aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Fix store with opaque dataTodd Short2016-01-231-7/+7
| | | | | | | | | | | | When experimental-store is enabled, it does not compile due to the change to opaque data structures. Change CRYPTO_add() to EVP_PKEY_up_ref() as needed. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> RT: #4263, GH: #579
* free item after sk_push failmrpre2016-01-231-0/+1
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Disable jpake if psk is disabled.Ben Laurie2016-01-231-0/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Refactor file writing - rewrite crypto/opensslconf.h.in as templateRichard Levitte2016-01-232-237/+234
| | | | | | | | | | | | | The turn has come to have crypto/opensslconf.h.in get run through util/dofile.pl. The consequence is that a large number of variables get moved to the %config table. Also, the string variables $openssl_*, which were populated with cpp lines, all being of the form "#define SOMETHING", were converted into ARRAY refs in %config values, containing just the list of macros to be defined. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refactor file writing - Adapt util/mkdef.pl to use configdata.pmRichard Levitte2016-01-222-53/+42
| | | | | | | | | For this adaptation, the variables $options and $version needed to move to %config in Configure, and why not move all other variables holding diverse version numbers at the same time? Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Refactor file writing - information on our use of Perl and Perl modulesRichard Levitte2016-01-225-24/+109
| | | | | | This includes a start on how to install missing modules. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refactor file writing - adapt util/dofile.pl to use with_fallbackRichard Levitte2016-01-221-1/+7
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Bundle the non core Perl module Text::TemplateRichard Levitte2016-01-2227-0/+4499
| | | | | | | | | | | | Because we're using Text::Template and we know it's a non core Perl module, we choose to bundle it into our source, for convenience. external/perl/Downloaded.txt document what modules we choose to bundle this way and exactly where we downloaded it from. With this changes comes the transfer module for with_fallback. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refactor file writing - arrange for use of bundled Perl modules as fallbackRichard Levitte2016-01-221-0/+19
| | | | | | | | | | | | | | | | | For our own convenience, we need a mechanism to be able to fall back on bundled Perl modules. It's a minimal package that's called like this: use with_fallback qw(Module1 Module2 ...); For each module, it will try to require them from the system installation, and failing that, it will temporarly add external/perl and try to require transfer::{ModuleName}. It requires that each bundled Perl modules is accompanied by a small transfer module (external/perl/transfer/ModuleName.pm in our example) that knows exactly what to load. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refactor file writing - introduce template driven file writingRichard Levitte2016-01-227-212/+415
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | apps/CA.pl and tools/c_rehash are built from template files. So far, this was done by Configure, which created its own problems as it forced everyone to reconfigure just because one of the template files had changed. Instead, have those files created as part of the normal build in apps/ and in tools/. Furthermore, this prepares for a future where Configure may produce entirely other build files than Makefile, and the latter can't be guaranteed to be the holder of all information for other scripts. Instead, configdata.pm (described below) becomes the center of configuration information. This introduces a few new things: %config a hash table to hold all kinds of configuration data that can be used by any other script. configdata.pm a perl module that Configure writes. It currently holds the hash tables %config and %target. util/dofile.pl a script that takes a template on STDIN and outputs the result after applying configuration data on it. It's supposed to be called like this: perl -I$(TOP) -Mconfigdata < template > result or perl -I$(TOP) -Mconfigdata templ1 templ2 ... > result Note: util/dofile.pl requires Text::Template. As part of this changed, remove a number of variables that are really just copies of entries in %target, and use %target directly. The exceptions are $target{cflags} and $target{lflags}, they do get copied to $cflags and $lflags. The reason for this is that those variable potentially go through a lot of changes and would rather deserve a place in %config. That, however, is for another commit. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Refactor config - consolidate and refresh print_table_entryRichard Levitte2016-01-221-120/+84
