aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-02-16ARM assembly pack: make it Windows-friendly.Andy Polyakov16-73/+185
"Windows friendliness" means a) flipping .thumb and .text directives, b) always generate Thumb-2 code when asked(*); c) Windows-specific references to external OPENSSL_armcap_P. (*) so far *some* modules were compiled as .code 32 even if Thumb-2 was targeted. It works at hardware level because processor can alternate between the modes with no overhead. But clang --target=arm-windows's builtin assembler just refuses to compile .code 32... Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8252)
2019-02-16s390x assembly pack: fix formal interface bug in chacha modulePatrick Steuer1-1/+1
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8257)
2019-02-16Add an OpenSSL library contextRichard Levitte12-3/+406
The context builds on CRYPTO_EX_DATA, allowing it to be dynamically extended with new data from the different parts of libcrypto. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8225)
2019-02-16Add CRYPTO_alloc_ex_data()Richard Levitte5-16/+106
This allows allocation of items at indexes that were created after the CRYPTO_EX_DATA variable was initialized, using the exact same method that was used then. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8225)
2019-02-15Add EC_GROUP_get0_fieldDavid Asraf5-1/+54
New function to return internal pointer for field. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8195)
2019-02-15Mark generated functions unused (applies to safestack, lhash, sparse_array)Richard Levitte4-50/+58
safestack.h, lhash.h and sparse_array.h all define macros to generate a full API for the containers as static inline functions. This potentially generates unused code, which some compilers may complain about. We therefore need to mark those generated functions as unused, so the compiler knows that we know, and stops complaining about it. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8246)
2019-02-15Add option to disable Extended Master SecretTodd Short12-14/+411
Add SSL_OP64_NO_EXTENDED_MASTER_SECRET, that can be set on either an SSL or an SSL_CTX. When processing a ClientHello, if this flag is set, do not indicate that the EMS TLS extension was received in either the ssl3 object or the SSL_SESSION. Retain most of the sanity checks between the previous and current session during session resumption, but weaken the check when the current SSL object is configured to not use EMS. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3910)
2019-02-15Use order not degree to calculate a buffer size in ecdsatestMatt Caswell1-3/+3
Otherwise this can result in an incorrect calculation of the maximum encoded integer length, meaning an insufficient buffer size is allocated. Thanks to Billy Brumley for helping to track this down. Fixes #8209 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8237)
2019-02-15Fix no-stdioMatt Caswell1-0/+2
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8238)
2019-02-15Configure: make --strict-warnings a regular user provided compiler optionRichard Levitte1-20/+16
This makes `--strict-warnings` into a compiler pseudo-option, i.e. it gets treated the same way as any other compiler option given on the configuration command line, but is retroactively replaced by actual compiler warning options, depending on what compiler is used. This makes it easier to see in what order options are given to the compiler from the configuration command line, i.e. this: ./config -Wall --strict-warnings would give the compiler flags in the same order as they're given, i.e.: -Wall -Werror -Wno-whatever ... instead of what we got previously: -Werror -Wno-whatever ... -Wall Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8239)
2019-02-14Fix -verify_return_error in s_clientMatt Caswell2-2/+3
The "verify_return_error" option in s_client is documented as: Return verification errors instead of continuing. This will typically abort the handshake with a fatal error. In practice this option was ignored unless also accompanied with the "-verify" option. It's unclear what the original intention was. One fix could have been to change the documentation to match the actual behaviour. However it seems unecessarily complex and unexpected that you should need to have both options. Instead the fix implemented here is make the option match the documentation so that "-verify" is not also required. Note that s_server has a similar option where "-verify" (or "-Verify") is still required. This makes more sense because those options additionally request a certificate from the client. Without a certificate there is no possibility of a verification failing, and so "-verify_return_error" doing nothing seems ok. Fixes #8079 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8080)
2019-02-14Don't signal SSL_CB_HANDSHAKE_START for TLSv1.3 post-handshake messagesMatt Caswell6-61/+51
