Add EVP_PKEY_get0_hmac() function

Before the addition of this function, it was impossible to read the
symmetric key from an EVP_PKEY_HMAC type EVP_PKEY.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1217)

Revert "RT4526: Call TerminateProcess, not ExitProcess"

This reverts commit 9c1a9ccf65d0ea1912675d3a622fa8e51b524b9e.

TerminateProcess is asynchronous, so the code as written in the above
commit is not correct. It is also probably not needed in the speed
case. Reverting in order to figure out the correct solution.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Skip the TLSProxy tests if environmental problems are an issue

On some platforms we can't startup the TLSProxy due to environmental
problems (e.g. network set up on the build machine). These aren't OpenSSL
problems so we shouldn't treat them as test failures. Just visibly
indicate that we are skipping the test.

We only skip the first time we attempt to start up the proxy. If that works
then everything else should do...if not we should probably investigate and
so report as a failure.

This also removes test_networking...there is a danger that this turns into
a test of user's environmental set up rather than OpenSSL.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix the build and tests following constification of DH, DSA, RSA

Misc fixes following the constification of the DH, DSA and RSA
getters.

Reviewed-by: Stephen Henson <steve@openssl.org>

Change the return type of EVP_EncodeUpdate

Previously EVP_EncodeUpdate returned a void. However there are a couple
of error conditions that can occur. Therefore the return type has been
changed to an int, with 0 indicating error and 1 indicating success.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Deal with the consequences of constifying getters

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Constify the parameter getters for RSA, DSA and DH

Including documentation changes

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

RT4526: Call TerminateProcess, not ExitProcess

Reviewed-by: Richard Levitte <levitte@openssl.org>

Constify input buffers of some X509V3 and X509_PURPOSE -related methods

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Constify X509_TRUST_add method.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Constify asn1/asn_mime.c

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Constify some input buffers in asn1

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Constify CMS_get0_type input

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Constify UI

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Constify PKCS12_create, PKCS12_add_key, PKCS12_add_safe.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Constify some conf_mod.c internal methods

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)

Change (!seqtt) to (seqtt == NULL)

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Always check that the value returned by asn1_do_adb() is non-NULL

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

perlasm/x86*.pl: add endbranch instruction.

For further information see "Control-flow Enforcement Technology
Preview" by Intel.

Reviewed-by: Rich Salz <rsalz@openssl.org>

modes/asm/ghashp8-ppc.pl: improve performance by 2.7x.

Reviewed-by: Rich Salz <rsalz@openssl.org>

aes/asm/aesp8-ppc.pl: implement "tweak chaining".

This is useful in Linux kernel context, in cases data happens
to be fragmented and processing can take multiple calls.

Reviewed-by: Rich Salz <rsalz@openssl.org>

test/evptests.txt: add more XTS tests.

Reviewed-by: Rich Salz <rsalz@openssl.org>

evp/e_aes.c: wire hardware-assisted XTS subroutines.

Reviewed-by: Rich Salz <rsalz@openssl.org>

aes/asm/aesp8-ppc.pl: add XTS subroutines.

Reviewed-by: Rich Salz <rsalz@openssl.org>

(Temporarily) don't download clang package

Reviewed-by: Emilia Käsper <emilia@openssl.org>

perlasm/x86_64-xlate.pl: add commentary.

Reviewed-by: Rich Salz <rsalz@openssl.org>

perlasm/x86_64-xlate.pl: refactor argument parsing loop.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Make x86_64-xlate.pl 'use strict' clean.

use strict would have caught a number of historical bugs in the perlasm
code, some in the repository and some found during review. It even found
a fresh masm-only bug (see below).

This required some tweaks. The "single instance is enough" globals got
switched to proper blessed objects rather than relying on symbolic refs.
A few types need $opcode passed in as a result.

The $$line thing is a little bit of a nuisance. There may be a clearer
pattern to use instead.

