openssl.git
4 years agoUse OPENSSL_malloc rather than malloc/calloc
Richard Levitte [Tue, 24 Mar 2015 11:16:31 +0000 (12:16 +0100)]
Use OPENSSL_malloc rather than malloc/calloc

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoFix eng_cryptodev to not depend on BN internals.
Richard Levitte [Tue, 24 Mar 2015 07:38:22 +0000 (08:38 +0100)]
Fix eng_cryptodev to not depend on BN internals.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoAdjust include path
Richard Levitte [Tue, 24 Mar 2015 10:59:01 +0000 (11:59 +0100)]
Adjust include path

Thanks to a -I.., the path does work, at least on unix.  However, this
doesn't work so well on VMS.  Correcting the path to not rely on given
-I does work on both.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoJPAKE Makefile missing 'files' target
Richard Levitte [Tue, 24 Mar 2015 10:57:14 +0000 (11:57 +0100)]
JPAKE Makefile missing 'files' target

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoRemove old style ASN.1 support.
Dr. Stephen Henson [Mon, 9 Feb 2015 14:54:48 +0000 (14:54 +0000)]
Remove old style ASN.1 support.

Remove old ASN.1 COMPAT type. This was meant as a temporary measure
so older ASN.1 code (from OpenSSL 0.9.6) still worked. It's a hack
which breaks constification and hopefully nothing uses it now, if
it ever did.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoreturn unexpected message when receiving kx with kDHr or kDHd
Kurt Roeckx [Sat, 14 Mar 2015 23:26:26 +0000 (00:26 +0100)]
return unexpected message when receiving kx with kDHr or kDHd

It was saying that it was an illegal parameter / unsupported cipher

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoDon't send a for ServerKeyExchange for kDHr and kDHd
Kurt Roeckx [Sat, 14 Mar 2015 22:23:26 +0000 (23:23 +0100)]
Don't send a for ServerKeyExchange for kDHr and kDHd

The certificate already contains the DH parameters in that case.
ssl3_send_server_key_exchange() would fail in that case anyway.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoMake sure that cert is never NULL
Kurt Roeckx [Wed, 18 Mar 2015 18:02:50 +0000 (19:02 +0100)]
Make sure that cert is never NULL

Also removes for it being NULL

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoFix build.
Dr. Stephen Henson [Mon, 23 Mar 2015 18:47:05 +0000 (18:47 +0000)]
Fix build.

Remove x_exten.c and x_exten.o from crypto/asn1/Makefile: they've moved now.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agomake X509_EXTENSION opaque
Dr. Stephen Henson [Sun, 15 Mar 2015 13:43:56 +0000 (13:43 +0000)]
make X509_EXTENSION opaque

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix SSL_clear unused return
Matt Caswell [Mon, 23 Mar 2015 15:27:40 +0000 (15:27 +0000)]
Fix SSL_clear unused return

Fix missing return value check in dtls1_listen when calling SSL_clear().

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agossl3_set_handshake_header returns
Matt Caswell [Mon, 9 Mar 2015 15:33:46 +0000 (15:33 +0000)]
ssl3_set_handshake_header returns

Change ssl_set_handshake_header from return void to returning int, and
handle error return code appropriately.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoapps return value checks
Matt Caswell [Fri, 6 Mar 2015 14:39:46 +0000 (14:39 +0000)]
apps return value checks

Ensure that all libssl functions called from within the apps have their
return values checked where appropriate.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix missing return value checks
Matt Caswell [Fri, 6 Mar 2015 14:37:17 +0000 (14:37 +0000)]
Fix missing return value checks

Ensure that all functions have their return values checked where
appropriate. This covers all functions defined and called from within
libssl.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoCheck libssl function returns
Matt Caswell [Thu, 5 Mar 2015 10:14:40 +0000 (10:14 +0000)]
Check libssl function returns

Mark most functions returning a result defined in any libssl header file
with __owur to warn if they are used without checking the return value.
Use -DUNUSED_RETURN compiler flag with gcc to activate these warnings.
Some functions returning a result are skipped if it is common and valid to
use these functions without checking the return value.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoAdd -DDEBUG_UNUSED to --strict-warnings
Matt Caswell [Fri, 6 Mar 2015 14:22:22 +0000 (14:22 +0000)]
Add -DDEBUG_UNUSED to --strict-warnings

In order to receive warnings on unused function return values the flag
-DDEBUG_UNUSED must be passed to the compiler. This change adds that for the
--strict-warnings Configure option.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoRemove PREFIX, as it's not used any more.
Richard Levitte [Sun, 22 Mar 2015 08:00:43 +0000 (09:00 +0100)]
Remove PREFIX, as it's not used any more.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoActually remove TABLE from version control
Richard Levitte [Sun, 22 Mar 2015 07:56:02 +0000 (08:56 +0100)]
Actually remove TABLE from version control

Follow up on the earlier "Do not keep TABLE in version control".
Actually removing TABLE from version control was forgotten.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoDon't check curves that haven't been sent
Matt Caswell [Fri, 20 Mar 2015 15:10:16 +0000 (15:10 +0000)]
Don't check curves that haven't been sent

Don't check that the curve appears in the list of acceptable curves for the
peer, if they didn't send us such a list (RFC 4492 does not require that the
extension be sent).

