oweals/openssl.git
7 years agoschlock global variable needs to be volatile
Xiaoyin Liu [Mon, 24 Jul 2017 15:28:50 +0000 (11:28 -0400)]
schlock global variable needs to be volatile

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4000)

7 years agoFix nid assignment in ASN1_STRING_TABLE_add
lolyonok [Fri, 14 Jul 2017 15:22:12 +0000 (18:22 +0300)]
Fix nid assignment in ASN1_STRING_TABLE_add

CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3934)

7 years agoMakefile.shared: Make link_shlib.linux-shared less verbose again
Richard Levitte [Mon, 24 Jul 2017 09:48:02 +0000 (11:48 +0200)]
Makefile.shared: Make link_shlib.linux-shared less verbose again

A previous change inavertently removed a silencing '@'

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4003)

7 years agotest/recipes/80-test_tsa.t: Don't trust 'OPENSSL_CONF'
Richard Levitte [Sat, 22 Jul 2017 21:37:06 +0000 (23:37 +0200)]
test/recipes/80-test_tsa.t: Don't trust 'OPENSSL_CONF'

There's a case when the environment variable OPENSSL_CONF is
useless...  when cross compiling for mingw and your wine environment
has an environment variable OPENSSL_CONF.  The latter will override
anything that's given when starting wine and there make the use of
that environment variable useless in our tests.

Therefore, we should not trust it, and use explicit '-config' options
instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3994)

7 years agoSimplify Makefile.shared
Richard Levitte [Fri, 21 Jul 2017 16:04:51 +0000 (18:04 +0200)]
Simplify Makefile.shared

Makefile.shared was designed to figure out static library names,
shared library names, library version compatibility, import library
names and the like on its own.  This was a design for pre-1.1.0
OpenSSL because the main Makefile didn't have all that knowledge.

With 1.1.0, the situation isn't the same, a lot more knowledge is
included in the main Makefile, and while Makefile.shared did things
right most of the time (there are some corner cases, such as the
choice of .sl or .so as DSO extension on some HPUX versions), there's
still an inherent fragility when one has to keep an eye on
Makefile.shared to make sure it produces what the main Makefile
produces.

This change simplifies Makefile.shared by removing all its
"intelligence" and have it depend entirely on the input from the main
Makefile instead.  That way, all the naming is driven from
configuration data.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3983)

7 years agoImprove struct tm population
Pauli [Sun, 23 Jul 2017 23:10:13 +0000 (09:10 +1000)]
Improve struct tm population

Using Zeller's congruence to fill the day of week field,
Also populate the day of year field.

Add unit test to cover a number of cases.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3999)

7 years agoAdd asn1_time_to_tm function and check days in month
Paul Yang [Mon, 10 Jul 2017 19:01:24 +0000 (03:01 +0800)]
Add asn1_time_to_tm function and check days in month

Based on discussion in PR #3566. Reduce duplicated code in original
asn1_utctime_to_tm and asn1_generalizedtime_to_tm, and introduce a new
internal function asn1_time_to_tm. This function also checks if the days
in the input time string is valid or not for the corresponding month.

Test cases are also added.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/3905)

7 years agoUpdate documentation for SSL_is_server()
Paul Yang [Sun, 9 Jul 2017 16:55:38 +0000 (00:55 +0800)]
Update documentation for SSL_is_server()

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3893)

7 years agoRemove unused function prototypes
Xiaoyin Liu [Sat, 22 Jul 2017 22:44:27 +0000 (18:44 -0400)]
Remove unused function prototypes

`args_verify()` and `opt_reset()` are declared in `apps/apps.h`, but they are
not referenced anywhere. So can we remove them from `apps.h`?

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3995)

7 years agoUpdate doc/ca.pod to clarify description for dates
Paul Yang [Sun, 9 Jul 2017 17:52:33 +0000 (01:52 +0800)]
Update doc/ca.pod to clarify description for dates

"Note" part is based on PR #3566

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3895)

7 years agoFix const correctness of EC_KEY_METHOD_get_*
Johannes Bauer [Fri, 21 Jul 2017 17:58:18 +0000 (19:58 +0200)]
Fix const correctness of EC_KEY_METHOD_get_*

Changes the EC_KEY_METHOD_get_* family to not need a EC_KEY_METHOD* as
its first parameter, but a const EC_KEY_METHOD*, which is entirely
sufficient.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
GH: #3985

7 years agoAdd --with-rand-seed
Rich Salz [Tue, 18 Jul 2017 13:39:21 +0000 (09:39 -0400)]
Add --with-rand-seed

Add a new config param to specify how the CSPRNG should be seeded.
Illegal values or nonsensical combinations (e.g., anything other
than "os" on VMS or HP VOS etc) result in build failures.
Add RDSEED support.
Add RDTSC but leave it disabled for now pending more investigation.

