oweals/openssl.git
7 years agoUpdate ossl_config.json for later BoringSSL commit
Matt Caswell [Tue, 14 Mar 2017 10:18:21 +0000 (10:18 +0000)]
Update ossl_config.json for later BoringSSL commit

Update the list of suppressions so that we can run a later BoringSSL set
of tests. This also adds an ErrorMap to greatly reduce the number of
failing tests. The remaining tests that still fail are just disabled for
now.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2930)

7 years agoMake the Boring tests pass
Matt Caswell [Tue, 14 Mar 2017 09:59:51 +0000 (09:59 +0000)]
Make the Boring tests pass

The boring tests are currently failing because they send a PSK extension
which isn't in the last place. This is not allowed in the latest TLS1.3
specs. However the Boring tests we have are based on an old commit that
pre-date when that rule first appeared.

The proper solution is to update the tests to a later commit. But for now
to get travis to go green we disable the failing tests.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2928)

7 years agoAdd the presence of ARIA to the change log.
Pauli [Tue, 14 Mar 2017 04:08:02 +0000 (14:08 +1000)]
Add the presence of ARIA to the change log.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2926)

7 years agoAdded a test case for RSA_padding_add_PKCS1_PSS_mgf1.
Bernd Edlinger [Thu, 2 Mar 2017 12:15:22 +0000 (13:15 +0100)]
Added a test case for RSA_padding_add_PKCS1_PSS_mgf1.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2801)

7 years agoFix a crash or unbounded allocation in RSA_padding_add_PKCS1_PSS_mgf1
Bernd Edlinger [Mon, 27 Feb 2017 11:40:35 +0000 (12:40 +0100)]
Fix a crash or unbounded allocation in RSA_padding_add_PKCS1_PSS_mgf1
and RSA_verify_PKCS1_PSS_mgf1 with 512-bit RSA vs. sha-512.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2801)

7 years agoBetter way to recognise mingw64 in config script
Richard Levitte [Mon, 13 Mar 2017 20:25:37 +0000 (21:25 +0100)]
Better way to recognise mingw64 in config script

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2922)

7 years agopoly1305/asm/poly1305-x86_64.pl: add poly1305_blocks_vpmadd52_4x.
Andy Polyakov [Sun, 12 Mar 2017 14:37:16 +0000 (15:37 +0100)]
poly1305/asm/poly1305-x86_64.pl: add poly1305_blocks_vpmadd52_4x.

As hinted by its name new subroutine processes 4 input blocks in
parallel. It still operates on 256-bit registers and is just
another step toward full-blown AVX512IFMA procedure.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agopoly1305/asm/poly1305-armv8.pl: ilp32-specific poly1305_init fix.
Andy Polyakov [Sun, 12 Mar 2017 14:32:59 +0000 (15:32 +0100)]
poly1305/asm/poly1305-armv8.pl: ilp32-specific poly1305_init fix.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agocrypto/x86*cpuid.pl: move extended feature detection.
Andy Polyakov [Sun, 12 Mar 2017 13:45:06 +0000 (14:45 +0100)]
crypto/x86*cpuid.pl: move extended feature detection.

Exteneded feature flags were not pulled on AMD processors, as result
a number of extensions were effectively masked on Ryzen. Original fix
for x86_64cpuid.pl addressed this problem, but messed up processor
vendor detection. This fix moves extended feature detection past
basic feature detection where it belongs. 32-bit counterpart is
harmonized too.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoDocument in CHANGES that config now recognises 64-bit mingw
Richard Levitte [Mon, 13 Mar 2017 12:20:55 +0000 (13:20 +0100)]
Document in CHANGES that config now recognises 64-bit mingw

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2917)

7 years agoRecognise mingw64 in config script
Richard Levitte [Mon, 13 Mar 2017 08:09:43 +0000 (09:09 +0100)]
Recognise mingw64 in config script

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2914)

7 years agoFix some doc nits
Rich Salz [Sat, 11 Mar 2017 17:48:32 +0000 (12:48 -0500)]
Fix some doc nits

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2909)

7 years agoFix out-of-memory condition in conf
Matt Caswell [Fri, 10 Mar 2017 10:51:35 +0000 (10:51 +0000)]
Fix out-of-memory condition in conf

conf has the ability to expand variables in config files. Repeatedly doing
this can lead to an exponential increase in the amount of memory required.
This places a limit on the length of a value that can result from an
expansion.

