openssl.git
20 months agoMake BN_num_bits_word constant-time.
David Benjamin [Tue, 23 Jan 2018 18:46:53 +0000 (13:46 -0500)]
Make BN_num_bits_word constant-time.

(This patch was written by Andy Polyakov. I only wrote the commit
message. Mistakes in the analysis are my fault.)

BN_num_bits, by way of BN_num_bits_word, currently leaks the
most-significant word of its argument via branching and memory access
pattern.

BN_num_bits is called on RSA prime factors in various places. These have
public bit lengths, but all bits beyond the high bit are secret. This
fully resolves those cases.

There are a few places where BN_num_bits is called on an input where the
bit length is also secret. This does *not* fully resolve those cases as
we still only look at the top word. Today, that is guaranteed to be
non-zero, but only because of the long-standing bn_correct_top timing
leak. Once that is fixed, a constant-time BN_num_bits on such inputs
must count bits on each word.

Instead, those cases should not call BN_num_bits at all. In particular,
BN_mod_exp_mont_consttime uses the exponent bit width to pick windows,
but it should be using the maximum bit width. The next patch will fix
this.

Thanks to Dinghao Wu, Danfeng Zhang, Shuai Wang, Pei Wang, and Xiao Liu
for reporting this issue.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5154)

(cherry picked from commit 972c87dfc7e765bd28a4964519c362f0d3a58ca4)

20 months agoMake sure we check an incoming reneg ClientHello in DTLS
Matt Caswell [Mon, 29 Jan 2018 14:55:44 +0000 (14:55 +0000)]
Make sure we check an incoming reneg ClientHello in DTLS

In TLS we have a check to make sure an incoming reneg ClientHello is
acceptable. The equivalent check is missing in the DTLS code. This means
that if a client does not signal the ability to handle secure reneg in the
initial handshake, then a subsequent reneg handshake should be rejected by
the server. In the DTLS case the reneg was being allowed if the the 2nd
ClientHello had a renegotiation_info extension. This is incorrect.

While incorrect, this does not represent a security issue because if
the renegotiation_info extension is present in the second ClientHello it
also has to be *correct*. Therefore this will only work if both the client
and server believe they are renegotiating, and both know the previous
Finished result. This is not the case in an insecure rengotiation attack.

I have also tidied up the check in the TLS code and given a better check
for determining whether we are renegotiating or not.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5192)

20 months agoAdd warnings to thread doc.
Rich Salz [Wed, 24 Jan 2018 22:28:45 +0000 (17:28 -0500)]
Add warnings to thread doc.

Thanks to Yun Jiang for pointing this out.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5164)

20 months agoFix BN doc
Rich Salz [Tue, 23 Jan 2018 14:58:33 +0000 (09:58 -0500)]
Fix BN doc

Backport from https://github.com/openssl/openssl/pull/5141

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/5151)

(cherry picked from commit 8b2124aba357a928fec6d7a3bafe186fc83080fc)

20 months agoFix error-path memory leak in asn_mime.c
Todd Short [Mon, 22 Jan 2018 19:30:24 +0000 (14:30 -0500)]
Fix error-path memory leak in asn_mime.c

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5142)

(cherry picked from commit a26dd465b21d8def440c16b6bd90227b03e12e02)

20 months agoChanged OPENSSL_gmtime so macOS uses threadsafe gmtime_r instead of gmtime.
Jonathan Scalise [Fri, 2 Jun 2017 20:47:03 +0000 (16:47 -0400)]
Changed OPENSSL_gmtime so macOS uses threadsafe gmtime_r instead of gmtime.

Updated uses of gmtime to now call OPENSSL_gmtime instead.

Used similar preprocessor logic to make sure localtime_r is called instead
of localtime when applicable.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3609)

20 months agoCleanup ctxs if callback fail to retrieve session ticket
J Mohan Rao Arisankala [Fri, 21 Apr 2017 16:03:46 +0000 (21:33 +0530)]
Cleanup ctxs if callback fail to retrieve session ticket

If tlsext ticket decrypt callback returns error, cleanup ctxs

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3273)

20 months agofix several typos in README.gost
Cristian Stoica [Fri, 12 Aug 2016 15:01:04 +0000 (18:01 +0300)]
fix several typos in README.gost

CLA: trivial

Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1449)

20 months agomerge two mutual exclusive #ifdefs to improve clarity
Cristian Stoica [Fri, 12 Aug 2016 14:53:25 +0000 (17:53 +0300)]
merge two mutual exclusive #ifdefs to improve clarity

CLA: trivial

Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1449)

20 months agoDon't crash on a missing Subject in index.txt
Matt Caswell [Fri, 19 Jan 2018 14:48:45 +0000 (14:48 +0000)]
Don't crash on a missing Subject in index.txt

An index.txt entry which has an empty Subject name field will cause ca
to crash. Therefore check it when we load it to make sure its not empty.

