oweals/openssl.git
8 years agoVMS: add [.util]shlib_wrap.exe and its build instructions
Richard Levitte [Tue, 20 Sep 2016 23:47:06 +0000 (01:47 +0200)]
VMS: add [.util]shlib_wrap.exe and its build instructions

This is a program for VMS that corresponds to util/shlib_wrap.sh.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agodescrip.mms.tmpl: in obj2bin, make sure an empty @deps means no empty lines
Richard Levitte [Tue, 20 Sep 2016 23:49:53 +0000 (01:49 +0200)]
descrip.mms.tmpl: in obj2bin, make sure an empty @deps means no empty lines

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoutil/dofile.pl: report if a template couldn't be loaded
Richard Levitte [Tue, 20 Sep 2016 23:49:04 +0000 (01:49 +0200)]
util/dofile.pl: report if a template couldn't be loaded

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoQuiet compiler warning about uninitialised variable
Richard Levitte [Tue, 20 Sep 2016 19:48:24 +0000 (21:48 +0200)]
Quiet compiler warning about uninitialised variable

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRT3669: dgst can only sign/verify one file.
Rich Salz [Fri, 2 Sep 2016 21:34:31 +0000 (17:34 -0400)]
RT3669: dgst can only sign/verify one file.

Check arg count and print an error message.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoapps/apps.c: include sys/socket.h to declare recv()
Richard Levitte [Tue, 20 Sep 2016 16:43:24 +0000 (18:43 +0200)]
apps/apps.c: include sys/socket.h to declare recv()

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoDocumentation fixup; no more ECDHParameters
Richard Levitte [Sun, 18 Sep 2016 21:52:30 +0000 (23:52 +0200)]
Documentation fixup; no more ECDHParameters

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoCrude VMS build files for demos/bio/
Richard Levitte [Thu, 8 Sep 2016 23:53:38 +0000 (01:53 +0200)]
Crude VMS build files for demos/bio/

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoCrude Makefile for demos/bio/
Richard Levitte [Thu, 8 Sep 2016 23:01:30 +0000 (01:01 +0200)]
Crude Makefile for demos/bio/

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDon't ignore Makefiles in demos/
Richard Levitte [Thu, 8 Sep 2016 23:01:15 +0000 (01:01 +0200)]
Don't ignore Makefiles in demos/

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFixup BIO demos for OpenSSL 1.1.x
Richard Levitte [Fri, 9 Sep 2016 07:32:00 +0000 (09:32 +0200)]
Fixup BIO demos for OpenSSL 1.1.x

Call SSL_CTX_new() before doing any configuration.
(or call OPENSSL_ssl_init())

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFixup BIO demos for OpenSSL 1.1.x
Richard Levitte [Thu, 8 Sep 2016 22:59:00 +0000 (00:59 +0200)]
Fixup BIO demos for OpenSSL 1.1.x

'ECDHParameters = Automatic' isn't accepted.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFixup BIO demos for OpenSSL 1.1.x
Richard Levitte [Thu, 8 Sep 2016 22:58:21 +0000 (00:58 +0200)]
Fixup BIO demos for OpenSSL 1.1.x

Note: server-cmod doesn't seem to do things right...  from loading
cmod.cnf, it tries to load libssl_conf.so.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConvert WPACKET_put_bytes to use convenience macros
Matt Caswell [Tue, 20 Sep 2016 13:47:44 +0000 (14:47 +0100)]
Convert WPACKET_put_bytes to use convenience macros

All the other functions that take an argument for the number of bytes
use convenience macros for this purpose. We should do the same with
WPACKET_put_bytes().