Credit to OSS-Fuzz for finding this problem.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2894)

7 years agoHandle find-doc-nits script rename
Rich Salz [Sat, 11 Mar 2017 15:28:45 +0000 (10:28 -0500)]
Handle find-doc-nits script rename

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoFix many doc L<> errors
Rich Salz [Sat, 11 Mar 2017 13:56:44 +0000 (08:56 -0500)]
Fix many doc L<> errors

Add 2017 copyright year
Add missing typedef to NAME
Remove ec(7) and bn(7) doc links
Remove .pod link errors, bogus links, make a few typo corrections
Fix some typo's in links and some missing items.
Don't link to C runtime functions (See OPENSSL_malloc for example/precedent)
Document ASN1_tag2str(), add a few typedef's that were missing from NAME
Update doc-nits target; addresses
    https://github.com/openssl/openssl/pull/1900#issuecomment-259943891,
Merge check-doc-links into find-doc-nits; if run regularly, would have found
    https://github.com/openssl/openssl/pull/2825

Reviewed-by: Richard Levitte <levitte@openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/2862)

7 years agoUI docs: Rephrase the UI method function return value description
Richard Levitte [Sat, 11 Mar 2017 09:51:04 +0000 (10:51 +0100)]
UI docs: Rephrase the UI method function return value description

It seems the =item isn't supposed to have pure numbers, or so tells me
perldoc.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2906)

7 years agoFix UI_get0_action_string()
Richard Levitte [Fri, 10 Mar 2017 23:54:52 +0000 (00:54 +0100)]
Fix UI_get0_action_string()

It shouldn't try to return an action description for UIT_PROMPT type
UI strings.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2904)

7 years agoDocument UI_METHOD and UI_STRING, both useful for UI_METHOD creators
Richard Levitte [Fri, 10 Mar 2017 23:51:53 +0000 (00:51 +0100)]
Document UI_METHOD and UI_STRING, both useful for UI_METHOD creators

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2903)

7 years agoUse the callbacks from the SSL object instead of the SSL_CTX object
Pauli [Tue, 7 Mar 2017 05:36:16 +0000 (15:36 +1000)]
Use the callbacks from the SSL object instead of the SSL_CTX object

... in functions dealing with the SSL object rather than the context.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2870)

7 years agoEncourage having external tests in multiple test recipes
Richard Levitte [Fri, 10 Mar 2017 19:42:12 +0000 (20:42 +0100)]
Encourage having external tests in multiple test recipes

This will make the individual external tests more easily selectable /
deselectable through the usual test selection mechanism.

This also moves external tests to group 95.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2902)

7 years agoAvoid questionable use of the value of a pointer
Bernd Edlinger [Fri, 10 Mar 2017 14:10:41 +0000 (15:10 +0100)]
Avoid questionable use of the value of a pointer

that refers to space
deallocated by a call to the free function in tls_decrypt_ticket.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2897)
(cherry picked from commit 13ed1afa923f4ffb553e389de08f26e9ce84e8a2)

7 years agoSplit test/recipes/03_test_internal.t into individual tests
Richard Levitte [Fri, 10 Mar 2017 19:18:56 +0000 (20:18 +0100)]
Split test/recipes/03_test_internal.t into individual tests

This allows a finer granularity when selecting which tests to run, and
makes the tests more vidible.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2901)

7 years agoDocument how to select / deselect test group numbers
Richard Levitte [Fri, 10 Mar 2017 07:32:58 +0000 (08:32 +0100)]
Document how to select / deselect test group numbers

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2892)

7 years agoAdd HelloRetryRequest text to s_client/s_server
Todd Short [Fri, 10 Mar 2017 16:51:17 +0000 (11:51 -0500)]
Add HelloRetryRequest text to s_client/s_server

