openssl.git
3 years agoappveyor.yml: engage VC-WIN64A-masm.
Andy Polyakov [Sun, 19 Feb 2017 21:11:29 +0000 (22:11 +0100)]
appveyor.yml: engage VC-WIN64A-masm.

One of the reasons for why masm/ml64 is not [fully] supported is that
it's problematic to support multiple versions. But latest one usually
works and/or it's lesser problem to make it work. So idea here is to
have a "whistle" when it breaks, so that problems can be evaluated as
they emerge. It's kind of "best effort" thing, as opposite to "full
support".

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoFix memory leak in pkcs12 -export
Dmitry Belyavskiy [Sat, 18 Feb 2017 17:43:01 +0000 (20:43 +0300)]
Fix memory leak in pkcs12 -export

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2676)

3 years agoFix some more memory leaks with TXT_DB_insert.
Bernd Edlinger [Sun, 19 Feb 2017 19:13:45 +0000 (20:13 +0100)]
Fix some more memory leaks with TXT_DB_insert.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2684)

3 years agoFix a few memleaks in TXT_DB.
Bernd Edlinger [Sun, 19 Feb 2017 17:12:03 +0000 (18:12 +0100)]
Fix a few memleaks in TXT_DB.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2684)

3 years agoProvided support for the -nameopt flag in s_client, s_server and s_time
Dmitry Belyavskiy [Tue, 21 Feb 2017 11:22:55 +0000 (14:22 +0300)]
Provided support for the -nameopt flag in s_client, s_server and s_time
commands.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2695)

3 years agoPrevent OOB in SRP base64 code.
Rich Salz [Tue, 21 Feb 2017 18:07:13 +0000 (13:07 -0500)]
Prevent OOB in SRP base64 code.

Change size comparison from > (GT) to >= (GTE) to ensure an additional
byte of output buffer, to prevent OOB reads/writes later in the function
Reject input strings larger than 2GB
Detect invalid output buffer size and return early

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2672)

3 years agoUpdate client, server and x509 fuzz corpus
Kurt Roeckx [Sun, 19 Feb 2017 15:53:50 +0000 (16:53 +0100)]
Update client, server and x509 fuzz corpus

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #2682

3 years agoCheck validity, not just signing for all certificates
Dr. Stephen Henson [Sun, 19 Feb 2017 21:16:46 +0000 (21:16 +0000)]
Check validity, not just signing for all certificates

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2679)

3 years agoAdd no siglags test for ECDSA certificate
Dr. Stephen Henson [Sun, 19 Feb 2017 18:55:26 +0000 (18:55 +0000)]
Add no siglags test for ECDSA certificate

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2679)

3 years agoSet default validity flags.
Dr. Stephen Henson [Sun, 19 Feb 2017 18:47:16 +0000 (18:47 +0000)]
Set default validity flags.

Set default validity flags if signature algorithms extension
is not present. Preserve flags when checking chains.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2679)

3 years agoremove md array: it is not used any more.
Dr. Stephen Henson [Sat, 18 Feb 2017 03:42:15 +0000 (03:42 +0000)]
remove md array: it is not used any more.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2679)

3 years agoRemoved ugly size_t less than zero check.
Hikar [Sat, 18 Feb 2017 07:44:49 +0000 (08:44 +0100)]
Removed ugly size_t less than zero check.

CLA: trivial.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2674)

3 years agoEnsure minsize >= sizeof(SH_LIST)
Pauli [Fri, 17 Feb 2017 00:39:20 +0000 (10:39 +1000)]
Ensure minsize >= sizeof(SH_LIST)

The sh_add_to_list function will overwrite subsequent slots in the free list
for small allocations.  This causes a segmentation fault if the writes goes
off the end of the secure memory.  I've not investigated if this problem
can overwrite memory without the segmentation fault, but it seems likely.

This fix limits the minsize to the sizeof of the SH_LIST structure (which
also has a side effect of properly aligning the pointers).

The alternative would be to return an error if minsize is too small.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2657)

3 years agofix spelling of Camellia in comment
Pauli [Wed, 1 Feb 2017 23:56:47 +0000 (09:56 +1000)]
fix spelling of Camellia in comment

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2337)

3 years agoImplementation of the ARIA cipher as described in RFC 5794.
Pauli [Wed, 1 Feb 2017 00:10:13 +0000 (10:10 +1000)]
Implementation of the ARIA cipher as described in RFC 5794.

