openssl.git
2 years agoRe-enable test_ssl_new resumption tests for TLSv1.3
Matt Caswell [Thu, 19 Jan 2017 16:49:57 +0000 (16:49 +0000)]
Re-enable test_ssl_new resumption tests for TLSv1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoRemove a TLS1.3 TODO that is now completed
Matt Caswell [Thu, 19 Jan 2017 16:44:25 +0000 (16:44 +0000)]
Remove a TLS1.3 TODO that is now completed

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoRe-enable TLSv1.3 session resumption related tests in sslapitest
Matt Caswell [Thu, 19 Jan 2017 16:02:27 +0000 (16:02 +0000)]
Re-enable TLSv1.3 session resumption related tests in sslapitest

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoUpdate create_ssl_connection() to make sure its gets a session
Matt Caswell [Thu, 19 Jan 2017 16:00:19 +0000 (16:00 +0000)]
Update create_ssl_connection() to make sure its gets a session

In TLSv1.3 the connection will be created before the session is
established. In OpenSSL we send the NewSessionTicket message immediately
after the client finished has been received. Therefore we change
create_ssl_connection() to attempt a read of application data after the
handshake has completed. We expect this to fail but it will force the
reading of the NewSessionTicket and the session to be set up.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoRe-enable ALPN resumption tests where we are using TLSv1.3
Matt Caswell [Thu, 19 Jan 2017 15:02:16 +0000 (15:02 +0000)]
Re-enable ALPN resumption tests where we are using TLSv1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoAlways ensure that session->cipher is set
Matt Caswell [Thu, 19 Jan 2017 15:01:55 +0000 (15:01 +0000)]
Always ensure that session->cipher is set

If we have deserialized the SSL_SESSION then in some circumstances the
session->cipher value is NULL. We were patching up in some places but not
in others. We should just do it as part of loading the SSL_SESSION.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoTweak a comment
Matt Caswell [Thu, 19 Jan 2017 12:12:35 +0000 (12:12 +0000)]
Tweak a comment

psk_kex_mode stores the available modes - not the one which we selected.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoUse the correct session resumption mechanism
Matt Caswell [Thu, 19 Jan 2017 11:23:06 +0000 (11:23 +0000)]
Use the correct session resumption mechanism

Don't attempt to add a TLS1.3 session to a TLS1.2 ClientHello session
ticket extensions. Similarly don't add a TLS1.2 session to a TLS1.3
psk extension.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoMove session version consistency check
Matt Caswell [Thu, 19 Jan 2017 10:46:53 +0000 (10:46 +0000)]
Move session version consistency check

Make sure the session version consistency check is inside
ssl_get_prev_session(). Also fixes a bug where an inconsistent version can
cause a seg fault in TLSv1.3.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoSet the kex modes on the client too.
Matt Caswell [Thu, 19 Jan 2017 10:07:50 +0000 (10:07 +0000)]
Set the kex modes on the client too.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoImplement server side of PSK extension construction
Matt Caswell [Wed, 18 Jan 2017 17:22:18 +0000 (17:22 +0000)]
Implement server side of PSK extension construction

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoImplement Server side of PSK extension parsing
Matt Caswell [Wed, 18 Jan 2017 16:28:23 +0000 (16:28 +0000)]
Implement Server side of PSK extension parsing

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoMake sure we also cleanse the finished key
Matt Caswell [Wed, 18 Jan 2017 11:52:50 +0000 (11:52 +0000)]
Make sure we also cleanse the finished key

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoProvide a key_share extension finaliser
Matt Caswell [Wed, 18 Jan 2017 11:31:37 +0000 (11:31 +0000)]
Provide a key_share extension finaliser

This mops up various edge cases with key_shares and makes sure we still
generate the handshake secret if we haven't been provided with one but we
have a PSK.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoAdd support for client side parsing of the PSK extension
Matt Caswell [Wed, 18 Jan 2017 09:38:53 +0000 (09:38 +0000)]
Add support for client side parsing of the PSK extension

