oweals/openssl.git
7 years agoapps/passwd.c: 32 bits are sufficient to hold ROUNDS_MAX.
Andy Polyakov [Sun, 26 Mar 2017 20:38:05 +0000 (22:38 +0200)]
apps/passwd.c: 32 bits are sufficient to hold ROUNDS_MAX.

Even though C standard defines 'z' modifier, recent mingw compilers break
the contract by defining __STDC_VERSION__ with non-compliant MSVCRT.DLL.
In other words we can't use %zu with mingw, but insteadl of cooking

Reviewed-by: Tim Hudson <tjh@openssl.org>
7 years agoIn err_cleanup(), cleanup the thread local storage too
Richard Levitte [Sun, 26 Mar 2017 18:01:44 +0000 (20:01 +0200)]
In err_cleanup(), cleanup the thread local storage too

Fixes #3033

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3035)

7 years agoaes/asm/bsaes-armv7.pl: relax stack alignment requirement.
Andy Polyakov [Sat, 25 Mar 2017 09:58:57 +0000 (10:58 +0100)]
aes/asm/bsaes-armv7.pl: relax stack alignment requirement.

Even though Apple refers to Procedure Call Standard for ARM Architecture
(AAPCS), they apparently adhere to custom version that doesn't follow
stack alignment constraints in the said standard. [Why or why? If it's
vendor lock-in thing, then it would be like worst spot ever.] And since
bsaes-armv7 relied on standard alignment, it became problematic to
execute the code on iOS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoengines/e_capi.c: formatting and styling fixes.
Andy Polyakov [Fri, 24 Mar 2017 15:00:31 +0000 (16:00 +0100)]
engines/e_capi.c: formatting and styling fixes.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoDon't access memory before checking the correct length in aesni_cbc_hmac_sha256_ctrl...
Bernd Edlinger [Fri, 24 Mar 2017 08:03:54 +0000 (09:03 +0100)]
Don't access memory before checking the correct length in aesni_cbc_hmac_sha256_ctrl in case EVP_CTRL_AEAD_TLS1_AAD.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3023)

7 years agoMove the downgrade sentinel declarations to a header file
Matt Caswell [Fri, 24 Mar 2017 09:57:21 +0000 (09:57 +0000)]
Move the downgrade sentinel declarations to a header file

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3022)

7 years agoAdd a test for the TLSv1.3 downgrade mechanism
Matt Caswell [Thu, 23 Mar 2017 16:33:57 +0000 (16:33 +0000)]
Add a test for the TLSv1.3 downgrade mechanism

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3022)

7 years agoMake the TLSv1.3 downgrade mechanism a configurable option
Matt Caswell [Wed, 22 Mar 2017 11:52:45 +0000 (11:52 +0000)]
Make the TLSv1.3 downgrade mechanism a configurable option

Make it disabled by default. When TLSv1.3 is out of draft we can remove
this option and have it enabled all the time.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3022)

7 years agoAdd client side support for TLSv1.3 downgrade mechanism
Matt Caswell [Wed, 22 Mar 2017 11:50:32 +0000 (11:50 +0000)]
Add client side support for TLSv1.3 downgrade mechanism

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3022)

7 years agoAdd server side support for TLSv1.3 downgrade mechanism
Matt Caswell [Wed, 22 Mar 2017 08:52:54 +0000 (08:52 +0000)]
Add server side support for TLSv1.3 downgrade mechanism

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3022)

7 years ago"any" instead of "and"
Zack Williams [Sat, 18 Mar 2017 01:43:53 +0000 (18:43 -0700)]
"any" instead of "and"

The "and" should be an "any"

Fixed in LibreSSL's docs: http://man.openbsd.org/man5/x509v3.cnf.5#Subject_alternative_name

CLA: trivial

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2980)

7 years agoFix function documentation
Ian Spence [Fri, 17 Mar 2017 02:06:52 +0000 (19:06 -0700)]
Fix function documentation

CLA: trivial

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2972)

7 years agobn/asm/sparcv9-mont.pl: fix squaring code path.
Andy Polyakov [Wed, 22 Mar 2017 09:51:25 +0000 (10:51 +0100)]
bn/asm/sparcv9-mont.pl: fix squaring code path.

