oweals/openssl.git
9 years agoAdjust the general fill-column in doc/dir-locals.example.el
Richard Levitte [Mon, 7 Sep 2015 22:59:50 +0000 (00:59 +0200)]
Adjust the general fill-column in doc/dir-locals.example.el

Having a general fill-column of 78 may look nice at first sight, but
if the edited text gets indented a bit afterward (such as with git
comments in 'git log'), it suddenly turns not so nice on a classic 80
columns terminal.  A fill-column of 70 will serve us better.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdjust the verify_extra test recipe to its executable
Richard Levitte [Mon, 7 Sep 2015 14:26:04 +0000 (16:26 +0200)]
Adjust the verify_extra test recipe to its executable

The verify_extra_test was recently changed to take its parameters as
arguments instead of having them hardcoded.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoGH391: Apple port
Rich Salz [Mon, 7 Sep 2015 14:08:14 +0000 (10:08 -0400)]
GH391: Apple port

Also make internal functions consistently return values, and
add a comment documenting them.

Reviewed-by: Ben Laurie <ben@openssl.org>
9 years agoMake sure that 80-test_ca.t finds all the config files
Richard Levitte [Sun, 6 Sep 2015 23:09:23 +0000 (01:09 +0200)]
Make sure that 80-test_ca.t finds all the config files

This recipe counted too much on being called with test/ as its current
working directory.  That's a mistake on, for example, Windows.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd a recipe for the new null pointer test
Richard Levitte [Sun, 6 Sep 2015 14:04:15 +0000 (16:04 +0200)]
Add a recipe for the new null pointer test

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoChange the 80-test_tsa recipe as per changes in testtsa
Richard Levitte [Sun, 6 Sep 2015 14:03:30 +0000 (16:03 +0200)]
Change the 80-test_tsa recipe as per changes in testtsa

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd a recipe for the new pbelu test
Richard Levitte [Thu, 3 Sep 2015 19:17:31 +0000 (21:17 +0200)]
Add a recipe for the new pbelu test

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoRemake the testsslproxy tests
Richard Levitte [Thu, 3 Sep 2015 18:54:01 +0000 (20:54 +0200)]
Remake the testsslproxy tests

The testsslproxy tests turned out to be useless as they were.  They
were really just for show and the results were ignore.  Now they are
changed into a more veerifiable test

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoSmall fix in OpenSSL::Test
Richard Levitte [Thu, 3 Sep 2015 17:41:40 +0000 (19:41 +0200)]
Small fix in OpenSSL::Test

Be careful when shifting in a function argument, you end up changing
the caller's value.  Instead, when it is an array, make a shallow copy
and shift in that instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoIncorporate recent changes that were originally made in test/testssl
Richard Levitte [Thu, 3 Sep 2015 17:39:58 +0000 (19:39 +0200)]
Incorporate recent changes that were originally made in test/testssl

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd documentation for the new testing framework
Richard Levitte [Thu, 3 Sep 2015 10:00:28 +0000 (12:00 +0200)]
Add documentation for the new testing framework

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd a recipe for the new gmdiff test
Richard Levitte [Thu, 3 Sep 2015 07:24:01 +0000 (09:24 +0200)]
Add a recipe for the new gmdiff test

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoCorrect test name
Richard Levitte [Thu, 3 Sep 2015 07:23:32 +0000 (09:23 +0200)]
Correct test name

Some tests were copied from test_jpake, but the title wasn't changed
accordingly.  This might seem like a small thing, but it does affect
the log file name...

