oweals/openssl.git
7 years agoCheck max_early_data against the amount of early data we actually receive
Matt Caswell [Thu, 23 Feb 2017 14:29:36 +0000 (14:29 +0000)]
Check max_early_data against the amount of early data we actually receive

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoMake sure we reset the read sequence when skipping records
Matt Caswell [Thu, 23 Feb 2017 16:05:57 +0000 (16:05 +0000)]
Make sure we reset the read sequence when skipping records

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoDisallow handshake messages in the middle of early_data
Matt Caswell [Thu, 23 Feb 2017 12:36:35 +0000 (12:36 +0000)]
Disallow handshake messages in the middle of early_data

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoFix seg fault when sending early_data using CCM ciphersuites
Matt Caswell [Thu, 23 Feb 2017 12:25:21 +0000 (12:25 +0000)]
Fix seg fault when sending early_data using CCM ciphersuites

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoGet s_client to report on whether early data was accepted or not
Matt Caswell [Thu, 23 Feb 2017 11:52:43 +0000 (11:52 +0000)]
Get s_client to report on whether early data was accepted or not

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoImplement client side parsing of the early_data extension
Matt Caswell [Thu, 23 Feb 2017 11:53:12 +0000 (11:53 +0000)]
Implement client side parsing of the early_data extension

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoAdd a "-early_data" option to s_server
Matt Caswell [Wed, 22 Feb 2017 15:24:11 +0000 (15:24 +0000)]
Add a "-early_data" option to s_server

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoFix changing of the cipher state when dealing with early data
Matt Caswell [Wed, 22 Feb 2017 14:09:42 +0000 (14:09 +0000)]
Fix changing of the cipher state when dealing with early data

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoConstruct the server side early_data extension
Matt Caswell [Wed, 22 Feb 2017 13:01:48 +0000 (13:01 +0000)]
Construct the server side early_data extension

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoProvide an SSL_read_early() function for reading early data
Matt Caswell [Tue, 21 Feb 2017 17:14:42 +0000 (17:14 +0000)]
Provide an SSL_read_early() function for reading early data

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoChange the cipher state when sending early data
Matt Caswell [Tue, 21 Feb 2017 16:40:16 +0000 (16:40 +0000)]
Change the cipher state when sending early data

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoImplement the early data changes required in tls13_change_cipher_state()
Matt Caswell [Tue, 21 Feb 2017 16:39:43 +0000 (16:39 +0000)]
Implement the early data changes required in tls13_change_cipher_state()

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoAdd an option to s_client to send early_data
Matt Caswell [Mon, 20 Feb 2017 16:00:20 +0000 (16:00 +0000)]
Add an option to s_client to send early_data

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoParse the early_data extension
Matt Caswell [Mon, 20 Feb 2017 16:35:03 +0000 (16:35 +0000)]
Parse the early_data extension

We also skip any early_data that subsequently gets sent. Later commits will
process it if we can.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoConstruct the early_data extension
Matt Caswell [Mon, 20 Feb 2017 15:44:42 +0000 (15:44 +0000)]
Construct the early_data extension

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoProvide functions to write early data
Matt Caswell [Tue, 21 Feb 2017 09:22:22 +0000 (09:22 +0000)]
Provide functions to write early data

We provide SSL_write_early() which *must* be called first on a connection
(prior to any other IO function including SSL_connect()/SSL_do_handshake()).
Also SSL_write_early_finish() which signals the end of early data.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoParse the ticket_early_data_info extension
Matt Caswell [Mon, 20 Feb 2017 14:56:51 +0000 (14:56 +0000)]
Parse the ticket_early_data_info extension

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoTeach SSL_trace() about the early_data_info extension
Matt Caswell [Fri, 17 Feb 2017 17:41:46 +0000 (17:41 +0000)]
Teach SSL_trace() about the early_data_info extension

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoAdd a -max_early_data option to s_server
Matt Caswell [Fri, 17 Feb 2017 17:01:16 +0000 (17:01 +0000)]
Add a -max_early_data option to s_server