This module is used only with odd input lengths, i.e. not used in normal
PKI cases, on contemporary processors. The problem was "illuminated" by
fuzzing tests.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoLook for comma before - in POD pages
Rich Salz [Thu, 23 Mar 2017 17:04:52 +0000 (13:04 -0400)]
Look for comma before - in POD pages

[skip ci]

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3021)

7 years agoFix find-doc-nits: { is significant in regexps
Richard Levitte [Thu, 23 Mar 2017 14:09:41 +0000 (15:09 +0100)]
Fix find-doc-nits: { is significant in regexps

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3019)

7 years agoFix 80-test_ssl_old.t: only count the ciphers if there are any.
Richard Levitte [Wed, 22 Mar 2017 10:06:20 +0000 (11:06 +0100)]
Fix 80-test_ssl_old.t: only count the ciphers if there are any.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3014)

7 years agomodes/ocb128.c: fix misaligned access in ILP32 builds on 64-bit processors.
Andy Polyakov [Mon, 20 Mar 2017 11:47:08 +0000 (12:47 +0100)]
modes/ocb128.c: fix misaligned access in ILP32 builds on 64-bit processors.

One could have fixed the problem by arranging 64-bit alignment of
EVP_AES_OCB_CTX.aad_buf in evp/e_aes.c, but CRYPTO_ocb128_aad
prototype doesn't imply alignment and we have to honour it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2994)

7 years agoaes/asm/aesni-sha*-x86_64.pl: fix IV handling in SHAEXT paths.
Andy Polyakov [Mon, 20 Mar 2017 10:38:25 +0000 (11:38 +0100)]
aes/asm/aesni-sha*-x86_64.pl: fix IV handling in SHAEXT paths.

Initial IV was disregarded on SHAEXT-capable processors. Amazingly
enough bulk AES128-SHA* talk-to-yourself tests were passing.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2992)

7 years agopoly1305/asm/poly1305-x86_64.pl: add poly1305_blocks_vpmadd52_8x.
Andy Polyakov [Sat, 18 Mar 2017 10:08:42 +0000 (11:08 +0100)]
poly1305/asm/poly1305-x86_64.pl: add poly1305_blocks_vpmadd52_8x.

As hinted by its name new subroutine processes 8 input blocks in
parallel by loading data to 512-bit registers. It still needs more
work, as it needs to handle some specific input lengths better.
In this sense it's yet another intermediate step...

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agox86_64 assembly pack: add some Ryzen performance results.
Andy Polyakov [Sat, 18 Mar 2017 08:59:01 +0000 (09:59 +0100)]
x86_64 assembly pack: add some Ryzen performance results.

Reviewed-by: Tim Hudson <tjh@openssl.org>
7 years agoChange exit_checker comment on returned status
Richard Levitte [Wed, 22 Mar 2017 07:49:57 +0000 (08:49 +0100)]
Change exit_checker comment on returned status

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3012)

7 years agoRefuse to run the PYCA external test if configured 'no-shared'
Richard Levitte [Tue, 21 Mar 2017 14:59:12 +0000 (15:59 +0100)]
Refuse to run the PYCA external test if configured 'no-shared'

[extended tests]

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3007)

7 years agoTravis: make a separate job for external tests
Richard Levitte [Tue, 21 Mar 2017 14:57:03 +0000 (15:57 +0100)]
Travis: make a separate job for external tests

Some of the external tests do not run well with 'no-shared'

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3007)

7 years ago95-test_external_pyca_data/cryptography.py: only install for testing
Richard Levitte [Tue, 21 Mar 2017 12:48:13 +0000 (13:48 +0100)]
95-test_external_pyca_data/cryptography.py: only install for testing

Also, be less silent when installing, so possible errors are shown.

