openssl.git
5 years agoRemove incorrect code inadvertently introduced through commit 59669b6ab.
Matt Caswell [Thu, 4 Dec 2014 09:22:50 +0000 (09:22 +0000)]
Remove incorrect code inadvertently introduced through commit 59669b6ab.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Conflicts:
ssl/d1_lib.c

5 years agoRemove "#if 0" code
Matt Caswell [Wed, 3 Dec 2014 09:21:09 +0000 (09:21 +0000)]
Remove "#if 0" code

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 4bb8eb9ce4f794fecf020a15b54e8505fced0edf)

5 years agoOnly use the fallback mtu after 2 unsuccessful retransmissions if it is less
Matt Caswell [Tue, 2 Dec 2014 11:16:35 +0000 (11:16 +0000)]
Only use the fallback mtu after 2 unsuccessful retransmissions if it is less
than the mtu we are already using

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 047f21593eebbc617a410a208ded01e65ca11028)

5 years agoUpdates to s_client and s_server to remove the constant 28 (for IPv4 header
Matt Caswell [Mon, 1 Dec 2014 23:57:44 +0000 (23:57 +0000)]
Updates to s_client and s_server to remove the constant 28 (for IPv4 header
and UDP header) when setting an mtu. This constant is not always correct (e.g.
if using IPv6). Use the new DTLS_CTRL functions instead.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 464ce92026bd0c79186cbefa75470f39607110be)

5 years agoIf we really get a situation where the underlying mtu is less than the minimum
Matt Caswell [Tue, 2 Dec 2014 00:16:55 +0000 (00:16 +0000)]
If we really get a situation where the underlying mtu is less than the minimum
we will support then dtls1_do_write can go into an infinite loop. This commit
fixes that.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit d3d9eef31661633f5b003a9e115c1822f79d1870)

5 years agoFix dtls_query_mtu so that it will always either complete with an mtu that is
Matt Caswell [Mon, 1 Dec 2014 22:18:18 +0000 (22:18 +0000)]
Fix dtls_query_mtu so that it will always either complete with an mtu that is
at least the minimum or it will fail.
There were some instances in dtls1_query_mtu where the final mtu can end up
being less than the minimum, i.e. where the user has set an mtu manually. This
shouldn't be allowed. Also remove dtls1_guess_mtu that, despite having
logic for guessing an mtu, was actually only ever used to work out the minimum
mtu to use.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 1620a2e49c777f31f2ce57966ae74006b48ad759)

5 years agoRemove instances in libssl of the constant 28 (for size of IPv4 header + UDP)
Matt Caswell [Mon, 1 Dec 2014 23:58:05 +0000 (23:58 +0000)]
Remove instances in libssl of the constant 28 (for size of IPv4 header + UDP)
and instead use the value provided by the underlying BIO. Also provide some
new DTLS_CTRLs so that the library user can set the mtu without needing to
know this constant. These new DTLS_CTRLs provide the capability to set the
link level mtu to be used (i.e. including this IP/UDP overhead). The previous
DTLS_CTRLs required the library user to subtract this overhead first.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 59669b6abf620d1ed2ef4d1e2df25c998b89b64d)

Conflicts:
ssl/d1_both.c
ssl/ssl_lib.c

5 years agoThere are a number of instances throughout the code where the constant 28 is
Matt Caswell [Mon, 1 Dec 2014 23:49:47 +0000 (23:49 +0000)]
There are a number of instances throughout the code where the constant 28 is
used with no explanation. Some of this was introduced as part of RT#1929. The
value 28 is the length of the IP header (20 bytes) plus the UDP header (8
bytes). However use of this constant is incorrect because there may be
instances where a different value is needed, e.g. an IPv4 header is 20 bytes
but an IPv6 header is 40. Similarly you may not be using UDP (e.g. SCTP).
This commit introduces a new BIO_CTRL that provides the value to be used for
this mtu "overhead". It will be used by subsequent commits.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 0d3ae34df573f477b6b1aaf614d52dcdfcff5fce)

Conflicts:
crypto/bio/bss_dgram.c

5 years agoThe first call to query the mtu in dtls1_do_write correctly checks that the
Matt Caswell [Mon, 1 Dec 2014 11:41:25 +0000 (11:41 +0000)]
The first call to query the mtu in dtls1_do_write correctly checks that the
mtu that we have received is not less than the minimum. If its less it uses the
minimum instead. The second call to query the mtu does not do that, but
instead uses whatever comes back. We have seen an instance in RT#3592 where we
have got an unreasonably small mtu come back. This commit makes both query
checks consistent.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 6abb0d1f8e702a0daa9c32b8021d01eda0483018)

5 years agoThe SSL_OP_NO_QUERY_MTU option is supposed to stop the mtu from being
Matt Caswell [Mon, 1 Dec 2014 11:13:15 +0000 (11:13 +0000)]
The SSL_OP_NO_QUERY_MTU option is supposed to stop the mtu from being
automatically updated, and we should use the one provided instead.
Unfortunately there are a couple of locations where this is not respected.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 001235778a6e9c645dc0507cad6092d99c9af8f5)