Fixes #5109

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5115)

20 months agoDon't allow an empty Subject when creating a Certificate
Matt Caswell [Fri, 19 Jan 2018 14:34:56 +0000 (14:34 +0000)]
Don't allow an empty Subject when creating a Certificate

Misconfiguration (e.g. an empty policy section in the config file) can
lead to an empty Subject. Since certificates should have unique Subjects
this should not be allowed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5115)

20 months agoUpdate the license end year
Richard Levitte [Sat, 20 Jan 2018 09:02:23 +0000 (10:02 +0100)]
Update the license end year

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5121)

(cherry picked from commit 7c24f9d21cddd2bb30167153b05168fee7e3cf0b)

21 months agoRevert BN_copy() flag copy semantics change
Matt Caswell [Mon, 15 Jan 2018 11:23:07 +0000 (11:23 +0000)]
Revert BN_copy() flag copy semantics change

Commit 9f9442918a changed the semantics of BN_copy() to additionally
copy the BN_FLG_CONSTTIME flag if it is set. This turns out to be
ill advised as it has unintended consequences. For example calling
BN_mod_inverse_no_branch() can sometimes return a result with the flag
set and sometimes not as a result. This can lead to later failures if we
go down code branches that do not support constant time, but check for
the presence of the flag.

The original commit was made due to an issue in BN_MOD_CTX_set(). The
original PR fixed the problem in that function, but it was changed in
review to fix it in BN_copy() instead. The solution seems to be to revert
the BN_copy() change and go back to the originally proposed way.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/5080)

(cherry picked from commit 7d461736f7bd3af3c2f266f8541034ecf6f41ed9)

21 months agoTolerate DTLS alerts with an incorrect version number
Matt Caswell [Fri, 5 Jan 2018 10:12:29 +0000 (10:12 +0000)]
Tolerate DTLS alerts with an incorrect version number

In the case of a protocol version alert being sent by a peer the record
version number may not be what we are expecting. In DTLS records with an
unexpected version number are silently discarded. This probably isn't
appropriate for alerts, so we tolerate a mismatch in the minor version
number.

This resolves an issue reported on openssl-users where an OpenSSL server
chose DTLS1.0 but the client was DTLS1.2 only and sent a protocol_version
alert with a 1.2 record number. This was silently ignored by the server.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5019)

21 months agoAdd fingerprint text, remove MD5
Rich Salz [Sun, 7 Jan 2018 03:32:59 +0000 (22:32 -0500)]
Add fingerprint text, remove MD5

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/4906)
(cherry picked from commit 794bf5f756ad4748735e9b333c40d2b1bf685c36)

21 months agotest/maketests.com: remove irrelevant comment
Richard Levitte [Sat, 6 Jan 2018 11:32:36 +0000 (12:32 +0100)]
test/maketests.com: remove irrelevant comment

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5017)

21 months agoAdd missing tests to the VMS test scripts
Richard Levitte [Thu, 4 Jan 2018 21:37:34 +0000 (22:37 +0100)]
Add missing tests to the VMS test scripts

Thanks to Douglas Fyfe @ VSI for making me aware of this

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5017)

21 months agoCorrected 'cms' exit status when key or certificate cannot be opened
Konstantin Shemyak [Thu, 28 Dec 2017 21:12:59 +0000 (23:12 +0200)]
Corrected 'cms' exit status when key or certificate cannot be opened

A backport of #4997.
Fixes #4996.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/5020)

21 months agoec/ecp_nistp*.c: sanitize for undefined/implmentation-specific behaviour.
Andy Polyakov [Sat, 23 Dec 2017 14:15:30 +0000 (15:15 +0100)]
ec/ecp_nistp*.c: sanitize for undefined/implmentation-specific behaviour.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/4974)

(cherry picked from commit 8af7e94d7b720224547efa7e3364857f7f666dd4)

21 months agoAdd missing comma between references
Viktor Dukhovni [Wed, 13 Dec 2017 15:56:44 +0000 (10:56 -0500)]
Add missing comma between references

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
22 months agoDocument the X509_V_FLAG_PARTIAL_CHAIN flag
Viktor Dukhovni [Tue, 12 Dec 2017 00:05:35 +0000 (19:05 -0500)]
Document the X509_V_FLAG_PARTIAL_CHAIN flag

Also documented X509_V_FLAG_TRUSTED_FIRST

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
22 months agoFix a switch statement fallthrough
Matt Caswell [Sun, 10 Dec 2017 09:55:08 +0000 (09:55 +0000)]
Fix a switch statement fallthrough

SSL_trace() has a case which was inadvertently falling through.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4888)

(cherry picked from commit 5bfb357a0d2046fc75daf67a5bc019eb87443729)

22 months agoConfigure: use a better method to identify gcc and derivates
Richard Levitte [Sat, 18 Nov 2017 16:54:57 +0000 (17:54 +0100)]
Configure: use a better method to identify gcc and derivates

Looking for 'gcc' and 'clang' in the output from the C compiler is
uncertain.  Some versions report argv[0], which might be /usr/bin/cc
(for example), and others might mention gcc without being gcc or a
derivate.

