSL_connect man page

Fixes #4237

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/6143)

6 years agoFix memory leaks in CA related functions.
Pavel Kopyl [Fri, 3 Nov 2017 15:18:59 +0000 (18:18 +0300)]
Fix memory leaks in CA related functions.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4700)

6 years agoFix regression with session cache use by clients
Benjamin Kaduk [Mon, 16 Apr 2018 12:32:02 +0000 (07:32 -0500)]
Fix regression with session cache use by clients

Commit d316cdcf6d8d6934663278145fe0a8191e14a8c5 introduced some extra
checks into the session-cache update procedure, intended to prevent
the caching of sessions whose resumption would lead to a handshake
failure, since if the server is authenticating the client, there needs to
be an application-set "session id context" to match up to the authentication
context.  While that change is effective for its stated purpose, there
was also some collatoral damage introduced along with the fix -- clients
that set SSL_VERIFY_PEER are not expected to set an sid_ctx, and so
their usage of session caching was erroneously denied.

Fix the scope of the original commit by limiting it to only acting
when the SSL is a server SSL.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5967)

6 years agoImprove error handling in rand_init function
Bernd Edlinger [Sat, 28 Apr 2018 18:35:54 +0000 (20:35 +0200)]
Improve error handling in rand_init function

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6124)

6 years agoAdd getter for X509_VERIFY_PARAM_get_hostflags
Matt Caswell [Mon, 30 Apr 2018 14:59:51 +0000 (15:59 +0100)]
Add getter for X509_VERIFY_PARAM_get_hostflags

Fixes #5061

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6139)

6 years agoClarify BN_mod_exp docs
Matt Caswell [Mon, 30 Apr 2018 14:05:45 +0000 (15:05 +0100)]
Clarify BN_mod_exp docs

Specifically this is not supported with an even modulus and
BN_FLG_CONSTTIME.

Fixes #5082

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6137)

6 years agoFix some errors and missing info in the CMS docs
Matt Caswell [Mon, 30 Apr 2018 11:05:42 +0000 (12:05 +0100)]
Fix some errors and missing info in the CMS docs

Fixes #5063

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6134)

6 years agoPrepare for 1.1.1-pre7-dev
Matt Caswell [Tue, 1 May 2018 12:55:46 +0000 (13:55 +0100)]
Prepare for 1.1.1-pre7-dev

Reviewed-by: Rich Salz <rsalz@openssl.org>
6 years agoPrepare for 1.1.1-pre6 release OpenSSL_1_1_1-pre6
Matt Caswell [Tue, 1 May 2018 12:46:05 +0000 (13:46 +0100)]
Prepare for 1.1.1-pre6 release

Reviewed-by: Rich Salz <rsalz@openssl.org>
6 years agoUpdate copyright year
Matt Caswell [Tue, 1 May 2018 12:34:30 +0000 (13:34 +0100)]
Update copyright year

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6145)

6 years agoUse the config file from the source not the host for the tests
Kurt Roeckx [Sat, 28 Apr 2018 21:26:22 +0000 (23:26 +0200)]
Use the config file from the source not the host for the tests

Fixes: #6046

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #6125

6 years agoConfigurations/unix-Makefile.tmpl: harmonize with no-engine.
Andy Polyakov [Thu, 26 Apr 2018 17:22:30 +0000 (19:22 +0200)]
Configurations/unix-Makefile.tmpl: harmonize with no-engine.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6106)

6 years agoConfigurations/10-main.conf: force no-engine on ios targets.
Andy Polyakov [Thu, 26 Apr 2018 17:22:04 +0000 (19:22 +0200)]
Configurations/10-main.conf: force no-engine on ios targets.

Rationale for enforcing no-engine is because of disconnect between
compile-time config and run-time, which is a per-application sandbox
directory which one can't predict in advance. Besides, none of the
bundled engines actually give an edge on iOS...

