oweals/openssl.git
8 years agoWorkaround an IO::Socket::IP bug
Matt Caswell [Mon, 16 May 2016 15:54:28 +0000 (16:54 +0100)]
Workaround an IO::Socket::IP bug

Workaround an apparent IO:Socket::IP bug where a seemingly valid
server socket is being returned even though a valid connection does not
exist. This causes the tests to intermittently hang. We additionally check
that the peerport looks ok to verify that the returned socket looks usable.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFold threads.h into crypto.h making API public
Viktor Dukhovni [Sun, 15 May 2016 17:02:17 +0000 (13:02 -0400)]
Fold threads.h into crypto.h making API public

Document thread-safe lock creation

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoDon't require any length of password when decrypting
Richard Levitte [Mon, 16 May 2016 15:29:43 +0000 (17:29 +0200)]
Don't require any length of password when decrypting

RT#2534

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoAdd support for RC / WINDRES env variables
Richard Levitte [Mon, 16 May 2016 15:08:13 +0000 (17:08 +0200)]
Add support for RC / WINDRES env variables

RT#2558

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoAdd missing initialiser in e_chil.c
Richard Levitte [Mon, 16 May 2016 13:47:58 +0000 (15:47 +0200)]
Add missing initialiser in e_chil.c

RT#2616

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agodo not remove links found in .git directory
Cristian Stoica [Mon, 16 May 2016 13:10:24 +0000 (16:10 +0300)]
do not remove links found in .git directory

Some setups use links inside .git directory and make clean should not
remove them to avoid breaking git meta-information.

Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
CLA: none; trivial
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1078)

8 years agoWindows: Add CRYPT32.LIB to the libraries to link you app with
Richard Levitte [Thu, 12 May 2016 20:32:12 +0000 (22:32 +0200)]
Windows: Add CRYPT32.LIB to the libraries to link you app with

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1063)

8 years agoDo not access SSL struct directly in TLS1_get_version and TLS1_get_client_version...
Alessandro Ghedini [Mon, 9 May 2016 11:59:26 +0000 (12:59 +0100)]
Do not access SSL struct directly in TLS1_get_version and TLS1_get_client_version macros

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoAdd SSL_client_version() getter function
Alessandro Ghedini [Mon, 9 May 2016 11:58:01 +0000 (12:58 +0100)]
Add SSL_client_version() getter function

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoAdd some documentation of SSL_CTX_set_tlsext_status_type()
Matt Caswell [Fri, 6 May 2016 09:19:35 +0000 (10:19 +0100)]
Add some documentation of SSL_CTX_set_tlsext_status_type()

The previous commit added SSL_CTX_set_tlsext_status_type(). This one adds
some documentation for it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoPropagate tlsext_status_type from SSL_CTX to SSL
jfigus [Tue, 2 Dec 2014 20:44:49 +0000 (15:44 -0500)]
Propagate tlsext_status_type from SSL_CTX to SSL

To allow OCSP stapling to work with libcurl.

Github PR #200

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoFix NPN protocol name list validation
Kazuki Yamaguchi [Sat, 12 Dec 2015 15:51:06 +0000 (00:51 +0900)]
Fix NPN protocol name list validation

Since 50932c4 "PACKETise ServerHello processing",
ssl_next_proto_validate() incorrectly allows empty protocol name.
draft-agl-tls-nextprotoneg-04[1] says "Implementations MUST ensure that
the empty string is not included and that no byte strings are
truncated."
This patch restores the old correct behavior.

[1] https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoUnify <TYPE>_up_ref methods signature and behaviour.
FdaSilvaYY [Mon, 7 Mar 2016 21:45:58 +0000 (22:45 +0100)]
Unify <TYPE>_up_ref methods signature and behaviour.

Add a status return value instead of void.
Add some sanity checks on reference counter value.
Update the docs.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoSmall MSVC build fixes.
Richard Levitte [Mon, 16 May 2016 07:48:15 +0000 (09:48 +0200)]
Small MSVC build fixes.

- "/Ox /O2 /Ob2" get's reduced to "/O2", the reason being:

    /Ox = /Ob2 /Og /Oi /Ot /Oy /Gs
    /O2 = /Ob2 /Og /Oi /Ot /Oy /Gs /GF /Gy

- apps/openssl.cnf gets installed.