Requires a refactor of the ServerHello parsing, so that we parse first and
then subsequently process. This is because the resumption information is
held in the extensions block which is parsed last - but we need to know that
information earlier.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoAdd support for the age_add field
Matt Caswell [Tue, 17 Jan 2017 10:43:37 +0000 (10:43 +0000)]
Add support for the age_add field

Update SSL_SESSION to store the age_add and use it where needed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoConstruct the client side psk extension for TLSv1.3
Matt Caswell [Fri, 13 Jan 2017 17:00:49 +0000 (17:00 +0000)]
Construct the client side psk extension for TLSv1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoProvide a new WPACKET function for filling in all the lengths
Matt Caswell [Fri, 13 Jan 2017 16:59:18 +0000 (16:59 +0000)]
Provide a new WPACKET function for filling in all the lengths

For the psk extension we need to fill in all the lengths of the message so
far, even though we haven't closed the WPACKET yet. This provides a function
to do that.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoUpdate the s_client -sess_out feature to work for TLSv1.3
Matt Caswell [Fri, 13 Jan 2017 14:25:15 +0000 (14:25 +0000)]
Update the s_client -sess_out feature to work for TLSv1.3

Previously "-sess_out" wrote out the session as soon as the handshake
finished. In TLSv1.3 this won't work because the NewSessionTicket message
arrives post-handshake. Instead we use the session callback mechanism to
do this.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoNever send a session id in TLS1.3
Matt Caswell [Fri, 13 Jan 2017 13:49:44 +0000 (13:49 +0000)]
Never send a session id in TLS1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoAdd a TODO around handling of SSL_get_session() and SSL_get1_session()
Matt Caswell [Fri, 13 Jan 2017 13:34:49 +0000 (13:34 +0000)]
Add a TODO around handling of SSL_get_session() and SSL_get1_session()

These functions are problematic in TLSv1.3 because the server sends the
NewSessionTicket message after the handshake has finished.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoProcess incoming NewSessionTicket messages on the client side
Matt Caswell [Fri, 13 Jan 2017 13:32:11 +0000 (13:32 +0000)]
Process incoming NewSessionTicket messages on the client side

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoCreate the NewSessionTicket message in TLSv1.3
Matt Caswell [Fri, 13 Jan 2017 09:19:10 +0000 (09:19 +0000)]
Create the NewSessionTicket message in TLSv1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoAdd support for the psk_key_exchange_modes extension
Matt Caswell [Thu, 12 Jan 2017 15:28:48 +0000 (15:28 +0000)]
Add support for the psk_key_exchange_modes extension

This is required for the later addition of resumption support.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoMove TLSv1.3 Session Ticket processing into the state machine
Matt Caswell [Wed, 11 Jan 2017 17:18:19 +0000 (17:18 +0000)]
Move TLSv1.3 Session Ticket processing into the state machine

We still ignore it for now, but at least its in the right place.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoDisable requests for renegotiation in TLSv1.3
Matt Caswell [Wed, 11 Jan 2017 16:29:38 +0000 (16:29 +0000)]
Disable requests for renegotiation in TLSv1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoMove state machine knowledge out of the record layer
Matt Caswell [Tue, 10 Jan 2017 23:02:28 +0000 (23:02 +0000)]
Move state machine knowledge out of the record layer

The record layer was making decisions that should really be left to the
state machine around unexpected handshake messages that are received after
the initial handshake (i.e. renegotiation related messages). This commit
removes that code from the record layer and updates the state machine
accordingly. This simplifies the state machine and paves the way for
handling other messages post-handshake such as the NewSessionTicket in
TLSv1.3.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoRemove use of the SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS flag
Matt Caswell [Tue, 10 Jan 2017 14:58:17 +0000 (14:58 +0000)]
Remove use of the SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS flag