Better then to fetch predefined macros and checking if __GNUC__ and
__clang__ are defined.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4755)

22 months agoRemove three test programs that snuck in
Richard Levitte [Sat, 9 Dec 2017 23:09:25 +0000 (00:09 +0100)]
Remove three test programs that snuck in

They are from the 1.1.0 or master branches

Fixes #4863

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4887)

22 months agoStandardize syntax around sizeof(foo)
Rich Salz [Fri, 8 Dec 2017 20:08:43 +0000 (15:08 -0500)]
Standardize syntax around sizeof(foo)

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4875)

22 months agoFix an incoherent test.
FdaSilvaYY [Fri, 8 Dec 2017 15:25:38 +0000 (10:25 -0500)]
Fix an incoherent test.

Pointer 'o' is set inside a local buffer, so it can't be NULL.
Also fix coding style and add comments

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4754)
(cherry picked from commit cef115ff0ca4255d3decc1dda87c5418a961fd2c)

22 months agoRemove unicode characters from source
Richard Levitte [Fri, 8 Dec 2017 10:40:30 +0000 (11:40 +0100)]
Remove unicode characters from source

Some compilers react badly to non-ASCII characters

Fixes #4877

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4879)

22 months agoAdd missing prototype for FIPS callback
Dr. Matthias St. Pierre [Mon, 26 Sep 2016 12:23:29 +0000 (14:23 +0200)]
Add missing prototype for FIPS callback

Fixes #2533

The call to FIPS_crypto_set_id_callback() was added in revision a43cfd7bb1fc681d563e,
but there is no prototype for it in <openssl/fips.h>.

Signed-off-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4870)

22 months agoFix the buffer sizing in the fatalerrtest
Matt Caswell [Thu, 7 Dec 2017 14:41:21 +0000 (14:41 +0000)]
Fix the buffer sizing in the fatalerrtest

Fixes #4865

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4866)

22 months agoFix initialisation in fatalerrtest
Matt Caswell [Thu, 7 Dec 2017 14:40:49 +0000 (14:40 +0000)]
Fix initialisation in fatalerrtest

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4866)

22 months agoPrepare for 1.0.2o-dev
Matt Caswell [Thu, 7 Dec 2017 13:20:44 +0000 (13:20 +0000)]
Prepare for 1.0.2o-dev

Reviewed-by: Andy Polyakov <appro@openssl.org>
22 months agoPrepare for 1.0.2n release OpenSSL_1_0_2n
Matt Caswell [Thu, 7 Dec 2017 13:19:36 +0000 (13:19 +0000)]
Prepare for 1.0.2n release

Reviewed-by: Andy Polyakov <appro@openssl.org>
22 months agoUpdate CHANGES and NEWS for the new release
Matt Caswell [Wed, 6 Dec 2017 13:54:37 +0000 (13:54 +0000)]
Update CHANGES and NEWS for the new release

Reviewed-by: Rich Salz <rsalz@openssl.org>
22 months agoFix linking of fatalerrtest in VisualStudio
Matt Caswell [Thu, 7 Dec 2017 11:17:22 +0000 (11:17 +0000)]
Fix linking of fatalerrtest in VisualStudio

Reviewed-by: Andy Polyakov <appro@openssl.org>
22 months agoAdd a test for CVE-2017-3737
Matt Caswell [Wed, 29 Nov 2017 13:56:15 +0000 (13:56 +0000)]
Add a test for CVE-2017-3737

Test reading/writing to an SSL object after a fatal error has been
detected.

Reviewed-by: Rich Salz <rsalz@openssl.org>
22 months agoDon't allow read/write after fatal error
Matt Caswell [Wed, 29 Nov 2017 14:04:01 +0000 (14:04 +0000)]
Don't allow read/write after fatal error

OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state"
mechanism. The intent was that if a fatal error occurred during a handshake
then OpenSSL would move into the error state and would immediately fail if
you attempted to continue the handshake. This works as designed for the
explicit handshake functions (SSL_do_handshake(), SSL_accept() and
SSL_connect()), however due to a bug it does not work correctly if
SSL_read() or SSL_write() is called directly. In that scenario, if the
handshake fails then a fatal error will be returned in the initial function
call. If SSL_read()/SSL_write() is subsequently called by the application
for the same SSL object then it will succeed and the data is passed without
being decrypted/encrypted directly from the SSL/TLS record layer.

In order to exploit this issue an attacker would have to trick an
application into behaving incorrectly by issuing an SSL_read()/SSL_write()
after having already received a fatal error.

Thanks to David Benjamin (Google) for reporting this issue and suggesting
this fix.

