openssl.git
3 years agoMove init of the WPACKET into write_state_machine()
Matt Caswell [Thu, 29 Sep 2016 22:28:29 +0000 (23:28 +0100)]
Move init of the WPACKET into write_state_machine()

Instead of initialising, finishing and cleaning up the WPACKET in every
message construction function, we should do it once in
write_state_machine().

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRemove untrue comment.
Ben Laurie [Sat, 1 Oct 2016 11:41:36 +0000 (12:41 +0100)]
Remove untrue comment.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoMake dependencies if Makefile is new.
Ben Laurie [Sat, 1 Oct 2016 11:40:58 +0000 (12:40 +0100)]
Make dependencies if Makefile is new.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoRename ssl_set_handshake_header2()
Matt Caswell [Thu, 29 Sep 2016 21:40:15 +0000 (22:40 +0100)]
Rename ssl_set_handshake_header2()

ssl_set_handshake_header2() was only ever a temporary name while we had
to have ssl_set_handshake_header() for code that hadn't been converted to
WPACKET yet. No code remains that needed that so we can rename it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRemove ssl_set_handshake_header()
Matt Caswell [Thu, 29 Sep 2016 21:32:36 +0000 (22:32 +0100)]
Remove ssl_set_handshake_header()

Remove the old ssl_set_handshake_header() implementations. Later we will
rename ssl_set_handshake_header2() to ssl_set_handshake_header().

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRemove the tls12_get_sigandhash_old() function
Matt Caswell [Thu, 29 Sep 2016 17:08:34 +0000 (18:08 +0100)]
Remove the tls12_get_sigandhash_old() function

This is no longer needed now that all messages use WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agofix memory leak
Dr. Stephen Henson [Sun, 2 Oct 2016 14:59:26 +0000 (15:59 +0100)]
fix memory leak

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoDon't use DES when disabled.
Ben Laurie [Sun, 2 Oct 2016 10:19:29 +0000 (11:19 +0100)]
Don't use DES when disabled.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agofix memory leak
Dr. Stephen Henson [Sat, 1 Oct 2016 14:16:59 +0000 (15:16 +0100)]
fix memory leak

Reviewed-by: Tim Hudson <tjh@openssl.org>
3 years agoAdd SRP test vectors from RFC5054
Dr. Stephen Henson [Thu, 29 Sep 2016 22:22:46 +0000 (23:22 +0100)]
Add SRP test vectors from RFC5054

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoSRP code tidy.
Dr. Stephen Henson [Thu, 29 Sep 2016 18:24:26 +0000 (19:24 +0100)]
SRP code tidy.

Tidy up srp_Calc_k and SRP_Calc_u by making them a special case of
srp_Calc_xy which performs SHA1(PAD(x) | PAD(y)).

This addresses an OCAP Audit issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConvert NewSessionTicket construction to WPACKET
Matt Caswell [Thu, 29 Sep 2016 17:00:37 +0000 (18:00 +0100)]
Convert NewSessionTicket construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix an error in packet_locl.h
Matt Caswell [Thu, 29 Sep 2016 17:00:01 +0000 (18:00 +0100)]
Fix an error in packet_locl.h

A convenience macro was using the wrong underlying function.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConvert CertStatus message construction to WPACKET
Matt Caswell [Thu, 29 Sep 2016 15:40:13 +0000 (16:40 +0100)]
Convert CertStatus message construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix mis-named macro in packet_locl.h
Matt Caswell [Thu, 29 Sep 2016 15:39:32 +0000 (16:39 +0100)]
Fix mis-named macro in packet_locl.h

A couple of the WPACKET_sub_memcpy* macros were mis-named.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConvert SeverDone construction to WPACKET
Matt Caswell [Thu, 29 Sep 2016 14:14:33 +0000 (15:14 +0100)]
Convert SeverDone construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agomake update
Dr. Stephen Henson [Wed, 28 Sep 2016 15:59:54 +0000 (16:59 +0100)]
make update

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoPrint <ABSENT> if a STACK is NULL.
Dr. Stephen Henson [Wed, 28 Sep 2016 14:18:58 +0000 (15:18 +0100)]
Print <ABSENT> if a STACK is NULL.

