In some environments, such as firmware, the current system time is entirely
meaningless. Provide a clean mechanism to suppress the checks against it.
Signed-off-by: NRich Salz <rsalz@akamai.com>
Reviewed-by: NTim Hudson <tjh@openssl.org>

Since there seems to be no way to avoid linking to libssl and libcrypto,
just wrap the test. This unbreaks "shared" builds when using clang and/or
OS X.
Signed-off-by: NRich Salz <rsalz@openssl.org>
Reviewed-by: NBen Laurie <ben@openssl.org>

Reviewed-by: NTim Hudson <tjh@openssl.org>

Commit d4ab70f2 added a test program
to check that the NULL pointer is represented as all zero bits, but
did not specify a build rule for that new executable.  On many platforms,
the implicit rule sufficed, since nptest is a very simple program, but
for at least darwin-i386-cc, an explicit rule is needed.  On darwin-i386-cc,
the implicit rule targetted a 64-bit executable, but the object file
containing the definition of main was a 32-bit object, which the linker
excluded from consideration, resulting in a link failure due to no
definition for _main.

Add the missing build rule to fix the build on such platforms.
Signed-off-by: NRich Salz <rsalz@openssl.org>
Reviewed-by: NDr. Stephen Henson <steve@openssl.org>

PR#4009.
Reviewed-by: NRich Salz <rsalz@openssl.org>

Add a test to ensure that "char *p = NULL" is equivalent to
all-bytes-zero.
Reviewed-by: NTim Hudson <tjh@openssl.org>

This does 64-bit division and multiplication, and on 32-bit platforms
pulls in libgcc symbols (and MSVC does similar) which may not be
available.  Mostly done by David Woodhouse.
Reviewed-by: NDr. Stephen Henson <steve@openssl.org>

Found on GitHub by dimman
Reviewed-by: NRichard Levitte <levitte@openssl.org>

This reverts the non-cleanup parts of commit c73ad690. We do actually
have a reasonable use case for OPENSSL_NO_RFC3779 in the EDK2 UEFI
build, since we don't have a strspn() function in our runtime environment
and we don't want the RFC3779 functionality anyway.

In addition, it changes the default behaviour of the Configure script so
that RFC3779 support isn't disabled by default. It was always disabled
from when it was first added in 2006, right up until the point where
OPENSSL_NO_RFC3779 was turned into a no-op, and the code in the
Configure script was left *trying* to disable it, but not actually
working.
Signed-off-by: NRich Salz <rsalz@akamai.com>
Reviewed-by: NTim Hudson <tjh@openssl.org>

After openssl_zalloc, cleanup more "set to 0/NULL" assignments.
Many are from github feedback.
Reviewed-by: NTim Hudson <tjh@openssl.org>

Add OPENSSL_SYS_UEFI flag for RAND handling;
Signed-off-by: NRich Salz <rsalz@akamai.com>
Reviewed-by: NTim Hudson <tjh@openssl.org>

Reviewed-by: NRich Salz <rsalz@openssl.org>

Also has changes from from David Woodhouse <David.Woodhouse@intel.com>
and some tweaks from me.
Signed-off-by: NRich Salz <rsalz@openssl.org>
Reviewed-by: NTim Hudson <tjh@openssl.org>

Reviewed-by: NMatt Caswell <matt@openssl.org>

Add test to check PBE lookups: these can fail if the PBE table is not
correctly orders. Add to "make test".
Reviewed-by: NMatt Caswell <matt@openssl.org>

Closes #63
Signed-off-by: NRich Salz <rsalz@openssl.org>
Reviewed-by: NBen Laurie <ben@openssl.org>

Reviewed-by: NMatt Caswell <matt@openssl.org>

It's test code that only runs on 64bit time_t machines.
Move it to a standalone test/gmdifftest
Reviewed-by: NRichard Levitte <levitte@openssl.org>

There are many places (nearly 50) where we malloc and then memset.
Add an OPENSSL_zalloc routine to encapsulate that.
(Missed one conversion; thanks Richard)
Also fixes GH328
Reviewed-by: NRichard Levitte <levitte@openssl.org>

Reviewed-by: NTim Hudson <tjh@openssl.org>

Reviewed-by: NTim Hudson <tjh@openssl.org>

Add support for testing ECDSA and DSA ciphersuites.
Reviewed-by: NMatt Caswell <matt@openssl.org>

Reviewed-by: NMatt Caswell <matt@openssl.org>

Use SSL_CONF for certificate handling is ssltest.c, this changes the
behaviour slightly: the -cert and -key options are no longer recognised
and a default certificate file is not used.

This change means that -s_cert and -c_cert can be used mode than once
to support use of multiple certificates.
Reviewed-by: NMatt Caswell <matt@openssl.org>

If supported create DSA and ECDSA certificates and test them.
Reviewed-by: NMatt Caswell <matt@openssl.org>

Reviewed-by: NRich Salz <rsalz@openssl.org>

The only place that uses it.
Reviewed-by: NTim Hudson <tjh@openssl.org>

Avoid using cnid = 0, use NID_undef instead, and return early instead
of trying to find an instance of that in the subject DN.
Reviewed-by: NRichard Levitte <levitte@openssl.org>

Initialize pointers in param id by the book (explicit NULL assignment,
rather than just memset 0).

In x509_verify_param_zero() set peername to NULL after freeing it.

In x509_vfy.c's internal check_hosts(), avoid potential leak of
possibly already non-NULL peername.  This is only set when a check
succeeds, so don't need to do this repeatedly in the loop.
Reviewed-by: NRichard Levitte <levitte@openssl.org>

Fix the setup of DTLS1.2 buffers to take account of the Header
Reviewed-by: NEmilia Käsper <emilia@openssl.org>
Reviewed-by: NMatt Caswell <matt@openssl.org>

The |z| value should be 0x04 not 0x02

RT#3838
Signed-off-by: NMatt Caswell <matt@openssl.org>
Reviewed-by: NEmilia Käsper <emilia@openssl.org>
Reviewed-by: NMatt Caswell <matt@openssl.org>

Reviewed-by: NRich Salz <rsalz@openssl.org>

Reviewed-by: NRich Salz <rsalz@openssl.org>

Reviewed-by: NRich Salz <rsalz@openssl.org>

Reviewed-by: NRich Salz <rsalz@openssl.org>

clang suggests %llu instead, but it isn't clear that is portable on
all platforms.

C99 and above define a handy macro for us, so we try to use that
definition and fall back to current definition if needed (though we
switch to 'u' for unsigned).
Reviewed-by: NMatt Caswell <matt@openssl.org>

Reviewed-by: NRichard Levitte <levitte@openssl.org>

The NULL cipher case can't actually happen because we have no
EVP_PBE_CTL combinations where cipher_nid is -1 and keygen is
PKCS12_PBE_keyivgen. But make the code more obviously correct.
Reviewed-by: NMatt Caswell <matt@openssl.org>

- Pass in the right ciphertext length to ensure we're indeed testing
  ciphertext corruption (and not truncation).
- Only test one mutation per byte to not make the test too slow.
- Add a separate test for truncated ciphertexts.
Reviewed-by: NRichard Levitte <levitte@openssl.org>

No, we should just delete it.  And updated the README
Reviewed-by: NMatt Caswell <matt@openssl.org>