This even a bug in the masm code.
9b634c9b37afc482a8dc8868e367bdd1b650e507 added logic to make labels
global or function-global based on whether something starts with a $,
seemingly intended to capture the $decor setting of '$L$'. However, it
references $ret which is not defined in label::out. label::out is always
called after label::re, so $ret was always the label itself, so the line
always ran.

I've removed the regular expression so as not to change the behavior of
the script. A number of the assembly files now routinely jump across
functions, so this seems to be the desired behavior now.

GH#1165

Signed-off-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

VMS: use BLDDIR rather than BUILDDIR in descrip.mms.tmpl

Just like in the other build file templates

Reviewed-by: Rich Salz <rsalz@openssl.org>

Add a developer target 'build_generated' to rebuild mandatory headers

Reviewed-by: Rich Salz <rsalz@openssl.org>

Build file templates: make sure to depend on generated header files

As well as properly generating those that are made from .in files.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Move the Configure generated header files to the top build.info

This turns these headers into build file generated ones.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Configure: Make it possible to generate mandatory header files

'DEPEND[]=file.h' becomes a special way to say that 'file.h' must be
generated before anything else is built.  It's likely that a number
of source files depend on these header files, this provides a simple
way to make sure they are always generated even it the dependency data
hasn't been added to the build file yet.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix omitted selector handling.

The selector field could be omitted because it has a DEFAULT value.
In this case *sfld == NULL (sfld can never be NULL). This was not
noticed because this was never used in existing ASN.1 modules.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Update fuzz corpora

Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #2949

Initialize the session_id

ssl_session_hash() always looks at the first 4 bytes, regardless of the length.
A client can send a session id that's shorter, and the callback could also
generate one that's shorter.  So we make sure that the rest of the buffer is
initliazed to 0 so that we always calculate the same hash.

Found by tis-interpreter, also previously reported as RT #2871

Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #2911

Remove an unused variable assignment

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT4562: Fix misleading doc on OPENSSL_config

Also changed the code to use "appname" not "filename"

Reviewed-by: Matt Caswell <matt@openssl.org>

Free memory on an error path

The function a2i_ASN1_STRING can encounter an error after already
allocating a buffer. It wasn't always freeing that buffer on error.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Avoid a double-free in crl2pl7

The variable |crtflst| could get double freed in an error path.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Add missing break statement

The -psk option processing was falling through to the -srp option
processing in the ciphers app.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix comment

Fix a comment following commit c2c49969e23605.

RT2388

Reviewed-by: Rich Salz <rsalz@openssl.org>

make update

Reviewed-by: Rich Salz <rsalz@openssl.org>

Shorten some symbol names

VMS C doesn't allow symbols longer than 31 characters.  We do the
automatic shortening with the library files, but not otherwise (to
make sure to work the VMS C magic).

For consistency, I shortened other similar symbols in the same manner.

Reviewed-by: Rich Salz <rsalz@openssl.org>

GH1141: Different fix, preferred by Richard.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3454: Re-enable nistp-64_gcc_128 on windows

Reviewed-by: Andy Polyakov <appro@openssl.org>

Missed some copyright merge

Reviewed-by: Tim Hudson <tjh@openssl.org>

Ensure that NULL r and s parameters cannot be set on DSA_SIG/ECDSA_SIGs.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1193)

Forgot to update the setter argument ordering in the public headers.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1193)

Reorder the setter arguments to more consistently match that of other APIs,
per review comments.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1193)

Implement DSA_SIG_set0() and ECDSA_SIG_set0(), for setting signature values.

SSH2 implementations which use DSA_do_verify() and ECDSA_do_verify() are given
the R and S values, and the data to be signed, by the client.  Thus in order
to validate these signatures, SSH2 implementations will digest and sign
the data -- and then pass in properly provisioned DSA_SIG and ECDSA_SIG objects.