If a STACK (corresponding to SEQUENCE OF or SET OF) is NULL then the
field is absent as opposed to empty (present but has zero elements).

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoadd item list support to d2i_test
Dr. Stephen Henson [Tue, 27 Sep 2016 23:24:58 +0000 (00:24 +0100)]
add item list support to d2i_test

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoASN1_ITEM should use type name not structure name.
Dr. Stephen Henson [Tue, 27 Sep 2016 21:39:12 +0000 (22:39 +0100)]
ASN1_ITEM should use type name not structure name.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd -item option to asn1parse
Dr. Stephen Henson [Tue, 27 Sep 2016 21:25:08 +0000 (22:25 +0100)]
Add -item option to asn1parse

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd ASN1_ITEM lookup and enumerate functions.
Dr. Stephen Henson [Tue, 27 Sep 2016 20:15:57 +0000 (21:15 +0100)]
Add ASN1_ITEM lookup and enumerate functions.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix missing NULL checks in NewSessionTicket construction
Matt Caswell [Thu, 29 Sep 2016 14:38:44 +0000 (15:38 +0100)]
Fix missing NULL checks in NewSessionTicket construction

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix an mis-matched function code so that "make update" doesn't fail
Matt Caswell [Thu, 29 Sep 2016 14:32:35 +0000 (15:32 +0100)]
Fix an mis-matched function code so that "make update" doesn't fail

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd an example of usage to the WPACKET_reserve_bytes() documentation
Matt Caswell [Thu, 29 Sep 2016 13:45:49 +0000 (14:45 +0100)]
Add an example of usage to the WPACKET_reserve_bytes() documentation

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAddress style feedback comments
Matt Caswell [Thu, 29 Sep 2016 13:39:47 +0000 (14:39 +0100)]
Address style feedback comments

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix a bug in CKE construction for PSK
Matt Caswell [Thu, 29 Sep 2016 11:04:08 +0000 (12:04 +0100)]
Fix a bug in CKE construction for PSK

In plain PSK we don't need to do anymore construction after the preamble.
We weren't detecting this case and treating it as an unknown cipher.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConvert ServerKeyExchange construction to WPACKET
Matt Caswell [Thu, 29 Sep 2016 10:46:08 +0000 (11:46 +0100)]
Convert ServerKeyExchange construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd the WPACKET_reserve_bytes() function
Matt Caswell [Thu, 29 Sep 2016 10:43:37 +0000 (11:43 +0100)]
Add the WPACKET_reserve_bytes() function

WPACKET_allocate_bytes() requires you to know the size of the data you
are allocating for, before you create it. Sometimes this isn't the case,
for example we know the maximum size that a signature will be before we
create it, but not the actual size. WPACKET_reserve_bytes() enables us to
reserve bytes in the WPACKET, but not count them as written yet. We then
subsequently need to acall WPACKET_allocate_bytes to actually count them as
written.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRemove tls12_copy_sigalgs_old()
Matt Caswell [Thu, 29 Sep 2016 13:26:36 +0000 (14:26 +0100)]
Remove tls12_copy_sigalgs_old()

This was a temporary function needed during the conversion to WPACKET. All
callers have now been converted to the new way of doing this so this
function is no longer required.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConvert CertificateRequest construction to WPACKET
Matt Caswell [Thu, 29 Sep 2016 13:25:52 +0000 (14:25 +0100)]
Convert CertificateRequest construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAddress style feedback comments
Matt Caswell [Thu, 29 Sep 2016 09:06:11 +0000 (10:06 +0100)]
Address style feedback comments

Merge declarations of same type together.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix a bug in the construction of the ClienHello SRTP extension
Matt Caswell [Wed, 28 Sep 2016 12:33:41 +0000 (13:33 +0100)]
Fix a bug in the construction of the ClienHello SRTP extension