5 years agoVerify that we have a sensible message len and fail if not
Matt Caswell [Mon, 1 Dec 2014 11:10:38 +0000 (11:10 +0000)]
Verify that we have a sensible message len and fail if not
RT#3592 provides an instance where the OPENSSL_assert that this commit
replaces can be hit. I was able to recreate this issue by forcing the
underlying BIO to misbehave and come back with very small mtu values. This
happens the second time around the while loop after we have detected that the
MTU has been exceeded following the call to dtls1_write_bytes.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit cf75017bfd60333ff65edf9840001cd2c49870a3)

5 years agoUse the SSLv23 method by default
Kurt Roeckx [Sat, 29 Nov 2014 15:17:54 +0000 (16:17 +0100)]
Use the SSLv23 method by default

If SSLv2 and SSLv3 are both disabled we still support SSL/TLS.

Reviewed-by: Richard Levitte <levitte@openssl.org>
5 years agoCheck for FindNextFile when defining it rather than FindFirstFile
Richard Levitte [Fri, 28 Nov 2014 22:06:20 +0000 (23:06 +0100)]
Check for FindNextFile when defining it rather than FindFirstFile

Reviewed-by: Matt Caswell <matt@openssl.org>
5 years ago[PR3597] Advance to the next state variant when reusing messages.
Richard Levitte [Fri, 28 Nov 2014 19:40:10 +0000 (20:40 +0100)]
[PR3597] Advance to the next state variant when reusing messages.

Previously, state variant was not advanced, which resulted in state
being stuck in the st1 variant (usually "_A").

This broke certificate callback retry logic when accepting connections
that were using SSLv2 ClientHello (hence reusing the message), because
their state never advanced to SSL3_ST_SR_CLNT_HELLO_C variant required
for the retry code path.

Reported by Yichun Zhang (agentzh).

Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
5 years agoCorrect some layout issues, convert all remaining tabs to appropriate amounts of...
Richard Levitte [Fri, 28 Nov 2014 15:31:10 +0000 (16:31 +0100)]
Correct some layout issues, convert all remaining tabs to appropriate amounts of spaces.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 8123d158ab6f0a6a468748c133e33c2063ff36b5)

5 years agoImproves the proxy certificates howto doc.
Alok Menghrajani [Fri, 14 Nov 2014 18:39:41 +0000 (10:39 -0800)]
Improves the proxy certificates howto doc.

The current documentation contains a bunch of spelling and grammar mistakes. I also
found it hard to understand some paragraphs, so here is my attempt to improve its
readability.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 03b637a730e4a298c360cc143de7564060c06324)

5 years agoFixed warning in ssl2_enc
Matt Caswell [Thu, 27 Nov 2014 20:40:18 +0000 (20:40 +0000)]
Fixed warning in ssl2_enc

Reviewed-by: Richard Levitte <levitte@openssl.org>
5 years agoCheck EVP_Cipher return values for SSL2
Matt Caswell [Tue, 18 Nov 2014 15:03:55 +0000 (15:03 +0000)]
Check EVP_Cipher return values for SSL2

Reviewed-by: Richard Levitte <levitte@openssl.org>
5 years agoAdd checks to the return value of EVP_Cipher to prevent silent encryption failure.
Matt Caswell [Tue, 18 Nov 2014 12:56:26 +0000 (12:56 +0000)]
Add checks to the return value of EVP_Cipher to prevent silent encryption failure.

PR#1767

Reviewed-by: Richard Levitte <levitte@openssl.org>
5 years agoRemove redundant checks in ssl_cert_dup. This was causing spurious error messages...
Matt Caswell [Thu, 27 Nov 2014 11:06:43 +0000 (11:06 +0000)]
Remove redundant checks in ssl_cert_dup. This was causing spurious error messages when using GOST

PR#3613

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit fc3968a25ce0c16cab8730ec0d68a59856158029)

5 years agoRemove duplicated code
Matt Caswell [Mon, 17 Nov 2014 14:22:10 +0000 (14:22 +0000)]
Remove duplicated code

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
5 years agoTidy up ocsp help output
Matt Caswell [Thu, 27 Nov 2014 10:15:47 +0000 (10:15 +0000)]
Tidy up ocsp help output

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 5e31a40f47c6bfd09c718d2af42ba8d8fe6bb932)

Conflicts:
apps/ocsp.c

(cherry picked from commit e16458269036f4334525009906d346f68a73b2a4)

5 years agoAdd documentation on -timeout option in the ocsp utility
André Guerreiro [Thu, 27 Nov 2014 10:11:33 +0000 (10:11 +0000)]
Add documentation on -timeout option in the ocsp utility

PR#3612

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit de87dd46c1283f899a9ecf4ccc72db74f36afbf2)
(cherry picked from commit 4d3df37bc7fd33d0bec5da04d2572caa0cdbab75)

5 years agoNetWare compilation fix.
Guenter [Thu, 27 Nov 2014 13:33:47 +0000 (13:33 +0000)]
NetWare compilation fix.

Workaround for NetWare CodeWarrior compiler which doesn't properly lookup
includes when in same directory as the C file which includes it.

