Add X25519 code from BoringSSL.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

TLS support for X25519

Add X25519 to TLS supported curve list.
Reject attempts to configure keys which cannot be used
for signing.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

add ecdhx25519 option to speed

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

skip inappropriate X25519 tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add X25519 test vectors from RFC7748 6.1
Check sign/verify blocked with X25519

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add X25519 curve to list

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add no signing flag.

Add a flag to EC_METHOD for curves which do not support signing.
New function EC_KEY_can_sign() returns 1 is key can be used for signing.
Return an explicit error is an attempt is made to sign with
no signing curves.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add new EC_METHOD for X25519.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add group_order_bits to EC_METHOD.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add custom_data field for EC_POINT, EC_KEY.

In some cases the EC_POINT and EC_KEY BIGNUM components are suboptimal
or inappropriate. Add an "custom_data" field which curves can populate with
a custom structure to suit their needs.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Extract compression form in EC_KEY_oct2key().

Extract compression form in EC_KEY_oct2key() instead of manually in the
ASN.1 code. For custom curves do not assume the initial octet is the
compression form: it isn't for X25519 et al.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Extended EC_METHOD customisation support.

Add support for optional overrides of various private key operations
in EC_METHOD.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

EC_METHOD customisation operations.

Extend EC_METHOD to permit additional customisation of private key and
ECDH operations.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Rename OIDs.

Use standard X25519 and X448 names for OIDs. Delete EdDSA OIDs: for now they
wont be used and EdDSA may use a different format.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

GH715: Missed some null-check-removals. follow commits 412bafdcf5, and 7c96dbcdab

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix mk1mf build

Removing certs broke the mk1mf build.

Reviewed-by: Richard Levitte <levitte@openssl.org>

GH715: Missed some null-check-removals.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT4351: Update doc for OPENSSL_cleanse

Reviewed-by: Richard Levitte <levitte@openssl.org>

VMS - don't exit out of a MMS recipe

Exiting out of a recipe more than necessary leaves an ugly message.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Make generation of dependency files more efficient when possible

When building with GNU C, clang or VMS C, it's more efficient to
generate dependency file and object file in one call rather than two.
Have the dependency output in a temporary file and compare it with the
previous one if available to see if replacement is waranted, thereby
avoiding unnecessary reconstruction of Makefile / descrip.mms.

Github issue #750

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT4354: Add some cross-refs

Stack Overflow has a number of questions related to mutual authentication,
the client and its certificate. Those visiting the man pages for functions
like SSL_CTX_use_certificate and SSL_CTX_load_verify_locations don't
receive the benefit of a cross reference to SSL_CTX_set_client_CA_list.

Reviewed-by: Richard Levitte <levitte@openssl.org>

using macro inside the case.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

fix build with no-srtp

- srtp_profiles variable is defined when building with SRTP, keeping
the variable usage also under ifndef OPENSSL_NO_SRTP
- alpn help option was kept under ifndef OPENSSL_NO_SRTP

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

ct_test.c doesn't need to include from source top, only testutil.c does

The INCLUDE statement can handle setting extra include directories for
individual object files, let's use it.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Remove last remains of old config strings

Reviewed-by: Andy Polyakov <appro@openssl.org>

modes/asm/ghash-x86_64.pl: refine GNU assembler version detection.

Even though AVX support was added in GAS 2.19 vpclmulqdq was apparently
added in 2.20.

Reviewed-by: Rich Salz <rsalz@openssl.org>

chacha/asm/chacha-*.pl: fix typos in tail processing.

RT#4323

Reviewed-by: Rich Salz <rsalz@openssl.org>

Reformat and update EC_KEY_new manual page.

Add some missing parentheses and reformat.

Document EC_KEY_oct2key(), EC_KEY_key2buf(), EC_KEY_oct2priv(),
EC_KEY_priv2oct() and EC_KEY_priv2buf()

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT2275: use BIO_sock_nbio()

Now that BIO_sock_nbio is available, use it in the apps.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove some old files.