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix heartbeat compilation error
Matt Caswell [Wed, 28 Sep 2016 11:03:30 +0000 (12:03 +0100)]
Fix heartbeat compilation error

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoDelete some unneeded code
Matt Caswell [Wed, 28 Sep 2016 10:15:36 +0000 (11:15 +0100)]
Delete some unneeded code

Some functions were being called from both code that used WPACKETs and code
that did not. Now that more code has been converted to use WPACKETs some of
that duplication can be removed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConvert ServerHello construction to WPACKET
Matt Caswell [Wed, 28 Sep 2016 10:13:48 +0000 (11:13 +0100)]
Convert ServerHello construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix an Uninit read in DTLS
Matt Caswell [Wed, 28 Sep 2016 13:12:26 +0000 (14:12 +0100)]
Fix an Uninit read in DTLS

If we have a handshake fragment waiting then dtls1_read_bytes() was not
correctly setting the value of recvd_type, leading to an uninit read.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix no-dtls
Matt Caswell [Wed, 28 Sep 2016 08:35:05 +0000 (09:35 +0100)]
Fix no-dtls

The new large message test in sslapitest needs OPENSSL_NO_DTLS guards

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoapps/apps.c: initialize and de-initialize engine around key loading
Richard Levitte [Wed, 28 Sep 2016 19:28:00 +0000 (21:28 +0200)]
apps/apps.c: initialize and de-initialize engine around key loading

Before loading a key from an engine, it may need to be initialized.
When done loading the key, we must de-initialize the engine.
(if the engine is already initialized somehow, only the reference
counter will be incremented then decremented)

Reviewed-by: Stephen Henson <steve@openssl.org>
3 years agoRevert "Call ENGINE_init() before trying to use keys from engine"
Rich Salz [Wed, 28 Sep 2016 18:40:25 +0000 (14:40 -0400)]
Revert "Call ENGINE_init() before trying to use keys from engine"

This reverts commit 0a72002993b8619fd0642d19af3364bafbd9a06c.
This fails to call ENGINE_finish; an alternate fix is forthcoming.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
3 years agoCall ENGINE_init() before trying to use keys from engine
David Woodhouse [Wed, 28 Sep 2016 12:08:45 +0000 (13:08 +0100)]
Call ENGINE_init() before trying to use keys from engine

When I said before that s_client "used to work in 1.0.2" that was only
partly true. It worked for engines which provided a default generic
method for some key type, because it called ENGINE_set_default() and
that ended up being an implicit initialisation and functional refcount.

But an engine which doesn't provide generic methods doesn't get initialised,
and then when you try to use it you get an error:

cannot load client certificate private key file from engine
140688147056384:error:26096075:engine routines:ENGINE_load_private_key:not initialised:crypto/engine/eng_pkey.c:66:
unable to load client certificate private key file

cf. https://github.com/OpenSC/libp11/issues/107 (in which we discover
that engine_pkcs11 *used* to provide generic methods that OpenSSL would
try to use for ephemeral DH keys when negotiating ECDHE cipher suites in
TLS, and that didn't work out very well.)

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1639)

3 years agoRestore '-keyform engine' support for s_client
David Woodhouse [Wed, 28 Sep 2016 12:07:52 +0000 (13:07 +0100)]
Restore '-keyform engine' support for s_client

This used to work in 1.0.2 but disappeared when the argument parsing was
revamped.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1639)

3 years agoAdd DTLS renegotiation tests
Matt Caswell [Tue, 27 Sep 2016 11:24:47 +0000 (12:24 +0100)]
Add DTLS renegotiation tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoExtend the renegotiation tests
Matt Caswell [Tue, 27 Sep 2016 10:50:43 +0000 (11:50 +0100)]
Extend the renegotiation tests

Add the ability to test both server initiated and client initiated reneg.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoUpdate README.ssltest.md
Matt Caswell [Tue, 27 Sep 2016 09:18:00 +0000 (10:18 +0100)]
Update README.ssltest.md