This implementation is written in endian agnostic C code. No attempt
at providing machine specific assembly code has been made. This
implementation expands the evptests by including the test cases from
RFC 5794 and ARIA official site rather than providing an individual
test case. Support for ARIA has been integrated into the command line
applications, but not TLS. Implemented modes are CBC, CFB1, CFB8,
CFB128, CTR, ECB and OFB128.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2337)

3 years agoAdded '-nameopt' option to the verify command.
Dmitry Belyavskiy [Thu, 16 Feb 2017 23:06:47 +0000 (02:06 +0300)]
Added '-nameopt' option to the verify command.

It makes possible to print the certificate's DN correctly in case of verification errors.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2656)

3 years agoDon't call memcpy if len is zero.
Rich Salz [Tue, 21 Feb 2017 00:17:53 +0000 (19:17 -0500)]
Don't call memcpy if len is zero.

Prevent undefined behavior in CRYPTO_cbc128_encrypt: calling this function
with the 'len' parameter being 0 would result in a memcpy where the source
and destination parameters are the same, which is undefined behavior.
Do same for AES_ige_encrypt.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2671)

3 years agoRevert "Use memcmp() instead of CRYPTO_memcmp() when fuzzing"
Kurt Roeckx [Mon, 20 Feb 2017 17:27:22 +0000 (18:27 +0100)]
Revert "Use memcmp() instead of CRYPTO_memcmp() when fuzzing"

This reverts commit 3aad8e18707bccaabee5f111de2db0696b45781c.

Reviewed-by: Andy Polyakov <appro@openssl.org>
GH: #2686

3 years ago.travis.yml: remove osx from build matrix.
Andy Polyakov [Sun, 19 Feb 2017 10:16:21 +0000 (11:16 +0100)]
.travis.yml: remove osx from build matrix.

Travis OS X utilization and backlog statistics suggest that it became
bottleneck for our integration builds with requests piling up for days
during working days of the week. Suggestion is to remove osx till
capacity is lesser issue.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoUse memcmp() instead of CRYPTO_memcmp() when fuzzing
Kurt Roeckx [Tue, 14 Feb 2017 23:36:46 +0000 (00:36 +0100)]
Use memcmp() instead of CRYPTO_memcmp() when fuzzing

Reviewed-by: Andy Polyakov <appro@openssl.org>
GH: #2633

3 years agoInternal siphash tests are not run.
Todd Short [Thu, 16 Feb 2017 14:09:39 +0000 (09:09 -0500)]
Internal siphash tests are not run.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2649)

3 years agoVMS fix of test/recipes/80-test_ssl_new.t
Richard Levitte [Sat, 18 Feb 2017 21:41:27 +0000 (22:41 +0100)]
VMS fix of test/recipes/80-test_ssl_new.t

On VMS, file names with more than one period get all but the last get
escaped with a ^, so 21-key-update.conf.in becomes 21-key-update^.conf.in
That means that %conf_dependent_tests and %skip become useless unless
we massage the file names that are used as indexes.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2678)

3 years agoFix no-dh and no-dsa
Richard Levitte [Sun, 19 Feb 2017 05:59:33 +0000 (06:59 +0100)]
Fix no-dh and no-dsa

Since 20-cert-select.conf will vary depending in no-dh and no-dsa,
don't check it against original when those options are selected

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2680)

3 years agoIf all versions of a proto are disabled, disabled the proto as well
Richard Levitte [Fri, 17 Feb 2017 19:48:28 +0000 (20:48 +0100)]
If all versions of a proto are disabled, disabled the proto as well

For example, 'no-dtls1 no-dtls1_2' will imply 'no-dtls'

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2670)

3 years agotest/README: clarify last test number group
Andy Polyakov [Fri, 17 Feb 2017 09:49:04 +0000 (10:49 +0100)]
test/README: clarify last test number group

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoExplicitly disallow DSA for TLS 1.3
Dr. Stephen Henson [Fri, 17 Feb 2017 16:08:19 +0000 (16:08 +0000)]
Explicitly disallow DSA for TLS 1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2667)