Allows you to set the number of bytes that can be sent as early data

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoConstruct the ticket_early_data_info extension
Matt Caswell [Fri, 17 Feb 2017 16:52:12 +0000 (16:52 +0000)]
Construct the ticket_early_data_info extension

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2737)

7 years agoRemove ref to err(7), update copyright.
Rich Salz [Thu, 2 Mar 2017 15:07:21 +0000 (10:07 -0500)]
Remove ref to err(7), update copyright.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2825)

7 years ago-precert doesn't work when configured no-ct, don't try to test it then
Richard Levitte [Thu, 2 Mar 2017 17:27:17 +0000 (18:27 +0100)]
-precert doesn't work when configured no-ct, don't try to test it then

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2827)

7 years agoFix the skip numbers in 80-test_ca.t
Richard Levitte [Thu, 2 Mar 2017 17:26:26 +0000 (18:26 +0100)]
Fix the skip numbers in 80-test_ca.t

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2827)

7 years agoUse the built in boolean type for CompressionExpected
Matt Caswell [Thu, 2 Mar 2017 13:41:10 +0000 (13:41 +0000)]
Use the built in boolean type for CompressionExpected

Don't create a custom boolean type for parsing CompressionExpected. Use
the existing one instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2814)

7 years agoAdd compression tests
Matt Caswell [Wed, 1 Mar 2017 12:11:51 +0000 (12:11 +0000)]
Add compression tests

Check whether we negotiate compression in various scenarios.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2814)

7 years agoFix a compression bug
Matt Caswell [Wed, 1 Mar 2017 11:20:30 +0000 (11:20 +0000)]
Fix a compression bug

do_ssl3_write() was crashing when compression was enabled. We calculate
the maximum length that a record will be after compression and reserve
those bytes in the WPACKET. Unfortunately we were adding the maximum
compression overhead onto the wrong variable resulting in a corrupted
record.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2814)

7 years agoEnsure that we never select compression in TLSv1.3
Matt Caswell [Wed, 1 Mar 2017 10:36:38 +0000 (10:36 +0000)]
Ensure that we never select compression in TLSv1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2814)

7 years agoAdd LDAP support (RFC 4511) to s_client ("-starttls ldap")
Robert Scheck [Sun, 26 Feb 2017 23:44:14 +0000 (00:44 +0100)]
Add LDAP support (RFC 4511) to s_client ("-starttls ldap")

Based on initial patch by Alex Bergmann <alex@linlab.net> and new function
ldap_ExtendedResponse_parse() by Andy Polyakov <appro@openssl.org>. Thanks
very much to both.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2293)

7 years agoConfigurations/10-main.conf: omit redundant -lresolv from Solaris configs.
Andy Polyakov [Wed, 1 Mar 2017 20:40:02 +0000 (21:40 +0100)]
Configurations/10-main.conf: omit redundant -lresolv from Solaris configs.

GH#2816

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agobio/b_addr.c: omit private hstrerror.
Andy Polyakov [Wed, 1 Mar 2017 20:28:05 +0000 (21:28 +0100)]
bio/b_addr.c: omit private hstrerror.

Private hstrerror was introduced to address linking problem on HP-UX,
but truth be told conemporary systems, HP-UX included, wouldn't come
to that call, they would use getaddrinfo and gai_strerror, while
gethostbyname and h_errno are there to serve legacy systems. Since
legacy systems are naturally disappearing breed, we can as well just
let user interpret number.

GH#2816

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoaes/aes_x86core.c: clarify reference implementation status.
Andy Polyakov [Wed, 1 Mar 2017 10:41:09 +0000 (11:41 +0100)]
aes/aes_x86core.c: clarify reference implementation status.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoevp/e_aes_cbc_hmac_{sha1|sha256}.c: tag reference code.
Andy Polyakov [Wed, 1 Mar 2017 10:40:41 +0000 (11:40 +0100)]
evp/e_aes_cbc_hmac_{sha1|sha256}.c: tag reference code.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoCHANGES: mention CFI annotations.
Andy Polyakov [Sun, 26 Feb 2017 20:37:50 +0000 (21:37 +0100)]
CHANGES: mention CFI annotations.

