openssl.git
5 years agoFix for CVE-2014-0224
Dr. Stephen Henson [Fri, 16 May 2014 11:49:48 +0000 (12:49 +0100)]
Fix for CVE-2014-0224

Only accept change cipher spec when it is expected instead of at any
time. This prevents premature setting of session keys before the master
secret is determined which an attacker could use as a MITM attack.

Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for reporting this issue
and providing the initial fix this patch is based on.

5 years agoFix for CVE-2014-0195
Dr. Stephen Henson [Tue, 13 May 2014 17:48:31 +0000 (18:48 +0100)]
Fix for CVE-2014-0195

A buffer overrun attack can be triggered by sending invalid DTLS fragments
to an OpenSSL DTLS client or server. This is potentially exploitable to
run arbitrary code on a vulnerable client or server.

Fixed by adding consistency check for DTLS fragments.

Thanks to Jüri Aedla for reporting this issue.

5 years agoFree up s->d1->buffered_app_data.q properly.
zhu qun-ying [Mon, 2 Jun 2014 13:38:52 +0000 (14:38 +0100)]
Free up s->d1->buffered_app_data.q properly.

PR#3286
(cherry picked from commit 71e95000afb2227fe5cac1c79ae884338bcd8d0b)

5 years agoecdsa.pod: typo.
Andy Polyakov [Wed, 11 Jan 2012 21:42:20 +0000 (21:42 +0000)]
ecdsa.pod: typo.
PR: 2678
Submitted by: Annie Yousar
(cherry picked from commit d572544a2cccc9dad7afcef24de11232e5506c99)

5 years agoTypo: set i to -1 before goto.
Sami Farin [Mon, 2 Jun 2014 11:24:19 +0000 (12:24 +0100)]
Typo: set i to -1 before goto.

PR#3302
(cherry picked from commit 9717f01951f976f76dd40a38d9fc7307057fa4c4)

5 years agoSet default global mask to UTF8 only.
Dr. Stephen Henson [Sun, 1 Jun 2014 14:03:00 +0000 (15:03 +0100)]
Set default global mask to UTF8 only.
(cherry picked from commit 3009244da47b989c4cc59ba02cf81a4e9d8f8431)

5 years agoAllocate extra space when NETSCAPE_HANG_BUG defined.
David Ramos [Sun, 1 Jun 2014 13:30:10 +0000 (14:30 +0100)]
Allocate extra space when NETSCAPE_HANG_BUG defined.

Make sure there is an extra 4 bytes for server done message when
NETSCAPE_HANG_BUG is defined.

PR#3361
(cherry picked from commit 673c42b2380c34e7500f05e7f00c674cc677a065)

5 years agoFix signed/unsigned warning.
Ben Laurie [Mon, 19 May 2014 17:20:54 +0000 (18:20 +0100)]
Fix signed/unsigned warning.
(cherry picked from commit 989d87cb1a174a951efd829ff6b2f68a322f9df8)

5 years agoSet version number correctly.
Dr. Stephen Henson [Thu, 29 May 2014 13:07:49 +0000 (14:07 +0100)]
Set version number correctly.

PR#3249
(cherry picked from commit 8909bf20269035d295743fca559207ef2eb84eb3)

5 years agoFix memory leak.
František Bořánek [Thu, 29 May 2014 12:49:10 +0000 (13:49 +0100)]
Fix memory leak.

PR#3278
(cherry picked from commit de56fe797081fc09ebd1add06d6e2df42a324fd5)

5 years agoFix for test_bn regular expression to work on Windows using MSYS. PR#3346
Peter Mosmans [Tue, 27 May 2014 22:26:11 +0000 (23:26 +0100)]
Fix for test_bn regular expression to work on Windows using MSYS. PR#3346

5 years agoFixed error in args for SSL_set_msg_callback and SSL_set_msg_callback_arg
Matt Caswell [Sun, 25 May 2014 22:37:53 +0000 (23:37 +0100)]
Fixed error in args for SSL_set_msg_callback and SSL_set_msg_callback_arg

5 years agoFix for non compilation with TLS_DEBUG defined
Matt Caswell [Sat, 24 May 2014 22:55:27 +0000 (23:55 +0100)]
Fix for non compilation with TLS_DEBUG defined

5 years agoFix for PKCS12_create if no-rc2 specified.
Dr. Stephen Henson [Wed, 21 May 2014 09:50:19 +0000 (10:50 +0100)]
Fix for PKCS12_create if no-rc2 specified.