Add update for testing renegotiation. Also change info on CTLOG_FILE
environment variable - which always seems to be required.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd support for testing renegotiation
Matt Caswell [Mon, 26 Sep 2016 16:25:43 +0000 (17:25 +0100)]
Add support for testing renegotiation

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix a bug in Renegotiation extension construction
Matt Caswell [Mon, 26 Sep 2016 14:31:20 +0000 (15:31 +0100)]
Fix a bug in Renegotiation extension construction

The conversion to WPACKET broke the construction of the renegotiation
extension.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConvert HelloRequest construction to WPACKET
Matt Caswell [Mon, 26 Sep 2016 13:59:08 +0000 (14:59 +0100)]
Convert HelloRequest construction to WPACKET

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd missing parameter.
David Benjamin [Thu, 25 Aug 2016 05:55:48 +0000 (01:55 -0400)]
Add missing parameter.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoSwitch back to assuming TLS 1.2.
David Benjamin [Thu, 18 Aug 2016 04:43:05 +0000 (00:43 -0400)]
Switch back to assuming TLS 1.2.

The TLSProxy::Record->new call hard-codes a version, like
70-test_sslrecords.t.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoAddress review comments.
David Benjamin [Thu, 18 Aug 2016 04:38:43 +0000 (00:38 -0400)]
Address review comments.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoDon't test quite so many of them.
David Benjamin [Wed, 10 Aug 2016 14:45:49 +0000 (10:45 -0400)]
Don't test quite so many of them.

Avoid making the CI blow up.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoTest CBC mode padding.
David Benjamin [Wed, 10 Aug 2016 04:45:51 +0000 (00:45 -0400)]
Test CBC mode padding.

This is a regression test for
https://github.com/openssl/openssl/pull/1431. It tests a
maximally-padded record with each possible invalid offset.

This required fixing a bug in Message.pm where the client sending a
fatal alert followed by close_notify was still treated as success.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoFix some mem leaks in sslapitest
Matt Caswell [Mon, 26 Sep 2016 11:04:23 +0000 (12:04 +0100)]
Fix some mem leaks in sslapitest

A mem leak could occur on an error path. Also the mempacket BIO_METHOD
needs to be cleaned up, because of the newly added DTLS test.

Also fixed a double semi-colon in ssltestlib.c

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd a basic test for BN_bn2dec.
David Benjamin [Thu, 25 Aug 2016 21:45:20 +0000 (17:45 -0400)]
Add a basic test for BN_bn2dec.

This would have caught 099e2968ed3c7d256cda048995626664082b1b30. This is
a port of the test added in
https://boringssl.googlesource.com/boringssl/+/7c040756178e14a4d181b6d93abb3827c93189c4

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1496)

3 years agoFix HelloVerifyRequest construction
Matt Caswell [Fri, 23 Sep 2016 13:40:16 +0000 (14:40 +0100)]
Fix HelloVerifyRequest construction

commit c536b6be1a introduced a bug that causes a reachable assert. This fixes
it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoUpdates CHANGES and NEWS for new release
Matt Caswell [Mon, 26 Sep 2016 08:43:45 +0000 (09:43 +0100)]
Updates CHANGES and NEWS for new release

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoAdd to fuzz corpora for CVE-2016-6309
Robert Swiecki [Sun, 25 Sep 2016 15:35:56 +0000 (16:35 +0100)]
Add to fuzz corpora for CVE-2016-6309

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoFix Use After Free for large message sizes
Matt Caswell [Fri, 23 Sep 2016 15:58:11 +0000 (16:58 +0100)]
Fix Use After Free for large message sizes

The buffer to receive messages is initialised to 16k. If a message is
received that is larger than that then the buffer is "realloc'd". This can
cause the location of the underlying buffer to change. Anything that is
referring to the old location will be referring to free'd data. In the
recent commit c1ef7c97 (master) and 4b390b6c (1.1.0) the point in the code
where the message buffer is grown was changed. However s->init_msg was not
updated to point at the new location.