- always delete files quietly, as they might not be there.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1075)

8 years agoFix some missing OBJ_dup failure checks.
FdaSilvaYY [Wed, 11 May 2016 22:29:22 +0000 (00:29 +0200)]
Fix some missing OBJ_dup failure checks.

Fix some missing OBJ_dup failure checks.
Merged from
https://boringssl.googlesource.com/boringssl/+/0ce78a757d815c0dde9ed5884229f3a5b2cb3e9c%5E!

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1057)

8 years agoopenssl_{startup,shutdown}.com.in are in the source directory
Richard Levitte [Sat, 14 May 2016 08:51:58 +0000 (10:51 +0200)]
openssl_{startup,shutdown}.com.in are in the source directory

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix various methods declaration in pod file
FdaSilvaYY [Mon, 9 May 2016 16:48:13 +0000 (18:48 +0200)]
Fix various methods declaration in pod file

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1042)

8 years agoIncrement size limit for ClientHello messages
Alessandro Ghedini [Fri, 25 Sep 2015 15:53:58 +0000 (17:53 +0200)]
Increment size limit for ClientHello messages

The current limit of 2^14 bytes is too low (e.g. RFC 5246 specifies the
maximum size of just the extensions field to be 2^16-1), and may cause
bogus failures.

RT#4063

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/413)

8 years agoFix engine cryptodev: pointer to IV
Kirill Marinushkin [Thu, 5 May 2016 18:51:07 +0000 (20:51 +0200)]
Fix engine cryptodev: pointer to IV

Currently point to wrong address

Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix OpenSSL_memdup error handling
Insu Yun [Thu, 5 May 2016 15:39:16 +0000 (11:39 -0400)]
Fix OpenSSL_memdup error handling

check source's kdf_ukm, not destination's

use != NULL, instead of implicit checking

don't free internal data structure like pkey_rsa_copy()

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoVMS perl: Fix glob output
Richard Levitte [Fri, 13 May 2016 09:21:06 +0000 (11:21 +0200)]
VMS perl: Fix glob output

In some cases, perl's glob() thinks it needs to return file names with
generation numbers, such as when a file name pattern includes two
periods.  Constructing other file names by simple appending to file
names with generation numbers isn't a good idea, so for the VMS case,
just peal the generation numbers if they are there.
Fortunately, this is easy, as the returned generation number delimiter
will always be a semi-colon.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd some additional NewSessionTicket tests
Matt Caswell [Wed, 11 May 2016 11:32:12 +0000 (12:32 +0100)]
Add some additional NewSessionTicket tests

If the server does not send a session ticket extension, it should not then
send the NewSessionTicket message.

If the server sends the session ticket extension, it MUST then send the
NewSessionTicket message.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoThe NewSessionTicket message is not optional.
David Benjamin [Sun, 6 Mar 2016 00:35:52 +0000 (19:35 -0500)]
The NewSessionTicket message is not optional.

Per RFC 4507, section 3.3:

   This message [NewSessionTicket] MUST be sent if the
   server included a SessionTicket extension in the ServerHello.  This
   message MUST NOT be sent if the server did not include a
   SessionTicket extension in the ServerHello.

The presence of the NewSessionTicket message should be determined
entirely from the ServerHello without probing.

RT#4389

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoFix stack constification definitions.
Dr. Stephen Henson [Fri, 13 May 2016 11:23:52 +0000 (12:23 +0100)]
Fix stack constification definitions.

RT#4471

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoCorrect documentation on digest used.
Dr. Stephen Henson [Thu, 12 May 2016 14:02:04 +0000 (15:02 +0100)]
Correct documentation on digest used.

RT#4302

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoFix signer option and support format SMIME.
Dr. Stephen Henson [Thu, 12 May 2016 16:13:50 +0000 (17:13 +0100)]
Fix signer option and support format SMIME.

Fix -signer option in smime utility to output signer certificates
when verifying.

Add support for format SMIME for -inform and -outform with cms and
smime utilities.