| | | | | | | | | | | It's time for print_table_entry to get a bit of refreshment. The way it was put together, we needed to maintain the list of known configuration keys of interest twice, in different shapes. This is error prone, so move the list of strings to a common list for all printing cases, and use simple formatting of lines to do the actual printout based on that list. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix quoting error in SRP printfAndy Isaacson2016-01-221-1/+1
| | | | | | | | The code is trying to interpolate the value of the BASE_SECTION macro, but due to excess escaping, it instead prints the string "BASE_SECTION". Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Fixed typo in the SSL_CTX_set_security_levelAlex Gaynor2016-01-221-1/+1
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Cleanup .gitignoreRichard Levitte2016-01-221-35/+37
| | | | | | | | Some things to ignore need to be properly rooted, and use a bit more precision on ignoring 'lib', as that maybe be a perfectly valid directory name to add into git elsewhere in the source tree. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Configurations - no_asm_filler is long gone, don't use itRichard Levitte2016-01-222-4/+0
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix build failure with CIPHER_DEBUGAlessandro Ghedini2016-01-221-3/+2
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* isalist(1) is obsolete; use isainfo(1)mmiyashi2016-01-221-2/+2
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Updated OSSL_DYNAMIC_VERSION/OSSL_DYNAMIC_OLDESTMichał Trojnara2016-01-221-2/+2
| | | | | | | Change to reflect changes in dynamic_fns Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* dsatest: use the correct BIO to print the test errorMarcus Meissner2016-01-221-1/+1
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* few typo fixesFdaSilvaYY2016-01-222-3/+3
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Remove outdated conftest.cRich Salz2016-01-221-99/+0
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Refactor config - @MK1MF_Builds out, general build scheme inRichard Levitte2016-01-224-56/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Time to get rid of @MK1MF_Builds and introduce a more flexible 'build_scheme' configuration key. Its value may be a string or an array of strings, meaning we need to teach resolve_config how to handle ARRAY referenses. The build scheme is a word that selects a function to create the appropriate result files for a certain configuration. Currently valid build schemes aer "mk1mf" and "unixmake", the plan is however to add at least one other for a more universal build scheme. Incidently, this also adds the functions 'add' and 'add_before', which can be used in a configuration, so instead of having to repeatedly write a sub like this: key1 => sub { join(" ", @_, "myvalues"); }, key2 => sub { join(" ", "myvalues", @_); }, one could write this: key1 => add(" ", "myvalues"), key2 => add_before(" ", "myvalues"), The good point with 'add' and 'add_before' is that they handle inheritances where the values are a misture of scalars and ARRAYs. If there are any ARRAY to be found, the resulting value will be an ARRAY, otherwise it will be a scalar with all the incoming valued joined together with the separator given as first argument to add/add_before. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refactor config - move templates and template docs to ConfigurationsRichard Levitte2016-01-223-390/+513
| | | | | | | | | | | | | | | | | | | | | | | | | | | Move the documentation of the target configuration form to Configurations/README. Move initial assembler object templates to Configurations/00-BASE-templates.conf. Furthermore, remove all variables containing the names of the non-assembler object files and make a BASE template of them instead. The values from this templates are used as defaults as is. The remaining manipulation of data when assembler modules are used is done only when $no_asm is false. While doing this, clean out some other related variables that aren't used anywhere. Also, we had to move the resolution of the chosen target a bit, or the function 'asm' would never catch a true $no_asm... this hasn't mattered before we've moved it all to the BASE template, but now it does. At the same time, add the default for the 'unistd' key to the BASE template. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refresh the thinking of --prefix and --openssldirRichard Levitte2016-01-225-17/+44
