Commit Graph

20642 Commits

Author SHA1 Message Date
Rich Salz
ffb46830e2 Add random serial# support.
Add -rand_serial to CA command and "serial_rand" config option.

Up RAND_BITS to 159, and comment why: now confirms to CABForum
guidelines (Ballot 164) as well as IETF RFC 5280 (PKIX).

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4185)
2017-08-22 09:00:04 -04:00
Pauli
932c0df29b Avoid a self-assignment.
Clang is generating a warning over an assignment of a variable to itself.
This occurs on an ASCII based machine where the convert to ASCII macro doesn't
do anything.  The fix is to introduce a temporary variable.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4214)
2017-08-22 13:07:37 +10:00
Pauli
9c481c2fdc Dead code elimination.
Remove the exit_main function which is never used.
Remove the exit_options array which is also unreferenced.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4213)
2017-08-22 10:46:19 +10:00
Pauli
a1df06b363 This has been added to avoid the situation where some host ctype.h functions
return true for characters > 127.  I.e. they are allowing extended ASCII
characters through which then cause problems.  E.g. marking superscript '2' as
a number then causes the common (ch - '0') conversion to number to fail
miserably.  Likewise letters with diacritical marks can also cause problems.

If a non-ASCII character set is being used (currently only EBCDIC), it is
adjusted for.

The implementation uses a single table with a bit for each of the defined
classes.  These functions accept an int argument and fail for
values out of range or for characters outside of the ASCII set.  They will
work for both signed and unsigned character inputs.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4102)
2017-08-22 09:45:25 +10:00
Pauli
00dfbaad88 Fix ctype arguments.
Cast arguments to the various ctype functions to unsigned char to match their
documentation.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4203)
2017-08-22 07:35:08 +10:00
Rich Salz
0d68367a12 Safely display SNI (just in case)
Thanks to Hubert Kario for pointing this out.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4193)
2017-08-21 15:28:56 -04:00
Paul Yang
43f985fdbf Document missing EVP_PKEY_method_* items
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4104)
2017-08-21 11:47:17 -04:00
Rich Salz
c27363f566 Check # of arguments for remaining commands.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/4201)
2017-08-21 10:58:49 -04:00
Johannes Bauer
b73b4d73de Add PKEY_CTX setter tests for TLS1-PRF
PKEY_CTX setters tests were previously present for HKDF and scrypt; this
patch also adds tests for the third currently supported KDF, TLS1-PRF.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4196)
2017-08-21 10:05:14 +01:00
Matt Caswell
888098304b More updates following review feedback
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
638c2dd0ab Updates following feedback on OPENSSL_assert() removal
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
42d7d7dd6a Remove OPENSSL_assert() from crypto/x509v3
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
24664a3bf5 Remove OPENSSL_assert() from crypto/x509
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
fb7621cb4b Remove OPENSSL_assert() from crypto/threads_none.c
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
e40ada04f4 Remove OPENSSL_assert() from crypto/pem
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
7d248ee0ae Remove OPENSSL_assert() from crypto/kdf
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
8f9ee7a33f Remove OPENSSL_assert() from crypto/hmac
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
de61c03cc7 Remove OPENSSL_assert() from crypto/ec
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
64d9844ab6 Remove OPENSSL_assert() from conf_api.c
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
437e5050d5 Remove OPENSSL_assert() usage from crypto/bn
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
86f31dd9cc Remove OPENSSL_assert() from various crypto/bio files
bss_dgram.c is deferred until later due to ongoing discussions.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Matt Caswell
297c1149f6 Remove OPENSSL_assert() from crypto/asn1/bio_asn1.c
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3740)
2017-08-21 08:44:44 +01:00
Pauli
045fe7313a Remove double error messages
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4204)
2017-08-21 10:37:34 +10:00
Richard Levitte
72460149db Fix ui_write in apps/apps.c
It used the default UI reader as fallback instead of the UI writer.