Use triple DES for certificate encryption if no-rc2 is
specified.

PR#3357
(cherry picked from commit 03b5b78c09fb10839a565f341cdc527c675e89ce)

5 years agoChange default cipher in smime app to des3.
Dr. Stephen Henson [Wed, 21 May 2014 09:39:11 +0000 (10:39 +0100)]
Change default cipher in smime app to des3.

PR#3357
(cherry picked from commit ca3ffd9670f2b589bf8cc04923f953e06d6fbc58)

Conflicts:

doc/apps/smime.pod

5 years agoRemoved note in BUGS section about AEAD ciphers - inadvertently added to wrong branch
Matt Caswell [Thu, 15 May 2014 20:19:46 +0000 (21:19 +0100)]
Removed note in BUGS section about AEAD ciphers - inadvertently added to wrong branch

5 years agoFix grammar error in verify pod. PR#3355
Jeffrey Walton [Wed, 14 May 2014 21:49:30 +0000 (22:49 +0100)]
Fix grammar error in verify pod. PR#3355

5 years agoAdd information to BUGS section of enc documentation. PR#3354
Jeffrey Walton [Wed, 14 May 2014 21:48:26 +0000 (22:48 +0100)]
Add information to BUGS section of enc documentation. PR#3354

5 years agoCorrected POD syntax errors. PR#3353
Michal Bozon [Wed, 14 May 2014 20:07:51 +0000 (21:07 +0100)]
Corrected POD syntax errors. PR#3353

5 years agoCheck sk_SSL_CIPHER_num() after assigning sk.
Kurt Roeckx [Mon, 12 May 2014 16:19:14 +0000 (18:19 +0200)]
Check sk_SSL_CIPHER_num() after assigning sk.

5 years agoAvoid out-of-bounds write in SSL_get_shared_ciphers
Günther Noack [Thu, 1 May 2014 11:33:11 +0000 (13:33 +0200)]
Avoid out-of-bounds write in SSL_get_shared_ciphers

PR: 3317

5 years agoFix infinite loop. PR#3347
Viktor Dukhovni [Sun, 11 May 2014 19:28:56 +0000 (20:28 +0100)]
Fix infinite loop. PR#3347

5 years agosafety check to ensure we dont send out beyond the users buffer
Tim Hudson [Sun, 11 May 2014 12:29:59 +0000 (13:29 +0100)]
safety check to ensure we dont send out beyond the users buffer

5 years agoReturn an error if no recipient type matches.
Dr. Stephen Henson [Thu, 8 May 2014 12:17:11 +0000 (13:17 +0100)]
Return an error if no recipient type matches.

If the key type does not match any CMS recipient type return
an error instead of using a random key (MMA mitigation). This
does not leak any useful information to an attacker.

PR#3348
(cherry picked from commit 83a3182e0560f76548f4378325393461f6275493)

5 years agoevp: prevent underflow in base64 decoding
Geoff Thorpe [Sun, 4 May 2014 22:44:14 +0000 (18:44 -0400)]
evp: prevent underflow in base64 decoding

This patch resolves RT ticket #2608.

Thanks to Robert Dugal for originally spotting this, and to David
Ramos for noticing that the ball had been dropped.

Signed-off-by: Geoff Thorpe <geoff@openssl.org>
5 years agobignum: allow concurrent BN_MONT_CTX_set_locked()
Geoff Thorpe [Sun, 4 May 2014 20:19:22 +0000 (16:19 -0400)]
bignum: allow concurrent BN_MONT_CTX_set_locked()

The lazy-initialisation of BN_MONT_CTX was serialising all threads, as
noted by Daniel Sands and co at Sandia. This was to handle the case that
2 or more threads race to lazy-init the same context, but stunted all
scalability in the case where 2 or more threads are doing unrelated
things! We favour the latter case by punishing the former. The init work
gets done by each thread that finds the context to be uninitialised, and
we then lock the "set" logic after that work is done - the winning
thread's work gets used, the losing threads throw away what they've done.