[skip ci]

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agobn/asm: clean up unused PA-RISC modules.
Andy Polyakov [Tue, 28 Feb 2017 22:25:36 +0000 (23:25 +0100)]
bn/asm: clean up unused PA-RISC modules.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agodes/des_locl.h: clean up unused/irrelevant macros.
Andy Polyakov [Tue, 28 Feb 2017 21:54:28 +0000 (22:54 +0100)]
des/des_locl.h: clean up unused/irrelevant macros.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoCheck for zero records and return immediately
Jon Spillett [Thu, 2 Mar 2017 02:54:06 +0000 (12:54 +1000)]
Check for zero records and return immediately

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2822)

7 years agoappveyor.yml: streamline pull requests.
Andy Polyakov [Wed, 1 Mar 2017 13:33:34 +0000 (14:33 +0100)]
appveyor.yml: streamline pull requests.

For pull requests not tagged with [extended tests]:

- short-curcuit most expensive fuzz and install tests;
- skip over non-shared builds;

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2810)

7 years agoConfigurations/50-masm.conf: add /nologo to ml64 command line.
Andy Polyakov [Wed, 1 Mar 2017 13:32:25 +0000 (14:32 +0100)]
Configurations/50-masm.conf: add /nologo to ml64 command line.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2810)

7 years agoAdd NOTES.UNIX, with a description on how to deal with runpaths
Richard Levitte [Wed, 1 Mar 2017 22:43:03 +0000 (23:43 +0100)]
Add NOTES.UNIX, with a description on how to deal with runpaths

[skip ci]

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2818)

7 years agoCheck that async_jobs is not negative and not too high.
Bernd Edlinger [Tue, 21 Feb 2017 05:58:04 +0000 (06:58 +0100)]
Check that async_jobs is not negative and not too high.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2693)

7 years agoCode health: ssl/ssl_locl.h unused macros
Andy [Wed, 1 Mar 2017 01:07:01 +0000 (01:07 +0000)]
Code health: ssl/ssl_locl.h unused macros

CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2806)

7 years agoVMS: compensate for gmtime_r() parameter pointer size
Richard Levitte [Wed, 1 Mar 2017 09:33:20 +0000 (10:33 +0100)]
VMS: compensate for gmtime_r() parameter pointer size

With VMS C, the second parameter takes a 32-bit pointer.  When
building with 64-bit pointer size default, we must compensate.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2811)

7 years agoDon't use deprecated EVP_CIPHER_CTX_cleanup() internally
Richard Levitte [Wed, 1 Mar 2017 09:48:34 +0000 (10:48 +0100)]
Don't use deprecated EVP_CIPHER_CTX_cleanup() internally

Use EVP_CIPHER_CTX_reset() instead

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2812)

7 years agoRemove some obsolete/obscure internal define switches:
Emilia Kasper [Tue, 28 Feb 2017 13:13:40 +0000 (14:13 +0100)]
Remove some obsolete/obscure internal define switches:

- FLAT_INC
- PKCS1_CHECK (the SSL_OP_PKCS1_CHECK options have been
  no-oped)
- PKCS_TESTVECT (debugging leftovers)
- SSL_AD_MISSING_SRP_USERNAME (unfinished feature)
- DTLS_AD_MISSING_HANDSHAKE_MESSAGE (unfinished feature)
- USE_OBJ_MAC (note this removes a define from the public header but
   very unlikely someone would be depending on it)
- SSL_FORBID_ENULL

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
7 years agoRemove OPENSSL_indirect_call()
Benjamin Kaduk [Tue, 28 Feb 2017 22:32:51 +0000 (16:32 -0600)]
Remove OPENSSL_indirect_call()

It's undocumented and unused in the tree.  The idea seems to have
never gained much traction, and can be removed without breaking
ABI compatibility.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2800)

7 years agoDon't free in cleanup routine
Benjamin Kaduk [Tue, 28 Feb 2017 22:09:53 +0000 (16:09 -0600)]
Don't free in cleanup routine

Cleanse instead, and free in the free routine.