PR#4215

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoWindows: When installing libraries and executables, install .pdb files as well
Richard Levitte [Thu, 12 May 2016 16:08:21 +0000 (18:08 +0200)]
Windows: When installing libraries and executables, install .pdb files as well

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDJGPP adjustments
Richard Levitte [Tue, 10 May 2016 12:41:19 +0000 (14:41 +0200)]
DJGPP adjustments

* Configure: Replaced -DTERMIO by -DTERMIOS in CFLAGS.

* crypto/bio/bss_dgram.c [WATT32]: Remove obsolete redefinition of
  function names: sock_write, sock_read and sock_puts.

* crypto/bio/bss_sock.c [WATT32]: For Watt-32 2.2.11 sock_write,
  sock_read and sock_puts are redefined to their private names so
  their names must be undefined first before they can be redefined
  again.

* crypto/bio/bss_file.c (file_fopen) [__DJGPP__]: Make a copy of the
  passed file name and replace the leading dots in the dirname part
  and the basname part of the file name, unless LFN is supported.

* e_os.h [__DJGPP__]: Undefine macro DEVRANDOM_EGD. Neither MS-DOS nor
  FreeDOS provide 'egd' sockets.
  New macro HAS_LFN_SUPPORT checks if underlying file system supports
  long file names or not.
  Include sys/un.h.
  Define WATT32_NO_OLDIES.

* INSTALL.DJGPP: Update URL of WATT-32 library.

Submitted by Juan Manuel Guerrero <juan.guerrero@gmx.de>

RT#4217

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoMove the DJGPP target to its own config.
Richard Levitte [Wed, 11 May 2016 11:47:19 +0000 (13:47 +0200)]
Move the DJGPP target to its own config.

DJGPP is a 3rd party configuration, we rely entirely on the OpenSSL to
help us fine tune and test.  Therefore, it's moved to its own config.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoFix uninitialized variable
Rich Salz [Thu, 12 May 2016 20:08:01 +0000 (16:08 -0400)]
Fix uninitialized variable

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoRemove proxy tests. Add verify callback tests.
Emilia Kasper [Thu, 7 Apr 2016 17:07:50 +0000 (19:07 +0200)]
Remove proxy tests. Add verify callback tests.

The old proxy tests test the implementation of an application proxy
policy callback defined in the test itself, which is not particularly
useful.

It is, however, useful to test cert verify overrides in
general. Therefore, replace these tests with tests for cert verify
callback behaviour.

Also glob the ssl test inputs on the .in files to catch missing
generated files.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAppease ubsan
Emilia Kasper [Wed, 11 May 2016 20:41:29 +0000 (22:41 +0200)]
Appease ubsan

ERR_LIB_USER has value 128, and shifting into the sign bit upsets the
shift sanitizer.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoCorrectly check for trailing digest options.
Dr. Stephen Henson [Thu, 12 May 2016 14:24:06 +0000 (15:24 +0100)]
Correctly check for trailing digest options.

Multiple digest options to the ocsp utility are allowed: e.g. to use
different digests for different certificate IDs. A digest option without
a following certificate is however illegal.

RT#4215

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRemove openssl.spec
Richard Levitte [Wed, 11 May 2016 07:12:32 +0000 (09:12 +0200)]
Remove openssl.spec

While it seemed like a good idea to have this file once upon a time,
this kind of file belongs with the package maintainer rather than in
our source.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRestore support for ENGINE format keys in apps.
Dr. Stephen Henson [Tue, 10 May 2016 14:19:56 +0000 (15:19 +0100)]
Restore support for ENGINE format keys in apps.

RT#4207

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoDon't use GOST ciphersuites with DTLS.
Dmitry Belyavsky [Wed, 11 May 2016 20:00:12 +0000 (21:00 +0100)]
Don't use GOST ciphersuites with DTLS.

RT#4438

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoDon't leak memory if realloc fails.
Dr. Stephen Henson [Wed, 11 May 2016 20:14:57 +0000 (21:14 +0100)]
Don't leak memory if realloc fails.

RT#4403

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoAdd a case for 64-bit OS X in config
Richard Levitte [Tue, 10 May 2016 21:22:29 +0000 (23:22 +0200)]
Add a case for 64-bit OS X in config

This makes it possible to just run ./config on a x86_64 machine with
no extra fuss.

