From 311af7c3be6eac14b257a695f3c3c428ca177b08 Mon Sep 17 00:00:00 2001
From: Jonas Schievink <jonas@schievink.net>
Date: Mon, 13 Jun 2016 21:17:20 +0200
Subject: [PATCH 1/9] Add PKey::private_key_from_pem_cb

---
 openssl/src/crypto/pkey.rs | 49 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 48 insertions(+), 1 deletion(-)

diff --git a/openssl/src/crypto/pkey.rs b/openssl/src/crypto/pkey.rs
index c411186022..f59ee40a62 100644
--- a/openssl/src/crypto/pkey.rs
+++ b/openssl/src/crypto/pkey.rs
@@ -1,9 +1,11 @@
-use libc::{c_int, c_uint, c_ulong};
+use libc::{c_int, c_uint, c_ulong, c_char, c_void};
 use std::io;
 use std::io::prelude::*;
 use std::iter::repeat;
 use std::mem;
+use std::panic::catch_unwind;
 use std::ptr;
+use std::slice;
 use bio::MemBio;
 
 use crypto::HashTypeInternals;
@@ -93,6 +95,51 @@ impl PKey {
         }
     }
 
+    /// Read a private key from PEM, supplying a password callback to be invoked if the private key
+    /// is encrypted.
+    ///
+    /// The callback will be passed the password buffer and should return the number of characters
+    /// placed into the buffer.
+    pub fn private_key_from_pem_cb<R, F>(reader: &mut R, mut pass_cb: F) -> Result<PKey, SslError>
+        where R: Read, F: FnMut(&mut [i8]) -> usize
+    {
+        extern "C" fn user_cb_wrapper<F>(buf: *mut c_char,
+                                         size: c_int,
+                                         _rwflag: c_int,
+                                         user_cb: *mut c_void)
+                                         -> c_int
+                                         where F: FnMut(&mut [i8]) -> usize {
+            let result = catch_unwind(|| {
+                // build a `i8` slice to pass to the user callback
+                let pass_slice = unsafe { slice::from_raw_parts_mut(buf, size as usize) };
+                let callback = unsafe { &mut *(user_cb as *mut F) };
+
+                callback(pass_slice)
+            });
+
+            if let Ok(len) = result {
+                return len as c_int;
+            } else {
+                return 0;
+            }
+        }
+
+        let mut mem_bio = try!(MemBio::new());
+        try!(io::copy(reader, &mut mem_bio).map_err(StreamError));
+
+        unsafe {
+            let evp = try_ssl_null!(ffi::PEM_read_bio_PrivateKey(mem_bio.get_handle(),
+                                                                 ptr::null_mut(),
+                                                                 Some(user_cb_wrapper::<F>),
+                                                                 &mut pass_cb as *mut _ as *mut c_void));
+
+            Ok(PKey {
+                evp: evp as *mut ffi::EVP_PKEY,
+                parts: Parts::Both,
+            })
+        }
+    }
+
     /// Reads public key from PEM, takes ownership of handle
     pub fn public_key_from_pem<R>(reader: &mut R) -> Result<PKey, SslError>
         where R: Read

From f0b4a032d5a6cdf3928318e113dcfd7e0ecf03f9 Mon Sep 17 00:00:00 2001
From: Jonas Schievink <jonas@schievink.net>
Date: Mon, 13 Jun 2016 21:47:02 +0200
Subject: [PATCH 2/9] Try to propagate callback panics