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoRemove deleted functions, update ordinals.
Dr. Stephen Henson [Mon, 23 Mar 2015 13:47:57 +0000 (13:47 +0000)]
Remove deleted functions, update ordinals.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoRemove {i2d,d2i}_ASN1_BOOLEAN
Dr. Stephen Henson [Sat, 14 Mar 2015 18:06:59 +0000 (18:06 +0000)]
Remove {i2d,d2i}_ASN1_BOOLEAN

Remove {i2d,d2i}_ASN1_BOOLEAN.

Rewrite single occurrence of d2i_ASN1_BOOLEAN in asn1_parse2

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoRemove old ASN.1 code.
Dr. Stephen Henson [Sat, 14 Mar 2015 04:16:42 +0000 (04:16 +0000)]
Remove old ASN.1 code.

Remove old M_ASN1_ macros and replace any occurences with the corresponding
function.

Remove d2i_ASN1_bytes, d2i_ASN1_SET, i2d_ASN1_SET: no longer used internally.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agosha/asm/sha256-armv4.pl: adapt for use in Linux kernel context.
Andy Polyakov [Mon, 23 Mar 2015 12:34:03 +0000 (13:34 +0100)]
sha/asm/sha256-armv4.pl: adapt for use in Linux kernel context.

In cooperation with Ard Biesheuvel (Linaro) and Sami Tolvanen (Google).

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoRefer to $table{$target} rather than $table{$t}.
Richard Levitte [Sat, 21 Mar 2015 23:27:48 +0000 (00:27 +0100)]
Refer to $table{$target} rather than $table{$t}.

Using $t is an artifact from the earlier changes in Configure and was
unfortunately forgotten as is.

Reviewed-by: Stephen Henson <steve@openssl.org>
4 years agoAdd AES unwrap test with invalid key.
Dr. Stephen Henson [Fri, 20 Mar 2015 22:53:16 +0000 (22:53 +0000)]
Add AES unwrap test with invalid key.

This tests the unwrap algorithm with an invalid key. The result should
be rejected without returning any plaintext.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoFix memory leak.
Dr. Stephen Henson [Fri, 20 Mar 2015 23:08:30 +0000 (23:08 +0000)]
Fix memory leak.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoCRYPTO_128_unwrap(): Fix refactoring damage
Richard Godbee [Sat, 14 Mar 2015 04:23:21 +0000 (21:23 -0700)]
CRYPTO_128_unwrap(): Fix refactoring damage

crypto/modes/wrap128.c was heavily refactored to support AES Key Wrap
with Padding, and four bugs were introduced into CRYPTO_128_unwrap() at
that time:

- crypto_128_unwrap_raw()'s return value ('ret') is checked incorrectly,
  and the function immediately returns 'ret' in (almost) all cases.
  This makes the IV checking code later in the function unreachable, but
  callers think the IV check succeeded since CRYPTO_128_unwrap()'s
  return value is non-zero.

  FIX: Return 0 (error) if crypto_128_unwrap_raw() returned 0 (error).

- crypto_128_unwrap_raw() writes the IV to the 'got_iv' buffer, not to
  the first 8 bytes of the output buffer ('out') as the IV checking code
  expects.  This makes the IV check fail.

  FIX: Compare 'iv' to 'got_iv', not 'out'.

- The data written to the output buffer ('out') is "cleansed" if the IV
  check fails, but the code passes OPENSSL_cleanse() the input buffer
  length ('inlen') instead of the number of bytes that
  crypto_128_unwrap_raw() wrote to the output buffer ('ret').  This
  means that OPENSSL_cleanse() could potentially write past the end of
  'out'.

  FIX: Change 'inlen' to 'ret' in the OPENSSL_cleanse() call.

- CRYPTO_128_unwrap() is returning the length of the input buffer
  ('inlen') instead of the number of bytes written to the output buffer
  ('ret').  This could cause the caller to read past the end of 'out'.

  FIX: Return 'ret' instead of 'inlen' at the end of the function.