Seems to have been introduced in commit
846ec07d904f9cc81d486db0db14fb84f61ff6e5 when EVP_CIPHER_CTX was made
opaque.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2798)

7 years agocrypto/des: remove unreferenced rcp_enc.c module.
Andy Polyakov [Tue, 28 Feb 2017 13:15:30 +0000 (14:15 +0100)]
crypto/des: remove unreferenced rcp_enc.c module.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
7 years agoCode health: Remove base address setting for mingw
Richard Levitte [Tue, 28 Feb 2017 17:24:02 +0000 (18:24 +0100)]
Code health: Remove base address setting for mingw

Base address setting was done for the sake of FIPS.  Since FIPS references
have been removed, we clean away this one as well.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2791)

7 years agoFix handling of EVP_PKEY_CTRL_PKCS7_ENCRYPT/DECRYPT with OPENSSL_NO_CMS.
Bernd Edlinger [Tue, 28 Feb 2017 08:48:32 +0000 (09:48 +0100)]
Fix handling of EVP_PKEY_CTRL_PKCS7_ENCRYPT/DECRYPT with OPENSSL_NO_CMS.

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2764)

7 years agoAdd AGL's "beer mug" PEM file as another test input
Benjamin Kaduk [Thu, 23 Feb 2017 22:22:10 +0000 (16:22 -0600)]
Add AGL's "beer mug" PEM file as another test input

AGL has a history of pointing out the idiosynchronies/laxness of the
openssl PEM parser in amusing ways.  If we want this functionality to
stay present, we should test that it works.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2756)

7 years agoAdd test corpus for PEM reading
Benjamin Kaduk [Thu, 23 Feb 2017 20:28:32 +0000 (14:28 -0600)]
Add test corpus for PEM reading

Generate a fresh certificate and DSA private key in their respective PEM
files.  Modify the resulting ASCII in various ways so as to produce input
files that might be generated by non-openssl programs (openssl always
generates "standard" PEM files, with base64 data in 64-character lines
except for a possible shorter last line).

Exercise various combinations of line lengths, leading/trailing
whitespace, non-base64 characters, comments, and padding, for both
unencrypted and encrypted files.  (We do not have any other test coverage
that uses encrypted files, as far as I can see, and the parser enforces
different rules for the body of encrypted files.)

Add a recipe to parse these test files and verify that they contain the
expected string or are rejected, according to the expected status.
Some of the current behavior is perhaps suboptimal and could be revisited.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2756)

7 years agoCode health: Quick note in changes and the OPENSSL_GLOBAL et al changes
Richard Levitte [Tue, 28 Feb 2017 16:36:02 +0000 (17:36 +0100)]
Code health: Quick note in changes and the OPENSSL_GLOBAL et al changes

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2785)

7 years agoCode health: With the VAX C-ism gone, OPENSSL_GLOBAL can be removed too
Richard Levitte [Tue, 28 Feb 2017 16:27:20 +0000 (17:27 +0100)]
Code health: With the VAX C-ism gone, OPENSSL_GLOBAL can be removed too

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2785)

7 years agoCode health: Remove another VAX C-ism, globaldef and globalref
Richard Levitte [Tue, 28 Feb 2017 15:43:09 +0000 (16:43 +0100)]
Code health: Remove another VAX C-ism, globaldef and globalref

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2785)

7 years agoCode health: make update
Richard Levitte [Tue, 28 Feb 2017 19:00:56 +0000 (20:00 +0100)]
Code health: make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2793)

