Commit Graph

17261 Commits

Author SHA1 Message Date
Rich Salz
54478ac92a GH1278: Removed error code for alerts
Commit aea145e removed some error codes that are generated
algorithmically: mapping alerts to error texts.  Found by
Andreas Karlsson.  This restores them, and adds two missing ones.

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 13:28:33 -04:00
Rich Salz
91da5e7710 Replace all #define's in pod pages.
Function-like macros are replaced with prototypes and a note
that they are implemented as macros.  Constants are just
referenced in-line in the text.

Tweak BIO_TYPE_... documentation.

Also fix RT4592.

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 12:55:45 -04:00
Richard Levitte
07aaab39b2 VMS: openssl_ivp must call versioned openssl_startup and openssl_utils
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-08 17:37:29 +02:00
Matt Caswell
4bbd4ba66d Disallow multiple protocol flags to s_server and s_client
We shouldn't allow both "-tls1" and "-tls1_2", or "-tls1" and "-no_tls1_2".
The only time multiple flags are allowed is where they are all "-no_<prot>".

This fixes Github Issue #1268

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-08 16:20:59 +01:00
Richard Levitte
3503549ee8 Unix: Set the execute permission on installed shared libraries
Some Unix variants require shared libraries to have the execute
permissions set, or they won't be loadable or executable when loaded.
Among others, cygwin has this requirement.

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 15:04:30 +02:00
Richard Levitte
27f215cfa3 Reorganize .gitignore to make better use of its features
It's possible to have a very few rules for some directories and trust
that other patterns further along will take care of whatever is left.
.gitignore should therefore be loosely organised from least generic to
most generic, allowing things like this:

    # Keep any file with extensions, such as foo.c, bar.h, ...
    !/dir/*.*

    # ....

    # Remove all object files
    *.o
    *.obj

With this change, we implement some very generic rules for what will
and will not be ignored in the fuzz subdirectory, and truse that
patterns later on (such as *.o, *.obj, *.exe) will take care of
everything we didn't specifically specify for the fuzz subdirectory.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-08 15:03:43 +02:00
Andy Polyakov
f1f5ee17b6 include/openssl: don't include <windows.h> in public headers.
If application uses any of Windows-specific interfaces, make it
application developer's respondibility to include <windows.h>.
Rationale is that <windows.h> is quite "toxic" and is sensitive
to inclusion order (most notably in relation to <winsock2.h>).
It's only natural to give complete control to the application developer.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 11:49:44 +02:00
Dr. Stephen Henson
ab6a591caa Support PKCS v2.0 print in pkcs12 utility.
Extended alg_print() in pkcs12 utility to support PBES2 algorithms.

RT#4588

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-08 02:09:02 +01:00
Richard Levitte
e78884d79c VMS: correct post-install instructions
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-07 15:07:32 +02:00
Richard Levitte
3ffb060ee2 Windows: make some vars in windows-makefile.tmpl reachable again
$openssldir and $enginesdir were mistakenly made unavailable to other
perl fragments.  They are still needed in the definition of CFLAGS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-07 15:07:32 +02:00
Richard Levitte
794ad95269 VMS: defined the logical name OPENSSL at all times
This logical names permits '#include <openssl/foo.h>' to work properly.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-07 15:07:32 +02:00
Richard Levitte
e8fb12957a Versioning engines default location: the VMS case
OpenSSL engines are tied to the OpenSSL shared library versions,
starting with OpenSSL 1.1.  We therefore need to install them in
directories which have the shared library version in it's name, to
easily allow multiple OpenSSL versions to be installed at the same
time.

For VMS, the change is a bit more involved, primarly because the top
installation directory was already versioned, *as well as* some of the
files inside.  That's a bit too much.  Version numbering in files is
also a bit different on VMS.  The engines for shared library version
1.1 will therefore end up in OSSL$INSTROOT:[ENGINES0101.'arch']

('arch' is the architecture we build for)

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-07 15:07:32 +02:00
Richard Levitte
b2de11c58b Versioning engines default location: the Unix case
OpenSSL engines are tied to the OpenSSL shared library versions,
starting with OpenSSL 1.1.  We therefore need to install them in
directories which have the shared library version in it's name, to
easily allow multiple OpenSSL versions to be installed at the same
time.

