Commit graph

15736 commits

Author SHA1 Message Date
David Woodhouse
92d23b339c Move declaration of X509_aux_print() out of #ifndef OPENSSL_NO_STDIO
This isn't a file access function; it's still present.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 14:51:08 -05:00
David Woodhouse
963bb62195 Allow OPENSSL_NO_SOCK in e_os.h even for non-Windows/DOS platforms
UEFI needs this too. Don't keep it only in the Windows/DOS ifdef block.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 14:51:08 -05:00
Rich Salz
8731a4fcd2 ISSUE 43: Add BIO_sock_shutdown
This replaces SHUTDOWN/SHUTDOWN2 with BIO_closesocket.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-07 14:47:54 -05:00
Rob Percival
2b2b96847d Minor update to includes and documentation for ct_test.c
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 14:45:49 -05:00
Rob Percival
11c8bc42f7 Remove OPENSSL_NO_UNIT_TEST guard from ct_test.c
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 14:45:49 -05:00
Rob Percival
3f3c7d26d5 Use s->session->peer instead of calling SSL_get_peer_certificate(s)
Avoids modifying certificate reference count, and thereby avoids locking.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 14:44:04 -05:00
Rob Percival
4d482ee24f Lowercase name of SSL_validate_ct as it is an internal function
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 14:44:04 -05:00
Rob Percival
1cb437bedb CT code now calls X509_free() after calling SSL_get_peer_certificate()
Without this, the peer certificate would never be deleted, resulting in
a memory leak.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 14:44:04 -05:00
Rob Percival
147e54a77e Fixes memory leaks in CT code
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 14:44:04 -05:00
Richard Levitte
c6912adf0c Fix the build tree include directory for afalg engine
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 19:06:24 +01:00
Richard Levitte
fa657fc8df Make OpenSSL::Test::setup() a bit more forgiving
It was unexpected that OpenSSL::Test::setup() should be called twice
by the same recipe.  However, that may happen if a recipe combines
OpenSSL::Test and OpenSSL::Test::Simple, which can be a sensible thing
to do.  Therefore, we now allow it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 19:04:28 +01:00
David Woodhouse
db922318b3 Elide EVP_read_pw_string() and friends for no-ui
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-03-07 12:52:56 -05:00
Benjamin Kaduk
d3054fb663 GH768: Minor grammar nits in CRYPTO_get_ex_new_index.pod
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-03-07 12:52:15 -05:00
Richard Levitte
d62d17b9c0 Unified - adapt the generation of padlock assembler to use GENERATE
This gets rid of the BEGINRAW..ENDRAW sections in engines/build.info.

This also moves the assembler generating perl scripts to take the
output file name as last command line argument, where necessary.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 18:28:25 +01:00
Richard Levitte
6bd7a4d96c Unified - adapt the generation of bignum assembler to use GENERATE
This gets rid of the BEGINRAW..ENDRAW sections in crypto/bn/build.info.

This also moves the assembler generating perl scripts to take the
output file name as last command line argument, where necessary.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 18:25:56 +01:00
Richard Levitte
8a67946e5b Unified - Add the build.info command OVERRIDE, to avoid build file clashes
Should it be needed because the recipes within a RAW section might
clash with those generated by Configure, it's possible to tell it
not to generate them with the use of OVERRIDES, for example:

    SOURCE[libfoo]=foo.c bar.c

    OVERRIDES=bar.o
    BEGINRAW[Makefile(unix)]
    bar.o: bar.c
        $(CC) $(CFLAGS) -DSPECIAL -c -o $@ $<
    ENDRAW[Makefile(unix)]

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 18:25:56 +01:00
Richard Levitte
66ddf178b4 Unified - Adapt the Unix and VMS templates to support GENERATE
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 18:25:56 +01:00
Richard Levitte
ae4c745075 Unified - Add the build.info command GENERATE, to generate source files
In some cases, one might want to generate some source files from
others, that's done as follows:

    GENERATE[foo.s]=asm/something.pl $(CFLAGS)
    GENERATE[bar.s]=asm/bar.S

The value of each GENERATE line is a command line or part of it.
Configure places no rules on the command line, except the the first
item muct be the generator file.  It is, however, entirely up to the
build file template to define exactly how those command lines should
be handled, how the output is captured and so on.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 18:25:56 +01:00
Matt Caswell
667867cced Add a function to detect if we have async or not
Add the ASYNC_is_capable() function and use it in speed.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 17:23:42 +00:00
Alessandro Ghedini
b8972edad6 GH804: Fix unused-result warnings in dasync
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-07 12:21:07 -05:00
Billy Brumley
0543603abf documentation and duplicate goto statements
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 12:20:42 -05:00
Billy Brumley
a67788c17e move ifdef statements
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 12:20:42 -05:00
Billy Brumley
61f6774e9a NIST SP800-56A co-factor ECDH KATs
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 12:20:42 -05:00
Matt Caswell
c292b105b1 Remove use of CRYPTO_LOCK_INIT in init code
Swap the use of CRYPTO_LOCK_INIT in the init code to use the new threading
API mechanism for locking.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-07 17:17:21 +00:00
Matt Caswell
a072ed0c88 Swap the init code to use the new Thread API thread locals
The init code was using its own thread local code. Now we have a central
API for it we should use that instead.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-07 17:17:21 +00:00
Matt Caswell
b1f1e7aeba Swap the init code to use CRYPTO_ONCE
The init code was using its own "once" implementation. Now that we have
the new thread API we should use that instead.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-07 17:17:21 +00:00
Dr. Stephen Henson
48fe8ab02e make update
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 17:11:21 +00:00
Dr. Stephen Henson
5596bda4fc Update documentation
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 17:11:21 +00:00
Dr. Stephen Henson
54dbf42398 Make PKCS8_PRIV_KEY_INFO opaque.
Make PKCS8_PRIV_KEY_INFO opaque. Several accessor functions already exist
for this structure. Two new ones were added to handle attributes.

The old handling of broken formats has been removed and the corresponding
structures simplified.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 17:11:21 +00:00
Andrea Grandi
1e61392296 Add support to ASYNC_WAIT_CTX to speed
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-07 16:27:25 +00:00
Andrea Grandi
b283968327 Remove unnecessary memset() to 0 and check for NULL before OPENSSL_free()
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-07 16:27:25 +00:00
Andrea Grandi
0ff4343575 Fix the error with RSA and the daysnc engine in async mode.
Move RSA struct in the job local struct.
The change is applied also to other crypto operations (e.g. DSA) to
make things consistent.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-07 16:27:25 +00:00
Andrea Grandi
8b0b80d923 Add support for async jobs in OpenSSL speed
Summary of the changes:

* Move the calls to the crypto operations inside wrapper functions.
  This is required because ASYNC_start_job takes a function as an argument.

* Add new function run_benchmark() that manages the jobs for all the operations.
  In the POSIX case it uses a select() to receive the events from the engine
  and resume the jobs that are paused, while in the WIN case it uses PeekNamedPipe()

* Add new option argument async_jobs to enable and specify the number of async jobs

Example:
  openssl speed -engine dasync -elapsed -async_jobs 32 rsa2048

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-07 16:27:24 +00:00
Emilia Kasper
a556f34220 Rework the default cipherlist.
- Always prefer forward-secure handshakes.
 - Consistently order ECDSA above RSA.
 - Next, always prefer AEADs to non-AEADs, irrespective of strength.
 - Within AEADs, prefer GCM > CHACHA > CCM for a given strength.
 - Prefer TLS v1.2 ciphers to legacy ciphers.
 - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default
   list to reduce ClientHello bloat.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 16:53:42 +01:00
Andy Polyakov
3ed1839dc3 Makefile.in: populate [PLIB_]LDFLAG even with $target{} settings.
RT#4373

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-07 15:00:20 +01:00
Andy Polyakov
adc4f1fc25 bn/asm/x86[_64]-mont*.pl: complement alloca with page-walking.
Some OSes, *cough*-dows, insist on stack being "wired" to
physical memory in strictly sequential manner, i.e. if stack
allocation spans two pages, then reference to farmost one can
be punishable by SEGV. But page walking can do good even on
other OSes, because it guarantees that villain thread hits
the guard page before it can make damage to innocent one...

