summaryrefslogtreecommitdiffstats
path: root/crypto/buffer (unfollow)
Commit message (Collapse)AuthorFilesLines
2018-03-21Add dladdr() for AIXMatthias Kraft5-7/+145
Although it deviates from the actual prototype of DSO_dsobyaddr(), this is now ISO C compliant and gcc -Wpedantic accepts the code. Added DATA segment checking to catch ptrgl virtual addresses. Avoid memleaks with every AIX/dladdr() call. Removed debug-fprintf()s. Added test case for DSO_dsobyaddr(), which will eventually call dladdr(). Removed unecessary AIX ifdefs again. The implementation can only lookup function symbols, no data symbols. Added PIC-flag to aix*-cc build targets. As AIX is missing a dladdr() implementation it is currently uncertain our exit()-handlers can still be called when the application exits. After dlclose() the whole library might have been unloaded already. Signed-off-by: Matthias Kraft <makr@gmx.eu> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5668)
2018-03-21Do not cache sessions with zero sid_ctx_length when SSL_VERIFY_PEERBenjamin Kaduk1-0/+12
The sid_ctx is something of a "certificate request context" or a "session ID context" -- something from the application that gives extra indication of what sort of thing this session is/was for/from. Without a sid_ctx, we only know that there is a session that we issued, but it could have come from a number of things, especially with an external (shared) session cache. Accordingly, when resuming, we will hard-error the handshake when presented with a session with zero-length sid_ctx and SSL_VERIFY_PEER is set -- we simply have no information about the peer to verify, so the verification must fail. In order to prevent these future handshake failures, proactively decline to add the problematic sessions to the session cache. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5175)
2018-03-20Remove mention of link between message digests and public key algorithms.Pauli2-10/+0
The comment in EVP_DigestInit.pod is: > Returns the NID of the public key signing algorithm associated with this digest. For example EVP_sha1() is associated with RSA so this will return B<NID_sha1WithRSAEncryption>. Since digests and signature algorithms are no longer linked this function is only retained for compatibility reasons. I.e. there is no link anymore. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5682)
2018-03-20aix compat fixes for ocsp.cEric Covener1-2/+8
WCOREDUMP and vsyslog are not portable Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5657)
2018-03-20Make pkeyutl a bit more user-friendlyJohannes Bauer1-10/+25
Give meaningful error messages when the user incorrectly uses pkeyutl. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3987)
2018-03-20Reduce the verbosity of test_storeMatt Caswell1-33/+38
The travis logs are going above 4Mb causing the builds to fail. One test creates excessive output. This change reduces that output by approx 180k. [extended tests] Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5694)
2018-03-20Fix the OCSP responder modeMatt Caswell1-1/+1
Broken by commit 3e3c7c36. Fixes #5681 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5688)
2018-03-20Prepare for 1.1.1-pre4-devMatt Caswell2-3/+3
Reviewed-by: Richard Levitte <levitte@openssl.org>
2018-03-20Prepare for 1.1.1-pre3 releaseOpenSSL_1_1_1-pre3Matt Caswell2-2/+2
Reviewed-by: Richard Levitte <levitte@openssl.org>
2018-03-20Update copyright yearMatt Caswell117-117/+117
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5689)
2018-03-20crypto/rand/rand_vms.c: include "internal/rand_int.h"Richard Levitte1-0/+1
Without it, the RAND_POOL typedef is missing Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5685)
2018-03-19Fix: drbgtest fails when tests are executed in random orderDr. Matthias St. Pierre1-1/+16
[extended tests] The test_rand_reseed assumed that the global DRBGs were not used previously. This assumption is false when the tests are executed in random order (OPENSSL_TEST_RAND_ORDER). So we uninstantiate them first and add a test for the first instantiation. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5680)
2018-03-19s_client, s_server: do generic SSL configuration first, specialization afterRichard Levitte2-9/+15
We did the SSL_CONF_cmd() pass last of all things that could affect the SSL ctx. However, the results of this, for example: -max_protocol TLSv1.3 -tls1_2 ... would mean that the protocol min got set to TLSv1.2 and the protocol max to TLSv1.3, when they should clearly both be TLSv1.2. However, if we see the SSL_CONF_cmd() switches as generic and those internal to s_client and s_server as specialisations, we get something that makes a little more sense. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5679)
2018-03-19Fix no-sm3/no-sm2 (with strict-warnings)Todd Short1-0/+2
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5677)
2018-03-19Fix no-sm3 (and no-sm2)Todd Short3-0/+11
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5677)
2018-03-19Don't generate buildtest_*err.cRichard Levitte1-0/+2
The error string header files aren't supposed to be included directly, so there's no point testing that they can. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5678)
2018-03-19Enhance ssltestlib's create_ssl_ctx_pair to take min and max proto versionRichard Levitte13-58/+127
Have all test programs using that function specify those versions. Additionally, have the remaining test programs that use SSL_CTX_new directly specify at least the maximum protocol version. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5663)
2018-03-19In TLSProxy::Proxy, specify TLSv1.3 as maximum allowable protocolRichard Levitte1-2/+2
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5663)
2018-03-19Support "-min_protocol" and "-max_protocol" in s_server and s_clientRichard Levitte1-0/+5
If for nothing else, they are needed when doing a regression test Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5663)
2018-03-19Fix no-ecMatt Caswell1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5673)
2018-03-19Fix no-sm2Matt Caswell5-31/+64
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5673)
2018-03-19Fix no-posix-io compile failureMatt Caswell2-2/+3
The fix in conf_include_test.c seems to be required because some compilers give an error if you give an empty string for the second argument to strpbrk(). It doesn't really make sense to send an empty string for this argument anyway, so make sure it has at least one character in it. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5666)