This flag is never set by anything so remove it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoChangeCipherSpec is not allowed in TLSv1.3
Matt Caswell [Fri, 6 Jan 2017 16:22:23 +0000 (16:22 +0000)]
ChangeCipherSpec is not allowed in TLSv1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)

2 years agoRemove annoying and pointless pause.
Ben Laurie [Mon, 2 Jan 2017 18:13:30 +0000 (18:13 +0000)]
Remove annoying and pointless pause.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2167)

2 years agoFix faulty free
Richard Levitte [Sun, 29 Jan 2017 07:52:02 +0000 (08:52 +0100)]
Fix faulty free

On error, i2o_SCT_signature() and i2o_SCT() free a pointer that may
have wandered off from the start of the allocated block (not currently
true for i2o_SCT_signature(), but has that potential as the code may
change.  To avoid this, save away the start of the allocated block and
free that instead.

Thanks to Guido Vranken for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2323)

2 years agotest/evp_test.c: If no algorithm was specified, don't try to check for DES
Richard Levitte [Sat, 28 Jan 2017 23:08:01 +0000 (00:08 +0100)]
test/evp_test.c: If no algorithm was specified, don't try to check for DES

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2319)

2 years agoUpdate client and server corpus
Kurt Roeckx [Sat, 28 Jan 2017 22:03:25 +0000 (23:03 +0100)]
Update client and server corpus

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2318

2 years agoDon't need the checkbox; the hook does it
Rich Salz [Sat, 28 Jan 2017 22:07:08 +0000 (17:07 -0500)]
Don't need the checkbox; the hook does it

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2317)

2 years agoAdd a couple of test to check CRL fingerprint
Richard Levitte [Sat, 28 Jan 2017 17:24:40 +0000 (18:24 +0100)]
Add a couple of test to check CRL fingerprint

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2314)

2 years agoDocument what EXFLAG_SET is for in x509v3.h
Richard Levitte [Sat, 28 Jan 2017 17:02:12 +0000 (18:02 +0100)]
Document what EXFLAG_SET is for in x509v3.h

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2314)

2 years agoX509_CRL_digest() - ensure precomputed sha1 hash before returning it
Richard Levitte [Sat, 28 Jan 2017 16:43:17 +0000 (17:43 +0100)]
X509_CRL_digest() - ensure precomputed sha1 hash before returning it

X509_CRL_digest() didn't check if the precomputed sha1 hash was actually
present.  This also makes sure there's an appropriate flag to check.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2314)

2 years agoCorrect pointer to be freed
Richard Levitte [Sat, 28 Jan 2017 14:14:07 +0000 (15:14 +0100)]
Correct pointer to be freed

The pointer that was freed in the SSLv2 section of ssl_bytes_to_cipher_list
may have stepped up from its allocated position.  Use a pointer that is
guaranteed to point at the start of the allocated block instead.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2312)

2 years agoAvoid over-long strings. Fix a mem leak.
Rich Salz [Thu, 26 Jan 2017 19:42:56 +0000 (14:42 -0500)]
Avoid over-long strings.  Fix a mem leak.

Reviewed-by: Stephen Henson <steve@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2299)

2 years agoAdd server signature algorithm bug test.
Dr. Stephen Henson [Wed, 25 Jan 2017 18:43:13 +0000 (18:43 +0000)]
Add server signature algorithm bug test.

Add a client authentication signature algorithm to simple
ssl test and a server signature algorithm. Since we don't
do client auth this should have no effect. However if we
use client auth signature algorithms by mistake this will
abort the handshake with a no shared signature algorithms
error.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2290)

2 years agoUse correct signature algorithm list when sending or checking.
Dr. Stephen Henson [Wed, 25 Jan 2017 19:12:48 +0000 (19:12 +0000)]
Use correct signature algorithm list when sending or checking.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2290)

2 years agoUpdate CHANGES and NEWS for new release
Matt Caswell [Tue, 24 Jan 2017 16:44:30 +0000 (16:44 +0000)]
Update CHANGES and NEWS for new release

Reviewed-by: Richard Levitte <levitte@openssl.org>
2 years agobn/asm/x86_64-mont5.pl: fix carry bug in bn_sqr8x_internal.
Andy Polyakov [Sat, 21 Jan 2017 20:30:49 +0000 (21:30 +0100)]
bn/asm/x86_64-mont5.pl: fix carry bug in bn_sqr8x_internal.

