oweals/openssl.git
8 years agoAdapt builtin cipher implementations to opaque EVP_CIPHER
Richard Levitte [Fri, 18 Dec 2015 16:01:28 +0000 (17:01 +0100)]
Adapt builtin cipher implementations to opaque EVP_CIPHER

They all stop including evp_locl.h, so we also take care of their
adaptation to opaque EVP_CIPHER_CTX, as was promised in an earlier
commit.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdapt the internal EVP routines to opaque EVP_CIPHER
Richard Levitte [Fri, 18 Dec 2015 16:00:46 +0000 (17:00 +0100)]
Adapt the internal EVP routines to opaque EVP_CIPHER

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMake EVP_CIPHER opaque and add creator/destructor/accessor/writer functions
Richard Levitte [Fri, 18 Dec 2015 15:37:02 +0000 (16:37 +0100)]
Make EVP_CIPHER opaque and add creator/destructor/accessor/writer functions

We follow the method used for EVP_MD.
Also, move all the internal EVP_CIPHER building macros from evp_locl.h
to evp_int.h.  This will benefit our builtin EVP_CIPHERs.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRemove EVP_CIPHER_CTX_flags, it's only confusing
Richard Levitte [Fri, 18 Dec 2015 14:06:30 +0000 (15:06 +0100)]
Remove EVP_CIPHER_CTX_flags, it's only confusing

EVP_CIPHER_CTX_flags was returning the flags of its associated
EVP_CIPHER.  However, EVP_CIPHER_CTX has flags of its own, so this
function is quite confusing and therefore error prone.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdapt all EVP_CIPHER_CTX users for it becoming opaque
Richard Levitte [Sun, 13 Dec 2015 21:08:41 +0000 (22:08 +0100)]
Adapt all EVP_CIPHER_CTX users for it becoming opaque

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdapt cipher implementations to opaque EVP_CIPHER_CTX
Richard Levitte [Sun, 13 Dec 2015 21:06:14 +0000 (22:06 +0100)]
Adapt cipher implementations to opaque EVP_CIPHER_CTX

Note: there's a larger number of implementations in crypto/evp/ that
aren't affected because they include evp_locl.h.  They will be handled
in a separate commit.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdapt the internal EVP routines to opaque EVP_CIPHER_CTX
Richard Levitte [Sun, 13 Dec 2015 20:36:33 +0000 (21:36 +0100)]
Adapt the internal EVP routines to opaque EVP_CIPHER_CTX

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd accessors and writers for EVP_CIPHER_CTX
Richard Levitte [Sun, 13 Dec 2015 20:25:42 +0000 (21:25 +0100)]
Add accessors and writers for EVP_CIPHER_CTX

New functions:

- EVP_CIPHER_CTX_encrypting()
- EVP_CIPHER_CTX_iv()
- EVP_CIPHER_CTX_iv_noconst()
- EVP_CIPHER_CTX_original_iv()
- EVP_CIPHER_CTX_buf_noconst()
- EVP_CIPHER_CTX_num()
- EVP_CIPHER_CTX_set_num()
- EVP_CIPHER_CTX_cipher_data()
- EVP_CIPHER_CTX_new_cipher_data()

Note that the accessors / writers for iv, buf and num may go away, as
those rather belong in the implementation's own structure (cipher_data)
when the implementation would affect them (that would be the case when
they are flagged EVP_CIPH_CUSTOM_IV or EVP_CIPH_FLAG_CUSTOM_CIPHER).

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMake EVP_CIPHER_CTX opaque and renew the creator / destructor functions
Richard Levitte [Sun, 13 Dec 2015 15:03:02 +0000 (16:03 +0100)]
Make EVP_CIPHER_CTX opaque and renew the creator / destructor functions

Following the method used for EVP_MD_CTX and HMAC_CTX,
EVP_CIPHER_CTX_init and EVP_CIPHER_CTX_cleanup are joined together
into one function, EVP_CIPHER_CTX_reset, with EVP_CIPHER_CTX_init kept
as an alias.
EVP_CIPHER_CTX_cleanup fills no purpose of its own any more and is
therefore removed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRT4227: Range-check in apps.
Rich Salz [Tue, 12 Jan 2016 01:40:38 +0000 (20:40 -0500)]
RT4227: Range-check in apps.