CVE-2017-3737

Reviewed-by: Rich Salz <rsalz@openssl.org>
22 months agobn/asm/rsaz-avx2.pl: fix digit correction bug in rsaz_1024_mul_avx2.
Andy Polyakov [Fri, 24 Nov 2017 10:35:50 +0000 (11:35 +0100)]
bn/asm/rsaz-avx2.pl: fix digit correction bug in rsaz_1024_mul_avx2.

Credit to OSS-Fuzz for finding this.

CVE-2017-3738

Reviewed-by: Rich Salz <rsalz@openssl.org>
22 months agoUpdate eng_fat.c
MerQGh [Mon, 4 Dec 2017 06:20:51 +0000 (09:20 +0300)]
Update eng_fat.c

This line will allow use private keys, which created by Crypto Pro, to
sign with OpenSSL.

CLA: trivial

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4836)

(cherry picked from commit b35bb37a3d6ecf11b43ef8717600ab61718c3cc2)

22 months agoFix docs for EVP_EncryptUpdate and EVP_DecryptUpdate
FdaSilvaYY [Tue, 28 Nov 2017 22:16:02 +0000 (23:16 +0100)]
Fix docs for EVP_EncryptUpdate and EVP_DecryptUpdate

Fixes #4775

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4815)

(cherry picked from commit a61c15eb9b8d0ef513d695c854516958e2ccf1eb)

23 months agoFix possible leaks on sk_X509_EXTENSION_push() failure ...
FdaSilvaYY [Mon, 6 Nov 2017 11:56:58 +0000 (12:56 +0100)]
Fix possible leaks on sk_X509_EXTENSION_push() failure ...

Backport of #4677 / 1687aa760cdd164b12c5b70e65cadcbce1e7ccfa

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4715)

23 months agoDon't use SSLv3_client_method internally with no-ssl3
Richard Levitte [Tue, 14 Nov 2017 04:03:19 +0000 (05:03 +0100)]
Don't use SSLv3_client_method internally with no-ssl3

Fixes #4734 #4649

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4735)

23 months agoConfigure: add back /WX to VC-WIN32.
Andy Polyakov [Sat, 11 Nov 2017 15:27:48 +0000 (16:27 +0100)]
Configure: add back /WX to VC-WIN32.

We had /WX (treat warnings as errors) in VC-WIN32 for long time. At
some point it was somehow omitted. It's argued that it allows to
keep better focus on new code, which motivates the comeback...

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4718)

23 months agoResolve warnings in VC-WIN32 build, which allows to add /WX.
Andy Polyakov [Sat, 11 Nov 2017 15:35:46 +0000 (16:35 +0100)]
Resolve warnings in VC-WIN32 build, which allows to add /WX.

It's argued that /WX allows to keep better focus on new code, which
motivates its comeback...

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4718)

23 months agolhash.c: Replace Unicode EN DASH with the ASCII char '-'.
Long Qin [Tue, 7 Nov 2017 06:59:20 +0000 (14:59 +0800)]
lhash.c: Replace Unicode EN DASH with the ASCII char '-'.

 * addressing", Proc. 6th Conference on Very Large Databases: 212–223
                                                                 ^
The EN DASH ('–') in this line is one UTF-8 character (hex: e2 80 93).
Under some code page setting (e.g. 936), Visual Studio may report C4819
warning: The file contains a character that cannot be represented in the
current code page.

Replace this character with the ASCII char '-' (Hex Code: 2D).

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4691)

(cherry picked from commit b4d0fa49d9d1a43792e58b0c8066bb23b9e53ef4)

23 months agossltest.c: cb_ticket2 appears to not return a value when it "should"
Richard Levitte [Fri, 10 Nov 2017 12:26:10 +0000 (13:26 +0100)]
ssltest.c: cb_ticket2 appears to not return a value when it "should"

cb_ticket2() does an exit, and should therefore not need to return anything.
Some compilers don't detect that, or don't care, and warn about a non-void
function without a return statement.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4713)

23 months agoVMS: make an alias for a long symbol (> 31 chars)
Richard Levitte [Fri, 10 Nov 2017 12:25:00 +0000 (13:25 +0100)]
VMS: make an alias for a long symbol (> 31 chars)

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4714)

23 months agoutil/copy.pl: work around glob quirk in some of earlier 5.1x Perl versions.
Andy Polyakov [Tue, 7 Nov 2017 20:38:30 +0000 (21:38 +0100)]
util/copy.pl: work around glob quirk in some of earlier 5.1x Perl versions.

In earlier 5.1x Perl versions quoting globs works only if there is
white space. If there is none, it's looking for names starting with ".