---
 openssl/src/crypto/pkey.rs | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/openssl/src/crypto/pkey.rs b/openssl/src/crypto/pkey.rs
index f59ee40a62..8ae9aa20dc 100644
--- a/openssl/src/crypto/pkey.rs
+++ b/openssl/src/crypto/pkey.rs
@@ -1,9 +1,10 @@
 use libc::{c_int, c_uint, c_ulong, c_char, c_void};
+use std::any::Any;
 use std::io;
 use std::io::prelude::*;
 use std::iter::repeat;
 use std::mem;
-use std::panic::catch_unwind;
+use std::panic;
 use std::ptr;
 use std::slice;
 use bio::MemBio;
@@ -100,21 +101,26 @@ impl PKey {
     ///
     /// The callback will be passed the password buffer and should return the number of characters
     /// placed into the buffer.
-    pub fn private_key_from_pem_cb<R, F>(reader: &mut R, mut pass_cb: F) -> Result<PKey, SslError>
+    pub fn private_key_from_pem_cb<R, F>(reader: &mut R, pass_cb: F) -> Result<PKey, SslError>
         where R: Read, F: FnMut(&mut [i8]) -> usize
     {
+        struct CallbackState<F: FnMut(&mut [i8]) -> usize> {
+            cb: F,
+            panic: Option<Box<Any + Send + 'static>>,
+        }
+
         extern "C" fn user_cb_wrapper<F>(buf: *mut c_char,
                                          size: c_int,
                                          _rwflag: c_int,
                                          user_cb: *mut c_void)
                                          -> c_int
                                          where F: FnMut(&mut [i8]) -> usize {
-            let result = catch_unwind(|| {
+            let result = panic::catch_unwind(|| {
                 // build a `i8` slice to pass to the user callback
                 let pass_slice = unsafe { slice::from_raw_parts_mut(buf, size as usize) };
-                let callback = unsafe { &mut *(user_cb as *mut F) };
+                let callback = unsafe { &mut *(user_cb as *mut CallbackState<F>) };
 
-                callback(pass_slice)
+                (callback.cb)(pass_slice)
             });
 
             if let Ok(len) = result {
@@ -124,6 +130,11 @@ impl PKey {
             }
         }
 
+        let mut cb = CallbackState {
+            cb: pass_cb,
+            panic: None,
+        };
+
         let mut mem_bio = try!(MemBio::new());
         try!(io::copy(reader, &mut mem_bio).map_err(StreamError));
 
@@ -131,7 +142,11 @@ impl PKey {
             let evp = try_ssl_null!(ffi::PEM_read_bio_PrivateKey(mem_bio.get_handle(),
                                                                  ptr::null_mut(),
                                                                  Some(user_cb_wrapper::<F>),
-                                                                 &mut pass_cb as *mut _ as *mut c_void));
+                                                                 &mut cb as *mut _ as *mut c_void));
+
+            if let Some(panic) = cb.panic {
+                panic::resume_unwind(panic);
+            }
 
             Ok(PKey {
                 evp: evp as *mut ffi::EVP_PKEY,

From 8119f06ca5ca50a677cf584cbe816500153ce783 Mon Sep 17 00:00:00 2001
From: Jonas Schievink <jonas@schievink.net>
Date: Tue, 14 Jun 2016 18:12:50 +0200
Subject: [PATCH 3/9] Move into utility module

---
 openssl/src/crypto/mod.rs  |  1 +
 openssl/src/crypto/pkey.rs | 43 +++-------------------------
 openssl/src/crypto/util.rs | 58 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 63 insertions(+), 39 deletions(-)
 create mode 100644 openssl/src/crypto/util.rs

diff --git a/openssl/src/crypto/mod.rs b/openssl/src/crypto/mod.rs
index 95b27022c4..9d79b8b09e 100644
--- a/openssl/src/crypto/mod.rs
+++ b/openssl/src/crypto/mod.rs
@@ -24,6 +24,7 @@ pub mod rand;
 pub mod symm;
 pub mod memcmp;
 pub mod rsa;
+mod util;
 
 mod symm_internal;
 
diff --git a/openssl/src/crypto/pkey.rs b/openssl/src/crypto/pkey.rs
index 8ae9aa20dc..605aed4274 100644
--- a/openssl/src/crypto/pkey.rs
+++ b/openssl/src/crypto/pkey.rs
@@ -1,12 +1,9 @@
-use libc::{c_int, c_uint, c_ulong, c_char, c_void};
-use std::any::Any;
+use libc::{c_int, c_uint, c_ulong, c_void};
 use std::io;
 use std::io::prelude::*;
 use std::iter::repeat;
 use std::mem;
-use std::panic;
 use std::ptr;
-use std::slice;
 use bio::MemBio;
 
 use crypto::HashTypeInternals;
@@ -15,6 +12,7 @@ use crypto::hash::Type as HashType;
 use ffi;
 use ssl::error::{SslError, StreamError};
 use crypto::rsa::RSA;
+use crypto::util::{CallbackState, invoke_passwd_cb};
 