Implement range-checking in all counts in apps.  Turns out only a couple
of cases were missing.  And make the range-checking code more strict.
Replace almost all opt_ulong() calls with opt_long()

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoYet another make update.
Rich Salz [Tue, 12 Jan 2016 00:22:47 +0000 (19:22 -0500)]
Yet another make update.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoMake sure to have both upper and mixed case symbols in SYMBOL_VECTOR
Richard Levitte [Tue, 12 Jan 2016 02:42:56 +0000 (03:42 +0100)]
Make sure to have both upper and mixed case symbols in SYMBOL_VECTOR

It was assumed that the syntax FOO/Foo=PROCEDURE would create both an
upper case and mixed case symbol in the GST.  Not so, it requires
having both FOO/Foo=PROCEDURE (to create the upper case alias) and
Foo=PROCEDURE (to create the mixed case slot).

We make sure that any symbol always occupies two slots (even those
that don't exist) by filling up with SPARE when necessary.  That will
assure that any changes will still have the same symbols in the same
slots no matter what (save a complete rewrite of the ordinals files).

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoUse SPARE instead of PRIVATE_PROCEDURE to reserve unused SYMBOL_VECTOR slots
Richard Levitte [Tue, 12 Jan 2016 02:40:27 +0000 (03:40 +0100)]
Use SPARE instead of PRIVATE_PROCEDURE to reserve unused SYMBOL_VECTOR slots

It was assumed that a dummy with the type PRIVATE_PROCEDURE would
simply occupy a slot but otherwise ignore the symbol.  Not so, but
there is SPARE for that purpose.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoThe limit per SYMBOL_VECTOR isn't the amount of symbols, it's the line length
Richard Levitte [Tue, 12 Jan 2016 00:07:46 +0000 (01:07 +0100)]
The limit per SYMBOL_VECTOR isn't the amount of symbols, it's the line length

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoVMS INDENTIFICATION should only have the version number
Richard Levitte [Mon, 11 Jan 2016 23:51:26 +0000 (00:51 +0100)]
VMS INDENTIFICATION should only have the version number

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoGH528: "cipher -v" output is confusing.
Rich Salz [Sun, 10 Jan 2016 00:25:52 +0000 (19:25 -0500)]
GH528: "cipher -v" output is confusing.

Fix the docs, and refactor some common code.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoHave mkdef.pl use case sensitive symbols for shareable symbol vector
Richard Levitte [Mon, 11 Jan 2016 21:33:35 +0000 (22:33 +0100)]
Have mkdef.pl use case sensitive symbols for shareable symbol vector

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFunction pop_info() returned a dangling pointer
Pascal Cuoq [Sun, 10 Jan 2016 12:43:37 +0000 (13:43 +0100)]
Function pop_info() returned a dangling pointer

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoupdate ordinals
Dr. Stephen Henson [Mon, 11 Jan 2016 15:36:54 +0000 (15:36 +0000)]
update ordinals

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoUse ossl_inline and DEFINE_LHASH_OF
Dr. Stephen Henson [Mon, 11 Jan 2016 15:22:30 +0000 (15:22 +0000)]
Use ossl_inline and DEFINE_LHASH_OF

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRemove mkstack.pl: it is no longer needed.
Dr. Stephen Henson [Thu, 24 Dec 2015 16:24:15 +0000 (16:24 +0000)]
Remove mkstack.pl: it is no longer needed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd lh_doall_arg inlining
Dr. Stephen Henson [Thu, 24 Dec 2015 16:20:54 +0000 (16:20 +0000)]
Add lh_doall_arg inlining

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd lh_doall inlining
Dr. Stephen Henson [Thu, 24 Dec 2015 16:07:21 +0000 (16:07 +0000)]
Add lh_doall inlining

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd lh_new() inlining
Dr. Stephen Henson [Thu, 24 Dec 2015 15:51:23 +0000 (15:51 +0000)]
Add lh_new() inlining

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoInline LHASH_OF
Dr. Stephen Henson [Mon, 11 Jan 2016 14:11:13 +0000 (14:11 +0000)]
Inline LHASH_OF

Make LHASH_OF use static inline functions.