PR#3569
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit 333fad9f2de1dea99552fcb424b312ca1a390f85)

5 years agoUpdates to X509_NAME_get_index_by_NID.pod submitted by user Bernardh via the wiki
Matt Caswell [Fri, 12 Sep 2014 05:00:26 +0000 (01:00 -0400)]
Updates to X509_NAME_get_index_by_NID.pod submitted by user Bernardh via the wiki
Minor changes made by Matt Caswell

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 648495864513da788246f9b75dbbbce0614ed5e8)

5 years agoUpdates to X509_NAME_add_entry_by_txt.pod submitted by user Bernardh via the wiki
Matt Caswell [Sat, 6 Sep 2014 22:48:54 +0000 (23:48 +0100)]
Updates to X509_NAME_add_entry_by_txt.pod submitted by user Bernardh via the wiki
Minor changes made by Matt Caswell.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit f281b8df704ce0123fa2193f2890a25da1756528)

5 years agoUpdates to EVP_PKEY_encrypt.pod submitted by user Bernardh via the wiki
Matt Caswell [Sat, 6 Sep 2014 22:47:55 +0000 (23:47 +0100)]
Updates to EVP_PKEY_encrypt.pod submitted by user Bernardh via the wiki
Minor changes made by Matt Caswell.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 34890ac18eb5ee7bffe9d460480164e1546b491e)

5 years agoAdd include of ssl.h which is required by srtp.h
Matt Caswell [Thu, 27 Nov 2014 12:25:18 +0000 (12:25 +0000)]
Add include of ssl.h which is required by srtp.h

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit f67203836cd4a35c1774b6147e0f2d33eb7b1b6f)

5 years agoFixed memory leak due to incorrect freeing of DTLS reassembly bit mask
Matt Caswell [Tue, 25 Nov 2014 13:36:00 +0000 (13:36 +0000)]
Fixed memory leak due to incorrect freeing of DTLS reassembly bit mask

PR#3608

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 8a35dbb6d89a16d792b79b157b3e89443639ec94)

5 years agoCorrected comments in ssl.h about SSLv23_method and friends
Matt Caswell [Tue, 25 Nov 2014 17:23:24 +0000 (17:23 +0000)]
Corrected comments in ssl.h about SSLv23_method and friends

PR#3574

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 3a0765882c4b3b67960b7efb203570764dd4ed29)

5 years agoDo not resume a session if the negotiated protocol version does not match
David Benjamin [Thu, 20 Nov 2014 15:22:40 +0000 (16:22 +0100)]
Do not resume a session if the negotiated protocol version does not match
the session's version (server).

See also BoringSSL's commit bdf5e72f50e25f0e45e825c156168766d8442dde.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 9e189b9dc10786c755919e6792e923c584c918a1)

5 years agoEnsure SSL3_FLAGS_CCS_OK (or d1->change_cipher_spec_ok for DTLS) is reset
Emilia Kasper [Wed, 19 Nov 2014 16:01:36 +0000 (17:01 +0100)]
Ensure SSL3_FLAGS_CCS_OK (or d1->change_cipher_spec_ok for DTLS) is reset
once the ChangeCipherSpec message is received. Previously, the server would
set the flag once at SSL3_ST_SR_CERT_VRFY and again at SSL3_ST_SR_FINISHED.
This would allow a second CCS to arrive and would corrupt the server state.

(Because the first CCS would latch the correct keys and subsequent CCS
messages would have to be encrypted, a MitM attacker cannot exploit this,
though.)

Thanks to Joeri de Ruiter for reporting this issue.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit e94a6c0ede623960728415b68650a595e48f5a43)

Conflicts:
CHANGES
ssl/s3_srvr.c

5 years agoAlways require an advertised NewSessionTicket message.
Emilia Kasper [Wed, 19 Nov 2014 15:40:27 +0000 (16:40 +0100)]
Always require an advertised NewSessionTicket message.

The server must send a NewSessionTicket message if it advertised one
in the ServerHello, so make a missing ticket message an alert
in the client.

An equivalent change was independently made in BoringSSL, see commit
6444287806d801b9a45baf1f6f02a0e3a16e144c.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit de2c7504ebd4ec15334ae151a31917753468f86f)

Conflicts:
CHANGES

5 years agoRemove ssl3_check_finished.
Emilia Kasper [Wed, 19 Nov 2014 15:28:11 +0000 (16:28 +0100)]
Remove ssl3_check_finished.

The client sends a session ID with the session ticket, and uses
the returned ID to detect resumption, so we do not need to peek
at handshake messages: s->hit tells us explicitly if we're resuming.

An equivalent change was independently made in BoringSSL, see commit
407886f589cf2dbaed82db0a44173036c3bc3317.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 980bc1ec6114f5511b20c2e6ca741e61a39b99d6)

Conflicts:
ssl/d1_clnt.c
ssl/s3_clnt.c

5 years agoSet s->hit when resuming from external pre-shared secret.
Emilia Kasper [Wed, 19 Nov 2014 14:56:27 +0000 (15:56 +0100)]
Set s->hit when resuming from external pre-shared secret.