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoRemake test/sslsessionticktest.pl into a recipe
Richard Levitte [Fri, 28 Aug 2015 01:07:24 +0000 (03:07 +0200)]
Remake test/sslsessionticktest.pl into a recipe

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdapt the libssl test harness testing scripts to new testing framework
Richard Levitte [Thu, 13 Aug 2015 17:38:59 +0000 (19:38 +0200)]
Adapt the libssl test harness testing scripts to new testing framework

This involves adding $TOP/util as perl library in test/run_tests.pl.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoCheck the validity of MINFO
Richard Levitte [Sun, 9 Aug 2015 04:52:50 +0000 (06:52 +0200)]
Check the validity of MINFO

MINFO may be an old file lying around, which might have
00-check_testexes.t produce incorrect results.  To make sure this
doesn't happen, check the variable VERSION in it against the same
variable in the top Makefile.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoBetter method of skipping all the tests in 00-check_testexes.t
Richard Levitte [Sun, 9 Aug 2015 03:35:57 +0000 (05:35 +0200)]
Better method of skipping all the tests in 00-check_testexes.t

Before trying to read MINFO, we have no idea how many to test for, and
because skip expects to get an exact number somehow, it's better to
use 'plan skip_all'.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoRemove special x509 test conversions
Richard Levitte [Sat, 8 Aug 2015 09:45:54 +0000 (11:45 +0200)]
Remove special x509 test conversions

Following the commit from July 2 that removed netscape formated certs,
it is no longer necessary to have conversion tests for it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd a few missing tests
Richard Levitte [Sat, 8 Aug 2015 09:33:10 +0000 (11:33 +0200)]
Add a few missing tests

test_clienthello
test_packet
test_verify_extra
test_secmem

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoPush the line buffer filter on the out BIO on VMS
Richard Levitte [Thu, 30 Apr 2015 17:52:36 +0000 (19:52 +0200)]
Push the line buffer filter on the out BIO on VMS

VMS files are normally record oriented rather than stream oriented.
This means that every write() will create a new record, which is seen
as a line of its own, regardless of if there was a \n in there or not.
bntest uses BN_print, which prints out number with more than one
write(), thereby dividing up the numbers in several lines, which
greatly disturbs the post-bntest checks that expect to find a full
formula to calculate on one line.

So, for VMS, we need to push the linebuffer filter on the out BIO.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoRework 00-test_checkexes.t for VMS
Richard Levitte [Thu, 30 Apr 2015 17:38:47 +0000 (19:38 +0200)]
Rework 00-test_checkexes.t for VMS

Unfortunately, a file spec with character range globs interfere with
paths on VMS, and are therefore disabled.  Rework this test to collect
a list of expected tests and a list of all recipes and compare the two
using grep.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoDocument OpenSSL::Test and OpenSSL::Test::Simple
Richard Levitte [Thu, 30 Apr 2015 12:30:15 +0000 (14:30 +0200)]
Document OpenSSL::Test and OpenSSL::Test::Simple

For OpenSSL::Test, it meant rearranging the code to better suite the
structure of the documentation.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoChange OpenSSL::Test to be an extension of Test::More
Richard Levitte [Thu, 30 Apr 2015 06:51:24 +0000 (08:51 +0200)]
Change OpenSSL::Test to be an extension of Test::More

It became tedious as well as error prone to have all recipes use
Test::More as well as OpenSSL::Test.  The easier way is to make
OpenSSL::Test an extension of Test::More, thereby having all version
checks as well as future checks firmly there.  Additionally, that
allows us to extend existing Test::More functions if the need would
arise.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoNew feature: STOPTEST
Richard Levitte [Wed, 29 Apr 2015 19:51:25 +0000 (21:51 +0200)]
New feature: STOPTEST

When the environment variable STOPTEST is defined (with any value other
than the empty string), the test machinery in OpenSSL::Test goes into a
different mode that will stop all testing at the end of a failing recipe.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd version numbers on some modules we use.
Richard Levitte [Tue, 28 Apr 2015 18:39:09 +0000 (20:39 +0200)]
Add version numbers on some modules we use.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoHave 'make clean' clean away the log files.
Richard Levitte [Tue, 28 Apr 2015 15:59:06 +0000 (17:59 +0200)]
Have 'make clean' clean away the log files.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoTone down the requirements of a test that will go away.
Richard Levitte [Thu, 23 Apr 2015 09:11:14 +0000 (11:11 +0200)]
Tone down the requirements of a test that will go away.