For Unix, the default installation directory is changed from
$PREFIX/lib/engines to $PREFIX/lib/engines-${major}_${minor} (mingw)
or $PREFIX/lib/engines-${major}.${minor} (all but mingw)

($PREFIX is the directory given for the configuration option --prefix,
and ${major} and ${minor} are the major and minor shared library
version numbers)

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-07 15:07:32 +02:00
Richard Levitte
ee0a61cfb8 Versioning engines default location: the Windows case
OpenSSL engines are tied to the OpenSSL shared library versions,
starting with OpenSSL 1.1.  We therefore need to install them in
directories which have the shared library version in it's name, to
easily allow multiple OpenSSL versions to be installed at the same
time.

For windows, the default installation directory is changed from
$PREFIX/lib/engines to $PREFIX/lib/engines-${major}_${minor}

($PREFIX is the directory given for the configuration option --prefix,
and ${major} and ${minor} are the major and minor shared library
version numbers)

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-07 15:07:32 +02:00
Rich Salz
d20841c414 Add OPENSSL_NO_EC wrapper
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-06 09:48:00 -04:00
Richard Levitte
8478a70333 Make 'build_libs' build shared libraries as well
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-06 14:38:13 +02:00
Dr. Stephen Henson
b385889640 Don't indicate errors during initial adb decode.
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-07-06 02:41:14 +01:00
Richard Levitte
e45c78fc98 VMS: make sure there's a file extension when creating files
When creating the library $lib.olb, make sure the extension is there.
Otherwise, a logical name with the same name as the file in question
will redirect the creation elsewhere.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-07-06 02:08:53 +02:00
Richard Levitte
5aa8096fd0 VMS: arch in config.com was mistakenly made process global
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-07-06 01:23:41 +02:00
Richard Levitte
85cdc842c8 make update
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-05 23:52:09 +02:00
Richard Levitte
5534c16a87 Stop using and deprecate ENGINE_setup_bsd_cryptodev
The calls we made to it were redundant, as the same initialization is
done later in OPENSSL_init_crypto() anyway.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-05 23:52:09 +02:00
FdaSilvaYY
b77a86535e Fix mem error handling in PKCS7_simple_smimecap
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-05 17:45:58 +01:00
FdaSilvaYY
4aed8756d8 Improve some error management code in CT
Separate invalid input case from any internal (malloc) failure

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-05 17:45:58 +01:00
FdaSilvaYY
e57036f2bf Fix some memory error handling in CT
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-05 17:45:58 +01:00
FdaSilvaYY
68efafc513 Add checks on sk_TYPE_push() returned value
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-05 17:45:50 +01:00
Dr. Stephen Henson
c2d551c019 Reorganise asn1.h and add comments.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-05 01:19:00 +01:00
Rich Salz
31b15b9b55 Update fuzz/README.md
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-04 09:47:27 -04:00
Richard Levitte
d513369bfa perl: Separate compile-time environment from runtime environment
Make it possible to have a separate and different perl command string
for installable scripts than we use when building, with the
environment variable HASHBANGPERL.  Its value default to the same as
the environment PERL if it's defined, otherwise '/usr/bin/env perl'.

Note: this is only relevant for Unix-like environments.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-07-04 15:40:31 +02:00
Andreas Karlsson
9d6daf99c2 Fix broken loading of client CAs
The SSL_load_client_CA_file() failed to load any CAs due to an
inccorrect assumption about the return value of lh_*_insert(). The
return value when inserting into a hash is the old value of the key.

The bug was introduced in 3c82e437bb.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1279)
2016-07-02 15:30:13 -04:00
Richard Levitte
3426de2262 VMS: Add installation verification procedure
On VMS, it's customary to have a procedure to check that the software
was installed correctly and can run as advertised.