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConvert CCS construction to WPACKET
Matt Caswell [Tue, 20 Sep 2016 11:26:46 +0000 (12:26 +0100)]
Convert CCS construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConvert Finished construction to WPACKET
Matt Caswell [Tue, 20 Sep 2016 11:19:18 +0000 (12:19 +0100)]
Convert Finished construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoStyle tweaks following review feedback
Matt Caswell [Tue, 20 Sep 2016 09:16:15 +0000 (10:16 +0100)]
Style tweaks following review feedback

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConvert NextProto message construction to WPACKET
Matt Caswell [Wed, 14 Sep 2016 11:10:33 +0000 (12:10 +0100)]
Convert NextProto message construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConvert Certificate message construction to WPACKET
Matt Caswell [Wed, 14 Sep 2016 10:41:27 +0000 (11:41 +0100)]
Convert Certificate message construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConvert ClientVerify Construction to WPACKET
Matt Caswell [Wed, 14 Sep 2016 10:10:37 +0000 (11:10 +0100)]
Convert ClientVerify Construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRemove an option related to a deprecated flag
FdaSilvaYY [Sat, 17 Sep 2016 19:29:48 +0000 (21:29 +0200)]
Remove an option related to a deprecated flag

CMS_NOOLDMIMETYPE and PKCS7_NOOLDMIMETYPE  are unused in pkcs7/cms code.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1585)

8 years agoFix various missing option help messages ...
FdaSilvaYY [Sun, 31 Jul 2016 17:02:50 +0000 (19:02 +0200)]
Fix various missing option help messages ...

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1585)

8 years agoConvert num_alloc to a size_t in stack.c and tweak style
Matt Caswell [Thu, 8 Sep 2016 10:06:29 +0000 (11:06 +0100)]
Convert num_alloc to a size_t in stack.c and tweak style

We were casting num_alloc to size_t in lots of places, or just using it in
a context where size_t makes more sense - so convert it. This simplifies
the code a bit.

Also tweak the style in stack.c a bit following on from the previous
commit

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoPrevent overflows in stack API
Guido Vranken [Thu, 8 Sep 2016 09:43:37 +0000 (10:43 +0100)]
Prevent overflows in stack API

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoUpdate INSTALL about no-md5 removal
FdaSilvaYY [Mon, 12 Sep 2016 20:42:37 +0000 (22:42 +0200)]
Update INSTALL about no-md5 removal

no-rsa is no longer an option since 7ec8de1

Fix a typo about poly1305

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1582)

8 years agoFix no-ocsp
Richard Levitte [Mon, 19 Sep 2016 13:08:58 +0000 (15:08 +0200)]
Fix no-ocsp

Some compilers complain about unused variables, and some tests do
not run well without OCSP.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConstify code about X509_VERIFY_PARAM
FdaSilvaYY [Thu, 15 Sep 2016 19:37:14 +0000 (21:37 +0200)]
Constify code about X509_VERIFY_PARAM

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1594)

8 years agoHave the configuration options 'no-err' and 'no-async' work again
Richard Levitte [Sat, 17 Sep 2016 19:57:29 +0000 (21:57 +0200)]
Have the configuration options 'no-err' and 'no-async' work again

In an earlier attempt to simplify the processing of disabled options,
'no-err' and 'no-async' stopped working properly.  'err' and 'async'
are directories under 'crypto/', but they are special insofar that
they can't be simply skipped, like all the algorithm directories can,
so they need special treatment among the disablable things.

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoSimplify configudata.pm dependency generation
Richard Levitte [Sat, 17 Sep 2016 18:50:56 +0000 (20:50 +0200)]
Simplify configudata.pm dependency generation

While we're at it, correct the fault in windows-makefile.tmpl

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoRemove an useless definition.
FdaSilvaYY [Thu, 15 Sep 2016 18:33:18 +0000 (20:33 +0200)]
Remove an useless definition.

APP_INFO is currently a field of MEM struct.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1583)

8 years agoUse switch instead of multiple ifs
Alessandro Ghedini [Tue, 13 Sep 2016 23:51:02 +0000 (00:51 +0100)]
Use switch instead of multiple ifs

Makes the logic a little bit clearer.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1571)

8 years agoSimplify the dependencies for remaking configdata.pm
Richard Levitte [Thu, 15 Sep 2016 21:56:03 +0000 (23:56 +0200)]
Simplify the dependencies for remaking configdata.pm

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoRearrange the storage of build file template names in %config
Richard Levitte [Thu, 15 Sep 2016 21:55:24 +0000 (23:55 +0200)]
Rearrange the storage of build file template names in %config

They are now relative paths as well

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoUse the registered conf file names as dependencies to build configdata.pm
Richard Levitte [Wed, 14 Sep 2016 20:22:20 +0000 (22:22 +0200)]
Use the registered conf file names as dependencies to build configdata.pm

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoRegister the name of the config file each config target was found in
Richard Levitte [Wed, 14 Sep 2016 20:21:41 +0000 (22:21 +0200)]
Register the name of the config file each config target was found in

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoRevert "Abort on unrecognised warning alerts"
Matt Caswell [Thu, 15 Sep 2016 19:43:16 +0000 (20:43 +0100)]
Revert "Abort on unrecognised warning alerts"

This reverts commit 77a6be4dfc2ecf406c2559a99bea51317ce0f533.