3 years agoadd DSA cert tests
Dr. Stephen Henson [Fri, 17 Feb 2017 15:28:36 +0000 (15:28 +0000)]
add DSA cert tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2667)

3 years agoAdd DH parameters, DSA cert and key
Dr. Stephen Henson [Fri, 17 Feb 2017 14:36:06 +0000 (14:36 +0000)]
Add DH parameters, DSA cert and key

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2667)

3 years agoAdd DSA support to mkcert.sh
Dr. Stephen Henson [Fri, 17 Feb 2017 14:44:59 +0000 (14:44 +0000)]
Add DSA support to mkcert.sh

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2667)

3 years agoAdd and use function test_pem to work out test filenames.
Dr. Stephen Henson [Thu, 16 Feb 2017 15:27:49 +0000 (15:27 +0000)]
Add and use function test_pem to work out test filenames.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2667)

3 years agoFix a slightly confusing if condition in a2i_ASN1_INTEGER.
Bernd Edlinger [Wed, 15 Feb 2017 19:01:53 +0000 (20:01 +0100)]
Fix a slightly confusing if condition in a2i_ASN1_INTEGER.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2640)

3 years agoFix a merge error
Matt Caswell [Fri, 17 Feb 2017 14:33:30 +0000 (14:33 +0000)]
Fix a merge error

Fix an error code clash due to a merge

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2665)

3 years agoFix test_x509_store
Richard Levitte [Fri, 17 Feb 2017 13:59:44 +0000 (14:59 +0100)]
Fix test_x509_store

Don't run this test unless 'openssl rehash' works properly.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2664)

3 years agoFix symbol shadow
Richard Levitte [Fri, 17 Feb 2017 13:31:51 +0000 (14:31 +0100)]
Fix symbol shadow

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2663)

3 years agoUpdates following review feedback
Matt Caswell [Thu, 16 Feb 2017 17:09:28 +0000 (17:09 +0000)]
Updates following review feedback

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoDon't use an enum in the return type for a public API function
Matt Caswell [Thu, 16 Feb 2017 17:04:40 +0000 (17:04 +0000)]
Don't use an enum in the return type for a public API function

We use an int instead. That means SSL_key_update() also should use an int.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoAdd some KeyUpdate tests
Matt Caswell [Wed, 15 Feb 2017 09:25:52 +0000 (09:25 +0000)]
Add some KeyUpdate tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoAdd documentation for SSL_key_update() and SSL_get_key_update_type()
Matt Caswell [Tue, 14 Feb 2017 15:25:22 +0000 (15:25 +0000)]
Add documentation for SSL_key_update() and SSL_get_key_update_type()

This also adds documentation for the pre-existing and related
SSL_renegotiate*() functions.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoFix a shadowed global variable warning
Matt Caswell [Tue, 14 Feb 2017 11:48:24 +0000 (11:48 +0000)]
Fix a shadowed global variable warning

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoUpdates following review feedback
Matt Caswell [Tue, 14 Feb 2017 11:20:44 +0000 (11:20 +0000)]
Updates following review feedback

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoLimit the number of KeyUpdate messages we can process
Matt Caswell [Mon, 13 Feb 2017 11:55:38 +0000 (11:55 +0000)]
Limit the number of KeyUpdate messages we can process

Too many KeyUpdate message could be inicative of a problem (e.g. an
infinite KeyUpdate loop if the peer always responds to a KeyUpdate message
with an "update_requested" KeyUpdate response), or (conceivably) an attack.
Either way we limit the number of KeyUpdate messages we are prepared to
handle.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoActually update the keys when a KeyUpdate message is sent or received
Matt Caswell [Fri, 10 Feb 2017 17:43:09 +0000 (17:43 +0000)]
Actually update the keys when a KeyUpdate message is sent or received

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoIf we receive an "update_requested" KeyUpdate then respond with a KeyUpdate
Matt Caswell [Thu, 9 Feb 2017 16:00:12 +0000 (16:00 +0000)]
If we receive an "update_requested" KeyUpdate then respond with a KeyUpdate

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoAdd the ability for a server to receive a KeyUpdate message
Matt Caswell [Thu, 9 Feb 2017 15:29:45 +0000 (15:29 +0000)]
Add the ability for a server to receive a KeyUpdate message