 #[derive(Copy, Clone)]
 pub enum Parts {
@@ -104,36 +102,7 @@ impl PKey {
     pub fn private_key_from_pem_cb<R, F>(reader: &mut R, pass_cb: F) -> Result<PKey, SslError>
         where R: Read, F: FnMut(&mut [i8]) -> usize
     {
-        struct CallbackState<F: FnMut(&mut [i8]) -> usize> {
-            cb: F,
-            panic: Option<Box<Any + Send + 'static>>,
-        }
-
-        extern "C" fn user_cb_wrapper<F>(buf: *mut c_char,
-                                         size: c_int,
-                                         _rwflag: c_int,
-                                         user_cb: *mut c_void)
-                                         -> c_int
-                                         where F: FnMut(&mut [i8]) -> usize {
-            let result = panic::catch_unwind(|| {
-                // build a `i8` slice to pass to the user callback
-                let pass_slice = unsafe { slice::from_raw_parts_mut(buf, size as usize) };
-                let callback = unsafe { &mut *(user_cb as *mut CallbackState<F>) };
-
-                (callback.cb)(pass_slice)
-            });
-
-            if let Ok(len) = result {
-                return len as c_int;
-            } else {
-                return 0;
-            }
-        }
-
-        let mut cb = CallbackState {
-            cb: pass_cb,
-            panic: None,
-        };
+        let mut cb = CallbackState::new(pass_cb);
 
         let mut mem_bio = try!(MemBio::new());
         try!(io::copy(reader, &mut mem_bio).map_err(StreamError));
@@ -141,13 +110,9 @@ impl PKey {
         unsafe {
             let evp = try_ssl_null!(ffi::PEM_read_bio_PrivateKey(mem_bio.get_handle(),
                                                                  ptr::null_mut(),
-                                                                 Some(user_cb_wrapper::<F>),
+                                                                 Some(invoke_passwd_cb::<F>),
                                                                  &mut cb as *mut _ as *mut c_void));
 
-            if let Some(panic) = cb.panic {
-                panic::resume_unwind(panic);
-            }
-
             Ok(PKey {
                 evp: evp as *mut ffi::EVP_PKEY,
                 parts: Parts::Both,
diff --git a/openssl/src/crypto/util.rs b/openssl/src/crypto/util.rs
new file mode 100644
index 0000000000..85df86b7c5
--- /dev/null
+++ b/openssl/src/crypto/util.rs
@@ -0,0 +1,58 @@
+use libc::{c_int, c_char, c_void};
+
+use std::any::Any;
+use std::panic;
+use std::slice;
+
+/// Wraps a user-supplied callback and a slot for panics thrown inside the callback (while FFI
+/// frames are on the stack).
+///
+/// When dropped, checks if the callback has panicked, and resumes unwinding if so.
+pub struct CallbackState<F> {
+    /// The user callback. Taken out of the `Option` when called.
+    cb: Option<F>,
+    /// If the callback panics, we place the panic object here, to be re-thrown once OpenSSL
+    /// returns.
+    panic: Option<Box<Any + Send + 'static>>,
+}
+
+impl<F> CallbackState<F> {
+    pub fn new(callback: F) -> Self {
+        CallbackState {
+            cb: Some(callback),
+            panic: None,
+        }
+    }
+}
+
+impl<F> Drop for CallbackState<F> {
+    fn drop(&mut self) {
+        if let Some(panic) = self.panic.take() {
+            panic::resume_unwind(panic);
+        }
+    }
+}
+
+/// Password callback function, passed to private key loading functions.
+///
+/// `cb_state` is expected to be a pointer to a `CallbackState`.
+pub extern "C" fn invoke_passwd_cb<F>(buf: *mut c_char,
+                                      size: c_int,
+                                      _rwflag: c_int,
+                                      cb_state: *mut c_void)
+                                      -> c_int
+                                      where F: FnMut(&mut [i8]) -> usize {
+    let result = panic::catch_unwind(|| {
+        // build a `i8` slice to pass to the user callback
+        let pass_slice = unsafe { slice::from_raw_parts_mut(buf, size as usize) };
+        let callback = unsafe { &mut *(cb_state as *mut CallbackState<F>) };
+
+        callback.cb.take().unwrap()(pass_slice)
+    });
+
+    if let Ok(len) = result {
+        return len as c_int;
+    } else {
+        return 0;
+    }
+}

