A memory leak can occur in dtls1_buffer_record if either of the calls to
ssl3_setup_buffers or pqueue_insert fail. The former will fail if there is a
malloc failure, whilst the latter will fail if attempting to add a duplicate
record to the queue. This should never happen because duplicate records should
be detected and dropped before any attempt to add them to the queue.
Unfortunately records that arrive that are for the next epoch are not being
recorded correctly, and therefore replays are not being detected.
Additionally, these "should not happen" failures that can occur in
dtls1_buffer_record are not being treated as fatal and therefore an attacker
could exploit this by sending repeated replay records for the next epoch,
eventually causing a DoS through memory exhaustion.

Thanks to Chris Mueller for reporting this issue and providing initial
analysis and a patch. Further analysis and the final patch was performed by
Matt Caswell from the OpenSSL development team.

CVE-2015-0206

Reviewed-by: Dr Stephen Henson <steve@openssl.org>

Unauthenticated DH client certificate fix.

Fix to prevent use of DH client certificates without sending
certificate verify message.

If we've used a client certificate to generate the premaster secret
ssl3_get_client_key_exchange returns 2 and ssl3_get_cert_verify is
never called.

We can only skip the certificate verify message in
ssl3_get_cert_verify if the client didn't send a certificate.

Thanks to Karthikeyan Bhargavan for reporting this issue.
CVE-2015-0205
Reviewed-by: Matt Caswell <matt@openssl.org>

Fix for CVE-2014-3570 (with minor bn_asm.c revamp).

Reviewed-by: Emilia Kasper <emilia@openssl.org>

Follow on from CVE-2014-3571. This fixes the code that was the original source
of the crash due to p being NULL. Steve's fix prevents this situation from
occuring - however this is by no means obvious by looking at the code for
dtls1_get_record. This fix just makes things look a bit more sane.

Reviewed-by: Dr Stephen Henson <steve@openssl.org>

Fix crash in dtls1_get_record whilst in the listen state where you get two
separate reads performed - one for the header and one for the body of the
handshake record.

CVE-2014-3571

Reviewed-by: Matt Caswell <matt@openssl.org>

fix error discrepancy

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix irix-cc build.

Reviewed-by: Matt Caswell <matt@openssl.org>

use correct credit in CHANGES

Reviewed-by: Matt Caswell <matt@openssl.org>

Only inherit the session ID context in SSL_set_SSL_CTX if the existing
context was also inherited (matches that of the existing SSL_CTX).

Reviewed-by: Tim Hudson <tjh@openssl.org>

use correct function name

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

RT3662: Allow leading . in nameConstraints

Change by SteveH from original by John Denker (in the RT)

Reviewed-by: Rich Salz <rsalz@openssl.org>

Some cleanup of L<> markup in pod files

Show only the #define, not the values, in BIO_f_buffer.  Data
abstraction and we can remove a "see also" entry.

Remove internal forward reference to NOTES in EVP_EncryptInit; just
say "see below" as we do in the other pages.

Add missing (3) in pem.pod so the L<> entry is consistent.
Fix entry to point to the "master" page, not the symlink'd one.

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix memory leak.

Fix memory leak by freeing up saved_message.data if it is not NULL.

PR#3489
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

Further comment amendments to preserve formatting prior to source reformat

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove blank line from start of cflags character array in buildinf.h

Reviewed-by: Richard Levitte <levitte@openssl.org>

CHANGES: mention "universal" ARM support.

This is re-commit without unrelated modification.

Reviewed-by: Matt Caswell <matt@openssl.org>

Revert "CHANGES: mention "universal" ARM support."

This reverts commit 4fec91506975f62a2f93be71a46acc7fae7eef45.

Reviewed-by: Matt Caswell <matt@openssl.org>

CHANGES: mention "universal" ARM support.