The same change was independently made in BoringSSL, see commit
9eaeef81fa2d4fd6246dc02b6203fa936a5eaf67

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 7b3ba508af5c86afe43e28174aa3c53a0a24f4d9)

5 years agoReset s->tlsext_ticket_expected in ssl_scan_serverhello_tlsext.
Emilia Kasper [Wed, 19 Nov 2014 14:42:43 +0000 (15:42 +0100)]
Reset s->tlsext_ticket_expected in ssl_scan_serverhello_tlsext.
This ensures that it's zeroed even if the SSL object is reused
(as in ssltest.c). It also ensures that it applies to DTLS, too.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit a06cd5d056c6a5b1d161786873e21a5e53d554d8)

5 years agoNew option no-ssl3-method which removes SSLv3_*method
Dr. Stephen Henson [Wed, 29 Oct 2014 12:51:31 +0000 (12:51 +0000)]
New option no-ssl3-method which removes SSLv3_*method

When no-ssl3 is set only make SSLv3 disabled by default. Retain -ssl3
options for s_client/s_server/ssltest.

When no-ssl3-method is set SSLv3_*method() is removed and all -ssl3
options.

We should document this somewhere, e.g. wiki, FAQ or manual page.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 3881d8106df732fc433d30446625dfa2396da42d)

Conflicts:
util/mkdef.pl

5 years agoAdded OPENSSL_NO_EC2M guards around the preferred EC curve list
Matt Caswell [Mon, 10 Nov 2014 23:42:50 +0000 (23:42 +0000)]
Added OPENSSL_NO_EC2M guards around the preferred EC curve list

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
5 years agoDon't use msg on error.
Jan Hykel [Sun, 16 Nov 2014 16:51:17 +0000 (16:51 +0000)]
Don't use msg on error.

Don't attempt to access msg structure if recvmsg returns an error.

PR#3483
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 012aa9ec76b158179b4de44bb5de8b8472045eac)

5 years agoFix cross reference table generator.
Dr. Stephen Henson [Sat, 1 Nov 2014 00:10:56 +0000 (00:10 +0000)]
Fix cross reference table generator.

If the hash or public key algorithm is "undef" the signature type
will receive special handling and shouldn't be included in the
cross reference table.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 55f7fb8848b6e4bec291724a479e1580d6f407d6)

5 years agoFixes a minor typo in the EVP docs.
Alok Menghrajani [Tue, 11 Nov 2014 22:39:11 +0000 (14:39 -0800)]
Fixes a minor typo in the EVP docs.

Out is the buffer which needs to contain at least inl + cipher_block_size - 1 bytes. Outl
is just an int*.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 5211e094dec9486a540ac480f345df1a8d2b2862)

5 years agoCorrect timestamp output when clock_precision_digits > 0
Michal Bozon [Wed, 12 Nov 2014 15:59:04 +0000 (15:59 +0000)]
Correct timestamp output when clock_precision_digits > 0

PR#3535

Reviewed-by: Stephen Henson <steve@openssl.org>
5 years agoFix free of garbage pointer. PR#3595
Matt Caswell [Wed, 12 Nov 2014 11:18:09 +0000 (11:18 +0000)]
Fix free of garbage pointer. PR#3595

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit e04d426bf98ebb22abf0f15b6f09d333a6e8b2ad)

5 years agoFix warning about negative unsigned intergers
Kurt Roeckx [Mon, 10 Nov 2014 18:03:03 +0000 (19:03 +0100)]
Fix warning about negative unsigned intergers

Reviewed-by: Richard Levitte <levitte@openssl.org>
5 years agoFix datarace reported by valgrind/helgrind
Russell Coker [Thu, 25 Jun 2009 05:59:32 +0000 (15:59 +1000)]
Fix datarace reported by valgrind/helgrind

This doesn't really fix the datarace but changes it so it can only happens
once. This isn't really a problem since we always just set it to the same
value. We now just stop writing it after the first time.

PR3584, https://bugs.debian.org/534534

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
5 years agomd32_common.h: address compiler warning in HOST_c2l.
Andy Polyakov [Wed, 29 Oct 2014 09:48:39 +0000 (10:48 +0100)]
md32_common.h: address compiler warning in HOST_c2l.

Reviewed-by: Stephen Henson <steve@openssl.org>
(cherry picked from commit d45282fc7cd9b97ed1479f8b8af713337fce57f5)

5 years agoUse only unsigned arithmetic in constant-time operations
Samuel Neves [Fri, 3 Oct 2014 23:13:36 +0000 (00:13 +0100)]
Use only unsigned arithmetic in constant-time operations

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
5 years agoTighten session ticket handling
Emilia Kasper [Tue, 28 Oct 2014 16:35:59 +0000 (17:35 +0100)]
Tighten session ticket handling

Tighten client-side session ticket handling during renegotiation:
ensure that the client only accepts a session ticket if the server sends
the extension anew in the ServerHello. Previously, a TLS client would
reuse the old extension state and thus accept a session ticket if one was
announced in the initial ServerHello.

