Commit graph

17296 commits

Author SHA1 Message Date
FdaSilvaYY
0517ffc47c Whitespace cleanup in docs
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1264)
2016-06-29 09:56:39 -04:00
FdaSilvaYY
9d22666eb8 Spelling
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1264)
2016-06-29 09:56:39 -04:00
Ben Laurie
cbddeebe49 Some interfaces may have IPv6 addresses even if an IPv6 address is not
"configured on the local system". Whatever that means. Example that is biting
me is loopback has ::1 as an address, but the network interface is v4 only.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-29 11:29:34 +01:00
Alex Gaynor
03cb37acec Add comment about X509_print
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Emilia Kasper <emilia@openssl.org>

GH: #1255
2016-06-28 18:30:41 +02:00
Emilia Kasper
d2b23cd2b0 SSL test framework: port SNI tests
Observe that the old tests were partly ill-defined:
setting sn_server1 but not sn_server2 in ssltest_old.c does not enable
the SNI callback.

Fix this, and also explicitly test both flavours of SNI mismatch (ignore
/ fatal alert). Tests still pass.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-28 17:26:24 +02:00
Emilia Kasper
2cdce3e32f base64 macro: parenthesize for clarity
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-28 17:23:11 +02:00
Richard Levitte
b8bbd8b1bd Windows: Make DESTDIR work
DESTDIR can't be used on Windows the same way as on Unix, the device
part of the installation paths get in the way.

To remedy this, have INSTALLTOP, OPENSSLDIR and ENGINESDIR get
different values depending on if $(DESTDIR) is empty or not, and use
$(INSTALLTOP), $(OPENSSLDIR) and $(ENGINESDIR) alone.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-28 15:42:52 +02:00
Richard Levitte
850000aa41 Build files: don't generate empty action lines in generatedir()
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-28 14:02:44 +02:00
Roumen Petrov
57ade5711b Use include paths to our source before any other cflags
This is just in case someone passed an inclusion path with the
configuration, and there are OpenSSL headers from another version
in there.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-27 23:52:40 +02:00
Andy Polyakov
7a53360031 engines/e_capi.c: accommodate recent DSA_SIG_[get|set]0 changes.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-27 23:32:09 +02:00
Andy Polyakov
e0685d2473 rsa/rsa_lib.c: const-ify RSA_get0_engine().
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-27 23:31:55 +02:00
Andy Polyakov
dbbb6a87a7 unix-Makefile.tmpl: omit lib<rary>.a updates from directory targets.
Since corresponding rule was removed from windows-makefile.tmpl out
of necessity, question popped if it's appropriate to harmonize even
unix-Makefile.tmpl. Note that as long as you work on single directory
'make lib<rary>.a' is effectively equivalent to 'make <dir/ectory>'
prior this modification.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-27 23:28:07 +02:00
Andy Polyakov
cfef7e9e68 windows-makefile.tmpl: don't use $? in library targets.
Problem with Microsoft lib.exe is that it doesn't *update* modules
in .lib archive, but creates new one upon every invocation. As result
if a source file was updated and nmake was executed, a useless archive
with only one module was created. In other words one has to always
pass all .obj modules on command line, not only recently recompiled.

[This also creates dilemma for directory targets, e.g. crypto\aes,
that were added to simplify every-day life for developer. Since
whole idea behind those targets is to minimize the re-compile time
upon single file modification, the only sensible thing to do is to
omit intended library update.]

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-27 23:26:12 +02:00
Matt Caswell
c3fd55d4a6 Add a test for fragmented alerts
The previous commit fixed a problem where fragmented alerts would cause an
infinite loop. This commit adds a test for these fragmented alerts.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-27 14:51:03 +01:00
Matt Caswell
63916e9a23 Ensure read records are marked as read
In some situations (such as when we receive a fragment of an alert)
we try to get the next packet but did not mark the current one as read,
meaning that we got the same record back again - leading to an infinite
loop.

Found using the BoringSSL test suite.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-27 14:51:03 +01:00
Rich Salz
6f4a6a5cd4 RT4586: Remove RSA_memory_lock; unused, not needed
Reviewed-by: Ben Laurie <ben@openssl.org>
2016-06-27 07:39:53 -04:00
Matt Caswell
56add338b1 Fix one more instance of incorrect OPENSSL_API_COMPAT value
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-27 11:51:50 +01:00
Matt Caswell
1aca3618ff Fix some OPENSSL_API_COMPAT values
There are 3 OPENSSL_API_COMPAT values that are incorrect in the header
files, and one inconsistency between the header and the .c

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-27 11:28:29 +01:00
Brian Smith
cd359b2564 Clarify use of |$end0| in stitched x86-64 AES-GCM code.
There was some uncertainty about what the code is doing with |$end0|
and whether it was necessary for |$len| to be a multiple of 16 or 96.
Hopefully these added comments make it clear that the code is correct
except for the caveat regarding low memory addresses.

Change-Id: Iea546a59dc7aeb400f50ac5d2d7b9cb88ace9027
Reviewed-on: https://boringssl-review.googlesource.com/7194
Reviewed-by: Adam Langley <agl@google.com>

Signed-off-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-27 10:15:05 +02:00
Andy Polyakov
0b919cc5d5 Configurations/10-main.conf: fix PA-RISC commentary.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-27 10:12:23 +02:00
Andy Polyakov
5fc77684f1 evp/evp_enc.c: refine partial buffer overlap detection.
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-27 10:09:07 +02:00
Andy Polyakov
c3a73daf0a evp/evp_enc.c: check for partially[!] overlapping buffers
in EVP_EncryptUpdate and EVP_DecryptUpdate. It is argued that in
general case it's impossible to provide guarantee that partially[!]
overlapping buffers can be tolerated.