[extended tests]

Fixes #3005

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3007)

7 years agoAdapt 20-test_enc.t and 20-test_enc_more.t to use statusvar
Richard Levitte [Tue, 21 Mar 2017 10:26:28 +0000 (11:26 +0100)]
Adapt 20-test_enc.t and 20-test_enc_more.t to use statusvar

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3004)

7 years agoAdapt 80-test_ssl_old.t to use statusvar
Richard Levitte [Tue, 21 Mar 2017 09:58:46 +0000 (10:58 +0100)]
Adapt 80-test_ssl_old.t to use statusvar

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3004)

7 years agoOpenSSL::Test: add a statusvar option for run with capture => 1
Richard Levitte [Tue, 21 Mar 2017 09:53:56 +0000 (10:53 +0100)]
OpenSSL::Test: add a statusvar option for run with capture => 1

When using run() with capture => 1, there was no way to find out if
the command was successful or not.  This change adds a statusvar
option, that must refer to a scalar variable, for example:

    my $status = undef;
    my @line = run(["whatever"], capture => 1, statusvar => \$status);

$status will be 1 if the command "whatever" was successful, 0
otherwise.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3004)

7 years agoRemove duplicate X509_OBJECT free function.
David Benjamin [Tue, 21 Mar 2017 04:27:35 +0000 (00:27 -0400)]
Remove duplicate X509_OBJECT free function.

These two functions do the same thing.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3001)

7 years agoAdd a test for resumption after HRR
Matt Caswell [Mon, 20 Mar 2017 18:21:54 +0000 (18:21 +0000)]
Add a test for resumption after HRR

Make sure we actually test resumption where an HRR has occurred.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2996)

7 years agoFix resumption after HRR
Matt Caswell [Mon, 20 Mar 2017 18:03:34 +0000 (18:03 +0000)]
Fix resumption after HRR

Commit 6b1bb98fa moved the processing of ClientHello extensions into the
state machine post-processing stage. After processing s->init_num is reset
to 0, so by post-processing we cannot rely on its value. Unfortunately we
were using it to handle the PSK extension. This causes the handshake to
fail.

We were using init_num to figure out the length of ClientHello2 so we can
remove it from the handshake_buffer. The handshake_buffer holds the
transcript of all the messages sent so far. For PSK processing though we
only want to add in a partial ClientHello2. This commit changes things so
we just work out where ClientHello2 starts, working forward from the
beginning of handshake_buffer.

Fixes #2983

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2996)

7 years agoRework how protocol specific ciphers in 80-test_ssl_old.t are picked out
Richard Levitte [Wed, 15 Mar 2017 01:40:55 +0000 (02:40 +0100)]
Rework how protocol specific ciphers in 80-test_ssl_old.t are picked out

The code to do this incorrectly assumed that the protocol version
could be used as a valid cipher suite  for the 'openssl cipher'
command.  While this is true in some cases, that isn't something to be
trusted.  Replace that assumption with code that takes the full
'openssl ciphers' command output and parses it to find the ciphers we
look for.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2956)

7 years agoFix decoding of ASN.1 LONG and ZLONG items
Richard Levitte [Mon, 20 Mar 2017 20:31:02 +0000 (21:31 +0100)]
Fix decoding of ASN.1 LONG and ZLONG items

LONG and ZLONG items (which are OpenSSL private special cases of
ASN1_INTEGER) are encoded into DER with padding if the leading octet
has the high bit set, where the padding can be 0x00 (for positive
numbers) or 0xff (for negative ones).

When decoding DER to LONG or ZLONG, the padding wasn't taken in
account at all, which means that if the encoded size with padding
is one byte more than the size of long, decoding fails.  This change
fixes that issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3000)

7 years agoDocument BIO_printf family
Rich Salz [Mon, 20 Mar 2017 20:25:22 +0000 (16:25 -0400)]
Document BIO_printf family

Also fix an error in UI_STRING (typo; wrong case).

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2999)

7 years agoFix docs for X509_CRL_get0_by_serial() and X509_CRL_get0_by_cert()
Richard Levitte [Mon, 20 Mar 2017 11:29:37 +0000 (12:29 +0100)]
Fix docs for X509_CRL_get0_by_serial() and X509_CRL_get0_by_cert()

They both return 2 when the revoked entry that's found has the reason
removeFromCRL.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2993)

7 years agoFix the error handling in CRYPTO_dup_ex_data.
Bernd Edlinger [Sun, 19 Mar 2017 15:14:33 +0000 (16:14 +0100)]
Fix the error handling in CRYPTO_dup_ex_data.
Fix a strict aliasing issue in ui_dup_method_data.
Add test coverage for CRYPTO_dup_ex_data, use OPENSSL_assert.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2988)

7 years agoFix a few internals tests
Richard Levitte [Mon, 20 Mar 2017 10:24:33 +0000 (11:24 +0100)]
Fix a few internals tests