Refactor and reorganization all seeding files (rand_unix/win/vms) so
that they are simpler.

Only require 128 bits of seeding material.

Many document improvements, including why to not use RAND_add() and the
limitations around using load_file/write_file.
Document RAND_poll().

Cleanup Windows RAND_poll and return correct status

More completely initialize the default DRBG.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/3965)

7 years agosha/asm/keccak1600-avx512.pl: absorb bug-fix and minor optimization.
Andy Polyakov [Thu, 20 Jul 2017 11:56:17 +0000 (13:56 +0200)]
sha/asm/keccak1600-avx512.pl: absorb bug-fix and minor optimization.

Hardware used for benchmarking courtesy of Atos, experiments run by
Romain Dolbeau <romain.dolbeau@atos.net>. Kudos!

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agox86_64 assembly pack: "optimize" for Knights Landing, add AVX-512 results.
Andy Polyakov [Thu, 20 Jul 2017 07:48:35 +0000 (09:48 +0200)]
x86_64 assembly pack: "optimize" for Knights Landing, add AVX-512 results.

"Optimize" is in quotes because it's rather a "salvage operation"
for now. Idea is to identify processor capability flags that
drive Knights Landing to suboptimial code paths and mask them.
Two flags were identified, XSAVE and ADCX/ADOX. Former affects
choice of AES-NI code path specific for Silvermont (Knights Landing
is of Silvermont "ancestry"). And 64-bit ADCX/ADOX instructions are
effectively mishandled at decode time. In both cases we are looking
at ~2x improvement.

AVX-512 results cover even Skylake-X :-)

Hardware used for benchmarking courtesy of Atos, experiments run by
Romain Dolbeau <romain.dolbeau@atos.net>. Kudos!

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoSupport converting cipher name to RFC name and vice versa
Paul Yang [Thu, 29 Jun 2017 19:06:19 +0000 (03:06 +0800)]
Support converting cipher name to RFC name and vice versa

Fixes: issue #3747

make SSL_CIPHER_standard_name globally available and introduce a new
function OPENSSL_cipher_name.

A new option '-convert' is also added to 'openssl ciphers' app.

Documentation and test cases are added.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/3859)

7 years agoFix out-of-bounds read in ctr_XOR
Benjamin Kaduk [Wed, 19 Jul 2017 22:59:52 +0000 (17:59 -0500)]
Fix out-of-bounds read in ctr_XOR

Looking at
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf
we see that in the CTR_DRBG_Update() algorithm (internal page number 51),
the provided input data is (after truncation to seedlen) xor-d with the
key and V vector (of length keylen and blocklen respectively).  The comment
in ctr_XOR notes that xor-ing with 0 is the identity function, so we can
just ignore the case when the provided input is shorter than seedlen.

The code in ctr_XOR() then proceeds to xor the key with the input, up
to the amount of input present, and computes the remaining input that
could be used to xor with the V vector, before accessing a full 16-byte
stretch of the input vector and ignoring the calculated length.  The correct
behavior is to respect the supplied input length and only xor the
indicated number of bytes.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3971)

7 years agotypedef's for RAND_DRBG methods
Benjamin Kaduk [Wed, 19 Jul 2017 22:32:08 +0000 (17:32 -0500)]
typedef's for RAND_DRBG methods

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3971)

7 years agoRemove trailing whitespace from drbgtest.c
Benjamin Kaduk [Wed, 19 Jul 2017 22:18:16 +0000 (17:18 -0500)]
Remove trailing whitespace from drbgtest.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3971)

7 years agoRename internal rand.h file
Rich Salz [Thu, 20 Jul 2017 14:20:47 +0000 (10:20 -0400)]
Rename internal rand.h file

Replacement fix for #3975

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3979)

