Prevent handshake with unseeded PRNG

Fix security issue where under certain conditions a client can complete a
handshake with an unseeded PRNG. The conditions are:
- Client is on a platform where the PRNG has not been seeded, and the
user has not seeded manually
- A protocol specific client method version has been used (i.e. not
SSL_client_methodv23)
- A ciphersuite is used that does not require additional random data
from the PRNG beyond the initial ClientHello client random
(e.g. PSK-RC4-SHA)

If the handshake succeeds then the client random that has been used will
have been generated from a PRNG with insufficient entropy and therefore
the output may be predictable.

For example using the following command with an unseeded openssl will
succeed on an unpatched platform:

openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA

CVE-2015-0285

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix wrong numbers being passed as string lengths

Signed-off-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

update ordinals

Reviewed-by: Matt Caswell <matt@openssl.org>

Wrong SSL version in DTLS1_BAD_VER ClientHello

Since commit 741c9959 ("DTLS revision."), we put the wrong protocol
version into our ClientHello for DTLS1_BAD_VER. The old DTLS
code which used ssl->version was replaced by the more generic SSL3 code
which uses ssl->client_version. The Cisco ASA no longer likes our
ClientHello.

RT#3711

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix DTLS1_BAD_VER regression

Commit 9cf0f187 in HEAD, and 68039af3 in 1.0.2, removed a version check
from dtls1_buffer_message() which was needed to distinguish between DTLS
1.x and Cisco's pre-standard version of DTLS (DTLS1_BAD_VER).

Based on an original patch by David Woodhouse <dwmw2@infradead.org>
RT#3703

Reviewed-by: Tim Hudson <tjh@openssl.org>

Cleanse PKCS#8 private key components.

New function ASN1_STRING_clear_free which cleanses an ASN1_STRING
structure before freeing it.

Call ASN1_STRING_clear_free on PKCS#8 private key components.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Additional CMS documentation.

Reviewed-by: Rich Salz <rsalz@openssl.org>

ARMv4 assembly pack: add Cortex-A15 performance data.

Reviewed-by: Tim Hudson <tjh@openssl.org>

GitHub 237:  Use https for IETF links

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

make errors

Run make errors on master

Reviewed-by: Richard Levitte <levitte@openssl.org>

Update mkerr.pl for new format

Make the output from mkerr.pl consistent with the newly reformatted code.

Reviewed-by: Richard Levitte <levitte@openssl.org>

update TABLE

Reviewed-by: Rich Salz <rsalz@openssl.org>

Cleanup spaces

Reviewed-by: Rich Salz <rsalz@openssl.org>

Catch up the VMS build.

crypto/crypto-lib.com - catch up with the OCSP changes
test/maketest.com and test/tests.com - catch up with the addition of test_evp_extra

Reviewed-by: Rich Salz <rsalz@openssl.org>

Make STACK_OF opaque.

Reviewed-by: Matt Caswell <matt@openssl.org>

update ordinals

Reviewed-by: Matt Caswell <matt@openssl.org>

Make OCSP structures opaque.

Reviewed-by: Matt Caswell <matt@openssl.org>

Use constants not numbers

This patch uses warning/fatal constants instead of numbers with comments for
warning/alerts in d1_pkt.c and s3_pkt.c

RT#3725

Reviewed-by: Rich Salz <rsalz@openssl.org>

Unchecked malloc fixes

Miscellaneous unchecked malloc fixes. Also fixed some mem leaks on error
paths as I spotted them along the way.

Reviewed-by: Tim Hudson <tjh@openssl.org>

add RIPEMD160 whirlpool tests

Add RIPEMD160 and whirlpool test data.
Add Count keyword to repeatedly call EVP_DigestUpate.

Reviewed-by: Matt Caswell <matt@openssl.org>

Check public key is not NULL.

CVE-2015-0288
PR#3708

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix format script.