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoAdd the ability for s_client to send a KeyUpdate message
Matt Caswell [Thu, 9 Feb 2017 13:33:09 +0000 (13:33 +0000)]
Add the ability for s_client to send a KeyUpdate message

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoAdd a SSL_get_key_update_type() function
Matt Caswell [Thu, 9 Feb 2017 15:05:46 +0000 (15:05 +0000)]
Add a SSL_get_key_update_type() function

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoAdd the ability for a client to send a KeyUpdate message
Matt Caswell [Thu, 9 Feb 2017 13:12:00 +0000 (13:12 +0000)]
Add the ability for a client to send a KeyUpdate message

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoAdd the ability for a client to receive a KeyUpdate message
Matt Caswell [Thu, 9 Feb 2017 12:07:31 +0000 (12:07 +0000)]
Add the ability for a client to receive a KeyUpdate message

This just receives the message. It doesn't actually update any keys yet.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoAdd SSL_trace() support for KeyUpdate messages
Matt Caswell [Wed, 8 Feb 2017 17:08:48 +0000 (17:08 +0000)]
Add SSL_trace() support for KeyUpdate messages

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoAdd a capability to s_server to send KeyUpdate messages
Matt Caswell [Wed, 8 Feb 2017 16:52:23 +0000 (16:52 +0000)]
Add a capability to s_server to send KeyUpdate messages

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoProvide a function to send a KeyUpdate message
Matt Caswell [Wed, 8 Feb 2017 09:15:22 +0000 (09:15 +0000)]
Provide a function to send a KeyUpdate message

This implements the server side KeyUpdate sending capability as well.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)

3 years agoFix typo in x86_64-mont5.pl CFI directives
David Benjamin [Thu, 16 Feb 2017 22:39:40 +0000 (17:39 -0500)]
Fix typo in x86_64-mont5.pl CFI directives

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2655)

3 years agoAdd a test of the X509_STORE / X509_LOOKUP API
Richard Levitte [Thu, 16 Feb 2017 20:07:33 +0000 (21:07 +0100)]
Add a test of the X509_STORE / X509_LOOKUP API

Fortunately, "openssl verify" makes good use of that API

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2652)

3 years agotest/README: clarify test number groups
Richard Levitte [Thu, 16 Feb 2017 20:06:42 +0000 (21:06 +0100)]
test/README: clarify test number groups

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2652)

3 years agoFix a mem leak in ssl_test_ctx.c
Matt Caswell [Thu, 16 Feb 2017 14:47:26 +0000 (14:47 +0000)]
Fix a mem leak in ssl_test_ctx.c

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2650)

3 years agoAdd client auth TLS 1.3 certificate selection tests
Dr. Stephen Henson [Wed, 15 Feb 2017 22:16:09 +0000 (22:16 +0000)]
Add client auth TLS 1.3 certificate selection tests

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2643)

3 years agoAdd ECDSA client certificates
Dr. Stephen Henson [Wed, 15 Feb 2017 22:03:04 +0000 (22:03 +0000)]
Add ECDSA client certificates

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2643)

3 years agoUse tls_choose_sigalg for client auth.
Dr. Stephen Henson [Wed, 15 Feb 2017 16:23:49 +0000 (16:23 +0000)]
Use tls_choose_sigalg for client auth.

For client auth call tls_choose_sigalg to select the certificate
and signature algorithm. Use the selected algorithm in
tls_construct_cert_verify.

Remove obsolete tls12_get_sigandhash.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2643)

3 years agoAdd client side support to tls_choose_sigalg.
Dr. Stephen Henson [Wed, 15 Feb 2017 16:19:43 +0000 (16:19 +0000)]
Add client side support to tls_choose_sigalg.

Select appropriate signature algorithm and certificate for client
authentication using tls_choose_sigalg.

A lot of selection logic is very similar except not finding a
certificate is not a fatal error: we just do not present a
certificate.