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-27 10:08:01 +02:00
Rich Salz
dca5eeb4d0 RT2680: Public EC key is shown as private
Re-implemented as suggested by Steve Henson.
Also change ECParameters_print the same way.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-06-26 17:28:16 -04:00
Rich Salz
5d28ff38fd RT2964: Fix it via doc
OBJ_nid2obj() and friends should be treated as const.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-06-26 09:24:49 -04:00
Rich Salz
c32bdbf171 Revert "RT2964: Fix it via doc"
This reverts commit 82f31fe4dd.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-06-25 22:08:21 -04:00
Rich Salz
82f31fe4dd RT2964: Fix it via doc
OBJ_nid2obj() and friends should be treated as const.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-06-25 16:40:07 -04:00
David Benjamin
d70a562714 Handle BN_mod_word failures.
As of 37258dadaa and the corresponding upstream
change, BN_mod_word may fail, like BN_div_word. Handle this properly. Thanks to
Brian Smith for pointing this out. See BoringSSL's
44bedc348d9491e63c7ed1438db100a4b8a830be.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>

GH: #1251
2016-06-25 11:01:34 +02:00
David Benjamin
748e85308e Fix BN_is_prime* calls.
This function returns a tri-state -1 on error. See BoringSSL's
53409ee3d7595ed37da472bc73b010cd2c8a5ffd.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>

GH: #1251
2016-06-25 11:01:30 +02:00
Kurt Roeckx
f08c8c1a19 Add x509 and crl corpora
Reviewed-by: Rich Salz <rsalz@openssl.org>

GH: #1229
2016-06-25 11:01:29 +02:00
Kurt Roeckx
e1859d8d54 Add X509 and CRL fuzzer
Reviewed-by: Rich Salz <rsalz@openssl.org>

GH: #1229
2016-06-25 11:01:29 +02:00
Rich Salz
3b5bea3604 Add -ciphers flag to enc command
Don't print the full list of ciphers as part of the -help output.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-24 16:39:05 -04:00
Andy Polyakov
67b8bf4d84 perlasm/x86_64-xlate.pl: address errors and warnings in elderly perls.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-24 22:10:19 +02:00
Andy Polyakov
8f3bc096af ./config: minor cleanup.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-24 22:07:56 +02:00
Andy Polyakov
c5c0cac5c1 ./config: detect x32-only environment.
RT#4583

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-24 22:07:33 +02:00
Nathaniel McCallum
3b92e51899 Teach EVP_PKEY_HMAC keys how to EVP_PKEY_cmp()
Fixes openssl/openssl#1236

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1237)
2016-06-24 12:31:31 -04:00
Kurt Roeckx
5bea15ebb3 Avoid signed overflow
Found by afl

Reviewed-by: Rich Salz <rsalz@openssl.org>

MR: #3013
2016-06-24 18:17:10 +02:00
Ben Laurie
24bf6f3c7f Deal with API changes.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-24 14:40:33 +01:00
Matt Caswell
0def528bc5 Ensure HMAC key gets cleansed after use
aesni_cbc_hmac_sha256_ctrl() and aesni_cbc_hmac_sha1_ctrl() cleanse the
HMAC key after use, but static int rc4_hmac_md5_ctrl() doesn't.

Fixes an OCAP Audit issue.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-24 13:25:00 +01:00
Matt Caswell
827d17f021 Add some documentation for missing HMAC functions
This includes the newly added HMAC_CTX_get_md().

Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-06-24 13:22:40 +01:00
Matt Caswell
a6211814c4 Add a getter to obtain the HMAC_CTX md
As a result of opaque HMAC_CTX apps need a getter for the HMAC_CTX md.

GitHub Issue #1152

Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-06-24 13:22:40 +01:00
Matt Caswell
d6079a87db Fix ASN1_STRING_to_UTF8 could not convert NumericString
tag2nbyte had -1 at 18th position, but underlying ASN1_mbstring_copy
supports NumericString. tag2nbyte is also used in do_print_ex which will
not be broken by setting 1 at 18th position of tag2nbyte

Reviewed-by: Stephen Henson <steve@openssl.org>
2016-06-23 20:49:43 +01:00
huangqinjin
51a3b763c3 Make x25519_compute_key() return a boolean
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-23 17:13:23 +01:00
huangqinjin
65ea288d47 Make ossl_ecdh_compute_key() return a boolean
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-23 17:13:23 +01:00
Sebastian Andrzej Siewior
70a56b9147 utils/mkdir-p: check if dir exists also after mkdir failed
with "make install -j8" it happens very often that two or more make
instances are creating the same directory in parallel. As a result one
instace creates the directory and second mkdir fails because the
directory exists already (but it did not while testing for it earlier).

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1204)
2016-06-23 11:10:29 -04:00
Rich Salz
fe2d149119 RT2867: des_ede3_cfb1 ignored "size in bits" flag
Code and tests by Steve.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-23 10:03:50 -04:00
Viktor Dukhovni
615dd78b72 Drop extraneous printf argument in mkcert.sh
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-23 23:40:29 +10:00
Kurt Roeckx
d0ba3119de Update fuzz corpora
Reviewed-by: Rich Salz <rsalz@openssl.org>

MR: #2986
2016-06-23 15:13:32 +02:00
FdaSilvaYY
3c82e437bb Add checks on sk_TYPE_push() returned result
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-23 14:03:29 +01:00
FdaSilvaYY
687b486859 Rework error handling from asn1_do_lock method.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-23 14:00:47 +01:00
Dr. Stephen Henson
b58614d7f5 Fix generation of expired CA certificate.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-22 23:23:09 +01:00