Add UEFI flag for rand build

Add OPENSSL_SYS_UEFI flag for RAND handling;

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>

Win32 build fix: include internal/numbers.h to get UIN32_MAX

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT3674: Make no-cms build work.

Also has changes from from David Woodhouse <David.Woodhouse@intel.com>
and some tweaks from me.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

make update

Reviewed-by: Matt Caswell <matt@openssl.org>

PBE lookup test

Add test to check PBE lookups: these can fail if the PBE table is not
correctly orders. Add to "make test".

Reviewed-by: Matt Caswell <matt@openssl.org>

Add initial Travis CI configuration

Closes #63

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Laurie <ben@openssl.org>

Two changes at ones lead to a confused libeay.num.  Fix

Reviewed-by: Matt Caswell <matt@openssl.org>

Check OPENSSL_gmtime_diff

It's test code that only runs on 64bit time_t machines.
Move it to a standalone test/gmdifftest

Reviewed-by: Richard Levitte <levitte@openssl.org>

Add and use OPENSSL_zalloc

There are many places (nearly 50) where we malloc and then memset.
Add an OPENSSL_zalloc routine to encapsulate that.
(Missed one conversion; thanks Richard)
Also fixes GH328

Reviewed-by: Richard Levitte <levitte@openssl.org>

make update

Reviewed-by: Tim Hudson <tjh@openssl.org>

make X509_CRL opaque

Reviewed-by: Tim Hudson <tjh@openssl.org>

Extend ciphersuite test coverage.

Add support for testing ECDSA and DSA ciphersuites.

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix CCM support in DTLS

Reviewed-by: Matt Caswell <matt@openssl.org>

Update ssltest certificate handling.

Use SSL_CONF for certificate handling is ssltest.c, this changes the
behaviour slightly: the -cert and -key options are no longer recognised
and a default certificate file is not used.

This change means that -s_cert and -c_cert can be used mode than once
to support use of multiple certificates.

Reviewed-by: Matt Caswell <matt@openssl.org>

Create DSA and ECDSA certificates.

If supported create DSA and ECDSA certificates and test them.

Reviewed-by: Matt Caswell <matt@openssl.org>

delete unused structure

Reviewed-by: Rich Salz <rsalz@openssl.org>

Move OPENSSL_ITEM to store.h

The only place that uses it.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Cleaner handling of "cnid" in do_x509_check

Avoid using cnid = 0, use NID_undef instead, and return early instead
of trying to find an instance of that in the subject DN.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Better handling of verify param id peername field

Initialize pointers in param id by the book (explicit NULL assignment,
rather than just memset 0).

In x509_verify_param_zero() set peername to NULL after freeing it.

In x509_vfy.c's internal check_hosts(), avoid potential leak of
possibly already non-NULL peername.  This is only set when a check
succeeds, so don't need to do this repeatedly in the loop.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix DTLS1.2 buffers

Fix the setup of DTLS1.2 buffers to take account of the Header

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Fix the comment for POINT_CONVERSION_UNCOMPRESSED

The |z| value should be 0x04 not 0x02

RT#3838

Signed-off-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

make update

Reviewed-by: Rich Salz <rsalz@openssl.org>

Document extension functions

Reviewed-by: Rich Salz <rsalz@openssl.org>

functions to retrieve certificate flags

Reviewed-by: Rich Salz <rsalz@openssl.org>

use uint32_t for certificate flags

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT3984: Fix clang compiler warning on Mac OS X where %ld is used for uint64_t.

clang suggests %llu instead, but it isn't clear that is portable on
all platforms.

C99 and above define a handy macro for us, so we try to use that
definition and fall back to current definition if needed (though we
switch to 'u' for unsigned).

Reviewed-by: Matt Caswell <matt@openssl.org>

apps/speed.c: fix memory leak

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT4002: check for NULL cipher in p12_crpt.c

The NULL cipher case can't actually happen because we have no
EVP_PBE_CTL combinations where cipher_nid is -1 and keygen is
PKCS12_PBE_keyivgen. But make the code more obviously correct.

Reviewed-by: Matt Caswell <matt@openssl.org>

RT 3493: fix RSA test

- Pass in the right ciphertext length to ensure we're indeed testing
  ciphertext corruption (and not truncation).
- Only test one mutation per byte to not make the test too slow.
- Add a separate test for truncated ciphertexts.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3767: openssl_button.gif should be PNG

No, we should just delete it.  And updated the README

Reviewed-by: Matt Caswell <matt@openssl.org>

Ignore .dir-locals.el

Because we recently encourage people to have a .dir-locals.el, it's a good
idea to ignore it on a git level.