Reviewed-by: Matt Caswell <matt@openssl.org>

fix compilation error

Reviewed-by: Tim Hudson <tjh@openssl.org>

Only allow ephemeral RSA keys in export ciphersuites.

OpenSSL clients would tolerate temporary RSA keys in non-export
ciphersuites. It also had an option SSL_OP_EPHEMERAL_RSA which
enabled this server side. Remove both options as they are a
protocol violation.

Thanks to Karthikeyan Bhargavan for reporting this issue.
(CVE-2015-0204)
Reviewed-by: Matt Caswell <matt@openssl.org>

ECDH downgrade bug fix.

Fix bug where an OpenSSL client would accept a handshake using an
ephemeral ECDH ciphersuites with the server key exchange message omitted.

Thanks to Karthikeyan Bhargavan for reporting this issue.

CVE-2014-3572
Reviewed-by: Matt Caswell <matt@openssl.org>

RT3546: Remove #define IRIX_CC_BUG

Leftovers from commit 448155e9bbda27cbba365ff549a7e2044a8a399f
Remove now-unused #define's

Reviewed-by: Matt Caswell <matt@openssl.org>

update ordinals

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 31c65a7bc0de7ff1446645d41af388893362f579)

Ensure that the session ID context of an SSL* is updated
when its SSL_CTX is updated.

From BoringSSL commit
https://boringssl.googlesource.com/boringssl/+/a5dc545bbcffd9c24cebe65e9ab5ce72d4535e3a

Reviewed-by: Rich Salz <rsalz@openssl.org>

Constify ASN1_TYPE_cmp add X509_ALGOR_cmp.

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Fix various certificate fingerprint issues.

By using non-DER or invalid encodings outside the signed portion of a
certificate the fingerprint can be changed without breaking the signature.
Although no details of the signed portion of the certificate can be changed
this can cause problems with some applications: e.g. those using the
certificate fingerprint for blacklists.

1. Reject signatures with non zero unused bits.

If the BIT STRING containing the signature has non zero unused bits reject
the signature. All current signature algorithms require zero unused bits.

2. Check certificate algorithm consistency.

Check the AlgorithmIdentifier inside TBS matches the one in the
certificate signature. NB: this will result in signature failure
errors for some broken certificates.

3. Check DSA/ECDSA signatures use DER.

Reencode DSA/ECDSA signatures and compare with the original received
signature. Return an error if there is a mismatch.

This will reject various cases including garbage after signature
(thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
(negative or with leading zeroes).

CVE-2014-8275
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Additional fix required for no-srtp to work

RT3638

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Fix building with no-srtp

RT3638

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add a clang build target for linux-x86_64

This change documents the world as-is, by turning all warnings on,
and then turning warnings that trigger off again.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove inconsistency in ARM support.
This facilitates "universal" builds, ones that target multiple
architectures, e.g. ARMv5 through ARMv7. See commentary in
Configure for details.

Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

ecp_nistz256-x86_64.pl: fix occasional failures.

RT: 3607
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: Emilia Kasper <emilia@openssl.org>

RT2914: NULL check missing in X509_name_canon

Check for NULL return from X509_NAME_ENTRY_new()

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

Remove SGC restart flag.

Reviewed-by: Matt Caswell <matt@openssl.org>

Remove MS SGC

MS Server gated cryptography is obsolete and dates from the time of export
restrictions on strong encryption and is only used by ancient versions of
MSIE.
Reviewed-by: Matt Caswell <matt@openssl.org>

Clear existing extension state.

When parsing ClientHello clear any existing extension state from
SRP login and SRTP profile.

Thanks to Karthikeyan Bhargavan for reporting this issue.
Reviewed-by: Matt Caswell <matt@openssl.org>

typo in s_client

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>

remove duplicate defines

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>

constify tls 1.2 lookup tables.

