Gregor Jasny [Sun, 13 May 2018 17:51:52 +0000 (19:51 +0200)]
NOTES.ANDROID: fix typo in build notes
CLA: trivial
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6244)
Andy Polyakov [Mon, 14 May 2018 15:06:04 +0000 (17:06 +0200)]
windows-makefile.tmpl: delete export library prior link.
LINK can outsmart itself and choose to not update export .lib upon
corresponding .dll re-link. Since dependency is between .lib and all
.obj-s, re-compilation of any .obj makes NMAKE relink .dll and all
.exe-s over and over...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Mon, 14 May 2018 17:35:30 +0000 (18:35 +0100)]
Suport TLSv1.3 draft 28
Also retains support for drafts 27 and 26
Fixes #6257
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6258)
Matt Caswell [Mon, 14 May 2018 13:37:16 +0000 (14:37 +0100)]
Fix no-tls1_2
Also fixes no-tls1_2-method, no-tls1_3, no-tls, no-ec
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6253)
Matt Caswell [Mon, 14 May 2018 13:28:06 +0000 (14:28 +0100)]
Fix no-psk
Fixes #6239
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6253)
Richard Levitte [Mon, 14 May 2018 07:28:52 +0000 (09:28 +0200)]
CI config: no need to make both install and install_docs
'install' depends on 'install_docs', so making the latter explicit is
a waste.
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6250)
Richard Levitte [Sun, 13 May 2018 09:35:14 +0000 (11:35 +0200)]
Link in passphrase-encoding(7) in relevant documentation
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6179)
Richard Levitte [Fri, 4 May 2018 22:06:07 +0000 (00:06 +0200)]
Docs: add general document on how pass phrases are handled
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6179)
Richard Levitte [Wed, 2 May 2018 12:18:55 +0000 (14:18 +0200)]
UI console: Restore tty settings, do not force ECHO after prompt
The Console UI method always set echo on after prompting without
echo. However, echo might not have been on originally, so just
restore the original TTY settings.
Fixes #2373
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6156)
FdaSilvaYY [Tue, 8 May 2018 08:34:59 +0000 (10:34 +0200)]
apps/speed: Add brainpool curves support
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6133)
FdaSilvaYY [Sun, 29 Apr 2018 23:13:58 +0000 (01:13 +0200)]
apps/speed: fix possible OOB access in some EC arrays
because there are actually 18 curves defined, but only 16 are plugged for
ecdsa test.
Deduce array size using OSSL_NELEM and so remove various magic numbers,
which required some declarations moving.
Implement OPT_PAIR list search without a null-ending element.
Fix some comparison between signed and unsigned integer expressions.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6133)
Kurt Roeckx [Sat, 12 May 2018 10:08:14 +0000 (12:08 +0200)]
Set sess to NULL after freeing it.
Found by OSS-fuzz
Bug introduced in commit
61fb59238dad6452a37ec14513fae617a4faef29
Reviewed-by: Matt Caswell <matt@openssl.org>
GH: #6235
Matt Caswell [Fri, 11 May 2018 09:28:47 +0000 (10:28 +0100)]
Don't memcpy the contents of an empty fragment
In DTLS if we have buffered a fragment for a zero length message (e.g.
ServerHelloDone) then, when we unbuffered the fragment, we were attempting
to memcpy the contents of the fragment which is zero length and a NULL
pointer. This is undefined behaviour. We should check first whether we
have a zero length fragment.
Fixes a travis issue.
[extended tests]
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6223)
Richard Levitte [Fri, 4 May 2018 12:19:44 +0000 (14:19 +0200)]
In cases where we ask PEM_def_callback for minimum 0 length, accept 0 length
Fixes #4716
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6173)
Dr. Matthias St. Pierre [Fri, 11 May 2018 14:54:43 +0000 (16:54 +0200)]
Fix typo: 'is an error occurred' in documentation
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6229)
Matt Caswell [Wed, 9 May 2018 17:22:36 +0000 (18:22 +0100)]
Rework the decrypt ticket callback
Don't call the decrypt ticket callback if we've already encountered a
fatal error. Do call it if we have an empty ticket present.