The internals tests for chacha, poly1305 and siphash were erroneously
made conditional on if mdc2 was enabled.  Corrected to depend on the
correct algorithms being enabled instead.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2991)

7 years agoImprove testing of elliptic curve validation
Richard Levitte [Thu, 2 Feb 2017 23:31:09 +0000 (00:31 +0100)]
Improve testing of elliptic curve validation

Add a test recipe (test/recipes/15-test_ecparams.t) which uses 'openssl
ecparam' to check the test vectors.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2544)

7 years agoImprove testing of elliptic curve validation
Joseph Birr-Pixton [Thu, 2 Feb 2017 23:29:49 +0000 (00:29 +0100)]
Improve testing of elliptic curve validation

This involves:

- A directory of valid and invalid PEM-encoded curves.
  This is non-exhaustive and can be added to.
- A minor patch to 'openssl ecparam' to make it exit non-zero
  when curve validation fails.

- A test recipe is added in a separate commit.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2544)

7 years agoUpdate test vectors in tls13secretstest
Joseph Birr-Pixton [Sun, 19 Mar 2017 17:20:05 +0000 (17:20 +0000)]
Update test vectors in tls13secretstest

These were still generated by openssl, but with
the previous commit are corroborated by rustls.

(cherry picked from commit eae1982619e90c6b79a6ebc89603d81c13c81ce8)

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2989)

7 years agoTLS1.3: Correct intermediate secret derivation
Joseph Birr-Pixton [Sun, 19 Mar 2017 16:40:14 +0000 (16:40 +0000)]
TLS1.3: Correct intermediate secret derivation

This label for this derivation was incorrectly "derived" or "der" depending
on the pointer size of the build(!). The correct string is "derived secret".

(cherry picked from commit 936dcf272033c1bf59a5e859ec63e2557194f191)

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2989)

7 years agoUse memcmp() instead of CRYPTO_memcmp() when fuzzing
Kurt Roeckx [Tue, 14 Feb 2017 23:36:46 +0000 (00:36 +0100)]
Use memcmp() instead of CRYPTO_memcmp() when fuzzing

Reviewed-by: Andy Polyakov <appro@openssl.org>
GH: #2633

7 years agoMake the CRYPTO_memcmp() prototype match memcmp()
Kurt Roeckx [Tue, 21 Feb 2017 21:20:34 +0000 (22:20 +0100)]
Make the CRYPTO_memcmp() prototype match memcmp()

Reviewed-by: Andy Polyakov <appro@openssl.org>
GH: #2633

7 years agodoc: fix -keylogfile option
Peter Wu [Fri, 17 Mar 2017 18:17:57 +0000 (19:17 +0100)]
doc: fix -keylogfile option

Add it in the options section, not the "Connected commands" section.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2977)

7 years agoImplement certificate_authorities extension
Dr. Stephen Henson [Fri, 10 Mar 2017 16:31:20 +0000 (16:31 +0000)]
Implement certificate_authorities extension

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2918)

7 years agoSupport draft-19 TLS certificate request format
Dr. Stephen Henson [Mon, 13 Mar 2017 13:29:34 +0000 (13:29 +0000)]
Support draft-19 TLS certificate request format

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2918)

7 years agoAllow signature algorithms in TLS 1.3 certificate request extensions.
Dr. Stephen Henson [Mon, 13 Mar 2017 13:27:18 +0000 (13:27 +0000)]
Allow signature algorithms in TLS 1.3 certificate request extensions.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2918)

7 years agoMove parsing and construction of CA names to separate functions
Dr. Stephen Henson [Wed, 8 Mar 2017 18:17:17 +0000 (18:17 +0000)]
Move parsing and construction of CA names to separate functions

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2918)

7 years agoFixed PKCS5_PBKDF2_HMAC() to adhere to the documentation.
Péter Budai [Tue, 11 Oct 2016 17:26:23 +0000 (19:26 +0200)]
Fixed PKCS5_PBKDF2_HMAC() to adhere to the documentation.

The documentation of this function states that the password parameter
can be NULL. However, the implementation returns an error in this case
due to the inner workings of the HMAC_Init_ex() function.
With this change, NULL password will be treated as an empty string and
PKCS5_PBKDF2_HMAC() no longer fails on this input.