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6106)

6 years agoDon't cleanup uninitialized thread local slots
Bernd Edlinger [Sat, 28 Apr 2018 17:09:55 +0000 (19:09 +0200)]
Don't cleanup uninitialized thread local slots

Fixes: #6120

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/6123)

6 years agoFix drbg thread cleanup and error handling
Bernd Edlinger [Thu, 26 Apr 2018 08:14:14 +0000 (10:14 +0200)]
Fix drbg thread cleanup and error handling

Fixes: #6081

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6089)

6 years agoUpdate version docs
Matt Caswell [Thu, 19 Apr 2018 12:32:45 +0000 (13:32 +0100)]
Update version docs

Make it clear that you should not attempt to get the version before the
first handshake is complete.

Fixes #2893

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6013)

6 years agoapps/s_server.c: Avoid unused variable due to 'no-dtls'
Richard Levitte [Thu, 26 Apr 2018 19:11:26 +0000 (21:11 +0200)]
apps/s_server.c: Avoid unused variable due to 'no-dtls'

Fixes #6098

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6104)

6 years agofix: BN_swap mishandles flags
Billy Brumley [Thu, 26 Apr 2018 15:08:36 +0000 (18:08 +0300)]
fix: BN_swap mishandles flags

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6099)

6 years agoFix mixed indentation (and other whitespace issues)
Dr. Matthias St. Pierre [Thu, 26 Apr 2018 11:57:14 +0000 (13:57 +0200)]
Fix mixed indentation (and other whitespace issues)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6094)

6 years ago15-test_out_option: Refactor and don't test directory write on VMS
Richard Levitte [Thu, 26 Apr 2018 15:41:46 +0000 (17:41 +0200)]
15-test_out_option: Refactor and don't test directory write on VMS

To my surprise, it turns out that on OpenVMS, opening './' (which
is translated to '[]') for writing actually creates a file, '[].'.
On OpenVMS, this is a perfectly valid file with no name or extension,
just the delimiter between the two.

Because of the mess the exception would generate in the test recipe,
it gets refactored again, to clearly separate each test inside it,
and use skips to avoid some of them (that makes it clear that they are
skipped and why, when running the recipe).

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6100)

6 years agoFix last(?) batch of malloc-NULL places
Rich Salz [Thu, 26 Apr 2018 18:02:24 +0000 (14:02 -0400)]
Fix last(?) batch of malloc-NULL places

Add a script to find them in the future

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/6103)

6 years agoFix memleaks in async api
Bernd Edlinger [Thu, 26 Apr 2018 16:39:51 +0000 (18:39 +0200)]
Fix memleaks in async api

Fixes: #5950

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6038)

6 years agoWait max. 60 seconds for s_client to connect
Bernd Edlinger [Mon, 16 Apr 2018 12:16:26 +0000 (14:16 +0200)]
Wait max. 60 seconds for s_client to connect

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5964)

6 years agoAdd missing error code when alloc-return-null
FdaSilvaYY [Thu, 26 Apr 2018 16:06:17 +0000 (12:06 -0400)]
Add missing error code when alloc-return-null

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6085)

6 years agoUpdate the *use_certificate* docs
Matt Caswell [Thu, 26 Apr 2018 13:05:40 +0000 (14:05 +0100)]
Update the *use_certificate* docs

Note that calling the *use_certificate* functions will replace any existing
certificate of the same type. The same thing applies for private keys.

Fixes #2147

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6092)

6 years agoFix typo in the definition of tls13_ciphers
Matt Caswell [Thu, 26 Apr 2018 13:20:59 +0000 (14:20 +0100)]
Fix typo in the definition of tls13_ciphers

SSL_kANY, and SSL_aANY were placed in the wrong fields. It makes no
functional difference since these macros evaluate to 0 anyway, which is
the correct value for these fields.

Fixes #6048

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6095)

6 years agoUse get_last_sys_error() instead of get_last_rtl_error()
Richard Levitte [Thu, 26 Apr 2018 07:59:22 +0000 (09:59 +0200)]
Use  get_last_sys_error() instead of get_last_rtl_error()

get_last_sys_error() already exists, so there's no need for yet
another macro that fulfills the same purpose.