None of this should live in writable memory

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>

Add missing include of sys/time.h

gettimeofday was undefined

Reviewed-by: Geoff Thorpe <geoff@openssl.org>

mark all block comments that need format preserving so that
indent will not alter them when reformatting comments

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Make "run" volatile

RT#3629

Reviewed-by: Richard Levitte <levitte@openssl.org>

Document openssl dgst -hmac option

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

dlfcn: always define _GNU_SOURCE

We need this for the freebsd kernel with glibc as used in the Debian kfreebsd
ports.  There shouldn't be a problem defining this on systems not using glibc.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix memory leak in the apps

The BIO_free() allocated ex_data again that we already freed.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3548: Remove unsupported platforms

This commit removes DG-UX.
It also flushes out some left-behinds in config.
And regenerates TABLE from Configure (hadn't been done in awhile).

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3548: unsupported platforms

This commit removes Sinix/ReliantUNIX RM400
(And a missed piece of BEOS fluff)

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3548: Remove unsupported platforms.

This commit removes MPE/iX

Reviewed-by: Andy Polyakov <appro@openssl.org>

Improves certificates HOWTO

* adds links to various related documents.
* fixes a few typos.
* rewords a few sentences.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Small typo

Reviewed-by: Stephen Henson <steve@openssl.org>

RT3548: Remvoe unsupported platforms

This commit removes SunOS (a sentimental favorite of mine).

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix incorrect OPENSSL_assert() usage.

Return an error code for I/O errors instead of an assertion failure.

PR#3470
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

RT3548: Remove outdated platforms

This commit removes all mention of NeXT and NextStep.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix a problem if CFLAGS is too long cversion.c fails to compile when config
is run with --strict-warnings.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Made it an error to define OPENSSL_USE_DEPRECATED if OpenSSL has been built
with OPENSSL_NO_DEPRECATED defined

Reviewed-by: Rich Salz <rsalz@openssl.org>

Update CHANGES for deprecated updates

Reviewed-by: Rich Salz <rsalz@openssl.org>

make update following changes to default config settings

Reviewed-by: Rich Salz <rsalz@openssl.org>

Change all instances of OPENSSL_NO_DEPRECATED to OPENSSL_USE_DEPRECATED
Introduce use of DECLARE_DEPRECATED

Reviewed-by: Rich Salz <rsalz@openssl.org>

Remove redundant OPENSSL_NO_DEPRECATED suppression

Reviewed-by: Rich Salz <rsalz@openssl.org>

Turn on OPENSSL_NO_DEPRECATED by default.
Also introduce OPENSSL_USE_DEPRECATED. If OPENSSL_NO_DEPRECATED is
defined at config stage then OPENSSL_USE_DEPRECATED has no effect -
deprecated functions are not available.
If OPENSSL_NO_DEPRECATED is not defined at config stage then
applications must define OPENSSL_USE_DEPRECATED in order to access
deprecated functions.
Also introduce compiler warnings for gcc for applications using
deprecated functions

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT3548: Remove some obsolete platforms

This commit removes Sony NEWS4

Reviewed-by: Richard Levitte <levitte@openssl.org>

Return error when a bit string indicates an invalid amount of bits left

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix yet anoither 'make clean' breakage.

Reviewed-by: Tim Hudson <tjh@openssl.org>

RT3548: Remove some obsolete platforms

This commit removes BEOS.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3544: Restore MWERKS for NetWare

Reviewed-by: Richard Levitte <levitte@openssl.org>

Reject invalid constructed encodings.

According to X6.90 null, object identifier, boolean, integer and enumerated
types can only have primitive encodings: return an error if any of
these are received with a constructed encoding.
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add a comment noting the padding oracle.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Revert "RT3425: constant-time evp_enc"

Causes more problems than it fixes: even though error codes
are not part of the stable API, several users rely on the
specific error code, and the change breaks them. Conversely,
we don't have any concrete use-cases for constant-time behaviour here.