I have also added two new test cases that tests the handling of the
special values NULL and -1 of the password and passlen parameters,
respectively.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1692)

7 years agoFix no-dtls builds
Matt Caswell [Fri, 17 Mar 2017 10:21:25 +0000 (10:21 +0000)]
Fix no-dtls builds

Commits f2ff1432f in master and 14d4d7eda in 1.1.0 broke the no-dtls build
by moving the position of a "#endif" for OPENSSL_NO_DTLS in a change
which is otherwise unrelated to DTLS. This puts it back to where it was.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2974)

7 years agoFix some undefined behaviour in stack test
Matt Caswell [Thu, 16 Mar 2017 17:32:32 +0000 (17:32 +0000)]
Fix some undefined behaviour in stack test

At one point the stack was passing a pointer of the element *before* an
array which is undefined.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2971)

7 years agoAdd unit tests for the lhash functionality.
Pauli [Thu, 16 Mar 2017 05:00:23 +0000 (15:00 +1000)]
Add unit tests for the lhash functionality.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2965)

7 years agoAdd Client CA names tests
Dr. Stephen Henson [Wed, 15 Mar 2017 17:26:05 +0000 (17:26 +0000)]
Add Client CA names tests

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2969)

7 years agoAdd ExpectedClientCANames
Dr. Stephen Henson [Wed, 15 Mar 2017 16:07:07 +0000 (16:07 +0000)]
Add ExpectedClientCANames

Add ExpectedClientCANames: for client auth this checks to see if the
list of certificate authorities supplied by the server matches the
expected value.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2969)

7 years agoRemove obsolete version test when returning CA names.
Dr. Stephen Henson [Thu, 16 Mar 2017 15:28:07 +0000 (15:28 +0000)]
Remove obsolete version test when returning CA names.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2969)

7 years agoAdd TLSv1.3 draft-19 messages to trace
Todd Short [Thu, 16 Mar 2017 16:56:01 +0000 (12:56 -0400)]
Add TLSv1.3 draft-19 messages to trace

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2970)

7 years agoHandle TLSv1.3 being disabled in clienthello test
Matt Caswell [Thu, 16 Mar 2017 15:09:59 +0000 (15:09 +0000)]
Handle TLSv1.3 being disabled in clienthello test

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2968)

7 years agoAdd tests for the padding extension
Matt Caswell [Thu, 16 Mar 2017 12:11:23 +0000 (12:11 +0000)]
Add tests for the padding extension

Check that the padding extension pads correctly for various scenarios.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2968)

7 years agoFix the Padding extension
Matt Caswell [Thu, 16 Mar 2017 10:18:39 +0000 (10:18 +0000)]
Fix the Padding extension

In OpenSSL 1.1.0 the padding extension MUST be last because it calculates
the length of everything that has been written into the ClientHello to
determine whether it needs to be padded or not. With TLSv1.3 that isn't
possible because the specification requires that the PSK extension is last.
Therefore we need to fix the padding extension to take account of any PSK
extension that will be later added.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2968)

7 years agoUpdates following review feedback
Matt Caswell [Thu, 16 Mar 2017 14:06:00 +0000 (14:06 +0000)]
Updates following review feedback

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoAdd some HRR tests
Matt Caswell [Wed, 15 Mar 2017 20:35:23 +0000 (20:35 +0000)]
Add some HRR tests

Check that we handle changes of ciphersuite between HRR and ServerHello
correctly.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoAdd some more PSK tests
Matt Caswell [Wed, 15 Mar 2017 18:44:05 +0000 (18:44 +0000)]
Add some more PSK tests

Test that if the server selects a ciphersuite with a different hash from
the PSK in the original ClientHello, the second ClientHello does not
contain the PSK.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoFix ciphersuite handling during an HRR
Matt Caswell [Wed, 15 Mar 2017 18:41:50 +0000 (18:41 +0000)]
Fix ciphersuite handling during an HRR

Choose a new ciphersuite for the HRR. Don't just use the one from the
session.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoEnsure after an HRR any PSKs have the right hash
Matt Caswell [Mon, 13 Mar 2017 16:09:47 +0000 (16:09 +0000)]
Ensure after an HRR any PSKs have the right hash