PR#3749

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agowrap128.c: Fix Doxygen comments
Richard Godbee [Sat, 14 Mar 2015 03:54:39 +0000 (20:54 -0700)]
wrap128.c: Fix Doxygen comments

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoAdd DTLS tests to make test
Matt Caswell [Tue, 3 Mar 2015 16:08:58 +0000 (16:08 +0000)]
Add DTLS tests to make test

Updated test/testssl script to include the new DTLS capability in ssltest.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoAdd DTLS support to ssltest
David Woodhouse [Tue, 3 Mar 2015 15:47:08 +0000 (15:47 +0000)]
Add DTLS support to ssltest

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoAdd DTLS to SSL_get_version
David Woodhouse [Tue, 3 Mar 2015 15:39:26 +0000 (15:39 +0000)]
Add DTLS to SSL_get_version

Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoIf the target is an old style debug- target, it will not have debugging [cl]flags
Richard Levitte [Thu, 19 Mar 2015 21:35:12 +0000 (22:35 +0100)]
If the target is an old style debug- target, it will not have debugging [cl]flags

Reviewed-by: Stephen Henson <steve@openssl.org>
4 years agoFix a failure to NULL a pointer freed on error.
Matt Caswell [Thu, 19 Mar 2015 10:16:32 +0000 (10:16 +0000)]
Fix a failure to NULL a pointer freed on error.

Reported by the LibreSSL project as a follow on to CVE-2015-0209

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoUpdate NEWS
Matt Caswell [Wed, 18 Mar 2015 10:10:01 +0000 (10:10 +0000)]
Update NEWS

Resync NEWS with the latest version from 1.0.2

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoUpdate CHANGES
Matt Caswell [Wed, 18 Mar 2015 09:35:22 +0000 (09:35 +0000)]
Update CHANGES

Resync CHANGES with the latest version from 1.0.2.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoPKCS#7: avoid NULL pointer dereferences with missing content
Emilia Kasper [Fri, 27 Feb 2015 15:52:23 +0000 (16:52 +0100)]
PKCS#7: avoid NULL pointer dereferences with missing content

In PKCS#7, the ASN.1 content component is optional.
This typically applies to inner content (detached signatures),
however we must also handle unexpected missing outer content
correctly.

This patch only addresses functions reachable from parsing,
decryption and verification, and functions otherwise associated
with reading potentially untrusted data.

Correcting all low-level API calls requires further work.

CVE-2015-0289

Thanks to Michal Zalewski (Google) for reporting this issue.

Reviewed-by: Steve Henson <steve@openssl.org>
4 years agoFix ASN1_TYPE_cmp
Dr. Stephen Henson [Mon, 9 Mar 2015 23:11:45 +0000 (23:11 +0000)]
Fix ASN1_TYPE_cmp

Fix segmentation violation when ASN1_TYPE_cmp is passed a boolean type. This
can be triggered during certificate verification so could be a DoS attack
against a client or a server enabling client authentication.

CVE-2015-0286

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix DHE Null CKE vulnerability
Matt Caswell [Tue, 10 Mar 2015 16:38:32 +0000 (16:38 +0000)]
Fix DHE Null CKE vulnerability

If client auth is used then a server can seg fault in the event of a DHE
cipher being used and a zero length ClientKeyExchange message being sent
by the client. This could be exploited in a DoS attack.

CVE-2015-1787

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix for CVE-2015-0291
Dr. Stephen Henson [Tue, 3 Mar 2015 13:20:57 +0000 (13:20 +0000)]
Fix for CVE-2015-0291

If a client renegotiates using an invalid signature algorithms extension
it will crash a server with a NULL pointer dereference.

Thanks to David Ramos of Stanford University for reporting this bug.

CVE-2015-0291

Reviewed-by: Tim Hudson <tjh@openssl.org>
4 years agoReject invalid PSS parameters.
Dr. Stephen Henson [Mon, 9 Mar 2015 23:16:33 +0000 (23:16 +0000)]
Reject invalid PSS parameters.

Fix a bug where invalid PSS parameters are not rejected resulting in a
NULL pointer exception. This can be triggered during certificate
verification so could be a DoS attack against a client or a server
enabling client authentication.

Thanks to Brian Carpenter for reporting this issues.

CVE-2015-0208

Reviewed-by: Tim Hudson <tjh@openssl.org>
4 years agoFree up ADB and CHOICE if already initialised.
Dr. Stephen Henson [Mon, 23 Feb 2015 02:32:44 +0000 (02:32 +0000)]
Free up ADB and CHOICE if already initialised.

CVE-2015-0287

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoFix Seg fault in DTLSv1_listen
Matt Caswell [Mon, 9 Mar 2015 16:09:04 +0000 (16:09 +0000)]
Fix Seg fault in DTLSv1_listen

The DTLSv1_listen function is intended to be stateless and processes
the initial ClientHello from many peers. It is common for user code to
loop over the call to DTLSv1_listen until a valid ClientHello is received
with an associated cookie. A defect in the implementation of DTLSv1_listen
means that state is preserved in the SSL object from one invokation to the
next that can lead to a segmentation fault. Erorrs processing the initial
ClientHello can trigger this scenario. An example of such an error could
be that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only
server.