This reverts commit 4aac102f75b517bdb56b1bcfd0a856052d559f6e.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Build fixes

Various build fixes, mostly uncovered by clang's unused-const-variable
and unused-function errors.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit 0e1c318ece3c82e96ae95a34a1badf58198d6b28)

Premaster secret handling fixes

From BoringSSL
- Send an alert when the client key exchange isn't correctly formatted.
- Reject overly short RSA ciphertexts to avoid a (benign) out-of-bounds memory access.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Clear warnings/errors within RL_DEBUG code sections (RL_DEBUG should be renamed)

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within TLS_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within KSSL_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within CIPHER_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within CIPHER_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within BN_CTX_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Check for invalid divisors in BN_div.

Invalid zero-padding in the divisor could cause a division by 0.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit a43bcd9e96c5180e5c6c82164ece643c0097485e)

The dtls1_output_cert_chain function no longer exists so remove it from
ssl_locl.h

Reviewed-by: Tim Hudson <tjh@openssl.org>

Don't set client_version to the ServerHello version.

The client_version needs to be preserved for the RSA key exchange.

This change also means that renegotiation will, like TLS, repeat the old
client_version rather than advertise only the final version. (Either way,
version change on renego is not allowed.) This is necessary in TLS to work
around an SChannel bug, but it's not strictly necessary in DTLS.

(From BoringSSL)

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add more meaningful OPENSSL_NO_ECDH error message for suite b mode

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Rename gost2814789t.c to gost2814789test.c. The old name caused problems
for dummytest if gost is compiled out, since the name of the test is not
standard (dummytest segfaults). Also the old name caused problems for git
because the executable was not in the .gitignore file

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add missing OPENSSL_NO_EC guards

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add OPENSSL_NO_ECDH guards

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Remove extraneous white space, and add some braces

Reviewed-by: Emilia Käsper <emilia@openssl.org>

DTLS fixes for signed/unsigned issues

Reviewed-by: Emilia Käsper <emilia@openssl.org>

RT3497: The ticket that keeps on giving.

Don't remove c_rehash that wasn't created by make; this script
is created by configure.

This fix brought to you by the letter "f" and
Reviewed-by: Emilia Kasper <emilia@openssl.org>

Allow using -SSLv2 again when setting Protocol in the config.

RT#3625

Reviewed-by: Emilia Käsper <emilia@openssl.org>

RT3497: Fix; don't remove header files

Doing 'config ; make clean' broke because clean removed
header files that normal build didn't create.  So don't
remove those files.  Hopefully will be better addressed by
Geoff's no-symlinks patch.

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix unused variable warning

The temporary variable causes unused variable warnings in opt mode with clang,
because the subsequent assert is compiled out.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fixed memory leak if BUF_MEM_grow fails

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

RT1688: Add dependencies for parallel make

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

make update

Reviewed-by: Tim Hudson <tjh@openssl.org>

Minor doc fixes.

In EVP_EncryptInit remove duplicate mention of EVP_idea_cbc()
In EVP_PKEY_CTX_ctrl.pod remove EVP_PKEY_get_default_digest_nid
since it is documented elsewhere.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3497: Clean up "dclean" targets

Some Makefiles had actions for "dclean" that really belonged
to the "clean" target.  This is wrong because clean ends up,
well, not really cleaning everything.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3543: Remove #ifdef LINT

I also replaced some exit/return wrappers in various
programs (from main) to standardize on return.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove old private pod2man

Include Richard's point to remove the 'sh -c' wrapper

Reviewed-by: Richard Levitte <levitte@openssl.org>

capi_ctrl, capi_vtrace: check for NULL after allocating and free it

Reviewed-by: Matt Caswell <matt@openssl.org>

tree_print: check for NULL after allocating err

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

tls1_heartbeat: check for NULL after allocating buf

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

tls1_process_heartbeat: check for NULL after allocating buffer

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

SSL_set_session: check for NULL after allocating s->kssl_ctx->client_princ

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>