Commit graph

2320 commits

Author SHA1 Message Date
David Benjamin
748e85308e Fix BN_is_prime* calls.
This function returns a tri-state -1 on error. See BoringSSL's
53409ee3d7595ed37da472bc73b010cd2c8a5ffd.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>

GH: #1251
2016-06-25 11:01:30 +02:00
Rich Salz
3b5bea3604 Add -ciphers flag to enc command
Don't print the full list of ciphers as part of the -help output.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-24 16:39:05 -04:00
mmiyashita
1d8b4eb2b4 segmentation fault with 'openssl s_client -prexit -keymatexport'
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1243)
2016-06-21 17:30:46 -04:00
Richard Levitte
a392ef20f0 Allow proxy certs to be present when verifying a chain
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
2016-06-20 21:34:37 +02:00
Richard Levitte
14d3c0dd2c apps/req.c: Increment the right variable when parsing '+'
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-20 20:11:07 +02:00
Jiri Horky
fb0303f3ce RT3136: Remove space after issuer/subject
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-20 09:25:12 -04:00
FdaSilvaYY
a8db2cfa4b Add a comment after some #endif at end of apps source code.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)
2016-06-18 16:30:24 -04:00
FdaSilvaYY
823146d65f Useless header include of openssl/rand.h
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1168)
2016-06-18 16:30:24 -04:00
Matt Caswell
1dcb8ca2a4 Use a STACK_OF(OPENSSL_CSTRING) for const char * stacks
Better than losing the const qualifier.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-18 15:34:03 +01:00
Matt Caswell
d012c1a179 Replace 4 casts with 1
Changing the type of the |str| variable in asn1pars enables us to remove
4 casts with just 1. This silences an OpenBSD warning along the way.

RT4378

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-18 15:34:03 +01:00
FdaSilvaYY
0ad69cd6c0 Spelling fixes
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1219)
2016-06-16 15:08:57 -04:00
Matt Caswell
f219a1b048 Revert "RT4526: Call TerminateProcess, not ExitProcess"
This reverts commit 9c1a9ccf65.

TerminateProcess is asynchronous, so the code as written in the above
commit is not correct. It is also probably not needed in the speed
case. Reverting in order to figure out the correct solution.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-16 17:37:37 +01:00
Richard Levitte
2ac6115d9e Deal with the consequences of constifying getters
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-15 20:09:27 +02:00
Rich Salz
9c1a9ccf65 RT4526: Call TerminateProcess, not ExitProcess
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-15 13:38:51 -04:00
FdaSilvaYY
82643254d6 Constify X509_TRUST_add method.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1215)
2016-06-15 13:22:38 -04:00
Matt Caswell
d285b5418e Avoid a double-free in crl2pl7
The variable |crtflst| could get double freed in an error path.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-14 11:27:10 +01:00
Matt Caswell
a45dca668e Add missing break statement
The -psk option processing was falling through to the -srp option
processing in the ciphers app.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-14 11:21:44 +01:00
Rich Salz
a7be5759cf RT3809: basicConstraints is critical
This is really a security bugfix, not enhancement any more.
Everyone knows critical extensions.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-06-13 09:18:22 -04:00
Dr. Stephen Henson
6ec6d52071 Don't skip leading zeroes in PSK keys.
Don't use BN_hex2bn() for PSK key conversion as the conversion to
BN and back removes leading zeroes, use OPENSSL_hexstr2buf() instead.

RT#4554

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-12 19:44:17 +01:00
John Denker
a3ef2c1679 RT2759: Don't read TTY when already at EOF.
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-12 08:52:40 -04:00
Rich Salz
7315ce80de Avoid memory leaks if options repeated.
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-12 08:02:46 -04:00
Rich Salz
fe08bd76e2 GH1183: Fix -unix and -connect, etc., override
If a user specifies -unix, -6, etc., then the program tries to
use the last one specified.  This is confusing code and leads to
scripting errors.  Instead, allow only one type.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-10 10:45:49 -04:00
Rich Salz
b1ffe8dbee GH1123: sort dir before rehash
This is needed to generate stable output names/symlinks.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-02 15:12:50 -04:00
Richard Levitte
6616429d4c Build the 'openssl rehash' command on VMS version 8.3 and up
Include a note in INSTALL that tests must be run from an unprivileged
process.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-02 21:11:07 +02:00
Matt Caswell
1c422164d8 Fix memory leak in crl2pkcs7 app
The crl2pkcs7 app leaks a stack of OPENSSL_STRINGs in error paths.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 18:00:53 +01:00
Matt Caswell
a855d1a155 Free a temporary buffer used by dsaparam application
The dsaparam application allocates a temporary buffer but then doesn't
free it.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 18:00:53 +01:00
Matt Caswell
6e4ab54b93 Free memory on error in cms app
The make_receipt_request() function in the cms app can leak memory on
an error condition.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 18:00:53 +01:00
Rich Salz
44c8a5e2b9 Add final(?) set of copyrights.
Add copyright to missing assembler files.
Add copyrights to missing test/* files.
Add copyrights
Various source and misc files.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 11:27:25 -04:00
Rich Salz
0f91e1dff4 Fix some RAND bugs
RT2630 -- segfault for int overlow
RT2877 -- check return values in apps/rand
Update CHANGES file for previous "windows rand" changes.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 10:45:18 -04:00
Matt Caswell
f83b85fb0f Ensure an ASN1_OBJECT is freed in error paths
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 14:58:46 +01:00
Matt Caswell
7b0ee1353d Free allocated password strings on exit
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 14:58:46 +01:00
Matt Caswell
a3768e0c9b Free a BIO_ADDR if DTLSv1_listen return <=0
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 14:51:36 +01:00
Matt Caswell
5bf7c7725b Ensure BIGNUM is freed in an error path
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 14:51:36 +01:00
Matt Caswell
fe2b7dfdf4 Free an X509_CRL in an error path
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 14:51:36 +01:00
Matt Caswell
0461b7ea7b Don't leak X509_OBJECT in an error path
Swap the ordering of some code to avoid a leak in an error path.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 14:51:36 +01:00
Matt Caswell
eeb21772ef Add dhparam sanity check and update DH_check documentation
The -check argument to dhparam should never identify any problems if we
have just generated the parameters. Add a sanity check for this and print
an error and fail if necessary.