CVE-2015-0207

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoMultiblock corrupted pointer fix
Matt Caswell [Mon, 2 Mar 2015 09:27:10 +0000 (09:27 +0000)]
Multiblock corrupted pointer fix

OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This
feature only applies on 64 bit x86 architecture platforms that support AES
NI instructions. A defect in the implementation of "multiblock" can cause
OpenSSL's internal write buffer to become incorrectly set to NULL when
using non-blocking IO. Typically, when the user application is using a
socket BIO for writing, this will only result in a failed connection.
However if some other BIO is used then it is likely that a segmentation
fault will be triggered, thus enabling a potential DoS attack.

CVE-2015-0290

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoConfigure: fold related configurations more aggressively and clean-up.
Andy Polyakov [Mon, 16 Mar 2015 21:33:36 +0000 (22:33 +0100)]
Configure: fold related configurations more aggressively and clean-up.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoCorrect the request of debug builds
Richard Levitte [Tue, 17 Mar 2015 15:30:54 +0000 (16:30 +0100)]
Correct the request of debug builds

./config would translate -d into having the target get a 'debug-'
prefix, and then run './Configure LIST' to find out if such a
debugging target exists or not.

With the recent changes, the separate 'debug-foo' targets are
disappearing, and we're giving the normal targets debugging
capabilities instead.  Unfortunately, './config' wasn't changed to
match this new behavior.

This change introduces the arguments '--debug' and '--release' - the
latter just for orthogonality - to ./Configure, and ./config now
treats -d by adding '--debug' to the options for ./Configure.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoDead code removal from apps
Matt Caswell [Thu, 12 Mar 2015 14:09:00 +0000 (14:09 +0000)]
Dead code removal from apps

Some miscellaneous removal of dead code from apps. Also fix an issue with
error handling with pkcs7.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoRemove dead code from crypto
Matt Caswell [Thu, 12 Mar 2015 14:08:21 +0000 (14:08 +0000)]
Remove dead code from crypto

Some miscellaneous removal of dead code from lib crypto.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix probable_prime over large shift
Matt Caswell [Fri, 13 Mar 2015 12:48:57 +0000 (12:48 +0000)]
Fix probable_prime over large shift

In the probable_prime() function we behave slightly different if the number
of bits we are interested in is <= BN_BITS2 (the num of bits in a BN_ULONG).
As part of the calculation we work out a size_limit as follows:

    size_limit = (((BN_ULONG)1) << bits) - BN_get_word(rnd) - 1;

There is a problem though if bits == BN_BITS2. Shifting by that much causes
undefined behaviour. I did some tests. On my system BN_BITS2 == 64. So I
set bits to 64 and calculated the result of:

    (((BN_ULONG)1) << bits)

I was expecting to get the result 0. I actually got 1! Strangely this...

    (((BN_ULONG)0) << BN_BITS2)

...does equal 0! This means that, on my system at least, size_limit will be
off by 1 when bits == BN_BITS2.

This commit fixes the behaviour so that we always get consistent results.

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoFix unintended sign extension
Matt Caswell [Thu, 12 Mar 2015 15:59:07 +0000 (15:59 +0000)]
Fix unintended sign extension

The function CRYPTO_128_unwrap_pad uses an 8 byte AIV (Alternative Initial
Value). The least significant 4 bytes of this is placed into the local
variable |ptext_len|. This is done as follows:

    ptext_len = (aiv[4] << 24) | (aiv[5] << 16) | (aiv[6] << 8) | aiv[7];

aiv[4] is an unsigned char, but (aiv[4] << 24) is promoted to a *signed*
int - therefore we could end up shifting into the sign bit and end up with
a negative value. |ptext_len| is a size_t (typically 64-bits). If the
result of the shifts is negative then the upper bits of |ptext_len| will
all be 1.

This commit fixes the issue by explicitly casting to an unsigned int.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix seg fault in s_time
Matt Caswell [Thu, 12 Mar 2015 16:42:55 +0000 (16:42 +0000)]
Fix seg fault in s_time

Passing a negative value for the "-time" option to s_time results in a seg
fault. This commit fixes it so that time has to be greater than 0.

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoAdd sanity check to PRF
Matt Caswell [Thu, 12 Mar 2015 14:37:26 +0000 (14:37 +0000)]
Add sanity check to PRF

The function tls1_PRF counts the number of digests in use and partitions
security evenly between them. There always needs to be at least one digest
in use, otherwise this is an internal error. Add a sanity check for this.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix memset call in stack.c
Matt Caswell [Thu, 12 Mar 2015 12:54:44 +0000 (12:54 +0000)]
Fix memset call in stack.c

The function sk_zero is supposed to zero the elements held within a stack.
It uses memset to do this. However it calculates the size of each element
as being sizeof(char **) instead of sizeof(char *). This probably doesn't
make much practical difference in most cases, but isn't a portable
assumption.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoMove malloc fail checks closer to malloc
Matt Caswell [Thu, 12 Mar 2015 11:25:03 +0000 (11:25 +0000)]
Move malloc fail checks closer to malloc

Move memory allocation failure checks closer to the site of the malloc in
dgst app. Only a problem if the debug flag is set...but still should be
fixed.