From c399c2475d71c313970dc4e3b271f0086e90b013 Mon Sep 17 00:00:00 2001
From: Jonas Schievink <jonas@schievink.net>
Date: Tue, 14 Jun 2016 18:17:25 +0200
Subject: [PATCH 4/9] Add RSA::private_key_from_pem_cb

---
 openssl/src/crypto/rsa.rs | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/openssl/src/crypto/rsa.rs b/openssl/src/crypto/rsa.rs
index 52b8590e19..d451aab6db 100644
--- a/openssl/src/crypto/rsa.rs
+++ b/openssl/src/crypto/rsa.rs
@@ -3,12 +3,13 @@ use std::fmt;
 use ssl::error::{SslError, StreamError};
 use std::ptr;
 use std::io::{self, Read, Write};
-use libc::c_int;
+use libc::{c_int, c_void};
 
 use bn::BigNum;
 use bio::MemBio;
 use crypto::HashTypeInternals;
 use crypto::hash;
+use crypto::util::{CallbackState, invoke_passwd_cb};
 
 pub struct RSA(*mut ffi::RSA);
 
@@ -76,6 +77,26 @@ impl RSA {
         }
     }
 
+    /// Reads an RSA private key from PEM formatted data and supplies a password callback.
+    pub fn private_key_from_pem_cb<R, F>(reader: &mut R, pass_cb: F) -> Result<RSA, SslError>
+        where R: Read, F: FnMut(&mut [i8]) -> usize
+    {
+        let mut cb = CallbackState::new(pass_cb);
+
+        let mut mem_bio = try!(MemBio::new());
+        try!(io::copy(reader, &mut mem_bio).map_err(StreamError));
+
+        unsafe {
+            let cb_ptr = &mut cb as *mut _ as *mut c_void;
+            let rsa = try_ssl_null!(ffi::PEM_read_bio_RSAPrivateKey(mem_bio.get_handle(),
+                                                                    ptr::null_mut(),
+                                                                    Some(invoke_passwd_cb::<F>),
+                                                                    cb_ptr));
+
+            Ok(RSA(rsa))
+        }
+    }
+
     /// Writes an RSA private key as unencrypted PEM formatted data
     pub fn private_key_to_pem<W>(&self, writer: &mut W) -> Result<(), SslError>
         where W: Write

From c1b7cd2420c679b611c7ff28024db10cb0ffb8b5 Mon Sep 17 00:00:00 2001
From: Jonas Schievink <jonas@schievink.net>
Date: Wed, 22 Jun 2016 21:51:43 +0200
Subject: [PATCH 5/9] Make the callback take a `&mut [c_char]`

---
 openssl/src/crypto/pkey.rs | 4 ++--
 openssl/src/crypto/rsa.rs  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/openssl/src/crypto/pkey.rs b/openssl/src/crypto/pkey.rs
index 605aed4274..238c1b9e9c 100644
--- a/openssl/src/crypto/pkey.rs
+++ b/openssl/src/crypto/pkey.rs
@@ -1,4 +1,4 @@
-use libc::{c_int, c_uint, c_ulong, c_void};
+use libc::{c_int, c_uint, c_ulong, c_void, c_char};
 use std::io;
 use std::io::prelude::*;
 use std::iter::repeat;
@@ -100,7 +100,7 @@ impl PKey {
     /// The callback will be passed the password buffer and should return the number of characters
     /// placed into the buffer.
     pub fn private_key_from_pem_cb<R, F>(reader: &mut R, pass_cb: F) -> Result<PKey, SslError>
-        where R: Read, F: FnMut(&mut [i8]) -> usize
+        where R: Read, F: FnMut(&mut [c_char]) -> usize
     {
         let mut cb = CallbackState::new(pass_cb);
 