RT#4356

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoFix TLSProxy race by adding missing eval
Viktor Dukhovni [Wed, 11 May 2016 22:01:41 +0000 (18:01 -0400)]
Fix TLSProxy race by adding missing eval

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoRecommend GH over RT, per team vote.
Rich Salz [Tue, 26 Apr 2016 19:50:28 +0000 (15:50 -0400)]
Recommend GH over RT, per team vote.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agomake update
Richard Levitte [Wed, 11 May 2016 20:12:57 +0000 (22:12 +0200)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agotypo
Dr. Stephen Henson [Wed, 11 May 2016 18:14:54 +0000 (19:14 +0100)]
typo

RT#4442

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoUpdate pkcs8 defaults.
Dr. Stephen Henson [Wed, 11 May 2016 11:41:58 +0000 (12:41 +0100)]
Update pkcs8 defaults.

Update pkcs8 utility to use 256 bit AES using SHA256 by default.

Update documentation.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoAdding missing BN_CTX_(start/end) in crypto/ec/ec_key.c
Steven Valdez [Tue, 1 Mar 2016 18:20:43 +0000 (13:20 -0500)]
Adding missing BN_CTX_(start/end) in crypto/ec/ec_key.c

RT#4363

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoReplace cipherlist test
Emilia Kasper [Wed, 6 Apr 2016 14:03:06 +0000 (16:03 +0200)]
Replace cipherlist test

The old cipherlist test in ssltest.c only tests the internal order of
the cipher table, which is pretty useless.

Replace this test with a test that catches inadvertent changes to the
default cipherlist.

Fix run_tests.pl to correctly filter tests that have "list" in their name.

(Also includes a small drive-by fix in .gitignore.)

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMake null_compression const
Matt Caswell [Wed, 11 May 2016 10:50:12 +0000 (11:50 +0100)]
Make null_compression const

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoFix V2ClientHello handling.
David Benjamin [Sat, 5 Mar 2016 18:14:11 +0000 (13:14 -0500)]
Fix V2ClientHello handling.

The V2ClientHello code creates an empty compression list, but the
compression list must explicitly contain the null compression (and later
code enforces this).

RT#4387

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoAdd -signcert to CA.pl usage message.
Dr. Stephen Henson [Tue, 10 May 2016 19:30:00 +0000 (20:30 +0100)]
Add -signcert to CA.pl usage message.

RT#4256

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoFix i2d_X509_AUX, update docs and add tests
Viktor Dukhovni [Mon, 2 May 2016 18:46:51 +0000 (14:46 -0400)]
Fix i2d_X509_AUX, update docs and add tests

When *pp is NULL, don't write garbage, return an unexpected pointer
or leak memory on error.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoAdd a couple of checks to prime app.
Dr. Stephen Henson [Tue, 10 May 2016 19:49:50 +0000 (20:49 +0100)]
Add a couple of checks to prime app.

RT#4402

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoAdd -srp option to ciphers command.
Dr. Stephen Henson [Tue, 10 May 2016 21:13:03 +0000 (22:13 +0100)]
Add -srp option to ciphers command.

RT#4224

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agocrypto/des: remove obsolete functions.
Andy Polyakov [Mon, 9 May 2016 09:20:35 +0000 (11:20 +0200)]
crypto/des: remove obsolete functions.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConfigurations: engage MIPS64 Poly1305 module.
Andy Polyakov [Wed, 4 May 2016 13:34:02 +0000 (15:34 +0200)]
Configurations: engage MIPS64 Poly1305 module.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoMIPS64 assembly pack: add Poly1305 module.
Andy Polyakov [Wed, 4 May 2016 13:33:42 +0000 (15:33 +0200)]
MIPS64 assembly pack: add Poly1305 module.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoConfigure: replace which() with IPC::Cmd::can_run.
Andy Polyakov [Mon, 9 May 2016 15:12:13 +0000 (17:12 +0200)]
Configure: replace which() with IPC::Cmd::can_run.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agowindows-makefile.tmpl: minor adjustments.
Andy Polyakov [Mon, 9 May 2016 22:06:11 +0000 (00:06 +0200)]
windows-makefile.tmpl: minor adjustments.

