Add support for DTLSv1_listen in s_server

DTLSv1_listen is a commonly used function within DTLS solutions for
listening for new incoming connections. This commit adds support to s_server
for using it.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Remove remaining old listen code

The old implementation of DTLSv1_listen which has now been replaced still
had a few vestiges scattered throughout the code. This commit removes them.

Reviewed-by: Andy Polyakov <appro@openssl.org>

DTLSv1_listen rewrite

The existing implementation of DTLSv1_listen() is fundamentally flawed. This
function is used in DTLS solutions to listen for new incoming connections
from DTLS clients. A client will send an initial ClientHello. The server
will respond with a HelloVerifyRequest containing a unique cookie. The
client the responds with a second ClientHello - which this time contains the
cookie.

Once the cookie has been verified then DTLSv1_listen() returns to user code,
which is typically expected to continue the handshake with a call to (for
example) SSL_accept().

Whilst listening for incoming ClientHellos, the underlying BIO is usually in
an unconnected state. Therefore ClientHellos can come in from *any* peer.
The arrival of the first ClientHello without the cookie, and the second one
with it, could be interspersed with other intervening messages from
different clients.

The whole purpose of this mechanism is as a defence against DoS attacks. The
idea is to avoid allocating state on the server until the client has
verified that it is capable of receiving messages at the address it claims
to come from. However the existing DTLSv1_listen() implementation completely
fails to do this. It attempts to super-impose itself on the standard state
machine and reuses all of this code. However the standard state machine
expects to operate in a stateful manner with a single client, and this can
cause various problems.

A second more minor issue is that the return codes from this function are
quite confused, with no distinction made between fatal and non-fatal errors.
Most user code treats all errors as non-fatal, and simply retries the call
to DTLSv1_listen().

This commit completely rewrites the implementation of DTLSv1_listen() and
provides a stand alone implementation that does not rely on the existing
state machine. It also provides more consistent return codes.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Add BIO_CTRL_DGRAM_SET_PEEK_MODE

Add the ability to peek at a message from the DTLS read BIO. This is needed
for the DTLSv1_listen rewrite.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Fix the rehash test on Windows

The openssl rehash command is not available on some platforms including
Windows. This change skips the associated tests if rehash is not available.

Reviewed-by: Richard Levitte <levitte@openssl.org>

make update

Reviewed-by: Rich Salz <rsalz@openssl.org>

header includes

Reviewed-by: Rich Salz <rsalz@openssl.org>

Document X509_get0_subject_key_id()

Reviewed-by: Rich Salz <rsalz@openssl.org>

New function X509_get0_subject_key_id()

Reviewed-by: Rich Salz <rsalz@openssl.org>

Make X509 opaque

Reviewed-by: Rich Salz <rsalz@openssl.org>

Avoid structure access in crypto/ts

Reviewed-by: Rich Salz <rsalz@openssl.org>

PACKET: simplify

Get rid of the third field that is no longer needed.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Remove ssl_put_cipher_by_char

Since SSLv3, a CipherSuite is always 2 bytes. The only place where we
need 3-byte ciphers is SSLv2-compatible ClientHello processing.

So, remove the ssl_put_cipher_by_char indirection.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Document BUF_strnlen

Reviewed-by: Matt Caswell <matt@openssl.org>

BUF_strdup and friends: update docs

Reviewed-by: Matt Caswell <matt@openssl.org>

BUF_strndup: tidy

Fix comment, add another overflow check, tidy style

Reviewed-by: Matt Caswell <matt@openssl.org>

Make BUF_strndup() read-safe on arbitrary inputs

BUF_strndup was calling strlen through BUF_strlcpy, and ended up reading
past the input if the input was not a C string.

Make it explicitly part of BUF_strndup's contract to never read more
than |siz| input bytes. This augments the standard strndup contract to
be safer.

The commit also adds a check for siz overflow and some brief documentation
for BUF_strndup().

Reviewed-by: Matt Caswell <matt@openssl.org>

GH398: Add mingw cross-compile, etc.

For all release branches.  It adds travis build support. If you don't
have a config file it uses the default (because we enabled travis for the
project), which uses ruby/rake/rakefiles, and you get confusing "build
still failing" messages.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Fix path in comments

Reviewed-by: Rich Salz <rsalz@openssl.org>

make depend

Reviewed-by: Rich Salz <rsalz@openssl.org>

Move certificate request and CRL routines to x509 dir.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Move functions.

