Commit Graph

15291 Commits

Author SHA1 Message Date
Richard Levitte
777a288270 unified build scheme: add build.info files
Now that we have the foundation for the "unified" build scheme in
place, we add build.info files.  They have been generated from the
Makefiles in the same directories.  Things that are platform specific
will appear in later commits.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-02-01 12:46:58 +01:00
Richard Levitte
9fe2bb77c4 unified build scheme: a first introduction
The "unified" build scheme revolves around small information files,
build.info, which each describe their own bit of everything that needs
to be built, using a mini-language described in Configurations/README.

The information in build.info file contain references to source files
and final result.  Object files are not mentioned at all, they are
simply from source files.  Because of this, all the *_obj items in
Configurations/*.conf are renamed to *_asm_src and the files listed
in the values are change from object files to their corresponding
source files.  For the sake of the other build schemes, Configure
generates corresponding *_obj entries in %target.

Furthermore, the "unified" build scheme supports having a build
directory tree separate from the source directry tree.

All paths in a build.info file is assumed to be relative to its
location, either within the source tree or within the build tree.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-02-01 12:46:58 +01:00
Viktor Dukhovni
1d85277235 Add tests for non-ca trusted roots and intermediates
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31 21:24:16 -05:00
Viktor Dukhovni
33cc5dde47 Compat self-signed trust with reject-only aux data
When auxiliary data contains only reject entries, continue to trust
self-signed objects just as when no auxiliary data is present.

This makes it possible to reject specific uses without changing
what's accepted (and thus overring the underlying EKU).

Added new supported certs and doubled test count from 38 to 76.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31 21:24:12 -05:00
Viktor Dukhovni
0daccd4dc1 Check chain extensions also for trusted certificates
This includes basic constraints, key usages, issuer EKUs and auxiliary
trust OIDs (given a trust suitably related to the intended purpose).

Added tests and updated documentation.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31 21:23:23 -05:00
Dr. Stephen Henson
1b4cf96f9b Zero newly allocated points
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31 22:18:31 +00:00
Dr. Stephen Henson
aedc37e700 Remove redundant code.
d2i_ECPrivateKey always caculates the public key so there is
no need to caculate it again in eckey_priv_decode().

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31 22:18:30 +00:00
Dr. Stephen Henson
be2e334fce Add EC_GROUP_order_bits, EC_GROUP_get0_order and EC_GROUP_get0_cofactor
New functions to return internal pointer for order and cofactor. This
avoids the need to allocate a new BIGNUM which to copy the value to.
Simplify code to use new functions.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31 22:18:30 +00:00
Andy Polyakov
81e03785f7 Engage poly1305-sparcv9 module.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-31 22:50:10 +01:00
Andy Polyakov
0049eb46e4 Add poly1305/asm/poly1305-sparcv9.pl.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-31 22:49:42 +01:00
Andy Polyakov
46d4d86577 Configure: restore original logic for -DWHIRLPOOL_ASM.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-31 22:43:29 +01:00
Daniel Kahn Gillmor
8ab31975ba RT4129: BUF_new_mem_buf should take const void *
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31 14:05:13 -05:00
Richard Levitte
0e87e05816 Remove the extra checks for Intel's C compiler
When the target is {something}-icc, we're doing some extra checks of
the icc compiler.  However, all such targets were cleaned away in
March 2015, so this Configure section is dead code.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31 19:51:33 +01:00
Rich Salz
b59e1bed7d RT3755: Remove duplicate #include
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-31 09:42:53 -05:00
Richard Levitte
fb36ca1290 Don't go into dotted directories when copying Makefile.in to Makefile
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31 12:49:36 +01:00
Rich Salz
769adcfe8b GH102: Extra volatile avoids GCC bug
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-01-30 20:19:19 -05:00
Rich Salz
9716b0b9de Remove extra level of indirection.
Remove OPENSSL_IMPORT as its only purpose is to define OPENSSL_EXTERN.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-30 18:11:12 -05:00
Rich Salz
94af0cd7f3 Move more BN internals to bn_lcl.h
There was an unused macro in ssl_locl.h that used an internal
type, so I removed it.
Move bio_st from bio.h to ossl_type.h

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-01-30 16:54:35 -05:00
Rich Salz
98ab57644f GH102: Add volatile to CRYPTO_memcmp
Can't hurt and seems to prevent problems from some over-aggressive
(LTO?) compilers.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-30 14:37:43 -05:00
Richard Levitte
c10d1bc81c When checking if there's a VMS directory spec, don't forget the possible device
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-30 17:11:48 +01:00
Richard Levitte
9c626317a6 Fix test/recipes/25-test_verify.t
top_dir() are used to create directory names, top_file() should be
used for files.  In a Unixly environment, that doesn't matter, but...

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-30 17:10:38 +01:00
Dr. Stephen Henson
4ddd5acecc handle "Ctrl" in separate function
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-30 16:02:48 +00:00
Dr. Stephen Henson
404cc933b7 Add test data for ECDH
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-30 16:02:48 +00:00
Dr. Stephen Henson
d4ad48d7bd Add support for EVP_PKEY_derive in evp_test
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-30 16:02:48 +00:00
Dr. Stephen Henson
bc9d9ce27a fix warning
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-30 16:02:48 +00:00
Dr. Stephen Henson
7ab507495b Add function to return internal enoding of X509_NAME.
PR#4280

Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-01-30 16:02:48 +00:00
Richard Levitte
33254e1c6f Fix opt_imax() call
Not all architectures have a time_t defined the same way.  To make
sure we get the same result, we need to cast &checkoffset to (intmax_t *)
and make sure that intmax_t is defined somehow.