Change the return code to have 5 distinct returns codes and separate it
from the input status value.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6198)
Matt Caswell [Wed, 9 May 2018 09:45:46 +0000 (10:45 +0100)]
Fix mem leak in sslapi test
The recent change in behaviour where you do not get a NewSessionTicket
message sent if you established the connection using a PSK caused a mem
leak to be triggered in sslapitest. It was actually a latent bug and we
were just lucky we never hit it before. The problem is due to complexity
with the way PSK sessions were set up in the early_data tests. PSK session
reference counting was handled differently to normal session reference
counting. This meant there were lots of special cases in the code where
we don't free a session if it is a PSK. It makes things easier if we just
handle PSK reference counts in the same way as other session reference
counts, and then we can remove all of the special case code.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6198)
Matt Caswell [Tue, 8 May 2018 15:29:02 +0000 (16:29 +0100)]
Add a test for the ticket callbacks
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6198)
Matt Caswell [Tue, 8 May 2018 15:28:44 +0000 (16:28 +0100)]
Document when a new session ticket gets created on resumption
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6198)
Matt Caswell [Tue, 8 May 2018 13:50:17 +0000 (14:50 +0100)]
Fix ticket callbacks in TLSv1.3
The return value from the ticket_key callback was not properly handled in
TLSv1.3, so that a ticket was *always* renewed even if the callback
requested that it should not be.
Also the ticket decrypt callback was not being called at all in TLSv1.3.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6198)
Matt Caswell [Tue, 8 May 2018 13:34:27 +0000 (14:34 +0100)]
Flush server side unauthenticated writes
When a server call SSL_write_early_data() to write to an unauthenticated
client the buffering BIO is still in place, so we should ensure we flush
the write.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6198)
Matt Caswell [Wed, 2 May 2018 15:08:07 +0000 (16:08 +0100)]
Add some more SSL_pending() and SSL_has_pending() tests
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6159)
Matt Caswell [Wed, 2 May 2018 15:08:27 +0000 (16:08 +0100)]
Don't set TCP_NODELAY on a UDP socket
This was preventing DTLS connections from being made from the command line.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6159)
Matt Caswell [Wed, 2 May 2018 15:07:13 +0000 (16:07 +0100)]
Mark DTLS records as read when we have finished with them
The TLS code marks records as read when its finished using a record. The DTLS code did
not do that. However SSL_has_pending() relies on it. So we should make DTLS consistent.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6159)
Matt Caswell [Thu, 10 May 2018 11:33:51 +0000 (12:33 +0100)]
Test an old style PSK callback with no cert will prefer SHA-256
If using an old style PSK callback and no certificate is configured for
the server, we should prefer ciphersuites based on SHA-256, because that
is the default hash for those callbacks as specified in the TLSv1.3 spec.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6215)
Matt Caswell [Thu, 10 May 2018 11:01:06 +0000 (12:01 +0100)]
Provide documentation for the -psk_session option
The s_client/s_server docs were missing documentation for this option.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6215)
Matt Caswell [Thu, 10 May 2018 10:51:45 +0000 (11:51 +0100)]
Prefer SHA-256 ciphersuites if using old style PSKs
If we have no certificate and we are using "old style" PSKs then we will
always default to using SHA-256 for that PSK. However we may have selected
a ciphersuite that is not based on SHA-256. Therefore if we see that there
are no certificates and we have been configured for "old style" PSKs then
we should prefer SHA-256 based ciphersuites during the selection process.