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2900)

7 years agoFix some RSA documentation
Matt Caswell [Fri, 10 Mar 2017 15:49:04 +0000 (15:49 +0000)]
Fix some RSA documentation

RSA_private_encrypt(), RSA_public_decrypt(), RSA_public_encrypt() and
RSA_private_decrypt() are declared with a "const" from parameter, but
this is not reflected in the docs.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2899)

7 years agoUse the new TLSv1.3 certificate_required alert where appropriate
Matt Caswell [Fri, 10 Mar 2017 15:09:24 +0000 (15:09 +0000)]
Use the new TLSv1.3 certificate_required alert where appropriate

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2898)

7 years agoAdd a test to check that if a PSK extension is not last then we fail
Matt Caswell [Fri, 10 Mar 2017 13:54:32 +0000 (13:54 +0000)]
Add a test to check that if a PSK extension is not last then we fail

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2896)

7 years agoCheck that the PSK extension is last
Matt Caswell [Fri, 10 Mar 2017 13:53:53 +0000 (13:53 +0000)]
Check that the PSK extension is last

We need to check that the PSK extension in a ClientHello is the last one.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2896)

7 years agoFixup previous merge.
Bernd Edlinger [Wed, 22 Feb 2017 07:14:07 +0000 (08:14 +0100)]
Fixup previous merge.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2703)

7 years agoMake it possible to select or deselect test groups by number
Richard Levitte [Thu, 9 Mar 2017 18:08:03 +0000 (19:08 +0100)]
Make it possible to select or deselect test groups by number

Examples of possible expressions (adapt to your platform):

    make test TESTS=-99
    make test TESTS=10
    make test TESTS=-9?
    make test TESTS=-[89]0
    make test TESTS=[89]0

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2887)

7 years agoMake the output of enc -ciphers identical even if run several times in a session.
Pauli [Wed, 8 Mar 2017 23:42:25 +0000 (09:42 +1000)]
Make the output of enc -ciphers identical even if run several times in a session.

This amounts to moving the column counter so it isn't a function local static variable and reinitialising it each time.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2884)

7 years agoExit the loop on failure
Jon Spillett [Wed, 1 Mar 2017 04:22:21 +0000 (14:22 +1000)]
Exit the loop on failure

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2805)

7 years agoAdd some TLS13 values to s_client/s_server
Todd Short [Wed, 8 Mar 2017 18:49:44 +0000 (13:49 -0500)]
Add some TLS13 values to s_client/s_server

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2882)

7 years agoLimit the output of the enc -ciphers command to just the ciphers enc can
Pauli [Wed, 8 Mar 2017 01:18:55 +0000 (11:18 +1000)]
Limit the output of the enc -ciphers command to just the ciphers enc can
process.  This means no AEAD ciphers and no XTS mode.

Update the test script that uses this output to test cipher suites to not
filter out the now missing cipher modes.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2876)

7 years agothis change will prevent undefined behavior when src and dst are equal (memcpy),...
Roberto Guimaraes [Sun, 26 Feb 2017 23:47:40 +0000 (15:47 -0800)]
this change will prevent undefined behavior when src and dst are equal (memcpy), effectively allowing setting length only in both functions.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2750)

7 years agoFix no-comp
Matt Caswell [Tue, 7 Mar 2017 09:58:27 +0000 (09:58 +0000)]
Fix no-comp

The value of SSL3_RT_MAX_ENCRYPTED_LENGTH normally includes the compression
overhead (even if no compression is negotiated for a connection). Except in
a build where no-comp is used the value of SSL3_RT_MAX_ENCRYPTED_LENGTH does
not include the compression overhead.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2872)

7 years agoFix the number of tests to skip if TLSv1.3 is disabled
Matt Caswell [Tue, 7 Mar 2017 16:21:38 +0000 (16:21 +0000)]
Fix the number of tests to skip if TLSv1.3 is disabled

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2875)

7 years agoAdd a test for records not on the record boundary
Matt Caswell [Tue, 7 Mar 2017 12:03:10 +0000 (12:03 +0000)]
Add a test for records not on the record boundary