Move various functions tagged onto t_x509.c to more appropriate places.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Update SEE ALSO sections.

Reviewed-by: Matt Caswell <matt@openssl.org>

Document signature accessors.

Reviewed-by: Matt Caswell <matt@openssl.org>

Extension parsing and encoding docs.

Reviewed-by: Matt Caswell <matt@openssl.org>

Document i2d_re_X509_REQ_tbs() and i2d_re_X509_CRL_tbs().

Reviewed-by: Matt Caswell <matt@openssl.org>

Document X509_REVOKED functions.

Reviewed-by: Matt Caswell <matt@openssl.org>

Document X509 sign and verify functions.

Reviewed-by: Matt Caswell <matt@openssl.org>

Document X509 public key functions.

Reviewed-by: Matt Caswell <matt@openssl.org>

Document X509 name get and set functions.

Reviewed-by: Matt Caswell <matt@openssl.org>

Document X509 version functions.

Reviewed-by: Matt Caswell <matt@openssl.org>

Use accessors in X509_REQ_print().

Reviewed-by: Rich Salz <rsalz@openssl.org>

Use accessor functions in X509_CRL_print().

Reviewed-by: Rich Salz <rsalz@openssl.org>

New accessor X509_REQ_get_X509_PUBKEY()

Reviewed-by: Rich Salz <rsalz@openssl.org>

Additional X509_CRL accessors.

Reviewed-by: Rich Salz <rsalz@openssl.org>

typo

Reviewed-by: Matt Caswell <matt@openssl.org>

Add comments to x509_int.h

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add accessors for X509_REVOKED.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add accessors for request and CRL signatures

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Remove "noise" comments from TS files.

Reviewed-by: Tim Hudson <tjh@openssl.org>

RT3479: Add UTF8 support to BIO_read_filename()

If we use BIO_new_file(), on Windows it'll jump through hoops to work
around their unusual charset/Unicode handling. it'll convert a UTF-8
filename to UCS-16LE and attempt to use _wfopen().

If you use BIO_read_filename(), it doesn't do this. Shouldn't it be
consistent?

It would certainly be nice if SSL_use_certificate_chain_file() worked.

Also made BIO_C_SET_FILENAME work (rsalz)

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Andy Polyakov <appro@openssl.org>

RT3823: Improve the robustness of event logging

There are a couple of minor fixes here:

1) Handle the case when RegisterEventSource() fails (which it may for
various reasons) and do the work of logging the event only if it succeeds.

2) Handle the case when ReportEvent() fails and do our best in debug builds
to at least attempt somehow indicate that something has gone wrong. The
typical situation would be someone running tools like DbMon, DBWin32,
DebugView or just having the debugger attached. The intent is to make sure
that at least some data will be captured so that we can save hours and days
of debugging time.

3) Minor fix to change the MessageBox() flag to MB_ICONERROR. Though the
value of MB_ICONERROR is the same value as MB_ICONSTOP, the intent is
better conveyed by using MB_ICONERROR.

Testing performed:

1) Clean compilation for debug-VC-WIN32 and VC-WIN32.

2) Good test results (nmake -f ms\ntdll.mak test) for debug-VC-WIN32 and
VC-WIN32.

3) Stepped through relevant changes using WinDBG and exercised the impacted
code paths.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Matt Caswell <matt@openssl.org>

GOST PKCS12 support

Changes required to add GOST support to PKCS12

Based on a patch provided by Dmitry Belyavsky <beldmit@gmail.com>

Reviewed-by: Stephen Henson <steve@openssl.org>

Add GOST extensions to PKCS#5

GOST extends PKCS5 PBES2/PBKDF2 with some additional GOST specific PRFs.

Based on a patch provided by Dmitry Belyavsky <beldmit@gmail.com>

Reviewed-by: Stephen Henson <steve@openssl.org>

Fix SRP memory leaks

There were some memory leaks in the creation of an SRP verifier (both on
successful completion and also on some error paths).

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Fix -srpvfile option in srp command line

The -srpvfile option was broken in the srp command line app. Using it would
always result in "-dbfile and -configfile cannot be specified together."
The error message is also wrong because the option is "-srpvfile" not
"-dbfile", so that has been fixed too.

