oweals/openssl.git
7 years agopoly1305/asm/poly1305-x86_64.pl: switch to vpermdd in table expansion.
Andy Polyakov [Sun, 25 Dec 2016 12:10:00 +0000 (13:10 +0100)]
poly1305/asm/poly1305-x86_64.pl: switch to vpermdd in table expansion.

Effectively it's minor size optimization, 5-6% per affected subroutine.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agopoly1305/asm/poly1305-x86_64.pl: optimize AVX512 code path.
Andy Polyakov [Sun, 25 Dec 2016 12:05:35 +0000 (13:05 +0100)]
poly1305/asm/poly1305-x86_64.pl: optimize AVX512 code path.

On pre-Skylake best optimization strategy was balancing port-specific
instructions, while on Skylake minimizing the sheer amount appears
more sensible.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoAdd tests for SHA1 and EC point compression
Dr. Stephen Henson [Sat, 25 Feb 2017 00:40:55 +0000 (00:40 +0000)]
Add tests for SHA1 and EC point compression

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2739)

7 years agoFor TLS 1.3 reject SHA1 TLS signatures
Dr. Stephen Henson [Sat, 25 Feb 2017 00:25:04 +0000 (00:25 +0000)]
For TLS 1.3 reject SHA1 TLS signatures

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2739)

7 years agoReject compressed point format with TLS 1.3
Dr. Stephen Henson [Fri, 24 Feb 2017 20:43:02 +0000 (20:43 +0000)]
Reject compressed point format with TLS 1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2739)

7 years agoEC certificate with compression point
Dr. Stephen Henson [Fri, 24 Feb 2017 17:29:59 +0000 (17:29 +0000)]
EC certificate with compression point

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2739)

7 years agoAdd SuiteB support to tls_choose_sigalg()
Dr. Stephen Henson [Fri, 24 Feb 2017 16:39:57 +0000 (16:39 +0000)]
Add SuiteB support to tls_choose_sigalg()

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2738)

7 years agoAdd Suite B tests
Dr. Stephen Henson [Fri, 24 Feb 2017 15:47:54 +0000 (15:47 +0000)]
Add Suite B tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2738)

7 years agoAdd P-384 root and P-384, P-256 EE certificates.
Dr. Stephen Henson [Sat, 18 Feb 2017 13:38:37 +0000 (13:38 +0000)]
Add P-384 root and P-384, P-256 EE certificates.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2738)

7 years agoX509 time: tighten validation per RFC 5280
Emilia Kasper [Fri, 17 Feb 2017 18:00:15 +0000 (19:00 +0100)]
X509 time: tighten validation per RFC 5280

- Reject fractional seconds
- Reject offsets
- Check that the date/time digits are in valid range.
- Add documentation for X509_cmp_time

GH issue 2620

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years ago.travis.yml: introduce concept of "extended tests"
Andy Polyakov [Mon, 6 Feb 2017 10:14:05 +0000 (11:14 +0100)]
.travis.yml: introduce concept of "extended tests"

Since CI is engaged on per merge request basis, it can be wasteful to
run each request through all the tests, especially those resource
consuming. Idea is to mark most of tests as "extended" and provide a
way to opt-in by marking last commit with [extended tests] tag. It's
still not as optimal as one could wish, as decision to skip a test
still requires machine time, and it's taken in configured environment,
i.e. with updates and additional packages installed...

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2292)

7 years ago.travis.yml: make package pulls conditional.
Andy Polyakov [Thu, 26 Jan 2017 00:02:43 +0000 (01:02 +0100)]
.travis.yml: make package pulls conditional.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2292)

7 years agoAdd -Wundef to --strict-warnings options.
Bernd Edlinger [Thu, 23 Feb 2017 13:52:23 +0000 (14:52 +0100)]
Add -Wundef to --strict-warnings options.