7 years agoFix faulty include
Richard Levitte [Thu, 20 Jul 2017 09:58:28 +0000 (11:58 +0200)]
Fix faulty include

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3974)

7 years agoAdd range-checking to RAND_DRBG_set_reseed_interval
Rich Salz [Wed, 19 Jul 2017 21:41:26 +0000 (17:41 -0400)]
Add range-checking to RAND_DRBG_set_reseed_interval

As suggested by Kurt.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/3970)

7 years agoAdd keygen test data
Dr. Stephen Henson [Tue, 18 Jul 2017 16:21:37 +0000 (17:21 +0100)]
Add keygen test data

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3920)

7 years agoAdd keygen test to evp_test
Dr. Stephen Henson [Sun, 16 Jul 2017 23:15:58 +0000 (00:15 +0100)]
Add keygen test to evp_test

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3920)

7 years agoTypo: should check mgf1md
Dr. Stephen Henson [Thu, 13 Jul 2017 14:51:27 +0000 (15:51 +0100)]
Typo: should check mgf1md

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3920)

7 years agoSet maskHash when creating parameters.
Dr. Stephen Henson [Thu, 13 Jul 2017 12:37:57 +0000 (13:37 +0100)]
Set maskHash when creating parameters.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3920)

7 years agoRemove some dead code
Matt Caswell [Mon, 17 Jul 2017 15:55:32 +0000 (16:55 +0100)]
Remove some dead code

The intention of the removed code was to check if the previous operation
carried. However this does not work. The "mask" value always ends up being
a constant and is all ones - thus it has no effect. This check is no longer
required because of the previous commit.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3832)

7 years agoFix undefined behaviour in e_aes_cbc_hmac_sha256.c and e_aes_cbc_hmac_sha1.c
Matt Caswell [Wed, 28 Jun 2017 14:18:30 +0000 (15:18 +0100)]
Fix undefined behaviour in e_aes_cbc_hmac_sha256.c and e_aes_cbc_hmac_sha1.c

In TLS mode of operation the padding value "pad" is obtained along with the
maximum possible padding value "maxpad". If pad > maxpad then the data is
invalid. However we must continue anyway because this is constant time code.

We calculate the payload length like this:

    inp_len = len - (SHA_DIGEST_LENGTH + pad + 1);

However if pad is invalid then inp_len ends up -ve (actually large +ve
because it is a size_t).

Later we do this:

    /* verify HMAC */
    out += inp_len;
    len -= inp_len;

This ends up with "out" pointing before the buffer which is undefined
behaviour. Next we calculate "p" like this:

    unsigned char *p =
        out + len - 1 - maxpad - SHA256_DIGEST_LENGTH;

Because of the "out + len" term the -ve inp_len value is cancelled out
so "p" points to valid memory (although technically the pointer arithmetic
is undefined behaviour again).

We only ever then dereference "p" and never "out" directly so there is
never an invalid read based on the bad pointer - so there is no security
issue.

This commit fixes the undefined behaviour by ensuring we use maxpad in
place of pad, if the supplied pad is invalid.

With thanks to Brian Carpenter for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3832)

7 years agoAdd DRBG random method
Rich Salz [Tue, 27 Jun 2017 16:04:37 +0000 (12:04 -0400)]
Add DRBG random method

Ported from the last FIPS release, with DUAL_EC and SHA1 and the
self-tests removed.  Since only AES-CTR is supported, other code
simplifications were done.  Removed the "entropy blocklen" concept.

Moved internal functions to new include/internal/rand.h.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/3789)

7 years agoAdd some performance notes about early data
Matt Caswell [Tue, 18 Jul 2017 13:54:23 +0000 (14:54 +0100)]
Add some performance notes about early data

In particular add information about the effect of Nagle's algorithm on
early data.

