summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2017-12-08Standardize syntax of sizeof(foo)Rich Salz
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4876)
2017-12-08Correct minor typo in ssl_locl.h commentDaniel Bevenius
CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4880) (cherry picked from commit 6aff543b9bf14bdac7f5385a9e56b8785b30f6d8)
2017-12-08Fix an incoherent test.FdaSilvaYY
Pointer 'o' is set inside a local buffer, so it can't be NULL. Also fix coding style and add comments Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4754) (cherry picked from commit cef115ff0ca4255d3decc1dda87c5418a961fd2c)
2017-12-08In apps_startup(), call OPENSSL_init_ssl() rather than OPENSSL_init_crypto()Richard Levitte
Otherwise, any command that relies on ssl modules may fail, because SSL_add_ssl_module() will be called after the config file has already been loaded. Fixes #4788 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4792) (cherry picked from commit 0488c0bbbe87eee3a800797b91350c653e9f1711)
2017-12-08In OPENSSL_init_ssl(), run the base ssl init before OPENSSL_init_crypto()Richard Levitte
IF OPENSSL_init_ssl() is called with the option flag OPENSSL_INIT_LOAD_CONFIG, any SSL config will be handled wrongly (i.e. there will be an attempt to load libssl_conf.so or whatever corresponds to that on non-Unix platforms). Therefore, at least SSL_add_ssl_module() MUST be called before OPENSSL_init_crypto() is called. The base ssl init does that, plus adds all kinds of ciphers and digests, which is harmless. Fixes #4788 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4792) (cherry picked from commit 0a90a6831e02e00d9043ada635421cfd3da5ffe2)
2017-12-08Remove unicode characters from sourceRichard Levitte
Some compilers react badly to non-ASCII characters Fixes #4877 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4879) (cherry picked from commit d68a0eaf45f12392065f3cf716a1a2682d55d3ce)
2017-12-07Fix the buffer sizing in the fatalerrtestMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4868)
2017-12-06Update CHANGES and NEWS for the new releaseMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-12-06Add a test for CVE-2017-3737Matt Caswell
Test reading/writing to an SSL object after a fatal error has been detected. This CVE only affected 1.0.2, but we should add it to other branches for completeness. Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-12-06bn/asm/rsaz-avx2.pl: fix digit correction bug in rsaz_1024_mul_avx2.Andy Polyakov
Credit to OSS-Fuzz for finding this. CVE-2017-3738 Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-12-04Update eng_fat.cMerQGh
This line will allow use private keys, which created by Crypto Pro, to sign with OpenSSL. CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4836) (cherry picked from commit b35bb37a3d6ecf11b43ef8717600ab61718c3cc2)
2017-12-04Adjusted Argument IndicesMarkus Sauermann
CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4835) (cherry picked from commit 1e2804f25c80136c33f3508adb54b24106b6b6f6)
2017-11-30Make possible variant SONAMEs and symbol versionsViktor Dukhovni
This small change in the Unix template and shared library build scripts enables building "variant" shared libraries. A "variant" shared library has a non-default SONAME, and non default symbol versions. This makes it possible to build (say) an OpenSSL 1.1.0 library that can coexist without conflict in the same process address space as the system's default OpenSSL library which may be OpenSSL 1.0.2. Such "variant" shared libraries make it possible to link applications against a custom OpenSSL library installed in /opt/openssl/1.1 or similar location, and not risk conflict with an indirectly loaded OpenSSL runtime that is required by some other dependency. Variant shared libraries have been fully tested under Linux, and build successfully on MacOS/X producing variant DYLD names. MacOS/X Darwin has no symbol versioning, but has a non-flat library namespace. Variant libraries may therefore support multiple OpenSSL libraries in the same address space also with MacOS/X, despite lack of symbol versions, but this has not been verified. Variant shared libraries are optional and off by default. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-11-30Fix docs for EVP_EncryptUpdate and EVP_DecryptUpdateFdaSilvaYY
Fixes #4775 Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4815)
2017-11-27Check for malloc failureRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4805) (cherry picked from commit 378db52bb0177ae03cac3c3ba194bb6dec34a2d7)
2017-11-25Pretty-print large INTEGERs and ENUMERATEDs in hex.David Benjamin
This avoids taking quadratic time to pretty-print certificates with excessively large integer fields. Very large integers aren't any more readable in decimal than hexadecimal anyway, and the i2s_* functions will parse either form. Found by libFuzzer. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4790) (cherry picked from commit 10a3195fcf7d04ba519651cf12e945a8fe470a3c)
2017-11-24Fix EVP_MD_meth_new.podRichard Levitte
A name too many in the NAME section, and a copyright year update Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4789) (cherry picked from commit 92793648945affdfe529fa711666d19528815789)
2017-11-24Correct EVP_CIPHER_meth_new.pod and EVP_MD_meth_new.podRichard Levitte