Test that we check that key change messages appear on a record boundary.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2875)

7 years agoCheck TLSv1.3 ServerHello, Finished and KeyUpdates are on record boundary
Matt Caswell [Tue, 7 Mar 2017 10:21:58 +0000 (10:21 +0000)]
Check TLSv1.3 ServerHello, Finished and KeyUpdates are on record boundary

In TLSv1.3 the above messages signal a key change. The spec requires that
the end of these messages must align with a record boundary. We can detect
this by checking for decrypted but as yet unread record data sitting in
OpenSSL buffers at the point where we process the messages.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2875)

7 years agoProvide a function to test whether we have unread records pending
Matt Caswell [Fri, 3 Mar 2017 12:41:39 +0000 (12:41 +0000)]
Provide a function to test whether we have unread records pending

Also updates SSL_has_pending() to use it. This actually fixes a bug in
SSL_has_pending() which is supposed to return 1 if we have any processed
or unprocessed data sitting in OpenSSL buffers. However it failed to return
1 if we had processed non-application data pending.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2875)

7 years agoRemove doc reference to non-existant GCM example
Pauli [Mon, 6 Mar 2017 22:45:48 +0000 (08:45 +1000)]
Remove doc reference to non-existant GCM example

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2866)

7 years agoGet pointer type right in BIO_ssl_shutdown()
Rich Salz [Thu, 16 Feb 2017 16:13:47 +0000 (11:13 -0500)]
Get pointer type right in BIO_ssl_shutdown()

Also, restore 1.0.2 behavior of looping over all BIO's in the chain.
Thanks to Joseph Bester for finding this and suggesting a fix to the
crash.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2651)

7 years agocrypto/x86_64cpuid.pl: move extended feature detection upwards.
Andy Polyakov [Sun, 5 Mar 2017 19:38:36 +0000 (20:38 +0100)]
crypto/x86_64cpuid.pl: move extended feature detection upwards.

Exteneded feature flags were not pulled on AMD processors, as result a
number of extensions were effectively masked on Ryzen. It should have
been reported for Excavator since it implements AVX2 extension, but
apparently nobody noticed or cared...

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agotest: add chacha_internal_test.
Andy Polyakov [Sat, 4 Mar 2017 22:11:16 +0000 (23:11 +0100)]
test: add chacha_internal_test.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoIncrease the password buffer size to APP_PASS_LEN.
Pauli [Tue, 7 Mar 2017 00:12:05 +0000 (10:12 +1000)]
Increase the password buffer size to APP_PASS_LEN.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2868)

7 years agoUnix Makefile: Have manual generation use the same perl script as Windows and VMS
Richard Levitte [Mon, 6 Mar 2017 20:17:32 +0000 (21:17 +0100)]
Unix Makefile: Have manual generation use the same perl script as Windows and VMS

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2863)

7 years agoutil/process_docs.pl: make it possible to add a suffix to man docs
Richard Levitte [Mon, 6 Mar 2017 20:16:35 +0000 (21:16 +0100)]
util/process_docs.pl: make it possible to add a suffix to man docs

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2863)

7 years agoAdd a test to check that we correctly handle record overflows
Matt Caswell [Mon, 6 Mar 2017 16:56:42 +0000 (16:56 +0000)]
Add a test to check that we correctly handle record overflows

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2861)

7 years agoTweak the TLSv1.3 record overflow limits
Matt Caswell [Mon, 6 Mar 2017 15:13:25 +0000 (15:13 +0000)]
Tweak the TLSv1.3 record overflow limits

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2861)

7 years agoFix double free in cookie generation.
Kurt Roeckx [Sun, 5 Mar 2017 20:00:11 +0000 (21:00 +0100)]
Fix double free in cookie generation.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
GH: #2850

7 years agoRemove some duplicate manpage entries
Rich Salz [Fri, 3 Mar 2017 20:03:42 +0000 (15:03 -0500)]
Remove some duplicate manpage entries

[skip ci]

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2860)

7 years agoAdd documentation on platform specific checks
Richard Levitte [Mon, 6 Mar 2017 10:19:49 +0000 (11:19 +0100)]
Add documentation on platform specific checks

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2851)

7 years agoAdd a platform specific configuration checker
Richard Levitte [Sun, 5 Mar 2017 20:51:18 +0000 (21:51 +0100)]
Add a platform specific configuration checker

For each platform, we may need to perform some basic checks to see
that available tools perform as we expect them.