Fixes #6197
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6215)
Kurt Roeckx [Wed, 9 May 2018 15:09:50 +0000 (17:09 +0200)]
Use void in all function definitions that do not take any arguments
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #6208
Kurt Roeckx [Wed, 9 May 2018 16:32:02 +0000 (18:32 +0200)]
rsaz_avx2_eligible doesn't take parameters
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #6208
Matt Caswell [Thu, 10 May 2018 14:31:00 +0000 (15:31 +0100)]
Set the ossl_shim to auto retry if not running asynchronously
In certain circumstances in the DTLS code we have to drop a record (e.g. if
it is a stale retransmit). We then have to move on to try and read the next
record. Some applications using blocking sockets (e.g. s_server/s_client
will hang if there isn't actually any data to be read from the socket yet).
Others can tolerate this. Therefore SSL_read()/SSL_write() can sometimes
return SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE even when using blocking
sockets. Applications can use the mode SSL_MODE_AUTO_RETRY, to switch this
behaviour off so that we never return unless we have read the data we
wanted to.
Commit
ad96225285 fixed a DTLS problem where we always retried even if
SSL_MODE_AUTO_RETRY was not set. However that fix caused the Boring
ossl_shim to fail in some tests because it was relying on the previous
(buggy) behaviour. The ossl_shim should be set into SSL_MODE_AUTO_RETRY if
it is not operating asynchronously to avoid this problem.
[extended tests]
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6216)
Andy Polyakov [Wed, 9 May 2018 10:24:05 +0000 (12:24 +0200)]
PPC assembly pack: add POWER9 results.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Mon, 7 May 2018 19:56:04 +0000 (21:56 +0200)]
.travis.yml: add pair of linux-ppc64le targets.
One is clang --strict-warnings and one gcc sanitizer extended test.
Sanitizer build is quite expensive, can take >30 mins and is commented
for occasions when there is reason to believe that PPC-specific problem
can be diagnosed with sanitizer.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6192)
Matt Caswell [Wed, 9 May 2018 11:05:39 +0000 (12:05 +0100)]
Fix no-cms
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6205)
Matt Caswell [Wed, 9 May 2018 10:49:02 +0000 (11:49 +0100)]
Fix no-tls1_2, no-tls1_2-method, no-chacha and no-poly1305
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6205)
Dr. Matthias St. Pierre [Tue, 8 May 2018 10:32:12 +0000 (12:32 +0200)]
Fix typos in x509 documentation
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6207)
Nicola Tuveri [Wed, 25 Apr 2018 12:27:59 +0000 (15:27 +0300)]
Add CHANGES entry for PR#6009
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6070)
Billy Brumley [Tue, 24 Apr 2018 13:03:42 +0000 (16:03 +0300)]
Add blinding in BN_GF2m_mod_inv for binary field inversions
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6070)
Billy Brumley [Tue, 24 Apr 2018 13:01:53 +0000 (16:01 +0300)]
ECC: unify generic ec2 and ecp scalar multiplication, deprecate ec2_mult.c
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6070)
Billy Brumley [Tue, 24 Apr 2018 13:00:08 +0000 (16:00 +0300)]
ECDSA: remove nonce padding (delegated to EC_POINT_mul)
* EC_POINT_mul is now responsible for constant time point multiplication
(for single fixed or variable point multiplication, when the scalar is
in the range [0,group_order), so we need to strip the nonce padding
from ECDSA.
* Entry added to CHANGES
* Updated EC_POINT_mul documentation
- Integrate existing EC_POINT_mul and EC_POINTs_mul entries in the
manpage to reflect the shift in constant-time expectations when
performing a single fixed or variable point multiplication;
- Add documentation to ec_method_st to reflect the updated "contract"
between callers and implementations of ec_method_st.mul.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6070)
Richard Levitte [Tue, 8 May 2018 18:15:27 +0000 (20:15 +0200)]
VMS rand: assign before check, not the other way around
items->ile3$w_code was checked before it was assigned its value...
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6200)
Bernd Edlinger [Mon, 7 May 2018 14:10:02 +0000 (16:10 +0200)]
Fix --strict-warnings build of ppc-linux target
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6191)
Andy Polyakov [Mon, 7 May 2018 08:27:45 +0000 (10:27 +0200)]
ec/ec_mult.c: get BN_CTX_start,end sequence right.