CVE-2016-6309

Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoFix a WPACKET bug
Matt Caswell [Fri, 23 Sep 2016 15:41:50 +0000 (16:41 +0100)]
Fix a WPACKET bug

If we request more bytes to be allocated than double what we have already
written, then we grow the buffer by the wrong amount.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoAdd a test for large messages
Matt Caswell [Fri, 23 Sep 2016 14:37:13 +0000 (15:37 +0100)]
Add a test for large messages

Ensure that we send a large message during the test suite.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
3 years agoConvert HelloVerifyRequest construction to WPACKET
Matt Caswell [Wed, 21 Sep 2016 10:26:47 +0000 (11:26 +0100)]
Convert HelloVerifyRequest construction to WPACKET

We actually construct a HelloVerifyRequest in two places with common code
pulled into a single function. This one commit handles both places.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd warning about a potential pitfall with WPACKET_allocate_bytes()
Matt Caswell [Wed, 21 Sep 2016 10:20:18 +0000 (11:20 +0100)]
Add warning about a potential pitfall with WPACKET_allocate_bytes()

If the underlying BUF_MEM gets realloc'd then the pointer returned could
become invalid. Therefore we should always ensure that the allocated
memory is filled in prior to any more WPACKET_* calls.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd -Wswitch-enum
Rich Salz [Tue, 30 Aug 2016 17:31:18 +0000 (13:31 -0400)]
Add -Wswitch-enum

Change code so when switching on an enumeration, have case's for all
enumeration values.

Reviewed-by: Andy Polyakov <appro@openssl.org>
3 years agoUpdates CHANGES and NEWS for new release
Matt Caswell [Wed, 21 Sep 2016 20:59:49 +0000 (21:59 +0100)]
Updates CHANGES and NEWS for new release

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoAvoid KCI attack for GOST
Dmitry Belyavsky [Mon, 19 Sep 2016 14:53:35 +0000 (15:53 +0100)]
Avoid KCI attack for GOST

Russian GOST ciphersuites are vulnerable to the KCI attack because they use
long-term keys to establish the connection when ssl client authorization is
on. This change brings the GOST implementation into line with the latest
specs in order to avoid the attack. It should not break backwards
compatibility.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoFix a hang with SSL_peek()
Matt Caswell [Sat, 10 Sep 2016 20:24:40 +0000 (21:24 +0100)]
Fix a hang with SSL_peek()

If while calling SSL_peek() we read an empty record then we go into an
infinite loop, continually trying to read data from the empty record and
never making any progress. This could be exploited by a malicious peer in
a Denial Of Service attack.

CVE-2016-6305

GitHub Issue #1563

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix a mem leak in NPN handling
Matt Caswell [Fri, 9 Sep 2016 09:53:39 +0000 (10:53 +0100)]
Fix a mem leak in NPN handling

If a server sent multiple NPN extensions in a single ClientHello then a
mem leak can occur. This will only happen where the client has requested
NPN in the first place. It does not occur during renegotiation. Therefore
the maximum that could be leaked in a single connection with a malicious
server is 64k (the maximum size of the ServerHello extensions section). As
this is client side, only occurs if NPN has been requested and does not
occur during renegotiation this is unlikely to be exploitable.

Issue reported by Shi Lei.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd some more OCSP testing
Matt Caswell [Tue, 13 Sep 2016 16:02:03 +0000 (17:02 +0100)]
Add some more OCSP testing

Test that the OCSP callbacks work as expected.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd OCSP_RESPID_match()
Matt Caswell [Tue, 13 Sep 2016 22:26:53 +0000 (23:26 +0100)]
Add OCSP_RESPID_match()

Add a function for testing whether a given OCSP_RESPID matches with a
certificate.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoAdd the ability to set OCSP_RESPID fields
Matt Caswell [Mon, 12 Sep 2016 16:39:55 +0000 (17:39 +0100)]
Add the ability to set OCSP_RESPID fields