Fixes #3906

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3955)

7 years agoRemove session checks from SSL_clear()
Matt Caswell [Tue, 18 Jul 2017 15:28:38 +0000 (16:28 +0100)]
Remove session checks from SSL_clear()

We now allow a different protocol version when reusing a session so we can
unconditionally reset the SSL_METHOD if it has changed.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/3954)

7 years agoAdd a test for SSL_clear()
Matt Caswell [Tue, 18 Jul 2017 10:34:47 +0000 (11:34 +0100)]
Add a test for SSL_clear()

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/3954)

7 years agoFix SSL_clear() in TLSv1.3
Matt Caswell [Tue, 18 Jul 2017 10:18:31 +0000 (11:18 +0100)]
Fix SSL_clear() in TLSv1.3

SSL_clear() does not reset the SSL_METHOD if a session already exists in
the SSL object. However, TLSv1.3 does not have an externally visible
version fixed method (only an internal one). The state machine assumes
that we are always starting from a version flexible method for TLSv1.3.
The simplest solution is to just fix SSL_clear() to always reset the method
if it is using the internal TLSv1.3 version fixed method.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/3954)

7 years agoTolerate a zero length ticket nonce
Matt Caswell [Tue, 18 Jul 2017 15:11:20 +0000 (16:11 +0100)]
Tolerate a zero length ticket nonce

TLSv1.3 draft-21 requires the ticket nonce to be at least 1 byte in length.
However NSS sends a zero length nonce. This is actually ok because the next
draft will allow zero length nonces anyway, so we should tolerate this.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3957)

7 years agoAdd a test for early_data when an HRR occurs
Matt Caswell [Fri, 14 Jul 2017 11:23:56 +0000 (12:23 +0100)]
Add a test for early_data when an HRR occurs

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3933)

7 years agoFix early_data with an HRR
Matt Caswell [Fri, 14 Jul 2017 13:50:48 +0000 (14:50 +0100)]
Fix early_data with an HRR

early_data is not allowed after an HRR. We failed to handle that
correctly.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3933)

7 years agoRSA_padding_check_PKCS1_type_2 is not constant time.
Emilia Kasper [Mon, 17 Jul 2017 14:47:13 +0000 (16:47 +0200)]
RSA_padding_check_PKCS1_type_2 is not constant time.

This is an inherent weakness of the padding mode. We can't make the
implementation constant time (see the comments in rsa_pk1.c), so add a
warning to the docs.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoRemove resolved TODO
Emilia Kasper [Thu, 13 Jul 2017 16:30:56 +0000 (18:30 +0200)]
Remove resolved TODO

Fixed in 5b8fa431ae8eb5a18ba913494119e394230d4b70

[ci skip]

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3924)

7 years agoFix bogus use of BIO_sock_should_retry.
Bernd Edlinger [Mon, 17 Jul 2017 09:51:19 +0000 (11:51 +0200)]
Fix bogus use of BIO_sock_should_retry.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3948)

7 years agoFix TLSv1.3 exporter secret
Tatsuhiro Tsujikawa [Sun, 16 Jul 2017 03:40:48 +0000 (12:40 +0900)]
Fix TLSv1.3 exporter secret

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3941)

7 years agoFix use-after-free
Rich Salz [Mon, 17 Jul 2017 06:52:26 +0000 (02:52 -0400)]
Fix use-after-free

Also fix a RANDerr call.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3947)

7 years agoFix some pedantic warnings.
Pauli [Mon, 17 Jul 2017 01:05:13 +0000 (11:05 +1000)]
Fix some pedantic warnings.

Introduced by #3862

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3944)

7 years agoStandardize apps use of -rand, etc.
Rich Salz [Wed, 5 Jul 2017 14:58:48 +0000 (10:58 -0400)]
Standardize apps use of -rand, etc.

Standardized the -rand flag and added a new one:
    -rand file...
            Always reads the specified files
    -writerand file
            Always writes to the file on exit

For apps that use a config file, the RANDFILE config parameter reads
the file at startup (to seed the RNG) and write to it on exit if
the -writerand flag isn't used.

Ensured that every app that took -rand also took -writerand, and
made sure all of that agreed with all the documentation.

Fix error reporting in write_file and -rand

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/3862)

7 years agoDon't use "version" in "OpenSSL Version 1.1.0" etc
Rich Salz [Sat, 15 Jul 2017 13:39:45 +0000 (09:39 -0400)]
Don't use "version" in "OpenSSL Version 1.1.0" etc

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/3938)

7 years agoAddress Coverity issues.
Pauli [Fri, 14 Jul 2017 00:08:38 +0000 (10:08 +1000)]
Address Coverity issues.

This patch addresses the use of uninitialised data raised in Coverity
issues 1414881 and 1414882.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3929)

7 years agosha/asm/keccak1600-avx2.pl: optimized remodelled version.
Andy Polyakov [Wed, 12 Jul 2017 14:02:42 +0000 (16:02 +0200)]
sha/asm/keccak1600-avx2.pl: optimized remodelled version.