I read the PROBLEMS, and they're outdated; nothing I'd put in the
online FAQ, for example.  Test-builds work without using these files.
Had to remove the rehash.time stuff from Makefile.in

Reviewed-by: Richard Levitte <levitte@openssl.org>

Keep a cache of files that already have a recipe, in common.tmpl

We don't want recipes for the same files generated more than once

Reviewed-by: Rich Salz <rsalz@openssl.org>

FreeBSD, at least, can restrict symbols in a shared library - so use the
Linux target that does that.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

testutil.c includes e_os.h.

Reviewed-by: Rich Salz <rsalz@openssl.org>

GH753: More spelling fix

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Apply default after having checked the given config target is valid

Reviewed-by: Rich Salz <rsalz@openssl.org>

Drop support for printing SSLv2 ciphers names.

Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #2083

Update and clarify EC_POINT documentation.

Reformat EC_POINT_new.pod and add parentheses to function names.
Clarify the octet form.
Add documentation for EC_POINT_oct2buf().

Reviewed-by: Rich Salz <rsalz@openssl.org>

Remove Ubsec engine

The ubsec engine is now considered obsolete and therefore has been
removed.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Moves SCT struct typedef into ossl_typ.h

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix for potential deferencing of null pointer in o2i_SCT_signature

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Public API for Certificate Transparency

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

GH752 ct_test uses testutil, so include that

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Revert "EC_KEY_priv2buf (): check parameter sanity"

This reverts commit acae59bb29ddc769743ab4a8ae373b5ff2f42b57.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

Don't build sanitizer builds with --debug

They're too slow.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix master compile error

Reviewed-by: Rich Salz <rsalz@openssl.org>

Remove comments saying you must do 'make -f Makefile.in TABLE'

Since the configs were remade into hash tables, this isn't needed
any more.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Make the table entry printer in Configure aware of ARRAYs

Reviewed-by: Rich Salz <rsalz@openssl.org>

GH680: Reuse strnlen() in strndup()

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

EC_KEY_priv2buf (): check parameter sanity

In EC_KEY_priv2buf(), check for pbuf sanity.
If invoked with NULL, gracefully returns the key length.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

check with NULL

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

explicit check for NULL

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Check method before access and release ctx in error paths

- In error paths, EVP_MD_CTX allocated by the callee is not released.
- Checking method before accessing

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

RT4335: Fix UEFI build of OBJ_NAME_new_index()

We are using strcmp() as the cmp_func, where in the EDK2 environment
strcmp actually ends up being the external AsciiStrCmp() function —
an EFI library function defined with the Microsoft ABI.

This means that we can't just assign function pointers to it, since
in GCC-hosted builds the ABI of any function *not* explicitly marked
EFIAPI is the native SysV ABI.

Arguably this stupidity ought to be resolved on the UEFI side, but in
the general case that would mean that we need to provide ABI-compatible
wrappers for *all* the "standard" functions, just in case they're used
like this.

And in fact we already have a workaround here for DEC C. So instead of
playing games with casting function pointers, it's nicer just to use a
simple function to wrap the strcmp() call. That cleans up the DEC C
workaround, *and* it works around the UEFI bogosity at the same time.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Forgotten change of add() call in Configure

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix a mkdef.pl warning

mkdef.pl was issuing the following error:

 Use of uninitialized value within %tag in numeric eq (==) at
 util/mkdef.pl line 560, <IN> line 92

This was because it was treating a __cplusplus "#ifdef" check as a "tag"
but then skipping over the corresponding "#endif". Therefore after
processing a file it still had "left over" tags from processing the
previous file. It was also getting confused by "#if" checks that didn't
match is pre-defined styles.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Unified on VMS - add %disabled in vmsconfig.pm (util/dofile.pl demands it)

Reviewed-by: Rich Salz <rsalz@openssl.org>

Normalise the include directives in ct_test.c

build.info needed a slight update, one more include directory.

Reviewed-by: Matt Caswell <matt@openssl.org>

Implement new multi-threading API

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Configure - neater looking add() and add_before()

They now default to " " as separator, but that can be overridden by
having a hash with parameters as last argument.  The only currently
recognised parameter is `separator'.