7 years agoCode health: Remove VAX exceptions in util/mkdef.pl
Richard Levitte [Tue, 28 Feb 2017 19:00:42 +0000 (20:00 +0100)]
Code health: Remove VAX exceptions in util/mkdef.pl

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2793)

7 years agoCode health: Remove unused VAX transfer vector for engines
Richard Levitte [Tue, 28 Feb 2017 18:57:33 +0000 (19:57 +0100)]
Code health: Remove unused VAX transfer vector for engines

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2793)

7 years agoExdata test was never enabled.
Rich Salz [Tue, 28 Feb 2017 15:53:28 +0000 (10:53 -0500)]
Exdata test was never enabled.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2787)

7 years agoRemove memcpy unrolling in bn_lib.c
Emilia Kasper [Tue, 28 Feb 2017 17:12:25 +0000 (18:12 +0100)]
Remove memcpy unrolling in bn_lib.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
7 years agoRemove support for HMAC_TEST_PRIVATE_KEY_FORMAT
Emilia Kasper [Tue, 28 Feb 2017 15:53:35 +0000 (16:53 +0100)]
Remove support for HMAC_TEST_PRIVATE_KEY_FORMAT

This is a bogus, undocumented format that was intended for testing; I
don't think anyone is using it.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoRemove GENCB_TEST compile flag
Rich Salz [Tue, 28 Feb 2017 17:08:54 +0000 (12:08 -0500)]
Remove GENCB_TEST compile flag

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2790)

7 years agoFix test_ssl_new when compiled with no-tls1_2 or no-dtls1_2
Matt Caswell [Tue, 28 Feb 2017 15:53:55 +0000 (15:53 +0000)]
Fix test_ssl_new when compiled with no-tls1_2 or no-dtls1_2

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2788)

7 years agoFix sslapitest when compiled with no-tls1_2
Matt Caswell [Tue, 28 Feb 2017 15:53:35 +0000 (15:53 +0000)]
Fix sslapitest when compiled with no-tls1_2

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2788)

7 years agoRevert rc4test removal, it performs additional tests not in evptests.txt
Dr. Stephen Henson [Tue, 28 Feb 2017 15:58:46 +0000 (15:58 +0000)]
Revert rc4test removal, it performs additional tests not in evptests.txt

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2789)

7 years agoRemove some commented out code in the tests
Matt Caswell [Tue, 28 Feb 2017 12:47:42 +0000 (12:47 +0000)]
Remove some commented out code in the tests

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2774)

7 years agoRemove some commented out code in libssl
Matt Caswell [Tue, 28 Feb 2017 12:47:22 +0000 (12:47 +0000)]
Remove some commented out code in libssl

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2774)

7 years agoRemove some commented out code in libcrypto
Matt Caswell [Tue, 28 Feb 2017 14:55:35 +0000 (14:55 +0000)]
Remove some commented out code in libcrypto

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2774)

7 years agoRemove some commented out code in the apps
Matt Caswell [Tue, 28 Feb 2017 12:46:56 +0000 (12:46 +0000)]
Remove some commented out code in the apps

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2774)

7 years agoRemove more redundant tests: md4, md5, rmd, rc4, p5_crpt2
Dr. Stephen Henson [Tue, 28 Feb 2017 15:11:48 +0000 (15:11 +0000)]
Remove more redundant tests: md4, md5, rmd, rc4, p5_crpt2

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2784)

7 years agoRemove a pointless "#ifndef" from bf_enc.c
Matt Caswell [Tue, 28 Feb 2017 15:14:04 +0000 (15:14 +0000)]
Remove a pointless "#ifndef" from bf_enc.c

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2778)

7 years agoRemove bf_cbc.c
Matt Caswell [Tue, 28 Feb 2017 13:31:41 +0000 (13:31 +0000)]
Remove bf_cbc.c

It is never built and the code is duplicated in bf_enc.c.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2778)

7 years agoUpdate year, wording tweak
Rich Salz [Mon, 27 Feb 2017 17:36:37 +0000 (12:36 -0500)]
Update year, wording tweak