One had some lines copied from the other, and both were missing a proper RETURN VALUES section. Fixes #4781 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4787) (cherry picked from commit 51e47d5f6a7944c3e3ddc5f6d376fc1320639277)
2017-11-22Avoid unnecessary MSYS2 conversion of some argumentsRichard Levitte
Fixes #4740 The MSYS2 run-time convert arguments that look like paths when executing a program unless that application is linked with the MSYS run-time. The exact conversion rules are listed here: http://www.mingw.org/wiki/Posix_path_conversion With the built-in configurations (all having names starting with "mingw"), the openssl application is not linked with the MSYS2 run-time, and therefore, it will receive possibly converted arguments from the process that executes it. This conversion is fine for normal path arguments, but it happens that some arguments to the openssl application get converted when they shouldn't. In one case, it's arguments like '-passin file:something', and in another, it's a file: URI (what typically happens is that URIs without an authority component get converted, 'cause the conversion mechanism doesn't recognise them as URIs). To avoid conversion where we don't want it, we simply assign MSYS2_ARG_CONV_EXCL a pattern to avoid specific conversions. As a precaution, we only do this where we obviously need it. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4766)
2017-11-16bn/bn_add.c: address performance regression.Andy Polyakov
Performance regression was reported for EC key generation between 1.0.2 and 1.1.x [in GH#2891]. It naturally depends on platform, values between 6 and 9% were observed. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4743) (cherry picked from commit a78324d95bd4568ce2c3b34bfa1d6f14cddf92ef)
2017-11-13asn1/a_strex.c: fix flags truncation in do_esc_char.Andy Polyakov
|flags| argument to do_esc_char was apparently truncated by implicit cast. [Caught by VC warning subsytem.] Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4721) (cherry picked from commit 372463103917fcc2b68bd2ba3db55b29ce325705)
2017-11-11lhash.c: Replace Unicode EN DASH with the ASCII char '-'.Long Qin
* addressing", Proc. 6th Conference on Very Large Databases: 212–223 ^ The EN DASH ('–') in this line is one UTF-8 character (hex: e2 80 93). Under some code page setting (e.g. 936), Visual Studio may report C4819 warning: The file contains a character that cannot be represented in the current code page. Replace this character with the ASCII char '-' (Hex Code: 2D). Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4691) (cherry picked from commit b4d0fa49d9d1a43792e58b0c8066bb23b9e53ef4)
2017-11-10Fix possible leaks on sk_X509_EXTENSION_push() failure ...FdaSilvaYY
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4677) (cherry picked from commit 1687aa760cdd164b12c5b70e65cadcbce1e7ccfa)
2017-11-10util/copy.pl: work around glob quirk in some of earlier 5.1x Perl versions.Andy Polyakov
In earlier 5.1x Perl versions quoting globs works only if there is white space. If there is none, it's looking for names starting with ". Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4695) (cherry picked from commit 1097d2a39e3f85d4dac2c4d1c238792d6e1d959f)
2017-11-08Configurations/unix-Makefile.tmpl: fix HP-UX build.Andy Polyakov
HP-UX make doesn't recognize $< in explict target rules, only in inference ones such as .c.o. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4697) (cherry picked from commit b6705d4893d1566c3a5427e387ce99344497758d)
2017-11-08rc4/build.info: fix HP-UX rc4-ia64 rule.Andy Polyakov
HP-UX make doesn't recognize $< in explict target rules, only in inference ones such as .c.o. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4694)
2017-11-07Configure: cleanup @disable_cascadeRichard Levitte
'rsa', 'sha' and 'tlsext' can't be disabled, not even as a consequence of other conditions, so having cascading disables that depend on them is futile. Clean up! Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4693) (cherry picked from commit 89635075d84353fc0c3d44a82fd0903ccd4ab24a)
2017-11-07Mark a zero length record as readMatt Caswell
If SSL_read() is called with a zero length buffer, and we read a zero length record then we should mark that record as read. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4686)
2017-11-07Fix race condition in TLSProxyMatt Caswell
Normally TLSProxy waits for the s_server process to finish before continuing. However in cases where serverconnects > 1 we need to keep the s_server process around for a later test so we continue immediately. This means that TAP test output can end up being printed to stdout at the same time as s_server is printing stuff. This confuses the test runner and can cause spurious test failures. This commit introduces a small delay in cases where serverconnects > 1 in order to give s_server enough time to finish what it was doing before we continue to the next test. Fixes #4129 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4661)
2017-11-07Remove 4 broken macros from ocsp.hMatt Caswell
There were 4 macros in ocsp.h that have not worked since 1.1.0 because they attempt to access the internals of an opaque structure. For OCSP_REQUEST_sign() applications should use OCSP_request_sign() instead. For OCSP_BASICRESP_sign() applications should use OCSP_basic_sign() instead. For OCSP_REQUEST_verify() applications should use OCSP_request_verify() instead. For OCSP_BASICRESP_verify() applications should use OCSP_basic_verify() instead. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4635) (cherry picked from commit 9f5671c7e9f30dfa53b1a2b553f234c2761ceb66)