Also updates the documentation for the -check argument, and the DH_check()
function.

RT#4244

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 13:19:02 +01:00
Matt Caswell
57358a83a4 req command incorrectly displays the bits for an EC key
When the "req" command is used to generate a new EC key using the -newkey
option it will incorrectly display:

 Generating a 2048 bit EC private key

This commit fixes the message to not display the bit length for EC keys
because we don't currently support getting that during generation.

GitHub Issue #1068

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-01 13:09:26 +01:00
Cristian Stoica
dab1f5fe4b speed.c: fix segfault with unrecognized algorithms
When an unrecognized algorithm is given on command line together with
-async_jobs, speed_main will jump to clean-up and run
ASYNC_cleanup_thread without calling ASYNC_init_thread first.

Example:
openssl speed -async_jobs 4 ras2048

Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1084)
2016-05-31 10:14:45 -04:00
Joey Yandle
151a4376bc remove winrand.c entirely, nothing seems to reference it
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1079)
2016-05-29 13:36:59 -04:00
Joey Yandle
6f0cc2a6f8 cherry pick pr-512 changes
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1079)
2016-05-29 13:36:59 -04:00
Joey Yandle
888db7f224 cherry pick pr-512 changes
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1079)
2016-05-29 13:36:59 -04:00
Matt Caswell
cb2e10f257 Fix intermittent windows failures in TLSProxy tests
When closing down the socket in s_client Windows will close it immediately
even if there is data in the write buffer still waiting to be sent. This
was causing tests to fail in Msys/Mingw builds because TLSProxy doesn't see
the final CloseNotify.

I have experimented with various ways of doing this "properly" (e.g.
shutting down the socket before closing, setting SO_LINGER etc). I can't
seem to find the "magic" formula that will make Windows do this. Inserting
a short 50ms sleep seems to do the trick...but its not very "nice" so I've
inserted a TODO on this item. Perhaps someone else will have better luck
in figuring this out.

RT#4255

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-27 15:18:54 +01:00
Matt Caswell
75dd6c1a39 Fix s_client/s_server waiting for stdin on Windows
On Windows we were using the function _kbhit() to determine whether there
was input waiting in stdin for us to read. Actually all this does is work
out whether there is a keyboard press event waiting to be processed in the
input buffer. This only seems to work in a standard Windows console (not
Msys console) and also doesn't work if you redirect the input from some
other source (as we do in TLSProxy tests). This commit changes things to
work differently depending on whether we are on the Windows console or not.

RT#4255

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-27 15:18:46 +01:00
Matt Caswell
384f08dc76 Fix some s_server issues on Windows
In s_server we call BIO_sock_should_retry() to determine the state of the
socket and work out whether we should retry an operation on it or not.
However if you leave it too long to call this then other operations may
have occurred in the meantime which affect the result. Therefore we should
call it early and remember the result for when we need to use it. This fixes
a test problem on Windows.

Another issue with s_server on Windows is that some of output to stdout does
not get displayed immediately. Apparently more liberal use of BIO_flush is
required.

RT#4255

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-27 15:18:35 +01:00
Richard Levitte
7030e35d07 build.info files: add quotes around any spec that may contain spaces
RT#4492

Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-05-25 11:50:44 +02:00
Richard Levitte
34f5d44f6a Make sure tsget and c_rehash are named with .pl suffix on Windows and VMS
Especially on Windows, the .pl suffix is associated with the perl
interpreter, and therefore make those scripts usable as commands of
their own.  On VMS, it simply looks better.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-23 21:48:42 +02:00
Richard Levitte
35b060fcc9 Make sure to initialize all CA.pl variables properly
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-23 21:48:42 +02:00
Dr. Stephen Henson
f65a8c1e66 Support -no-CAfile -no-CApath in ctx2
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-05-23 19:15:20 +01:00
Dr. Stephen Henson
05dba8151b Support for traditional format private keys.
Add new function PEM_write_bio_PrivateKey_traditional() to enforce the
use of legacy "traditional" private key format. Add -traditional option
to pkcs8 and pkey utilities.

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-05-23 16:41:34 +01:00
FdaSilvaYY
8bf780432c Indent and dead code cleanup
tofree pointer  is no more used...

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1103)
2016-05-21 08:58:27 -04:00