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4696)

23 months ago{aes-armv4|bsaes-armv7|sha256-armv4}.pl: make it work with binutils-2.29
Andy Polyakov [Sun, 5 Nov 2017 16:08:16 +0000 (17:08 +0100)]
{aes-armv4|bsaes-armv7|sha256-armv4}.pl: make it work with binutils-2.29

It's not clear if it's a feature or bug, but binutils-2.29[.1]
interprets 'adr' instruction with Thumb2 code reference differently,
in a way that affects calculation of addresses of constants' tables.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/4673)

23 months agoFix error handling in heartbeat processing
Bernd Edlinger [Mon, 6 Nov 2017 10:27:41 +0000 (11:27 +0100)]
Fix error handling in heartbeat processing

Fixes: #4590

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4681)

23 months agoDon't error with -1 for BIGNUM exp operations
Matt Caswell [Mon, 6 Nov 2017 11:18:35 +0000 (11:18 +0000)]
Don't error with -1 for BIGNUM exp operations

The man pages say that BIGNUM arithmetic operations fail with a 0 return.
However some functions were returning -1 on error. In master and 1.1.0 they
already return 0, so this brings 1.0.2 in line.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/4682)

23 months agoFix an endless loop in rsa_builtin_keygen.
Rich Salz [Mon, 6 Mar 2017 14:54:17 +0000 (09:54 -0500)]
Fix an endless loop in rsa_builtin_keygen.

Cherry-picked by Matt Caswell from 69795831.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4670)

23 months agoAdd error handling in dsa_main and ASN1_i2d_bio.
Pavel Kopyl [Fri, 27 Oct 2017 13:13:11 +0000 (16:13 +0300)]
Add error handling in dsa_main and ASN1_i2d_bio.

CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/4600)

(cherry picked from commit a6f622bc99ffdc7b34199babb9d200b24a7a6431)

23 months agoCheck return value of OBJ_nid2obj in dsa_pub_encode.
Pavel Kopyl [Fri, 27 Oct 2017 13:18:06 +0000 (16:18 +0300)]
Check return value of OBJ_nid2obj in dsa_pub_encode.

CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/4600)

(cherry picked from commit 7760384b403a61824c43cc767a11cd22abfa9e49)

23 months agoFix no-ssl3-method build
Kurt Roeckx [Thu, 2 Nov 2017 17:53:16 +0000 (18:53 +0100)]
Fix no-ssl3-method build

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #4649

23 months agoPrepare for 1.0.2n-dev
Matt Caswell [Thu, 2 Nov 2017 14:34:50 +0000 (14:34 +0000)]
Prepare for 1.0.2n-dev

Reviewed-by: Andy Polyakov <appro@openssl.org>
23 months agoPrepare for 1.0.2m release OpenSSL_1_0_2m
Matt Caswell [Thu, 2 Nov 2017 14:33:44 +0000 (14:33 +0000)]
Prepare for 1.0.2m release

Reviewed-by: Andy Polyakov <appro@openssl.org>
23 months agomake update
Matt Caswell [Thu, 2 Nov 2017 14:33:44 +0000 (14:33 +0000)]
make update

Reviewed-by: Andy Polyakov <appro@openssl.org>
23 months agoUpdate CHANGES and NEWS for new release
Matt Caswell [Thu, 2 Nov 2017 11:23:17 +0000 (11:23 +0000)]
Update CHANGES and NEWS for new release

Reviewed-by: Andy Polyakov <appro@openssl.org>
23 months agobn/asm/x86_64-mont5.pl: fix carry bug in bn_sqrx8x_internal.
Andy Polyakov [Thu, 17 Aug 2017 19:08:57 +0000 (21:08 +0200)]
bn/asm/x86_64-mont5.pl: fix carry bug in bn_sqrx8x_internal.

Credit to OSS-Fuzz for finding this.

CVE-2017-3736

Reviewed-by: Rich Salz <rsalz@openssl.org>
23 months agoAddress a timing side channel whereby it is possible to determine some
Pauli [Tue, 31 Oct 2017 23:47:13 +0000 (09:47 +1000)]
Address a timing side channel whereby it is possible to determine some

information about the length of the scalar used in ECDSA operations
from a large number (2^32) of signatures.

Thanks to Neals Fournaise, Eliane Jaulmes and Jean-Rene Reinhard for
reporting this issue.

Refer to #4576 for further details.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4623)

23 months agoAddress a timing side channel whereby it is possible to determine some
Pauli [Tue, 31 Oct 2017 20:58:13 +0000 (06:58 +1000)]
Address a timing side channel whereby it is possible to determine some

information about the length of a value used in DSA operations from
a large number of signatures.

This doesn't rate as a CVE because:

* For the non-constant time code, there are easier ways to extract
  more information.

* For the constant time code, it requires a significant number of signatures
  to leak a small amount of information.

Thanks to Neals Fournaise, Eliane Jaulmes and Jean-Rene Reinhard for
reporting this issue.