Reviewed-by: Tim Hudson <tjh@openssl.org>
4 years agoAdd malloc failure checks
Matt Caswell [Thu, 12 Mar 2015 11:10:47 +0000 (11:10 +0000)]
Add malloc failure checks

Add some missing checks for memory allocation failures in ca app.

Reviewed-by: Tim Hudson <tjh@openssl.org>
4 years agoDo not keep TABLE in version control.
Richard Levitte [Mon, 16 Mar 2015 21:36:19 +0000 (22:36 +0100)]
Do not keep TABLE in version control.

TABLE was always a debugging tool, and permitted everyone to see the
effect of changes in the string-format configs.  The hash-format
configs being much more readable, distributing TABLE becomes much less
necessary.

Being able to produce a TABLE is kept, however, as it still is a
useful debugging tool for configs, what with multi-level inheritance
and all.

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoConfiguration cleanup: personal configs
Richard Levitte [Thu, 12 Mar 2015 13:58:07 +0000 (14:58 +0100)]
Configuration cleanup: personal configs

Move obviously personal configurations to personal files.

Note: those files should really not be in the main repo at all

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoUpdated TABLE
Richard Levitte [Mon, 16 Mar 2015 21:01:01 +0000 (22:01 +0100)]
Updated TABLE

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoFind debug- targets that can be combined with their non-debug counterparts and do so
Richard Levitte [Thu, 12 Mar 2015 13:55:05 +0000 (14:55 +0100)]
Find debug- targets that can be combined with their non-debug counterparts and do so

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoChange all the main configurations to the new format.
Richard Levitte [Tue, 10 Mar 2015 23:58:50 +0000 (00:58 +0100)]
Change all the main configurations to the new format.

As part of this, remove some levitte examples that never were relevant.

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoRethink templates.
Richard Levitte [Tue, 10 Mar 2015 21:04:44 +0000 (22:04 +0100)]
Rethink templates.

Because base templates express inheritance of values, the attribute is
renamed to 'inherit_from', and texts about this talk about 'inheritance(s)'
rather than base templates.

As they were previously implemented, base templates that were listed
together would override one another, the first one acting as defaults for
the next and so on.

However, it was pointed out that a strength of inheritance would be to
base configurations on several templates - for example one for CPU, one
for operating system and one for compiler - and that requires a different
way of combining those templates.  With this change, inherited values
from several inheritances are concatenated by default (keep on reading).

Also, in-string templates with the double-curly syntax are removed,
replaced with the possibility to have a configuration value be a coderef
(i.e. a 'sub { /* your code goes here */ }') that gets the list of values
from all inheritances as the list @_.  The result of executing such a
coderef on a list of values is assumed to become a string.  ANY OTHER
FORM OF VALUE WILL CURRENTLY BREAK.

As a matter of fact, an attribute in the current config with no value is
assumed to have this coderef as value:

    sub { join(' ', @_) }

While we're at it, rename debug-[cl]flags to debug_[cl]flags and
nodebug-[cl]flags to release_[cl]flags.

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoProvide a few examples by converting my own strings to hash table configurations
Richard Levitte [Fri, 6 Mar 2015 09:16:05 +0000 (10:16 +0100)]
Provide a few examples by converting my own strings to hash table configurations

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoAdd base template processing.
Richard Levitte [Fri, 6 Mar 2015 09:01:08 +0000 (10:01 +0100)]
Add base template processing.

Base templates are templates that are used to inherit from.  They can
loosely be compared with parent class inheritance in object orientation.
They can be used for the same purpose as the variables with multi-field
strings are used in old-style string configurations.

Base templates are declared with the base_templates configuration
attribute, like so:

"example_target" => {
base_templates => [ "x86_asm", ... ]
...
}

Note: The value of base_templates MUST be an array reference (an array
enclosed in square brackets).

Any configuration target can be used as a base template by another.  It
is also possible to have a target that's a pure template and not meant to
be used directly as a configuration target.  Such a target is marked with
the template configuration attribute, like so:

"example_template" => {
template => 1,
cc => "mycc",
...
},

As part of this commit, all variables with multi-field strings have been
translated to pure templates.  The variables currently remain since we
can't expect people to shift to hash table configurations immediately.

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoAdd template reference processing.
Richard Levitte [Fri, 6 Mar 2015 02:00:53 +0000 (03:00 +0100)]
Add template reference processing.

Template references are words with double brackets, and refer to the
same field in the target pointed at the the double bracketed word.

For example, if a target's configuration has the following entry:

    'cflags' => '-DFOO {{x86_debug}}'

... then {{x86_debug}} will be replaced with the 'cflags' value from
target 'x86_debug'.