Signed-off-by: Geoff Thorpe <geoff@openssl.org>
5 years agoInitialize num properly.
Dr. Stephen Henson [Tue, 6 May 2014 13:07:37 +0000 (14:07 +0100)]
Initialize num properly.

PR#3289
PR#3345
(cherry picked from commit 3ba1e406c2309adb427ced9815ebf05f5b58d155)

5 years agoSet Enveloped data version to 2 if ktri version not zero.
Dr. Stephen Henson [Tue, 6 May 2014 13:02:17 +0000 (14:02 +0100)]
Set Enveloped data version to 2 if ktri version not zero.
(cherry picked from commit 9c5d953a07f472452ae2cb578e39eddea2de2b9c)

5 years agoAdd new sponsors
Steve Marquess [Thu, 24 Apr 2014 11:13:05 +0000 (07:13 -0400)]
Add new sponsors
(cherry picked from commit 351f0a124bffaa94d2a8abdec2e7dde5ae9c457d)

5 years agoAdd new key fingerprint.
Dr. Stephen Henson [Fri, 11 Apr 2014 01:50:51 +0000 (02:50 +0100)]
Add new key fingerprint.
(cherry picked from commit 3143a332e8f2f5ca1a6f0262a1a1a66103f2adf7)

5 years agoFix free errors in ocsp utility.
Dr. Stephen Henson [Wed, 9 Apr 2014 14:42:40 +0000 (15:42 +0100)]
Fix free errors in ocsp utility.

Keep copy of any host, path and port values allocated by
OCSP_parse_url and free as necessary.
(cherry picked from commit 5219d3dd350cc74498dd49daef5e6ee8c34d9857)

5 years agoUpdate FAQ.
Dr. Stephen Henson [Fri, 4 Apr 2014 11:46:39 +0000 (12:46 +0100)]
Update FAQ.
(cherry picked from commit 6cc0068430d0a4abdef0b466d422e6a4d154a5fe)

5 years agoUse correct length when prompting for password.
Dr. Stephen Henson [Fri, 4 Apr 2014 11:44:43 +0000 (12:44 +0100)]
Use correct length when prompting for password.

Use bufsiz - 1 not BUFSIZ - 1 when prompting for a password in
the openssl utility.

Thanks to Rob Mackinnon, Leviathan Security for reporting this issue.
(cherry picked from commit 7ba08a4d73c1bdfd3aced09a628b1d7d7747cdca)

5 years agoFix base64 decoding bug.
Eric Young [Wed, 2 Apr 2014 18:50:33 +0000 (19:50 +0100)]
Fix base64 decoding bug.

A short PEM encoded sequence if passed to the BIO, and the file
had 2 \n following would fail.

PR#3289
(cherry picked from commit 10378fb5f4c67270b800e8f7c600cd0548874811)

5 years agomake update
Dr. Stephen Henson [Thu, 27 Mar 2014 01:03:46 +0000 (01:03 +0000)]
make update

5 years agoUpdate NEWS
Dr. Stephen Henson [Thu, 27 Mar 2014 01:03:07 +0000 (01:03 +0000)]
Update NEWS

5 years agoUpdate ordinals.
Dr. Stephen Henson [Wed, 12 Mar 2014 14:35:54 +0000 (14:35 +0000)]
Update ordinals.

Use a previously unused value as we will be updating multiple released
branches.
(cherry picked from commit 0737acd2a8cc688902b5151cab5dc6737b82fb96)

5 years agoFix for CVE-2014-0076 backported to 0.9.8 branch
mancha [Thu, 27 Mar 2014 00:55:08 +0000 (00:55 +0000)]
Fix for CVE-2014-0076 backported to 0.9.8 branch

Fix for the attack described in the paper "Recovering OpenSSL
ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
by Yuval Yarom and Naomi Benger. Details can be obtained from:
http://eprint.iacr.org/2014/140

Thanks to Yuval Yarom and Naomi Benger for discovering this
flaw and to Yuval Yarom for supplying a fix.