The format script didn't correctly recognise some ASN.1 macros and
didn't reformat some files as a result. Fix script and reformat
affected files.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Cleanup some doc files

ACKNOWLEDGEMENTS is now spelled correctly :)
README.ASN1 talked about 0.9.6, so it's deleted.
I turned doc/standards.txt into a set of one-line summaries of RFCs, and
also updated the pointers to original sources (to be web links)

Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove experimental 56bit export ciphers

These ciphers are removed:
    TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5
    TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5
    TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA
    TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA
    TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA
    TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA
    TLS1_CK_DHE_DSS_WITH_RC4_128_SHA
They were defined in a long-expired IETF internet-draft:
draft-ietf-tls-56-bit-ciphersuites-01.txt

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix d2i_SSL_SESSION for DTLS1_BAD_VER

Some Cisco appliances use a pre-standard version number for DTLS. We support
this as DTLS1_BAD_VER within the code.

This change fixes d2i_SSL_SESSION for that DTLS version.

Based on an original patch by David Woodhouse <dwmw2@infradead.org>

RT#3704

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fixed missing return value checks.

Added various missing return value checks in tls1_change_cipher_state.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix missing return value checks.

Fixed various missing return value checks in ssl3_send_newsession_ticket.
Also a mem leak on error.

Reviewed-by: Richard Levitte <levitte@openssl.org>

reformat evp_test.c

Reviewed-by: Matt Caswell <matt@openssl.org>

Add OCB support and test vectors for evp_test.

Reviewed-by: Matt Caswell <matt@openssl.org>

Skip unsupported digests in evp_test

Reviewed-by: Matt Caswell <matt@openssl.org>

add MD4 test data

Reviewed-by: Matt Caswell <matt@openssl.org>

Skip unsupported ciphers in evp_test.

Reviewed-by: Matt Caswell <matt@openssl.org>

Make OpenSSL compile with no-rc4

Reviewed-by: Matt Caswell <matt@openssl.org>

Add algorithm skip support.

Add support for skipping disabled algorithms: if an attempt to load a
public or private key results in an unknown algorithm error then any
test using that key is automatically skipped.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix evp_extra_test.c with no-ec
When OpenSSL is configured with no-ec, then the new evp_extra_test fails to
pass. This change adds appropriate OPENSSL_NO_EC guards around the code.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove NETSCAPE_HANG_BUG
NETSCAPE_HANG_BUG is a workaround for a browser bug from many years ago
(2000).
It predates DTLS, so certainly has no place in d1_srvr.c.
In s3_srvr.c it forces the ServerDone to appear in the same record as the
CertificateRequest when doing client auth.

BoringSSL have already made the same commit:
79ae85e4f777f94d91b7be19e8a62016cb55b3c5

Reviewed-by: Tim Hudson <tjh@openssl.org>

Removed support for SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG. Also removed
the "-hack" option from s_server that set this option.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Update the SHA* documentation
Updates to include SHA224, SHA256, SHA384 and SHA512. In particular note
the restriction on setting md to NULL with regards to thread safety.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix NAME section of d2i_ECPKParameters to prevent broken symlinks when using
the extract-names.pl script.

RT#3718

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix some minor documentation issues

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Remove pointless free, and use preferred way of calling d2i_* functions

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add dire warnings about the "reuse" capability of the d2i_* functions.

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Provide documentation for i2d_ECPrivateKey and d2i_ECPrivateKey

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Fix a failure to NULL a pointer freed on error.

Inspired by BoringSSL commit 517073cd4b by Eric Roman <eroman@chromium.org>

CVE-2015-0209

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Import evp_test.c from BoringSSL. Unfortunately we already have a file
called evp_test.c, so I have called this one evp_extra_test.c

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add documentation for the -no_alt_chains option for various apps, as well as
the X509_V_FLAG_NO_ALT_CHAINS flag.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

Add -no_alt_chains option to apps to implement the new
X509_V_FLAG_NO_ALT_CHAINS flag. Using this option means that when building
certificate chains, the first chain found will be the one used. Without this
flag, if the first chain found is not trusted then we will keep looking to
see if we can build an alternative chain instead.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

Add flag to inhibit checking for alternate certificate chains. Setting this
behaviour will force behaviour as per previous versions of OpenSSL

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

In certain situations the server provided certificate chain may no longer be
valid. However the issuer of the leaf, or some intermediate cert is in fact
in the trust store.

