Clarify use of |$end0| in stitched x86-64 AES-GCM code.

There was some uncertainty about what the code is doing with |$end0|
and whether it was necessary for |$len| to be a multiple of 16 or 96.
Hopefully these added comments make it clear that the code is correct
except for the caveat regarding low memory addresses.

Change-Id: Iea546a59dc7aeb400f50ac5d2d7b9cb88ace9027
Reviewed-on: https://boringssl-review.googlesource.com/7194
Reviewed-by: Adam Langley <agl@google.com>
Signed-off-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Configurations/10-main.conf: fix PA-RISC commentary.

Reviewed-by: Rich Salz <rsalz@openssl.org>

evp/evp_enc.c: refine partial buffer overlap detection.

Reviewed-by: Matt Caswell <matt@openssl.org>

evp/evp_enc.c: check for partially[!] overlapping buffers
in EVP_EncryptUpdate and EVP_DecryptUpdate. It is argued that in
general case it's impossible to provide guarantee that partially[!]
overlapping buffers can be tolerated.

Reviewed-by: Matt Caswell <matt@openssl.org>

RT2680: Public EC key is shown as private

Re-implemented as suggested by Steve Henson.
Also change ECParameters_print the same way.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

RT2964: Fix it via doc

OBJ_nid2obj() and friends should be treated as const.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

Revert "RT2964: Fix it via doc"

This reverts commit 82f31fe4dd0dac30229fa8684229b49d2bcef404.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

RT2964: Fix it via doc

OBJ_nid2obj() and friends should be treated as const.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

Handle BN_mod_word failures.

As of 37258dadaa9e36db4b96a3aa54aa6c67136160cc and the corresponding upstream
change, BN_mod_word may fail, like BN_div_word. Handle this properly. Thanks to
Brian Smith for pointing this out. See BoringSSL's
44bedc348d9491e63c7ed1438db100a4b8a830be.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1251

Fix BN_is_prime* calls.

This function returns a tri-state -1 on error. See BoringSSL's
53409ee3d7595ed37da472bc73b010cd2c8a5ffd.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1251

Add x509 and crl corpora

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1229

Add X509 and CRL fuzzer

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1229

Add -ciphers flag to enc command

Don't print the full list of ciphers as part of the -help output.

Reviewed-by: Andy Polyakov <appro@openssl.org>

perlasm/x86_64-xlate.pl: address errors and warnings in elderly perls.

Reviewed-by: Rich Salz <rsalz@openssl.org>

./config: minor cleanup.

Reviewed-by: Rich Salz <rsalz@openssl.org>

./config: detect x32-only environment.

RT#4583

Reviewed-by: Rich Salz <rsalz@openssl.org>

Teach EVP_PKEY_HMAC keys how to EVP_PKEY_cmp()

Fixes openssl/openssl#1236

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1237)

Avoid signed overflow

Found by afl

Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #3013

Deal with API changes.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Ensure HMAC key gets cleansed after use

aesni_cbc_hmac_sha256_ctrl() and aesni_cbc_hmac_sha1_ctrl() cleanse the
HMAC key after use, but static int rc4_hmac_md5_ctrl() doesn't.

Fixes an OCAP Audit issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Add some documentation for missing HMAC functions

This includes the newly added HMAC_CTX_get_md().

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add a getter to obtain the HMAC_CTX md

As a result of opaque HMAC_CTX apps need a getter for the HMAC_CTX md.

GitHub Issue #1152

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix ASN1_STRING_to_UTF8 could not convert NumericString

tag2nbyte had -1 at 18th position, but underlying ASN1_mbstring_copy
supports NumericString. tag2nbyte is also used in do_print_ex which will
not be broken by setting 1 at 18th position of tag2nbyte

Reviewed-by: Stephen Henson <steve@openssl.org>

Make x25519_compute_key() return a boolean

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Make ossl_ecdh_compute_key() return a boolean

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

utils/mkdir-p: check if dir exists also after mkdir failed

with "make install -j8" it happens very often that two or more make
instances are creating the same directory in parallel. As a result one
instace creates the directory and second mkdir fails because the
directory exists already (but it did not while testing for it earlier).

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1204)

RT2867: des_ede3_cfb1 ignored "size in bits" flag

Code and tests by Steve.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Drop extraneous printf argument in mkcert.sh

Reviewed-by: Rich Salz <rsalz@openssl.org>

Update fuzz corpora

Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #2986

Add checks on sk_TYPE_push() returned result

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Rework error handling from asn1_do_lock method.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Fix generation of expired CA certificate.

Reviewed-by: Richard Levitte <levitte@openssl.org>

OpenSSL::Test: Fix directory calculations in __cwd()

The previous fix contained a mistake, where any absolute path in
%directories would be cleared away instead of just being left alone.