The original 1.1.1 design was to use SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE to signal start/end of a post-handshake message exchange in TLSv1.3. Unfortunately experience has shown that this confuses some applications who mistake it for a TLSv1.2 renegotiation. This means that KeyUpdate messages are not handled properly. This commit removes the use of SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE to signal the start/end of a post-handshake message exchange. Individual post-handshake messages are still signalled in the normal way. This is a potentially breaking change if there are any applications already written that expect to see these TLSv1.3 events. However, without it, KeyUpdate is not currently usable for many applications. Fixes #8069 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8096)
2019-02-14Ignore cipher suites when setting cipher listSam Roberts4-8/+105
set_cipher_list() sets TLSv1.2 (and below) ciphers, and its success or failure should not depend on whether set_ciphersuites() has been used to setup TLSv1.3 ciphers. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7759)
2019-02-14Configure: stop forcing use of DEFINE macros in headersRichard Levitte1-0/+3
There are times when one might want to use something like DEFINE_STACK_OF in a .c file, because it defines a stack for a type defined in that .c file. Unfortunately, when configuring with `--strict-warnings`, clang aggressively warn about unused functions in such cases, which forces the use of such DEFINE macros to header files. We therefore disable this warning from the `--strict-warnings` definition for clang. (note for the curious: `-Wunused-function` is enabled via `-Wall`) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8234)
2019-02-14Sparse array iterators include index position.Pauli4-23/+129
Iterators over the sparse array structures have gained an initial argument which indicates the index into the array of the element. This can be used, e.g., to delete or modify the associated value. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8229)
2019-02-13Windows/Cygwin dlls need the executable bit setMichael Haubenwallner1-1/+1
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8226)
2019-02-13test/build.info: add missing ../apps/includeRichard Levitte1-1/+1
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8227)
2019-02-13Added new EVP/KDF API.David Makepeace40-809/+3211
Changed PKEY/KDF API to call the new API. Added wrappers for PKCS5_PBKDF2_HMAC() and EVP_PBE_scrypt() to call the new EVP KDF APIs. Documentation updated. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6674)
2019-02-13Sparse array limit testing: reduce the range limit for the number of bitsPauli1-1/+1
in a sparse array pointer block. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8221)
2019-02-13Fix null pointer dereference in cms_RecipientInfo_kari_initDaniel DeFreez1-1/+4
CLA: trivial Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8137)
2019-02-13Move libapps headers into their own directoryRichard Levitte8-116/+116
This got triggered by test/testutil.h including ../apps/opt.h. Some compilers do all inclusions from the directory of the C file being compiled, so when a C file includes a header file with a relative file spec, and that header file also includes another header file with a relative file spec, the compiler no longer follows. As a specific example, test/testutil/basic_output.c included ../testutil.h. Fine so far, but then, test/testutil.h includes ../apps/opt.h, and the compiler ends up trying to include (seen from the source top) test/apps/opt.h rather than apps/opt.h, and fails. The solution could have been to simply add apps/ as an inclusion directory. However, that directory also has header files that have nothing to do with libapps, so we take this a bit further, create apps/include and move libapps specific headers there, and then add apps/include as inclusion directory in the build.info files where needed. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/8210)
2019-02-13Fix master build.Pauli1-1/+1
The recent change from ENGINES to MODULES broke the configure it seems. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8219)
2019-02-13Macro typo fix not propagatedPauli1-1/+1
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8217)
2019-02-13Fix typo in commentPauli1-1/+1
Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/8218)
2019-02-12To use BN_BITS2, we'd better include openssl/bn.hRichard Levitte1-0/+1
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8212)
2019-02-12eng_devcrypto.c: close open session on initEneas U de Queiroz1-6/+20
cipher_init may be called on an already initialized context, without a necessary cleanup. This separates cleanup from initialization, closing an eventual open session before creating a new one. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7859)
2019-02-12CHANGES: add note about building devcrypto dynamicEneas U de Queiroz1-0/+3
Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7859)
2019-02-12e_devcrypto: make the /dev/crypto engine dynamicEneas U de Queiroz4-63/+121
Engine has been moved from crypto/engine/eng_devcrypto.c to engines/e_devcrypto.c. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7859)
2019-02-12AArch64 assembly pack: authenticate return addresses.Andy Polyakov8-1/+77
ARMv8.3 adds pointer authentication extension, which in this case allows to ensure that, when offloaded to stack, return address is same at return as at entry to the subroutine. The new instructions are nops on processors that don't implement the extension, so that the vetification is backward compatible. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8205)