OCSP_RESPID was made opaque in 1.1.0, but no accessors were provided for
setting the name/key value for the OCSP_RESPID.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix OCSP Status Request extension unbounded memory growth
Matt Caswell [Fri, 9 Sep 2016 09:08:45 +0000 (10:08 +0100)]
Fix OCSP Status Request extension unbounded memory growth

A malicious client can send an excessively large OCSP Status Request
extension. If that client continually requests renegotiation,
sending a large OCSP Status Request extension each time, then there will
be unbounded memory growth on the server. This will eventually lead to a
Denial Of Service attack through memory exhaustion. Servers with a
default configuration are vulnerable even if they do not support OCSP.
Builds using the "no-ocsp" build time option are not affected.

I have also checked other extensions to see if they suffer from a similar
problem but I could not find any other issues.

CVE-2016-6304

Issue reported by Shi Lei.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFix error message typo, wrong function code
Richard Levitte [Thu, 22 Sep 2016 08:15:02 +0000 (10:15 +0200)]
Fix error message typo, wrong function code

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agoExcessive allocation of memory in dtls1_preprocess_fragment()
Matt Caswell [Mon, 19 Sep 2016 10:57:07 +0000 (11:57 +0100)]
Excessive allocation of memory in dtls1_preprocess_fragment()

This issue is very similar to CVE-2016-6307 described in the previous
commit. The underlying defect is different but the security analysis and
impacts are the same except that it impacts DTLS.

A DTLS message includes 3 bytes for its length in the header for the
message.
This would allow for messages up to 16Mb in length. Messages of this length
are excessive and OpenSSL includes a check to ensure that a peer is sending
reasonably sized messages in order to avoid too much memory being consumed
to service a connection. A flaw in the logic of version 1.1.0 means that
memory for the message is allocated too early, prior to the excessive
message length check. Due to way memory is allocated in OpenSSL this could
mean an attacker could force up to 21Mb to be allocated to service a
connection. This could lead to a Denial of Service through memory
exhaustion. However, the excessive message length check still takes place,
and this would cause the connection to immediately fail. Assuming that the
application calls SSL_free() on the failed conneciton in a timely manner
then the 21Mb of allocated memory will then be immediately freed again.
Therefore the excessive memory allocation will be transitory in nature.
This then means that there is only a security impact if:

1) The application does not call SSL_free() in a timely manner in the
event that the connection fails
or
2) The application is working in a constrained environment where there
is very little free memory
or
3) The attacker initiates multiple connection attempts such that there
are multiple connections in a state where memory has been allocated for
the connection; SSL_free() has not yet been called; and there is
insufficient memory to service the multiple requests.

Except in the instance of (1) above any Denial Of Service is likely to
be transitory because as soon as the connection fails the memory is
subsequently freed again in the SSL_free() call. However there is an
increased risk during this period of application crashes due to the lack
of memory - which would then mean a more serious Denial of Service.

This issue does not affect TLS users.

Issue was reported by Shi Lei (Gear Team, Qihoo 360 Inc.).

CVE-2016-6308

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoExcessive allocation of memory in tls_get_message_header()
Matt Caswell [Mon, 19 Sep 2016 10:39:21 +0000 (11:39 +0100)]
Excessive allocation of memory in tls_get_message_header()

A TLS message includes 3 bytes for its length in the header for the message.
This would allow for messages up to 16Mb in length. Messages of this length
are excessive and OpenSSL includes a check to ensure that a peer is sending
reasonably sized messages in order to avoid too much memory being consumed
to service a connection. A flaw in the logic of version 1.1.0 means that
memory for the message is allocated too early, prior to the excessive
message length check. Due to way memory is allocated in OpenSSL this could
mean an attacker could force up to 21Mb to be allocated to service a
connection. This could lead to a Denial of Service through memory
exhaustion. However, the excessive message length check still takes place,
and this would cause the connection to immediately fail. Assuming that the
application calls SSL_free() on the failed conneciton in a timely manner
then the 21Mb of allocated memory will then be immediately freed again.
Therefore the excessive memory allocation will be transitory in nature.
This then means that there is only a security impact if:

1) The application does not call SSL_free() in a timely manner in the
event that the connection fails
or
2) The application is working in a constrained environment where there
is very little free memory
or
3) The attacker initiates multiple connection attempts such that there
are multiple connections in a state where memory has been allocated for
the connection; SSL_free() has not yet been called; and there is
insufficient memory to service the multiple requests.