Avoid a -Wundef warning in refcount.h
Avoid a -Wundef warning in o_str.c
Avoid a -Wundef warning in testutil.h
Include internal/cryptlib.h before openssl/stack.h
to avoid use of undefined symbol OPENSSL_API_COMPAT.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2712)

7 years agoTidy up certificate type handling.
Dr. Stephen Henson [Thu, 23 Feb 2017 22:12:28 +0000 (22:12 +0000)]
Tidy up certificate type handling.

The certificate types used to be held in a fixed length array or (if
it was too long) a malloced buffer. This was done to retain binary
compatibility. The code can be simplified now SSL is opaque by always
using a malloced buffer.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2733)

7 years agoIncrease the size of the stack buffer to prevent an overflow.
Pauli [Thu, 23 Feb 2017 03:46:01 +0000 (13:46 +1000)]
Increase the size of the stack buffer to prevent an overflow.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2721)

7 years agoFix potential memory leak in ASN1_TIME_to_generalizedtime()
Todd Short [Fri, 17 Feb 2017 16:36:13 +0000 (11:36 -0500)]
Fix potential memory leak in ASN1_TIME_to_generalizedtime()

If ret is allocated, it may be leaked on error.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2666)

7 years agoFix duplicate error codes
Kurt Roeckx [Thu, 23 Feb 2017 22:10:01 +0000 (23:10 +0100)]
Fix duplicate error codes

Reviewed-by: Matt Caswell <matt@openssl.org>
GH: #2732

7 years agoImplement SSL_read_ex() and SSL_write_ex() as documented.
Kurt Roeckx [Sat, 19 Nov 2016 19:15:35 +0000 (20:15 +0100)]
Implement SSL_read_ex() and SSL_write_ex() as documented.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
GH: #1964

7 years agoAdd an sslapitest for early callback
Benjamin Kaduk [Mon, 13 Feb 2017 18:42:43 +0000 (12:42 -0600)]
Add an sslapitest for early callback

Make sure that we can stop handshake processing and resume it later.
Also check that the cipher list and compression methods are sane.
Unfortunately, we don't have the client-side APIs needed to force
a specific (known) session ID to be sent in the ClientHello, so
that accessor cannot be tested here.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoLet test handshakes stop on certain errors
Benjamin Kaduk [Mon, 13 Feb 2017 21:10:54 +0000 (15:10 -0600)]
Let test handshakes stop on certain errors

Certain callback APIs allow the callback to request async processing
by trickling a particular error value up the stack to the application
as an error return from the handshake function.  In those cases,
SSL_want() returns a code specific to the type of async processing
needed.

The create_ssl_connection() helper function for the tests is very
helpful for several things, including creating API tests.  However,
it does not currently let us test the async processing functionality
of these callback interfaces, because the special SSL error codes
are treated as generic errors and the helper continues to loop until
it reaches its maximum iteration count.

Add a new parameter, 'want', that indicates an expected/desired
special SSL error code, so that the helper will terminate when
either side reports that error, giving control back to the calling
function and allowing the test to proceed.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoUse correct variable in test diagnostic
Benjamin Kaduk [Mon, 13 Feb 2017 20:14:06 +0000 (14:14 -0600)]
Use correct variable in test diagnostic

create_ssl_connection() prints out the results if SSL_accept() and/or
SSL_connect() fail, but was reusing the client return value when printing
about SSL_accept() failures.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoAdopt test to changed behavior
Benjamin Kaduk [Thu, 9 Feb 2017 23:21:42 +0000 (17:21 -0600)]
Adopt test to changed behavior

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoTests for SSL early callback
Benjamin Kaduk [Tue, 31 Jan 2017 22:06:30 +0000 (16:06 -0600)]
Tests for SSL early callback

Plumb things through in the same place as the SNI callback, since
we recommend that the early callback replace (and supplement) the
SNI callback, and add a few test cases.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoAdd SSL_CTX early callback
Benjamin Kaduk [Mon, 23 Jan 2017 23:03:16 +0000 (17:03 -0600)]
Add SSL_CTX early callback

Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.

This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client.  However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration.  That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.

We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later.  To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed.  This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.

Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback.  This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.

Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.

Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoPrepare for WORK_MORE_C
Benjamin Kaduk [Mon, 6 Feb 2017 21:33:28 +0000 (15:33 -0600)]
Prepare for WORK_MORE_C

Add the new enum value and case statements as appropriate.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoTests for SSL_bytes_to_cipher_list()
Benjamin Kaduk [Mon, 30 Jan 2017 18:59:59 +0000 (12:59 -0600)]
Tests for SSL_bytes_to_cipher_list()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoRefactor SSL_bytes_to_cipher_list()
Benjamin Kaduk [Tue, 31 Jan 2017 01:20:14 +0000 (19:20 -0600)]
Refactor SSL_bytes_to_cipher_list()

Split off the portions that mutate the SSL object into a separate
function that the state machine calls, so that the public API can
be a pure function.  (It still needs the SSL parameter in order
to determine what SSL_METHOD's get_cipher_by_char() routine to use,
though.)

Instead of returning the stack of ciphers (functionality that was
not used internally), require using the output parameter, and add
a separate output parameter for the SCSVs contained in the supplied
octets, if desired.  This lets us move to the standard return value
convention.  Also make both output stacks optional parameters.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoExport SSL_bytes_to_cipher_list()
Benjamin Kaduk [Mon, 30 Jan 2017 17:24:17 +0000 (11:24 -0600)]
Export SSL_bytes_to_cipher_list()

Move ssl_bytes_to_cipher_list() to ssl_lib.c and create a public
wrapper around it.  This lets application early callbacks easily get
SSL_CIPHER objects from the raw ciphers bytes without having to
reimplement the parsing code.  In particular, they do not need to
know the details of the sslv2 format ClientHello's ciphersuite
specifications.

Document the new public function, including the arguably buggy behavior
of modifying the supplied SSL object.  On the face of it, such a function
should be able to be pure, just a direct translation of wire octets to
internal data structures.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoLet ssl_get_cipher_by_char yield not-valid ciphers
Benjamin Kaduk [Mon, 6 Feb 2017 17:30:16 +0000 (11:30 -0600)]
Let ssl_get_cipher_by_char yield not-valid ciphers

Now that we have made SCSVs into more of a first-class object, provide
a way for the bytes-to-SSL_CIPHER conversion to actually return them.
Add a flag 'all' to ssl_get_cipher_by_char to indicate that we want
all the known ciphers, not just the ones valid for encryption.  This will,
in practice, let the caller retrieve the SCSVs.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoAdd more first-class support for SCSVS
Benjamin Kaduk [Fri, 3 Feb 2017 23:17:21 +0000 (17:17 -0600)]
Add more first-class support for SCSVS

Just as we have a table of ssl3_ciphers, add a table of ssl3_scsvs, to contain
SSL_CIPHER objects for these non-valid ciphers.  This will allow for unified
handling of such indicators, especially as we are preparing to pass them around
between functions.

Since the 'valid' field is not set for the SCSVs, they should not be used
for anything requiring a cryptographic cipher (as opposed to something
being stuck in a cipher-shaped hole in the TLS wire protocol).

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoMove CLIENTHELLO_MSG up in the header
Benjamin Kaduk [Mon, 23 Jan 2017 23:00:47 +0000 (17:00 -0600)]
Move CLIENTHELLO_MSG up in the header

We'll be adding a field of this type to struct ssl_st in a subsequent
commit, and need the type definition to be in scope already.
Also move up the RAW_EXTENSION definition that it depends on.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoStore the number of extensions in CLIENTHELLO_MSG
Benjamin Kaduk [Mon, 23 Jan 2017 22:59:23 +0000 (16:59 -0600)]
Store the number of extensions in CLIENTHELLO_MSG

Keep track of the length of the pre_proc_exts array.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agooutput number of exts from tls_collect_extensions()
Benjamin Kaduk [Mon, 23 Jan 2017 22:56:43 +0000 (16:56 -0600)]
output number of exts from tls_collect_extensions()

Modify the API of tls_collect_extensions() to be able to output the number of
extensions that are known (i.e., the length of its 'res' output).  This number
can never be zero on a successful return due to the builtin extensions list,
but use a separate output variable so as to not overload the return value
semantics.