Unfortunately, the existing OpenSSL-1.1.0 APIs do not allow for directly setting
those R and S values in these objects, which makes using OpenSSL for such
SSH2 implementations much more difficult.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1193)

Add some missing return value checks

Some misc return value checks

Reviewed-by: Rich Salz <rsalz@openssl.org>

Update sslapitest to use the test framework

Reviewed-by: Rich Salz <rsalz@openssl.org>

Update the SSL_set_session() documentation

Update the SSL_set_session() documentation to reflect the fact that old
bad sessions are removed from the cache if necessary.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Add some session API tests

This commit adds some session API tests, and in particular tests the
modified behaviour of SSL_set_session() introduced in the last commit. To
do this I have factored out some common code from the asynciotest into a
new ssltestlib.c file. I've also renamed getsettest to sslapitest as this
more closely matches what it now is!

Reviewed-by: Rich Salz <rsalz@openssl.org>

Ensure SSL_set_session clears the old session from cache if it is bad

SSL_clear() and SSL_free() will remove a session from the cache if it is
considered "bad". However SSL_set_session() does not do this for the session
it is replacing.

SSL_clear() clears an SSL object ready for reuse. It does not clear the
session though. This means that:

  SSL_clear(s)
  SSL_set_session(s, sess);

and
  SSL_set_session(s, sess);
  SSL_clear(s);

do not do the same thing, although logically you would expect that they
would.

The failure of SSL_set_session() to remove bad sessions from the cache
should be considered a bug, so this commit fixes it.

RT#597

Reviewed-by: Rich Salz <rsalz@openssl.org>

SSL test: only write out server2 when testing SNI

The SNI tests introduced a redundant "server2" section into every test
configuration. Copy this automatically from "server" unless testing SNI,
to reduce noise in the generated confs.

Also remove duplicate SSL_TEST_CTX_create (merge conflict error).

Reviewed-by: Rich Salz <rsalz@openssl.org>

Handle inability to create AFALG socket

Some Linux platforms have a suitably recent kernel to support AFALG, but
apparently you still can't actually create an afalg socket. This extends
the afalg_chk_platform() function to additionally check whether we can
create an AFALG socket. We also amend the afalgtest to not report a
failure to load the engine as a test failure. A failure to load is almost
certainly due to platform environmental issues, and not an OpenSSL problem.

RT 4434

Reviewed-by: Andy Polyakov <appro@openssl.org>

Port DTLS version negotiation tests

Reviewed-by: Rich Salz <rsalz@openssl.org>

Clean up following new SNI tests

- Only send SNI in SNI tests. This allows us to test handshakes without
  the SNI extension as well.
- Move all handshake-specific machinery to handshake_helper.c
- Use enum types to represent the enum everywhere
  (Resorting to plain ints can end in sign mismatch when the enum is
  represented by an unsigned type.)

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT3809: basicConstraints is critical

This is really a security bugfix, not enhancement any more.
Everyone knows critical extensions.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

bn/bn_add.c: favour counted loops over ifs and breaks.

Reviewed-by: Rich Salz <rsalz@openssl.org>

doc/crypto/OPENSSL_ia32cap.pod update.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Don't skip leading zeroes in PSK keys.

Don't use BN_hex2bn() for PSK key conversion as the conversion to
BN and back removes leading zeroes, use OPENSSL_hexstr2buf() instead.

RT#4554

Reviewed-by: Matt Caswell <matt@openssl.org>

RT2759: Don't read TTY when already at EOF.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Avoid memory leaks if options repeated.

Reviewed-by: Andy Polyakov <appro@openssl.org>

RT3053: Check for NULL before dereferencing

Reviewed-by: Tim Hudson <tjh@openssl.org>

Ensure that the EVP_MD_meth_new docs properly match the declared functions;
it looks like these names have shifted a little over time.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1203)

Avoid creating illegal pointers

Found by tis-interpreter

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1179

include stdlib for malloc() and free()

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1174

Don't compare a just free()d pointer

Found by tis-interpreter

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1173

Specify array sizes

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1172

Avoid creating an illegal pointer.

Found by tis-interpreter

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1166

Avoid creating an illegal pointer

Found by tis-interpreter

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1164

Fix an error path leak in int X509_ATTRIBUTE_set1_data()

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix an error path leak in do_ext_nconf()

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix seg fault in TS_RESP_verify_response()

The TS_RESP_verify_response() function is used for verifying the response
from a TSA. You can set the provided TS_VERIFY_CTX with different flags
depending on what aspects of the response you wish to verify.