Thanks for mancha for backporting the fix to OpenSSL 0.9.8 branch.

5 years agoFix alert handling.
mancha [Thu, 27 Mar 2014 00:47:14 +0000 (00:47 +0000)]
Fix alert handling.

Fix OpenSSL 0.9.8 alert handling.

PR#3038

5 years agoRemove duplicate statement.
Dr. Stephen Henson [Sat, 15 Feb 2014 01:27:56 +0000 (01:27 +0000)]
Remove duplicate statement.
(cherry picked from commit 5a7652c3e585e970e5b778074c92e617e48fde38)

5 years agoClarify docs.
Dr. Stephen Henson [Wed, 29 Jan 2014 00:59:35 +0000 (00:59 +0000)]
Clarify docs.

Remove reference to ERR_TXT_MALLOCED in the error library as that is
only used internally. Indicate that returned error data must not be
freed.
(cherry picked from commit f2d678e6e89b6508147086610e985d4e8416e867)

5 years agofix shell syntax PR#3216
Dr. Stephen Henson [Fri, 10 Jan 2014 23:03:47 +0000 (23:03 +0000)]
fix shell syntax PR#3216
(cherry picked from commit 080ae6843299c873808c04487d4ccf51624fe618)

5 years agoRestore SSL_OP_MSIE_SSLV2_RSA_PADDING
Dr. Stephen Henson [Sat, 4 Jan 2014 13:50:52 +0000 (13:50 +0000)]
Restore SSL_OP_MSIE_SSLV2_RSA_PADDING

The flag SSL_OP_MSIE_SSLV2_RSA_PADDING hasn't done anything since OpenSSL
0.9.7h but deleting it will break source compatibility with any software
that references it. Restore it but #define to zero.
(cherry picked from commit b17d6b8d1d49fa4732deff17cfd1833616af0d9c)

5 years agoremove obsolete STATUS file
Dr. Stephen Henson [Tue, 10 Dec 2013 00:11:06 +0000 (00:11 +0000)]
remove obsolete STATUS file

5 years agoAdd release dates to NEWS
Dr. Stephen Henson [Mon, 9 Dec 2013 23:53:28 +0000 (23:53 +0000)]
Add release dates to NEWS

5 years agoSimplify and update openssl.spec
Dr. Stephen Henson [Wed, 27 Nov 2013 15:37:39 +0000 (15:37 +0000)]
Simplify and update openssl.spec

5 years agoFixes for no-static-engine and Windows builds.
Dr. Stephen Henson [Thu, 21 Nov 2013 15:47:19 +0000 (15:47 +0000)]
Fixes for no-static-engine and Windows builds.

5 years agoUpdate CHANGES.
Rob Stradling [Thu, 12 Sep 2013 20:47:25 +0000 (21:47 +0100)]
Update CHANGES.

5 years agoFix compilation with this branch's definition of SSL_CIPHER.
Rob Stradling [Tue, 10 Sep 2013 12:04:05 +0000 (13:04 +0100)]
Fix compilation with this branch's definition of SSL_CIPHER.

5 years agoRemove empty line.
Rob Stradling [Tue, 10 Sep 2013 11:46:24 +0000 (12:46 +0100)]
Remove empty line.

5 years agoTidy up comments.
Rob Stradling [Tue, 10 Sep 2013 11:45:34 +0000 (12:45 +0100)]
Tidy up comments.

5 years agoUse TLS version supplied by client when fingerprinting Safari.
Rob Stradling [Tue, 10 Sep 2013 11:43:33 +0000 (12:43 +0100)]
Use TLS version supplied by client when fingerprinting Safari.

5 years agoBackport TLS 1.1/1.2 #defines
Rob Stradling [Tue, 10 Sep 2013 11:42:46 +0000 (12:42 +0100)]
Backport TLS 1.1/1.2 #defines

5 years agoDon't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X.
Rob Stradling [Tue, 10 Sep 2013 11:41:37 +0000 (12:41 +0100)]
Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X.
OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.