| | | | | | | | | | | | | | | --prefix is now exclusively used for software and manual installation. --openssldir is not exclusively used as a default location for certs, keys and the default openssl.cnf. This change is made to bring clarity, to have the two less intertwined, and to be more compatible with the usual ways of software installation. Please change your habits and scripts to use --prefix rather than --openssldir for installation location now. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* RT3863 ECC: Add missing NULL check. Set a flagBilly Brumley2016-01-212-0/+3
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Refactor config - throw away the last remains of '--test-sanity'Richard Levitte2016-01-211-4/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Refactor config - consolidate handling of disabled stuffRichard Levitte2016-01-211-120/+81
| | | | | | | | | | | | | | | | | | | It's time to refactor the handling of %disabled so that all information of value is in the same place. We have so far had a few cascading disable rules in form of code, far away from %disabled. Instead, bring that information to the array @disable_cascade, which is a list of pairs of the form 'test => descendents'. The test part can be a string, and it's simply checked if that string is a key in %disabled, or it can be a CODEref to do a more complex test. If the test comes true, then all descendents are disabled. This check is performed until there are no more things that need to be disabled. Also, $default_depflags is constructed from the information in %disabled instead of being a separate string. While a string of its own is visually appealing, it's much too easy to forget to update it when something is changed in %disabled. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Refactor config - rewrite handling of "reconf"Richard Levitte2016-01-211-203/+194
| | | | | | | | | | | | | The way the "reconf"/"reconfigure" argument is handled is overly complicated. Just grep for it first, and if it is there in the current arguments, get the old command line arguments from Makefile. While we're at it, make the Makefile variable CONFIGURE_ARGS hold the value as a perl list of strings. This makes things much safer in case one of the arguments would contain a space. Since CONFIGURE_ARGS is used for nothing else, there's no harm in this. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Multiple -trusted/-untrusted/-CRLfile options in verifyViktor Dukhovni2016-01-203-63/+89
| | | | | | | | | | | | | | It is sometimes useful (especially in automated tests) to supply multiple trusted or untrusted certificates via separate files rather than have to prepare a single file containing them all. To that end, change verify(1) to accept these options zero or more times. Also automatically set -no-CAfile and -no-CApath when -trusted is specified. Improve verify(1) documentation, which could still use some work. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Refactor apps load_certs/load_crls to work incrementallyViktor Dukhovni2016-01-2010-64/+45
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* More X509_verify_cert() tests via verify(1).Viktor Dukhovni2016-01-209-5/+259
| | | | | | | Still need tests for trusted-first and tests that probe construction of alternate chains. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Reject when explicit trust EKU are set and none match.Viktor Dukhovni2016-01-201-0/+15
| | | | | | | | | | | | | | | Returning untrusted is enough for for full chains that end in self-signed roots, because when explicit trust is specified it suppresses the default blanket trust of self-signed objects. But for partial chains, this is not enough, because absent a similar trust-self-signed policy, non matching EKUs are indistinguishable from lack of EKU constraints. Therefore, failure to match any trusted purpose must trigger an explicit reject. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Commit pre-generated test_verify certsViktor Dukhovni2016-01-2030-0/+608
| | | | | | | | | | | | | | | | | | | | | | | | | These can be re-generated via: cd test/certs; ./setup.sh if need be. The keys are all RSA 2048-bit keys, but it is possible to change that via environment variables. cd test/certs rm -f *-key.pem *-key2.pem OPENSSL_KEYALG=rsa OPENSSL_KEYBITS=3072 ./setup.sh cd test/certs rm -f *-key.pem *-key2.pem OPENSSL_KEYALG=ecdsa OPENSSL_KEYBITS=secp384r1 ./setup.sh ... Keys are re-used if already present, so the environment variables are only used when generating any keys that are missing. Hence the "rm -f" Reviewed-by: Richard Levitte <levitte@openssl.org>
* Scripts to generate verify test certsViktor Dukhovni2016-01-202-0/+222
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Check Suite-B constraints with EE DANE recordsViktor Dukhovni2016-01-202-28/+46