00-check_testexes.t was a way for me to check that I didn't forget a
compiled test app.  The way it worked was to require MINFO to be present.
Considering the need for this test has diminished considerably at this
point, I might as well tone down the requirement, and have it skip the
test (and not fail it) if MINFO isn't present.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoRemove old testing scripts out of the way.
Richard Levitte [Tue, 21 Apr 2015 19:10:01 +0000 (21:10 +0200)]
Remove old testing scripts out of the way.

For now, I'm moving them into Attic/.  They will be removed later.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdapt mk1mf.pl and helpers to the new testing framework.
Richard Levitte [Tue, 21 Apr 2015 18:09:36 +0000 (20:09 +0200)]
Adapt mk1mf.pl and helpers to the new testing framework.

With the new testing framework, building a test target with mk1mf.pl
becomes a very simple thing.  And especially, no more need to do the
amount of hackery in unix.pl we did.

Also, some tests need a working apps/CA.pl as well as rehashed certs
in certs/demo.  So, move the code creating those files so it gets done
regardless, not just in non-mk1mf environments.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoSimplify very simple test recipes further.
Richard Levitte [Tue, 21 Apr 2015 17:29:01 +0000 (19:29 +0200)]
Simplify very simple test recipes further.

Very simple test recipes easily become tedious, so they might benefit
from being made as simple as possible.  Therefore, OpenSSL::Test::Simple
is born.  It currently provides but one function, simple_test(), which
takes a minimum of two parameters (test name and program to run), with
the optional third, being the algorithm to be checked for before
running the test itself.

All recipes with that simple thing to do have been rewritten to be as
minimal as possible.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoRemove test targets from Makefile, have it use run_tests.pl
Richard Levitte [Sun, 19 Apr 2015 21:49:30 +0000 (23:49 +0200)]
Remove test targets from Makefile, have it use run_tests.pl

Also remove recipes/00-check_testalltests.t, since it will lack the
information from the now gone alltests target.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoIgnore the log files
Richard Levitte [Sun, 19 Apr 2015 20:29:46 +0000 (22:29 +0200)]
Ignore the log files

The new test framework produces a lot of log files (one for each
test).  Git doesn't need to know.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd recipes for misc other things we want to test
Richard Levitte [Sun, 19 Apr 2015 20:26:12 +0000 (22:26 +0200)]
Add recipes for misc other things we want to test

Note that this required a change in constant_time_test.c, as it says
"ok", which interferes with what Test::Harness expects to see.  I had
constant_time_test.c say "success" instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd recipes for the larger protocols
Richard Levitte [Sun, 19 Apr 2015 20:24:17 +0000 (22:24 +0200)]
Add recipes for the larger protocols

This covers the certificate authority commands, the cms and smime
commands, OCSP, SSL and TSA.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd engine and evp test recipes.
Richard Levitte [Fri, 17 Apr 2015 18:16:13 +0000 (20:16 +0200)]
Add engine and evp test recipes.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd recipes for tests related to certificates
Richard Levitte [Fri, 17 Apr 2015 18:15:22 +0000 (20:15 +0200)]
Add recipes for tests related to certificates

Some of them make use of recipes/tconversion.pl.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd asymetric cipher test recipes
Richard Levitte [Fri, 17 Apr 2015 18:13:58 +0000 (20:13 +0200)]
Add asymetric cipher test recipes

Some of them make use of recipes/tconversion.pl.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd a helper script for key file format conversion tests
Richard Levitte [Fri, 17 Apr 2015 18:10:24 +0000 (20:10 +0200)]
Add a helper script for key file format conversion tests

As tests are done until now, there are a few scripts that look almost,
but not quite the same.  tkey, tx509, tcrl, tpkcs7, treq, tsid and
probably a few more.