For the moment, the added checkers test that Perl gives the expected
path format.  This should help MingW users to see if they run an
appropriate Perl implementation, for example.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2851)

7 years agoFix an endless loop in rsa_builtin_keygen.
Rich Salz [Mon, 6 Mar 2017 14:54:17 +0000 (09:54 -0500)]
Fix an endless loop in rsa_builtin_keygen.

And add a test case.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2757)

7 years agoFix no-ec
Matt Caswell [Mon, 6 Mar 2017 10:16:07 +0000 (10:16 +0000)]
Fix no-ec

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2858)

7 years agoFix a test failure with no-tls1_1
Matt Caswell [Mon, 6 Mar 2017 10:03:53 +0000 (10:03 +0000)]
Fix a test failure with no-tls1_1

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2857)

7 years agoFix no-psk
Matt Caswell [Mon, 6 Mar 2017 09:51:54 +0000 (09:51 +0000)]
Fix no-psk

Fixes #2847

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2856)

7 years agoDon't call memcmp with a NULL pointer
Matt Caswell [Sat, 4 Mar 2017 23:58:03 +0000 (23:58 +0000)]
Don't call memcmp with a NULL pointer

If early data is sent to a server, but ALPN is not used then memcmp is
called with a NULL pointer which is undefined behaviour.

Fixes #2841

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2845)

7 years agoAdd a test for TLSv1.3 cookies
Matt Caswell [Fri, 3 Mar 2017 10:28:02 +0000 (10:28 +0000)]
Add a test for TLSv1.3 cookies

We just check that if we insert a cookie into an HRR it gets echoed back
in the subsequent ClientHello.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2839)

7 years agoAdd basic TLSv1.3 cookie support
Matt Caswell [Thu, 2 Mar 2017 17:37:03 +0000 (17:37 +0000)]
Add basic TLSv1.3 cookie support

We do not allow the generation of TLSv1.3 cookies. But if we receive one
in an HRR we will echo it back in the ClientHello.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2839)

7 years agoappveyor.yml: call upon cmd to redirect stderr.
Andy Polyakov [Thu, 2 Mar 2017 13:07:45 +0000 (14:07 +0100)]
appveyor.yml: call upon cmd to redirect stderr.

If stderr is not redirected an uncatchable exception is thrown.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoapps/s_client.c: harden ldap_ExtendedResponse_parse.
Andy Polyakov [Thu, 2 Mar 2017 15:56:44 +0000 (16:56 +0100)]
apps/s_client.c: harden ldap_ExtendedResponse_parse.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoFix a memory leak on an error path
Matt Caswell [Sat, 4 Mar 2017 15:45:40 +0000 (15:45 +0000)]
Fix a memory leak on an error path

A leak of an SSL_SESSION object can occur when decoding a psk extension on
an error path when using TLSv1.3

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2843)

7 years agoEnsure we don't call memcpy with a NULL pointer
Matt Caswell [Fri, 3 Mar 2017 08:56:25 +0000 (08:56 +0000)]
Ensure we don't call memcpy with a NULL pointer

Commit d5aa14dd simplified the bn_expand_internal() and BN_copy() functions.
Unfortunately it also removed some checks which are still required,
otherwise we call memcpy passing in NULL which is not allowed.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2836)

7 years agoUpdate and add test
Dr. Stephen Henson [Fri, 3 Mar 2017 21:02:42 +0000 (21:02 +0000)]
Update and add test

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2840)

7 years agoSet specific error is we have no valid signature algorithms set
Dr. Stephen Henson [Fri, 3 Mar 2017 03:23:27 +0000 (03:23 +0000)]
Set specific error is we have no valid signature algorithms set

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2840)

7 years agoSignature algorithm enhancement.
Dr. Stephen Henson [Fri, 3 Mar 2017 03:10:13 +0000 (03:10 +0000)]
Signature algorithm enhancement.