New register usage pattern allows to achieve sligtly better
performance. Not as much as I hoped for. Performance is believed
to be limited by irreconcilable write-back conflicts, rather than
lack of computational resources or data dependencies.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agosha/asm/keccak1600-avx2.pl: remodel register usage.
Andy Polyakov [Wed, 12 Jul 2017 13:55:19 +0000 (15:55 +0200)]
sha/asm/keccak1600-avx2.pl: remodel register usage.

This gives much more freedom to rearrange instructions. This is
unoptimized version, provided for reference. Basically you need
to compare it to initial 29724d0e15b4934abdf2d7ab71957b05d1a28256
to figure out the key difference.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agotestutil: stanza files are text files, open them as such
Richard Levitte [Sat, 15 Jul 2017 16:20:24 +0000 (18:20 +0200)]
testutil: stanza files are text files, open them as such

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3939)

7 years agoOSSL_STORE "file" scheme loader: check that a DOS device is correctly named
Richard Levitte [Sat, 15 Jul 2017 09:21:11 +0000 (11:21 +0200)]
OSSL_STORE "file" scheme loader: check that a DOS device is correctly named

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3907)

7 years agoOSSL_STORE "file" scheme loader: check for absolute path in URI later
Richard Levitte [Wed, 12 Jul 2017 10:44:24 +0000 (12:44 +0200)]
OSSL_STORE "file" scheme loader: check for absolute path in URI later

If we have a local file with a name starting with 'file:', we don't
want to check if the part after 'file:' is absolute.  Instead, mark
each possibility for absolute check if needed, and perform the
absolute check later on, when checking each actual path.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3907)

7 years agotest/recipes/90-test_store.t: Add a few cases with files starting with 'file:'
Richard Levitte [Wed, 12 Jul 2017 10:42:16 +0000 (12:42 +0200)]
test/recipes/90-test_store.t: Add a few cases with files starting with 'file:'

These cases are performed on Linux only.  They check that files with
names starting with 'file:' can be processed as well.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3907)

7 years agoOSSL_STORE: Treat URIs as files first (with exceptions), then as full URIs
Richard Levitte [Tue, 11 Jul 2017 09:54:00 +0000 (11:54 +0200)]
OSSL_STORE: Treat URIs as files first (with exceptions), then as full URIs

To handle paths that contain devices (for example, C:/foo/bar.pem on
Windows), try to "open" the URI using the file scheme loader first,
and failing that, check if the device is really a scheme we know.

The "file" scheme does the same kind of thing to pick out the path
part of the URI.

An exception to this special treatment is if the URI has an authority
part (something that starts with "//" directly after what looks like a
scheme).  Such URIs will never be treated as plain file paths.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3907)

7 years agoOSSL_STORE: spell error reason correctly
Richard Levitte [Tue, 11 Jul 2017 09:46:14 +0000 (11:46 +0200)]
OSSL_STORE: spell error reason correctly

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3907)

7 years agotest/recipes/90-test_store.t: Test absolute files
Richard Levitte [Tue, 11 Jul 2017 07:51:04 +0000 (09:51 +0200)]
test/recipes/90-test_store.t: Test absolute files

We haven't tested plain absolute paths without making them URIs...

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3907)

7 years agotest/recipes/90-test_store.t: Rename some functions
Richard Levitte [Tue, 11 Jul 2017 07:48:08 +0000 (09:48 +0200)]
test/recipes/90-test_store.t: Rename some functions

to_rel_file_uri really treated all files appropriately, absolute and
relative alike, and really just constructs a URI, so gets renamed to
to_file_uri

to_file_uri, on the other hand, forces the path into an absolute one,
so gets renamed to to_abs_file_uri

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3907)

7 years agoStart to overhaul RAND API
Rich Salz [Thu, 22 Jun 2017 13:21:43 +0000 (09:21 -0400)]
Start to overhaul RAND API

Remove unused rand_hw_xor, MD/EVP indirection
Make rand_pseudo same as rand.
Cleanup formatting and ifdef control
Rename some things:
    - rand_meth to openssl_rand_meth; make it global
    - source file
    - lock/init functions, start per-thread state
    - ossl_meth_init to ossl_rand_init
Put state into RAND_STATE structure
And put OSSL_RAND_STATE into ossl_typ.h
Use "randomness" instead of "entropy"