- some Perl versions are allergic to missing ';';
- don't stop if del fails;
- omit unused environment variable;

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoutil/mkdef.pl: omit ordinals from Windows DLLs.
Andy Polyakov [Mon, 9 May 2016 21:50:43 +0000 (23:50 +0200)]
util/mkdef.pl: omit ordinals from Windows DLLs.

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoTypo.
Dr. Stephen Henson [Tue, 10 May 2016 15:39:52 +0000 (16:39 +0100)]
Typo.

RT#4538

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoFix the docs for ERR_remove_thread_state and ERR_remove_state
Richard Levitte [Tue, 10 May 2016 11:12:01 +0000 (13:12 +0200)]
Fix the docs for ERR_remove_thread_state and ERR_remove_state

Don't primarly recommend using OPENSSL_thread_stop(), as that's a last
resort.  Instead, recommend leaving it to automatic mechanisms.

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoRestore the ERR_remove_thread_state() API and make it a no-op
Richard Levitte [Sun, 8 May 2016 15:01:09 +0000 (17:01 +0200)]
Restore the ERR_remove_thread_state() API and make it a no-op

The ERR_remove_thread_state() API is restored to take a pointer
argument, but does nothing more.  ERR_remove_state() is also made into
a no-op.  Both functions are deprecated and users are recommended to
use OPENSSL_thread_stop() instead.

Documentation is changed to reflect this.

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoHave [.VMS]openssl_{startup,shutdown}.com depend on respective *.in
Richard Levitte [Tue, 10 May 2016 05:54:32 +0000 (07:54 +0200)]
Have [.VMS]openssl_{startup,shutdown}.com depend on respective *.in

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoFix VMS/openssl_{startup,shutddown}.com.in
Richard Levitte [Mon, 9 May 2016 20:59:02 +0000 (22:59 +0200)]
Fix VMS/openssl_{startup,shutddown}.com.in

They were using the wrong variables.

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoConfigure: adhere to $(CROSS_COMPILE)ranlib.
Andy Polyakov [Mon, 9 May 2016 13:35:55 +0000 (15:35 +0200)]
Configure: adhere to $(CROSS_COMPILE)ranlib.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoConfigure: make it work with Perl 5.10.
Andy Polyakov [Mon, 9 May 2016 09:44:10 +0000 (11:44 +0200)]
Configure: make it work with Perl 5.10.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoIRIX fixes.
Andy Polyakov [Wed, 4 May 2016 21:40:47 +0000 (23:40 +0200)]
IRIX fixes.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoAdd NULL check in i2d_PrivateKey()
Richard Levitte [Mon, 9 May 2016 19:52:11 +0000 (21:52 +0200)]
Add NULL check in i2d_PrivateKey()

Originally submitted by Kurt Cancemi <kurt@x64architecture.com>

Closes RT#4533

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoDon't send signature algorithms when client_version is below TLS 1.2.
David Benjamin [Sun, 6 Mar 2016 00:49:20 +0000 (19:49 -0500)]
Don't send signature algorithms when client_version is below TLS 1.2.

Per RFC 5246,

    Note: this extension is not meaningful for TLS versions prior to 1.2.
    Clients MUST NOT offer it if they are offering prior versions.
    However, even if clients do offer it, the rules specified in [TLSEXT]
    require servers to ignore extensions they do not understand.

Although second sentence would suggest that there would be no interop
problems in always offering the extension, WebRTC has reported issues
with Bouncy Castle on < TLS 1.2 ClientHellos that still include
signature_algorithms. See also
https://bugs.chromium.org/p/webrtc/issues/detail?id=4223

RT#4390

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoFix BIO_eof() for BIO pairs
Matt Caswell [Mon, 9 May 2016 14:04:11 +0000 (15:04 +0100)]
Fix BIO_eof() for BIO pairs

BIO_eof() was always returning true when using a BIO pair. It should only
be true if the peer BIO is empty and has been shutdown.