CVE-2017-3732

Reviewed-by: Rich Salz <rsalz@openssl.org>
2 years agotest/bntest.c: regression test for carry bug in bn_sqr8x_internal.
Andy Polyakov [Sat, 21 Jan 2017 20:28:18 +0000 (21:28 +0100)]
test/bntest.c: regression test for carry bug in bn_sqr8x_internal.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2 years agoDocument DH_check_params()
Richard Levitte [Sun, 15 Jan 2017 17:20:49 +0000 (18:20 +0100)]
Document DH_check_params()

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2 years agoBetter check of DH parameters in TLS data
Richard Levitte [Fri, 30 Dec 2016 20:57:28 +0000 (21:57 +0100)]
Better check of DH parameters in TLS data

When the client reads DH parameters from the TLS stream, we only
checked that they all are non-zero.  This change updates the check to
use DH_check_params()

DH_check_params() is a new function for light weight checking of the p
and g parameters:

    check that p is odd
    check that 1 < g < p - 1

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2 years agocrypto/evp: harden AEAD ciphers.
Andy Polyakov [Wed, 18 Jan 2017 23:20:49 +0000 (00:20 +0100)]
crypto/evp: harden AEAD ciphers.

Originally a crash in 32-bit build was reported CHACHA20-POLY1305
cipher. The crash is triggered by truncated packet and is result
of excessive hashing to the edge of accessible memory. Since hash
operation is read-only it is not considered to be exploitable
beyond a DoS condition. Other ciphers were hardened.

Thanks to Robert Święcki for report.

CVE-2017-3731

Reviewed-by: Rich Salz <rsalz@openssl.org>
2 years agocrypto/evp: harden RC4_MD5 cipher.
Andy Polyakov [Wed, 18 Jan 2017 23:17:30 +0000 (00:17 +0100)]
crypto/evp: harden RC4_MD5 cipher.

Originally a crash in 32-bit build was reported CHACHA20-POLY1305
cipher. The crash is triggered by truncated packet and is result
of excessive hashing to the edge of accessible memory (or bogus
MAC value is produced if x86 MD5 assembly module is involved). Since
hash operation is read-only it is not considered to be exploitable
beyond a DoS condition.

Thanks to Robert Święcki for report.

CVE-2017-3731

Reviewed-by: Rich Salz <rsalz@openssl.org>
2 years agoLimit the length of the encrypted premaster key.
Cory Benfield [Wed, 25 Jan 2017 19:42:16 +0000 (19:42 +0000)]
Limit the length of the encrypted premaster key.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2288)

2 years agoFix small typo
Richard Levitte [Wed, 25 Jan 2017 20:25:53 +0000 (21:25 +0100)]
Fix small typo

In test/ssl_test, parsing ExpectedClientSignHash ended up in the
expected_server_sign_hash field.

Reviewed-by: Stephen Henson <steve@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2289)

2 years agoFix a merge error
Matt Caswell [Wed, 25 Jan 2017 15:17:42 +0000 (15:17 +0000)]
Fix a merge error

Clashing function code values in evp.h

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2285)

2 years agoRemove assert from is_partially_overlapping()
Matt Caswell [Wed, 25 Jan 2017 15:01:43 +0000 (15:01 +0000)]
Remove assert from is_partially_overlapping()

This function is used to validate application supplied parameters. An
assert should be used to check for an error that is internal to OpenSSL.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2275)