Fixes #4120

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6088)

6 years agoPEM_def_callback(): use same parameter names as for pem_password_cb
Richard Levitte [Wed, 25 Apr 2018 20:53:40 +0000 (22:53 +0200)]
PEM_def_callback(): use same parameter names as for pem_password_cb

Add a bit more commentary to explain what's going on.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6080)

6 years agoPEM_def_callback(): don't loop because of too short password given
Richard Levitte [Wed, 25 Apr 2018 11:57:39 +0000 (13:57 +0200)]
PEM_def_callback(): don't loop because of too short password given

That error is already caught by EVP_read_pw_string_min, and causes
this function to return -1, so the code detecting too short passwords
in this function is practically dead.

Fixes #5465

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6080)

6 years agoopenssl rehash: exit 0 on warnings, same as c_rehash
Richard Levitte [Wed, 25 Apr 2018 17:59:36 +0000 (19:59 +0200)]
openssl rehash: exit 0 on warnings, same as c_rehash

Fixes #6083

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6084)

6 years agoms/uplink-x86.pl: close the file handle that was opened
Richard Levitte [Wed, 25 Apr 2018 11:01:39 +0000 (13:01 +0200)]
ms/uplink-x86.pl: close the file handle that was opened

Fixes #5656

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6079)

6 years agoFix documentation for the -showcerts s_client option
Matt Caswell [Tue, 24 Apr 2018 09:27:32 +0000 (10:27 +0100)]
Fix documentation for the -showcerts s_client option

This option shows the certificates as sent by the server. It is not the
full verified chain.

Fixes #4933

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6067)

6 years agoapps/opt.c: Remove the access checks of input and output files
Richard Levitte [Tue, 24 Apr 2018 12:31:32 +0000 (14:31 +0200)]
apps/opt.c: Remove the access checks of input and output files

open() will take care of the checks anyway

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6033)

6 years agoBetter check of return values from app_isdir and app_access
Richard Levitte [Fri, 20 Apr 2018 10:27:14 +0000 (12:27 +0200)]
Better check of return values from app_isdir and app_access

[extended tests]

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6033)

6 years agoRevert "Check directory is able to create files for various -out option"
Richard Levitte [Fri, 20 Apr 2018 10:22:45 +0000 (12:22 +0200)]
Revert "Check directory is able to create files for various -out option"

This reverts commit 555c94a0db9661428da0a45cb32b9f002324eefd.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6033)

6 years agoRevert "Add VMS version of app_dirname()"
Richard Levitte [Fri, 20 Apr 2018 10:22:36 +0000 (12:22 +0200)]
Revert "Add VMS version of app_dirname()"

This reverts commit 215a6730f1eaf53b01a4eb10d75bd09fd74f70cc.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6033)

6 years agoRevert "Check on VMS as well"
Richard Levitte [Fri, 20 Apr 2018 10:22:27 +0000 (12:22 +0200)]
Revert "Check on VMS as well"

This reverts commit f6d765988f37c43edb1056ab83165f2569182e9d.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6033)

6 years agotest/recipes/15-test_out_option.t: refine tests
Richard Levitte [Fri, 20 Apr 2018 06:36:18 +0000 (08:36 +0200)]
test/recipes/15-test_out_option.t: refine tests

Test writing to the null device.  This should be successful.

Also, refactor so the planned number of tests is calculated.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6033)

6 years ago[SM2_sign] add minimal EVP_PKEY functionality testing
Nicola Tuveri [Tue, 10 Apr 2018 00:53:01 +0000 (03:53 +0300)]
[SM2_sign] add minimal EVP_PKEY functionality testing

The actual functionality of generating signatures through the `EVP_PKEY`
API is completely untested.
Current tests under the `EVP_PKEY` API
(`test/recipes/30-test_evp_data/evppkey.txt`) only cover `Verify` and
`Decrypt`, while encryption and signature generation are tested with
ad-hoc clients (`test/sm2crypttest.c`, `test/sm2signtest.c`) that do not
call the `EVP_PKEY` interface at all but soon-to-be private functions
that bypass it (cf. PR#5895 ).

It is my opinion that an ideal solution for the future would consist on
enhancing the `test/evp_pkey` facility and syntax to allow tests to take
control of the PRNG to inject known nonces and validate the results of
`EVP_PKEY` implementations against deterministic known answer tests, but
it is probably too late to work on this feature in time for next release.