RT#1215

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix: failed to open config file if not specified when using CA commands
Hansruedi Patzen [Sat, 20 Feb 2016 16:27:02 +0000 (17:27 +0100)]
Fix: failed to open config file if not specified when using CA commands

Issue was introduced in
https://github.com/openssl/openssl/commit/a0a82324f965bbcc4faed4e1ee3fcaf81ea52166

This patch fixes an issue which causes the 'openssl ca' commands to
fail if '-config' is not specified even if it says so otherwise.
Problem is that the default config is not loaded and the conf variable
is NULL which causes an exception.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoVMS: support VERBOSE and V in descrip.mms
Richard Levitte [Sun, 8 May 2016 14:57:55 +0000 (16:57 +0200)]
VMS: support VERBOSE and V in descrip.mms

With Unixly Makefiles as well as with nmake, make variables are
transferred to the shell running the commands as envinronment
variables.  This principle doesn't apply with MMS, so we must
explicitely define VERBOSE as commands when it's needed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRecognise VERBOSE and V as well as HARNESS_VERBOSE
Dr. Stephen Henson [Sun, 8 May 2016 12:09:56 +0000 (13:09 +0100)]
Recognise VERBOSE and V as well as HARNESS_VERBOSE

PR#4462

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMissing credit in CHANGES
Rich Salz [Mon, 9 May 2016 12:56:35 +0000 (08:56 -0400)]
Missing credit in CHANGES

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix error in the loop of ECDH
Andrea Grandi [Tue, 3 May 2016 02:24:48 +0000 (03:24 +0100)]
Fix error in the loop of ECDH

The tests was incorrectly repeated multiple times when using the
async_jobs options

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoFree any existing SRTP connection profile
Matt Caswell [Thu, 5 May 2016 19:59:03 +0000 (20:59 +0100)]
Free any existing SRTP connection profile

When setting a new SRTP connection profile using
SSL_CTX_set_tlsext_use_srtp() or SSL_set_tlsext_use_srtp() we should
free any existing profile first to avoid a memory leak.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
8 years agoConfigurations/windows-makefile.tmpl: expand environments early.
Andy Polyakov [Fri, 6 May 2016 10:45:50 +0000 (12:45 +0200)]
Configurations/windows-makefile.tmpl: expand environments early.

If environment variables are not explanded early enough, expanded
strings are passed with single backslash to C compiler, e.g.
C:\Program Files, which effectively results in OpenSSL looking for
engines and certificates in C:Program Files.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agofix tab-space mixed indentation
FdaSilvaYY [Tue, 3 May 2016 20:40:33 +0000 (22:40 +0200)]
fix tab-space mixed indentation

No code change

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agofix check
J Mohan Rao Arisankala [Fri, 6 May 2016 01:35:44 +0000 (07:05 +0530)]
fix check

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agofew missing allocation failure checks and releases on error paths
J Mohan Rao Arisankala [Thu, 5 May 2016 18:13:32 +0000 (23:43 +0530)]
few missing allocation failure checks and releases on error paths

- Missing checks for allocation failure.
- releasing memory in few missing error paths

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agomemset() doesn't take NULL.
Ben Laurie [Wed, 4 May 2016 10:45:49 +0000 (11:45 +0100)]
memset() doesn't take NULL.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoAdd fuzzing!
Ben Laurie [Sat, 26 Mar 2016 17:19:14 +0000 (17:19 +0000)]
Add fuzzing!

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoConstify PKCS12_newpass()
Dr. Stephen Henson [Fri, 6 May 2016 02:46:09 +0000 (03:46 +0100)]
Constify PKCS12_newpass()

PR#4449

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd documentation of PKCS12_newpass()
Jeffrey Walton [Thu, 5 May 2016 13:26:26 +0000 (14:26 +0100)]
Add documentation of PKCS12_newpass()

PR#4478

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoTidy up PKCS12_newpass() fix memory leaks.
Dr. Stephen Henson [Thu, 5 May 2016 14:37:23 +0000 (15:37 +0100)]
Tidy up PKCS12_newpass() fix memory leaks.