A seg fault will occur if you supply the TS_VFY_SIGNER or TS_VFY_TSA_NAME
flags without also specifying TS_VFY_SIGNATURE.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix no-dtls* builds

Most of the no-dtls* builds were failing due to one test which had an
incorrect "skip" condition.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Expand SSL_CTX_set_default_verify_paths() documentation

Add some information about the location of the default directory and the
default file.

RT#1051

Reviewed-by: Andy Polyakov <appro@openssl.org>

GH1183: Fix -unix and -connect, etc., override

If a user specifies -unix, -6, etc., then the program tries to
use the last one specified.  This is confusing code and leads to
scripting errors.  Instead, allow only one type.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Omit corpora from tarball.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Make corpora binary.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Add fuzz corpora.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3720 Increment session miss counter properly

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

RT 4242: reject invalid EC point coordinates

We already test in EC_POINT_oct2point that points are on the curve. To
be on the safe side, move this check to
EC_POINT_set_affine_coordinates_* so as to also check point coordinates
received through some other method.

We do not check projective coordinates, though, as
- it's unlikely that applications would be receiving this primarily
  internal representation from untrusted sources, and
- it's possible that the projective setters are used in a setting where
  performance matters.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Make a2i_ipadd an internal function

Reviewed-by: Richard Levitte <levitte@openssl.org>

More API docs; small changes.

Also fix typo noted on GitHub.
Suppport typedef and #define to find-doc-nits

Reviewed-by: Richard Levitte <levitte@openssl.org>

Clean up "generic" intro pod files.

Files like dh.pod, etc., mostly duplicated the API-specific pod files.
Removed the duplicated content; that often mean the whole file could
be removed.  Some of the content about internals got moved into README
files in the source tree.  Some content (e.g., err.pod) got moved
into other pod pages.

Annotate generic pages, remove dup NAME

Reviewed-by: Richard Levitte <levitte@openssl.org>

Write X509_dup, PEM_read, etc.

Partially document the ASN1 template stuff, and its use for i2d/d2i
and PEM I/O.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Docs: install generic manpages to man section 7

Reviewed-by: Rich Salz <rsalz@openssl.org>

hmac/hmac.c: fix sizeof typo in hmac_ctx_cleanup.

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix session ticket and SNI

When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.

However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:

1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.

To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.

Fix these two cases, and add unit test code to validate ticket behavior.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)

Fixes to get -ansi working

Various fixes to get the following to compile:

./config no-asm -ansi -D_DEFAULT_SOURCE

RT4479
RT4480

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Add some accessor API's

GH1098: Add X509_get_pathlen() (and a test)
GH1097:  Add SSL_is_dtls() function.

Documented.

Reviewed-by: Matt Caswell <matt@openssl.org>

crypto/x509/x509_vpm.c: Simplify int_x509_param_set1()

This change also avoids calling strlen twice when srclen is 0

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Always use session_ctx when removing a session

Sessions are stored on the session_ctx, which doesn't change after
SSL_set_SSL_CTX().

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Fix some typos in pod files

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1189)

Ignore tsget.pl and c_rehash.pl, as well as other compiler generated files

Reviewed-by: Matt Caswell <matt@openssl.org>

Add empty record tests

The previous commit changed how we handle out-of-context empty records.
This commit adds some tests for the various scenarios. There are three
tests:
1: Check that if we inject an out-of-context empty record then we fail
2: Check that if we inject an in-context empty record then we succeed
3: Check that if we inject too many in-context empty records then we fail.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Reject out of context empty records

Previously if we received an empty record we just threw it away and
ignored it. Really though if we get an empty record of a different content
type to what we are expecting then that should be an error, i.e. we should
reject out of context empty records. This commit makes the necessary changes
to achieve that.

RT#4395

Reviewed-by: Andy Polyakov <appro@openssl.org>