There were some unexpected side effects to this commit, e.g. in SSLv3 a
warning alert gets sent "no_certificate" if a client does not send a
Certificate during Client Auth. With the above commit this causes the
connection to abort, which is incorrect. There may be some other edge cases
like this so we need to have a rethink on this.

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoFinally, make sure vms_term_sock.c is built on VMS
Richard Levitte [Wed, 14 Sep 2016 21:40:27 +0000 (23:40 +0200)]
Finally, make sure vms_term_sock.c is built on VMS

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRefactor to avoid unnecessary preprocessor logic
Richard Levitte [Thu, 15 Sep 2016 09:20:18 +0000 (11:20 +0200)]
Refactor to avoid unnecessary preprocessor logic

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoReformat to fit OpenSSL source code standards
Richard Levitte [Wed, 14 Sep 2016 18:54:30 +0000 (20:54 +0200)]
Reformat to fit OpenSSL source code standards

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd copyright and license on apps/vms_term_sock.[ch]
Richard Levitte [Wed, 14 Sep 2016 18:52:03 +0000 (20:52 +0200)]
Add copyright and license on apps/vms_term_sock.[ch]

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoVSI submission: redirect terminal input through socket
Richard Levitte [Wed, 3 Aug 2016 19:16:43 +0000 (21:16 +0200)]
VSI submission: redirect terminal input through socket

This is needed, because on VMS, select() can only be used on sockets.  being
able to use select() on all kinds of file descriptors is unique to Unix.

So, the solution for VMS is to create a layer that translates input from
standard input to socket communication.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMake reference to other manpage more explicit
Rich Salz [Wed, 14 Sep 2016 15:13:57 +0000 (11:13 -0400)]
Make reference to other manpage more explicit

Where -curves, etc., are defined: SSL_CONF_cmd

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoGH1536: Install empty CT log list
Rich Salz [Fri, 9 Sep 2016 22:05:41 +0000 (18:05 -0400)]
GH1536: Install empty CT log list

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoVMS: Really don't force symbol mixed case when building DSOs
Richard Levitte [Wed, 14 Sep 2016 15:49:21 +0000 (17:49 +0200)]
VMS: Really don't force symbol mixed case when building DSOs

This is an amendment to the september 8 commit titled "VMS: Don't
force symbol mixed case when building DSOs"

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRather than one variable for each passwd type, use one enum variable
Richard Levitte [Wed, 14 Sep 2016 03:06:56 +0000 (05:06 +0200)]
Rather than one variable for each passwd type, use one enum variable

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoTest the new SHA256 and SHA512 based password generation options
Richard Levitte [Wed, 14 Sep 2016 02:07:36 +0000 (04:07 +0200)]
Test the new SHA256 and SHA512 based password generation options

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoDocument the new SHA256 and SHA512 password generation options
Richard Levitte [Wed, 14 Sep 2016 02:07:04 +0000 (04:07 +0200)]
Document the new SHA256 and SHA512 password generation options

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd SHA256 and SHA512 based output for 'openssl passwd'
Richard Levitte [Wed, 14 Sep 2016 01:52:40 +0000 (03:52 +0200)]
Add SHA256 and SHA512 based output for 'openssl passwd'

RT#4674 issue 2

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd -h and -help for c_rehash script and app
Rich Salz [Mon, 12 Sep 2016 15:29:22 +0000 (11:29 -0400)]
Add -h and -help for c_rehash script and app

Resolves GH1515 and GH1509.