5 years ago Fix overly lenient comparisons:
Bodo Moeller [Mon, 16 Sep 2013 10:59:21 +0000 (12:59 +0200)]
Fix overly lenient comparisons:

    - EC_GROUP_cmp shouldn't consider curves equal just because
      the curve name is the same. (They really *should* be the same
      in this case, but there's an EC_GROUP_set_curve_name API,
      which could be misused.)

    - EC_POINT_cmp shouldn't return 0 for ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED
      or EC_R_INCOMPATIBLE_OBJECTS errors because in a cmp API, 0 indicates
      equality (not an error).

    Reported by: king cope

(cherry picked from commit ca567a03ad4595589b6062465a8404764da4e3fa)

Conflicts:
Configure

5 years agoCorrect ECDSA example.
Dr. Stephen Henson [Tue, 20 Aug 2013 15:33:02 +0000 (16:33 +0100)]
Correct ECDSA example.
(cherry picked from commit 3a918ea2bbf4175d9461f81be1403d3781b2c0dc)

6 years agoDTLS message_sequence number wrong in rehandshake ServerHello
Michael Tuexen [Tue, 13 Aug 2013 17:53:19 +0000 (18:53 +0100)]
DTLS message_sequence number wrong in rehandshake ServerHello

This fix ensures that
* A HelloRequest is retransmitted if not responded by a ClientHello
* The HelloRequest "consumes" the sequence number 0. The subsequent
ServerHello uses the sequence number 1.
* The client also expects the sequence number of the ServerHello to
be 1 if a HelloRequest was received earlier.
This patch fixes the RFC violation.

Conflicts:

ssl/d1_pkt.c
(cherry picked from commit 6f87807e629ee10ec0006b39d8851af8c5ade67b)

6 years agoDTLS handshake fix.
Michael Tuexen [Thu, 8 Aug 2013 12:28:55 +0000 (13:28 +0100)]
DTLS handshake fix.

Reported by: Prashant Jaikumar <rmstar@gmail.com>

Fix handling of application data received before a handshake.
(cherry picked from commit 0c75eeacd3285b395dc75b65c3e6fe6ffbef59f0)

6 years agoSet s->d1 to NULL after freeing it.
Dr. Stephen Henson [Mon, 8 Apr 2013 17:03:12 +0000 (18:03 +0100)]
Set s->d1 to NULL after freeing it.
(cherry picked from commit 04638f2fc335a6dc2af8e5d556d36e29c261dcd2)

6 years agoPrint out DSA key if parameters absent.
Dr. Stephen Henson [Sun, 7 Apr 2013 16:23:21 +0000 (17:23 +0100)]
Print out DSA key if parameters absent.

In DSA_print DSA parameters can be absent (e.g inherited) it is
not a fatal error.

6 years agoDisable compression for DTLS.
Dr. Stephen Henson [Tue, 19 Mar 2013 13:46:28 +0000 (13:46 +0000)]
Disable compression for DTLS.

The only standard compression method is stateful and is incompatible with
DTLS.
(cherry picked from commit e14b8410ca882da8e9579a2d928706f894c8e1ae)

6 years agox86cpuid.pl: make it work with older CPU.
Andy Polyakov [Mon, 18 Mar 2013 19:03:44 +0000 (20:03 +0100)]
x86cpuid.pl: make it work with older CPU.

PR: 3005, from master

6 years agoAvoid unnecessary fragmentation.
Michael Tuexen [Mon, 18 Mar 2013 14:30:38 +0000 (14:30 +0000)]
Avoid unnecessary fragmentation.
(cherry picked from commit 80ccc66d7eedb2d06050130c77c482ae1584199a)

6 years agoEncode INTEGER correctly.
Dr. Stephen Henson [Mon, 18 Mar 2013 14:19:40 +0000 (14:19 +0000)]
Encode INTEGER correctly.

If an ASN1_INTEGER structure is allocated but not explicitly set encode
it as zero: don't generate an invalid zero length INTEGER.

6 years agoTypo.
Dr. Stephen Henson [Mon, 18 Mar 2013 13:58:32 +0000 (13:58 +0000)]
Typo.