Triggered by Coverity analysis.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6190)
Matt Caswell [Thu, 3 May 2018 11:06:38 +0000 (12:06 +0100)]
Add a DTLS test for dropped records
Drop a record from a handshake and check that we can still complete the
handshake. Repeat for all records in the handshake.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6170)
Matt Caswell [Thu, 3 May 2018 15:00:51 +0000 (16:00 +0100)]
Keep the DTLS timer running after the end of the handshake if appropriate
During a full handshake the server is the last one to "speak". The timer
should continue to run until we know that the client has received our last
flight (e.g. because we receive some application data).
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6170)
Matt Caswell [Thu, 3 May 2018 15:00:05 +0000 (16:00 +0100)]
Only auto-retry for DTLS if configured to do so
Otherwise we may end up in a hang when using blocking sockets
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6170)
Matt Caswell [Thu, 3 May 2018 14:59:31 +0000 (15:59 +0100)]
Fix s_client and s_server so that they correctly handle the DTLS timer
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6170)
Matt Caswell [Thu, 3 May 2018 11:07:47 +0000 (12:07 +0100)]
Don't fail on an out-of-order CCS in DTLS
Fixes #4929
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6170)
Matt Caswell [Tue, 1 May 2018 08:32:30 +0000 (09:32 +0100)]
Add a CMS API test
Previous tests only invoked CMS via the command line app. This test uses
the CMS API directly to do and encrypt and decrypt operation. This test
would have caught the memory leak fixed by the previous commit (when
building with enable-crypto-mdebug).
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6142)
Matt Caswell [Tue, 1 May 2018 08:29:17 +0000 (09:29 +0100)]
Fix a mem leak in CMS
The function CMS_RecipientInfo_set0_pkey() is a "set0" and therefore
memory management passes to OpenSSL. If the same function is called again
then we should ensure that any previous value that was set is freed first
before we set it again.
Fixes #5052
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6142)
FdaSilvaYY [Sun, 6 May 2018 15:34:04 +0000 (17:34 +0200)]
windows-makefile.tmpl: rearrange cleanup commands to avoid ...
deletion of *.exp files in krb5 sub-module.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6186)
Andy Polyakov [Sun, 6 May 2018 16:36:09 +0000 (18:36 +0200)]
.travis.yml: temporarily mask gcc-5 ubsan build.
Linking fails with "unrecognized option '--push-state--no-as-needed'",
which is beyond our control.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6185)
Andy Polyakov [Sun, 6 May 2018 16:30:59 +0000 (18:30 +0200)]
.travis.yml: minor facelift
Apparently trusty image has newer clang, there is no need to pull
clang-3.9 packages. It's clang-5.0.0, installation is a bit quirky,
as it fails to compile for example strcmp(s,"-") without warning,
and complains about unreferred -I flags. But it's argued that benefits
of exercising newer sanitizer outweights the inconvenience of
additional -D__NO_STRING_INLINE and -Wno-unused-command-line-argument.
Also pull golang when actually needed.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6185)
Rich Salz [Sat, 5 May 2018 19:57:21 +0000 (15:57 -0400)]
Cleanup
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6183)
Todd Short [Thu, 3 May 2018 15:17:49 +0000 (11:17 -0400)]
Configure: fix Mac OS X builds that still require makedepend
Earlier Apple Xcode compilers, e.g. one targeting Mac OS X 10.7, don't
support dependency generation and one still has to use makedepend. It's
unclear when it was fixed, but all clang-based Apple compilers seem to
support -M options.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6169)
Andy Polyakov [Fri, 4 May 2018 12:25:45 +0000 (14:25 +0200)]
Configure: pass more suitable argument to compiler_predefined().
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6174)
Andy Polyakov [Fri, 4 May 2018 12:06:44 +0000 (14:06 +0200)]
Configure: move --noexecstack probe to Configure.
config probe doesn't work in cross-compile scenarios or with clang.