For TLS 1.2 and earlier we only check the current certificate
is suitable (for compatibility with previous logic) for TLS 1.3
(where there are no compatibility issues) we support multiple
client certificates for different algorithms.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2643)

3 years agoChange req_check_len error message, it also accepts 20 bytes, but states 'less than...
lrns [Thu, 16 Feb 2017 11:27:55 +0000 (12:27 +0100)]
Change req_check_len error message, it also accepts 20 bytes, but states 'less than' in the error message

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2648)

3 years agoUse _WIN32 over WIN32 for preprocessor conditional
Benjamin Kaduk [Thu, 29 Dec 2016 17:38:24 +0000 (11:38 -0600)]
Use _WIN32 over WIN32 for preprocessor conditional

The intent seems to be that the WIN32 symbol is for things that are a direct
byproduct of being a windows-variant configuration and should be used for
feature en/disablement on windows systems.  Use of the _WIN32 symbol is more
widespread, being used to implement platform portability of more generic code.

We do define WIN32 in some situations in e_os.h, but that is not included
universally.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2642)

3 years agoUpdate CHANGES and NEWS for new release
Matt Caswell [Thu, 16 Feb 2017 09:51:56 +0000 (09:51 +0000)]
Update CHANGES and NEWS for new release

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoRemove an OPENSSL_assert() and replace with a soft assert and check
Matt Caswell [Fri, 3 Feb 2017 14:45:49 +0000 (14:45 +0000)]
Remove an OPENSSL_assert() and replace with a soft assert and check

Following on from CVE-2017-3733, this removes the OPENSSL_assert() check
that failed and replaces it with a soft assert, and an explicit check of
value with an error return if it fails.

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoDon't change the state of the ETM flags until CCS processing
Matt Caswell [Fri, 3 Feb 2017 14:06:20 +0000 (14:06 +0000)]
Don't change the state of the ETM flags until CCS processing

In 1.1.0 changing the ciphersuite during a renegotiation can result in
a crash leading to a DoS attack. In master this does not occur with TLS
(instead you get an internal error, which is still wrong but not a security
issue) - but the problem still exists in the DTLS code.

The problem is caused by changing the flag indicating whether to use ETM
or not immediately on negotiation of ETM, rather than at CCS. Therefore,
during a renegotiation, if the ETM state is changing (usually due to a
change of ciphersuite), then an error/crash will occur.

Due to the fact that there are separate CCS messages for read and write
we actually now need two flags to determine whether to use ETM or not.

CVE-2017-3733

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoProvide a test for the Encrypt-Then-Mac renegotiation crash
Matt Caswell [Fri, 3 Feb 2017 11:21:07 +0000 (11:21 +0000)]
Provide a test for the Encrypt-Then-Mac renegotiation crash

In 1.1.0 changing the ciphersuite during a renegotiation can result in
a crash leading to a DoS attack. In master this does not occur with TLS
(instead you get an internal error, which is still wrong but not a security
issue) - but the problem still exists in the DTLS code.

This commit provides a test for the issue.

CVE-2017-3733

Reviewed-by: Richard Levitte <levitte@openssl.org>
3 years agoFix warning
Dr. Stephen Henson [Thu, 16 Feb 2017 01:29:14 +0000 (01:29 +0000)]
Fix warning

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2644)

3 years agoHandle negative reply for NNTP STARTTLS in s_client
Robert Scheck [Tue, 14 Feb 2017 20:47:25 +0000 (21:47 +0100)]
Handle negative reply for NNTP STARTTLS in s_client

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2629)

3 years agoProperly zero cipher_data for ChaCha20-Poly1305 on cleanup
Kazuki Yamaguchi [Thu, 26 Jan 2017 04:01:30 +0000 (13:01 +0900)]
Properly zero cipher_data for ChaCha20-Poly1305 on cleanup

Fix a typo. Probably this has not been found because EVP_CIPHER_CTX is
smaller than EVP_CHACHA_AEAD_CTX and heap overflow does not occur.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2294)

3 years agocrypto/armcap.c: short-circuit processor capability probe in iOS builds.
Andy Polyakov [Wed, 15 Feb 2017 11:01:09 +0000 (12:01 +0100)]
crypto/armcap.c: short-circuit processor capability probe in iOS builds.

Capability probing by catching SIGILL appears to be problematic
on iOS. But since Apple universe is "monocultural", it's actually
possible to simply set pre-defined processor capability mask.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2617)

3 years agoARMv4 assembly pack: harmonize Thumb-ification of iOS build.
Andy Polyakov [Mon, 13 Feb 2017 17:16:16 +0000 (18:16 +0100)]
ARMv4 assembly pack: harmonize Thumb-ification of iOS build.