Original commit by Paul Dale. Backported to 1.0.2 by Matt Caswell

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4642)

23 months agoFix weak digest in TLS 1.2 with SNI.
David Benjamin [Mon, 23 Oct 2017 23:13:05 +0000 (19:13 -0400)]
Fix weak digest in TLS 1.2 with SNI.

1ce95f19601bbc6bfd24092c76c8f8105124e857 was incomplete and did not
handle the case when SSL_set_SSL_CTX was called from the cert_cb
callback rather than the SNI callback. The consequence is any server
using OpenSSL 1.0.2 and the cert_cb callback for SNI only ever signs a
weak digest, SHA-1, even when connecting to clients which use secure
ones.

Fix this and add regression tests for both this and the original issue.

Fixes #4554.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4577)

23 months agoUse malloc/memset not calloc for WinCE portability
Richard Levitte [Thu, 26 Oct 2017 18:49:47 +0000 (20:49 +0200)]
Use malloc/memset not calloc for WinCE portability

Fixes: #2539

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4594)

23 months agoDon't use strcasecmp and strncasecmp for IA5 strings
Matt Caswell [Fri, 20 Oct 2017 16:11:03 +0000 (17:11 +0100)]
Don't use strcasecmp and strncasecmp for IA5 strings

The functions strcasecmp() and strncasecmp() will use locale specific rules
when performing comparison. This could cause some problems in certain
locales. For example in the Turkish locale an 'I' character is not the
uppercase version of 'i'. However IA5 strings should not use locale specific
rules, i.e. for an IA5 string 'I' is uppercase 'i' even if using the
Turkish locale.

This fixes a bug in name constraints checking reported by Thomas Pornin
(NCCGroup).

This is not considered a security issue because it would require both a
Turkish locale (or other locale with similar issues) and malfeasance by
a trusted name-constrained CA for a certificate to pass name constraints
in error. The constraints also have to be for excluded sub-trees which are
extremely rare. Failure to match permitted subtrees is a bug, not a
vulnerability.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4570)

23 months agoDon't make any changes to the lhash structure if we are going to fail
Matt Caswell [Wed, 18 Oct 2017 13:07:57 +0000 (14:07 +0100)]
Don't make any changes to the lhash structure if we are going to fail

The lhash expand() function can fail if realloc fails. The previous
implementation made changes to the structure and then attempted to do a
realloc. If the realloc failed then it attempted to undo the changes it
had just made. Unfortunately changes to lh->p were not undone correctly,
ultimately causing subsequent expand() calls to increment num_nodes to a
value higher than num_alloc_nodes, which can cause out-of-bounds reads/
writes. This is not considered a security issue because an attacker cannot
cause realloc to fail.

This commit moves the realloc call to near the beginning of the function
before any other changes are made to the lhash structure. That way if a
failure occurs we can immediately fail without having to undo anything.

Thanks to Pavel Kopyl (Samsung) for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4551)

23 months agoasn1_item_embed_new(): don't free an embedded item
Richard Levitte [Tue, 24 Oct 2017 11:42:41 +0000 (13:42 +0200)]
asn1_item_embed_new(): don't free an embedded item

The previous change with this intention didn't quite do it.  An
embedded item must not be freed itself, but might potentially contain
non-embedded elements, which must be freed.

So instead of calling ASN1_item_ex_free(), where we can't pass the
combine flag, we call asn1_item_embed_free() directly.

This changes asn1_item_embed_free() from being a static function to
being a private non-static function.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/4578)

23 months agoFix memory leak in GENERAL_NAME_set0_othername.
Xiangyu Bu [Wed, 18 Oct 2017 00:10:53 +0000 (17:10 -0700)]
Fix memory leak in GENERAL_NAME_set0_othername.

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4544)

(cherry picked from commit 04761b557a53f026630dd5916b2b8522d94579db)

23 months agoasn1_item_embed_new(): don't free an embedded item
Richard Levitte [Mon, 23 Oct 2017 14:48:17 +0000 (16:48 +0200)]
asn1_item_embed_new(): don't free an embedded item

An embedded item wasn't allocated separately on the heap, so don't
free it as if it was.

Issue discovered by Pavel Kopyl

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4571)

23 months agoAdditional name for all commands
Rich Salz [Thu, 19 Oct 2017 12:22:12 +0000 (08:22 -0400)]
Additional name for all commands

Add openssl-foo as a name for the openssl "foo" command.
Recommended by a usability study conducted by Martin Ukrop at CRoCS, FI MU
Fixes: #4548
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/4557)

2 years agoDon't use colortable; avoid Win32 overwrite
Rich Salz [Wed, 4 Oct 2017 19:00:23 +0000 (15:00 -0400)]
Don't use colortable; avoid Win32 overwrite

Thanks to Jo Hornsby for reporting this and helping with the fix.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4464)

2 years agoEnsure we test all parameters for BN_FLG_CONSTTIME
Matt Caswell [Wed, 27 Sep 2017 10:13:47 +0000 (11:13 +0100)]
Ensure we test all parameters for BN_FLG_CONSTTIME

RSA_setup_blinding() calls BN_BLINDING_create_param() which later calls
BN_mod_exp() as follows:

BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx)

ret->mod will have BN_FLG_CONSTTIME set, but ret->e does not. In
BN_mod_exp() we only test the third param for the existence of this flag.
We should test all the inputs.