In addition consolidate -Qunused-arguments handling.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6174)
Richard Levitte [Fri, 4 May 2018 12:44:19 +0000 (14:44 +0200)]
BIO_s_mem() write: Skip early when input length is zero
When the input length is zero, just return zero early. Otherwise,
there's a small chance that memory allocation is engaged, fails and
returns -1, which is a bit confusing when nothing should be written.
Fixes #4782 #4827
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/6175)
Richard Levitte [Fri, 4 May 2018 17:41:53 +0000 (19:41 +0200)]
docs: Fix typo EVP_PKEY_new_id -> EVP_PKEY_CTX_new_id
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6177)
Dr. Matthias St. Pierre [Wed, 2 May 2018 21:06:15 +0000 (23:06 +0200)]
v3_purp.c: add locking to x509v3_cache_extensions()
Fixes #6121
Thanks to Mingtao Yang for reporting this bug.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6162)
Richard Levitte [Wed, 2 May 2018 04:16:04 +0000 (06:16 +0200)]
VMS: modernise rand_pool_acquire_entropy, step 2
Add more items that could serve as entropy source.
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6151)
Richard Levitte [Mon, 30 Apr 2018 16:04:10 +0000 (18:04 +0200)]
VMS: modernise rand_pool_acquire_entropy, step 1
Stop redefining structures that are already defined in system
headers. This also means we can stop setting the pointer size
globally, because the system structures will have the correct pointer
sizes either way. The only exception is passing the right pointer
size to a function.
Stop trying to twist things around with rand(), that's the job of the
DRBG that we feed.
Stop assuming the location of the JPI$_FINALEXC item, look it up
instead.
Signal an exception if the sys$getjpiw call fails (it means the item
list isn't set up right, so works as an assertion, but using VMS
methodology).
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6151)
Matt Caswell [Fri, 27 Apr 2018 16:36:11 +0000 (17:36 +0100)]
Return an error from BN_mod_inverse if n is 1 (or -1)
Calculating BN_mod_inverse where n is 1 (or -1) doesn't make sense. We
should return an error in that case. Instead we were returning a valid
result with value 0.
Fixes #6004
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6119)
Matt Caswell [Wed, 2 May 2018 10:32:39 +0000 (11:32 +0100)]
Make X509_VERIFY_PARAM_get_hostflags() take a const arg
Commit
5b748dea5 added this function which should have taken a const
argument.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6154)
Matt Caswell [Fri, 27 Apr 2018 11:20:04 +0000 (12:20 +0100)]
Add a test for SSL_get_shared_ciphers()
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6113)
Matt Caswell [Fri, 27 Apr 2018 11:09:08 +0000 (12:09 +0100)]
Fix a bug in create_ssl_ctx_pair()
The max protocol version was only being set on the server side. It should
have been done on both the client and the server.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6113)
Matt Caswell [Fri, 27 Apr 2018 10:38:19 +0000 (11:38 +0100)]
Add some documentation for SSL_get_shared_ciphers()
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6113)
Matt Caswell [Fri, 27 Apr 2018 10:24:01 +0000 (11:24 +0100)]
Fix comment in ssl_locl.h
The ciphers field in a session contains the stack of ciphers offered by
the client.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6113)
Matt Caswell [Fri, 27 Apr 2018 10:20:52 +0000 (11:20 +0100)]
Fix SSL_get_shared_ciphers()
The function SSL_get_shared_ciphers() is supposed to return ciphers shared
by the client and the server. However it only ever returned the client
ciphers.
Fixes #5317
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6113)
FdaSilvaYY [Tue, 1 May 2018 21:25:16 +0000 (23:25 +0200)]
opensslconf.h inclusion cleanup
No need to buildtest on opensslconf.h
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6149)
Andy Polyakov [Mon, 30 Apr 2018 20:59:51 +0000 (22:59 +0200)]
bn/asm/*-mont.pl: harmonize with BN_from_montgomery_word.