diff --git a/openssl/src/crypto/rsa.rs b/openssl/src/crypto/rsa.rs
index d451aab6db..c7f5cfaf95 100644
--- a/openssl/src/crypto/rsa.rs
+++ b/openssl/src/crypto/rsa.rs
@@ -3,7 +3,7 @@ use std::fmt;
 use ssl::error::{SslError, StreamError};
 use std::ptr;
 use std::io::{self, Read, Write};
-use libc::{c_int, c_void};
+use libc::{c_int, c_void, c_char};
 
 use bn::BigNum;
 use bio::MemBio;
@@ -79,7 +79,7 @@ impl RSA {
 
     /// Reads an RSA private key from PEM formatted data and supplies a password callback.
     pub fn private_key_from_pem_cb<R, F>(reader: &mut R, pass_cb: F) -> Result<RSA, SslError>
-        where R: Read, F: FnMut(&mut [i8]) -> usize
+        where R: Read, F: FnMut(&mut [c_char]) -> usize
     {
         let mut cb = CallbackState::new(pass_cb);
 

From 41b78547ad0357d3e86462f72c0cff333096d59f Mon Sep 17 00:00:00 2001
From: Jonas Schievink <jonas@schievink.net>
Date: Wed, 22 Jun 2016 22:05:03 +0200
Subject: [PATCH 6/9] Put password callbacks behind a cargo feature

---
 openssl/Cargo.toml         | 1 +
 openssl/src/crypto/mod.rs  | 1 +
 openssl/src/crypto/pkey.rs | 7 ++++++-
 openssl/src/crypto/rsa.rs  | 7 ++++++-
 4 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/openssl/Cargo.toml b/openssl/Cargo.toml
index 39f2fc6512..f9288bfa2c 100644
--- a/openssl/Cargo.toml
+++ b/openssl/Cargo.toml
@@ -27,6 +27,7 @@ ecdh_auto = ["openssl-sys-extras/ecdh_auto"]
 pkcs5_pbkdf2_hmac = ["openssl-sys/pkcs5_pbkdf2_hmac"]
 
 nightly = []
+catch_unwind = []
 
 [dependencies]
 bitflags = ">= 0.5.0, < 0.8.0"
diff --git a/openssl/src/crypto/mod.rs b/openssl/src/crypto/mod.rs
index 9d79b8b09e..481eb05c32 100644
--- a/openssl/src/crypto/mod.rs
+++ b/openssl/src/crypto/mod.rs
@@ -24,6 +24,7 @@ pub mod rand;
 pub mod symm;
 pub mod memcmp;
 pub mod rsa;
+#[cfg(feature = "catch_unwind")]
 mod util;
 
 mod symm_internal;
diff --git a/openssl/src/crypto/pkey.rs b/openssl/src/crypto/pkey.rs
index 238c1b9e9c..bbb8427dfb 100644
--- a/openssl/src/crypto/pkey.rs
+++ b/openssl/src/crypto/pkey.rs
@@ -1,4 +1,4 @@
-use libc::{c_int, c_uint, c_ulong, c_void, c_char};
+use libc::{c_int, c_uint, c_ulong};
 use std::io;
 use std::io::prelude::*;
 use std::iter::repeat;
@@ -12,6 +12,10 @@ use crypto::hash::Type as HashType;
 use ffi;
 use ssl::error::{SslError, StreamError};
 use crypto::rsa::RSA;
+
+#[cfg(feature = "catch_unwind")]
+use libc::{c_void, c_char};
+#[cfg(feature = "catch_unwind")]
 use crypto::util::{CallbackState, invoke_passwd_cb};
 