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07 14:58:14 +01:00
Emilia Kasper
56cd71b46e Restore some mingw builds
"no-pic" builds have in fact been green (and reasonably fast), so
restore them while we figure out why tests without "no-pic" hang.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-03-07 14:53:38 +01:00
Andy Polyakov
6e42e3ff9c perlasm/x86_64-xlate.pl: handle binary constants early.
Not all assemblers of "gas" flavour handle binary constants, e.g.
seasoned MacOS Xcode doesn't, so give them a hand.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-07 14:51:26 +01:00
Matt Caswell
a193388811 Fix some clang warnings
The af_alg engine and associated test were creating warnings when compiled
with clang. This fixes it.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-07 13:36:17 +00:00
Matt Caswell
e2524943ce Fix minor errors in the afalg test
The new afalg test should have a copyright date of 2016. Also an
incorrect buffer was being sent to EVP_CipherFinal_ex when
decrypting.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-07 13:36:17 +00:00
clucey
d245844010 Adding afalg test
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-07 13:36:17 +00:00
Matt Caswell
15457b6203 Fix OPENSSL_INIT flags to avoid a clash.
The 0x00010000L OPENSSL_INIT flag appeared twice.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-07 13:36:17 +00:00
Matt Caswell
8da00a38cd Misc afalg build fixes
Misc afalg build fixes as suggested by Richard Levitte for the latest
Configure changes.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-07 13:36:17 +00:00
clucey
6cba4a6661 Rework based on feedback:
1. Cleaned up eventfd handling
2. Reworked socket setup code to allow other algorithms to be added in
   future
3. Fixed compile errors for static build
4. Added error to error stack in all cases of ALG_PERR/ALG_ERR
5. Called afalg_aes_128_cbc() from bind() to avoid race conditions
6. Used MAX_INFLIGHT define in io_getevents system call
7. Coding style fixes

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-07 13:36:17 +00:00
clucey
7f458a48ff ALG: Add AFALG engine
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-07 13:36:17 +00:00
Emilia Kasper
b63447c115 Trim Travis config part 2
- Remove Win builds (temporarily). They're slow, allowed to fail,
  and therefore not useful as they are.
- Make the --unified part of the matrix build-only. (This can be
  swapped if --unified becomes the default)
- Only build 'no-engine' once, don't run any tests, but don't allow it
  to fail.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-07 12:46:35 +01:00
Emilia Kasper
3135650970 Trim the Travis config
- Remove no-asm. We've got to cut something, and this is at least
  partially covered by the sanitizer builds.
- Remove enable-crypto-mdebug from sanitizer
  builds. enable-crypto-mdebug has been shown to catch some static
  initialization bugs that the standard leak sanitizer can't so
  perhaps it has _some_ value; but we shouldn't let the two compete.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-06 22:37:18 +01:00
Rich Salz
a4cb3bc8f2 GH616: Remove dead code
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-03-05 13:45:40 -05:00
Richard Levitte
0c8734198d No -fno-common for Darwin
When object files with common block symbols are added to static
libraries on Darwin, those symbols are invisible to the linker that
tries to use them.  Our solution was to use -fno-common when compiling
C source.

Unfortunately, there is assembler code that defines OPENSSL_ia32cap_P
as a common block symbol, unconditionally, and in some cases, there is
no other definition.  -fno-common doesn't help in this case.

However, 'ranlib -c' adds common block symbols to the index of the
static library, which makes them visible to the linker using it, and
that solves the problem we've seen.

The common conclusion is, either use -fno-common or ranlib -c on
Darwin.  Since we have common block symbols unconditionally, choosing
the method for our source is easy.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-03-05 12:10:13 +01:00
Richard Levitte
a2ed050328 New ordinal files, recreated from scratch
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-05 09:06:09 +01:00