Given that commit b5a85f70d8 highlights some critical bugs in the hook
between the `EVP_PKEY` interface and SM2 signature generation and that
these defects escaped testing and code review, I think that at least for
now it is beneficial to at least add the kind of "bogus" testing
provided by this patch:
this is a "fake" test as it does only verify that the SM2 `EVP_PKEY`
interface is capable of creating a signature without failing, but it
does not say anything about the generated signature being valid, nor
does it test the functional correctness of the cryptosystem.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6066)

6 years ago[SM2_sign] fix double free and return value
Nicola Tuveri [Tue, 10 Apr 2018 00:19:30 +0000 (03:19 +0300)]
[SM2_sign] fix double free and return value

Currently, critical bugs prevent using SM2 signatures through the
`EVP_PKEY` interface: any application that managed to satisfy the
requirement of forcing SM3 as the message digest â€“ even if this is
currently not possible transparently through the `EVP_PKEY` interface
and requires manually forcing the MD selection â€“ would crash with a
segmentation fault upon calling the `SM2_sign()` function.

This is easily verified using the OpenSSL CLI to execute this critical
code path under the right conditions:
`openssl dgst -sm3 -hex -sign sm2.eckey /path/to/file/to/sign`

The issue is caused by a double free at the end of `SM2_sign()` in
`crypto/sm2/sm2_sign.c` in case of successful signature generation.
In addition, even if the double free was not causing segfaults,
the function returns the wrong return value in case of success (it
would return 0 rather than 1).

This patch fixes both problems.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6066)

6 years agoFix the MAX_CURVELIST definition
Matt Caswell [Tue, 24 Apr 2018 09:10:39 +0000 (10:10 +0100)]
Fix the MAX_CURVELIST definition

The MAX_CURVELIST macro defines the total number of in-built SSL/TLS curves
that we support. However it has not been updated as new curves are added.

Fixes #5232

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/6065)

6 years agoAdd missing malloc-return-null instance
Rich Salz [Tue, 24 Apr 2018 16:41:45 +0000 (12:41 -0400)]
Add missing malloc-return-null instance

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6071)

6 years agox509/by_dir.c: Remove dead code
Dr. Matthias St. Pierre [Tue, 24 Apr 2018 07:17:09 +0000 (09:17 +0200)]
x509/by_dir.c: Remove dead code

Noticed in #5837

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6064)

6 years agoAdd a test to verify the ClientHello version is the same in a reneg
Matt Caswell [Mon, 23 Apr 2018 16:40:10 +0000 (17:40 +0100)]
Add a test to verify the ClientHello version is the same in a reneg

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6059)

6 years agoIn a reneg use the same client_version we used last time
Matt Caswell [Mon, 23 Apr 2018 16:14:47 +0000 (17:14 +0100)]
In a reneg use the same client_version we used last time

In 1.0.2 and below we always send the same client_version in a reneg
ClientHello that we sent the first time around, regardless of what
version eventually gets negotiated. According to a comment in
statem_clnt.c this is a workaround for some buggy servers that choked if
we changed the version used in the RSA encrypted premaster secret.

In 1.1.0+ this behaviour no longer occurs. This restores the original
behaviour.

Fixes #1651

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6059)

6 years agoDon't build AFALG on android
Matt Caswell [Mon, 23 Apr 2018 14:37:03 +0000 (15:37 +0100)]
Don't build AFALG on android

This didn't get built anyway for gcc because it was detected as a cross
compile. But it did get built for clang - even though this is still a cross
compile build. This disables it in all cases for Android.

Fixes #5748

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/6057)

6 years agoAllow TLSv1.3 EC certs to use compressed points
Matt Caswell [Mon, 23 Apr 2018 13:02:23 +0000 (14:02 +0100)]
Allow TLSv1.3 EC certs to use compressed points

The spec does not prohib certs form using compressed points. It only
requires that points in a key share are uncompressed. It says nothing
about point compression for certs, so we should not fail if a cert uses a
compressed point.