Montgomery multiplication post-conditions in some of code paths were
formally non-constant time. Cache access pattern was result-neutral,
but a little bit asymmetric, which might have produced a signal [if
processor reordered load and stores at run-time].
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6141)
FdaSilvaYY [Mon, 28 Nov 2016 22:36:50 +0000 (23:36 +0100)]
apps/speed.c: merge parameters defining EC curves to test ...
... and unify 'bits' declarations and printing format.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6132)
Dr. Matthias St. Pierre [Thu, 26 Apr 2018 18:36:41 +0000 (20:36 +0200)]
a_strex.c: prevent out of bound read in do_buf()
which is used for ASN1_STRING_print_ex*() and X509_NAME_print_ex*().
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6105)
Richard Levitte [Wed, 2 May 2018 04:24:20 +0000 (06:24 +0200)]
Change rand_pool_bytes_needed to handle less entropy than 1 per 8 bits
rand_pool_bytes_needed() was constructed in such a way that the
smallest acceptable entropy factor was 1 entropy bits per 8 bits of
data. At the same time, we have a DRBG_MINMAX_FACTOR that allows
weaker source, as small as 1 bit of entropy per 128 bits of data.
The conclusion is that rand_pool_bytes_needed() needs to change to
support weaker entropy sources. We therefore change the input of
entropy per byte to be an entropy factor instead. This entropy factor
expresses how many bits of data it takes (on average) to get 1 bit of
entropy.
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6150)
Matt Caswell [Tue, 1 May 2018 10:46:58 +0000 (11:46 +0100)]
Add a note about Nagle's algorithm on the SSL_connect man page
Fixes #4237
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/6143)
Pavel Kopyl [Fri, 3 Nov 2017 15:18:59 +0000 (18:18 +0300)]
Fix memory leaks in CA related functions.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4700)
Benjamin Kaduk [Mon, 16 Apr 2018 12:32:02 +0000 (07:32 -0500)]
Fix regression with session cache use by clients
Commit
d316cdcf6d8d6934663278145fe0a8191e14a8c5 introduced some extra
checks into the session-cache update procedure, intended to prevent
the caching of sessions whose resumption would lead to a handshake
failure, since if the server is authenticating the client, there needs to
be an application-set "session id context" to match up to the authentication
context. While that change is effective for its stated purpose, there
was also some collatoral damage introduced along with the fix -- clients
that set SSL_VERIFY_PEER are not expected to set an sid_ctx, and so
their usage of session caching was erroneously denied.
Fix the scope of the original commit by limiting it to only acting
when the SSL is a server SSL.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5967)
Bernd Edlinger [Sat, 28 Apr 2018 18:35:54 +0000 (20:35 +0200)]
Improve error handling in rand_init function
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6124)
Matt Caswell [Mon, 30 Apr 2018 14:59:51 +0000 (15:59 +0100)]
Add getter for X509_VERIFY_PARAM_get_hostflags
Fixes #5061
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6139)
Matt Caswell [Mon, 30 Apr 2018 14:05:45 +0000 (15:05 +0100)]
Clarify BN_mod_exp docs
Specifically this is not supported with an even modulus and
BN_FLG_CONSTTIME.
Fixes #5082
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6137)
Matt Caswell [Mon, 30 Apr 2018 11:05:42 +0000 (12:05 +0100)]
Fix some errors and missing info in the CMS docs
Fixes #5063
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6134)
Matt Caswell [Tue, 1 May 2018 12:55:46 +0000 (13:55 +0100)]
Prepare for 1.1.1-pre7-dev
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Tue, 1 May 2018 12:46:05 +0000 (13:46 +0100)]
Prepare for 1.1.1-pre6 release
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Tue, 1 May 2018 12:34:30 +0000 (13:34 +0100)]
Update copyright year
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6145)
Kurt Roeckx [Sat, 28 Apr 2018 21:26:22 +0000 (23:26 +0200)]
Use the config file from the source not the host for the tests
Fixes: #6046
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #6125
Andy Polyakov [Thu, 26 Apr 2018 17:22:30 +0000 (19:22 +0200)]
Configurations/unix-Makefile.tmpl: harmonize with no-engine.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6106)
Andy Polyakov [Thu, 26 Apr 2018 17:22:04 +0000 (19:22 +0200)]
Configurations/10-main.conf: force no-engine on ios targets.