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Make SRP work with -www

PR#3817

Reviewed-by: Rich Salz <rsalz@openssl.org>

Handle SSL_ERROR_WANT_X509_LOOKUP

Reviewed-by: Rich Salz <rsalz@openssl.org>

remove unneeded includes

Reviewed-by: Richard Levitte <levitte@openssl.org>

make no-dh work

Reviewed-by: Richard Levitte <levitte@openssl.org>

Move EVP_PKEY_METHOD into private headers.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Simplify Simple.pm further, and make it more verbose

Reviewed-by: Stephen Henson <steve@openssl.org>

Correct srp test

There actually is a "srp" feature to check the availability on

Reviewed-by: Stephen Henson <steve@openssl.org>

Correct jpake test

There actually is a "jpake" feature to check the availability on

Reviewed-by: Stephen Henson <steve@openssl.org>

Correct sha tests

These tests were checking for specific sha variants, when they should
just check if "sha" is disabled.

Reviewed-by: Stephen Henson <steve@openssl.org>

Correct whirlpool test

It depended on 'openssl no-wp', which always exited with code 0, so
this test would never be performed, and this, I never discovered that
the program it's supposed to run was misspellt.  Furthermore, the
feature to check is 'whirlpool', not 'wp'.

All corrected.

Reviewed-by: Stephen Henson <steve@openssl.org>

Finally, remove a possibly disabled feature

I have no clue why MD_GHOST94 was checked on, there is no
OPENSSL_NO_MD_GHOST94 in sight anywhere

Reviewed-by: Stephen Henson <steve@openssl.org>

Add more features that may be disabled

Have a look at the directories in crypto/, I found reason to add
checks on CMAC and HMAC.  This might be completely irrelevant, but I
prefered covering too much than not enough.

Reviewed-by: Stephen Henson <steve@openssl.org>

Add more features that may be disabled

A grep of OPENSSL_NO_ in the rest of the source tree revealed a few
more features to check.

NOTE: there are some of those macros that I ignore because a check of
them doesn't seem useful to external apps.  This might change later on.

Reviewed-by: Stephen Henson <steve@openssl.org>

Add more features that may be disabled

After a grep of OPENSSL_NO_ in apps/*.c, a few more features that may
be interesting to check the availability of came up.

Reviewed-by: Stephen Henson <steve@openssl.org>

Add more features that may be disabled

I've tried to make this list as complete as possible, based on
information found in apps/progs.pl.

Reviewed-by: Stephen Henson <steve@openssl.org>

Sort the disabled features alphabetically

Reviewed-by: Stephen Henson <steve@openssl.org>

typo

Reviewed-by: Richard Levitte <levitte@openssl.org>

Update Simple.pm to use disabled()

Reviewed-by: Richard Levitte <levitte@openssl.org>

Change test recipes to use disabled()

Reviewed-by: Richard Levitte <levitte@openssl.org>

Add Utils.pm

Add Utils.pm for test utilities. This currently just contains one function:
disabled which checks if a feature is disabled based on the output of
openssl list -disabled

Reviewed-by: Richard Levitte <levitte@openssl.org>

Small typo

OPENSSL_NO_ECA changed to OPENSSL_NO_EC

Reviewed-by: Stephen Henson <steve@openssl.org>

Make sure to actually use @smime_cms_comp_test when testing it...

Obvious typo, and it took configuring with 'zlib' to discover it,
otherwise there was a previous skip that bypassed this section
entirely.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix some test failures when Configured with zlib

TLSProxy was failing if we are Configured with compression because it
doesn't support it. This fix simply switches compression off for the
purposes of the test.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Print out a list of disabled features.

New option "openssl list -disabled" this lists a set of disabled features
in a form which can be conveniently parsed by the test framework so it
knows which tests to skip.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Return shared OIDs when decoding.

When an OID is decoded see if it exists in the registered OID table
and if so return the shared OID instead of dynamically allocating
an ASN1_OBJECT.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix indentation

Reviewed-by: Richard Levitte <levitte@openssl.org>

Check if test_rehash is run as root

If test/recipes/40-test_rehash.t is executed as root, the last test
will fail, since the created directory will remain writable no matter
what.  Make sure it complains loudly about being run as root.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Remove PACKET_back

It's unused, and the same functionality can be achieved with saving a
copy of the struct.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Make sure OPENSSL_cleanse checks for NULL

In master we have the function OPENSSL_clear_free(x,y), which immediately
returns if x == NULL. In <=1.0.2 this function does not exist so we have to
do:
OPENSSL_cleanse(x, y);
OPENSSL_free(x);

However, previously, OPENSSL_cleanse did not check that if x == NULL, so
the real equivalent check would have to be:
if (x != NULL)
    OPENSSL_cleanse(x, y);
OPENSSL_free(x);

It would be easy to get this wrong during cherry-picking to other branches
and therefore, for safety, it is best to just ensure OPENSSL_cleanse also
checks for NULL.