Fixes #5743

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/6055)

6 years agoDocument when a session gets removed from cache
Matt Caswell [Mon, 23 Apr 2018 10:23:43 +0000 (11:23 +0100)]
Document when a session gets removed from cache

Document the fact that if a session is not closed down cleanly then the
session gets removed from the cache and marked as non-resumable.

Fixes #4720

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/6053)

6 years agoRemove some logically dead code
Matt Caswell [Mon, 23 Apr 2018 08:01:49 +0000 (09:01 +0100)]
Remove some logically dead code

This dead code should have been removed as part of #5874 but got missed.

Found by Coverity.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/6049)

6 years agoImprove backwards compat with 1.0.2 for ECDHParameters
Matt Caswell [Fri, 20 Apr 2018 13:12:11 +0000 (14:12 +0100)]
Improve backwards compat with 1.0.2 for ECDHParameters

In 1.0.2 you could configure automatic ecdh params by using the
ECDHParameters config directive and setting it to the value
"+Automatic" or just "Automatic". This is no longer required in 1.1.0+
but we still recognise the "+Automatic" keyword for backwards compatibility.
However we did not recognise just "Automatic" without the leading "+" which
is equally valid. This commit fixes that omission.

Fixes #4113

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6035)

6 years agoX509: add more error codes on malloc or sk_TYP_push failure
FdaSilvaYY [Wed, 28 Mar 2018 20:32:31 +0000 (22:32 +0200)]
X509: add more error codes on malloc or sk_TYP_push failure

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5837)

6 years agoa_strex.c: improve documentation of 'tag2nbyte' lookup table
Dr. Matthias St. Pierre [Fri, 20 Apr 2018 15:55:02 +0000 (17:55 +0200)]
a_strex.c: improve documentation of 'tag2nbyte' lookup table

The 'tag2nbyte' lookup table maps the tags of ASN1 string types
to their respective character widths. It is used for example by
ASN1_STRING_to_UTF8(). This commit adds the tag names as comments.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6062)

6 years agoRemove superfluous NULL checks. Add Andy's BN_FLG comment.
Billy Brumley [Mon, 23 Apr 2018 11:34:11 +0000 (14:34 +0300)]
Remove superfluous NULL checks. Add Andy's BN_FLG comment.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6009)

6 years agoMove up check for EC_R_INCOMPATIBLE_OBJECTS and for the point at infinity case
Nicola Tuveri [Fri, 20 Apr 2018 11:13:40 +0000 (11:13 +0000)]
Move up check for EC_R_INCOMPATIBLE_OBJECTS and for the point at infinity case

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6009)

6 years agoPass through
Nicola Tuveri [Fri, 20 Apr 2018 11:02:52 +0000 (11:02 +0000)]
Pass through

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6009)

6 years agoladder description: why it works
Billy Brumley [Thu, 19 Apr 2018 16:10:21 +0000 (19:10 +0300)]
ladder description: why it works

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6009)

6 years agoAddress code style comments
Nicola Tuveri [Thu, 19 Apr 2018 12:43:33 +0000 (12:43 +0000)]
Address code style comments

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6009)

6 years agoElliptic curve scalar multiplication with timing attack defenses
Billy Brumley [Thu, 19 Apr 2018 09:21:51 +0000 (12:21 +0300)]
Elliptic curve scalar multiplication with timing attack defenses

Co-authored-by: Nicola Tuveri <nic.tuv@gmail.com>
Co-authored-by: Cesar Pereida Garcia <cesar.pereidagarcia@tut.fi>
Co-authored-by: Sohaib ul Hassan <soh.19.hassan@gmail.com>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6009)

6 years agoFix usage of ossl_assert()
Kurt Roeckx [Sun, 22 Apr 2018 20:04:25 +0000 (22:04 +0200)]
Fix usage of ossl_assert()

Reviewed-by: Andy Polyakov <appro@openssl.org>
GH: #6044

6 years agoARM assembly pack: make it work with older assembler.
Andy Polyakov [Sun, 22 Apr 2018 14:09:56 +0000 (16:09 +0200)]
ARM assembly pack: make it work with older assembler.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/6043)

6 years ago00-base-templates.conf: wire keccak1600-armv4 module.
Andy Polyakov [Sun, 22 Apr 2018 12:08:28 +0000 (14:08 +0200)]
00-base-templates.conf: wire keccak1600-armv4 module.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6042)