Reviewed-by: Bodo Moeller <bodo@openssl.org>
(cherry picked from commit d663df2399d1d9d6015bcfd2ec87b925ea3558a2)

Conflicts:
CHANGES

5 years agoFix ssltest logic when some protocols are compiled out.
Emilia Kasper [Mon, 27 Oct 2014 15:25:17 +0000 (16:25 +0100)]
Fix ssltest logic when some protocols are compiled out.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
(cherry picked from commit fd28a41ec899eb8749e21d11441fd4df35ed9a07)

Conflicts:
ssl/ssltest.c

5 years agoFix and improve SSL_MODE_SEND_FALLBACK_SCSV documentation.
Bodo Moeller [Tue, 21 Oct 2014 20:40:41 +0000 (22:40 +0200)]
Fix and improve SSL_MODE_SEND_FALLBACK_SCSV documentation.

Reviewed-by: Rich Salz <rsalz@openssl.org>
5 years agoWhen processing ClientHello.cipher_suites, don't ignore cipher suites
Bodo Moeller [Tue, 21 Oct 2014 20:32:30 +0000 (22:32 +0200)]
When processing ClientHello.cipher_suites, don't ignore cipher suites
listed after TLS_FALLBACK_SCSV.

RT: 3575
Reviewed-by: Emilia Kasper <emilia@openssl.org>
5 years agoKeep old method in case of an unsupported protocol
Kurt Roeckx [Tue, 21 Oct 2014 18:45:15 +0000 (20:45 +0200)]
Keep old method in case of an unsupported protocol

When we're configured with no-ssl3 and we receive an SSL v3 Client Hello, we set
the method to NULL.  We didn't used to do that, and it breaks things.  This is a
regression introduced in 62f45cc27d07187b59551e4fad3db4e52ea73f2c.  Keep the old
method since the code is not able to deal with a NULL method at this time.

CVE-2014-3569, PR#3571

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 392fa7a952e97d82eac6958c81ed1e256e6b8ca5)

5 years agono-ssl2 with no-ssl3 does not mean drop the ssl lib
Tim Hudson [Mon, 20 Oct 2014 05:12:17 +0000 (15:12 +1000)]
no-ssl2 with no-ssl3 does not mean drop the ssl lib

Reviewed-by: Geoff Thorpe <geoff@openssl.org>
(cherry picked from commit c882abd52269a59ed8e0510e5febf667428ece85)

5 years agoe_os.h: refine inline override logic (to address warnings in debug build).
Andy Polyakov [Tue, 30 Sep 2014 19:05:33 +0000 (21:05 +0200)]
e_os.h: refine inline override logic (to address warnings in debug build).

Reviewed-by: Dr Stephen Henson <steve@openssl.org>
(cherry picked from commit 55c7a4cf112bf154ed405ee05a6b7924b6b1ba92)

5 years agoe_os.h: allow inline functions to be compiled by legacy compilers.
Andy Polyakov [Wed, 24 Sep 2014 22:32:56 +0000 (00:32 +0200)]
e_os.h: allow inline functions to be compiled by legacy compilers.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 40155f408985aff2e9f1b61b7cb04a3e518633a1)

5 years agoRT3547: Add missing static qualifier
Kurt Cancemi [Sun, 28 Sep 2014 19:28:49 +0000 (15:28 -0400)]
RT3547: Add missing static qualifier

Reviewed-by: Ben Laurie <ben@openssl.org>
(cherry picked from commit 87d388c955c14a7c1371f9c7555fb429a406a3d3)

5 years agoPrepare for 1.0.1k-dev
Matt Caswell [Wed, 15 Oct 2014 12:55:20 +0000 (13:55 +0100)]
Prepare for 1.0.1k-dev

Reviewed-by: Stephen Henson <steve@openssl.org>
5 years agoPrepare for 1.0.1j release OpenSSL_1_0_1j
Matt Caswell [Wed, 15 Oct 2014 12:54:46 +0000 (13:54 +0100)]
Prepare for 1.0.1j release

Reviewed-by: Stephen Henson <steve@openssl.org>
5 years agoUpdates to NEWS
Matt Caswell [Wed, 15 Oct 2014 11:27:03 +0000 (12:27 +0100)]
Updates to NEWS

Reviewed-by: Dr Stephen Henson <steve@openssl.org>
5 years agoAdd updates to CHANGES file
Matt Caswell [Wed, 15 Oct 2014 09:40:29 +0000 (10:40 +0100)]
Add updates to CHANGES file

Reviewed-by: Bodo Möller <bodo@openssl.org>
5 years agoFix no-ssl3 configuration option
Geoff Thorpe [Wed, 15 Oct 2014 07:25:50 +0000 (03:25 -0400)]
Fix no-ssl3 configuration option

CVE-2014-3568

Reviewed-by: Emilia Kasper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
5 years agoFix for session tickets memory leak.
Dr. Stephen Henson [Wed, 15 Oct 2014 00:53:55 +0000 (01:53 +0100)]
Fix for session tickets memory leak.

CVE-2014-3567

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 5dc6070a03779cd524f0e67f76c945cb0ac38320)

5 years agoFix SRTP compile issues for windows
Matt Caswell [Wed, 15 Oct 2014 00:23:07 +0000 (01:23 +0100)]
Fix SRTP compile issues for windows

Related to CVE-2014-3513

This fix was developed by the OpenSSL Team

Reviewed-by: Tim Hudson <tjh@openssl.org>
5 years agoFix for SRTP Memory Leak
Matt Caswell [Wed, 15 Oct 2014 00:20:38 +0000 (01:20 +0100)]
Fix for SRTP Memory Leak

CVE-2014-3513

This issue was reported to OpenSSL on 26th September 2014, based on an origi
issue and patch developed by the LibreSSL project. Further analysis of the i
was performed by the OpenSSL team.