The special separator `undef' will force the result to become a list
rather than a concatenated string.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Update test build/run for unified

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix memory issues in BIO_*printf functions

The internal |fmtstr| function used in processing a "%s" format string
in the BIO_*printf functions could overflow while calculating the length
of a string and cause an OOB read when printing very long strings.

Additionally the internal |doapr_outch| function can attempt to write to
an OOB memory location (at an offset from the NULL pointer) in the event of
a memory allocation failure. In 1.0.2 and below this could be caused where
the size of a buffer to be allocated is greater than INT_MAX. E.g. this
could be in processing a very long "%s" format string. Memory leaks can also
occur.

These issues will only occur on certain platforms where sizeof(size_t) >
sizeof(int). E.g. many 64 bit systems. The first issue may mask the second
issue dependent on compiler behaviour.

These problems could enable attacks where large amounts of untrusted data
is passed to the BIO_*printf functions. If applications use these functions
in this way then they could be vulnerable. OpenSSL itself uses these
functions when printing out human-readable dumps of ASN.1 data. Therefore
applications that print this data could be vulnerable if the data is from
untrusted sources. OpenSSL command line applications could also be
vulnerable where they print out ASN.1 data, or if untrusted data is passed
as command line arguments.

Libssl is not considered directly vulnerable. Additionally certificates etc
received via remote connections via libssl are also unlikely to be able to
trigger these issues because of message size limits enforced within libssl.

CVE-2016-0799

Issue reported by Guido Vranken.

Reviewed-by: Andy Polyakov <appro@openssl.org>

fix "no-engine" build of test fixture

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Add some 'no-engine' builds to travis, for test

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

GH715: ENGINE_finish can take NULL

Simplifies calling code.  Also fixed up any !ptr tests that were
nearby, turning them into NULL tests.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix unified build after CT reorg

Reviewed-by: Richard Levitte <levitte@openssl.org>

Tests for parsing and printing certificates containing SCTs

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Add more CT utility routines to be used as part of larger patch.

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

GH463: Fix OPENSSL_NO_OCSP build

Fixes github issue 463.  Building the app without OPENSSL_NO_SOCK
isn't supported, so only do OPENSSL_NO_OCSP.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Fix indents

Reviewed-by: Andy Polyakov <appro@openssl.org>

Build fix: remove cleanse_ctr

Reviewed-by: Andy Polyakov <appro@openssl.org>

RT4116: Change cleanse to just memset

See also the discussion in https://github.com/openssl/openssl/pull/455

Reviewed-by: Andy Polyakov <appro@openssl.org>

CVE-2016-0798: avoid memory leak in SRP

The SRP user database lookup method SRP_VBASE_get_by_user had confusing
memory management semantics; the returned pointer was sometimes newly
allocated, and sometimes owned by the callee. The calling code has no
way of distinguishing these two cases.

Specifically, SRP servers that configure a secret seed to hide valid
login information are vulnerable to a memory leak: an attacker
connecting with an invalid username can cause a memory leak of around
300 bytes per connection.

Servers that do not configure SRP, or configure SRP but do not configure
a seed are not vulnerable.

In Apache, the seed directive is known as SSLSRPUnknownUserSeed.

To mitigate the memory leak, the seed handling in SRP_VBASE_get_by_user
is now disabled even if the user has configured a seed.

Applications are advised to migrate to SRP_VBASE_get1_by_user. However,
note that OpenSSL makes no strong guarantees about the
indistinguishability of valid and invalid logins. In particular,
computations are currently not carried out in constant time.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Solaris DSOs were still named libFOO.so, fixed

Reviewed-by: Andy Polyakov <appro@openssl.org>

Make it possible to build even if dependency files can't be generated

If the local system doesn't have GNU C or clang, and not even
makedepend, the build will stop because the call of 'makedepend'
fails.  This changes so the build won't stop because of such failure.
The result will be empty .d files, and that's ok.

Reviewed-by: Rich Salz <rsalz@openssl.org>

GH742: keep gost specific variable under macro

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

GH235: Set error status on malloc failure

Reviewed-by: Emilia Käsper <emilia@openssl.org>

GH480: Don't break statements with CPP stuff.