Having this value easily available will give consumers a way to avoid repeating
the calculation.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)

7 years agoCheck for the presence of _WIN32 rather than its value.
Richard Levitte [Thu, 23 Feb 2017 13:41:20 +0000 (14:41 +0100)]
Check for the presence of _WIN32 rather than its value.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2727)

7 years agoIn apps/rehash.c, decorate the inclusion of internal/o_dir.h for VMS
Richard Levitte [Thu, 23 Feb 2017 12:45:00 +0000 (13:45 +0100)]
In apps/rehash.c, decorate the inclusion of internal/o_dir.h for VMS

The library files are built with symbol names as is, while the
application is built with the default uppercase-all-symbols mode.
That's fine for public APIs, because we have __DECC_INCLUDE_PROLOGUE.H
and __DECC_INCLUDE_EPILOGUE.H automatically telling the compiler how
to treat the public header files.  However, we don't have the same
setup for internal library APIs, since they are usually only used by
the libraries.

Because apps/rehash.c uses a library internal header file, we have to
surround that inclusion with the same kind of pragmas found in
__DECC_INCLUDE_PROLOGUE.H and __DECC_INCLUDE_EPILOGUE.H, or we get
unresolved symbols when building no-shared.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2725)

7 years agoAdd a test case that tests more of the cipher modes.
Pauli [Wed, 22 Feb 2017 22:34:32 +0000 (08:34 +1000)]
Add a test case that tests more of the cipher modes.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2715)

7 years agoOn VMS, massage the fetch file names to remove the generation number
Richard Levitte [Thu, 23 Feb 2017 00:45:04 +0000 (01:45 +0100)]
On VMS, massage the fetch file names to remove the generation number

The generation number is ';nnn' at the end of the file name fetched
with readdir().  Because rehash checks for specific extensions and
doesn't expect an additional generation number, the easiest is to
massage the received file name early by simply removing the generation
number.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2717)

7 years agoLet the output from 'openssl enc -ciphers' go to stdout
Richard Levitte [Wed, 22 Feb 2017 23:11:18 +0000 (00:11 +0100)]
Let the output from 'openssl enc -ciphers' go to stdout

Also, don't exit with an error code

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2716)

7 years agoFix typo, should be && rather than &
Richard Levitte [Wed, 22 Feb 2017 20:06:27 +0000 (21:06 +0100)]
Fix typo, should be && rather than &

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2689)

7 years agoRemove -Wno-parentheses-equality from gcc --strict-warnings options.
Bernd Edlinger [Wed, 22 Feb 2017 11:19:31 +0000 (12:19 +0100)]
Remove -Wno-parentheses-equality from gcc --strict-warnings options.
There has never been any gcc option of that kind.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2705)

7 years agoFix typo, missing ||
Richard Levitte [Wed, 22 Feb 2017 18:50:33 +0000 (19:50 +0100)]
Fix typo, missing ||

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2707)

7 years agoIterate over EC_GROUP's poly array in a safe way
Rich Salz [Wed, 22 Feb 2017 18:11:08 +0000 (13:11 -0500)]
Iterate over EC_GROUP's poly array in a safe way

Prevent that memory beyond the last element is accessed if every element
of group->poly[] is non-zero

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2689)

7 years agoMake "openssl rehash" work on VMS 8.3 and up
Richard Levitte [Wed, 22 Feb 2017 15:48:55 +0000 (16:48 +0100)]
Make "openssl rehash" work on VMS 8.3 and up

A spelling error prevented it from building correctly.
Furthermore, we need to be more careful when to add a / at the end
of the dirname and when not.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2706)

7 years agoHave the directory reader use the Unix API on VMS
Richard Levitte [Wed, 22 Feb 2017 17:12:04 +0000 (18:12 +0100)]
Have the directory reader use the Unix API on VMS

opendir(), readdir() and closedir() have been available on VMS since
version 7.0.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2707)