Don't include a PSK that does not have the right hash for the selected
ciphersuite following an HRR.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoHelloRetryRequest updates for draft-19
Matt Caswell [Mon, 13 Mar 2017 15:21:15 +0000 (15:21 +0000)]
HelloRetryRequest updates for draft-19

Draft-19 changes the HRR transcript hash so that the initial ClientHello
is replaced in the transcript with a special synthetic message_hash message
that just contains a hash of ClientHello1 as its message body.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoCheck ClientHello boundary as per draft-19
Matt Caswell [Thu, 9 Mar 2017 22:58:05 +0000 (22:58 +0000)]
Check ClientHello boundary as per draft-19

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoMerge early_data_info extension into early_data
Matt Caswell [Thu, 9 Mar 2017 15:31:55 +0000 (15:31 +0000)]
Merge early_data_info extension into early_data

As per draft-19

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoUpdate end of early data processing for draft-19
Matt Caswell [Thu, 9 Mar 2017 15:03:07 +0000 (15:03 +0000)]
Update end of early data processing for draft-19

The end of early data is now indicated by a new handshake message rather
than an alert.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoUpdate the TLSv1.3 secrets test vectors for draft-19
Matt Caswell [Wed, 8 Mar 2017 14:29:14 +0000 (14:29 +0000)]
Update the TLSv1.3 secrets test vectors for draft-19

These are self-generated test vectors which gives us very little
confidence that we've got the implementation right. However until
we can get vectors from somewhere else (or ideally official vectors)
this is all we've got. At least it will tell us if we accidentally
break something at some point in the future.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoUpdate secret generation for draft-19
Matt Caswell [Wed, 8 Mar 2017 13:57:17 +0000 (13:57 +0000)]
Update secret generation for draft-19

TLSv1.3 draft 19 introduces a new pre HKDF-extract Derive-Secret stage.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoUpdate the TLSv1.3 version indicator for draft-19
Matt Caswell [Wed, 8 Mar 2017 11:48:43 +0000 (11:48 +0000)]
Update the TLSv1.3 version indicator for draft-19

This change will mean we will lose interoperability with draft-18
implementations.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)

7 years agoFix typo in ASYNC_WAIT_CTX_new.pod doc
Paul Yang [Thu, 16 Mar 2017 08:58:30 +0000 (16:58 +0800)]
Fix typo in ASYNC_WAIT_CTX_new.pod doc

For the function that get the changed fds, it should be
'ASYNC_WAIT_CTX_get_changed_fds()' instead of 'ASYNC_WAIT_CTX_fds_have_changed()'.

CLA: trivial

Signed-off-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2966)

7 years agoSimplify code around next_proto.len by changing 'len' data type.
FdaSilvaYY [Mon, 5 Dec 2016 23:42:01 +0000 (00:42 +0100)]
Simplify code around next_proto.len by changing 'len' data type.

clean an useless static qualifier and a dead comment.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2278)

7 years agoRemove documentation of deleted function
Benjamin Kaduk [Tue, 28 Feb 2017 22:39:01 +0000 (16:39 -0600)]
Remove documentation of deleted function

It's even removing a BUGS entry!

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2797)

7 years agoRemove unused typedefs from indent config
Benjamin Kaduk [Tue, 28 Feb 2017 22:00:23 +0000 (16:00 -0600)]
Remove unused typedefs from indent config

Some things were not removed from util/indent.pro when they were removed
from the code.

grep '^-T' util/indent.pro | awk '{print $2} > /tmp/a
grep -rF -f /tmp/a --exclude CHANGES --exclude 'INSTALL' --exclude 'LICENSE' --exclude 'NEWS' --exclude 'NOTES*' --exclude 'README*' --exclude indent.pro --exclude-dir corpora -o -h *|sort|uniq>/tmp/b
comm -23 <(sort /tmp/a) /tmp/b >/tmp/c
grep -v -E '(LHASH_OF|STACK_OF)' /tmp/c > /tmp/d
grep -v -Ff /tmp/d util/indent.pro > util/indent.pro

Manually adjusted to retain time_t and the ossl_*intmax_t types.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2797)

7 years agoRemove some unused PEM structures
Benjamin Kaduk [Tue, 28 Feb 2017 21:51:38 +0000 (15:51 -0600)]
Remove some unused PEM structures

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2797)

7 years agoRename the test_stack recipe file name to be consistent with the rest of the
Pauli [Thu, 16 Mar 2017 04:16:00 +0000 (14:16 +1000)]
Rename the test_stack recipe file name to be consistent with the rest of the
tests.