Reviewed-by: Rich Salz <rsalz@openssl.org>

make update

Reviewed-by: Rich Salz <rsalz@openssl.org>

Add X509_up_ref function.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Add X509_CRL_up_ref function

Reviewed-by: Rich Salz <rsalz@openssl.org>

check bn_new return value

Slightly modified from the original PR.
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>

make X509_REQ opaque

Reviewed-by: Rich Salz <rsalz@openssl.org>

make X509_CERT_AUX opaque

Reviewed-by: Rich Salz <rsalz@openssl.org>

Remove asn1-kludge option.

Remove asn1-kludge option from the req utility. It was a decade old
workaround for CAs and software which required an invalid encoding
of PKCS#10 certificate requests: omitting the attributes field even
though it is not OPTIONAL.

Reviewed-by: Rich Salz <rsalz@openssl.org>

GH367 follow-up, for more clarity

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

BN_mod_exp_mont_consttime: check for zero modulus.

Don't dereference |d| when |top| is zero. Also test that various BIGNUM methods behave correctly on zero/even inputs.

Follow-up to b11980d79a52ec08844f08bea0e66c04b691840b

Reviewed-by: Rich Salz <rsalz@openssl.org>

Remove auto-fill-mode

Apparently, emacs sees changes to auto-fill-mode as insecure

Reviewed-by: Rich Salz <rsalz@openssl.org>

Add an example .dir-locals.el

This file, when copied to .dir-locals.el in the OpenSSL source top,
will make sure that the CC mode style "OpenSSL-II" will be used for
all C files.

Additionally, I makes sure that tabs are never used as indentation
character, regardless of the emacs mode, and that the fill column is
78.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Add emacs CC mode style for OpenSSL

This hopefully conforms closely enough to the current code style.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix spurious bntest failures.

BN_bntest_rand generates a single-word zero BIGNUM with quite a large probability.

A zero BIGNUM in turn will end up having a NULL |d|-buffer, which we shouldn't dereference without checking.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove the "times" directory.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix 4c42ebd; forgot to inutil util/libeay.num

Reviewed-by: Tim Hudson <tjh@openssl.org>

GH354: Memory leak fixes

Fix more potential leaks in X509_verify_cert()
Fix memory leak in ClientHello test
Fix memory leak in gost2814789 test
Fix potential memory leak in PKCS7_verify()
Fix potential memory leaks in X509_add1_reject_object()
Refactor to use "goto err" in cleanup.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

GH367: Fix dsa keygen for too-short seed

If the seed value for dsa key generation is too short (< qsize),
return an error. Also update the documentation.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Fix memory over-read

Fix from David Baggett via tweet.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Various doc fixes.

Make all mention of digest algorithm use "any supported algorithm"

RT2071, some new manpages from Victor B. Wagner <vitus@cryptocom.ru>:
    X509_LOOKUP_hash_dir.pod
    X509_check_ca.pod
    X509_check_issued.pod

RT 1600:
    Remove references to non-existant objects(3)
    Add RETURN VALUES to BIO_do_accept page.

RT1818:
    RSA_sign Can return values other than 0 on failure.

RT3634:
    Fix AES CBC aliases (Steffen Nurpmeso <sdaoden@yandex.com>)

RT3678:
    Some clarifications to BIO_new_pair
    (Devchandra L Meetei <dlmeetei@gmail.com>)

RT3787:
    Fix some EVP_ function return values
    (Laetitia Baudoin <lbaudoin@google.com>)

Reviewed-by: Tim Hudson <tjh@openssl.org>

GH350: -help text few s_client and s_server flags

add -help description of sigalgs, client_sigalgs, curves
and named_curve

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>

Fixed problem with multiple load-unload of comp zlib

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>

GH correct organizationalUnitName

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>

Clean up reset of read/write sequences

Use sizeof instead of an explicit size, and use the functions for the
purpose.

Reviewed-by: Rich Salz <rsalz@openssl.org>

PACKET: add methods for reading length-prefixed TLS vectors.

Rewrite ssl3_get_client_hello to use the new methods.

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix SSLv2-compatible ClientHello processing.

If the client challenge is less than 32 bytes, it is padded with leading - not trailing - zero bytes.

Reviewed-by: Matt Caswell <matt@openssl.org>

PACKET: constify where possible

The PACKET should hold a 'const unsigned char*' underneath as well
but the legacy code passes the record buffer around as 'unsigned char*'
(to callbacks, too) so that's a bigger refactor.

Reviewed-by: Matt Caswell <matt@openssl.org>

GH371: Print debug info for ALPN extension

Also known as RT 4106
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Matt Caswell <matt@openssl.org>

Remove _locked memory functions.

Undocumented, unused, unnecessary (replaced by secure arena).

Reviewed-by: Richard Levitte <levitte@openssl.org>

BN_bin2bn handle leading zero's

If a binary sequence is all zero's, call BN_zero.

Reviewed-by: Matt Caswell <matt@openssl.org>

Add NewSessionTicket test suite

Add a set of tests for checking that NewSessionTicket messages are
behaving as expected.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix TLSProxy end of test detection

Previously TLSProxy would detect a successful handshake once it saw the
server Finished message. This causes problems with abbreviated handshakes,
or if the client fails to process a message from the last server flight.