6 years agosha/asm/keccak1600-armv4.pl: adapt for multi-platform.
Andy Polyakov [Sun, 22 Apr 2018 11:59:52 +0000 (13:59 +0200)]
sha/asm/keccak1600-armv4.pl: adapt for multi-platform.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6042)

6 years ago00-base-templates.conf: wire keccak1600-ppc64 module.
Andy Polyakov [Sun, 22 Apr 2018 11:45:12 +0000 (13:45 +0200)]
00-base-templates.conf: wire keccak1600-ppc64 module.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6042)

6 years ago00-base-templates.conf: wire keccak1600-s390x module.
Andy Polyakov [Sun, 22 Apr 2018 11:09:49 +0000 (13:09 +0200)]
00-base-templates.conf: wire keccak1600-s390x module.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6042)

6 years ago00-base-templates.conf: wire keccak1600-armv8 module.
Andy Polyakov [Sun, 22 Apr 2018 11:00:28 +0000 (13:00 +0200)]
00-base-templates.conf: wire keccak1600-armv8 module.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6042)

6 years ago00-base-templates.conf: wire keccak1600-x86_64 module.
Andy Polyakov [Sun, 22 Apr 2018 10:56:31 +0000 (12:56 +0200)]
00-base-templates.conf: wire keccak1600-x86_64 module.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6042)

6 years agosha/asm/keccak1600-x86_64.pl: make it work on Windows.
Andy Polyakov [Sun, 22 Apr 2018 10:48:56 +0000 (12:48 +0200)]
sha/asm/keccak1600-x86_64.pl: make it work on Windows.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6042)

6 years agoConfigure: add $target{keccak1600_asm_src}.
Andy Polyakov [Sun, 22 Apr 2018 08:42:59 +0000 (10:42 +0200)]
Configure: add $target{keccak1600_asm_src}.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6042)

6 years agosha/asm/keccak1600-armv8.pl: halve the size of hw-assisted subroutine.
Andy Polyakov [Sun, 22 Apr 2018 10:24:09 +0000 (12:24 +0200)]
sha/asm/keccak1600-armv8.pl: halve the size of hw-assisted subroutine.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
6 years ago.travis.yml: switch to newer osx image.
Andy Polyakov [Sun, 22 Apr 2018 19:14:15 +0000 (21:14 +0200)]
.travis.yml: switch to newer osx image.

Default osx image runs Mac OS X 10.12, which apparently suffers from
infrequent socket failures affecting some tests. Later image runs
10.13...

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5986)

6 years agoFix openssl ca, to correctly make output file binary when using -spkac
Richard Levitte [Mon, 23 Apr 2018 08:22:56 +0000 (10:22 +0200)]
Fix openssl ca, to correctly make output file binary when using -spkac

On Unix, this doesn't matter, but on other platforms, it may.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6050)

6 years agoFix late opening of output file
Richard Levitte [Mon, 23 Apr 2018 08:26:05 +0000 (10:26 +0200)]
Fix late opening of output file

For 'openssl dhparams', the output file was opened after calculations
were made, which is a waste of cycles and time if the output file
turns out not to be writable.

Fixes #3404

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6051)

6 years agoAdd support for getrandom() or equivalent system calls and use them by default
Kurt Roeckx [Sun, 8 Apr 2018 18:20:25 +0000 (20:20 +0200)]
Add support for getrandom() or equivalent system calls and use them by default

Reviewed-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
GH: #5910

6 years agoFix building linux-armv4 with --strict-warnings
Bernd Edlinger [Thu, 19 Apr 2018 18:56:46 +0000 (20:56 +0200)]
Fix building linux-armv4 with --strict-warnings

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6026)

6 years agoEnsure the thread keys are always allocated in the same order
Bernd Edlinger [Fri, 20 Apr 2018 13:45:06 +0000 (15:45 +0200)]
Ensure the thread keys are always allocated in the same order

Fixes: #5899

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5911)