When building a trust chain if the first attempt fails, then try to see if
alternate chains could be constructed that are trusted.

RT3637
RT3621

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

Remove CVS filtering from find targets

Reviewed-by: Richard Levitte <levitte@openssl.org>

Move build config table to separate files.

Move the build configuration table into separate files.  The Configurations
file is standard configs, and Configurations.team is for openssl-team
members.  Any other file, Configurations*, found in the same directory
as the Configure script, is loaded.

To add another file, use --config=FILE flags (which should probably be
an absolute path).

Written by Stefen Eissing <stefan.eissing@greenbytes.de> and Rich Salz
<rsalz@openssl.org>, contributed by Akamai Technologies.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Document -no_explicit

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fix crash in SPARC T4 XTS.

Reviewed-by: Tim Hudson <tjh@openssl.org>

aes/asm/bsaes-armv7: fix kernel-side XTS and harmonize with Linux.

XTS bug spotted and fix suggested by Adrian Kotelba.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Don't set no_protocol if -tls1 selected.

Reviewed-by: Tim Hudson <tjh@openssl.org>

perlasm/x86masm.pl: make it work.

Though this doesn't mean that masm becomes supported, the script is
still provided on don't-ask-in-case-of-doubt-use-nasm basis.
See RT#3650 for background.

Reviewed-by: Matt Caswell <matt@openssl.org>

sha/asm/sha1-586.pl: fix typo.

The typo doesn't affect supported configuration, only unsupported masm.

Reviewed-by: Matt Caswell <matt@openssl.org>

evp/evp_test.c: avoid crashes when referencing uninitialized pointers.

For some reason failure surfaced on ARM platforms.

Reviewed-by: Matt Caswell <matt@openssl.org>

typo

Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Fix null-pointer dereference

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix memory leak

Reviewed-by: Matt Caswell <matt@openssl.org>

Avoid a double-free in an error path.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

Restore -DTERMIO/-DTERMIOS on Windows platforms.

The previous defaulting to TERMIOS took away -DTERMIOS / -DTERMIO a
bit too enthusiastically.  Windows/DOSish platforms of all sorts get
identified as OPENSSL_SYS_MSDOS, and they get a different treatment
altogether UNLESS -DTERMIO or -DTERMIOS is explicitely given with the
configuration.  The answer is to restore those macro definitions for
the affected configuration targets.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Assume TERMIOS is default, remove TERMIO on all Linux.

The rationale for this move is that TERMIOS is default, supported by
POSIX-1.2001, and most definitely on Linux.  For a few other systems,
TERMIO may still be the termnial interface of preference, so we keep
-DTERMIO on those in Configure.

crypto/ui/ui_openssl.c is simplified in this regard, and will define
TERMIOS for all systems except a select few exceptions.
Reviewed-by: Matt Caswell <matt@openssl.org>

Add additional EC documentation.

Reviewed-by: Matt Caswell <matt@openssl.org>

Use named curve parameter encoding by default.

Many applications require named curve parameter encoding instead of explicit
parameter encoding (including the TLS library in OpenSSL itself). Set this
encoding by default instead of requiring an explicit call to set it.

Add OPENSSL_EC_EXPLICT_CURVE define.
Reviewed-by: Matt Caswell <matt@openssl.org>

More RSA tests.

Reviewed-by: Andy Polyakov <appro@openssl.org>

remove unused method declaration

Reviewed-by: Richard Levitte <levitte@openssl.org>

size_t for buffer functions.

Change BUF_MEM_grow and BUF_MEM_grow_clean to return size_t.
Reviewed-by: Richard Levitte <levitte@openssl.org>

Add leak detection, fix leaks.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Add EVP_PKEY test data.