Rationale for enforcing no-engine is because of disconnect between
compile-time config and run-time, which is a per-application sandbox
directory which one can't predict in advance. Besides, none of the
bundled engines actually give an edge on iOS...
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6106)
Bernd Edlinger [Sat, 28 Apr 2018 17:09:55 +0000 (19:09 +0200)]
Don't cleanup uninitialized thread local slots
Fixes: #6120
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/6123)
Bernd Edlinger [Thu, 26 Apr 2018 08:14:14 +0000 (10:14 +0200)]
Fix drbg thread cleanup and error handling
Fixes: #6081
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6089)
Matt Caswell [Thu, 19 Apr 2018 12:32:45 +0000 (13:32 +0100)]
Update version docs
Make it clear that you should not attempt to get the version before the
first handshake is complete.
Fixes #2893
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6013)
Richard Levitte [Thu, 26 Apr 2018 19:11:26 +0000 (21:11 +0200)]
apps/s_server.c: Avoid unused variable due to 'no-dtls'
Fixes #6098
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6104)
Billy Brumley [Thu, 26 Apr 2018 15:08:36 +0000 (18:08 +0300)]
fix: BN_swap mishandles flags
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6099)
Dr. Matthias St. Pierre [Thu, 26 Apr 2018 11:57:14 +0000 (13:57 +0200)]
Fix mixed indentation (and other whitespace issues)
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6094)
Richard Levitte [Thu, 26 Apr 2018 15:41:46 +0000 (17:41 +0200)]
15-test_out_option: Refactor and don't test directory write on VMS
To my surprise, it turns out that on OpenVMS, opening './' (which
is translated to '[]') for writing actually creates a file, '[].'.
On OpenVMS, this is a perfectly valid file with no name or extension,
just the delimiter between the two.
Because of the mess the exception would generate in the test recipe,
it gets refactored again, to clearly separate each test inside it,
and use skips to avoid some of them (that makes it clear that they are
skipped and why, when running the recipe).
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6100)
Rich Salz [Thu, 26 Apr 2018 18:02:24 +0000 (14:02 -0400)]
Fix last(?) batch of malloc-NULL places
Add a script to find them in the future
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/6103)
Bernd Edlinger [Thu, 26 Apr 2018 16:39:51 +0000 (18:39 +0200)]
Fix memleaks in async api
Fixes: #5950
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6038)
Bernd Edlinger [Mon, 16 Apr 2018 12:16:26 +0000 (14:16 +0200)]
Wait max. 60 seconds for s_client to connect
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5964)
FdaSilvaYY [Thu, 26 Apr 2018 16:06:17 +0000 (12:06 -0400)]
Add missing error code when alloc-return-null
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6085)
Matt Caswell [Thu, 26 Apr 2018 13:05:40 +0000 (14:05 +0100)]
Update the *use_certificate* docs
Note that calling the *use_certificate* functions will replace any existing
certificate of the same type. The same thing applies for private keys.
Fixes #2147
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6092)
Matt Caswell [Thu, 26 Apr 2018 13:20:59 +0000 (14:20 +0100)]
Fix typo in the definition of tls13_ciphers
SSL_kANY, and SSL_aANY were placed in the wrong fields. It makes no
functional difference since these macros evaluate to 0 anyway, which is
the correct value for these fields.
Fixes #6048
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6095)
Richard Levitte [Thu, 26 Apr 2018 07:59:22 +0000 (09:59 +0200)]
Use get_last_sys_error() instead of get_last_rtl_error()
get_last_sys_error() already exists, so there's no need for yet
another macro that fulfills the same purpose.
Fixes #4120
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6088)