Reviewed-by: Rich Salz <rsalz@openssl.org>

base64 decode: check for high bit

Previously, the conversion would silently coerce to ASCII. Now, we error
out.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3757: base64 encoding bugs

Rewrite EVP_DecodeUpdate.

In particular: reject extra trailing padding, and padding in the middle
of the content. Don't limit line length. Add tests.

Previously, the behaviour was ill-defined, and depended on the position
of the padding within the input.

In addition, this appears to fix a possible two-byte oob read.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Dr Stephen Henson <steve@openssl.org>

Remove PACKET_(get|goto)_bookmark

The bookmark API results in a lot of boilerplate error checking that can
be much more easily achieved with a simple struct copy. It also lays the
path for removing the third PACKET field.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Embed various signature algorithms.

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT4033: Use OPENSSL_SYS_UNIX not "unix"

Real fix for RT 4033

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT4047: Set reference count earlier

Make sure it's valid very early.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Disentangle RSA premaster secret parsing

Simplify encrypted premaster secret reading by using new methods in the
PACKET API.

Don't overwrite the packet buffer. RSA decrypt accepts truncated
ciphertext with leading zeroes omitted, so it's even possible that by
crafting a valid ciphertext with several leading zeroes, this could
cause a few bytes out-of-bounds write. The write is harmless because of
the size of the underlying message buffer, but nevertheless we shouldn't
write into the packet.

Reviewed-by: Matt Caswell <matt@openssl.org>

Embed X509_REQ_INFO

Reviewed-by: Rich Salz <rsalz@openssl.org>

Embed X509_CINF

Reviewed-by: Rich Salz <rsalz@openssl.org>

X509_CRL_INFO embed

Reviewed-by: Rich Salz <rsalz@openssl.org>

Change X509_VAL in X509 structure to embedded.

Reviewed-by: Rich Salz <rsalz@openssl.org>

New ASN.1 embed macro.

New ASN.1 macro ASN1_EMBED. This is the same as ASN1_SIMPLE except the
structure is not allocated: it is part of the parent. That is instead of

FOO *x;

it must be:

FOO x;

This reduces memory fragmentation and make it impossible to accidentally
set a mandatory field to NULL.

This currently only works for SEQUENCE and since it is equivalent to
ASN1_SIMPLE it cannot be tagged, OPTIONAL, SET OF or SEQUENCE OF.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix build on mingw

When OPENSSL_EXPORT_VAR_AS_FUNCTION is defined, the static_ASN1_ITEM_start
macro doesn't exist so the build fails. This problem was introduced in
commit df2ee0e.

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Fix return values when adding serverinfo fails.

Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1128

make update

Reviewed-by: Rich Salz <rsalz@openssl.org>

Extend the notes on how to do testing

These notes include the use of HARNESS_VERBOSE (see the manual for
Test::Harness) and the method to enumerate specific tests to run.

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add a method to list available tests

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add a few notes on perl

Reviewed-by: Emilia Käsper <emilia@openssl.org>

d2i: don't update input pointer on failure

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
MR #1005

Fix PSK identity hint handling.

For server use a PSK identity hint value in the CERT structure which
is inherited when SSL_new is called and which allows applications to
set hints on a per-SSL basis. The previous version of
SSL_use_psk_identity_hint tried (wrongly) to use the SSL_SESSION structure.

PR#4039

Reviewed-by: Matt Caswell <matt@openssl.org>

Constify ECDSA_METHOD_new.

PR#3920.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix zlib CMS compilation.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Use default field separator.

If the field separator isn't specified through -nameopt then use
XN_FLAG_SEP_CPLUS_SPC instead of printing nothing and returing an error.

PR#2397

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix "defined but not used" warnings.

Reviewed-by: Matt Caswell <matt@openssl.org>

Enable -Wmissing-variable-declarations and
-Wincompatible-pointer-types-discards-qualifiers (the latter did not require
any code changes).

Reviewed-by: Rich Salz <rsalz@openssl.org>