2 years agoAdjust in and in_len instead of donelen
Matt Caswell [Wed, 25 Jan 2017 09:26:35 +0000 (09:26 +0000)]
Adjust in and in_len instead of donelen

Don't use the temp variable donelen in the non-aad fragmented code path.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2275)

2 years agoFix the overlapping check for fragmented "Update" operations
Matt Caswell [Tue, 24 Jan 2017 12:57:34 +0000 (12:57 +0000)]
Fix the overlapping check for fragmented "Update" operations

When doing in place encryption the overlapping buffer check can fail
incorrectly where we have done a partial block "Update" operation. This
fixes things to take account of any pending partial blocks.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2275)

2 years agoUpdate evp_test to make sure passing partial block to "Update" is ok
Matt Caswell [Mon, 23 Jan 2017 12:45:33 +0000 (12:45 +0000)]
Update evp_test to make sure passing partial block to "Update" is ok

The previous commit fixed a bug where a partial block had been passed to
an "Update" function and it wasn't properly handled. We should catch this
type of error in evp_test.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2275)

2 years agoProperly handle a partial block in OCB mode
Matt Caswell [Mon, 23 Jan 2017 12:44:48 +0000 (12:44 +0000)]
Properly handle a partial block in OCB mode

If we have previously been passed a partial block in an "Update" call then
make sure we properly increment the output buffer when we use it.

Fixes #2273

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2275)

2 years agoDon't use magic numbers in aes_ocb_cipher()
Matt Caswell [Mon, 23 Jan 2017 12:43:59 +0000 (12:43 +0000)]
Don't use magic numbers in aes_ocb_cipher()

Lots of references to 16 replaced by AES_BLOCK_SIZE. Also a few other style
tweaks in that function

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2275)

2 years agoFix memory leaks in the Certificate extensions code
Matt Caswell [Wed, 25 Jan 2017 14:45:12 +0000 (14:45 +0000)]
Fix memory leaks in the Certificate extensions code

After collecting extensions we must free them again.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2284)

2 years agoFix a few double ;
FdaSilvaYY [Wed, 28 Dec 2016 18:22:25 +0000 (19:22 +0100)]
Fix a few double ;

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1618)

2 years agoTypo, fix a comment
FdaSilvaYY [Sat, 10 Dec 2016 11:44:59 +0000 (12:44 +0100)]
Typo, fix a comment

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1618)

2 years agoStyle
FdaSilvaYY [Fri, 9 Dec 2016 20:17:05 +0000 (21:17 +0100)]
Style

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1618)

2 years agoFix a few misspellings.
FdaSilvaYY [Thu, 17 Nov 2016 22:55:43 +0000 (23:55 +0100)]
Fix a few misspellings.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1618)

2 years agoFix some style and indent issue
FdaSilvaYY [Sat, 24 Sep 2016 11:37:32 +0000 (13:37 +0200)]
Fix some style and indent issue
simplify some code.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1618)

2 years agoFew nit's
FdaSilvaYY [Sat, 24 Sep 2016 11:37:16 +0000 (13:37 +0200)]
Few nit's

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1618)

2 years agoFix some extra or missing whitespaces...
FdaSilvaYY [Tue, 23 Aug 2016 22:17:31 +0000 (00:17 +0200)]
Fix some extra or missing whitespaces...

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1618)

2 years agos_client: Better response success check for CONNECT
Richard Levitte [Wed, 5 Oct 2016 10:37:58 +0000 (12:37 +0200)]
s_client: Better response success check for CONNECT

Instead of looking for "200" and "established" (and failing all other
2xx responses or "Established"), let's look for a line that's not a
header (i.e. doesn't contain a ':') and where the first space is
followed by a '2'.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1664)

2 years agoCleanup EVP_CIPH/EP_CTRL duplicate defines
Todd Short [Mon, 9 Jan 2017 20:29:42 +0000 (15:29 -0500)]
Cleanup EVP_CIPH/EP_CTRL duplicate defines