recipes/tconversions.pl is a helper script that generalises the
function of each of those, and can then be used in a general manner
from test recipes.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd the encryption test recipe
Richard Levitte [Fri, 17 Apr 2015 18:07:13 +0000 (20:07 +0200)]
Add the encryption test recipe

This tests all available openssl cipher commands.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd recipes for individual block ciphers, stream ciphers and digests
Richard Levitte [Fri, 17 Apr 2015 18:04:19 +0000 (20:04 +0200)]
Add recipes for individual block ciphers, stream ciphers and digests

These recipes all correspond to a compiled test program.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoAdd math tests recipes
Richard Levitte [Fri, 17 Apr 2015 17:57:55 +0000 (19:57 +0200)]
Add math tests recipes

The math recipes are among the heavier, but also quite important.
For the BN test, we have previously relied on bc to verify the numbers.
Unfortunately, bc doesn't exist everywhere, making tests on some platforms
rather painful.  With the new recipe (recipes/10-test_bn.t), we rely
on perl's Math::BigInt and a homegrown simple calculator (recipes/bc.pl)
that can do enough to cover for bc.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoGroundwork for a perl based testing framework
Richard Levitte [Fri, 17 Apr 2015 17:44:48 +0000 (19:44 +0200)]
Groundwork for a perl based testing framework

The idea with this perl based testing framework is to make use of
what's delivered with perl and exists on all sorts of platforms.

The choice came to using Test::More and Test::Harness, as that seems
to be the most widely spread foundation, even if perl is aged.

The main runner of the show is run_tests.pl.  As it currently stands,
it's designed to run from inside Makefile, but it's absolutely
possible to run it from the command line as well, like so:

cd test
OPENSSL_SRCDIR=.. perl run_tests.pl

The tester scripts themselves are stored in the subdirectory recipes/,
and initially, we have two such scripts, recipes/00-check_testalltests.t
and recipes/00-check_testexes.t.  recipes/00-check_testalltests.t will
pick out the dependencies of "alltests" in test/Makefile, and check if
it can find recipes with corresponding names.  recipes/00-check_testexes.t
does something similar, but bases it on existing compiled test binaries.
They make it easy to figure out what's to be added, and will be
removed when this effort is finished.

Individual recipes can be run as well, of course, as they are perl
scripts in themselves.  For example, you can run only
recipes/00-check_testexes.t like so:

cd test
OPENSSL_SRCDIR=.. perl recipes/00-check_testexes.t

To make coding easier, there's a routine library OpenSSL::Test, which
is reachable in a perl script like so:

use lib 'testlib';
use OpenSSL::Test;

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoPACKETise ServerKeyExchange
Matt Caswell [Tue, 4 Aug 2015 20:22:31 +0000 (21:22 +0100)]
PACKETise ServerKeyExchange

Process the ServerKeyExchange message using the PACKET API

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoPACKETise ServerHello processing
Matt Caswell [Tue, 4 Aug 2015 16:36:02 +0000 (17:36 +0100)]
PACKETise ServerHello processing

Process ServerHello messages using the PACKET API

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoUpdates for NumericString support
Matt Caswell [Wed, 26 Aug 2015 12:49:49 +0000 (13:49 +0100)]
Updates for NumericString support

Ensure that EBCDIC support works and update a comment.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoAdd NumericString support
Dmitry Belyavsky [Wed, 26 Aug 2015 12:34:31 +0000 (13:34 +0100)]
Add NumericString support

GOST requires improved NumericString support.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoFix build break due to rehash command
Matt Caswell [Mon, 7 Sep 2015 09:08:38 +0000 (10:08 +0100)]
Fix build break due to rehash command

The build was breaking due to a Makefile recipe expecting an openssl
version to be on the PATH with support for the rehash command.