7 years agoapps/req.c: flag "-new" is implied by "-precert"
Rob Percival [Fri, 13 Jan 2017 19:10:26 +0000 (19:10 +0000)]
apps/req.c: flag "-new" is implied by "-precert"

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/843)

7 years agoChange CA.pl flag from --newprecert to --precert
Rob Percival [Fri, 13 Jan 2017 19:06:03 +0000 (19:06 +0000)]
Change CA.pl flag from --newprecert to --precert

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/843)

7 years agoDocumentation for the -precert flag for "openssl req"
Rob Percival [Thu, 10 Mar 2016 20:32:16 +0000 (20:32 +0000)]
Documentation for the -precert flag for "openssl req"

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/843)

7 years agoBasic test for "openssl req -precert" via apps/CA.pl
Rob Percival [Thu, 10 Mar 2016 20:26:34 +0000 (20:26 +0000)]
Basic test for "openssl req -precert" via apps/CA.pl

TODO(robpercival): Should actually test that the output certificate
contains the poison extension.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/843)

7 years agoAdds a "-precert" flag to "openssl req" for creating pre-certificates
Rob Percival [Thu, 10 Mar 2016 19:15:13 +0000 (19:15 +0000)]
Adds a "-precert" flag to "openssl req" for creating pre-certificates

This makes it a little easier to create a pre-certificate.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/843)

7 years agoAdd some more consistency checks in tls_decrypt_ticket.
Bernd Edlinger [Wed, 22 Feb 2017 10:59:44 +0000 (11:59 +0100)]
Add some more consistency checks in tls_decrypt_ticket.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2704)

7 years agoCorrect the no-dh and no-dsa fix
Richard Levitte [Wed, 22 Feb 2017 00:49:50 +0000 (01:49 +0100)]
Correct the no-dh and no-dsa fix

The condition wasn't quite right

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2702)

7 years agoFix i2d_SSL_SESSION pp output parameter should point to end of asn1 data.
Bernd Edlinger [Mon, 13 Feb 2017 12:03:52 +0000 (13:03 +0100)]
Fix i2d_SSL_SESSION pp output parameter should point to end of asn1 data.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2607)

7 years agoappveyor.yml: engage VC-WIN64A-masm.
Andy Polyakov [Sun, 19 Feb 2017 21:11:29 +0000 (22:11 +0100)]
appveyor.yml: engage VC-WIN64A-masm.

One of the reasons for why masm/ml64 is not [fully] supported is that
it's problematic to support multiple versions. But latest one usually
works and/or it's lesser problem to make it work. So idea here is to
have a "whistle" when it breaks, so that problems can be evaluated as
they emerge. It's kind of "best effort" thing, as opposite to "full
support".

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoFix memory leak in pkcs12 -export
Dmitry Belyavskiy [Sat, 18 Feb 2017 17:43:01 +0000 (20:43 +0300)]
Fix memory leak in pkcs12 -export

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2676)

7 years agoFix some more memory leaks with TXT_DB_insert.
Bernd Edlinger [Sun, 19 Feb 2017 19:13:45 +0000 (20:13 +0100)]
Fix some more memory leaks with TXT_DB_insert.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2684)

7 years agoFix a few memleaks in TXT_DB.
Bernd Edlinger [Sun, 19 Feb 2017 17:12:03 +0000 (18:12 +0100)]
Fix a few memleaks in TXT_DB.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2684)

7 years agoProvided support for the -nameopt flag in s_client, s_server and s_time
Dmitry Belyavskiy [Tue, 21 Feb 2017 11:22:55 +0000 (14:22 +0300)]
Provided support for the -nameopt flag in s_client, s_server and s_time
commands.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2695)

7 years agoPrevent OOB in SRP base64 code.
Rich Salz [Tue, 21 Feb 2017 18:07:13 +0000 (13:07 -0500)]
Prevent OOB in SRP base64 code.