The fix was developed by the OpenSSL team.

Reviewed-by: Tim Hudson <tjh@openssl.org>
5 years agoFix SSL_R naming inconsistency.
Bodo Moeller [Wed, 15 Oct 2014 12:47:39 +0000 (14:47 +0200)]
Fix SSL_R naming inconsistency.

Reviewed-by: Tim Hudson <tjh@openssl.org>
5 years agoaesni-x86_64.pl: make ECB subroutine Windows ABI compliant.
Andy Polyakov [Wed, 15 Oct 2014 09:10:08 +0000 (11:10 +0200)]
aesni-x86_64.pl: make ECB subroutine Windows ABI compliant.

RT: 3553
Reviewed-by: Emilia Kasper <emilia@openssl.org>
(cherry picked from commit 69d5747f90136aa026a96204f26ab39549dfc69b)

5 years agoAdd constant_time_locl.h to HEADERS,
Tim Hudson [Thu, 25 Sep 2014 06:04:35 +0000 (08:04 +0200)]
Add constant_time_locl.h to HEADERS,
so the Win32 compile picks it up correctly.

Reviewed-by: Richard Levitte <levitte@openssl.org>
5 years agoAdd the constant time test to the VMS build and tests
Richard Levitte [Thu, 25 Sep 2014 04:47:23 +0000 (06:47 +0200)]
Add the constant time test to the VMS build and tests

Reviewed-by: Tim Hudson <tjh@openssl.org>
Conflicts:
test/maketests.com
test/tests.com

5 years agoInclude "constant_time_locl.h" rather than "../constant_time_locl.h".
Richard Levitte [Wed, 24 Sep 2014 20:59:37 +0000 (22:59 +0200)]
Include "constant_time_locl.h" rather than "../constant_time_locl.h".
The different -I compiler parameters will take care of the rest...

Reviewed-by: Tim Hudson <tjh@openssl.org>
5 years agoSpaces were added in some strings for better readability. However, those spaces do...
Richard Levitte [Mon, 16 Jun 2014 11:24:04 +0000 (13:24 +0200)]
Spaces were added in some strings for better readability. However, those spaces do not belong in file names, so when picking out the individual parts, remove the spaces

Reviewed-by: Tim Hudson <tjh@openssl.org>
5 years agoAdjust VMS build to Unix build. Most of all, make it so the disabled
Richard Levitte [Wed, 6 Aug 2014 02:37:27 +0000 (04:37 +0200)]
Adjust VMS build to Unix build.  Most of all, make it so the disabled
algorithms MD2 and RC5 don't get built.
Also, disable building the test apps in crypto/des and crypto/pkcs7, as
they have no support at all.

Reviewed-by: Tim Hudson <tjh@openssl.org>
5 years agoMake sure test/tests.com exit gracefully, even when openssl.exe wasn't properly built.
Richard Levitte [Wed, 18 Jun 2014 11:41:54 +0000 (13:41 +0200)]
Make sure test/tests.com exit gracefully, even when openssl.exe wasn't properly built.

Reviewed-by: Tim Hudson <tjh@openssl.org>
5 years agoUpdate the VMS build according to the latest unixly build. Partly provided by Zoltan...
Richard Levitte [Wed, 6 Aug 2014 01:54:57 +0000 (03:54 +0200)]
Update the VMS build according to the latest unixly build. Partly provided by Zoltan Arpadffy <arpadffy@polarhome.com>

Reviewed-by: Tim Hudson <tjh@openssl.org>
5 years agoMake sure that disabling the MAYLOSEDATA3 warning is only done when the compiler...
Richard Levitte [Sat, 14 Jun 2014 13:13:44 +0000 (15:13 +0200)]
Make sure that disabling the MAYLOSEDATA3 warning is only done when the compiler supports it. Otherwise, there are warnings about it lacking everywhere, which is quite tedious to read through while trying to check for other warnings.

Reviewed-by: Tim Hudson <tjh@openssl.org>
5 years agoSupport TLS_FALLBACK_SCSV.
Bodo Moeller [Wed, 15 Oct 2014 02:05:42 +0000 (04:05 +0200)]
Support TLS_FALLBACK_SCSV.

Reviewed-by: Rich Salz <rsalz@openssl.org>
5 years agoPreserve digests for SNI.
Dr. Stephen Henson [Fri, 10 Oct 2014 12:18:09 +0000 (13:18 +0100)]
Preserve digests for SNI.

SSL_set_SSL_CTX is normally called for SNI after ClientHello has
received and the digest to use for each certificate has been decided.
The original ssl->cert contains the negotiated digests and is now
copied to the new ssl->cert.