2018-03-19Place ticket keys into secure memoryTodd Short5-25/+34
Place the session ticket AES and HMAC keys into secure memory. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2351)
2018-03-19Fix no-pskMatt Caswell3-1/+15
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5667)
2018-03-19Revise and cleanup; use strict,warningsRich Salz3-158/+131
Use shorter names for some defines, so also had to change the .c file that used them. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5669)
2018-03-19Apply system_default configuration on SSL_CTX_new().Tomas Mraz9-8/+135
When SSL_CTX is created preinitialize it with system default configuration from system_default section. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4848)
2018-03-19Add a multithread rand testKurt Roeckx1-0/+89
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5547)
2018-03-19Don't use a ssl specific DRBG anymoreKurt Roeckx22-165/+35
Since the public and private DRBG are per thread we don't need one per ssl object anymore. It could also try to get entropy from a DRBG that's really from an other thread because the SSL object moved to an other thread. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5547)
2018-03-19Make the public and private DRBG thread localKurt Roeckx5-33/+76
This avoids lock contention. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5547)
2018-03-19Handle evp_tests assumption of EVP_PKEY_FLAG_AUTOARGLENJack Lloyd5-8/+43
Without actually using EVP_PKEY_FLAG_AUTOARGLEN Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4793)
2018-03-19Support SM2 ECIES scheme via EVPJack Lloyd3-19/+84
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4793)
2018-03-19Add SM2 signature and ECIES schemesJack Lloyd28-31/+1784
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4793)
2018-03-19Configurations/15-android.conf: detect clang by PATH, not by CC.Andy Polyakov2-13/+31
Since they intend to omit gcc, it's more appropriate to simply detect if there is NDK's clang on PATH, as opposite to requiring to specify it with CC=clang (and looking for it on PATH). Also detect NDK version and default to armv7-a for NDK>16. Address failure to recognize -D__ADNDROID_API__=N in CPPFLAGS. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5613)
2018-03-19Add NOTES.ANDROID.Andy Polyakov3-26/+75
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5613)
2018-03-19Configurations/15-android.conf: default to RC4_CHAR whenever possible.Andy Polyakov1-0/+4
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5613)
2018-03-19MIPS assembly pack: default heuristic detection to little-endian.Andy Polyakov3-3/+3
Current endianness detection is somewhat opportunistic and can fail in cross-compile scenario. Since we are more likely to cross-compile for little-endian now, adjust the default accordingly. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5613)
2018-03-19Configurations/15-android.conf: refine clang support.Andy Polyakov1-3/+6
Adjusting ARM default broke clang support, and x86[_64] needed path adjustment. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5613)
2018-03-19Configure: pass -no-integrated-as.Andy Polyakov1-1/+3
Occasionally you have to pass -no-integrated-as to clang, but we consider any -no-option as no-option. Don't touch -no-integrated-as. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5613)
2018-03-19Fix bio callback backward compatibilityBernd Edlinger5-18/+156
Don't pass a pointer to uninitialized processed value for BIO_CB_READ and BIO_CB_WRITE Check the correct cmd code in BIO_callback_ctrl Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5516)
2018-03-19Fix a crash in SSLfatal due to invalid enc_write_ctxBernd Edlinger5-1/+10
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5645)
2018-03-19Fix no-cmacMatt Caswell1-1/+6
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5665)
2018-03-19Fix no-ecMatt Caswell2-1/+2
Raw private/public key loading may fail for X25519/X448 if ec has been disabled. Also fixed a missing blank line in evppkey.txt resulting in a warning in the test output. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5664)
2018-03-19Add a CHANGES entry to mention the replay protection capabilitiesMatt Caswell1-0/+4
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5644)
2018-03-19Document the replay protection capabilitiesMatt Caswell1-8/+49
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5644)
2018-03-19Add a test for 0RTT replay protectionMatt Caswell1-0/+57
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5644)
2018-03-19Add an anti-replay mechanismMatt Caswell2-3/+11
If the server is configured to allow early data then we check if the PSK session presented by the client is available in the cache or not. If it isn't then this may be a replay and we disallow it. If it is then we allow it and remove the session from the cache. Note: the anti-replay protection is not used for externally established PSKs. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5644)
2018-03-19Don't update the session cache when processing a client certificate in TLSv1.3Matt Caswell1-3/+0
We should only update the session cache when we issue a NewSessionTicket. These are issued automatically after processing a client certificate. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5644)
2018-03-19Always call the new_session_cb when issuing a NewSessionTicket in TLSv1.3Matt Caswell4-9/+24
Conceptually in TLSv1.3 there can be multiple sessions associated with a single connection. Each NewSessionTicket issued can be considered a separate session. We can end up issuing multiple NewSessionTickets on a single connection at the moment (e.g. in a post-handshake auth scenario). Each of those issued tickets should have the new_session_cb called, it should go into the session cache separately and it should have a unique id associated with it (so that they can be found individually in the cache). Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5644)
2018-03-19engines/asm/e_padlock*: add support for Zhaoxin's x86 platformJeffZhao2-2/+20
VIA and Shanghai United Investment Co.,Ltd. found Shanghai ZhaoXin, which is a fabless x86 CPU IC design company. ZhaoXin has issued ZX-C, ZX-D x86 processors, which have 'Shanghai' CPU vendor id. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5640)
2018-03-19Clarify a couple of details around "make variables"Richard Levitte1-3/+7
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5660)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-12 02:43:24 +0100