2019-02-12Add sparse array data type.Pauli8-3/+680
This commit adds a space and time efficient sparse array data structure. The structure's raw API is wrapped by inline functions which provide type safety. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8197)
2019-02-11Rework build: small correction in unix-Makefile.tmplRichard Levitte1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8162)
2019-02-11Rework build: add special cases for AIXRichard Levitte2-2/+28
When reworking the way library file names and extensions were formed, AIX was lost in the process. This restores the previous functionality. Fixes #8156 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8162)
2019-02-11apps/ocsp.c Use the same HAVE_FORK / NO_FORK as in speed.cRichard Levitte1-1/+15
This allows the user to override our defaults if needed, and in a consistent manner. Partial fix for #7607 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7624)
2019-02-11test/recipes/02-err_errstr: skip errors that may not be loaded on WindowsRichard Levitte1-0/+37
Fixes #8091 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8094) (cherry picked from commit 0e1b0e510dfe078b3fb2586d987d7b49ff8ef0b2)
2019-02-11Build: correct BASE shlib_version_as_filenameRichard Levitte1-2/+2
This function is designed to use $config{shlib_version} directly instead of taking an input argument, yet the BASE variant didn't do this. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8146)
2019-02-11ENGINE modules aren't special, so call them MODULESRichard Levitte9-83/+90
The only thing that makes an ENGINE module special is its entry points. Other than that, it's a normal dynamically loadable module, nothing special about it. This change has us stop pretending anything else. We retain using ENGINE as a term for installation, because it's related to a specific installation directory, and we therefore also mark ENGINE modules specifically as such with an attribute in the build.info files. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8147)
2019-02-11Updated test command line parsing to support commmon commandsShane Lontis46-876/+1402
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6975)
2019-02-11Allow the syntax of the .include directive to optionally have '='Tomas Mraz5-2/+26
If the old openssl versions not supporting the .include directive load a config file with it, they will bail out with error. This change allows using the .include = <filename> syntax which is interpreted as variable assignment by the old openssl config file parser. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8141)
2019-02-11Fix comment typoPauli1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8196)
2019-02-11Fix null pointer dereference in ssl_module_initDaniel DeFreez1-0/+2
CLA: Trivial Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8183)
2019-02-08Update d2i_PrivateKey documentationTodd Short1-7/+11
Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8168)
2019-02-08Fix d2i_PublicKey() for EC keysTodd Short1-1/+1
o2i_ECPublicKey() requires an EC_KEY structure filled with an EC_GROUP. o2i_ECPublicKey() is called by d2i_PublicKey(). In order to fulfill the o2i_ECPublicKey()'s requirement, d2i_PublicKey() needs to be called with an EVP_PKEY with an EC_KEY containing an EC_GROUP. However, the call to EVP_PKEY_set_type() frees any existing key structure inside the EVP_PKEY, thus freeing the EC_KEY with the EC_GROUP that o2i_ECPublicKey() needs. This means you can't d2i_PublicKey() for an EC key... The fix is to check to see if the type is already set appropriately, and if so, not call EVP_PKEY_set_type(). Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8168)
2019-02-08Address a bug in the DRBG tests where the reseeding wasn't properlyPauli1-3/+3
reinstantiating the DRBG. Bug reported by Doug Gibbons. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/8184)
2019-02-07test/drbgtest.c: call OPENSSL_thread_stop() explicitlyRichard Levitte1-0/+10
The manual says this in its notes: ... and therefore applications using static linking should also call OPENSSL_thread_stop() on each thread. ... Fixes #8171 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8173)
2019-02-07Make OPENSSL_malloc_init() a no-opMatt Caswell2-11/+4
Making this a no-op removes a potential infinite loop than can occur in some situations. Fixes #2865 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8167)
2019-02-07Add CHANGES entry for blake2macAntoine Salon1-0/+3
Signed-off-by: Antoine Salon <asalon@vmware.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8172)
2019-02-06blake2: avoid writing to output buffer when using default digest lengthAntoine Salon2-10/+24
Signed-off-by: Antoine Salon <asalon@vmware.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7726)
2019-02-06blake2: add evpmac test vectorsAntoine Salon2-4/+252
Signed-off-by: Antoine Salon <asalon@vmware.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7726)
2019-02-06blake2: backport changes to blake2sAntoine Salon10-11/+264
Signed-off-by: Antoine Salon <asalon@vmware.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7726)
2019-02-06blake2: add EVP_MAC man pageAntoine Salon2-7/+124
Signed-off-by: Antoine Salon <asalon@vmware.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7726)
generated by cgit v1.1 at 2024-08-10 11:05:19 +0000