Reviewed-by: Rich Salz <rsalz@openssl.org>

rand/randfile.c: make it non-ASCII-savvy.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Move OS-specific fopen quirks to o_fopen.c.

Reviewed-by: Richard Levitte <levitte@openssl.org>

crypto/cryptlib.c: omit OPENSSL_ia32cap_loc().

Reviewed-by: Rich Salz <rsalz@openssl.org>

Spelling... and more spelling

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1245)

segmentation fault with 'openssl s_client -prexit -keymatexport'

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1243)

Avoid creating an illegal pointer.

Found by tis-interpreter

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1230

Make RSA key exchange code actually constant-time.

Using RSA_PKCS1_PADDING with RSA_private_decrypt is inherently unsafe.
The API requires writing output on success and touching the error queue
on error. Thus, although the padding check itself is constant-time as of
294d1e36c2495ff00e697c9ff622856d3114f14f, and the logic after the
decryption in the SSL code is constant-time as of
adb46dbc6dd7347750df2468c93e8c34bcb93a4b, the API boundary in the middle
still leaks whether the padding check succeeded, giving us our
much-loved Bleichenbacher padding oracle.

Instead, PKCS#1 padding must be handled by the caller which uses
RSA_NO_PADDING, in timing-sensitive code integrated with the
Bleichenbacher mitigation. Removing PKCS#1 padding in constant time is
actually much simpler when the expected length is a constant (and if
it's not a constant, avoiding a padding oracle seems unlikely), so just
do it inline.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1222

buf2hexstr: properly deal with empty string

It wrote before the start of the string

found by afl

Reviewed-by: Richard Levitte <levitte@openssl.org>
MR: #2994

Fix typo

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1241)

Appveyor: test install as well, via a fake deploy_script

Reviewed-by: Matt Caswell <matt@openssl.org>

Travis: When testing install, install docs as well

Reviewed-by: Matt Caswell <matt@openssl.org>

OpenSSL::Test: Fix directory calculations in __cwd()

We recalculate the location of the directories we keep track of.
However, we did so after having moved to the new directory already, so
the data we did the calculations from were possibly not quite correct.

This change moves the calculations to happen before moving to the new
directory.

This issue is sporadic, and possibly dependent on the platform.

Reviewed-by: Matt Caswell <matt@openssl.org>

More doc cleanup

Add missing entries to NAME section
Add SYNOPSIS lines, remove old NAME entries
Update find-doc-nits; better regexp's for parsing SYNOPSIS sections.
Rename a couple of files to have an API name.
Remove RSA_private_decrypt; it was duplicate content
Update for recent doc additions

Reviewed-by: Matt Caswell <matt@openssl.org>

Avoid using latest clang since repo not available

Reviewed-by: Richard Levitte <levitte@openssl.org>

Make arm-xlate.pl set use strict.

It was already nearly clean. Just one undeclared variable.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1240)

Add verification of proxy certs to 25-test_verify.t

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>

Create some proxy certificates

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>

Make it possible to generate proxy certs with test/certs/mkcert.sh

This extends 'req' to take more than one DN component, and to take
them as full DN components and not just CN values.  All other commands
are changed to pass "CN = $cn" instead of just a CN value.

This adds 'genpc', which differs from the other 'gen*' commands by not
calling 'req', and expect the result from 'req' to come through stdin.

Finally, test/certs/setup.sh gets the commands needed to generate a
few proxy certificates.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>

make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>

Allow proxy certs to be present when verifying a chain

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>

Fix proxy certificate pathlength verification

While travelling up the certificate chain, the internal
proxy_path_length must be updated with the pCPathLengthConstraint
value, or verification will not work properly.  This corresponds to
RFC 3820, 4.1.4 (a).

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>

Check that the subject name in a proxy cert complies to RFC 3820

The subject name MUST be the same as the issuer name, with a single CN
entry added.

RT#1852

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>

RT3925: Remove trailing semi from macro

Reviewed-by: Andy Polyakov <appro@openssl.org>

apps/req.c: Increment the right variable when parsing '+'

Reviewed-by: Rich Salz <rsalz@openssl.org>

Remove pointless free loop in X509_TRUST_cleanup()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1194)

Remove pointless free loop in X509_PURPOSE_cleanup()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1194)

doc and comment fixes

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1233)

crypto/evp/e_aes_cbc_hmac_sha256.c: Remove spurious memset

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1231)

RT3136: Remove space after issuer/subject

Reviewed-by: Richard Levitte <levitte@openssl.org>

Make DSA_SIG and ECDSA_SIG getters const.

Reorder arguments to follow convention.

Also allow r/s to be NULL in DSA_SIG_get0, similarly to ECDSA_SIG_get0.

This complements GH1193 which adds non-const setters.