Except in the instance of (1) above any Denial Of Service is likely to
be transitory because as soon as the connection fails the memory is
subsequently freed again in the SSL_free() call. However there is an
increased risk during this period of application crashes due to the lack
of memory - which would then mean a more serious Denial of Service.

This issue does not affect DTLS users.

Issue was reported by Shi Lei (Gear Team, Qihoo 360 Inc.).

CVE-2016-6307

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoDon't leak on an OPENSSL_realloc() failure
Matt Caswell [Wed, 21 Sep 2016 14:49:28 +0000 (15:49 +0100)]
Don't leak on an OPENSSL_realloc() failure

If OPENSSL_sk_insert() calls OPENSSL_realloc() and it fails, it was leaking
the originally allocated memory.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoDon't allow too many consecutive warning alerts
Matt Caswell [Wed, 21 Sep 2016 13:07:31 +0000 (14:07 +0100)]
Don't allow too many consecutive warning alerts

Certain warning alerts are ignored if they are received. This can mean that
no progress will be made if one peer continually sends those warning alerts.
Implement a count so that we abort the connection if we receive too many.

Issue reported by Shi Lei.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agorand/randfile.c: treat empty string in RAND_file_name as error.
Andy Polyakov [Tue, 20 Sep 2016 15:08:03 +0000 (17:08 +0200)]
rand/randfile.c: treat empty string in RAND_file_name as error.

Suggested in GH#1589.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agorand/randfile.c: rationalize __OpenBSD__ code path.
Andy Polyakov [Tue, 20 Sep 2016 15:06:58 +0000 (17:06 +0200)]
rand/randfile.c: rationalize __OpenBSD__ code path.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agorand/randfile.c: restore fallback to $HOME for non-setuid programs.
Andy Polyakov [Tue, 20 Sep 2016 14:59:32 +0000 (16:59 +0200)]
rand/randfile.c: restore fallback to $HOME for non-setuid programs.

Reported in GH#1589, but solution is different from suggested.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoDcoument -alpn flag
Rich Salz [Wed, 21 Sep 2016 14:59:15 +0000 (10:59 -0400)]
Dcoument -alpn flag

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoGH1555: Don't bump size on realloc failure
Rich Salz [Fri, 9 Sep 2016 14:52:59 +0000 (10:52 -0400)]
GH1555: Don't bump size on realloc failure

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoRevert "Constify code about X509_VERIFY_PARAM"
Rich Salz [Wed, 21 Sep 2016 14:37:03 +0000 (10:37 -0400)]
Revert "Constify code about X509_VERIFY_PARAM"

This reverts commit 81f9ce1e1965e0e33db6d2391285c4c1b6af0434.

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agotest/x509aux.c: Fix argv loop
Richard Levitte [Wed, 21 Sep 2016 12:44:42 +0000 (14:44 +0200)]
test/x509aux.c: Fix argv loop

There are cases when argc is more trustable than proper argv termination.
Since we trust argc in all other test programs, we might as well treat it
the same way in this program.

Reviewed-by: Matt Caswell <matt@openssl.org>
3 years agomake update and fix some associated mis-matched error codes
Matt Caswell [Wed, 21 Sep 2016 13:05:42 +0000 (14:05 +0100)]
make update and fix some associated mis-matched error codes

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoFix a missing NULL check in dsa_builtin_paramgen
Matt Caswell [Wed, 14 Sep 2016 12:27:59 +0000 (13:27 +0100)]
Fix a missing NULL check in dsa_builtin_paramgen

We should check the last BN_CTX_get() call to ensure that it isn't NULL
before we try and use any of the allocated BIGNUMs.