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3758)

7 years agoFor Windows, use _stat rather than stat
Richard Levitte [Fri, 14 Jul 2017 04:33:16 +0000 (06:33 +0200)]
For Windows, use _stat rather than stat

This allows for better flexibility with mixed /M compiler flags

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3930)

7 years agoFix style in crypto/store/loader_file.c
Richard Levitte [Fri, 14 Jul 2017 04:30:45 +0000 (06:30 +0200)]
Fix style in crypto/store/loader_file.c

With added commenting to describe the individual decoders a little
more.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3930)

7 years agoUpdate PR#3925
Roelof duToit [Thu, 13 Jul 2017 18:09:19 +0000 (14:09 -0400)]
Update PR#3925

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3925)

7 years agoRetry SSL_read on ERROR_WANT_READ.
Roelof duToit [Thu, 13 Jul 2017 17:07:26 +0000 (13:07 -0400)]
Retry SSL_read on ERROR_WANT_READ.
This resolves the retry issue in general, but also the specific case where a TLS 1.3 server sends a post-handshake NewSessionTicket message prior to appdata.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3925)

7 years agoFix #946 Add -preserve_dates to x509 app
Todd Short [Fri, 20 Feb 2015 20:00:28 +0000 (15:00 -0500)]
Fix #946 Add -preserve_dates to x509 app

Add the -preserve_dates dates option to preserve dates when signing
a certificate.
Prevent -days and -preserve_dates being used simultaneously
Fixes #946

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/946)

7 years agoFix bug in err_string_data_cmp
Rich Salz [Sat, 8 Jul 2017 16:43:55 +0000 (12:43 -0400)]
Fix bug in err_string_data_cmp

Unsigned overflow.  Thanks to Brian Carpenter for reporting this.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3887)

7 years agoRemove trailing blanks.
Pauli [Thu, 13 Jul 2017 00:41:57 +0000 (10:41 +1000)]
Remove trailing blanks.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3918)

7 years agoTest cleaning and modernisation
Pauli [Wed, 12 Jul 2017 21:37:01 +0000 (07:37 +1000)]
Test cleaning and modernisation

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3917)

7 years agoChange return (x) to return x
Pauli [Wed, 12 Jul 2017 22:23:22 +0000 (08:23 +1000)]
Change return (x) to return x

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3912)

7 years agoAvoid having an unsigned integer decrement below zero.
Pauli [Tue, 11 Jul 2017 22:54:14 +0000 (08:54 +1000)]
Avoid having an unsigned integer decrement below zero.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3912)

7 years agoFix some issues raise by coverity in the tests.
Pauli [Wed, 5 Jul 2017 23:10:28 +0000 (09:10 +1000)]
Fix some issues raise by coverity in the tests.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3846)

7 years agoAdd sanity test for certificate table
Dr. Stephen Henson [Sat, 8 Jul 2017 18:28:15 +0000 (19:28 +0100)]
Add sanity test for certificate table

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3858)

7 years agoMove certificate table to header file so it can be tested.
Dr. Stephen Henson [Sat, 8 Jul 2017 11:11:59 +0000 (12:11 +0100)]
Move certificate table to header file so it can be tested.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3858)

7 years agoAdd additional ECDSA/Ed25519 selection tests.
Dr. Stephen Henson [Tue, 4 Jul 2017 12:07:22 +0000 (13:07 +0100)]
Add additional ECDSA/Ed25519 selection tests.

Add two tests with ECDSA+SHA256 preferred over Ed25519, the second also
excludes P-256 from the supported curves extension which will force the
use of Ed25519 in TLS 1.2, but not TLS 1.3: this would fail before the
certificate table updates.