Reviewed-by: Matt Caswell <matt@openssl.org>
8 years agoFix OCSP_RESPID processing bug introduced by WPACKET changes
Matt Caswell [Tue, 13 Sep 2016 22:59:11 +0000 (23:59 +0100)]
Fix OCSP_RESPID processing bug introduced by WPACKET changes

An OCSP_RESPID in a status request extension has 2 bytes for the length
not 1.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd some sanity checks around usage of t_fromb64()
Matt Caswell [Thu, 8 Sep 2016 13:32:27 +0000 (14:32 +0100)]
Add some sanity checks around usage of t_fromb64()

The internal SRP function t_fromb64() converts from base64 to binary. It
does not validate that the size of the destination is sufficiently large -
that is up to the callers. In some places there was such a check, but not
in others.

Add an argument to t_fromb64() to provide the size of the destination
buffer and validate that we don't write too much data. Also add some sanity
checks to the callers where appropriate.

With thanks to Shi Lei for reporting this issue.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoEncourage use of the macros for the various "sub" functions
Matt Caswell [Tue, 13 Sep 2016 14:42:12 +0000 (15:42 +0100)]
Encourage use of the macros for the various "sub" functions

Don't call WPACKET_sub_memcpy(), WPACKET_sub_allocation_bytes() and
WPACKET_start_sub_packet_len() directly.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMake wpackettest conform to style rules
Matt Caswell [Tue, 13 Sep 2016 13:17:09 +0000 (14:17 +0100)]
Make wpackettest conform to style rules

Remove extra indentation at the start of an "if".

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd a WPACKET_sub_allocate_bytes() function
Matt Caswell [Tue, 13 Sep 2016 10:32:52 +0000 (11:32 +0100)]
Add a WPACKET_sub_allocate_bytes() function

Updated the construction code to use the new function. Also added some
convenience macros for WPACKET_sub_memcpy().

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConvert CKE construction to use the WPACKET API
Matt Caswell [Tue, 13 Sep 2016 10:01:04 +0000 (11:01 +0100)]
Convert CKE construction to use the WPACKET API

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd a test for 'openssl passwd'
Richard Levitte [Tue, 13 Sep 2016 21:23:51 +0000 (23:23 +0200)]
Add a test for 'openssl passwd'

Also, enlarge test group 20 to include openssl commands that aren't
tested otherwise

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix 'openssl passwd' with arguments -1 or -apr1
Richard Levitte [Tue, 13 Sep 2016 20:48:35 +0000 (22:48 +0200)]
Fix 'openssl passwd' with arguments -1 or -apr1

RT#4674

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix some magic values about revocation info type...
FdaSilvaYY [Sat, 6 Aug 2016 12:19:03 +0000 (14:19 +0200)]
Fix some magic values about revocation info type...

Add comments, document -valid option.
Add some const qualifiers.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1560)

8 years agoAdd --missing-help to list command
Rich Salz [Sat, 10 Sep 2016 19:46:48 +0000 (15:46 -0400)]
Add --missing-help to list command

Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoRemove -xtarget=ultra from solaris(64)-sparcv9-cc builds.
Andy Grundman [Tue, 30 Aug 2016 21:25:10 +0000 (17:25 -0400)]
Remove -xtarget=ultra from solaris(64)-sparcv9-cc builds.

This flag got moved after -xarch=v9 in 1.1.0 and had the unexpected
side effect of the compiler building for 32-bit v8plusa instead of v9.

GH#1521
CLA: none; trivial

Signed-off-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agobio.h: fix number of arguments passed to BIO_ptr_ctrl()
Viktor Szakats [Tue, 30 Aug 2016 16:56:49 +0000 (18:56 +0200)]
bio.h: fix number of arguments passed to BIO_ptr_ctrl()
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1520)

8 years agos_client: avoid warning on Windows/MS-DOS systems
Viktor Szakats [Tue, 30 Aug 2016 01:01:16 +0000 (03:01 +0200)]
s_client: avoid warning on Windows/MS-DOS systems

it appears when using gcc/mingw:
```
apps/s_client.c:815:9: warning: variable 'at_eof' set but not used [-Wunused-but-set-variable]
     int at_eof = 0;
         ^~~~~~
```
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1512)