Add new lh_get_down_load and lh_set_down_load functions and their
typesafe inline equivalents.

Make lh_error a function instead of a macro.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoGH540: add casts to safestack.h
Alessandro Ghedini [Sun, 10 Jan 2016 23:02:17 +0000 (23:02 +0000)]
GH540: add casts to safestack.h

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoFix jpaketest compilation error.
Dr. Stephen Henson [Mon, 11 Jan 2016 17:11:24 +0000 (17:11 +0000)]
Fix jpaketest compilation error.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoOnly run DANE tests when EC is supported
Richard Levitte [Mon, 11 Jan 2016 16:20:39 +0000 (17:20 +0100)]
Only run DANE tests when EC is supported

Since danetest is to test DANE rather than specific algorithms, it's
acceptable to require EC when testing it.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoMake SSL{_CTX,}_{get,set,clear}_options functions
Viktor Dukhovni [Mon, 11 Jan 2016 01:15:04 +0000 (20:15 -0500)]
Make SSL{_CTX,}_{get,set,clear}_options functions

These now take and return unsigned long, and get is constified.
Updated related documentation and util/ssleay.num

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoAdjust $default_depflags to changes in Configure
Richard Levitte [Mon, 11 Jan 2016 09:59:13 +0000 (10:59 +0100)]
Adjust $default_depflags to changes in Configure

We use $default_depflags to check if a 'make depend' is needed after
configuring, so it needs to be kept up to date.

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoFix NSS format session output
Matt Caswell [Tue, 29 Dec 2015 00:17:10 +0000 (00:17 +0000)]
Fix NSS format session output

Commit 189ae368d91 (RT ticket 3352) provided the capability to output
session key data in NSS format. The big apps cleanup broke that capability.
This commit restores it.

RT#4201

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoUpdate leak test to check return values.
Dr. Stephen Henson [Sun, 10 Jan 2016 23:29:46 +0000 (23:29 +0000)]
Update leak test to check return values.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoAdd memory leak return value.
Dr. Stephen Henson [Sun, 10 Jan 2016 23:25:07 +0000 (23:25 +0000)]
Add memory leak return value.

Make CRYPTO_mem_leaks() and CRYPTO_mem_leaks_fp() return a status value.
Update documentation. Don't abort() if there are leaks.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoEnable/disable crypto-mdebug just like other features
Viktor Dukhovni [Sun, 10 Jan 2016 19:42:10 +0000 (14:42 -0500)]
Enable/disable crypto-mdebug just like other features

Also always abort() on leak failure.

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoDisable some algorithms by default
Dr. Stephen Henson [Sun, 10 Jan 2016 13:33:31 +0000 (13:33 +0000)]
Disable some algorithms by default

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoRegenerate SSL record/statem error strings
Viktor Dukhovni [Sat, 9 Jan 2016 22:18:02 +0000 (17:18 -0500)]
Regenerate SSL record/statem error strings

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agofix shadow warning
Dr. Stephen Henson [Sun, 10 Jan 2016 23:28:09 +0000 (23:28 +0000)]
fix shadow warning

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFile is about s_time, not s_client
Kurt Roeckx [Sat, 2 Jan 2016 19:42:27 +0000 (20:42 +0100)]
File is about s_time, not s_client

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoAllow disabling the min and max version
Kurt Roeckx [Sat, 2 Jan 2016 19:06:07 +0000 (20:06 +0100)]
Allow disabling the min and max version

Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org>
8 years agoFuture-proof deprecated declartion parsing
Viktor Dukhovni [Sat, 9 Jan 2016 22:11:18 +0000 (17:11 -0500)]
Future-proof deprecated declartion parsing

Support two-digest major/minor/micro numbers and die when the input
fails to parse

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoRT41897: Add an CRYPTO_secure_actual_size
Rich Salz [Thu, 7 Jan 2016 21:05:45 +0000 (16:05 -0500)]
RT41897: Add an CRYPTO_secure_actual_size

This is already documented, I just forgot to include the code :)

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoFix c++ compilation
Mat [Sat, 9 Jan 2016 19:15:28 +0000 (20:15 +0100)]
Fix c++ compilation

Fixes https://github.com/openssl/openssl/issues/532

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoAdds missing type casts
Mat [Sat, 9 Jan 2016 19:22:17 +0000 (20:22 +0100)]
Adds missing type casts

This fixes https://github.com/openssl/openssl/issues/534

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoAdds crypto-mdebug as a valid option
Mat [Sat, 9 Jan 2016 22:55:57 +0000 (23:55 +0100)]
Adds crypto-mdebug as a valid option

Adds crypto-mdebug as a valid option. Fixes https://github.com/openssl/openssl/issues/537

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoFix build failure on Windows
Mat [Sat, 9 Jan 2016 18:45:16 +0000 (19:45 +0100)]
Fix build failure on Windows

Fixes https://github.com/openssl/openssl/issues/530

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoupdate ordinals
Dr. Stephen Henson [Sat, 9 Jan 2016 21:55:46 +0000 (21:55 +0000)]
update ordinals

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoAdd DEPRECATEDIN support.
Dr. Stephen Henson [Sat, 9 Jan 2016 13:40:02 +0000 (13:40 +0000)]
Add DEPRECATEDIN support.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoCorrect header defines
Dr. Stephen Henson [Fri, 8 Jan 2016 01:31:39 +0000 (01:31 +0000)]
Correct header defines

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoremove hard coded algorithms
Dr. Stephen Henson [Fri, 8 Jan 2016 01:25:36 +0000 (01:25 +0000)]
remove hard coded algorithms

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoRecognise disabled algorithms automatically.
Dr. Stephen Henson [Thu, 7 Jan 2016 03:19:09 +0000 (03:19 +0000)]
Recognise disabled algorithms automatically.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoFix no CRYPTO_MDEBUG build (windows)
Rich Salz [Fri, 8 Jan 2016 02:40:52 +0000 (21:40 -0500)]
Fix no CRYPTO_MDEBUG build (windows)

In order for mkdep to find #ifdef'd functions, they must be
wrapped (in the header file) with
        #ifndef OPENSSL_NO_...
So do that for various CRYPTO_mem_debug... things.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoFixup actually update danetest.c
Viktor Dukhovni [Fri, 8 Jan 2016 00:16:10 +0000 (19:16 -0500)]
Fixup actually update danetest.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAnother portability fix.
Rich Salz [Fri, 8 Jan 2016 18:06:01 +0000 (13:06 -0500)]
Another portability fix.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoUpdate comment as bn_dup_expand is gone
Viktor Dukhovni [Fri, 8 Jan 2016 04:56:43 +0000 (23:56 -0500)]
Update comment as bn_dup_expand is gone

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoSimplify deprecated declaration exception
Viktor Dukhovni [Fri, 8 Jan 2016 04:47:30 +0000 (23:47 -0500)]
Simplify deprecated declaration exception

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoPortability fix for apps/s_client.c
Rich Salz [Fri, 8 Jan 2016 15:36:37 +0000 (10:36 -0500)]
Portability fix for apps/s_client.c

Make some local variables and a table of them be static.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoDANE CHANGES
Viktor Dukhovni [Fri, 8 Jan 2016 03:00:14 +0000 (22:00 -0500)]
DANE CHANGES