Reviewed-by: Ben Laurie <ben@openssl.org>
9 years agofix build breakage on windows
Rich Salz [Mon, 7 Sep 2015 01:39:26 +0000 (21:39 -0400)]
fix build breakage on windows

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoFix typo, that broke build on non-unix
Rich Salz [Sun, 6 Sep 2015 23:01:24 +0000 (19:01 -0400)]
Fix typo, that broke build on non-unix

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoAdd rehash command to openssl
Timo Teras [Thu, 7 May 2015 16:48:47 +0000 (12:48 -0400)]
Add rehash command to openssl

On Unix/Linux platforms, merge c_rehash script into openssl as a
C program.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoSmall fix: make istext static
Richard Levitte [Sun, 6 Sep 2015 20:43:25 +0000 (22:43 +0200)]
Small fix: make istext static

This takes away a build failure in some cases.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoFix enc so it properly treats BASE64 as text
Richard Levitte [Sun, 6 Sep 2015 15:12:39 +0000 (17:12 +0200)]
Fix enc so it properly treats BASE64 as text

To set both the incoming and outgoing data when 'encrypting' or
'decrypting' to FORMAT_BASE64 wasn't quite the right thing to do.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoFixup merge conflicts in util/libeay.num
Richard Levitte [Sun, 6 Sep 2015 12:13:00 +0000 (14:13 +0200)]
Fixup merge conflicts in util/libeay.num

Reviewed-by: Stephen Henson <steve@openssl.org>
9 years agoChange the treatment of stdin and stdout to allow binary data
Richard Levitte [Sun, 6 Sep 2015 10:20:12 +0000 (12:20 +0200)]
Change the treatment of stdin and stdout to allow binary data

If the output to stdout or the input from stdin is meant to be binary,
it's deeply unsetting to get the occasional LF converted to CRLF or
the other way around.  If someone happens to forget to redirect stdin
or stdout, they will get gibberish anyway, line ending conversion will
not change that.

Therefore, let's not have dup_bio_* decide unilaterally what mode the
BIO derived from stdin and stdout, and rather let the app decide by
declaring the intended format.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agodup_bio_* and bio_open_* are utility functions and belong in apps.c
Richard Levitte [Sun, 6 Sep 2015 08:51:04 +0000 (10:51 +0200)]
dup_bio_* and bio_open_* are utility functions and belong in apps.c

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoRemove warning about use of uninitialised variable
Richard Levitte [Sun, 6 Sep 2015 10:56:33 +0000 (12:56 +0200)]
Remove warning about use of uninitialised variable

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoHave binary mode when the format is binary, not the other way around
Richard Levitte [Fri, 4 Sep 2015 13:17:29 +0000 (15:17 +0200)]
Have binary mode when the format is binary, not the other way around

Fixing a small mixup.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoHave the test executables output in text mode
Richard Levitte [Fri, 4 Sep 2015 12:07:57 +0000 (14:07 +0200)]
Have the test executables output in text mode

The test executables use standard output and standard error for text output,
so let's open the corresponding BIOs in text mode.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoChange the way apps open their input and output files
Richard Levitte [Fri, 4 Sep 2015 10:49:06 +0000 (12:49 +0200)]
Change the way apps open their input and output files

The different apps had the liberty to decide whether they would open their
input and output files in binary mode or not, which could be confusing if
two different apps were handling the same type of file in different ways.

The solution is to centralise the decision of low level file organisation,
and that the apps would use a selection of formats to state the intent of
the file.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoMake the handling of output and input formats consistent
Richard Levitte [Fri, 4 Sep 2015 00:46:47 +0000 (02:46 +0200)]
Make the handling of output and input formats consistent

Most of all, we needed to sort out which ones are binary and which
ones are text, and make sure they are treated accordingly and
consistently so

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoMake the verify_extra test location agnostic
Richard Levitte [Fri, 4 Sep 2015 15:04:33 +0000 (17:04 +0200)]
Make the verify_extra test location agnostic