Change tls12_sigalg_allowed() so it is passed a SIGALG_LOOKUP parameter,
this avoids multiple lookups.

When we copy signature algorithms return an error if no valid TLS message
signing algorithm is present. For TLS 1.3 this means we need at least one
signature algorithm other than RSA PKCS#1 or SHA1 both of which can only be
used to sign certificates and not TLS messages.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2840)

7 years agoDisallow zero length signature algorithms
Dr. Stephen Henson [Fri, 3 Mar 2017 02:44:18 +0000 (02:44 +0000)]
Disallow zero length signature algorithms

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2840)

7 years agoDon't allow DSA for TLS 1.3
Dr. Stephen Henson [Wed, 1 Mar 2017 17:15:43 +0000 (17:15 +0000)]
Don't allow DSA for TLS 1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2840)

7 years agouse OSSLzu instead of lu format for size_t display
edelangh [Fri, 17 Feb 2017 12:23:22 +0000 (13:23 +0100)]
use OSSLzu instead of lu format for size_t display

CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2660)

7 years agoReset executable bits on files where not needed.
Bernd Edlinger [Fri, 3 Mar 2017 08:13:40 +0000 (09:13 +0100)]
Reset executable bits on files where not needed.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2835)

7 years agoUpdate the cipher(1) documentation to explicitly state that the RSA cipher
Pauli [Thu, 2 Mar 2017 02:52:44 +0000 (12:52 +1000)]
Update the cipher(1) documentation to explicitly state that the RSA cipher
string means the same a kRSA.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2821)

7 years agosh_malloc & sh_free prototype change to match POSIX
Rich Salz [Fri, 3 Mar 2017 00:16:57 +0000 (19:16 -0500)]
sh_malloc & sh_free prototype change to match POSIX

CLA: trivial

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2823)

7 years agoSilence some more clang warnings
Matt Caswell [Fri, 3 Mar 2017 00:03:47 +0000 (00:03 +0000)]
Silence some more clang warnings

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2832)

7 years agoSilence some clang warnings
Matt Caswell [Thu, 2 Mar 2017 23:53:30 +0000 (23:53 +0000)]
Silence some clang warnings

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2831)

7 years agoMore early data documentation updates following feedback
Matt Caswell [Thu, 2 Mar 2017 17:40:43 +0000 (17:40 +0000)]
More early data documentation updates following feedback

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoUpdate the API documentation for the latest early data changes
Matt Caswell [Thu, 2 Mar 2017 16:05:02 +0000 (16:05 +0000)]
Update the API documentation for the latest early data changes

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoUpdate early data API for writing to unauthenticated clients
Matt Caswell [Thu, 2 Mar 2017 15:49:33 +0000 (15:49 +0000)]
Update early data API for writing to unauthenticated clients

Change the early data API so that the server must use
SSL_write_early_data() to write to an unauthenticated client.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoRename SSL_write_early() to SSL_write_early_data()
Matt Caswell [Thu, 2 Mar 2017 15:05:36 +0000 (15:05 +0000)]
Rename SSL_write_early() to SSL_write_early_data()

This is for consistency with the rest of the API where all the functions
are called *early_data*.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoRename SSL_read_early() to SSL_read_early_data()
Matt Caswell [Thu, 2 Mar 2017 14:42:55 +0000 (14:42 +0000)]
Rename SSL_read_early() to SSL_read_early_data()

This is for consistency with the rest of the API where all the functions
are called *early_data*.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoUpdates to the early data documentation
Matt Caswell [Tue, 28 Feb 2017 00:40:24 +0000 (00:40 +0000)]
Updates to the early data documentation

Following on from the latest API changes.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoUpdates to s_server and s_client for the latest early_data API changes
Matt Caswell [Mon, 27 Feb 2017 20:55:04 +0000 (20:55 +0000)]
Updates to s_server and s_client for the latest early_data API changes