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix some typos in comments
Viktor Dukhovni [Wed, 6 Jan 2016 20:28:39 +0000 (15:28 -0500)]
Fix some typos in comments

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoBackwards-compatibility subject to OPENSSL_API_COMPAT
Viktor Dukhovni [Tue, 5 Jan 2016 04:00:33 +0000 (23:00 -0500)]
Backwards-compatibility subject to OPENSSL_API_COMPAT

Provide backwards-compatiblity for functions, macros and include
files if OPENSSL_API_COMPAT is either not defined or defined less
than the version number of the release in which the feature was
deprecated.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoDANE s_client support
Viktor Dukhovni [Tue, 29 Dec 2015 19:25:50 +0000 (14:25 -0500)]
DANE s_client support

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoRemove all remaining traces if PEM_Seal
Richard Levitte [Thu, 7 Jan 2016 22:28:15 +0000 (23:28 +0100)]
Remove all remaining traces if PEM_Seal

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoMinor test update
Viktor Dukhovni [Thu, 7 Jan 2016 21:53:29 +0000 (16:53 -0500)]
Minor test update

* Remove extraneous test/Makefile.orig
* Use basedomain instead of argv[1] in test/danetest.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix another build break for no-mem-debug
Rich Salz [Thu, 7 Jan 2016 21:16:22 +0000 (16:16 -0500)]
Fix another build break for no-mem-debug

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix build-break; 'make update'
Rich Salz [Thu, 7 Jan 2016 20:40:08 +0000 (15:40 -0500)]
Fix build-break; 'make update'

Commit bbd86bf5424a611cb6b77a3a17fc522931c4dcb8 broke certain builds.
Commit 0674427f71ca050e3c61a7ec9dc71b208c3b39f5 missing 'make update'

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agomem functions cleanup
Rich Salz [Thu, 7 Jan 2016 20:06:38 +0000 (15:06 -0500)]
mem functions cleanup

Only two macros CRYPTO_MDEBUG and CRYPTO_MDEBUG_ABORT to control this.
If CRYPTO_MDEBUG is not set, #ifdef out the whole debug machinery.
        (Thanks to Jakob Bohm for the suggestion!)
Make the "change wrapper functions" be the only paradigm.
Wrote documentation!
Format the 'set func' functions so their paramlists are legible.
Format some multi-line comments.
Remove ability to get/set the "memory debug" functions at runtme.
Remove MemCheck_* and CRYPTO_malloc_debug_init macros.
Add CRYPTO_mem_debug(int flag) function.
Add test/memleaktest.
Rename CRYPTO_malloc_init to OPENSSL_malloc_init; remove needless calls.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoRemove the old VMS linker option file creator for shlibs
Richard Levitte [Thu, 7 Jan 2016 19:51:28 +0000 (20:51 +0100)]
Remove the old VMS linker option file creator for shlibs

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoEnhance util/mkdef.pl to provide a VMS linker option file for shlibs
Richard Levitte [Thu, 7 Jan 2016 19:49:53 +0000 (20:49 +0100)]
Enhance util/mkdef.pl to provide a VMS linker option file for shlibs

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoRemove crypto/pem/pem_seal.c
Richard Levitte [Thu, 7 Jan 2016 19:45:37 +0000 (20:45 +0100)]
Remove crypto/pem/pem_seal.c

It's functionality appears unused.  If we're wrong, we will revert.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDANE support for X509_verify_cert()
Viktor Dukhovni [Tue, 29 Dec 2015 19:12:36 +0000 (14:12 -0500)]
DANE support for X509_verify_cert()

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agouse more descriptive name DEFINE_STACK_OF_CONST
Dr. Stephen Henson [Thu, 7 Jan 2016 17:02:20 +0000 (17:02 +0000)]
use more descriptive name DEFINE_STACK_OF_CONST

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoOnly declare stacks in headers
Dr. Stephen Henson [Wed, 6 Jan 2016 02:54:18 +0000 (02:54 +0000)]
Only declare stacks in headers