Depending on platform, verify_extra_test may fail because it relies on
test/ being the current working directory.  Make it get all the required
files on the command line instead to solve that issue.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agomake update
Dr. Stephen Henson [Thu, 3 Sep 2015 17:40:19 +0000 (18:40 +0100)]
make update

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoAvoid direct X509 structure access
Dr. Stephen Henson [Wed, 2 Sep 2015 21:01:18 +0000 (22:01 +0100)]
Avoid direct X509 structure access

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoReplace X509 macros with functions
Dr. Stephen Henson [Wed, 2 Sep 2015 20:46:39 +0000 (21:46 +0100)]
Replace X509 macros with functions

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoCleanup testtsa script
Rich Salz [Wed, 10 Jun 2015 22:53:31 +0000 (18:53 -0400)]
Cleanup testtsa script

Add RUN function; remove single-use functions and use their body inline.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoMake TS structures opaque.
Rich Salz [Wed, 10 Jun 2015 18:07:40 +0000 (14:07 -0400)]
Make TS structures opaque.

Most of the accessors existed and were already used so it was easy.
TS_VERIFY_CTX didn't have accessors/settors so I added the simple and
obvious ones, and changed the app to use them.  Also, within crypto/ts,
replaced the functions with direct access to the structure members
since we generally aren't opaque within a directory.

Also fix RT3901.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoRT3955: Reduce some stack usage
Rich Salz [Fri, 4 Sep 2015 12:13:19 +0000 (08:13 -0400)]
RT3955: Reduce some stack usage

Use malloc/free instead of big onstack buffers.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoIn X509_STORE_CTX_init, cleanup on failure
mrpre [Sat, 29 Aug 2015 02:26:39 +0000 (10:26 +0800)]
In X509_STORE_CTX_init, cleanup on failure

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoRT3951: Add X509_V_FLAG_NO_CHECK_TIME to suppress time check
David Woodhouse [Fri, 31 Jul 2015 07:49:50 +0000 (08:49 +0100)]
RT3951: Add X509_V_FLAG_NO_CHECK_TIME to suppress time check

In some environments, such as firmware, the current system time is entirely
meaningless. Provide a clean mechanism to suppress the checks against it.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoUse the shlib wrapper when running nptest
Alessandro Ghedini [Sat, 5 Sep 2015 11:06:51 +0000 (13:06 +0200)]
Use the shlib wrapper when running nptest

Since there seems to be no way to avoid linking to libssl and libcrypto,
just wrap the test. This unbreaks "shared" builds when using clang and/or
OS X.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Laurie <ben@openssl.org>
9 years agomake X509_REVOKED opaque
Dr. Stephen Henson [Sat, 5 Sep 2015 11:28:54 +0000 (12:28 +0100)]
make X509_REVOKED opaque

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoSupply a build rule for the recently added nptest
Benjamin Kaduk [Fri, 4 Sep 2015 23:50:24 +0000 (18:50 -0500)]
Supply a build rule for the recently added nptest

Commit d4ab70f27cb7e518e6a9d6323c996cc3feb7496b added a test program
to check that the NULL pointer is represented as all zero bits, but
did not specify a build rule for that new executable.  On many platforms,
the implicit rule sufficed, since nptest is a very simple program, but
for at least darwin-i386-cc, an explicit rule is needed.  On darwin-i386-cc,
the implicit rule targetted a 64-bit executable, but the object file
containing the definition of main was a 32-bit object, which the linker
excluded from consideration, resulting in a link failure due to no
definition for _main.

Add the missing build rule to fix the build on such platforms.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
9 years agoMatch SUITEB strings at start of cipher list.
Dr. Stephen Henson [Thu, 3 Sep 2015 23:20:34 +0000 (00:20 +0100)]
Match SUITEB strings at start of cipher list.

PR#4009.