Fixes #4147
Fixes #4195

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/4198)
2017-08-19 21:56:43 +02:00
Rich Salz
b842fcbb37 Put thread-fork-init inside a run-once guard
Thanks to Christian Heimes for pointing this out.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4191)
2017-08-18 11:48:35 -04:00
Todd Short
10ed1b7239 Reorder extensions to put SigAlgs last
Force non-empty padding extension.
When enabled, force the padding extension to be at least 1 byte long.
WebSphere application server cannot handle having an empty
extension (e.g. EMS/EtM) as the last extension in a client hello.
This moves the SigAlgs extension last for TLSv1.2 to avoid this
issue.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3921)
2017-08-18 09:52:17 -04:00
Balaji Marisetti
326eaa941e Addressed build failure because of missing #ifdef AF_UNIX guard
CLA: trivial

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4067)
2017-08-18 14:43:15 +01:00
Richard Levitte
77a9c26e03 Add a comment on expectations in the "tar" target
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4179)
2017-08-18 15:16:31 +02:00
Richard Levitte
17c84aa763 Prepare tarball in dist directory
We changed directory to the wrong directory.
This change also separates the preparation phase from the tarball
building phase.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4179)
2017-08-18 15:16:30 +02:00
Richard Levitte
34a5b7d727 Turn on error sensitivity in the "tar" target
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4179)
2017-08-18 15:16:30 +02:00
Richard Levitte
fdf9450f42 test/asn1_time_test.c: Better check of signed time_t
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4182)
2017-08-18 09:52:01 +02:00
Andy Polyakov
8909c2ceee err/err.c: improve readability.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-08-18 09:24:52 +02:00
Andy Polyakov
d3d880ce01 err/err.c: fix "wraparound" bug in ERR_set_error_data.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-08-18 09:24:44 +02:00
Pauli
9ef73a6fd9 Fix windows build after too aggressive e_os.h removal
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4187)
2017-08-18 10:37:32 +10:00
Pauli
b99fe5f492 Remove tests dependence on e_os.h
Apart from ssltest_old.c, the test suite relied on e_os.h for the
OSSL_NELEM macro and nothing else.

The ssltest_old.c also requires EXIT and some socket macros.

Create a new header to define the OSSL_NELEM macro and use that instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4186)
2017-08-18 09:50:25 +10:00
Bernd Edlinger
524fdd5155 Clear outputs in PKCS12_parse error handling.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4145)
2017-08-17 17:57:15 +02:00
Richard Levitte
5b7b011525 When building a tarball, avoid trying to copy submodules
submodules are directories that we don't want in our tarballs, so
avoid them.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4178)
2017-08-17 11:44:02 +02:00
Pauli
296cbb5777 Determine the number of output columns for the list and help commands using
the command names rather than hard coding it (conditionally).

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4162)
2017-08-17 07:52:38 +10:00
David von Oheimb
121738d1cb Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL
Now the certs arg is not any more neglected when building the signer cert chain.
Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy.

See also http://rt.openssl.org/Ticket/Display.html?id=4620

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 14:32:38 -04:00
Andy Polyakov
e0584e96c1 sha/asm/keccak1600-armv4.pl: optimize for Thumb-2.
Reduce per-round instruction count in Thumb-2 case by 16%. This is
achieved by folding ldr/str pairs to their double-word counterparts.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-08-16 20:25:20 +02:00
David Benjamin
6b9c46ff3f Fix some documentation typos.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/4173)
2017-08-16 13:07:43 -04:00
FdaSilvaYY
a303e9a6a8 fix some typos
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4172)
2017-08-16 10:36:34 -04:00
FdaSilvaYY
2e38091c14 Fix two MSVC warnings in apps.c
warning C4996: 'fileno': The POSIX name for this item is deprecated.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4172)
2017-08-16 10:36:34 -04:00
FdaSilvaYY
31a80694d4 [Win] Fix some test method signatures ...
to halves MSVC warnings.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4172)
2017-08-16 10:36:34 -04:00
Matt Caswell
30bb02597d Copy dlls into fuzz directory
This should fix the recent AppVeyor failures.

[extended tests]

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4171)
2017-08-16 15:22:43 +01:00
gbrl
61389f0981 bndiv fuzzer: limit the size of the input to avoid timeout
CLA: trivial

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4119)
2017-08-16 10:05:40 -04:00
Johannes Bauer
64bf10167b Fix coding style of EVP_PKEY_CTX_ctrl_uint64
Code review of @dot-asm pointed out style guide violation; this patch
fixes it.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/4166)
2017-08-15 17:30:25 -05:00
Rich Salz
b35ef02628 Print pathnames for 'version -r'
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4168)
2017-08-15 16:45:32 -04:00
Richard Levitte
1fcb6a3daa STORE: Add documentation on the expectations for returned names
Returned OSSL_STORE_INFO_NAME typed infos are supposed to be a
canonical URI for the corresponding object.  For example, when using
the 'file' scheme loader, the file name is returned, possibly prefixed
with 'file://'

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3856)
2017-08-15 21:37:04 +02:00
Richard Levitte
330242959d STORE: Add info on the expected post_process callback behavior
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3856)
2017-08-15 21:37:04 +02:00