Change size comparison from > (GT) to >= (GTE) to ensure an additional
byte of output buffer, to prevent OOB reads/writes later in the function
Reject input strings larger than 2GB
Detect invalid output buffer size and return early

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2672)

7 years agoUpdate client, server and x509 fuzz corpus
Kurt Roeckx [Sun, 19 Feb 2017 15:53:50 +0000 (16:53 +0100)]
Update client, server and x509 fuzz corpus

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2682

7 years agoCheck validity, not just signing for all certificates
Dr. Stephen Henson [Sun, 19 Feb 2017 21:16:46 +0000 (21:16 +0000)]
Check validity, not just signing for all certificates

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2679)

7 years agoAdd no siglags test for ECDSA certificate
Dr. Stephen Henson [Sun, 19 Feb 2017 18:55:26 +0000 (18:55 +0000)]
Add no siglags test for ECDSA certificate

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2679)

7 years agoSet default validity flags.
Dr. Stephen Henson [Sun, 19 Feb 2017 18:47:16 +0000 (18:47 +0000)]
Set default validity flags.

Set default validity flags if signature algorithms extension
is not present. Preserve flags when checking chains.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2679)

7 years agoremove md array: it is not used any more.
Dr. Stephen Henson [Sat, 18 Feb 2017 03:42:15 +0000 (03:42 +0000)]
remove md array: it is not used any more.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2679)

7 years agoRemoved ugly size_t less than zero check.
Hikar [Sat, 18 Feb 2017 07:44:49 +0000 (08:44 +0100)]
Removed ugly size_t less than zero check.

CLA: trivial.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2674)

7 years agoEnsure minsize >= sizeof(SH_LIST)
Pauli [Fri, 17 Feb 2017 00:39:20 +0000 (10:39 +1000)]
Ensure minsize >= sizeof(SH_LIST)

The sh_add_to_list function will overwrite subsequent slots in the free list
for small allocations.  This causes a segmentation fault if the writes goes
off the end of the secure memory.  I've not investigated if this problem
can overwrite memory without the segmentation fault, but it seems likely.

This fix limits the minsize to the sizeof of the SH_LIST structure (which
also has a side effect of properly aligning the pointers).

The alternative would be to return an error if minsize is too small.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2657)

7 years agofix spelling of Camellia in comment
Pauli [Wed, 1 Feb 2017 23:56:47 +0000 (09:56 +1000)]
fix spelling of Camellia in comment

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2337)

7 years agoImplementation of the ARIA cipher as described in RFC 5794.
Pauli [Wed, 1 Feb 2017 00:10:13 +0000 (10:10 +1000)]
Implementation of the ARIA cipher as described in RFC 5794.

This implementation is written in endian agnostic C code. No attempt
at providing machine specific assembly code has been made. This
implementation expands the evptests by including the test cases from
RFC 5794 and ARIA official site rather than providing an individual
test case. Support for ARIA has been integrated into the command line
applications, but not TLS. Implemented modes are CBC, CFB1, CFB8,
CFB128, CTR, ECB and OFB128.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2337)

7 years agoAdded '-nameopt' option to the verify command.
Dmitry Belyavskiy [Thu, 16 Feb 2017 23:06:47 +0000 (02:06 +0300)]
Added '-nameopt' option to the verify command.

It makes possible to print the certificate's DN correctly in case of verification errors.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2656)

7 years agoDon't call memcpy if len is zero.
Rich Salz [Tue, 21 Feb 2017 00:17:53 +0000 (19:17 -0500)]
Don't call memcpy if len is zero.

Prevent undefined behavior in CRYPTO_cbc128_encrypt: calling this function
with the 'len' parameter being 0 would result in a memcpy where the source
and destination parameters are the same, which is undefined behavior.
Do same for AES_ige_encrypt.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2671)

7 years agoRevert "Use memcmp() instead of CRYPTO_memcmp() when fuzzing"
Kurt Roeckx [Mon, 20 Feb 2017 17:27:22 +0000 (18:27 +0100)]
Revert "Use memcmp() instead of CRYPTO_memcmp() when fuzzing"

This reverts commit 3aad8e18707bccaabee5f111de2db0696b45781c.