Add TLS 1.3 test also with P-256 exclude from the groups extension: this
should have no effect as the groups extension is not used for signature
selection in TLS 1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3858)

7 years agoUse cert tables in ssl_set_sig_mask
Dr. Stephen Henson [Tue, 4 Jul 2017 10:38:23 +0000 (11:38 +0100)]
Use cert tables in ssl_set_sig_mask

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3858)

7 years agomake errors
Dr. Stephen Henson [Sat, 8 Jul 2017 22:16:09 +0000 (23:16 +0100)]
make errors

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3858)

7 years agoUse cert tables instead of X509_certificate_type
Dr. Stephen Henson [Thu, 29 Jun 2017 15:10:31 +0000 (16:10 +0100)]
Use cert tables instead of X509_certificate_type

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3858)

7 years agoUse certificate tables instead of ssl_cert_type
Dr. Stephen Henson [Thu, 29 Jun 2017 14:20:09 +0000 (15:20 +0100)]
Use certificate tables instead of ssl_cert_type

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3858)

7 years agoUse certificate tables instead of ssl_cipher_get_cert_index.
Dr. Stephen Henson [Thu, 29 Jun 2017 13:55:06 +0000 (14:55 +0100)]
Use certificate tables instead of ssl_cipher_get_cert_index.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3858)

7 years agoReplace tls12_get_pkey_idx
Dr. Stephen Henson [Wed, 28 Jun 2017 16:56:45 +0000 (17:56 +0100)]
Replace tls12_get_pkey_idx

The functiontls12_get_pkey_idx is only used to see if a certificate index is
enabled: call ssl_cert_is_disabled instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3858)

7 years agoAdd SSL_aCERT: this is used for any ciphersuite with a certificate.
Dr. Stephen Henson [Fri, 30 Jun 2017 17:57:42 +0000 (18:57 +0100)]
Add SSL_aCERT: this is used for any ciphersuite with a certificate.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3858)

7 years agoAdd certificate properties table.
Dr. Stephen Henson [Wed, 28 Jun 2017 16:45:10 +0000 (17:45 +0100)]
Add certificate properties table.

Add certificate table giving properties of each certificate index:
specifically the NID associated with the index and the the auth mask
value for any cipher the certificate can be used with.

This will be used to generalise certificate handling instead of hard coding
algorithm specific cases.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3858)

7 years agoDemo style fixes and modernisation.
Pauli [Wed, 12 Jul 2017 04:18:00 +0000 (14:18 +1000)]
Demo style fixes and modernisation.

Address some style issues in the demos and modernise the C.
Fix the exit/return from main handling.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3914)

7 years agocoding style: remove extra whitespace charactor
hongliang [Wed, 12 Jul 2017 02:51:00 +0000 (10:51 +0800)]
coding style: remove extra whitespace charactor

CLA: trivial

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3913)

7 years agoRewrite RAND_egd
Rich Salz [Sat, 8 Jul 2017 18:45:15 +0000 (14:45 -0400)]
Rewrite RAND_egd

Use stdio and its buffering.
Limit to 255 bytes (could remove that if neceessary).

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/3888)

7 years agoFix error handling in get_header_and_data.
Bernd Edlinger [Sun, 9 Jul 2017 19:24:18 +0000 (21:24 +0200)]
Fix error handling in get_header_and_data.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3896)

7 years agoFix crash in BUF_MEM_grow_clean.
Bernd Edlinger [Sun, 9 Jul 2017 19:22:26 +0000 (21:22 +0200)]
Fix crash in BUF_MEM_grow_clean.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3896)

7 years agoOptimize sha/asm/keccak1600-avx2.pl.
Andy Polyakov [Sat, 8 Jul 2017 14:06:49 +0000 (16:06 +0200)]
Optimize sha/asm/keccak1600-avx2.pl.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoAdd sha/asm/keccak1600-avx2.pl.
Andy Polyakov [Sat, 8 Jul 2017 14:05:30 +0000 (16:05 +0200)]
Add sha/asm/keccak1600-avx2.pl.

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 years agoTrivial bounds checking.
Pauli [Thu, 6 Jul 2017 04:56:20 +0000 (14:56 +1000)]
Trivial bounds checking.

Bounds checking strpy, strcat and sprintf.
These are the remaining easy ones to cover a recently removed commit.
Some are trivial, some have been modified and a couple left as they are because the reverted change didn't bounds check properly.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3871)

7 years agoFix cipher_compare
Richard Levitte [Sat, 8 Jul 2017 20:13:24 +0000 (22:13 +0200)]
Fix cipher_compare

Unsigned overflow.  Found by Brian Carpenter

Fixes #3889

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3890)

7 years agoUpdate various RAND podpages
Rich Salz [Fri, 7 Jul 2017 20:47:39 +0000 (16:47 -0400)]
Update various RAND podpages

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3883)

7 years agoFix s_client crash where the hostname is provided as a positional arg
Matt Caswell [Fri, 7 Jul 2017 14:51:02 +0000 (15:51 +0100)]
Fix s_client crash where the hostname is provided as a positional arg

If the hostname is provided as a positional arg then s_client crashes.
The crash occurs as s_client exits (after either a successful or
unsuccessful connection attempt).