| | | | | | | | | | | | | | When DANE-EE(3) matches or either of DANE-EE/PKIX-EE fails, we don't build a chain at all, but rather succeed or fail with just the leaf certificate. In either case also check for Suite-B violations. As unlikely as it may seem that anyone would enable both DANE and Suite-B, we should do what the application asks. Took the opportunity to eliminate the "cb" variables in x509_vfy.c, just call ctx->verify_cb(ok, ctx) Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Refactor config - split read_config into read_config and resolve_configRichard Levitte2016-01-201-416/+244
| | | | | | | | | | | | | | | | | | Split the read_config function into read_config that ONLY reads the configuration files but doesn't try to resolve any of the inheritances, and resolve_config which resolves the inheritance chain of a given target. Move them to the bottom of Configure, with the rest of the helpers. Have a new small hash table, %target, which will hold the values for the target the user requested. This also means that all access to the current target data can be reduced from '$table{$target}->{key}' to a mere '$target{key}'. While we're at it, the old string formatted configurations are getting obsolete, so they may as well get deprecated entirely. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refactor config - throw away '--test-sanity'Richard Levitte2016-01-201-43/+0
| | | | | | | | Get rid of the --test-sanity option. Since we no longer have string based configurations, we don't have the problem with miscounting colons any more. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refactor config - a small cosmetic touchup of ConfigureRichard Levitte2016-01-201-12/+7
| | | | | | | | | | Start simple, removed some unused variables and change all '<<EOF' to '<<"EOF"'. The latter is because some code colorizers (notably, in emacs) cannot recognise the here document end marker unless it's quoted and therefore assume the rest of the file is part of the here document. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add an engine destructor to eng_cryptodev.Richard Levitte2016-01-201-0/+36
| | | | Reviewed-by: Ben Laurie <ben@openssl.org>
* Adapt BSD cryptodev engine to opaque EVP_MD_CTX, EVP_CIPHER_CTX, etcRichard Levitte2016-01-201-204/+333
| | | | Reviewed-by: Ben Laurie <ben@openssl.org>
* Remove update tagsRich Salz2016-01-2060-141/+8
| | | | | Also remove depend/local_depend. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Consolidate "make update"Rich Salz2016-01-208-20/+20
| | | | | | Rename 'update' to 'generate'. Rather than recurse, just explicitly call the three generate targets directly. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Handle SSL_shutdown while in init more appropriatelyMatt Caswell2016-01-204-4/+20
| | | | | | | | | | | | | | | Calling SSL_shutdown while in init previously gave a "1" response, meaning everything was successfully closed down (even though it wasn't). Better is to send our close_notify, but fail when trying to receive one. The problem with doing a shutdown while in the middle of a handshake is that once our close_notify is sent we shouldn't really do anything else (including process handshake/CCS messages) until we've received a close_notify back from the peer. However the peer might send a CCS before acting on our close_notify - so we won't be able to read it because we're not acting on CCS messages! Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* make EVP_PKEY opaqueDr. Stephen Henson2016-01-2039-108/+121
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove the GOST engineMatt Caswell2016-01-1936-7129/+14
| | | | | | | | | | The GOST engine is now out of date and is removed by this commit. An up to date GOST engine is now being maintained in an external repository. See: https://wiki.openssl.org/index.php/Binaries Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix BSD -rpath parameterRichard Levitte2016-01-191-1/+1
| | | | | | | | | For BSD systems, Configure adds a shared_ldflags including a reference to the Makefile variable LIBRPATH, but since it must be passed down to Makefile.shared, care must be taken so the value of LIBRPATH doesn't get expanded too early, or it ends up giving an empty string. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* API compat for SSLeay_add_ssl_algorithmsViktor Dukhovni2016-01-191-0/+3
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Validate ClientHello session_id field length and send alert on failureAlessandro Ghedini2016-01-192-5/+13
| | | | | | | RT#4080 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* prf redirection build fixesDr. Stephen Henson2016-01-192-1/+2
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Update license year range to 2016Prayag Verma2016-01-191-1/+1
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-19 17:00:03 +0000