PR#4466

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoOnly set CMS parameter when encrypting
Dr. Stephen Henson [Fri, 6 May 2016 18:27:49 +0000 (19:27 +0100)]
Only set CMS parameter when encrypting

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRT3513: req doesn't display attributes using utf8string
isnotnick [Tue, 16 Dec 2014 15:25:59 +0000 (16:25 +0100)]
RT3513: req doesn't display attributes using utf8string

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoREADME.PERL: clarify "matching" Perl requirement on Windows.
Andy Polyakov [Thu, 5 May 2016 15:07:06 +0000 (17:07 +0200)]
README.PERL: clarify "matching" Perl requirement on Windows.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agopoly1305/asm/poly1305-x86_64.pl: contain symbols within shared lib.
Andy Polyakov [Wed, 4 May 2016 21:53:06 +0000 (23:53 +0200)]
poly1305/asm/poly1305-x86_64.pl: contain symbols within shared lib.

We don't need it, but external users might find it handy.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agopoly1305/asm/poly1305-x86_64.pl: make it cross-compile.
Andy Polyakov [Wed, 4 May 2016 21:45:35 +0000 (23:45 +0200)]
poly1305/asm/poly1305-x86_64.pl: make it cross-compile.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agotestlib/OpenSSL/Test.pm: address 5.10 warnings.
Andy Polyakov [Wed, 4 May 2016 21:42:57 +0000 (23:42 +0200)]
testlib/OpenSSL/Test.pm: address 5.10 warnings.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agotest/evp_test.c: exercise different combinations of data misalignment.
Andy Polyakov [Sat, 23 Apr 2016 17:14:21 +0000 (19:14 +0200)]
test/evp_test.c: exercise different combinations of data misalignment.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoUse default ASN.1 for SEED.
Dr. Stephen Henson [Thu, 5 May 2016 21:17:05 +0000 (22:17 +0100)]
Use default ASN.1 for SEED.

The default ASN.1 handling can be used for SEED. This also makes
CMS work with SEED.

PR#4504

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agotypo
Dr. Stephen Henson [Thu, 5 May 2016 21:44:44 +0000 (22:44 +0100)]
typo

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMove 3DES from HIGH to MEDIUM
Rich Salz [Thu, 5 May 2016 21:08:41 +0000 (17:08 -0400)]
Move 3DES from HIGH to MEDIUM

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
8 years agoAlways try to set ASN.1 parameters for CMS.
Dr. Stephen Henson [Mon, 21 Mar 2016 15:48:51 +0000 (15:48 +0000)]
Always try to set ASN.1 parameters for CMS.

Try to set the ASN.1 parameters for CMS encryption even if the IV
length is zero as the underlying cipher should still set the type.

This will correctly result in errors if an attempt is made to use
an unsupported cipher type.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoGH356: Change assert to normal error
Sergio Garcia Murillo [Thu, 5 May 2016 21:27:30 +0000 (17:27 -0400)]
GH356: Change assert to normal error

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoHandle no async jobs in libssl
Matt Caswell [Tue, 3 May 2016 16:55:00 +0000 (17:55 +0100)]
Handle no async jobs in libssl

If the application has limited the size of the async pool using
ASYNC_init_thread() then we could run out of jobs while trying to start a
libssl io operation. However libssl was failing to handle this and treating
it like a fatal error. It should not be fatal...we just need to retry when
there are jobs available again.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoDocument inversion ladder in curve25519
Emilia Kasper [Fri, 29 Apr 2016 17:19:58 +0000 (19:19 +0200)]
Document inversion ladder in curve25519

This demystifies two for-loops that do nothing. They were used to write
the ladder in a unified way. Now that the ladder is otherwise commented,
remove the dead loops.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoScript changed; update the generated file.
Rich Salz [Thu, 5 May 2016 14:21:46 +0000 (10:21 -0400)]
Script changed; update the generated file.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
8 years agoImprove heartbeats coding style
Matt Caswell [Thu, 5 May 2016 15:04:22 +0000 (16:04 +0100)]
Improve heartbeats coding style

Based on an orignal commit by GitHub user BertramScharpf. Rebased and
updated to take account of all the updates since this was first raised.

GH PR#62

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoTweak generated warning lines.
Rich Salz [Sun, 1 May 2016 12:47:43 +0000 (08:47 -0400)]
Tweak generated warning lines.

Reviewed-by: Andy Polyakov <appro@openssl.org>