8 years agoConfigure: detect gcc's dependency generation capability more accurately.
Andy Polyakov [Sat, 10 Sep 2016 19:12:56 +0000 (21:12 +0200)]
Configure: detect gcc's dependency generation capability more accurately.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agobn/bn_lcl.h: improve interoperability with clang and Android NDK.
Andy Polyakov [Sat, 10 Sep 2016 16:57:14 +0000 (18:57 +0200)]
bn/bn_lcl.h: improve interoperability with clang and Android NDK.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConfigure: impose ^X on whole build procedure.
Andy Polyakov [Fri, 9 Sep 2016 21:45:57 +0000 (23:45 +0200)]
Configure: impose ^X on whole build procedure.

Traditionally Configure passed $ENV{PERL} to Makefile. But this
resulted in ambiguilty as Configure script could be executed by
interpreter different from one executing remaining scripts. Since
we separate compile- and run-time interpreters with HASHBANGPERL
variable, there is no reason to segment the build procedure.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAbort on unrecognised warning alerts
Matt Caswell [Mon, 12 Sep 2016 10:04:51 +0000 (11:04 +0100)]
Abort on unrecognised warning alerts

A peer continually sending unrecognised warning alerts could mean that we
make no progress on a connection. We should abort rather than continuing if
we receive an unrecognised warning alert.

Thanks to Shi Lei for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFix a few style nits in the wpacket code
Matt Caswell [Tue, 13 Sep 2016 08:40:38 +0000 (09:40 +0100)]
Fix a few style nits in the wpacket code

Addressing more feedback comments.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRemove else after a return in packet code
Matt Caswell [Mon, 12 Sep 2016 08:41:01 +0000 (09:41 +0100)]
Remove else after a return in packet code

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoPull out some common packet code into a function
Matt Caswell [Mon, 12 Sep 2016 08:39:10 +0000 (09:39 +0100)]
Pull out some common packet code into a function

Two locations had the same loop for writing out a value. Pull it out into
a function.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd some soft asserts where applicable
Matt Caswell [Fri, 9 Sep 2016 08:49:16 +0000 (09:49 +0100)]
Add some soft asserts where applicable

This is an internal API. Some of the tests were for programmer erorr and
"should not happen" situations, so a soft assert is reasonable.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAddress WPACKET review comments
Matt Caswell [Thu, 8 Sep 2016 23:13:41 +0000 (00:13 +0100)]
Address WPACKET review comments

A few style tweaks here and there. The main change is that curr and
packet_len are now offsets into the buffer to account for the fact that
the pointers can change if the buffer grows. Also dropped support for the
WPACKET_set_packet_len() function. I thought that was going to be needed
but so far it hasn't been. It doesn't really work any more due to the
offsets change.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoSimplify the overflow checks in WPACKET_allocate_bytes()
Matt Caswell [Thu, 8 Sep 2016 22:08:53 +0000 (23:08 +0100)]
Simplify the overflow checks in WPACKET_allocate_bytes()

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMove the WPACKET documentation comments to packet_locl.h
Matt Caswell [Thu, 8 Sep 2016 10:44:25 +0000 (11:44 +0100)]
Move the WPACKET documentation comments to packet_locl.h

The PACKET documentation is already in packet_locl.h so it makes sense to
have the WPACKET documentation there as well.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd tests for the WPACKET implementation
Matt Caswell [Thu, 8 Sep 2016 09:01:24 +0000 (10:01 +0100)]
Add tests for the WPACKET implementation

The tests will only work in no-shared builds because WPACKET is an
internal only API that does not get exported by the shared library.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoEnsure the WPACKET gets cleaned up in the event of an error
Matt Caswell [Thu, 8 Sep 2016 09:00:56 +0000 (10:00 +0100)]
Ensure the WPACKET gets cleaned up in the event of an error

Otherwise a mem leak can occur.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoVarious bug fixes and tweaks to WPACKET implementation
Matt Caswell [Thu, 8 Sep 2016 08:58:29 +0000 (09:58 +0100)]
Various bug fixes and tweaks to WPACKET implementation

Also added the WPACKET_cleanup() function to cleanup a WPACKET if we hit
an error.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd WPACKET_sub_memcpy() function
Matt Caswell [Tue, 6 Sep 2016 14:19:32 +0000 (15:19 +0100)]
Add WPACKET_sub_memcpy() function