[skip ci]

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2964)

7 years agoFixed a crash in print_notice.
Bernd Edlinger [Tue, 14 Mar 2017 14:10:52 +0000 (15:10 +0100)]
Fixed a crash in print_notice.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2935)

7 years agoRemove dead code
Benjamin Kaduk [Tue, 14 Mar 2017 22:53:46 +0000 (17:53 -0500)]
Remove dead code

tls1_get_curvelist() does not read from its third parameter, so
the assignments prior to function call were dead code and can be removed.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2952)

7 years agoTighten up client status_request processing
Benjamin Kaduk [Tue, 14 Mar 2017 23:57:43 +0000 (18:57 -0500)]
Tighten up client status_request processing

Instead of making a positive comparison against the invalid value
that our server would send, make a negative check against the only
value that is not an error.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2953)

7 years agoForgotten 'make update'
Richard Levitte [Wed, 15 Mar 2017 20:20:11 +0000 (21:20 +0100)]
Forgotten 'make update'

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoVMS: turning off CALL_DEBUG isn't possible on Alpha
Richard Levitte [Wed, 15 Mar 2017 16:10:48 +0000 (17:10 +0100)]
VMS: turning off CALL_DEBUG isn't possible on Alpha

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2962)

7 years agoAdd EC_KEY_get0_engine()
Richard Levitte [Wed, 15 Mar 2017 13:11:34 +0000 (14:11 +0100)]
Add EC_KEY_get0_engine()

Just as for DH, DSA and RSA, this gives the engine associated with the
key.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2960)

7 years agoRewrite the documentation for sk_TYPE_find() and sk_TYPE_find_ex() to better
Pauli [Wed, 15 Mar 2017 04:29:08 +0000 (14:29 +1000)]
Rewrite the documentation for sk_TYPE_find() and sk_TYPE_find_ex() to better
describe the vagaries in their behaviour.

[skip ci]

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2958)

7 years agoUnit tests for crypto/stack.
Pauli [Tue, 14 Mar 2017 02:37:26 +0000 (12:37 +1000)]
Unit tests for crypto/stack.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2924)

7 years agoFix a hang in tests that use sessionfile
Matt Caswell [Wed, 15 Mar 2017 00:54:04 +0000 (00:54 +0000)]
Fix a hang in tests that use sessionfile

The logic for testing whether the sessionfile has been created or not
was faulty and could result in race conditions. If you "lose" the tests
hang waiting for a session file that's never going to arrive.

Fixes #2950

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2955)

7 years agoNOTES.WIN: mention Strawberry Perl as option.
Andy Polyakov [Tue, 14 Mar 2017 20:29:24 +0000 (21:29 +0100)]
NOTES.WIN: mention Strawberry Perl as option.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agotest/recipes/03-test_internal_*: call setup() first.
Andy Polyakov [Tue, 14 Mar 2017 14:23:39 +0000 (15:23 +0100)]
test/recipes/03-test_internal_*: call setup() first.

Strawberry Perl bailed out running test\run_tests.pl insisting on
setup() being called explicitly.

Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoClear alpn_selected_len for clients, too
Benjamin Kaduk [Wed, 15 Mar 2017 00:17:15 +0000 (19:17 -0500)]
Clear alpn_selected_len for clients, too

Zero out the length alongside the NULLing of the pointer, to
bring parity between the selected and proposed fields..

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2954)

7 years agoVMS: don't use /DSF, turn off CALL_DEBUG instead
Richard Levitte [Wed, 15 Mar 2017 01:52:20 +0000 (02:52 +0100)]
VMS: don't use /DSF, turn off CALL_DEBUG instead

It turns out that /DSF didn't do any good for our purposes.  Instead,
remove the CALL_DEBUG flag from any image we link.  This ensures that
we can have debugging information in the image files, but don't
automatically end up in a debugging session upon image activation.