The procedure added here is fairly simple, it checks that all
libraries are in place, that the header crypto.h is in place, and that
the command 'openssl version -a' runs without trouble.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-02 15:50:44 +02:00
Richard Levitte
d17d3293d1 Fix some VMS inconsistencies
- The install top is versioned by default.  However, only the major
  version should be used.
- the default areas for certs, private keys an config files have
  changed, now all prefixed with 'OSSL$'.  This gets reflected in
  cryptlib.h.
- [.VMS]openssl_startup.com.in had some faults regarding creating
  rooted concealed logical names.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-02 15:49:45 +02:00
Richard Levitte
dbb3aba17e Install the openssl app with version number on VMS
This makes it possible for script writers to lock on to a specific
version if they need to.  Note that only the major version number is
used.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-02 15:49:45 +02:00
Richard Levitte
8842005e75 Have the VMS shared library file names contain the shared version
Also, have the static library file names contain the pointer size when
applicable.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-02 15:49:45 +02:00
Richard Levitte
34d5490a1d Pass down correct information to the VMS startup script templates
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-02 15:49:45 +02:00
Richard Levitte
7878e536d0 Add the missing pointer_size information on VMS configs
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-02 15:49:45 +02:00
Ben Laurie
27c40a9317 Ensure that global dependencies are built first, even for parallell builds
Also, make sure that per-file deps are included in the build, even if previous
builds have failed.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-02 13:57:07 +01:00
Matt Caswell
fe964f0c88 Use the SSL_METHODs passed to create_ssl_ctx_pair()
Don't use hardcoded SSL_METHODs!

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-01 23:23:16 +01:00
Matt Caswell
1e16987fc1 Avoid an overflow in constructing the ServerKeyExchange message
We calculate the size required for the ServerKeyExchange message and then
call BUF_MEM_grow_clean() on the buffer. However we fail to take account of
2 bytes required for the signature algorithm and 2 bytes for the signature
length, i.e. we could overflow by 4 bytes. In reality this won't happen
because the buffer is pre-allocated to a large size that means it should be
big enough anyway.

Addresses an OCAP Audit issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-01 19:23:29 +01:00
Rich Salz
43cb309053 Cleanup obj_dat.h, obj_dat.pl
The recent merge of https://github.com/openssl/openssl/pull/1264
removed some trailing whitespace from the generated file obj_dat.h.
Unfortunately obj_dat.pl kept re-adding it.  Clean up the
script and the output it generates.

Add 'use strict / use warnings'

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-01 13:53:37 -04:00
Richard Levitte
15a1f19e62 Deal with pod2html issues, in this case the lack of .html suffix in links
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-01 19:06:37 +02:00
Richard Levitte
0483f58652 Simplify INCLUDE statements in build.info files
Now that INCLUDE considers both the source and build trees, no need
for the rel2abs perl fragment hacks any more.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-01 18:36:08 +02:00
Richard Levitte
4748f89022 Make build.info INCLUDE stmts be both source and build tree relative
INCLUDE statements in build.info files were source tree centric.  That
meant that to get include directory specs in the build tree, we had to
resort to perl fragments that specified the build tree include paths
as absolute ones.

This change has the INCLUDE statement consider both the source and
build tree for any include directory.  It means that there may be some
extra unnecessary include paths, but it also makes life simpler for
anyone who makes changes in the build.info files.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-01 18:34:21 +02:00
Dr. Stephen Henson
352dbbaf4c fix 'set but not used' warning
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-01 16:05:37 +01:00
Kurt Roeckx
a05b0bcf87 Re-add x509 and crl fuzzer
Reviewed-by: Rich Salz <rsalz@openssl.org>

GH: #1276
2016-07-01 17:02:33 +02:00
Kurt Roeckx
dd850bcb39 Add old locking constants back
Fixes #1260

Reviewed-by: Matt Caswell <matt@openssl.org>

GH: #1266
2016-07-01 17:02:33 +02:00
Kurt Roeckx
453bff2267 Make CRYPTO_num_locks() return 1
malloc(0) might return NULL and code for the old callbacks might fail,
instead just say they should allocate 1 entry.

Reviewed-by: Matt Caswell <matt@openssl.org>

GH: #1266
2016-07-01 17:02:33 +02:00
mrpre
152d264616 fix code formatting
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1223)
2016-07-01 10:56:19 -04:00
mrpre
0a1d3a8152 add return value for expand
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1223)
2016-07-01 10:56:19 -04:00
Alessandro Ghedini
a66069dbcd Fix printing private EC_KEY
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1273)
2016-07-01 10:46:21 -04:00
Viktor Szakats
533bf1df55 ssl.h: spelling in comment
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1275)
2016-07-01 10:40:13 -04:00