Thanks to Samuel Weiser (samuel.weiser@iaik.tugraz.at) for reporting this
issue.

This typically only happens once at key load, so this is unlikely to be
exploitable in any real scenario.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4477)

(cherry picked from commit e913d11f444e0b46ec1ebbf3340813693f4d869d)

2 years agoFix backport by moving file.
Dr. Stephen Henson [Mon, 2 Oct 2017 22:15:32 +0000 (23:15 +0100)]
Fix backport by moving file.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4453)

2 years agoDocument missing EVP_PKEY_method_* items
Paul Yang [Mon, 21 Aug 2017 15:47:17 +0000 (11:47 -0400)]
Document missing EVP_PKEY_method_* items

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 43f985fdbf4e5c2d5c95a717cc644f000de8bc75)

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4453)

2 years agoupdate ordinals
Dr. Stephen Henson [Mon, 2 Oct 2017 20:08:17 +0000 (21:08 +0100)]
update ordinals

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4453)

2 years agoEVP_PKEY_METHOD accessor functions.
Dr. Stephen Henson [Mon, 20 Jul 2015 21:05:10 +0000 (22:05 +0100)]
EVP_PKEY_METHOD accessor functions.

Functions to retrieve the function pointer of an existing method: this
can be used to create a method which intercepts or modifies the behaviour
of an existing method while retaining most of the existing behaviour.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit e7451ed137450e4bc6c4bec33bc9054bce443feb)

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4453)

2 years agoFix the return type of felem_is_zero_int which should be int.
Bernd Edlinger [Mon, 2 Oct 2017 15:24:17 +0000 (17:24 +0200)]
Fix the return type of felem_is_zero_int which should be int.
Change argument type of xxxelem_is_zero_int to const void*
to avoid the need of type casts.

Fixes #4413

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4450)

(cherry picked from commit c55b786a8911cef41f890735ba5fde79e116e055)

2 years agoAdded const-time flag to DSA key decoding to avoid potential leak of privkey
Samuel Weiser [Fri, 29 Sep 2017 11:29:25 +0000 (13:29 +0200)]
Added const-time flag to DSA key decoding to avoid potential leak of privkey

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4440)

(cherry picked from commit 6364475a990449ef33fc270ac00472f7210220f2)

2 years agodoc: note that the BN_new() initialises the BIGNUM
Hubert Kario [Fri, 29 Sep 2017 13:40:43 +0000 (15:40 +0200)]
doc: note that the BN_new() initialises the BIGNUM

BN_new() and BN_secure_new() not only allocate memory, but also
initialise it to deterministic value - 0.

Document that behaviour to make it explicit

backport from #4438

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4443)

2 years agodoc: BN_free() is NULL-safe
Hubert Kario [Fri, 29 Sep 2017 11:27:32 +0000 (13:27 +0200)]
doc: BN_free() is NULL-safe

document that parameter to BN_free can be NULL

backport from master

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4439)

2 years agoBN_copy now propagates BN_FLG_CONSTTIME
Samuel Weiser [Sat, 16 Sep 2017 14:52:44 +0000 (16:52 +0200)]
BN_copy now propagates BN_FLG_CONSTTIME

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4377)

(cherry picked from commit 9f9442918aeaed5dc2442d81ab8d29fe3e1fb906)

2 years agoFixed error in propagating BN_FLG_CONSTTIME flag through BN_MONT_CTX_set, which could...
Samuel Weiser [Fri, 15 Sep 2017 20:12:53 +0000 (22:12 +0200)]
Fixed error in propagating BN_FLG_CONSTTIME flag through BN_MONT_CTX_set, which could lead to information disclosure on RSA primes p and q.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4377)

(cherry picked from commit 3de81a5912041a70884cf4e52e7213f3b5dfa747)

2 years agoMake sure that a cert with extensions gets version number 2 (v3)
Richard Levitte [Tue, 26 Sep 2017 08:45:05 +0000 (10:45 +0200)]
Make sure that a cert with extensions gets version number 2 (v3)

Fixes #4419

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4421)

2 years agoFix overflow in c2i_ASN1_BIT_STRING.
David Benjamin [Mon, 18 Sep 2017 19:58:41 +0000 (15:58 -0400)]
Fix overflow in c2i_ASN1_BIT_STRING.

c2i_ASN1_BIT_STRING takes length as a long but uses it as an int.  Check
bounds before doing so. Previously, excessively large inputs to the
function could write a single byte outside the target buffer. (This is
unreachable as asn1_ex_c2i already uses int for the length.)