6 years agoMerge branch 'OpenSSL_0_9_8-stable' of /home/steve/src/git/openssl into OpenSSL_0_9_8...
Dr. Stephen Henson [Tue, 26 Feb 2013 17:13:37 +0000 (17:13 +0000)]
Merge branch 'OpenSSL_0_9_8-stable' of /home/steve/src/git/openssl into OpenSSL_0_9_8-stable

6 years agoUse orig_len, not rec->orig_len
Geoff Lowe [Tue, 26 Feb 2013 17:12:13 +0000 (17:12 +0000)]
Use orig_len, not rec->orig_len

6 years agoFix POD errors to stop make install_docs dying with pod2man 2.5.0+
Nick Alcock [Fri, 15 Feb 2013 17:44:11 +0000 (17:44 +0000)]
Fix POD errors to stop make install_docs dying with pod2man 2.5.0+

podlators 2.5.0 has switched to dying on POD syntax errors. This means
that a bunch of long-standing erroneous POD in the openssl documentation
now leads to fatal errors from pod2man, halting installation.

Unfortunately POD constraints mean that you have to sort numeric lists
in ascending order if they start with 1: you cannot do 1, 0, 2 even if
you want 1 to appear first. I've reshuffled such (alas, I wish there
were a better way but I don't know of one).

6 years agocms-test.pl: make it work with not-so-latest perl.
Andy Polyakov [Mon, 16 May 2011 18:11:45 +0000 (18:11 +0000)]
cms-test.pl: make it work with not-so-latest perl.
(cherry picked from commit 9c437e2faded18b4ef6499d7041c65d6e216955b)

6 years agoCheck DTLS_BAD_VER for version number.
David Woodhouse [Tue, 12 Feb 2013 15:09:44 +0000 (15:09 +0000)]
Check DTLS_BAD_VER for version number.

Need to check DTLS_BAD_VER as well as DTLS1_VERSION.
PR:2984
(cherry picked from commit 6a14feb048c0b7ad4da341fca364171e273da325)

6 years agoFix for SSL_get_certificate
Dr. Stephen Henson [Mon, 11 Feb 2013 18:24:03 +0000 (18:24 +0000)]
Fix for SSL_get_certificate

Now we set the current certificate to the one used by a server
there is no need to call ssl_get_server_send_cert which will
fail if we haven't sent a certificate yet.
(cherry picked from commit 147dbb2fe3bead7a10e2f280261b661ce7af7adc)

6 years agoFix in ssltest is no-ssl2 configured
Dr. Stephen Henson [Mon, 11 Feb 2013 18:17:50 +0000 (18:17 +0000)]
Fix in ssltest is no-ssl2 configured
(cherry picked from commit cbf9b4aed3e209fe8a39e1d6f55aaf46d1369dc4)

6 years agouse 10240 for tar record size
Dr. Stephen Henson [Mon, 11 Feb 2013 15:05:49 +0000 (15:05 +0000)]
use 10240 for tar record size

6 years agoFAQ/README: we are now using Git instead of CVS
Lutz Jaenicke [Mon, 11 Feb 2013 10:29:05 +0000 (11:29 +0100)]
FAQ/README: we are now using Git instead of CVS
(cherry picked from commit f88dbb8385c199a2a28e9525c6bba3a64bda96af)

Conflicts:

INSTALL.W32

6 years agoSet next version.
Dr. Stephen Henson [Sun, 10 Feb 2013 13:30:04 +0000 (13:30 +0000)]
Set next version.

Note: it was decided that after 0.9.8y it should be 0.9.8za then
0.9.8zb etc.

6 years agossl/s3_[clnt|srvr].c: fix warning and linking error.
Andy Polyakov [Sat, 9 Feb 2013 18:38:47 +0000 (19:38 +0100)]
ssl/s3_[clnt|srvr].c: fix warning and linking error.