Remove duplicate defines from EVP source files.
Most of them were in evp.h, which is always included.
Add new ones evp_int.h
EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK is now always defined in evp.h, so
remove conditionals on it

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2201)

2 years agoFix error handling in compute_key, BN_CTX_get can return NULL
Bernd Edlinger [Thu, 22 Dec 2016 12:51:27 +0000 (13:51 +0100)]
Fix error handling in compute_key, BN_CTX_get can return NULL

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2132)

2 years agoDo not overallocate for tmp.ciphers_raw
Benjamin Kaduk [Tue, 24 Jan 2017 16:50:21 +0000 (10:50 -0600)]
Do not overallocate for tmp.ciphers_raw

Well, not as much, at least.

Commit 07afdf3c3ac97af4f2b4eec22a97f7230f8227e0 changed things so
that for SSLv2 format ClientHellos we store the cipher list in the
TLS format, i.e., with two bytes per cipher, to be consistent with
historical behavior.

However, the space allocated for the array still performed the computation
with three bytes per cipher, a needless over-allocation (though a relatively
small one, all things considered).

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2281)

2 years agoAdd support for Poly1305 in EVP_PKEY
Todd Short [Fri, 16 Dec 2016 22:00:43 +0000 (17:00 -0500)]
Add support for Poly1305 in EVP_PKEY

Add Poly1305 as a "signed" digest.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2128)

2 years agoFix SSL_get0_raw_cipherlist()
Matt Caswell [Tue, 24 Jan 2017 11:12:03 +0000 (11:12 +0000)]
Fix SSL_get0_raw_cipherlist()

SSL_get0_raw_cipherlist() was a little too "raw" in the case of an SSLv2
compat ClientHello. In 1.0.2 and below, during version negotiation, if
we received an SSLv2 compat ClientHello but actually wanted to do SSLv3+
then we would construct a "fake" SSLv3+ ClientHello. This "fake" ClientHello
would have its ciphersuite list converted to the SSLv3+ format. It was
this "fake" raw list that got saved away to later be returned by a call to
SSL_get0_raw_cipherlist().

In 1.1.0+ version negotiation works differently and we process an SSLv2
compat ClientHello directly without the need for an intermediary "fake"
ClientHello. This meant that the raw ciphersuite list being saved was in
the SSLv2 format. Any caller of this function would not expect that and
potentially overread the returned buffer by one byte.

Fixes #2189

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2280)

2 years agoAdd missing flags for EVP_chacha20()
Kazuki Yamaguchi [Thu, 29 Dec 2016 15:59:56 +0000 (00:59 +0900)]
Add missing flags for EVP_chacha20()

ChaCha20 code uses its own custom cipher_data. Add EVP_CIPH_CUSTOM_IV
and EVP_CIPH_ALWAYS_CALL_INIT so that the key and the iv can be set by
different calls of EVP_CipherInit_ex().

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2156)

2 years agoFix a ssl session leak due to OOM in lh_SSL_SESSION_insert
Bernd Edlinger [Thu, 22 Dec 2016 19:17:29 +0000 (20:17 +0100)]
Fix a ssl session leak due to OOM in lh_SSL_SESSION_insert

- s == NULL can mean c is a new session *or* lh_insert was
  unable to create a hash entry.
- use lh_SSL_SESSION_retrieve to check for this error condition.
- If it happens simply remove the extra reference again.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2138)

2 years agoRAND_egd_bytes: No need to check RAND_status on connection error.
ganesh [Fri, 11 Nov 2016 03:13:13 +0000 (08:43 +0530)]
RAND_egd_bytes: No need to check RAND_status on connection error.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1886)

2 years agoFixed the return code for RAND_egd_bytes.
ganesh [Thu, 10 Nov 2016 11:16:43 +0000 (16:46 +0530)]
Fixed the return code for RAND_egd_bytes.