Unfortunately, this means the CALL_DEBUG must be turned on when there
is a need to run with the debugger activated, and to turn it off when
done.  This has been documented in NOTES.VMS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2957)

7 years agoAdd Python Cryptography.io external test suite
Jon Spillett [Thu, 9 Mar 2017 00:50:55 +0000 (10:50 +1000)]
Add Python Cryptography.io external test suite

Add python cryptography testing instructions too

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2885)

7 years agoAdd additional RSA-PSS and RSA-OAEP tests.
Dr. Stephen Henson [Tue, 14 Mar 2017 19:02:10 +0000 (19:02 +0000)]
Add additional RSA-PSS and RSA-OAEP tests.

Import test data from:
ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip

This is a set of RSA-PSS and RSA-OAEP test vectors including some edge cases
with unusual key sizes.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2944)

7 years agoRe-enable some BoringSSL tests
Matt Caswell [Tue, 14 Mar 2017 17:29:11 +0000 (17:29 +0000)]
Re-enable some BoringSSL tests

The previous 2 commits fixed some issues in the Boring tests. This
re-enables those tests.

[extended tests]

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2942)

7 years agoSSL_get_peer_cert_chain() does not work after a resumption
Matt Caswell [Tue, 14 Mar 2017 17:27:46 +0000 (17:27 +0000)]
SSL_get_peer_cert_chain() does not work after a resumption

After a resumption it is documented that SSL_get_peer_cert_chain() will
return NULL. In BoringSSL it still returns the chain. We don't support that
so we should update the shim to call SSL_get_peer_certificate() instead
when checking whether a peer certificate is available.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2942)

7 years agoEnsure we set the session id context in ossl_shim
Matt Caswell [Tue, 14 Mar 2017 17:26:46 +0000 (17:26 +0000)]
Ensure we set the session id context in ossl_shim

OpenSSL requires that we set the session id context. BoringSSL apparently
does not require this, so wasn't setting it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2942)

7 years agoDe-obfuscate
Benjamin Kaduk [Tue, 14 Mar 2017 22:14:30 +0000 (17:14 -0500)]
De-obfuscate

No need to break out of the loop and repeat the loop termination
condition when we can just return.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2949)

7 years agoVMS: throw away [.util]shareable_image_wrap.c.in and add replacement scripts
Richard Levitte [Tue, 14 Mar 2017 21:09:57 +0000 (22:09 +0100)]
VMS: throw away [.util]shareable_image_wrap.c.in and add replacement scripts

[.util]shareable_image_wrap.c.in was never useful because lib$spawn()
insisted on combining stdout and stderr into one.

Instead, we introduce two scripts that create and destroy a temporary
environment where the local shareable images become available,
[.util]local_shlib.com and [.util]unlocal_shlib.com.  They also define
DBG$IMAGE_DSF_PATH, which is require so the debugger can find the Debug
Symbol Files.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2947)

7 years agoVMS: Change debug linking method to generate a separate Debug Symbol File
Richard Levitte [Tue, 14 Mar 2017 21:00:13 +0000 (22:00 +0100)]
VMS: Change debug linking method to generate a separate Debug Symbol File

That makes it possible to run images without automagically ending up
in a debug session, while still being able to debug when required.

All .DSF files must reside in the same directory to be useful.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2947)

7 years ago.travis.yml: make git submodule update conditional.
Andy Polyakov [Mon, 13 Mar 2017 11:13:07 +0000 (12:13 +0100)]
.travis.yml: make git submodule update conditional.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
7 years agoAdd test for -nameout output
Rich Salz [Tue, 14 Mar 2017 18:53:35 +0000 (14:53 -0400)]
Add test for -nameout output

Using a cert with Cyrillic characters, kindly supplied by Dmitry Belyavsky

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2943)

7 years agoUpdate master Travis to Trusty
Emilia Kasper [Tue, 14 Mar 2017 15:40:34 +0000 (16:40 +0100)]
Update master Travis to Trusty

This gets us a newer Clang, and newer Go.
1.1.0 already runs on Trusty without issues.

To do this, we need to disable afalgeng in the -Werror build.

afalgeng isn't compatible with the -Werror build on
Travis Trusty due to kernel header mismatch.

(See also 97043e46aa7083c787a1efd72ac31ca97ed41610)

Reviewed-by: Richard Levitte <levitte@openssl.org>