 #[derive(Copy, Clone)]
@@ -99,6 +103,7 @@ impl PKey {
     ///
     /// The callback will be passed the password buffer and should return the number of characters
     /// placed into the buffer.
+    #[cfg(feature = "catch_unwind")]
     pub fn private_key_from_pem_cb<R, F>(reader: &mut R, pass_cb: F) -> Result<PKey, SslError>
         where R: Read, F: FnMut(&mut [c_char]) -> usize
     {
diff --git a/openssl/src/crypto/rsa.rs b/openssl/src/crypto/rsa.rs
index c7f5cfaf95..a67fe38ea9 100644
--- a/openssl/src/crypto/rsa.rs
+++ b/openssl/src/crypto/rsa.rs
@@ -3,12 +3,16 @@ use std::fmt;
 use ssl::error::{SslError, StreamError};
 use std::ptr;
 use std::io::{self, Read, Write};
-use libc::{c_int, c_void, c_char};
+use libc::c_int;
 
 use bn::BigNum;
 use bio::MemBio;
 use crypto::HashTypeInternals;
 use crypto::hash;
+
+#[cfg(feature = "catch_unwind")]
+use libc::{c_void, c_char};
+#[cfg(feature = "catch_unwind")]
 use crypto::util::{CallbackState, invoke_passwd_cb};
 
 pub struct RSA(*mut ffi::RSA);
@@ -78,6 +82,7 @@ impl RSA {
     }
 
     /// Reads an RSA private key from PEM formatted data and supplies a password callback.
+    #[cfg(feature = "catch_unwind")]
     pub fn private_key_from_pem_cb<R, F>(reader: &mut R, pass_cb: F) -> Result<RSA, SslError>
         where R: Read, F: FnMut(&mut [c_char]) -> usize
     {

From d176ea1c6e7aaa4e96d27eb0c62dc11fdb990aca Mon Sep 17 00:00:00 2001
From: Jonas Schievink <jonas@schievink.net>
Date: Wed, 22 Jun 2016 22:27:53 +0200
Subject: [PATCH 7/9] Add an RSA key decryption test

---
 openssl/src/crypto/rsa.rs      | 18 ++++++++++++++++++
 openssl/test/rsa-encrypted.pem | 30 ++++++++++++++++++++++++++++++
 openssl/test/run.sh            |  2 +-
 3 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 openssl/test/rsa-encrypted.pem

diff --git a/openssl/src/crypto/rsa.rs b/openssl/src/crypto/rsa.rs
index a67fe38ea9..d030328390 100644
--- a/openssl/src/crypto/rsa.rs
+++ b/openssl/src/crypto/rsa.rs
@@ -303,4 +303,22 @@ mod test {
 