Don't define stacks in C source files: it causes warnings
about unused functions in some compilers.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoRename DECLARE*STACK_OF to DEFINE*STACK_OF
Dr. Stephen Henson [Mon, 28 Dec 2015 00:04:33 +0000 (00:04 +0000)]
Rename DECLARE*STACK_OF to DEFINE*STACK_OF

Applications wishing to include their own stacks now just need to include

DEFINE_STACK_OF(foo)

in a header file.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoremove unused PREDECLARE
Dr. Stephen Henson [Sun, 27 Dec 2015 23:46:39 +0000 (23:46 +0000)]
remove unused PREDECLARE

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix declarations and constification for inline stack.
Dr. Stephen Henson [Wed, 23 Dec 2015 00:47:28 +0000 (00:47 +0000)]
Fix declarations and constification for inline stack.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoChange STACK_OF to use inline functions.
Dr. Stephen Henson [Wed, 23 Dec 2015 00:47:13 +0000 (00:47 +0000)]
Change STACK_OF to use inline functions.

Change DECLARE_STACK_OF into inline functions. This avoids the need for
auto generated mkstack.pl macros and now handles const properly.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoDANE make update
Viktor Dukhovni [Tue, 29 Dec 2015 19:40:46 +0000 (14:40 -0500)]
DANE make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDANE documentation typos
Viktor Dukhovni [Wed, 6 Jan 2016 18:48:16 +0000 (13:48 -0500)]
DANE documentation typos

Reported-by: Claus Assmann
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRemove more (rest?) of FIPS build stuff.
Rich Salz [Mon, 14 Dec 2015 20:24:27 +0000 (15:24 -0500)]
Remove more (rest?) of FIPS build stuff.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoRemove some unused perl scripts
Rich Salz [Fri, 18 Dec 2015 03:20:01 +0000 (22:20 -0500)]
Remove some unused perl scripts

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoDANE support structures, constructructors and accessors
Viktor Dukhovni [Tue, 29 Dec 2015 18:28:28 +0000 (13:28 -0500)]
DANE support structures, constructructors and accessors

Also tweak some of the code in demos/bio, to enable interactive
testing of BIO_s_accept's use of SSL_dup.  Changed the sconnect
client to authenticate the server, which now exercises the new
SSL_set1_host() function.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix X509_STORE_CTX_cleanup()
Viktor Dukhovni [Fri, 1 Jan 2016 05:51:12 +0000 (00:51 -0500)]
Fix X509_STORE_CTX_cleanup()

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoDrop incorrect id == -1 case from X509_check_trust
Viktor Dukhovni [Tue, 29 Dec 2015 18:16:47 +0000 (13:16 -0500)]
Drop incorrect id == -1 case from X509_check_trust

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoX509_verify_cert() cleanup
Viktor Dukhovni [Tue, 29 Dec 2015 17:42:57 +0000 (12:42 -0500)]
X509_verify_cert() cleanup

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoCleanup of verify(1) failure output
Viktor Dukhovni [Fri, 1 Jan 2016 23:45:29 +0000 (18:45 -0500)]
Cleanup of verify(1) failure output

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoInstead of a local hack, implement SIZE_MAX in numbers.h if it's missing
Richard Levitte [Sat, 2 Jan 2016 18:19:00 +0000 (19:19 +0100)]
Instead of a local hack, implement SIZE_MAX in numbers.h if it's missing

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoFix a possible memleak
Richard Levitte [Fri, 18 Dec 2015 12:03:45 +0000 (13:03 +0100)]
Fix a possible memleak

If there's a failure allocating md_data, the destination pctx will have
a shared pointer with the source EVP_MD_CTX, which will lead to problems
when either the source or the destination is freed.