This change additionally sends some application data and finishes when the
client sends a CloseNotify.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix DTLS session ticket renewal

A DTLS client will abort a handshake if the server attempts to renew the
session ticket. This is caused by a state machine discrepancy between DTLS
and TLS discovered during the state machine rewrite work.

The bug can be demonstrated as follows:

Start a DTLS s_server instance:
openssl s_server -dtls

Start a client and obtain a session but no ticket:
openssl s_client -dtls -sess_out session.pem -no_ticket

Now start a client reusing the session, but allow a ticket:
openssl s_client -dtls -sess_in session.pem

The client will abort the handshake.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Ignore generated *.S ARM assembly files

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

RT4019: Duplicate -hmac flag in dgst.pod

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

GH372: Remove duplicate flags

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Small cleanup of crypto.pod

Came up on the mailing list, from Ken Goldman.

Reviewed-by: Tim Hudson <tjh@openssl.org>

GH337: Need backslash before leading #

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>

RT4015: Add missing date to CHANGES

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>

More test cases.

Add DSA tests.

Add tests to verify signatures against public keys. This will also check
that a public key is read in correctly.

Reviewed-by: Ben Laurie <ben@openssl.org>

Add DSA digest length checks.

Reviewed-by: Ben Laurie <ben@openssl.org>

Fix L<> content in manpages

L<foo|foo> is sub-optimal  If the xref is the same as the title,
which is what we do, then you only need L<foo>.  This fixes all
1457 occurrences in 349 files.  Approximately.  (And pod used to
need both.)

Reviewed-by: Richard Levitte <levitte@openssl.org>

Add new types to indent.pro

Reviewed-by: Rich Salz <rsalz@openssl.org>

Add new GOST OIDs

Add new OIDs for latest GOST updates

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Restore previous behaviour of only running one algorithm when -evp alg is used.

Submitted by: Eric Young <eay@pobox.com>
Reviewed-by: Ben Laurie <ben@openssl.org>

restore usage of -elapsed that was disabled in the ifdef reorg

Reviewed-by: Ben Laurie <ben@openssl.org>

GH345: Remove stderr output

Reviewed-by: Tim Hudson <tjh@openssl.org>

Move FAQ to the web.

Best hope of keeping current.

Reviewed-by: Tim Hudson <tjh@openssl.org>

PACKETise CertificateRequest

Process CertificateRequest messages using the PACKET API

Reviewed-by: Emilia Käsper <emilia@openssl.org>

PACKETise ClientKeyExchange processing

Use the new PACKET code to process the CKE message

Reviewed-by: Stephen Henson <steve@openssl.org>

PACKETise NewSessionTicket

Process NewSessionTicket messages using the new PACKET API

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Fix session tickets

Commit 9ceb2426b0 (PACKETise ClientHello) broke session tickets by failing
to detect the session ticket extension in an incoming ClientHello. This
commit fixes the bug.

Reviewed-by: Emilia Käsper <emilia@openssl.org>

add CCM docs

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add CCM ciphersuites from RFC6655 and RFC7251

Reviewed-by: Tim Hudson <tjh@openssl.org>

ccm8 support

Reviewed-by: Tim Hudson <tjh@openssl.org>

CCM support.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Update docs.

Clarify and update documention for extra chain certificates.

PR#3878.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Documentation for SSL_check_chain()

Reviewed-by: Matt Caswell <matt@openssl.org>

for test_sslvertol, add a value to display SSL version < 3 in debug

Reviewed-by: Matt Caswell <matt@openssl.org>

Fixups in libssl test harness

- select an actual file handle for devnull
- do not declare $msgdata twice
- SKE records sometimes seem to come without sig
- in SKE parsing, use and use $pub_key_len when parsing $pub_key

Reviewed-by: Matt Caswell <matt@openssl.org>

Use -I to add to @INC, and use -w to produce warnings

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix FAQ formatting for new website.

Reviewed-by: Matt Caswell <matt@openssl.org>

PACKETise Certificate Status message

Process the Certificate Status message using the PACKET API

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Enhance PACKET readability

Enhance the PACKET code readability, and fix a stale comment. Thanks
to Ben Kaduk (bkaduk@akamai.com) for pointing this out.

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add missing return check for PACKET_buf_init

The new ClientHello PACKET code is missing a return value check.

Reviewed-by: Emilia Käsper <emilia@openssl.org>

GH364: Free memory on an error path

Part of RT 3997
Per Ben, just jump to common exit code.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>

PACKETise Server Certificate processing

Use the PACKET API to process an incoming server Certificate message.

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Return error for unsupported modes.

PR#3974
PR#3975

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix memory leak if setup fails.

Reviewed-by: Matt Caswell <matt@openssl.org>

Err isn't always malloc failure.

Reviewed-by: Matt Caswell <matt@openssl.org>