PR: 3560
Reviewed-by: Tim Hudson <tjh@openssl.org>
5 years agoRemoved duplicate definition of PKCS7_type_is_encrypted
Matt Caswell [Fri, 3 Oct 2014 22:48:49 +0000 (23:48 +0100)]
Removed duplicate definition of PKCS7_type_is_encrypted

Patch supplied by Matthieu Patou <mat@matws.net>, and modified to also
remove duplicate definition of PKCS7_type_is_digest.

PR#3551

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit e0fdea3e49e7454aa76bd5ecf3a3747641354c68)

5 years agoAdd additional DigestInfo checks.
Dr. Stephen Henson [Thu, 25 Sep 2014 22:28:48 +0000 (23:28 +0100)]
Add additional DigestInfo checks.

Reencode DigestInto in DER and check against the original: this
will reject any improperly encoded DigestInfo structures.

Note: this is a precautionary measure, there is no known attack
which can exploit this.

Thanks to Brian Smith for reporting this issue.
Reviewed-by: Tim Hudson <tjh@openssl.org>
5 years agoAdd missing tests
Emilia Kasper [Thu, 25 Sep 2014 11:39:21 +0000 (13:39 +0200)]
Add missing tests

Accidentally omitted from commit 455b65dfab0de51c9f67b3c909311770f2b3f801

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit fdc35a9d3e8cf4cfd9330d5df9883f42cf5648ad)

5 years agoUse correct function name: CMS_add1_signer()
Dr. Stephen Henson [Sat, 20 Sep 2014 00:00:55 +0000 (01:00 +0100)]
Use correct function name: CMS_add1_signer()

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 5886354dcca4f8445ed35b6995a035b75409590c)

5 years agocrypto/bn/bn_nist.c: work around MSC ARM compiler bug.
Andy Polyakov [Wed, 24 Sep 2014 22:42:26 +0000 (00:42 +0200)]
crypto/bn/bn_nist.c: work around MSC ARM compiler bug.

RT: 3541
Reviewed-by: Emilia Kasper <emilia@openssl.org>
(cherry picked from commit 8b07c005fe006044d0e4a795421447deca3c9f2c)

5 years agoRT3425: constant-time evp_enc
Emilia Kasper [Fri, 5 Sep 2014 12:47:33 +0000 (14:47 +0200)]
RT3425: constant-time evp_enc

Do the final padding check in EVP_DecryptFinal_ex in constant time to
avoid a timing leak from padding failure.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 4aac102f75b517bdb56b1bcfd0a856052d559f6e)

Conflicts:
crypto/evp/evp_enc.c

(cherry picked from commit 738911cde68b2b3706e502cf8daf5b14738f2f42)

5 years agoRT3067: simplify patch
Emilia Kasper [Thu, 4 Sep 2014 11:04:42 +0000 (13:04 +0200)]
RT3067: simplify patch

(Original commit adb46dbc6dd7347750df2468c93e8c34bcb93a4b)

Use the new constant-time methods consistently in s3_srvr.c

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit 455b65dfab0de51c9f67b3c909311770f2b3f801)

5 years agoThis change alters the processing of invalid, RSA pre-master secrets so
Adam Langley [Wed, 24 Apr 2013 18:45:44 +0000 (14:45 -0400)]
This change alters the processing of invalid, RSA pre-master secrets so
that bad encryptions are treated like random session keys in constant
time.

(cherry picked from commit adb46dbc6dd7347750df2468c93e8c34bcb93a4b)

Reviewed-by: Rich Salz <rsalz@openssl.org>
5 years agoRT3066: rewrite RSA padding checks to be slightly more constant time.
Emilia Kasper [Thu, 28 Aug 2014 17:43:49 +0000 (19:43 +0200)]
RT3066: rewrite RSA padding checks to be slightly more constant time.

Also tweak s3_cbc.c to use new constant-time methods.
Also fix memory leaks from internal errors in RSA_padding_check_PKCS1_OAEP_mgf1

This patch is based on the original RT submission by Adam Langley <agl@chromium.org>,
as well as code from BoringSSL and OpenSSL.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Conflicts:
crypto/rsa/rsa_oaep.c

5 years agoFixed error introduced in commit f2be92b94dad3c6cbdf79d99a324804094cf1617
Tim Hudson [Sun, 21 Sep 2014 11:54:31 +0000 (21:54 +1000)]
Fixed error introduced in commit f2be92b94dad3c6cbdf79d99a324804094cf1617
that fixed PR#3450 where an existing cast masked an issue when i was changed
from int to long in that commit

Picked up on z/linux (s390) where sizeof(int)!=sizeof(long)

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit b5ff559ff90124c6fd53bbb49dae5edb4e821e0a)

5 years agoRT2560: missing NULL check in ocsp_req_find_signer
Rich Salz [Wed, 10 Sep 2014 15:43:45 +0000 (11:43 -0400)]
RT2560: missing NULL check in ocsp_req_find_signer

If we don't find a signer in the internal list, then fall
through and look at the internal list; don't just return NULL.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit b2aa38a980e9fbf158aafe487fb729c492b241fb)

5 years agoRT3301: Discard too-long heartbeat requests
Erik Auerswald [Wed, 27 Aug 2014 02:50:34 +0000 (22:50 -0400)]
RT3301: Discard too-long heartbeat requests

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit af4c6e348e4bad6303e7d214cdcf2536487aabe4)

5 years agopsk_client_callback, 128-byte id bug.
Adam Langley [Fri, 20 Jun 2014 19:00:00 +0000 (12:00 -0700)]
psk_client_callback, 128-byte id bug.