PR: 2979

6 years agos3_cbc.c: make CBC_MAC_ROTATE_IN_PLACE universal.
Andy Polyakov [Fri, 8 Feb 2013 20:30:52 +0000 (21:30 +0100)]
s3_cbc.c: make CBC_MAC_ROTATE_IN_PLACE universal.
(cherry picked from commit f93a41877d8d7a287debb7c63d7b646abaaf269c)

6 years agos3_cbc.c: get rid of expensive divisions [from master].
Andy Polyakov [Fri, 8 Feb 2013 15:59:26 +0000 (16:59 +0100)]
s3_cbc.c: get rid of expensive divisions [from master].
(cherry picked from commit e9baceab5a385e570706ca98dec768b2d89d1ac6)

6 years agossl/s3_enc.c: remove artefact.
Andy Polyakov [Fri, 8 Feb 2013 11:03:16 +0000 (12:03 +0100)]
ssl/s3_enc.c: remove artefact.

6 years agossl/[d1|s3]_pkt.c: harmomize orig_len handling.
Andy Polyakov [Thu, 7 Feb 2013 21:47:05 +0000 (22:47 +0100)]
ssl/[d1|s3]_pkt.c: harmomize orig_len handling.
(cherry picked from commit 8545f73b8919770a5d012fe7a82d6785b69baa27)

6 years agoFix IV check and padding removal.
Dr. Stephen Henson [Thu, 7 Feb 2013 21:06:37 +0000 (21:06 +0000)]
Fix IV check and padding removal.

Fix the calculation that checks there is enough room in a record
after removing padding and optional explicit IV. (by Steve)

For AEAD remove the correct number of padding bytes (by Andy)
(cherry picked from commit be125aa5bae0b6baac526890c835e10378b6df74)

6 years agossl/*: remove SSL3_RECORD->orig_len to restore binary compatibility.
Andy Polyakov [Fri, 1 Feb 2013 14:31:50 +0000 (15:31 +0100)]
ssl/*: remove SSL3_RECORD->orig_len to restore binary compatibility.

Kludge alert. This is arranged by passing padding length in unused
bits of SSL3_RECORD->type, so that orig_len can be reconstructed.
(cherry picked from commit 413cbfe68d83f9afc726b7234c49bd5ccddb97b4)

6 years agoFix for EXP-RC2-CBC-MD5
Adam Langley [Wed, 6 Feb 2013 15:50:42 +0000 (15:50 +0000)]
Fix for EXP-RC2-CBC-MD5

MD5 should use little endian order. Fortunately the only ciphersuite
affected is EXP-RC2-CBC-MD5 (TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5) which
is a rarely used export grade ciphersuite.
(cherry picked from commit ee463921ed94572b97a5e1fa8c4d88a27099347e)

6 years agoprepare for release OpenSSL_0_9_8y
Dr. Stephen Henson [Mon, 4 Feb 2013 23:31:21 +0000 (23:31 +0000)]
prepare for release

6 years agomake update
Dr. Stephen Henson [Mon, 4 Feb 2013 23:21:50 +0000 (23:21 +0000)]
make update

6 years agoFix error codes.
Dr. Stephen Henson [Mon, 4 Feb 2013 21:13:18 +0000 (21:13 +0000)]
Fix error codes.
(cherry picked from commit 35d732fc2e1badce13be22a044187ebd4d769552)

6 years agoupdate NEWS and CHANGES
Dr. Stephen Henson [Mon, 4 Feb 2013 23:18:46 +0000 (23:18 +0000)]
update NEWS and CHANGES

6 years agobn_word.c: fix overflow bug in BN_add_word.
Andy Polyakov [Fri, 9 Nov 2012 13:58:40 +0000 (13:58 +0000)]
bn_word.c: fix overflow bug in BN_add_word.
(cherry picked from commit 134c00659a1bc67ad35a1e4620e16bc4315e6e37)

6 years agoupdate NEWS
Dr. Stephen Henson [Fri, 1 Feb 2013 16:05:54 +0000 (16:05 +0000)]
update NEWS

6 years agos3/s3_cbc.c: allow for compilations with NO_SHA256|512.
Andy Polyakov [Fri, 1 Feb 2013 09:10:32 +0000 (10:10 +0100)]
s3/s3_cbc.c: allow for compilations with NO_SHA256|512.
(cherry picked from commit d5371324d978e4096bf99b9d0fe71b2cb65d9dc8)

6 years agossl/s3_cbc.c: md_state alignment portability fix.
Andy Polyakov [Fri, 1 Feb 2013 08:59:56 +0000 (09:59 +0100)]
ssl/s3_cbc.c: md_state alignment portability fix.