According to the documentation, the return code should be -1 when
RAND_status does not return 1.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1886)

2 years agoFixed the return code of RAND_query_egd_bytes when connect fails.
ganesh [Wed, 9 Nov 2016 15:14:22 +0000 (20:44 +0530)]
Fixed the return code of RAND_query_egd_bytes when connect fails.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1886)

2 years agoReplace div-spoiler hack with simpler code
Andy Polyakov [Wed, 18 Jan 2017 17:12:34 +0000 (12:12 -0500)]
Replace div-spoiler hack with simpler code

This comes from a comment in GH issue #1027. Andy wrote the code,
Rich made the PR.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2253)

2 years agoAdd documentation for the key logging callbacks
Cory Benfield [Fri, 20 Jan 2017 16:22:49 +0000 (16:22 +0000)]
Add documentation for the key logging callbacks

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1646)

2 years agoAdd tests for the key logging callbacks.
Cory Benfield [Fri, 20 Jan 2017 16:22:39 +0000 (16:22 +0000)]
Add tests for the key logging callbacks.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1646)

2 years agoAdd support for key logging callbacks.
Cory Benfield [Fri, 20 Jan 2017 16:22:30 +0000 (16:22 +0000)]
Add support for key logging callbacks.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1646)

2 years agoFix no-tls1_2
Richard Levitte [Sat, 21 Jan 2017 13:44:52 +0000 (14:44 +0100)]
Fix no-tls1_2

It seems that the ssl test 20-cert-select.conf dislikes the lack of TLSv1.2

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2268)

2 years agoFix use before assignment
FdaSilvaYY [Wed, 16 Nov 2016 21:46:25 +0000 (22:46 +0100)]
Fix use before assignment

 it was getting the SerialNumber of a previous cert.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2272)

2 years agoExtend the test_ssl_new renegotiation tests to include client auth
Matt Caswell [Tue, 22 Nov 2016 16:55:35 +0000 (16:55 +0000)]
Extend the test_ssl_new renegotiation tests to include client auth

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1982)

2 years agoStop server from expecting Certificate message when not requested
Matt Caswell [Tue, 22 Nov 2016 16:54:28 +0000 (16:54 +0000)]
Stop server from expecting Certificate message when not requested

In a non client-auth renegotiation where the original handshake *was*
client auth, then the server will expect the client to send a Certificate
message anyway resulting in a connection failure.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1982)

2 years agoStop client from sending Certificate message when not requested
Matt Caswell [Tue, 22 Nov 2016 16:39:27 +0000 (16:39 +0000)]
Stop client from sending Certificate message when not requested

In a non client-auth renegotiation where the original handshake *was*
client auth, then the client will send a Certificate message anyway
resulting in a connection failure.

Fixes #1920

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1982)

2 years agoFix SSL_VERIFY_CLIENT_ONCE
Matt Caswell [Tue, 22 Nov 2016 16:23:22 +0000 (16:23 +0000)]
Fix SSL_VERIFY_CLIENT_ONCE

The flag SSL_VERIFY_CLIENT_ONCE is documented as follows:

  B<Server mode:> only request a client certificate on the initial TLS/SSL
  handshake. Do not ask for a client certificate again in case of a
  renegotiation. This flag must be used together with SSL_VERIFY_PEER.

  B<Client mode:> ignored

But the implementation actually did nothing. After the server sends its
ServerKeyExchange message, the code was checking s->session->peer to see if
it is NULL. If it was set then it did not ask for another client
certificate. However s->session->peer will only be set in the event of a
resumption, but a ServerKeyExchange message is only sent in the event of a
full handshake (i.e. no resumption).

The documentation suggests that the original intention was for this to
have an effect on renegotiation, and resumption doesn't come into it.

The fix is to properly check for renegotiation, not whether there is already
a client certificate in the session.

