Commit graph

15048 commits

Author SHA1 Message Date
Dr. Stephen Henson
0c787647de update DSA docs
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-02-01 15:12:54 +00:00
Dr. Stephen Henson
167548061d add option to exclude public key from EC keys
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-01 15:11:18 +00:00
Dr. Stephen Henson
f6de4eb77f Fix memory leak and print out keygen errors.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-01 15:11:18 +00:00
Rich Salz
f1f07a2367 Better check for gcc/clang
Iteratively improved with Richard and Andy.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-01 09:42:10 -05:00
Dmitry-Me
eb507efba8 Comment "secure memcmp" implementation
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-02-01 08:32:58 -05:00
Dr. Stephen Henson
995197ab84 Use PKCS#8 format EC key so test is skipped with no-ec
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-01 13:18:19 +00:00
Richard Levitte
8ffdf7ffd7 unified build scheme: add a personal configuration to test it
Nothing else will run the unified scheme for now.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-02-01 12:46:58 +01:00
Richard Levitte
777a288270 unified build scheme: add build.info files
Now that we have the foundation for the "unified" build scheme in
place, we add build.info files.  They have been generated from the
Makefiles in the same directories.  Things that are platform specific
will appear in later commits.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-02-01 12:46:58 +01:00
Richard Levitte
9fe2bb77c4 unified build scheme: a first introduction
The "unified" build scheme revolves around small information files,
build.info, which each describe their own bit of everything that needs
to be built, using a mini-language described in Configurations/README.

The information in build.info file contain references to source files
and final result.  Object files are not mentioned at all, they are
simply from source files.  Because of this, all the *_obj items in
Configurations/*.conf are renamed to *_asm_src and the files listed
in the values are change from object files to their corresponding
source files.  For the sake of the other build schemes, Configure
generates corresponding *_obj entries in %target.

Furthermore, the "unified" build scheme supports having a build
directory tree separate from the source directry tree.

All paths in a build.info file is assumed to be relative to its
location, either within the source tree or within the build tree.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-02-01 12:46:58 +01:00
Viktor Dukhovni
1d85277235 Add tests for non-ca trusted roots and intermediates
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31 21:24:16 -05:00
Viktor Dukhovni
33cc5dde47 Compat self-signed trust with reject-only aux data
When auxiliary data contains only reject entries, continue to trust
self-signed objects just as when no auxiliary data is present.

This makes it possible to reject specific uses without changing
what's accepted (and thus overring the underlying EKU).

Added new supported certs and doubled test count from 38 to 76.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31 21:24:12 -05:00
Viktor Dukhovni
0daccd4dc1 Check chain extensions also for trusted certificates
This includes basic constraints, key usages, issuer EKUs and auxiliary
trust OIDs (given a trust suitably related to the intended purpose).

Added tests and updated documentation.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31 21:23:23 -05:00
Dr. Stephen Henson
1b4cf96f9b Zero newly allocated points
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31 22:18:31 +00:00
Dr. Stephen Henson
aedc37e700 Remove redundant code.
d2i_ECPrivateKey always caculates the public key so there is
no need to caculate it again in eckey_priv_decode().

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31 22:18:30 +00:00
Dr. Stephen Henson
be2e334fce Add EC_GROUP_order_bits, EC_GROUP_get0_order and EC_GROUP_get0_cofactor
New functions to return internal pointer for order and cofactor. This
avoids the need to allocate a new BIGNUM which to copy the value to.
Simplify code to use new functions.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31 22:18:30 +00:00
Andy Polyakov
81e03785f7 Engage poly1305-sparcv9 module.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-31 22:50:10 +01:00
Andy Polyakov
0049eb46e4 Add poly1305/asm/poly1305-sparcv9.pl.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-31 22:49:42 +01:00
Andy Polyakov
46d4d86577 Configure: restore original logic for -DWHIRLPOOL_ASM.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-31 22:43:29 +01:00
Daniel Kahn Gillmor
8ab31975ba RT4129: BUF_new_mem_buf should take const void *
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31 14:05:13 -05:00
Richard Levitte
0e87e05816 Remove the extra checks for Intel's C compiler
When the target is {something}-icc, we're doing some extra checks of
the icc compiler.  However, all such targets were cleaned away in
March 2015, so this Configure section is dead code.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31 19:51:33 +01:00
Rich Salz
b59e1bed7d RT3755: Remove duplicate #include
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-31 09:42:53 -05:00
Richard Levitte
fb36ca1290 Don't go into dotted directories when copying Makefile.in to Makefile
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31 12:49:36 +01:00
Rich Salz
769adcfe8b GH102: Extra volatile avoids GCC bug
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-01-30 20:19:19 -05:00
Rich Salz
9716b0b9de Remove extra level of indirection.
Remove OPENSSL_IMPORT as its only purpose is to define OPENSSL_EXTERN.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-30 18:11:12 -05:00
Rich Salz
94af0cd7f3 Move more BN internals to bn_lcl.h
There was an unused macro in ssl_locl.h that used an internal
type, so I removed it.
Move bio_st from bio.h to ossl_type.h

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-01-30 16:54:35 -05:00
Rich Salz
98ab57644f GH102: Add volatile to CRYPTO_memcmp
Can't hurt and seems to prevent problems from some over-aggressive
(LTO?) compilers.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-30 14:37:43 -05:00
Richard Levitte
c10d1bc81c When checking if there's a VMS directory spec, don't forget the possible device
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-30 17:11:48 +01:00
Richard Levitte
9c626317a6 Fix test/recipes/25-test_verify.t
top_dir() are used to create directory names, top_file() should be
used for files.  In a Unixly environment, that doesn't matter, but...