RISCs are picky and alignment granted by compiler for md_state can be
insufficient for SHA512.
(cherry picked from commit 36260233e7e3396feed884d3f501283e0453c04f)

6 years agossl/s3_cbc.c: uint64_t portability fix.
Andy Polyakov [Fri, 1 Feb 2013 08:55:43 +0000 (09:55 +0100)]
ssl/s3_cbc.c: uint64_t portability fix.

Break dependency on uint64_t. It's possible to declare bits as
unsigned int, because TLS packets are limited in size and 32-bit
value can't overflow.
(cherry picked from commit cab13fc8473856a43556d41d8dac5605f4ba1f91)

6 years agoDon't access EVP_MD internals directly.
Dr. Stephen Henson [Fri, 1 Feb 2013 14:29:01 +0000 (14:29 +0000)]
Don't access EVP_MD internals directly.

6 years agoAdd ordinal for CRYPTO_memcmp: since this will affect multiple
Dr. Stephen Henson [Thu, 31 Jan 2013 15:19:00 +0000 (15:19 +0000)]
Add ordinal for CRYPTO_memcmp: since this will affect multiple
branches it needs to be in a "gap".

6 years agoTiming fix mitigation for FIPS mode.
Dr. Stephen Henson [Thu, 31 Jan 2013 14:35:34 +0000 (14:35 +0000)]
Timing fix mitigation for FIPS mode.
We have to use EVP in FIPS mode so we can only partially mitigate
timing differences.

Make an extra call to HMAC_Update to hash additonal blocks
to cover any timing differences caused by removal of padding.

6 years agoMove CRYPTO_memcmp to o_init.c when compiling with fips: cryptlib.o
Dr. Stephen Henson [Thu, 31 Jan 2013 14:31:11 +0000 (14:31 +0000)]
Move CRYPTO_memcmp to o_init.c when compiling with fips: cryptlib.o
is in the fips module for fips capable builds.

6 years agoThe cbc functions shouldn't be inside #ifdef OPENSSL_NO_TLSEXT
Dr. Stephen Henson [Thu, 31 Jan 2013 14:14:25 +0000 (14:14 +0000)]
The cbc functions shouldn't be inside #ifdef OPENSSL_NO_TLSEXT

6 years agoUpdate DTLS code to match CBC decoding in TLS.
Ben Laurie [Mon, 28 Jan 2013 17:34:33 +0000 (17:34 +0000)]
Update DTLS code to match CBC decoding in TLS.

This change updates the DTLS code to match the constant-time CBC
behaviour in the TLS.
(cherry picked from commit 9f27de170d1b7bef3d46d41382dc4dafde8b3900)
(cherry picked from commit 5e4ca556e970edb8a7f364fcb6ee6818a965a60b)

Conflicts:
ssl/d1_enc.c
ssl/d1_pkt.c
ssl/s3_pkt.c

6 years agoDon't crash when processing a zero-length, TLS >= 1.1 record.
Ben Laurie [Mon, 28 Jan 2013 17:33:18 +0000 (17:33 +0000)]
Don't crash when processing a zero-length, TLS >= 1.1 record.

The previous CBC patch was bugged in that there was a path through enc()
in s3_pkt.c/d1_pkt.c which didn't set orig_len. orig_len would be left
at the previous value which could suggest that the packet was a
sufficient length when it wasn't.
(cherry picked from commit 6cb19b7681f600b2f165e4adc57547b097b475fd)
(cherry picked from commit 2c948c1bb218f4ae126e14fd3453d42c62b93235)

Conflicts:
ssl/s3_enc.c

6 years agoFixups.
Ben Laurie [Wed, 30 Jan 2013 16:56:30 +0000 (16:56 +0000)]
Fixups.