         assert!(result);
     }
+
+    #[test]
+    pub fn test_password() {
+        let mut password_queried = false;
+        let mut buffer = File::open("test/rsa-encrypted.pem").unwrap();
+        let rsa = RSA::private_key_from_pem_cb(&mut buffer, |password| {
+            password_queried = true;
+            password[0] = b'm' as _;
+            password[1] = b'y' as _;
+            password[2] = b'p' as _;
+            password[3] = b'a' as _;
+            password[4] = b's' as _;
+            password[5] = b's' as _;
+            6
+        }).unwrap();
+
+        assert!(password_queried);
+    }
 }
diff --git a/openssl/test/rsa-encrypted.pem b/openssl/test/rsa-encrypted.pem
new file mode 100644
index 0000000000..a624999726
--- /dev/null
+++ b/openssl/test/rsa-encrypted.pem
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,E2F16153E2BA3D617285A68C896BA6AF
+
+vO9SnhtGjGe8pG1pN//vsONnvJr+DjU+lFCiSqGMPT7tezDnbehLfS+9kus2HV7r
+HmI14JvVG9O7NpF7zMyBRlHYdWcCCWED9Yar0NsWN9419e5pMe/bqIXAzAiJbtT4
+OB9U5XF3m+349zjN1dVXPPLGRmMC1pcHAlofeb5nIUFTvUi5xcsbe1itGjgkkvHb
+Bt8NioHTBun8kKrlsFQOuB55ylBU/eWG8DQBtvFOmQ7iWp0RnGQfh8k5e5rcZNpQ
+fD9ygc7UVISl0xTrIG4IH15g34H+nrBauKtIPOpNPuXQPOMHCZv3XH8wnhrWHHwT
+ZFnQBdXbSpQtMsRh0phG2G+VIlyCgSn4+CxjCJ+TgFtsoK/tU0unmRYc59QnTxxb
+qkHYsPs3E0NApQAgH1ENEGl1M+FGLYQH7gftjc3ophBTeRA17sRmD7Y4QBInggsq
+Gv6tImPVBdekAjz/Ls/EyMwjAvvrL5eAokqrIsAarGo+zmbJKHzknw2KUz2En0+k
+YYaxB4oy9u7bzuQlvio6xYHJEb4K197bby4Dldmqv7YCCJBJwhOBAInMD687viKv
+vcUwL8YuS6cW5E8MbvEENlY4+lvKKj3M8Bnyb79cYIPQe92EuCwXU9DZXPRMLwwM
+oFEJpF5E/PmNJzu+B52ahHtDrh83WSx71fWqjdTqwkPZhAYo3ztsfFkb/UqUcq8u
+rBSebeUjZh0XZ9B04eshZQ5vJUcXGtYIe/77beV3Pv89/fw+zTZjpiP9Q3sZALzf
+Qt0YGp0/6qBuqR1tcqdu65AS2hun7yFw7uRavqYKvww4axRiz2do+xWmZFuoCAwD
+EWktaUujltpvAc1lo7lg4C6nByefJB9Xqk22N/vpqOsWr1NbAntT42Qj/HF9BVWR
+osvN3yMnKYWYe6oSTVnNBDM5obWAIHd3I9gcxTOTb1KsEwt2RrDs5EpB5ptS3Fjo
+JfBRhNZQ3cXttrIIhsHgDn9BDNg865/xpIgktKj0gEd60Abx0PqkAIm6IZTh4Efg
+7uZwfzxB+saOcddbrW2gNdzVZMC0s2Ye3sqHhtLbAJ3BlXYTxE4CAvTg54Ny+5hF
+IjvjlOKgXceSG1cSfk21/wyp9RY3Ft0AEYvvp0kZScWZaoA2aSFDUrchXVhgrEbn
+lJ7UptjefwRFIreAlwbKSbIDDNWnyzvIWyHfQ2aYqgnb7W7XqNPSgH9cALCfzirI
+dlRHjha0bMUtrjPCC/YfMXzJBVniy0gG6Pd5uC7vz/Awn6/6HRQVNaTQASphPBQ7
+bJuz+JTfzI9OUVCMRMdnb6b35U4P9tibFmnPvzTIPe+3WUmf8aRsLS3NN3G1Webd
+PMYVZpMycPaAI0Ht87axhsOzlxCWHYWjdHa+WoNNc1J90TxLCmAHquh5BDaWvjMK
+0DySftJZjV7Tf1p2KosmU83LRl39B5NHMbZb1xOEZl9IWwhT/PVKTVZ25xdxWLfb
+hF4l8rfvKehIp5r4t8zW1bvI2Hl6vrUvmcUVWt3BfKjxlgwRVD0vvwonMt1INesF
+204vUBeXbDsUUicLwOyUgaFvJ3XU3dOyvL9MhOgM5OgoFRRhG+4AS8a5JCD8iLtq
+-----END RSA PRIVATE KEY-----
diff --git a/openssl/test/run.sh b/openssl/test/run.sh
index 829f11e97f..1c23067fe1 100755
--- a/openssl/test/run.sh
+++ b/openssl/test/run.sh
@@ -8,7 +8,7 @@ if [ "$TEST_FEATURES" == "true" ]; then
 fi
 
 if [ "$TRAVIS_RUST_VERSION" == "nightly" ]; then
-    FEATURES="$FEATURES nightly"
+    FEATURES="$FEATURES nightly catch_unwind"
 fi
 
 if [ "$TRAVIS_OS_NAME" != "osx" ]; then

From 351bc569a46ab1590736114a50179351de8719d7 Mon Sep 17 00:00:00 2001
From: Jonas Schievink <jonas@schievink.net>
Date: Sun, 26 Jun 2016 18:24:47 +0200
Subject: [PATCH 8/9] Put the test behind the catch_unwind feature