Note: template references are resolved recursively, and circular
references are not allowed

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoRewrite Configure to handle the target values as hash tables.
Richard Levitte [Fri, 6 Mar 2015 01:00:21 +0000 (02:00 +0100)]
Rewrite Configure to handle the target values as hash tables.

The reasoning is that configuration strings are hard to read and error
prone, and that a better way would be for them to be key => value hashes.

Configure is made to be able to handle target configuration values as a
string as well as a hash.  It also does the best it can to combine a
"debug-foo" target with a "foo" target, given that they are similar
except for the cflags and lflags values.  The latter are spliced into
options that are common for "debug-foo" and "foo", options that exist
only with "debug-foo" and options that exist only with "foo", and make
them into combinable attributes that holds common cflags, extra cflags
for debuggin and extra cflags for non-debugging configurations.

The next step is to make it possible to have template configurations.

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoMake X509_ATTRIBUTE opaque.
Dr. Stephen Henson [Sat, 14 Mar 2015 23:48:47 +0000 (23:48 +0000)]
Make X509_ATTRIBUTE opaque.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix regression in ASN1_UTCTIME_cmp_time_t
Carl Jackson [Sat, 31 Jan 2015 10:22:47 +0000 (02:22 -0800)]
Fix regression in ASN1_UTCTIME_cmp_time_t

Previously, ASN1_UTCTIME_cmp_time_t would return 1 if s > t, -1 if
s < t, and 0 if s == t.

This behavior was broken in a refactor [0], resulting in the opposite
time comparison behavior.

[0]: 904348a4922333106b613754136305db229475ea

PR#3706

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoOPENSSL_NO_EC* merge; missed one file
Rich Salz [Sun, 15 Mar 2015 18:49:15 +0000 (14:49 -0400)]
OPENSSL_NO_EC* merge; missed one file

Missed one file in the #ifdef merge; thanks Kurt.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
4 years agoUpdate ordinals, fix error message.
Dr. Stephen Henson [Sat, 14 Mar 2015 22:42:55 +0000 (22:42 +0000)]
Update ordinals, fix error message.

Update error messages to say "EC is disabled" these can then be picked up
by mkdef.pl.

Update ordinals.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
4 years agoRemove ssl_cert_inst()
Kurt Roeckx [Sat, 14 Mar 2015 17:09:44 +0000 (18:09 +0100)]
Remove ssl_cert_inst()

It created the cert structure in SSL_CTX or SSL if it was NULL, but they can
never be NULL as the comments already said.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
4 years agoAvoid reading an unused byte after the buffer
Andy Polyakov [Sat, 21 Feb 2015 12:51:56 +0000 (13:51 +0100)]
Avoid reading an unused byte after the buffer

Other curves don't have this problem.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
4 years agoFix undefined behaviour in shifts.
Emilia Kasper [Sat, 14 Mar 2015 04:10:13 +0000 (21:10 -0700)]
Fix undefined behaviour in shifts.

Td4 and Te4 are arrays of u8. A u8 << int promotes the u8 to an int first then shifts.
If the mathematical result of a shift (as modelled by lhs * 2^{rhs}) is not representable
in an integer, behaviour is undefined. In other words, you can't shift into the sign bit
of a signed integer. Fix this by casting to u32 whenever we're shifting left by 24.

(For consistency, cast other shifts, too.)

Caught by -fsanitize=shift

Submitted by Nick Lewycky (Google)

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoAllocate string types directly.
Dr. Stephen Henson [Tue, 24 Feb 2015 00:57:51 +0000 (00:57 +0000)]
Allocate string types directly.

Allocate and free ASN.1 string types directly instead of going through
the ASN.1 item code.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix key wrapping mode with padding to conform to RFC 5649.
Petr Spacek [Mon, 26 Jan 2015 13:39:50 +0000 (14:39 +0100)]
Fix key wrapping mode with padding to conform to RFC 5649.

According to RFC 5649 section 4.1 step 1) we should not add padding
if plaintext length is multiply of 8 ockets.

This matches pseudo-code in http://dx.doi.org/10.6028/NIST.SP.800-38F
on page 15, section 6.3 KWP, algorithm 5 KWP-AE, step 2.

PR#3675

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoRemove obsolete declarations.
Dr. Stephen Henson [Thu, 12 Mar 2015 14:12:17 +0000 (14:12 +0000)]
Remove obsolete declarations.

Remove DECLARE_ASN1_SET_OF and DECLARE_PKCS12_STACK_OF these haven't been
used internally in OpenSSL for some time.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoUpdate mkstack.pl to match safestack.h
Dr. Stephen Henson [Thu, 12 Mar 2015 14:05:27 +0000 (14:05 +0000)]
Update mkstack.pl to match safestack.h

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoASN.1 print fix.
Dr. Stephen Henson [Wed, 11 Mar 2015 23:30:52 +0000 (23:30 +0000)]
ASN.1 print fix.