Fix a bug in handling of 128 byte long PSK identity in
psk_client_callback.

OpenSSL supports PSK identities of up to (and including) 128 bytes in
length. PSK identity is obtained via the psk_client_callback,
implementors of which are expected to provide a NULL-terminated
identity. However, the callback is invoked with only 128 bytes of
storage thus making it impossible to return a 128 byte long identity and
the required additional NULL byte.

This CL fixes the issue by passing in a 129 byte long buffer into the
psk_client_callback. As a safety precaution, this CL also zeroes out the
buffer before passing it into the callback, uses strnlen for obtaining
the length of the identity returned by the callback, and aborts the
handshake if the identity (without the NULL terminator) is longer than
128 bytes.

(Original patch amended to achieve strnlen in a different way.)

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit be0d851732bad7370640702bc9c4a33189ede287)

5 years agoEnsure that x**0 mod 1 = 0.
Adam Langley [Tue, 23 Apr 2013 16:13:51 +0000 (12:13 -0400)]
Ensure that x**0 mod 1 = 0.

(cherry picked from commit 2b0180c37fa6ffc48ee40caa831ca398b828e680)

Reviewed-by: Ben Laurie <ben@openssl.org>
5 years agoFollowup on RT3334 fix: make sure that a directory that's the empty
Richard Levitte [Thu, 14 Aug 2014 23:24:34 +0000 (01:24 +0200)]
Followup on RT3334 fix: make sure that a directory that's the empty
string returns 0 with errno = ENOENT.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 360928b7d0f16dde70e26841bbf9e1af727e8b8f)

5 years agoRT3334: Fix crypto/LPdir_win.c
Phil Mesnier [Thu, 14 Aug 2014 17:35:07 +0000 (19:35 +0200)]
RT3334: Fix crypto/LPdir_win.c

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 6a14fe7576e7a14a46ba14df8be8fe478536b4fb)

5 years agoMake the inline const-time functions static.
Emilia Kasper [Thu, 28 Aug 2014 17:45:55 +0000 (19:45 +0200)]
Make the inline const-time functions static.

"inline" without static is not correct as the compiler may choose to ignore it
and will then either emit an external definition, or expect one.

Reviewed-by: Geoff Thorpe <geoff@openssl.org>
(cherry picked from commit 86f50b36e63275a916b147f9d8764e3c0c060fdb)

5 years agomd5-x86_64.pl: work around warning.
Andy Polyakov [Sat, 30 Aug 2014 17:17:09 +0000 (19:17 +0200)]
md5-x86_64.pl: work around warning.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 4d86e8df6be69ed13abb73fd564f1f894eea0a98)

5 years agoAdd tags/TAGS
Rich Salz [Mon, 14 Jul 2014 15:27:16 +0000 (11:27 -0400)]
Add tags/TAGS

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 9d6253cfd3395dfe7147dae134579c6b16544c53)

5 years agoRT2119,3407: Updated to dgst.pod
Rich Salz [Thu, 28 Aug 2014 23:11:42 +0000 (19:11 -0400)]
RT2119,3407: Updated to dgst.pod

Re-order algorithm list.
Be consistent in command synopsis.
Add content about signing.
Add EXAMPLE section
Add some missing options: -r, -fips-fingerprint -non-fips-allow
Various other fixes.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 6aa9dbab0f9b90060b7ee609b8c3c726ce4faf21)

5 years agoRT1941: c_rehash.pod is missing
James Westby [Thu, 14 Aug 2014 14:14:35 +0000 (10:14 -0400)]
RT1941: c_rehash.pod is missing

Add the file written by James Westby, graciously contributed
under the terms of the OpenSSL license.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit cf2239b3b397174a8a6b1cc84ff68aba34ed5941)

5 years agoRT2379: Bug in BIO_set_accept_port.pod
Rich Salz [Mon, 18 Aug 2014 17:00:51 +0000 (13:00 -0400)]
RT2379: Bug in BIO_set_accept_port.pod

The doc says that port can be "*" to mean any port.
That's wrong.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 07e3b31fae98b985d3d2aad7066144b11833f688)

5 years agoConstant-time utilities
Emilia Kasper [Thu, 28 Aug 2014 13:33:34 +0000 (15:33 +0200)]
Constant-time utilities

Pull constant-time methods out to a separate header, add tests.

Reviewed-by: Bodo Moeller <bodo@openssl.org>
(cherry picked from commit 9a9b0c0401cae443f115ff19921d347b20aa396b)

Conflicts:
test/Makefile

5 years agoRT2400: ASN1_STRING_to_UTF8 missing initializer
Raphael Spreitzer [Thu, 28 Aug 2014 02:53:10 +0000 (22:53 -0400)]
RT2400: ASN1_STRING_to_UTF8 missing initializer

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit f9fb43e176ad2a914108cd2b403425dc1ebc7262)