This issue was introduced by commit 729ef85611.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3881)

7 years agoSome SSL_OP_ values can't be used in 1.1.x
Matt Caswell [Fri, 7 Jul 2017 13:43:21 +0000 (14:43 +0100)]
Some SSL_OP_ values can't be used in 1.1.x

SSL_OP_ALL was set in 0x0BFF so reusing some of these bits would cause
ABI compatibility issues.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3833)

7 years agoChoose a safer value for SSL_OP_ALLOW_NO_DHE_KEX
Matt Caswell [Fri, 7 Jul 2017 09:56:48 +0000 (10:56 +0100)]
Choose a safer value for SSL_OP_ALLOW_NO_DHE_KEX

1.1.0 included the previous value for SSL_OP_ALLOW_NO_DHE_KEX in
SSL_OP_ALL. This might cause binary compatibility issues. We should choose
a value that is not in SSL_OP_ALL.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3833)

7 years agoUpdate the documentation for the new SSL_OP_ALLOW_NO_DHE_KEX option
Matt Caswell [Mon, 3 Jul 2017 14:59:30 +0000 (15:59 +0100)]
Update the documentation for the new SSL_OP_ALLOW_NO_DHE_KEX option

Also the associated configuration parameters and command line switches.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3833)

7 years agoDo not allow non-dhe kex_modes by default
Matt Caswell [Fri, 30 Jun 2017 08:41:03 +0000 (09:41 +0100)]
Do not allow non-dhe kex_modes by default

Allow that mode to be configured if desired.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3833)

7 years agoUpdates following review feedback of TLSv1.3 draft-21 code
Matt Caswell [Fri, 7 Jul 2017 10:21:29 +0000 (11:21 +0100)]
Updates following review feedback of TLSv1.3 draft-21 code

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3852)

7 years agoUpdate SSL_trace() to know about ticket_nonce
Matt Caswell [Wed, 5 Jul 2017 10:31:51 +0000 (11:31 +0100)]
Update SSL_trace() to know about ticket_nonce

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3852)

7 years agoUpdate the early_secret generation to use the new ticket_nonce field
Matt Caswell [Wed, 5 Jul 2017 10:26:10 +0000 (11:26 +0100)]
Update the early_secret generation to use the new ticket_nonce field

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3852)

7 years agoUpdate the test/session.pem to have a tick_nonce value
Matt Caswell [Wed, 5 Jul 2017 10:24:30 +0000 (11:24 +0100)]
Update the test/session.pem to have a tick_nonce value

Otherwise the ClientHello test fails

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3852)

7 years agoUpdate tls13_hkdf_expand() to take the length of the data
Matt Caswell [Wed, 5 Jul 2017 10:23:16 +0000 (11:23 +0100)]
Update tls13_hkdf_expand() to take the length of the data

In most scenarios the length of the input data is the hashsize, or 0 if
the data is NULL. However with the new ticket_nonce changes the length can
be different.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3852)

7 years agoThe correct key length for a TLSv1.3 SHA384 ciphersuite is 48
Matt Caswell [Wed, 5 Jul 2017 09:45:02 +0000 (10:45 +0100)]
The correct key length for a TLSv1.3 SHA384 ciphersuite is 48

Our test was using 32. The latest ticket nonce changes now validate this
value and so sslapitest was failing.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3852)

7 years agoSend and receive the ticket_nonce field in a NewSessionTicket
Matt Caswell [Wed, 5 Jul 2017 07:45:46 +0000 (08:45 +0100)]
Send and receive the ticket_nonce field in a NewSessionTicket

This just adds the processing for sending and receiving the newly added
ticket_nonce field. It doesn't actually use it yet.

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3852)

7 years agoUpdate the version number for TLSv1.3 draft 21
Matt Caswell [Tue, 4 Jul 2017 10:02:02 +0000 (11:02 +0100)]
Update the version number for TLSv1.3 draft 21

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3852)