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoMove from explicit sub-packets to implicit ones
Matt Caswell [Tue, 6 Sep 2016 14:09:51 +0000 (15:09 +0100)]
Move from explicit sub-packets to implicit ones

No need to declare an explicit sub-packet. Just start one.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoRename PACKETW to WPACKET
Matt Caswell [Mon, 5 Sep 2016 16:34:04 +0000 (17:34 +0100)]
Rename PACKETW to WPACKET

To avoid confusion with the read PACKET structure.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoConvert tls_construct_client_hello() to use PACKETW
Matt Caswell [Wed, 3 Aug 2016 19:57:52 +0000 (20:57 +0100)]
Convert tls_construct_client_hello() to use PACKETW

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoFirst pass at writing a writeable packets API
Matt Caswell [Wed, 3 Aug 2016 16:06:39 +0000 (17:06 +0100)]
First pass at writing a writeable packets API

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd enginesdir to libcrypto.pc pkg-config file
David Woodhouse [Sat, 27 Aug 2016 19:33:23 +0000 (20:33 +0100)]
Add enginesdir to libcrypto.pc pkg-config file

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoVMS: Don't force symbol mixed case when building DSOs
Richard Levitte [Thu, 8 Sep 2016 18:54:34 +0000 (20:54 +0200)]
VMS: Don't force symbol mixed case when building DSOs

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoVMS: be less picky when loading DSOs
Richard Levitte [Thu, 8 Sep 2016 18:48:30 +0000 (20:48 +0200)]
VMS: be less picky when loading DSOs

The DSO API was picky about casing of symbol names on VMS.

There's really no reason to be that picky, it's mostly just annoying.
Therefore, we take away the possibility to flag for a choice, and will
instead first try to find a symbol with exact case, and failing that,
we try to find it in upper case.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoutil/shlib_wrap.sh is now auto-generated so tell git to ignore it
Matt Caswell [Sun, 11 Sep 2016 16:47:39 +0000 (12:47 -0400)]
util/shlib_wrap.sh is now auto-generated so tell git to ignore it

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoFix EC_KEY_print so it prints out private key information
Tim Hudson [Fri, 9 Sep 2016 20:53:33 +0000 (06:53 +1000)]
Fix EC_KEY_print so it prints out private key information
even when the public key is not present in an EC_KEY

Reviewed-by: Stephen Henson <steve@openssl.org>
8 years agoTrim config output
Rich Salz [Tue, 6 Sep 2016 16:26:38 +0000 (12:26 -0400)]
Trim config output

With extensive help and feedback from Richard and Andy.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
8 years agoVMS: Use different C flags for programs that aren't to be installed
Richard Levitte [Thu, 8 Sep 2016 17:23:38 +0000 (19:23 +0200)]
VMS: Use different C flags for programs that aren't to be installed

This is generalised by having the following macros for stuff that won't
be installed:

    NO_INST_LIB_CFLAGS, used instead of LIB_CFLAGS
    NO_INST_DSO_CFLAGS, used instead of DSO_CFLAGS
    NO_INST_BIN_CFLAGS, used instead of BIN_CFLAGS

They take values from corresponding target config fields if those are
defined, otherwise they take the respective values from LIB_CFLAGS,
DSO_CFLAGS and BIN_CFLAGS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoBuild file templates: additional information to build file template functions
Richard Levitte [Thu, 8 Sep 2016 16:09:47 +0000 (18:09 +0200)]
Build file templates: additional information to build file template functions

Send a bit information to the build file template functions.  For
src2obj(), the additional option 'product' holds the name of the final
file that the object file will go into.  Additionally, the diverse
functions will get the option 'installed', with a value that evaluates
true if the final product is to be installed, otherwise false.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoIf errno is ENXIO in BSS_new_file(), set BIO_R_NO_SUCH_FILE
Richard Levitte [Thu, 8 Sep 2016 21:39:26 +0000 (23:39 +0200)]
If errno is ENXIO in BSS_new_file(), set BIO_R_NO_SUCH_FILE