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoTest for NULL ptr == 0
Rich Salz [Thu, 3 Sep 2015 20:56:28 +0000 (16:56 -0400)]
Test for NULL ptr == 0

Add a test to ensure that "char *p = NULL" is equivalent to
all-bytes-zero.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoRT3998: Allow scrypt to be disabled
Rich Salz [Fri, 4 Sep 2015 17:07:10 +0000 (13:07 -0400)]
RT3998: Allow scrypt to be disabled

This does 64-bit division and multiplication, and on 32-bit platforms
pulls in libgcc symbols (and MSVC does similar) which may not be
available.  Mostly done by David Woodhouse.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
9 years agoMore zalloc nits
Rich Salz [Fri, 4 Sep 2015 12:13:19 +0000 (08:13 -0400)]
More zalloc nits

Found on GitHub by dimman

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoRevert "OPENSSL_NO_xxx cleanup: RFC3779"
David Woodhouse [Thu, 23 Jul 2015 16:30:06 +0000 (17:30 +0100)]
Revert "OPENSSL_NO_xxx cleanup: RFC3779"

This reverts the non-cleanup parts of commit c73ad69017. We do actually
have a reasonable use case for OPENSSL_NO_RFC3779 in the EDK2 UEFI
build, since we don't have a strspn() function in our runtime environment
and we don't want the RFC3779 functionality anyway.

In addition, it changes the default behaviour of the Configure script so
that RFC3779 support isn't disabled by default. It was always disabled
from when it was first added in 2006, right up until the point where
OPENSSL_NO_RFC3779 was turned into a no-op, and the code in the
Configure script was left *trying* to disable it, but not actually
working.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoremove 0 assignments.
Rich Salz [Thu, 3 Sep 2015 13:15:26 +0000 (09:15 -0400)]
remove 0 assignments.

After openssl_zalloc, cleanup more "set to 0/NULL" assignments.
Many are from github feedback.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoAdd UEFI flag for rand build
Long, Qin [Wed, 22 Jul 2015 09:04:18 +0000 (10:04 +0100)]
Add UEFI flag for rand build

Add OPENSSL_SYS_UEFI flag for RAND handling;

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoWin32 build fix: include internal/numbers.h to get UIN32_MAX
Richard Levitte [Thu, 3 Sep 2015 12:03:54 +0000 (14:03 +0200)]
Win32 build fix: include internal/numbers.h to get UIN32_MAX

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoRT3674: Make no-cms build work.
David Bar [Mon, 3 Aug 2015 16:45:26 +0000 (12:45 -0400)]
RT3674: Make no-cms build work.

Also has changes from from David Woodhouse <David.Woodhouse@intel.com>
and some tweaks from me.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agomake update
Dr. Stephen Henson [Thu, 3 Sep 2015 15:25:03 +0000 (16:25 +0100)]
make update

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoPBE lookup test
Dr. Stephen Henson [Thu, 3 Sep 2015 14:46:43 +0000 (15:46 +0100)]
PBE lookup test

Add test to check PBE lookups: these can fail if the PBE table is not
correctly orders. Add to "make test".

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoAdd initial Travis CI configuration
Alessandro Ghedini [Wed, 19 Aug 2015 22:12:29 +0000 (00:12 +0200)]
Add initial Travis CI configuration

Closes #63

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Laurie <ben@openssl.org>
9 years agoTwo changes at ones lead to a confused libeay.num. Fix
Richard Levitte [Thu, 3 Sep 2015 08:16:59 +0000 (10:16 +0200)]
Two changes at ones lead to a confused libeay.num.  Fix

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoCheck OPENSSL_gmtime_diff
Rich Salz [Wed, 26 Aug 2015 20:22:10 +0000 (16:22 -0400)]
Check OPENSSL_gmtime_diff

It's test code that only runs on 64bit time_t machines.
Move it to a standalone test/gmdifftest

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoAdd and use OPENSSL_zalloc
Rich Salz [Tue, 25 Aug 2015 17:25:58 +0000 (13:25 -0400)]
Add and use OPENSSL_zalloc