This is also RT 4137

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Andy Polyakov <appro@openssl.org>

Fix typo, reformat comment.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Remove unused parameter in ssl_set_masks().

The ssl_set_masks() function no longer depends on the cipher. This
also means there is no need to set the masks for each cipher in
ssl3_choose_cipher.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Update documentation of SSL METHODs and ciphers

Reviewed-by: Kurt Roeckx <kurt@openssl.org>

correct name of GNU shared libraries

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

test/ectest.c: add regression test for RT#4284.

Reviewed-by: Rich Salz <rsalz@openssl.org>

ec/asm/ecp_nistz256-*.pl: get corner case logic right.

RT#4284

Reviewed-by: Rich Salz <rsalz@openssl.org>

ec/asm/ecp_nistz256-x86_64.pl: get corner case logic right.

RT#4284

Reviewed-by: Rich Salz <rsalz@openssl.org>

test/recipes/80-test_ca.t: remove_tree->rmtree to make it work with Perl 5.10.

Reviewed-by: Richard Levitte <levitte@openssl.org>

poly1305/asm/poly1305-armv4.pl: replace ambiguous instruction.

Different assembler versions disagree on how to interpret #-1 as
argument to vmov.i64, as 0xffffffffffffffff or 0x00000000ffffffff.
So replace it with something they can't disagree on.

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT4339: Fix handling of <internal/bn_conf.h>

The entire contents of <internal/bn_conf.h> are unwanted in the UEFI
build because we have to do it differently there. To support building
for both 32-bit and 64-bit platforms without re-running the OpenSSL
Configure script, the EDK2 environment defines THIRTY_TWO_BIT or
SIXTY_FOUR_BIT for itself according to the target platform.

The current setup is broken, though. It checks for OPENSSL_SYS_UEFI but
before it's actually defined, since opensslconf.h hasn't yet been
included.

Let's fix that by including opensslconf.h. And also let's move the
bn_conf.h doesn't even need to *exist* in the UEFI build environment.

This is also GH PR736.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

GH735: remove unnecessary allocation

Removing code, where memory was getting allocated for an unused variable

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Add PKCS7_NO_DUAL_CONTENT flag

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove all -march= from configs

These flags are limitting needlessly, are often patched by packagers,
and should be specified on the configuration command line by anyone
who desires for it to be specific rather than forced by us.

This work was already done with mingw when those configs were worked
on, now it gets applied to the remaining configs.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Add OPENSSL_PIC back

In the earlier change, where static libraries get built with position
independent code, OPENSSL_PIC was removed by mistake.  This adds it
back.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove unused parameters from internal functions

Reviewed-by: Richard Levitte <levitte@openssl.org>

Use $disabled{shared} in a safer manner

Reviewed-by: Rich Salz <rsalz@openssl.org>

The build files use %disabled, make sure to pass it to them

Reviewed-by: Rich Salz <rsalz@openssl.org>

MemorySanitizer: address false positive

Explicitly unpoison the result of FD_ZERO

Tests now pass, using -fsanitize=memory

Reviewed-by: Rich Salz <rsalz@openssl.org>

GH678: Add a few more zalloc

Remove some duplicated NULL/zero init.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

RT4334: Check UEFI before __STDC_VERSION__ for <inttypes.h>

Adding -nostdinc to the EDK2 showed that we were including <inttypes.h>
for some UEFI builds, because the check for __STDC_VERSION__ happens
before the check for OPENSSL_SYS_UEFI. Fix that.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

Partial revert of 1288f26 and fix for no-async

The commit 1288f26 says that it fixes no-async, but instead seems to break
it. Therefore revert that change and fix no-async.

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT4309: Define PRIu64 for UEFI build

Provide an appropriate definition of PRIu64 for the EDK2 build, since
we don't have <inttypes.h> there.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

RT4320/GH705: Fix PEM parsing bug.

Also removing confusing pointer-alias variable.
Reviewed-by: Richard Levitte <levitte@openssl.org>