When printing out an ASN.1 structure if the type is an item template don't
fall thru and attempt to interpret as a primitive type.

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoadditional configuration documentation
Dr. Stephen Henson [Sun, 1 Mar 2015 15:25:39 +0000 (15:25 +0000)]
additional configuration documentation

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoFix RSA_X931_derive_ex
Matt Caswell [Wed, 11 Mar 2015 17:43:38 +0000 (17:43 +0000)]
Fix RSA_X931_derive_ex

In the RSA_X931_derive_ex a call to BN_CTX_new is made. This can return
NULL on error. However the return value is not tested until *after* it is
derefed! Also at the top of the function a test is made to ensure that
|rsa| is not NULL. If it is we go to the "err" label. Unfortunately the
error handling code deref's rsa.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoSSL_check_chain fix
Matt Caswell [Wed, 11 Mar 2015 17:01:38 +0000 (17:01 +0000)]
SSL_check_chain fix

If SSL_check_chain is called with a NULL X509 object or a NULL EVP_PKEY
or the type of the public key is unrecognised then the local variable
|cpk| in tls1_check_chain does not get initialised. Subsequently an
attempt is made to deref it (after the "end" label), and a seg fault will
result.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
4 years agoFix missing return checks in v3_cpols.c
Matt Caswell [Wed, 11 Mar 2015 20:50:20 +0000 (20:50 +0000)]
Fix missing return checks in v3_cpols.c

Fixed assorted missing return value checks in c3_cpols.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix dsa_pub_encode
Matt Caswell [Wed, 11 Mar 2015 20:19:08 +0000 (20:19 +0000)]
Fix dsa_pub_encode

The return value from ASN1_STRING_new() was not being checked which could
lead to a NULL deref in the event of a malloc failure. Also fixed a mem
leak in the error path.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix dh_pub_encode
Matt Caswell [Wed, 11 Mar 2015 20:08:16 +0000 (20:08 +0000)]
Fix dh_pub_encode

The return value from ASN1_STRING_new() was not being checked which could
lead to a NULL deref in the event of a malloc failure. Also fixed a mem
leak in the error path.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix asn1_item_print_ctx
Matt Caswell [Wed, 11 Mar 2015 19:41:01 +0000 (19:41 +0000)]
Fix asn1_item_print_ctx

The call to asn1_do_adb can return NULL on error, so we should check the
return value before attempting to use it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoASN1_primitive_new NULL param handling
Matt Caswell [Wed, 11 Mar 2015 16:00:01 +0000 (16:00 +0000)]
ASN1_primitive_new NULL param handling

ASN1_primitive_new takes an ASN1_ITEM * param |it|. There are a couple
of conditional code paths that check whether |it| is NULL or not - but
later |it| is deref'd unconditionally. If |it| was ever really NULL then
this would seg fault. In practice ASN1_primitive_new is marked as an
internal function in the public header file. The only places it is ever
used internally always pass a non NULL parameter for |it|. Therefore, change
the code to sanity check that |it| is not NULL, and remove the conditional
checking.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoFix EVP_DigestInit_ex with NULL digest
Matt Caswell [Wed, 11 Mar 2015 15:41:52 +0000 (15:41 +0000)]
Fix EVP_DigestInit_ex with NULL digest

Calling EVP_DigestInit_ex which has already had the digest set up for it
should be possible. You are supposed to be able to pass NULL for the type.
However currently this seg faults.

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agoFix error handling in bn_exp
Matt Caswell [Wed, 11 Mar 2015 15:31:16 +0000 (15:31 +0000)]
Fix error handling in bn_exp

In the event of an error |rr| could be NULL. Therefore don't assume you can
use |rr| in the error handling code.

Reviewed-by: Andy Polyakov <appro@openssl.org>
4 years agossl/s3_clnt.c: fix intermittent failures.
Andy Polyakov [Thu, 12 Mar 2015 07:54:28 +0000 (08:54 +0100)]
ssl/s3_clnt.c: fix intermittent failures.

[and respect error return value in ssltest.c]

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoMerge OPENSSL_NO_EC{DH,DSA} into OPENSSL_NO_EC
Rich Salz [Tue, 10 Mar 2015 23:09:27 +0000 (19:09 -0400)]
Merge OPENSSL_NO_EC{DH,DSA} into OPENSSL_NO_EC

Suggested by John Foley <foleyj@cisco.com>.

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoFix seg fault in ASN1_generate_v3/ASN1_generate_nconf
Matt Caswell [Tue, 10 Mar 2015 23:15:15 +0000 (23:15 +0000)]
Fix seg fault in ASN1_generate_v3/ASN1_generate_nconf

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
4 years agoMove Configurations* out of the way and rename them.
Richard Levitte [Wed, 11 Mar 2015 09:22:50 +0000 (10:22 +0100)]
Move Configurations* out of the way and rename them.