Reviewed-by: Rich Salz <rsalz@openssl.org>

rand/randfile.c: remove obsolete commentary.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Tests should check validation status directly

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Test SCT lists

This encompasses what was previously tested.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

aes/asm/bsaes-armv7.pl: omit redundant stores in XTS subroutines.

Reviewed-by: Rich Salz <rsalz@openssl.org>

aes/asm/bsaes-armv7.pl: fix XTS decrypt test failure.

RT#4578

Reviewed-by: Rich Salz <rsalz@openssl.org>

Change the RAND_file_name documentation accordingly

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>

Change default directory for the .rnd file on Windows and VMS

The previous change for Windows wasn't quite right.  Corrected to use
%HOME%, %USERPROFILE% and %SYSTEMPROFILE%, in that order.

Also adding the default home for VMS, SYS$LOGIN:

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>

Add a comment after some #endif at end of apps source code.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)

Useless header include of openssl/rand.h

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)

Useless includes

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)

Missing NULL check on OBJ_dup result in x509_name_canon

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)

Fix an MSVC warning.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)

Use a STACK_OF(OPENSSL_CSTRING) for const char * stacks

Better than losing the const qualifier.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>

OpenBSD has intypes.h

Update e_os2.h so that inttypes.h is included.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>

Replace 4 casts with 1

Changing the type of the |str| variable in asn1pars enables us to remove
4 casts with just 1. This silences an OpenBSD warning along the way.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>

Improve const correctness for stacks of EVP_MD

EVP_MDs are always const, so stacks of them should be too. This silences
a warning about type punning on OpenBSD.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>

constify SRP

Add const qualifiers to lots of SRP stuff. This started out as an effort
to silence some "type-punning" warnings on OpenBSD...but the fix was to
have proper const correctness in SRP.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>

Avoid type punning warnings in b_addr.c

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>

Change default directory for storing the .rnd file on Windows

Previously we would try %RANDFILE%, then %HOME% and finally "C:".
Unfortunately this often ends up being "C:" which the user may not
have write permission for.

Now we try %RANDFILE% first, and then the same set of environment vars
as GetTempFile() uses, i.e. %TMP%, then %TEMP%, %USERPROFILE% and
%SYSTEMROOT%. If all else fails we fall back to %HOME% and only then "C:".

Reviewed-by: Rich Salz <rsalz@openssl.org>

Harmonise the different build files

- User targets are now the same and generally do the same things
- configdata.pm depends on exactly the same files on all platforms
- VMS production of shared libraries is simplified
- VMS automatic dependency files get the extension .D rather than .MMS

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix GCC build; make update; fix number re-use

Reviewed-by: Richard Levitte <levitte@openssl.org>

Spelling fixes

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1219)

no-ripemd is an alias for no-rmd160

mkdef.pl was failing to understand no-ripemd. This is a deprecated option
which should act as an alias for no-rmd160.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix build break.

Aggregate local initializers are rarely portable (:

Reviewed-by: Richard Levitte <levitte@openssl.org>

Add EVP_PKEY_get0_hmac() function

Before the addition of this function, it was impossible to read the
symmetric key from an EVP_PKEY_HMAC type EVP_PKEY.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1217)

Revert "RT4526: Call TerminateProcess, not ExitProcess"

This reverts commit 9c1a9ccf65d0ea1912675d3a622fa8e51b524b9e.

TerminateProcess is asynchronous, so the code as written in the above
commit is not correct. It is also probably not needed in the speed
case. Reverting in order to figure out the correct solution.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Skip the TLSProxy tests if environmental problems are an issue

On some platforms we can't startup the TLSProxy due to environmental
problems (e.g. network set up on the build machine). These aren't OpenSSL
problems so we shouldn't treat them as test failures. Just visibly
indicate that we are skipping the test.

We only skip the first time we attempt to start up the proxy. If that works
then everything else should do...if not we should probably investigate and
so report as a failure.

This also removes test_networking...there is a danger that this turns into
a test of user's environmental set up rather than OpenSSL.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix the build and tests following constification of DH, DSA, RSA

Misc fixes following the constification of the DH, DSA and RSA
getters.

Reviewed-by: Stephen Henson <steve@openssl.org>

Change the return type of EVP_EncodeUpdate

Previously EVP_EncodeUpdate returned a void. However there are a couple
of error conditions that can occur. Therefore the return type has been
changed to an int, with 0 indicating error and 1 indicating success.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Deal with the consequences of constifying getters

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Constify the parameter getters for RSA, DSA and DH

Including documentation changes

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

RT4526: Call TerminateProcess, not ExitProcess

Reviewed-by: Richard Levitte <levitte@openssl.org>

Constify input buffers of some X509V3 and X509_PURPOSE -related methods

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Constify X509_TRUST_add method.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Constify asn1/asn_mime.c

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Constify some input buffers in asn1

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Constify CMS_get0_type input

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)