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2755)

7 years agoRemove the file r160test.c
Matt Caswell [Tue, 28 Feb 2017 13:23:37 +0000 (13:23 +0000)]
Remove the file r160test.c

It is empty and is not compiled

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2777)

7 years agoRemove wp_test.c: exactly the same tests are in evptests.txt
Dr. Stephen Henson [Tue, 28 Feb 2017 14:18:27 +0000 (14:18 +0000)]
Remove wp_test.c: exactly the same tests are in evptests.txt

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2783)

7 years agoRemove dead code in bn
Matt Caswell [Tue, 28 Feb 2017 10:08:51 +0000 (10:08 +0000)]
Remove dead code in bn

There are a number of symbols in bn which are internal only and never used
by anything. They should be removed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2766)

7 years agoRemove some #if 0 code in ssl, crypto/bio
Todd Short [Tue, 28 Feb 2017 14:04:29 +0000 (09:04 -0500)]
Remove some #if 0 code in ssl, crypto/bio

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2781)

7 years agoCode health: Stop using timeb.h / ftime() (VMS only)
Richard Levitte [Tue, 28 Feb 2017 13:07:08 +0000 (14:07 +0100)]
Code health: Stop using timeb.h / ftime() (VMS only)

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2775)

7 years agoCode health: Remove obvious VAX C fixups
Richard Levitte [Tue, 28 Feb 2017 13:06:14 +0000 (14:06 +0100)]
Code health: Remove obvious VAX C fixups

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2775)

7 years agoMore Configure cleanup. Remove
Emilia Kasper [Tue, 28 Feb 2017 13:54:07 +0000 (14:54 +0100)]
More Configure cleanup. Remove
- util/incore
- util/fipslink.pl
- the unused "baseaddr" configure switch

Reviewed-by: Stephen Henson <steve@openssl.org>
7 years agoClean up references to FIPS
Emilia Kasper [Tue, 28 Feb 2017 11:30:28 +0000 (12:30 +0100)]
Clean up references to FIPS

This removes the fips configure option. This option is broken as the
required FIPS code is not available.

FIPS_mode() and FIPS_mode_set() are retained for compatibility, but
FIPS_mode() always returns 0, and FIPS_mode_set() can only be used to
turn FIPS mode off.

Reviewed-by: Stephen Henson <steve@openssl.org>
7 years agoRemove BN_DEBUG_TRIX
Emilia Kasper [Tue, 28 Feb 2017 12:25:06 +0000 (13:25 +0100)]
Remove BN_DEBUG_TRIX

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoRemove debugging leftovers in apps/opt.c
Emilia Kasper [Tue, 28 Feb 2017 10:47:10 +0000 (11:47 +0100)]
Remove debugging leftovers in apps/opt.c

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoAvoid buffer underflow in evp_test.
Pauli [Mon, 27 Feb 2017 04:26:16 +0000 (14:26 +1000)]
Avoid buffer underflow in evp_test.

The second loop in the remove_space function doesn't check for walking
back off of the start of the string while setting white space to 0.

This fix exits this loop once the pointer is before the (updated) beginning
of the string.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2752)

7 years agoRemove unnecessary memset after PR #2583 avoids accessing
Bernd Edlinger [Mon, 13 Feb 2017 12:21:34 +0000 (13:21 +0100)]
Remove unnecessary memset after PR #2583 avoids accessing
the uninitialized session_id now.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2608)

7 years agoMove the CHIL engine to demos/engines
Richard Levitte [Tue, 28 Feb 2017 13:47:55 +0000 (14:47 +0100)]
Move the CHIL engine to demos/engines

Moving out of the way, Makefile to be added

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2780)

7 years agoRemove some dead code from libssl
Matt Caswell [Tue, 28 Feb 2017 10:52:09 +0000 (10:52 +0000)]
Remove some dead code from libssl