Configure would load the glob "Configurations*".  The problem with
this is that it also loads all kinds of backups of those
configurations that some editors do, like emacs' classic
'Configurations~'.  The solution is to give them an extension, such as
'.conf', and make sure to end the glob with that.

Also, because 'Configurations.conf' makes for a silly name, and
because a possibly large number of configurations will become clutter,
move them to a subdirectory 'Configurations/', and rename them to
something more expressive, as well as something that sets up some form
of sorting order.  Thus:

    Configurations -> Configurations/10-main.conf
    Configurations.team -> Configurations/90-team.conf

Finally, make sure that Configure sorts the list of files that 'glob'
produces, and adapt Makefile.org.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoCleanse buffers
Matt Caswell [Mon, 9 Mar 2015 13:59:58 +0000 (13:59 +0000)]
Cleanse buffers

Cleanse various intermediate buffers used by the PRF.

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoHarmonize return values in dtls1_buffer_record
Emilia Kasper [Wed, 4 Mar 2015 21:05:53 +0000 (13:05 -0800)]
Harmonize return values in dtls1_buffer_record

Ensure all malloc failures return -1.

Reported by Adam Langley (Google).

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoBIO_debug_callback: Fix output on 64-bit machines
Richard Godbee [Sun, 21 Sep 2014 06:14:11 +0000 (02:14 -0400)]
BIO_debug_callback: Fix output on 64-bit machines

BIO_debug_callback() no longer assumes the hexadecimal representation of
a pointer fits in 8 characters.

Signed-off-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoPrevent handshake with unseeded PRNG
Matt Caswell [Thu, 26 Feb 2015 11:56:00 +0000 (11:56 +0000)]
Prevent handshake with unseeded PRNG

Fix security issue where under certain conditions a client can complete a
handshake with an unseeded PRNG. The conditions are:
- Client is on a platform where the PRNG has not been seeded, and the
user has not seeded manually
- A protocol specific client method version has been used (i.e. not
SSL_client_methodv23)
- A ciphersuite is used that does not require additional random data
from the PRNG beyond the initial ClientHello client random
(e.g. PSK-RC4-SHA)

If the handshake succeeds then the client random that has been used will
have been generated from a PRNG with insufficient entropy and therefore
the output may be predictable.

For example using the following command with an unseeded openssl will
succeed on an unpatched platform:

openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA

CVE-2015-0285

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoFix wrong numbers being passed as string lengths
Dmitry-Me [Sun, 1 Jun 2014 17:30:52 +0000 (21:30 +0400)]
Fix wrong numbers being passed as string lengths

Signed-off-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoupdate ordinals
Dr. Stephen Henson [Mon, 9 Mar 2015 16:55:18 +0000 (16:55 +0000)]
update ordinals

Reviewed-by: Matt Caswell <matt@openssl.org>
4 years agoWrong SSL version in DTLS1_BAD_VER ClientHello
David Woodhouse [Mon, 2 Mar 2015 16:20:15 +0000 (16:20 +0000)]
Wrong SSL version in DTLS1_BAD_VER ClientHello

Since commit 741c9959 ("DTLS revision."), we put the wrong protocol
version into our ClientHello for DTLS1_BAD_VER. The old DTLS
code which used ssl->version was replaced by the more generic SSL3 code
which uses ssl->client_version. The Cisco ASA no longer likes our
ClientHello.

RT#3711

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoFix DTLS1_BAD_VER regression
Matt Caswell [Mon, 2 Mar 2015 14:34:19 +0000 (14:34 +0000)]
Fix DTLS1_BAD_VER regression

Commit 9cf0f187 in HEAD, and 68039af3 in 1.0.2, removed a version check
from dtls1_buffer_message() which was needed to distinguish between DTLS
1.x and Cisco's pre-standard version of DTLS (DTLS1_BAD_VER).

Based on an original patch by David Woodhouse <dwmw2@infradead.org>
RT#3703

Reviewed-by: Tim Hudson <tjh@openssl.org>
4 years agoCleanse PKCS#8 private key components.
Dr. Stephen Henson [Tue, 3 Mar 2015 14:20:23 +0000 (14:20 +0000)]
Cleanse PKCS#8 private key components.

New function ASN1_STRING_clear_free which cleanses an ASN1_STRING
structure before freeing it.

Call ASN1_STRING_clear_free on PKCS#8 private key components.

Reviewed-by: Rich Salz <rsalz@openssl.org>
4 years agoAdditional CMS documentation.
Dr. Stephen Henson [Tue, 24 Feb 2015 16:35:37 +0000 (16:35 +0000)]
Additional CMS documentation.

Reviewed-by: Rich Salz <rsalz@openssl.org>