Issue reported by Shi Lei.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoVMS: add [.util]shlib_wrap.exe and its build instructions
Richard Levitte [Tue, 20 Sep 2016 23:47:06 +0000 (01:47 +0200)]
VMS: add [.util]shlib_wrap.exe and its build instructions

This is a program for VMS that corresponds to util/shlib_wrap.sh.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agodescrip.mms.tmpl: in obj2bin, make sure an empty @deps means no empty lines
Richard Levitte [Tue, 20 Sep 2016 23:49:53 +0000 (01:49 +0200)]
descrip.mms.tmpl: in obj2bin, make sure an empty @deps means no empty lines

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoutil/dofile.pl: report if a template couldn't be loaded
Richard Levitte [Tue, 20 Sep 2016 23:49:04 +0000 (01:49 +0200)]
util/dofile.pl: report if a template couldn't be loaded

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoQuiet compiler warning about uninitialised variable
Richard Levitte [Tue, 20 Sep 2016 19:48:24 +0000 (21:48 +0200)]
Quiet compiler warning about uninitialised variable

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRT3669: dgst can only sign/verify one file.
Rich Salz [Fri, 2 Sep 2016 21:34:31 +0000 (17:34 -0400)]
RT3669: dgst can only sign/verify one file.

Check arg count and print an error message.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoapps/apps.c: include sys/socket.h to declare recv()
Richard Levitte [Tue, 20 Sep 2016 16:43:24 +0000 (18:43 +0200)]
apps/apps.c: include sys/socket.h to declare recv()

Reviewed-by: Tim Hudson <tjh@openssl.org>
3 years agoDocumentation fixup; no more ECDHParameters
Richard Levitte [Sun, 18 Sep 2016 21:52:30 +0000 (23:52 +0200)]
Documentation fixup; no more ECDHParameters

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoCrude VMS build files for demos/bio/
Richard Levitte [Thu, 8 Sep 2016 23:53:38 +0000 (01:53 +0200)]
Crude VMS build files for demos/bio/

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoCrude Makefile for demos/bio/
Richard Levitte [Thu, 8 Sep 2016 23:01:30 +0000 (01:01 +0200)]
Crude Makefile for demos/bio/

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoDon't ignore Makefiles in demos/
Richard Levitte [Thu, 8 Sep 2016 23:01:15 +0000 (01:01 +0200)]
Don't ignore Makefiles in demos/

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFixup BIO demos for OpenSSL 1.1.x
Richard Levitte [Fri, 9 Sep 2016 07:32:00 +0000 (09:32 +0200)]
Fixup BIO demos for OpenSSL 1.1.x

Call SSL_CTX_new() before doing any configuration.
(or call OPENSSL_ssl_init())

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFixup BIO demos for OpenSSL 1.1.x
Richard Levitte [Thu, 8 Sep 2016 22:59:00 +0000 (00:59 +0200)]
Fixup BIO demos for OpenSSL 1.1.x

'ECDHParameters = Automatic' isn't accepted.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoFixup BIO demos for OpenSSL 1.1.x
Richard Levitte [Thu, 8 Sep 2016 22:58:21 +0000 (00:58 +0200)]
Fixup BIO demos for OpenSSL 1.1.x

Note: server-cmod doesn't seem to do things right...  from loading
cmod.cnf, it tries to load libssl_conf.so.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoConvert WPACKET_put_bytes to use convenience macros
Matt Caswell [Tue, 20 Sep 2016 13:47:44 +0000 (14:47 +0100)]
Convert WPACKET_put_bytes to use convenience macros

All the other functions that take an argument for the number of bytes
use convenience macros for this purpose. We should do the same with
WPACKET_put_bytes().

Reviewed-by: Rich Salz <rsalz@openssl.org>