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoProtocol version selection and negotiation rewrite
Viktor Dukhovni [Tue, 29 Dec 2015 08:24:17 +0000 (03:24 -0500)]
Protocol version selection and negotiation rewrite

The protocol selection code is now consolidated in a few consecutive
short functions in a single file and is table driven.  Protocol-specific
constraints that influence negotiation are moved into the flags
field of the method structure.  The same protocol version constraints
are now applied in all code paths.  It is now much easier to add
new protocol versions without reworking the protocol selection
logic.

In the presence of "holes" in the list of enabled client protocols
we no longer select client protocols below the hole based on a
subset of the constraints and then fail shortly after when it is
found that these don't meet the remaining constraints (suiteb, FIPS,
security level, ...).  Ideally, with the new min/max controls users
will be less likely to create "holes" in the first place.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
8 years agoRefine and re-wrap Min/Max protocol docs
Viktor Dukhovni [Tue, 29 Dec 2015 08:19:24 +0000 (03:19 -0500)]
Refine and re-wrap Min/Max protocol docs

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoAdd support for minimum and maximum protocol version
Kurt Roeckx [Sun, 6 Dec 2015 16:56:41 +0000 (17:56 +0100)]
Add support for minimum and maximum protocol version

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoFix no-dh.
Ben Laurie [Fri, 1 Jan 2016 15:39:31 +0000 (15:39 +0000)]
Fix no-dh.

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoremove invalid free
Dr. Stephen Henson [Fri, 1 Jan 2016 00:47:06 +0000 (00:47 +0000)]
remove invalid free

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoUse X509_get0_pubkey where appropriate
Dr. Stephen Henson [Sun, 20 Dec 2015 00:32:36 +0000 (00:32 +0000)]
Use X509_get0_pubkey where appropriate

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoUpdate to SHA256 for TSA signing digest.
Rich Salz [Wed, 30 Dec 2015 23:18:08 +0000 (18:18 -0500)]
Update to SHA256 for TSA signing digest.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix faulty check in the VMS version of opt_progname
Richard Levitte [Wed, 30 Dec 2015 15:57:05 +0000 (16:57 +0100)]
Fix faulty check in the VMS version of opt_progname

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoRemove the #ifndef OPENSSL_SYS_VMS around SSL_add_dir_cert_subjects_to_stack
Richard Levitte [Wed, 30 Dec 2015 15:56:05 +0000 (16:56 +0100)]
Remove the #ifndef OPENSSL_SYS_VMS around SSL_add_dir_cert_subjects_to_stack

It served a purpose, but not any more.

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoCorrect missing prototype
Richard Levitte [Wed, 30 Dec 2015 13:57:16 +0000 (14:57 +0100)]
Correct missing prototype

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoSIZE_MAX doesn't exist everywhere, supply an alternative
Richard Levitte [Wed, 30 Dec 2015 13:56:59 +0000 (14:56 +0100)]
SIZE_MAX doesn't exist everywhere, supply an alternative

SIZE_MAX is a great macro, and does unfortunately not exist everywhere.
Since we check against half of it, using bitwise shift to calculate the
value of half SIZE_MAX should be safe enough.

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoFix some missing or faulty header file inclusions
Richard Levitte [Wed, 30 Dec 2015 13:54:29 +0000 (14:54 +0100)]
Fix some missing or faulty header file inclusions

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoCheck for missing DSA parameters.
Dr. Stephen Henson [Wed, 30 Dec 2015 13:34:53 +0000 (13:34 +0000)]
Check for missing DSA parameters.

If DSA parameters are absent return -1 (for unknown) in DSA_security_bits.

If parameters are absent when a certificate is set in an SSL/SSL_CTX
structure this will reject the certificate by default. This will cause DSA
certificates which omit parameters to be rejected but that is never (?)
done in practice.

Thanks to Brian 'geeknik' Carpenter for reporting this issue.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoConvert RSA encrypt to use EVP_PKEY
Dr. Stephen Henson [Mon, 28 Dec 2015 00:45:48 +0000 (00:45 +0000)]
Convert RSA encrypt to use EVP_PKEY

Reviewed-by: Rich Salz <rsalz@openssl.org>