Three modules were left behind in a285992763f3961f69a8d86bf7dfff020a08cef9.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2617)

3 years agoSet current certificate to selected certificate.
Dr. Stephen Henson [Wed, 15 Feb 2017 15:28:56 +0000 (15:28 +0000)]
Set current certificate to selected certificate.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2637)

3 years agosha/asm/*-x86_64.pl: add CFI annotations.
Andy Polyakov [Mon, 13 Feb 2017 21:34:51 +0000 (22:34 +0100)]
sha/asm/*-x86_64.pl: add CFI annotations.

Reviewed-by: Rich Salz <rsalz@openssl.org>
3 years agoRework error handling of custom_ext_meth_add towards strong exception safety.
Bernd Edlinger [Wed, 15 Feb 2017 10:36:17 +0000 (11:36 +0100)]
Rework error handling of custom_ext_meth_add towards strong exception safety.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2636)

3 years agoFix merge issue
Matt Caswell [Wed, 15 Feb 2017 09:44:46 +0000 (09:44 +0000)]
Fix merge issue

Causes make update to fail.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2634)

3 years agoSkip curve check if sigalg doesn't specify a curve.
Dr. Stephen Henson [Tue, 14 Feb 2017 14:27:15 +0000 (14:27 +0000)]
Skip curve check if sigalg doesn't specify a curve.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)

3 years agoUse CERT_PKEY pointer instead of index
Dr. Stephen Henson [Tue, 14 Feb 2017 00:35:26 +0000 (00:35 +0000)]
Use CERT_PKEY pointer instead of index

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)

3 years agoSimplify tls_construct_server_key_exchange
Dr. Stephen Henson [Mon, 13 Feb 2017 18:07:00 +0000 (18:07 +0000)]
Simplify tls_construct_server_key_exchange

Use negotiated signature algorithm and certificate index in
tls_construct_key_exchange instead of recalculating it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)

3 years agoUse cert_index and sigalg
Dr. Stephen Henson [Mon, 13 Feb 2017 16:32:06 +0000 (16:32 +0000)]
Use cert_index and sigalg

Now the certificate and signature algorithm is set in one place we
can use it directly insetad of recalculating it. The old functions
ssl_get_server_send_pkey() and ssl_get_server_cert_index() are no
longer required.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)

3 years agoAdd sigalg for earlier TLS versions
Dr. Stephen Henson [Mon, 13 Feb 2017 16:04:07 +0000 (16:04 +0000)]
Add sigalg for earlier TLS versions

Update tls_choose_sigalg to choose a signature algorithm for all
versions of TLS not just 1.3.

For TLS 1.2 we choose the highest preference signature algorithm
for the chosen ciphersuite.

For TLS 1.1 and earlier the signature algorithm is determined by
the ciphersuite alone. For RSA we use a special MD5+SHA1 signature
algorithm.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)

3 years agoChange tls_choose_sigalg so it can set errors and alerts.
Dr. Stephen Henson [Mon, 13 Feb 2017 15:50:43 +0000 (15:50 +0000)]
Change tls_choose_sigalg so it can set errors and alerts.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)

3 years agoadd ssl_has_cert
Dr. Stephen Henson [Mon, 13 Feb 2017 15:40:21 +0000 (15:40 +0000)]
add ssl_has_cert

Add inline function ssl_has_cert which checks to see if a certificate and
private key for a given index are not NULL.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)

3 years agoFix a few typos
FdaSilvaYY [Mon, 6 Feb 2017 23:05:06 +0000 (00:05 +0100)]
Fix a few typos
[skip ci]

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2571)

3 years agoRemove obsolete comment
Guido Vranken [Sat, 11 Feb 2017 21:41:38 +0000 (22:41 +0100)]
Remove obsolete comment

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1613)

3 years agoPrevents that OPENSSL_gmtime incorrectly signals success if gmtime_r fails, and that...
Guido Vranken [Thu, 22 Sep 2016 20:48:44 +0000 (22:48 +0200)]
Prevents that OPENSSL_gmtime incorrectly signals success if gmtime_r fails, and that struct* tm result's possibly uninitialized content is used

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1613)