6 years agoopenssl/err.h: remove duplicate OSSL_STOREerr()
Dr. Matthias St. Pierre [Thu, 19 Apr 2018 21:33:32 +0000 (23:33 +0200)]
openssl/err.h: remove duplicate OSSL_STOREerr()

Two definitions in lines 127 and 136, introduced in 71a5516dcc8.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6029)

6 years agoopenssl/ssl.h: restore some renamed public SSL_CTRL defines
Dr. Matthias St. Pierre [Thu, 19 Apr 2018 16:26:36 +0000 (18:26 +0200)]
openssl/ssl.h: restore some renamed public SSL_CTRL defines

Fixes #6022

In commit de4d764e3271, the following SSL_CTRL #define's where renamed

    SSL_CTRL_GET_CURVES        ->  SSL_CTRL_GET_GROUPS
    SSL_CTRL_SET_CURVES        ->  SSL_CTRL_SET_GROUPS
    SSL_CTRL_SET_CURVES_LIST   ->  SSL_CTRL_SET_GROUPS_LIST
    SSL_CTRL_GET_SHARED_CURVE  ->  SSL_CTRL_GET_SHARED_GROUP

The corresponding function-like macros (e.g, SSL_get1_curves(ctx, s)) were
renamed, too, and compatibility #define's were added. This was overlooked for
the above constants. Since the constants are part of the public interface,
they must not be removed for a minor release.

As a consequence the Qt5 configure check (and the build) fails.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6023)

6 years agoAdd a test for SSL_pending()
Matt Caswell [Thu, 19 Apr 2018 15:44:17 +0000 (16:44 +0100)]
Add a test for SSL_pending()

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6020)

6 years agoFix SSL_pending() for DTLS
Matt Caswell [Thu, 19 Apr 2018 15:42:39 +0000 (16:42 +0100)]
Fix SSL_pending() for DTLS

DTLS was not correctly returning the number of pending bytes left in
a call to SSL_pending(). This makes the detection of truncated packets
almost impossible.

Fixes #5478

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6020)

6 years agoTest the state of SSL_in_init() from the info_callback
Matt Caswell [Thu, 19 Apr 2018 14:44:52 +0000 (15:44 +0100)]
Test the state of SSL_in_init() from the info_callback

Check that in a handshake done event SSL_in_init() is 0 (see #4574)

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6019)

6 years agoMake sure SSL_in_init() returns 0 at SSL_CB_HANDSHAKE_DONE
Matt Caswell [Thu, 19 Apr 2018 14:26:28 +0000 (15:26 +0100)]
Make sure SSL_in_init() returns 0 at SSL_CB_HANDSHAKE_DONE

In 1.1.0 and before calling SSL_in_init() from the info_callback
at SSL_CB_HANDSHAKE_DONE would return 0. This commit fixes it so
that it does again for 1.1.1. This broke Node.

Fixes #4574

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6019)

6 years agoDocument supported digest functions
Kurt Roeckx [Tue, 26 Dec 2017 13:40:37 +0000 (14:40 +0100)]
Document supported digest functions

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6024)

6 years agoEnable all implemented digests
Richard Levitte [Thu, 19 Apr 2018 18:15:41 +0000 (20:15 +0200)]
Enable all implemented digests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6025)

6 years agoClear buffer in PEM_write_bio
Bernd Edlinger [Fri, 30 Mar 2018 17:13:06 +0000 (19:13 +0200)]
Clear buffer in PEM_write_bio

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5814)

6 years agoReflect special `DEFAULT` behavior in ciphers(1)
Alois Mahdal [Wed, 21 Feb 2018 15:49:33 +0000 (16:49 +0100)]
Reflect special `DEFAULT` behavior in ciphers(1)

Actual behavior of DEFAULT is different than currently described.
Rather than actinf as cipher string, DEFAULT cannot be combined using
logical operators, etc.

Fixes #5420.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5428)

6 years agoDon't distribute team internal config targets
Richard Levitte [Mon, 2 Apr 2018 08:24:33 +0000 (10:24 +0200)]
Don't distribute team internal config targets

Configurations/90-team.conf isn't for public consumption, so we rename
it to 90-team.norelease.conf and make sure 'make dist' and 'make tar'
don't include it in the tarball.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5836)