openssl, branch OpenSSL_1_1_0f

Prepare for 1.1.0f release

2017-05-25T12:46:16Z

Reviewed-by: Stephen Henson

Update CHANGES and NEWS for new release

2017-05-25T11:43:08Z

Reviewed-by: Kurt Roeckx (Merged from https://github.com/openssl/openssl/pull/3547)

Document that PKCS#12 functions assume UTF-8 for passwords

2017-05-24T20:17:27Z

Part of issue #3531 Reviewed-by: Rich Salz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/3535) (cherry picked from commit cff85f39e438830cb5bc8bf7cb2ed6458670c5be)

Clarify what character encoding is used in the returned UI strings

2017-05-24T20:14:55Z

Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/3532) (cherry picked from commit 789d6dddecbc231f5c858d203aab318cf81676fd)

Fix typo in doc/man3/EVP_EncrypInit.pod

2017-05-23T08:31:59Z

In the example section. CLA: trivial Signed-off-by: Paul Yang Reviewed-by: Rich Salz Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/3520) (cherry picked from commit 719b289d62d32fe45226e8bc5b4fb0d76f6a1b5d)

[1.1.0 backport] set entry type on SCTs from X.509 and OCSP extensions

2017-05-22T16:44:26Z

Reviewed-by: Matt Caswell Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/3519)

Fix infinite loops in secure memory allocation.

2017-05-22T12:48:21Z

Remove assertion when mmap() fails. Only give the 1<<31 limit test as an example. Fix the small arena test to just check for the symptom of the infinite loop (i.e. initialized set on failure), rather than the actual infinite loop. This avoids some valgrind errors. Backport of: PR #3512 commit fee423bb68869de02fceaceefbc847e98213574b PR #3510 commit a486561b691d6293a901b412172ca0c6d1ffc0dc PR #3455 commit c8e89d58a5d44b9dd657d6d13a5a10d1d4d30733 PR #3449 commit 7031ddac94d0ae616d1b0670263a9265ce672cd2 Issue 1: sh.bittable_size is a size_t but i is and int, which can result in freelist == -1 if sh.bittable_size exceeds an int. This seems to result in an OPENSSL_assert due to invalid allocation size, so maybe that is "ok." Worse, if sh.bittable_size is exactly 1<<31, then this becomes an infinite loop (because 1<<31 is a negative int, so it can be shifted right forever and sticks at -1). Issue 2: CRYPTO_secure_malloc_init() sets secure_mem_initialized=1 even when sh_init() returns 0. If sh_init() fails, we end up with secure_mem_initialized=1 but sh.minsize=0. If you then call secure_malloc(), which then calls, sh_malloc(), this then enters an infite loop since 0 << anything will never be larger than size. Issue 3: That same sh_malloc loop will loop forever for a size greater than size_t/2 because i will proceed (assuming sh.minsize=16): i=16, 32, 64, ..., size_t/8, size_t/4, size_t/2, 0, 0, 0, 0, .... This sequence will never be larger than "size". Reviewed-by: Andy Polyakov Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/3453)

Fix srp app missing NULL termination with password callback

2017-05-22T08:30:44Z

The password_callback() function does not necessarily NULL terminate the password buffer, the caller must use the returned length but the srp app uses this function as if it was doing NULL termination. This made the -passin and -passout options of "openssl srp" fail inexpicably and randomly or even crash. Fixed by enlarging the buffer by one, so that the maximum password length remains unchanged, and adding NULL termination upon return. [Rearrange code for coding style compliance in process.] Reviewed-by: Matt Caswell Reviewed-by: Andy Polyakov (Merged from https://github.com/openssl/openssl/pull/3475) (cherry picked from commit 0e83981d61fc435f42d4bb4d774272b69556b7bc)

test/run_tests.pl: don't mask test failures.

2017-05-22T08:18:15Z

Switch to TAP::Harness inadvertently masked test failures. Test::Harness::runtests was terminating with non-zero exit code in case of failure[s], while TAP::Harness apparently holds caller responsible for doing so. Reviewed-by: Rich Salz Reviewed-by: Richard Levitte

-inkey can be an identifier, not just a file

2017-05-21T22:24:49Z

update pkcs12, smime, ts apps. Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/3507) (cherry picked from commit 48b5352212d8c68f7fd071ca9f38822b7e954c5a)