As far as I can tell this has been broken for a *long* time.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1982)

2 years agofix a memory leak in ssl3_generate_key_block fix the error handling in ssl3_change_ci...
Bernd Edlinger [Sun, 1 Jan 2017 00:43:20 +0000 (01:43 +0100)]
fix a memory leak in ssl3_generate_key_block fix the error handling in ssl3_change_cipher_state

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2164)

2 years agoCheck the exit code from the server process
Bernd Edlinger [Tue, 10 Jan 2017 08:22:05 +0000 (09:22 +0100)]
Check the exit code from the server process

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2205)

2 years agopoly1305/poly1305_base2_44.c: clarify shift boundary condition.
Andy Polyakov [Sun, 25 Dec 2016 15:36:43 +0000 (16:36 +0100)]
poly1305/poly1305_base2_44.c: clarify shift boundary condition.

Reviewed-by: Matt Caswell <matt@openssl.org>
2 years agoec/asm/ecp_nistz256-ppc64.pl: minor POWER8-specific optimization.
Andy Polyakov [Thu, 29 Dec 2016 22:42:49 +0000 (23:42 +0100)]
ec/asm/ecp_nistz256-ppc64.pl: minor POWER8-specific optimization.

Up to 4% depending on benchmark.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2 years ago'openssl passwd' command can now compute AIX MD5-based passwords hashes.
Gaétan Njinang [Fri, 20 Jan 2017 05:37:43 +0000 (06:37 +0100)]
'openssl passwd' command can now compute AIX MD5-based passwords hashes.

The difference between the AIX MD5 password algorithm and the standard MD5
password algorithm is that in AIX there is no magic string while in the
standard MD5 password algorithm the magic string is "$1$"

Documentation of '-aixmd5' option of 'openssl passwd' command is added.

1 test is added in test/recipes/20-test-passwd.t

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2251)

2 years agoFix DSA parameter generation control error
Richard Levitte [Wed, 18 Jan 2017 15:19:26 +0000 (16:19 +0100)]
Fix DSA parameter generation control error

When setting the digest parameter for DSA parameter generation, the
signature MD was set instead of the parameter generation one.
Fortunately, that's also the one that was used for parameter
generation, but it ultimately meant the parameter generator MD and the
signature MD would always be the same.

Fixes github issue #2016

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2250)

2 years agoAdd signing hash tests
Dr. Stephen Henson [Sun, 15 Jan 2017 15:59:48 +0000 (15:59 +0000)]
Add signing hash tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2235)

2 years agoAdd options to check TLS signing hashes
Dr. Stephen Henson [Fri, 13 Jan 2017 15:20:42 +0000 (15:20 +0000)]
Add options to check TLS signing hashes

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2235)

2 years agocorrect 3 mistakes
Markus Triska [Wed, 18 Jan 2017 23:07:20 +0000 (00:07 +0100)]
correct 3 mistakes

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2257)

2 years agoSkip ECDH tests for SSLv3
Rich Salz [Mon, 16 Jan 2017 19:30:59 +0000 (14:30 -0500)]
Skip ECDH tests for SSLv3

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1597)

2 years agoIf client doesn't send curves list, don't assume all.
Rich Salz [Mon, 19 Sep 2016 17:09:58 +0000 (13:09 -0400)]
If client doesn't send curves list, don't assume all.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1597)

2 years agoDefines and strings for special salt length values, add tests
Dr. Stephen Henson [Tue, 17 Jan 2017 17:51:24 +0000 (17:51 +0000)]
Defines and strings for special salt length values, add tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2236)

2 years agoadditional PSS tests for -1 and invalid salt length
Dr. Stephen Henson [Mon, 16 Jan 2017 18:07:54 +0000 (18:07 +0000)]
additional PSS tests for -1 and invalid salt length

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2236)

2 years agoAdd support for -1, -2 salt lengths for PSS only keys.
Dr. Stephen Henson [Mon, 16 Jan 2017 16:52:52 +0000 (16:52 +0000)]
Add support for -1, -2 salt lengths for PSS only keys.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2236)