VMS sets that errno when the device part of a file spec is malformed
or a logical name that doesn't exist.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoTravis: Do asan and msan with shared libraries
Richard Levitte [Thu, 8 Sep 2016 08:57:31 +0000 (10:57 +0200)]
Travis: Do asan and msan with shared libraries

Reviewed-by: Emilia Käsper <emilia@openssl.org>
8 years agoFix mem leaks during auto-deinit
Matt Caswell [Mon, 5 Sep 2016 13:12:58 +0000 (14:12 +0100)]
Fix mem leaks during auto-deinit

Certain functions are automatically called during auto-deinit in order
to deallocate resources. However, if we have never entered a function which
marks lib crypto as inited then they never get called. This can happen if
the user only ever makes use of a small sub-set of functions that don't hit
the auto-init code.

This commit ensures all such resources deallocated by these functions also
init libcrypto when they are initially allocated.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Ben Laurie <ben@openssl.org>
8 years agoEnsure trace recognises X25519
Matt Caswell [Fri, 2 Sep 2016 09:42:36 +0000 (10:42 +0100)]
Ensure trace recognises X25519

Using the -trace option to s_server or s_client was incorrectly printing
UNKNOWN for the X25519 curve.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoengines/afalg: make it compile with backward compatibility headers.
Andy Polyakov [Sun, 4 Sep 2016 20:53:22 +0000 (22:53 +0200)]
engines/afalg: make it compile with backward compatibility headers.

Reviewed-by: Tim Hudson <tjh@openssl.org>
8 years agoConfigurations/10-main.cf: AIX "facelift".
Andy Polyakov [Sat, 3 Sep 2016 20:03:55 +0000 (22:03 +0200)]
Configurations/10-main.cf: AIX "facelift".

Improve interchangeability of aix*-gcc targets by linking shared
libraries with -static-libgcc, and address linking problems with
vendor compiler.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agochacha/asm/chacha-ppc.pl: add missing .text directive.
Andy Polyakov [Fri, 2 Sep 2016 22:46:01 +0000 (00:46 +0200)]
chacha/asm/chacha-ppc.pl: add missing .text directive.

RT#4667

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAdd missing debug strings.
Rich Salz [Wed, 7 Sep 2016 19:40:16 +0000 (15:40 -0400)]
Add missing debug strings.

Found by turning -Wswitch-enum on.

Reviewed-by: Richard Levitte <levitte@openssl.org>
8 years agoAllow asan, msan and ubsan to be configured with shared libraries
Richard Levitte [Wed, 7 Sep 2016 18:56:20 +0000 (20:56 +0200)]
Allow asan, msan and ubsan to be configured with shared libraries

The background story is that util/shlib_wrap.sh was setting LD_PRELOAD
or similar platform dependent variables, just in case the shared
libraries were built with -rpath.  Unfortunately, this doesn't work
too well with asan, msan or ubsan.

So, the solution is to forbid the combination of shared libraries,
-rpath and any of the sanity analyzers we can configure.

This changes util/shlib_wrap.sh so it only contains the code that sets
LD_PRELOAD when -rpath has been used when configuring.

Reviewed-by: Rich Salz <rsalz@openssl.org>
8 years agoAvoid EVP_PKEY_cmp() crash on EC keys without public component
David Woodhouse [Wed, 7 Sep 2016 15:53:18 +0000 (16:53 +0100)]
Avoid EVP_PKEY_cmp() crash on EC keys without public component

Some hardware devices don't provide the public EC_POINT data. The only
way for X509_check_private_key() to validate that the key matches a
given certificate is to actually perform a sign operation and then
verify it using the public key in the certificate.

Maybe that can come later, as discussed in issue 1532. But for now let's
at least make it fail gracefully and not crash.

GH: 1532

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1547)
(cherry picked from commit 92ed7fa575a80955f3bb6efefca9bf576a953586)

8 years agoConfigure: Reorganise the checking of disabled options
Richard Levitte [Tue, 6 Sep 2016 18:14:33 +0000 (20:14 +0200)]
Configure: Reorganise the checking of disabled options

The way we figured out what options are crypto algorithms and what are
something other was somewhat sketchy.  This change bases the
distinction on available sdirs instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>