Add some EVP_PKEY test data for sign and verify tests including
failure cases.
Reviewed-by: Richard Levitte <levitte@openssl.org>

EVP_PKEY support for evp_test

Add two new keywords "PublicKey" and "PrivateKey". These will load a key
in PEM format from the lines immediately following the keyword and assign
it a name according to the value. These will be used later for public and
private key testing operations.

Add tests for Sign, Verify, VerifyRecover and Decrypt.
Reviewed-by: Richard Levitte <levitte@openssl.org>

Add CMAC test data.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Add HMAC test data.

Reviewed-by: Richard Levitte <levitte@openssl.org>

MAC support for evp_test

Reviewed-by: Richard Levitte <levitte@openssl.org>

New macro to set mac key.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Return error code is any tests fail.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Transfer a fix from 1.0.1

manually picked from e7b85bc40200961984925604ca444517359a6067
Reviewed-by: Stephen Henson <steve@openssl.org>

RT937: Enable pilotAttributeType uniqueIdentifier

Reviewed-by: Richard Levitte <levitte@openssl.org>

evp/evp.h: add missing camellia-ctr declarations.

Reviewed-by: Matt Caswell <matt@openssl.org>

RT3670: Check return from BUF_MEM_grow_clean

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3684: rand_egd needs stddef.h

And remove backup definition of offsetof.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Missing OPENSSL_free on error path.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Engage ecp_nistz256-armv4 module.

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add ec/asm/ecp_nistz256-armv4.pl module.

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add Camellia CTR mode.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Add more Camellia OIDs.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Add SSL_SESSION_get0_ticket API function.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Correct reading back of tlsext_tick_lifetime_hint from ASN1.

When writing out the hint, if the hint > 0, then we write it out otherwise
we skip it.

Previously when reading the hint back in, if were expecting to see one
(because the ticket length > 0), but it wasn't present then we set the hint
to -1, otherwise we set it to 0. This fails to set the hint to the same as
when it was written out.

The hint should never be negative because the RFC states the hint is
unsigned. It is valid for a server to set the hint to 0 (this means the
lifetime is unspecified according to the RFC). If the server set it to 0, it
should still be 0 when we read it back in.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Provide the API functions SSL_SESSION_has_ticket and
SSL_SESSION_get_ticket_lifetime_hint. The latter has been reported as
required to fix Qt for OpenSSL 1.1.0. I have also added the former in order
to determine whether a ticket is present or not - otherwise it is difficult
to know whether a zero lifetime hint is because the server set it to 0, or
because there is no ticket.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Make tlsext_tick_lifetime_hint an unsigned long (from signed long).

From RFC4507:
"The ticket_lifetime_hint field contains a hint from the server about how
long the ticket should be stored.  The value indicates the lifetime in
seconds as a 32-bit unsigned integer in network byte order."

Reviewed-by: Tim Hudson <tjh@openssl.org>

ec/ecp_nistz256.c: fix compiler warnings.

Reviewed-by: Matt Caswell <matt@openssl.org>

Configure: disable warning C4090 in Windows builds.

Reviewed-by: Matt Caswell <matt@openssl.org>

ec/asm/ecp_nistz256-x86.pl: fix typos (error shows in Windows build).

Reviewed-by: Matt Caswell <matt@openssl.org>

New evp_test updates.

Print usage message.

Print expected and got values if mismatch.
Reviewed-by: Andy Polyakov <appro@openssl.org>

Add new test file.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Initial version of new evp_test program.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Fix hostname validation in the command-line tool to honour negative return values.

Specifically, an ASN.1 NumericString in the certificate CN will fail UTF-8 conversion
and result in a negative return value, which the "x509 -checkhost" command-line option
incorrectly interpreted as success.

Also update X509_check_host docs to reflect reality.

Thanks to Sean Burford (Google) for reporting this issue.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove some functions that are no longer used and break the build with:
./config --strict-warnings enable-deprecated

Reviewed-by: Tim Hudson <tjh@openssl.org>

HMAC_cleanup, and HMAC_Init are stated as deprecated in the docs and source.
Mark them as such with OPENSSL_USE_DEPRECATED

Reviewed-by: Tim Hudson <tjh@openssl.org>