There are a small number of functions in libssl that are internal only
and never used by anything.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2770)

7 years agoCode cleanup: remove the VMS specific reimplementation of gmtime
Richard Levitte [Tue, 28 Feb 2017 07:15:31 +0000 (08:15 +0100)]
Code cleanup: remove the VMS specific reimplementation of gmtime

This reimplementation was necessary before VMS C V7.1.  Since that's
the minimum version we support in this OpenSSL version, the
reimplementation is no longer needed.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2762)

7 years agoRemove dead code in crypto/pkcs7
Emilia Kasper [Tue, 28 Feb 2017 10:37:22 +0000 (11:37 +0100)]
Remove dead code in crypto/pkcs7

Reviewed-by: Stephen Henson <steve@openssl.org>
7 years agoRemove methtest.c
Emilia Kasper [Tue, 28 Feb 2017 10:33:38 +0000 (11:33 +0100)]
Remove methtest.c

This file tests code that doesn't exist.

Reviewed-by: Stephen Henson <steve@openssl.org>
7 years agoRemove ancient demoCA directory
Dr. Stephen Henson [Tue, 28 Feb 2017 05:17:11 +0000 (05:17 +0000)]
Remove ancient demoCA directory

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2760)

7 years agoRenumber to avoid a error code clash
Richard Levitte [Mon, 27 Feb 2017 22:34:29 +0000 (23:34 +0100)]
Renumber to avoid a error code clash

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2758)

7 years agoTrace support for TLS 1.3 certificate request message
Dr. Stephen Henson [Wed, 22 Feb 2017 17:26:04 +0000 (17:26 +0000)]
Trace support for TLS 1.3 certificate request message

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2728)

7 years agoInitial incomplete TLS 1.3 certificate request support.
Dr. Stephen Henson [Wed, 22 Feb 2017 17:26:44 +0000 (17:26 +0000)]
Initial incomplete TLS 1.3 certificate request support.

This adds partial support for TLS 1.3 certificate request message.

The request context and extensions are currently ignored on receive
and set to zero length on send.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2728)

7 years agoAdjust the default value of the private key size
Adrian Vollmer [Mon, 27 Feb 2017 14:51:21 +0000 (15:51 +0100)]
Adjust the default value of the private key size

...in the man page to reflect the actual default (2048 instead of 512)

CLA: trivial
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2754)

7 years agopoly1305/asm/poly1305-x86_64.pl: minor AVX512 optimization.
Andy Polyakov [Sat, 25 Feb 2017 17:37:24 +0000 (18:37 +0100)]
poly1305/asm/poly1305-x86_64.pl: minor AVX512 optimization.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agocrypto/x86_64cpuid.pl: add CFI annotations.
Andy Polyakov [Sat, 25 Feb 2017 21:17:21 +0000 (22:17 +0100)]
crypto/x86_64cpuid.pl: add CFI annotations.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agowhrlpool/asm/wp-x86_64.pl: add CFI annotations.
Andy Polyakov [Sat, 25 Feb 2017 21:16:57 +0000 (22:16 +0100)]
whrlpool/asm/wp-x86_64.pl: add CFI annotations.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agocamellia/asm/cmll-x86_64.pl: add CFI annotations.
Andy Polyakov [Sat, 25 Feb 2017 21:16:38 +0000 (22:16 +0100)]
camellia/asm/cmll-x86_64.pl: add CFI annotations.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agopoly1305/asm/poly1305-x86_64.pl: add CFI annotations.
Andy Polyakov [Sat, 25 Feb 2017 18:37:02 +0000 (19:37 +0100)]
poly1305/asm/poly1305-x86_64.pl: add CFI annotations.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agochacha/asm/chacha-x86_64.pl: add CFI annotations.
Andy Polyakov [Sat, 25 Feb 2017 18:36:43 +0000 (19:36 +0100)]
chacha/asm/chacha-x86_64.pl: add CFI annotations.

Reviewed-by: Rich Salz <rsalz@openssl.org>