Reviewed-by: Andy Polyakov <appro@openssl.org>
GH: #2686

7 years ago.travis.yml: remove osx from build matrix.
Andy Polyakov [Sun, 19 Feb 2017 10:16:21 +0000 (11:16 +0100)]
.travis.yml: remove osx from build matrix.

Travis OS X utilization and backlog statistics suggest that it became
bottleneck for our integration builds with requests piling up for days
during working days of the week. Suggestion is to remove osx till
capacity is lesser issue.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoUse memcmp() instead of CRYPTO_memcmp() when fuzzing
Kurt Roeckx [Tue, 14 Feb 2017 23:36:46 +0000 (00:36 +0100)]
Use memcmp() instead of CRYPTO_memcmp() when fuzzing

Reviewed-by: Andy Polyakov <appro@openssl.org>
GH: #2633

7 years agoInternal siphash tests are not run.
Todd Short [Thu, 16 Feb 2017 14:09:39 +0000 (09:09 -0500)]
Internal siphash tests are not run.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2649)

7 years agoVMS fix of test/recipes/80-test_ssl_new.t
Richard Levitte [Sat, 18 Feb 2017 21:41:27 +0000 (22:41 +0100)]
VMS fix of test/recipes/80-test_ssl_new.t

On VMS, file names with more than one period get all but the last get
escaped with a ^, so 21-key-update.conf.in becomes 21-key-update^.conf.in
That means that %conf_dependent_tests and %skip become useless unless
we massage the file names that are used as indexes.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2678)

7 years agoFix no-dh and no-dsa
Richard Levitte [Sun, 19 Feb 2017 05:59:33 +0000 (06:59 +0100)]
Fix no-dh and no-dsa

Since 20-cert-select.conf will vary depending in no-dh and no-dsa,
don't check it against original when those options are selected

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2680)

7 years agoIf all versions of a proto are disabled, disabled the proto as well
Richard Levitte [Fri, 17 Feb 2017 19:48:28 +0000 (20:48 +0100)]
If all versions of a proto are disabled, disabled the proto as well

For example, 'no-dtls1 no-dtls1_2' will imply 'no-dtls'

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2670)

7 years agotest/README: clarify last test number group
Andy Polyakov [Fri, 17 Feb 2017 09:49:04 +0000 (10:49 +0100)]
test/README: clarify last test number group

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoExplicitly disallow DSA for TLS 1.3
Dr. Stephen Henson [Fri, 17 Feb 2017 16:08:19 +0000 (16:08 +0000)]
Explicitly disallow DSA for TLS 1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2667)

7 years agoadd DSA cert tests
Dr. Stephen Henson [Fri, 17 Feb 2017 15:28:36 +0000 (15:28 +0000)]
add DSA cert tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2667)

7 years agoAdd DH parameters, DSA cert and key
Dr. Stephen Henson [Fri, 17 Feb 2017 14:36:06 +0000 (14:36 +0000)]
Add DH parameters, DSA cert and key

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2667)

7 years agoAdd DSA support to mkcert.sh
Dr. Stephen Henson [Fri, 17 Feb 2017 14:44:59 +0000 (14:44 +0000)]
Add DSA support to mkcert.sh

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2667)

7 years agoAdd and use function test_pem to work out test filenames.
Dr. Stephen Henson [Thu, 16 Feb 2017 15:27:49 +0000 (15:27 +0000)]
Add and use function test_pem to work out test filenames.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2667)

7 years agoFix a slightly confusing if condition in a2i_ASN1_INTEGER.
Bernd Edlinger [Wed, 15 Feb 2017 19:01:53 +0000 (20:01 +0100)]
Fix a slightly confusing if condition in a2i_ASN1_INTEGER.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2640)