There are many places (nearly 50) where we malloc and then memset.
Add an OPENSSL_zalloc routine to encapsulate that.
(Missed one conversion; thanks Richard)
Also fixes GH328

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agomake update
Dr. Stephen Henson [Mon, 31 Aug 2015 22:48:44 +0000 (23:48 +0100)]
make update

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agomake X509_CRL opaque
Dr. Stephen Henson [Mon, 31 Aug 2015 20:30:13 +0000 (21:30 +0100)]
make X509_CRL opaque

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoExtend ciphersuite test coverage.
Dr. Stephen Henson [Wed, 26 Aug 2015 13:28:38 +0000 (14:28 +0100)]
Extend ciphersuite test coverage.

Add support for testing ECDSA and DSA ciphersuites.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoFix CCM support in DTLS
Dr. Stephen Henson [Wed, 26 Aug 2015 13:03:24 +0000 (14:03 +0100)]
Fix CCM support in DTLS

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoUpdate ssltest certificate handling.
Dr. Stephen Henson [Wed, 26 Aug 2015 11:22:39 +0000 (12:22 +0100)]
Update ssltest certificate handling.

Use SSL_CONF for certificate handling is ssltest.c, this changes the
behaviour slightly: the -cert and -key options are no longer recognised
and a default certificate file is not used.

This change means that -s_cert and -c_cert can be used mode than once
to support use of multiple certificates.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoCreate DSA and ECDSA certificates.
Dr. Stephen Henson [Wed, 26 Aug 2015 11:20:32 +0000 (12:20 +0100)]
Create DSA and ECDSA certificates.

If supported create DSA and ECDSA certificates and test them.

Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agodelete unused structure
Dr. Stephen Henson [Wed, 2 Sep 2015 17:39:48 +0000 (18:39 +0100)]
delete unused structure

Reviewed-by: Rich Salz <rsalz@openssl.org>
9 years agoMove OPENSSL_ITEM to store.h
Rich Salz [Wed, 2 Sep 2015 02:44:10 +0000 (22:44 -0400)]
Move OPENSSL_ITEM to store.h

The only place that uses it.

Reviewed-by: Tim Hudson <tjh@openssl.org>
9 years agoCleaner handling of "cnid" in do_x509_check
Viktor Dukhovni [Wed, 2 Sep 2015 01:59:08 +0000 (21:59 -0400)]
Cleaner handling of "cnid" in do_x509_check

Avoid using cnid = 0, use NID_undef instead, and return early instead
of trying to find an instance of that in the subject DN.

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoBetter handling of verify param id peername field
Viktor Dukhovni [Wed, 2 Sep 2015 01:47:12 +0000 (21:47 -0400)]
Better handling of verify param id peername field

Initialize pointers in param id by the book (explicit NULL assignment,
rather than just memset 0).

In x509_verify_param_zero() set peername to NULL after freeing it.

In x509_vfy.c's internal check_hosts(), avoid potential leak of
possibly already non-NULL peername.  This is only set when a check
succeeds, so don't need to do this repeatedly in the loop.

Reviewed-by: Richard Levitte <levitte@openssl.org>
9 years agoFix DTLS1.2 buffers
Hiroyuki YAMAMORI [Wed, 26 Aug 2015 13:45:40 +0000 (14:45 +0100)]
Fix DTLS1.2 buffers

Fix the setup of DTLS1.2 buffers to take account of the Header

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agoFix the comment for POINT_CONVERSION_UNCOMPRESSED
Tim Zhang [Mon, 11 May 2015 09:58:51 +0000 (10:58 +0100)]
Fix the comment for POINT_CONVERSION_UNCOMPRESSED

The |z| value should be 0x04 not 0x02

RT#3838

Signed-off-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
9 years agomake update
Dr. Stephen Henson [Tue, 1 Sep 2015 18:09:20 +0000 (19:09 +0100)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>