2017-11-05Consolidate the locations where we have our internal perl modulesRichard Levitte
Instead of having perl modules under test/testlib and util, consolidate them all to be inside util/perl. (this is an adaptation of the part of #4069 that wasn't included in #4666) Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4667)
2017-11-05Perl: Use our own globbing wrapper rather than File::Glob::globRichard Levitte
File::Glob::glob is deprecated, it's use generates this kind of message: File::Glob::glob() will disappear in perl 5.30. Use File::Glob::bsd_glob() instead. at ../master/Configure line 277. The first idea was to use a construction that makes the caller glob() use File::Glob::bsd_glob(). That turned out not to work well everywhere, so instead, we make our own wrapper, OpenSSL::Glob and use that. Fixes #4636 (this is an adaptation of #4040 and part of #4069, for 1.1.0) Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4666)
2017-11-05aes/asm/{aes-armv4|bsaes-armv7}.pl: make it work with binutils-2.29.Andy Polyakov
It's not clear if it's a feature or bug, but binutils-2.29[.1] interprets 'adr' instruction with Thumb2 code reference differently, in a way that affects calculation of addresses of constants' tables. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/4669) (cherry picked from commit b82acc3c1a7f304c9df31841753a0fa76b5b3cda)
2017-11-03Spelling doc #3580FdaSilvaYY
Duplicated tests descriptions Backport of #3580 to 1.1.0 plus a few other typo fixes found at fligth. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/4645)
2017-11-03Add error handling in dsa_main and ASN1_i2d_bio.Pavel Kopyl
CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/4600) (cherry picked from commit a6f622bc99ffdc7b34199babb9d200b24a7a6431)
2017-11-03Check return value of OBJ_nid2obj in dsa_pub_encode.Pavel Kopyl
CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/4600) (cherry picked from commit 7760384b403a61824c43cc767a11cd22abfa9e49)
2017-11-03Travis: if "make update" created a diff, please show itRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4652) (cherry picked from commit d7948767556e68378b75196841b3d32dd70d169a)
2017-11-02Prepare for 1.1.0h-devMatt Caswell
Reviewed-by: Andy Polyakov <appro@openssl.org>
2017-11-02Prepare for 1.1.0g releaseOpenSSL_1_1_0gMatt Caswell
Reviewed-by: Andy Polyakov <appro@openssl.org>
2017-11-02Update CHANGES and NEWS for new releaseMatt Caswell
Reviewed-by: Andy Polyakov <appro@openssl.org>
2017-11-02bn/asm/x86_64-mont5.pl: fix carry bug in bn_sqrx8x_internal.Andy Polyakov
Credit to OSS-Fuzz for finding this. CVE-2017-3736 Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-11-02Fix small but important regressionRichard Levitte
In OpenSSL pre 1.1.0, 'openssl x509 -CAkeyformat engine' was possible and supported. In 1.1.0, a small typo ('F' instead of 'f') removed that possibility. This restores the pre 1.1.0 behavior. Fixes #4366 Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4643) (cherry picked from commit bd6eba79d70677f891f1bb55b6f5bc5602c47cbc)
2017-11-01Address a timing side channel whereby it is possible to determine somePauli
information about the length of the scalar used in ECDSA operations from a large number (2^32) of signatures. This doesn't rate as a CVE because: * For the non-constant time code, there are easier ways to extract more information. * For the constant time code, it requires a significant number of signatures to leak a small amount of information. Thanks to Neals Fournaise, Eliane Jaulmes and Jean-Rene Reinhard for reporting this issue. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4576) (cherry picked from commit 4a089bbdf11f9e231cc68f42bba934c954d81a49)
2017-11-01 Address a timing side channel whereby it is possible to determine somePauli
information about the length of a value used in DSA operations from a large number of signatures. This doesn't rate as a CVE because: * For the non-constant time code, there are easier ways to extract more information. * For the constant time code, it requires a significant number of signatures to leak a small amount of information. Thanks to Neals Fournaise, Eliane Jaulmes and Jean-Rene Reinhard for reporting this issue. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4576) (cherry picked from commit c0caa945f6ef30363e0d01d75155f20248403df4)
2017-10-31Travis: Add a docs checking jobRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4631)
2017-10-31docs: assign section 7 where appropriateRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4633)
2017-10-31doc/crypto/OPENSSL_secure_malloc: add missing namesRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4633)
2017-10-31docs: fixup OpenSSL version styleRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4633)
2017-10-31Adapt util/find-doc-nits back to 1.1.0Richard Levitte
This version was a direct port from 1.1.1-dev, which has a different source structure for the docs. Adjustment done. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4633)
2017-10-31Fix EVP_PKEY_ASN1_METHOD manualRichard Levitte
Missing names slipped through Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4630)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-31 15:42:19 +0000