To make really sure we don't pass a variable with the wrong size down
to opt_imax(), we use a temporary intmax_t.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-30 16:23:44 +01:00
Richard Levitte
421e30ec67 Configure: Clarify the handling of $thread_cflags
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-30 07:53:02 +01:00
Viktor Dukhovni
ea5e0c1caf Make opt_imax visible in all apps
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 18:46:55 -05:00
Rich Salz
826e9e5446 Missed rc2_int from before.
Also remove $Makefile variable :)

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-01-29 17:22:38 -05:00
Viktor Dukhovni
bc8c34d74a Fix invalid policy detection
As a side-effect of opaque x509, ex_flags were looked up too early,
before additional policy cache updates.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-29 17:00:40 -05:00
Rich Salz
ced2c2c598 Templatize util/domd
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-29 16:56:07 -05:00
Viktor Dukhovni
56087077d8 Better type for x509 -checkend argument
This is a time_t and can be zero or negative.  So use 'M' (maximal
signed int) not 'p' (positive int).

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 15:38:08 -05:00
Richard Levitte
04b08fbc3d Complete the lflags -> lflags/ex_libs transition
Some last lflags to convert to ex_libs or a combo of lflags and ex_libs

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 19:28:05 +01:00
Richard Levitte
1740c16265 Configure et al: split up the lflags configuration item into two
The lflags configuration had a weird syntax with a % as separator.  If
it was present, whatever came before ended up as PEX_LIBS in Makefile
(usually, this is LDFLAGS), while whatever came after ended up as
EX_LIBS.

This change splits that item into lflags and ex_libs, making their use
more explicit.

Also, PEX_LIBS in all the Makefiles are renamed to LDFLAGS.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 18:36:57 +01:00
Richard Levitte
ddf47a10cd Make use of add() and add_before() in Configurations/
A few more sub-joins could be replaced with calls to add() and add_before()

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 18:17:30 +01:00
Richard Levitte
f8206c8e24 Revert "Don't replace cflags with thread_cflags, only append the latter"
This reverts commit a450326ee0.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 18:00:45 +01:00
Rich Salz
723acb1445 Merge error, wrong domd submitted.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-29 11:36:21 -05:00
Richard Levitte
a450326ee0 Don't replace cflags with thread_cflags, only append the latter
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-29 17:32:31 +01:00
Rich Salz
96d608beb0 Remove clean-depend
Remove depend hacks from demos/engines.
Remove clean-depend; just call makedepend (or $CC -M) and use that.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-29 11:15:20 -05:00
Viktor Dukhovni
aea6116146 Make it possible to check for explicit auxiliary trust
By default X509_check_trust() trusts self-signed certificates from
the trust store that have no explicit local trust/reject oids
encapsulated as a "TRUSTED CERTIFICATE" object.  (See the -addtrust
and -trustout options of x509(1)).

This commit adds a flag that makes it possible to distinguish between
that implicit trust, and explicit auxiliary settings.

With flags |= X509_TRUST_NO_SS_COMPAT, a certificate is only trusted
via explicit trust settings.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-29 10:53:46 -05:00
Emilia Kasper
d8ca44ba41 Always DPURIFY
The use of the uninitialized buffer in the RNG has no real security
benefits and is only a nuisance when using memory sanitizers.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-29 16:33:13 +01:00
Rich Salz
a01dab9462 Remove x86_gcc_des,x86_gcc_opts
This is a followin from !1738, we no longer need those variables.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-29 10:30:57 -05:00
Matt Caswell
8ce4e7e605 Add have_precompute_mult tests
Add tests for have_precompute_mult for the optimised curves (nistp224,
nistp256 and nistp521) if present

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-29 12:56:58 +00:00
Matt Caswell
615614c886 Fix bug in nistp224/256/521 where have_precompute_mult always returns 0
During precomputation if the group given is well known then we memcpy a
well known precomputation. However we go the wrong label in the code and
don't store the data properly. Consequently if we call have_precompute_mult
the data isn't there and we return 0.

RT#3600

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-29 12:56:58 +00:00
Matt Caswell
f5a12207ec Add missing return value checks
The function DH_check_pub_key() was missing some return value checks in
some calls to BN functions.

RT#4278

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-01-29 11:53:32 +00:00
Matt Caswell
cb389fe804 Correct value of DH_CHECK_PUBKEY_INVALID
A new return value for DH_check_pub_key was recently added:
DH_CHECK_PUBKEY_INVALID. As this is a flag which can be ORed with other
return values it should have been set to the value 4 not 3.

RT#4278

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-01-29 11:53:32 +00:00
Matt Caswell
ec4479249d Implement Async SSL_shutdown
This extends the existing async functionality to SSL_shutdown(), i.e.
SSL_shutdown() can now casuse an SSL_ERROR_WANT_ASYNC error to be returned
from SSL_get_error() if async mode has been enabled.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-29 11:36:44 +00:00
Viktor Dukhovni
35ade23b02 Keep RC5 bit shifts in [0..31]
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-28 21:39:46 -05:00
Dr. Stephen Henson
987157f6f6 Use callback for DSAPublicKey
PR#4277

Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-01-28 23:41:35 +00:00