Thanks to NCC for finding this issue. Fix written by Martin Kreichgauer.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4385)

(cherry picked from commit 6b1c8204b33aaedb7df7a009c241412839aaf950)

2 years agoUpdate rsautl.pod for typo
multics [Sun, 10 Sep 2017 13:02:07 +0000 (21:02 +0800)]
Update rsautl.pod for typo

Fixes the typo
CLA: trivial

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4354)

(cherry picked from commit f70c22eb23763c6dce050293cc1b9a0a234d72b2)

2 years agoFix error handling/cleanup
Rich Salz [Thu, 7 Sep 2017 20:17:06 +0000 (16:17 -0400)]
Fix error handling/cleanup

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/4326)
(cherry picked from commit 180794c54e98ae467c4ebced3737e1ede03e320a)

2 years agoAvoid out-of-bounds read
Rich Salz [Tue, 22 Aug 2017 15:44:41 +0000 (11:44 -0400)]
Avoid out-of-bounds read

Fixes CVE 2017-3735

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/4276)

(cherry picked from commit b23171744b01e473ebbfd6edad70c1c3825ffbcd)

2 years agoRemove an out of date reference to RT
Matt Caswell [Fri, 25 Aug 2017 13:39:07 +0000 (14:39 +0100)]
Remove an out of date reference to RT

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4260)

2 years agoFix cherry-pick; move file.
Rich Salz [Wed, 23 Aug 2017 21:51:56 +0000 (17:51 -0400)]
Fix cherry-pick; move file.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4238)

2 years agoCorrect GCM docs.
Dr. Stephen Henson [Wed, 23 Aug 2017 23:00:31 +0000 (00:00 +0100)]
Correct GCM docs.

Fix GCM documentation: the tag does not have to be supplied before
decrypting any data any more.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4231)

2 years agoTweak wording to be more clear.
Rich Salz [Wed, 23 Aug 2017 16:06:41 +0000 (12:06 -0400)]
Tweak wording to be more clear.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4234)

(cherry picked from commit a130950df92abf7dd787b000403da02af8f41c2d)

2 years agoUse casts for arguments to ctype functions.
Pauli [Mon, 21 Aug 2017 23:10:50 +0000 (09:10 +1000)]
Use casts for arguments to ctype functions.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4212)

2 years agoSet FIPS thread id callback.
Dr. Stephen Henson [Fri, 18 Aug 2017 16:58:05 +0000 (17:58 +0100)]
Set FIPS thread id callback.

Fixes #4180

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4192)

2 years agoFix OCSP_basic_verify() cert chain construction in case bs->certs is NULL (backport)
David von Oheimb [Thu, 17 Aug 2017 19:45:06 +0000 (21:45 +0200)]
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL (backport)

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4183)

2 years agoerr/err.c: fix "wraparound" bug in ERR_set_error_data.
Andy Polyakov [Wed, 16 Aug 2017 21:06:57 +0000 (23:06 +0200)]
err/err.c: fix "wraparound" bug in ERR_set_error_data.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit d3d880ce01cfaf0091f46a2f6b5bd146d47a93e7)

2 years agoClear outputs in PKCS12_parse error handling.
Bernd Edlinger [Sat, 12 Aug 2017 08:02:09 +0000 (10:02 +0200)]
Clear outputs in PKCS12_parse error handling.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4146)

2 years agoFix 'no-cms'
Richard Levitte [Thu, 6 Jul 2017 08:11:17 +0000 (10:11 +0200)]
Fix 'no-cms'

Fixes #3867

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3873)

2 years agoAdd missing HTML tag in www_body in s_server.c
Xiaoyin Liu [Sat, 5 Aug 2017 06:31:04 +0000 (02:31 -0400)]
Add missing HTML tag in www_body in s_server.c

In the generated HTML document, the `<pre>` tag is not closed.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4088)
(cherry picked from commit 1a9f5cf0d58629ab8972f50e937d8ab78bf27b6f)

2 years agoAvoid surpising password dialog in X509 file lookup.
Bernd Edlinger [Mon, 7 Aug 2017 16:02:53 +0000 (18:02 +0200)]
Avoid surpising password dialog in X509 file lookup.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4111)

(cherry picked from commit db854bb14a7010712cfc02861731399b1b587474)

2 years agoAdd NOTTOOLONG macro for more clear code.
Rich Salz [Mon, 7 Aug 2017 16:36:39 +0000 (12:36 -0400)]
Add NOTTOOLONG macro for more clear code.

Also fix one missing use of it. Thanks to GitHub user Vort for finding
it and pointing out the fix.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4106)

2 years agoAdd a missing CRYPTO_w_unlock in get_cert_by_subject
Bernd Edlinger [Fri, 4 Aug 2017 06:11:24 +0000 (08:11 +0200)]
Add a missing CRYPTO_w_unlock in get_cert_by_subject

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4084)