7 years agoFix a merge error
Matt Caswell [Fri, 17 Feb 2017 14:33:30 +0000 (14:33 +0000)]
Fix a merge error

Fix an error code clash due to a merge

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2665)

7 years agoFix test_x509_store
Richard Levitte [Fri, 17 Feb 2017 13:59:44 +0000 (14:59 +0100)]
Fix test_x509_store

Don't run this test unless 'openssl rehash' works properly.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2664)

7 years agoFix symbol shadow
Richard Levitte [Fri, 17 Feb 2017 13:31:51 +0000 (14:31 +0100)]
Fix symbol shadow

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2663)

7 years agoUpdates following review feedback
Matt Caswell [Thu, 16 Feb 2017 17:09:28 +0000 (17:09 +0000)]
Updates following review feedback

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoDon't use an enum in the return type for a public API function
Matt Caswell [Thu, 16 Feb 2017 17:04:40 +0000 (17:04 +0000)]
Don't use an enum in the return type for a public API function

We use an int instead. That means SSL_key_update() also should use an int.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoAdd some KeyUpdate tests
Matt Caswell [Wed, 15 Feb 2017 09:25:52 +0000 (09:25 +0000)]
Add some KeyUpdate tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoAdd documentation for SSL_key_update() and SSL_get_key_update_type()
Matt Caswell [Tue, 14 Feb 2017 15:25:22 +0000 (15:25 +0000)]
Add documentation for SSL_key_update() and SSL_get_key_update_type()

This also adds documentation for the pre-existing and related
SSL_renegotiate*() functions.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoFix a shadowed global variable warning
Matt Caswell [Tue, 14 Feb 2017 11:48:24 +0000 (11:48 +0000)]
Fix a shadowed global variable warning

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoUpdates following review feedback
Matt Caswell [Tue, 14 Feb 2017 11:20:44 +0000 (11:20 +0000)]
Updates following review feedback

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoLimit the number of KeyUpdate messages we can process
Matt Caswell [Mon, 13 Feb 2017 11:55:38 +0000 (11:55 +0000)]
Limit the number of KeyUpdate messages we can process

Too many KeyUpdate message could be inicative of a problem (e.g. an
infinite KeyUpdate loop if the peer always responds to a KeyUpdate message
with an "update_requested" KeyUpdate response), or (conceivably) an attack.
Either way we limit the number of KeyUpdate messages we are prepared to
handle.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoActually update the keys when a KeyUpdate message is sent or received
Matt Caswell [Fri, 10 Feb 2017 17:43:09 +0000 (17:43 +0000)]
Actually update the keys when a KeyUpdate message is sent or received

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoIf we receive an "update_requested" KeyUpdate then respond with a KeyUpdate
Matt Caswell [Thu, 9 Feb 2017 16:00:12 +0000 (16:00 +0000)]
If we receive an "update_requested" KeyUpdate then respond with a KeyUpdate

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoAdd the ability for a server to receive a KeyUpdate message
Matt Caswell [Thu, 9 Feb 2017 15:29:45 +0000 (15:29 +0000)]
Add the ability for a server to receive a KeyUpdate message

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoAdd the ability for s_client to send a KeyUpdate message
Matt Caswell [Thu, 9 Feb 2017 13:33:09 +0000 (13:33 +0000)]
Add the ability for s_client to send a KeyUpdate message

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoAdd a SSL_get_key_update_type() function
Matt Caswell [Thu, 9 Feb 2017 15:05:46 +0000 (15:05 +0000)]
Add a SSL_get_key_update_type() function

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoAdd the ability for a client to send a KeyUpdate message
Matt Caswell [Thu, 9 Feb 2017 13:12:00 +0000 (13:12 +0000)]
Add the ability for a client to send a KeyUpdate message

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

7 years agoAdd the ability for a client to receive a KeyUpdate message
Matt Caswell [Thu, 9 Feb 2017 12:07:31 +0000 (12:07 +0000)]
Add the ability for a client to receive a KeyUpdate message

This just receives the message. It doesn't actually update any keys yet.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)