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-30 17:10:38 +01:00
Dr. Stephen Henson
4ddd5acecc handle "Ctrl" in separate function
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-30 16:02:48 +00:00
Dr. Stephen Henson
404cc933b7 Add test data for ECDH
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-30 16:02:48 +00:00
Dr. Stephen Henson
d4ad48d7bd Add support for EVP_PKEY_derive in evp_test
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-30 16:02:48 +00:00
Dr. Stephen Henson
bc9d9ce27a fix warning
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-30 16:02:48 +00:00
Dr. Stephen Henson
7ab507495b Add function to return internal enoding of X509_NAME.
PR#4280

Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-01-30 16:02:48 +00:00
Richard Levitte
33254e1c6f Fix opt_imax() call
Not all architectures have a time_t defined the same way.  To make
sure we get the same result, we need to cast &checkoffset to (intmax_t *)
and make sure that intmax_t is defined somehow.

To make really sure we don't pass a variable with the wrong size down
to opt_imax(), we use a temporary intmax_t.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-30 16:23:44 +01:00
Richard Levitte
421e30ec67 Configure: Clarify the handling of $thread_cflags
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-30 07:53:02 +01:00
Viktor Dukhovni
ea5e0c1caf Make opt_imax visible in all apps
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 18:46:55 -05:00
Rich Salz
826e9e5446 Missed rc2_int from before.
Also remove $Makefile variable :)

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-01-29 17:22:38 -05:00
Viktor Dukhovni
bc8c34d74a Fix invalid policy detection
As a side-effect of opaque x509, ex_flags were looked up too early,
before additional policy cache updates.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-29 17:00:40 -05:00
Rich Salz
ced2c2c598 Templatize util/domd
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-29 16:56:07 -05:00
Viktor Dukhovni
56087077d8 Better type for x509 -checkend argument
This is a time_t and can be zero or negative.  So use 'M' (maximal
signed int) not 'p' (positive int).

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 15:38:08 -05:00
Richard Levitte
04b08fbc3d Complete the lflags -> lflags/ex_libs transition
Some last lflags to convert to ex_libs or a combo of lflags and ex_libs

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 19:28:05 +01:00
Richard Levitte
1740c16265 Configure et al: split up the lflags configuration item into two
The lflags configuration had a weird syntax with a % as separator.  If
it was present, whatever came before ended up as PEX_LIBS in Makefile
(usually, this is LDFLAGS), while whatever came after ended up as
EX_LIBS.

This change splits that item into lflags and ex_libs, making their use
more explicit.

Also, PEX_LIBS in all the Makefiles are renamed to LDFLAGS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 18:36:57 +01:00
Richard Levitte
ddf47a10cd Make use of add() and add_before() in Configurations/
A few more sub-joins could be replaced with calls to add() and add_before()

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 18:17:30 +01:00
Richard Levitte
f8206c8e24 Revert "Don't replace cflags with thread_cflags, only append the latter"
This reverts commit a450326ee0.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 18:00:45 +01:00
Rich Salz
723acb1445 Merge error, wrong domd submitted.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-29 11:36:21 -05:00
Richard Levitte
a450326ee0 Don't replace cflags with thread_cflags, only append the latter
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 17:32:31 +01:00
Rich Salz
96d608beb0 Remove clean-depend
Remove depend hacks from demos/engines.
Remove clean-depend; just call makedepend (or $CC -M) and use that.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-29 11:15:20 -05:00
Viktor Dukhovni
aea6116146 Make it possible to check for explicit auxiliary trust
By default X509_check_trust() trusts self-signed certificates from
the trust store that have no explicit local trust/reject oids
encapsulated as a "TRUSTED CERTIFICATE" object.  (See the -addtrust
and -trustout options of x509(1)).

This commit adds a flag that makes it possible to distinguish between
that implicit trust, and explicit auxiliary settings.

With flags |= X509_TRUST_NO_SS_COMPAT, a certificate is only trusted
via explicit trust settings.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-29 10:53:46 -05:00
Emilia Kasper
d8ca44ba41 Always DPURIFY
The use of the uninitialized buffer in the RNG has no real security
benefits and is only a nuisance when using memory sanitizers.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-29 16:33:13 +01:00
Rich Salz
a01dab9462 Remove x86_gcc_des,x86_gcc_opts
This is a followin from !1738, we no longer need those variables.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-29 10:30:57 -05:00