3 years agoUse TLSEXT_KEYNAME_LENGTH in tls_decrypt_ticket.
Bernd Edlinger [Mon, 13 Feb 2017 17:36:13 +0000 (18:36 +0100)]
Use TLSEXT_KEYNAME_LENGTH in tls_decrypt_ticket.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2618)

3 years agoPrevent allocations of size 0 in sh_init, which are not possible with the default...
Guido Vranken [Mon, 13 Feb 2017 00:36:43 +0000 (01:36 +0100)]
Prevent allocations of size 0 in sh_init, which are not possible with the default OPENSSL_zalloc, but are possible if the user has installed their own allocator using CRYPTO_set_mem_functions. If the 0-allocations succeeds, the secure heap code will later access (at least) the first byte of that space, which is technically an OOB access. This could lead to problems with some custom allocators that only return a valid pointer for subsequent free()-ing, and do not expect that the pointer is actually dereferenced.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2605)

3 years agoAdd Sieve support (RFC 5804) to s_client ("-starttls sieve")
Robert Scheck [Thu, 9 Feb 2017 21:20:59 +0000 (22:20 +0100)]
Add Sieve support (RFC 5804) to s_client ("-starttls sieve")

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2300)

3 years agoAdd no-ec build
Rich Salz [Tue, 14 Feb 2017 16:51:22 +0000 (11:51 -0500)]
Add no-ec build

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2626)

3 years agoMake -xcert work again.
Dr. Stephen Henson [Tue, 14 Feb 2017 17:18:00 +0000 (17:18 +0000)]
Make -xcert work again.

When a certificate is prepended update the list pointer.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2628)

3 years agoFix no-ec compilation
Matt Caswell [Tue, 14 Feb 2017 15:57:50 +0000 (15:57 +0000)]
Fix no-ec compilation

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2624)

3 years agoRemove a double call to ssl3_send_alert()
Matt Caswell [Wed, 8 Feb 2017 17:27:09 +0000 (17:27 +0000)]
Remove a double call to ssl3_send_alert()

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)

3 years agoFix a bogus uninit variable warning
Matt Caswell [Wed, 8 Feb 2017 17:16:25 +0000 (17:16 +0000)]
Fix a bogus uninit variable warning

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)

3 years agoAdd a bytestogroup macro
Matt Caswell [Mon, 6 Feb 2017 16:52:38 +0000 (16:52 +0000)]
Add a bytestogroup macro

For converting the 2 byte group id into an unsigned int.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)

3 years agoVarious style fixes following review feedback
Matt Caswell [Mon, 6 Feb 2017 16:47:29 +0000 (16:47 +0000)]
Various style fixes following review feedback

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)

3 years agoUpdate the tls13messages test to add some HRR scenarios
Matt Caswell [Thu, 2 Feb 2017 16:28:45 +0000 (16:28 +0000)]
Update the tls13messages test to add some HRR scenarios

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)

3 years agoUpdate the kex modes tests to check various HRR scenarios
Matt Caswell [Thu, 2 Feb 2017 16:06:50 +0000 (16:06 +0000)]
Update the kex modes tests to check various HRR scenarios

Make sure we get an HRR in the right circumstances based on kex mode.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)

3 years agoUpdate TLSProxy to know about HelloRetryRequest messages
Matt Caswell [Thu, 2 Feb 2017 16:06:28 +0000 (16:06 +0000)]
Update TLSProxy to know about HelloRetryRequest messages

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)

3 years agoUpdate test counting in checkhandshake.pm
Matt Caswell [Thu, 2 Feb 2017 14:54:24 +0000 (14:54 +0000)]
Update test counting in checkhandshake.pm

Previously counting the number of tests in checkhandshake.pm took an
initial guess and then modified it based on various known special
cases. That is becoming increasingly untenable, so this changes it to
properly calculate the number of tests we expect to run.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)

3 years agoUpdate the key_share tests for HelloRetryRequest
Matt Caswell [Thu, 2 Feb 2017 13:12:08 +0000 (13:12 +0000)]
Update the key_share tests for HelloRetryRequest

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)

3 years agoAdd trace support for HelloRetryRequest
Matt Caswell [Thu, 2 Feb 2017 11:16:25 +0000 (11:16 +0000)]
Add trace support for HelloRetryRequest

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)