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoMake SSL_write_early_finish() an internal only function
Matt Caswell [Mon, 27 Feb 2017 20:54:39 +0000 (20:54 +0000)]
Make SSL_write_early_finish() an internal only function

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoAdd early_data tests
Matt Caswell [Mon, 27 Feb 2017 11:20:22 +0000 (11:20 +0000)]
Add early_data tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoVarious fixes required to allow SSL_write/SSL_read during early data
Matt Caswell [Mon, 27 Feb 2017 11:19:57 +0000 (11:19 +0000)]
Various fixes required to allow SSL_write/SSL_read during early data

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoEnable the server to call SSL_write() without stopping the ability to call SSL_read_e...
Matt Caswell [Sat, 25 Feb 2017 15:59:44 +0000 (15:59 +0000)]
Enable the server to call SSL_write() without stopping the ability to call SSL_read_early()

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoEnable the client to call SSL_read() without stopping the ability to call SSL_write_e...
Matt Caswell [Sat, 25 Feb 2017 15:34:07 +0000 (15:34 +0000)]
Enable the client to call SSL_read() without stopping the ability to call SSL_write_early()

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoIntroduce a new early_data state in the state machine
Matt Caswell [Sat, 25 Feb 2017 00:06:49 +0000 (00:06 +0000)]
Introduce a new early_data state in the state machine

Also simplifies the state machine a bit.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoImprove the early data sanity check in SSL_do_handshake()
Matt Caswell [Fri, 24 Feb 2017 17:08:41 +0000 (17:08 +0000)]
Improve the early data sanity check in SSL_do_handshake()

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoAdd documentation for the new s_client and s_server early_data options
Matt Caswell [Fri, 24 Feb 2017 16:17:00 +0000 (16:17 +0000)]
Add documentation for the new s_client and s_server early_data options

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoTighten sanity checks when calling early data functions
Matt Caswell [Fri, 24 Feb 2017 16:11:03 +0000 (16:11 +0000)]
Tighten sanity checks when calling early data functions

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoAdd documentation for the early data functions
Matt Caswell [Fri, 24 Feb 2017 15:38:38 +0000 (15:38 +0000)]
Add documentation for the early data functions

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoMake SSL_get_early_data_status() take a const
Matt Caswell [Fri, 24 Feb 2017 14:17:41 +0000 (14:17 +0000)]
Make SSL_get_early_data_status() take a const

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoMake SSL_get_max_early_data() and SSL_CTX_get_max_early_data() take a const
Matt Caswell [Fri, 24 Feb 2017 14:08:59 +0000 (14:08 +0000)]
Make SSL_get_max_early_data() and SSL_CTX_get_max_early_data() take a const

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoAdd a SSL_SESSION_get_max_early_data() function
Matt Caswell [Fri, 24 Feb 2017 14:08:06 +0000 (14:08 +0000)]
Add a SSL_SESSION_get_max_early_data() function

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoDon't attempt to write more early_data than we know the server will accept
Matt Caswell [Fri, 24 Feb 2017 13:51:04 +0000 (13:51 +0000)]
Don't attempt to write more early_data than we know the server will accept

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoOnly accept early_data if the negotiated ALPN is the same
Matt Caswell [Fri, 24 Feb 2017 12:45:37 +0000 (12:45 +0000)]
Only accept early_data if the negotiated ALPN is the same

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoSkip early_data if appropriate after a HelloRetryRequest
Matt Caswell [Fri, 24 Feb 2017 11:40:49 +0000 (11:40 +0000)]
Skip early_data if appropriate after a HelloRetryRequest

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoDon't accept early_data if we are going to issue a HelloRetryRequest
Matt Caswell [Fri, 24 Feb 2017 11:13:25 +0000 (11:13 +0000)]
Don't accept early_data if we are going to issue a HelloRetryRequest

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoAdd extra validation parsing the server-to-client early_data extension
Matt Caswell [Fri, 24 Feb 2017 10:29:20 +0000 (10:29 +0000)]
Add extra validation parsing the server-to-client early_data extension

Check that we actually resumed the session, and that we selected the first
identity.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)