And fix an unused variable warning
---
 openssl/src/crypto/rsa.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/openssl/src/crypto/rsa.rs b/openssl/src/crypto/rsa.rs
index d030328390..9a04bf7fda 100644
--- a/openssl/src/crypto/rsa.rs
+++ b/openssl/src/crypto/rsa.rs
@@ -305,10 +305,11 @@ mod test {
     }
 
     #[test]
+    #[cfg(feature = "catch_unwind")]
     pub fn test_password() {
         let mut password_queried = false;
         let mut buffer = File::open("test/rsa-encrypted.pem").unwrap();
-        let rsa = RSA::private_key_from_pem_cb(&mut buffer, |password| {
+        RSA::private_key_from_pem_cb(&mut buffer, |password| {
             password_queried = true;
             password[0] = b'm' as _;
             password[1] = b'y' as _;

From f24ab2693636f16ce71a171a4d4d63bd0f5bbea0 Mon Sep 17 00:00:00 2001
From: Jonas Schievink <jonas@schievink.net>
Date: Sun, 26 Jun 2016 19:44:53 +0200
Subject: [PATCH 9/9] FnMut -> FnOnce, update docs

---
 openssl/src/crypto/pkey.rs | 4 +++-
 openssl/src/crypto/rsa.rs  | 4 +++-
 openssl/src/crypto/util.rs | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/openssl/src/crypto/pkey.rs b/openssl/src/crypto/pkey.rs
index bbb8427dfb..157440476d 100644
--- a/openssl/src/crypto/pkey.rs
+++ b/openssl/src/crypto/pkey.rs
@@ -103,9 +103,11 @@ impl PKey {
     ///
     /// The callback will be passed the password buffer and should return the number of characters
     /// placed into the buffer.
+    ///
+    /// Requires the `catch_unwind` feature.
     #[cfg(feature = "catch_unwind")]
     pub fn private_key_from_pem_cb<R, F>(reader: &mut R, pass_cb: F) -> Result<PKey, SslError>
-        where R: Read, F: FnMut(&mut [c_char]) -> usize
+        where R: Read, F: FnOnce(&mut [c_char]) -> usize
     {
         let mut cb = CallbackState::new(pass_cb);
 
diff --git a/openssl/src/crypto/rsa.rs b/openssl/src/crypto/rsa.rs
index 9a04bf7fda..3b420fbc33 100644
--- a/openssl/src/crypto/rsa.rs
+++ b/openssl/src/crypto/rsa.rs
@@ -82,9 +82,11 @@ impl RSA {
     }
 
     /// Reads an RSA private key from PEM formatted data and supplies a password callback.
+    ///
+    /// Requires the `catch_unwind` feature.
     #[cfg(feature = "catch_unwind")]
     pub fn private_key_from_pem_cb<R, F>(reader: &mut R, pass_cb: F) -> Result<RSA, SslError>
-        where R: Read, F: FnMut(&mut [c_char]) -> usize
+        where R: Read, F: FnOnce(&mut [c_char]) -> usize
     {
         let mut cb = CallbackState::new(pass_cb);
 
diff --git a/openssl/src/crypto/util.rs b/openssl/src/crypto/util.rs
index 85df86b7c5..be72aa59cc 100644
--- a/openssl/src/crypto/util.rs
+++ b/openssl/src/crypto/util.rs
@@ -41,7 +41,7 @@ pub extern "C" fn invoke_passwd_cb<F>(buf: *mut c_char,
                                       _rwflag: c_int,
                                       cb_state: *mut c_void)
                                       -> c_int
-                                      where F: FnMut(&mut [i8]) -> usize {
+                                      where F: FnOnce(&mut [i8]) -> usize {
     let result = panic::catch_unwind(|| {
         // build a `i8` slice to pass to the user callback
         let pass_slice = unsafe { slice::from_raw_parts_mut(buf, size as usize) };