oweals/openssl.git
6 years agoX509_cmp_time: only return 1, 0, -1.
Emilia Kasper [Mon, 18 Dec 2017 17:41:05 +0000 (18:41 +0100)]
X509_cmp_time: only return 1, 0, -1.

The behaviour of X509_cmp_time used to be undocumented.

The new behaviour, documented in master, is to return only 0, 1, or -1.
Make the code in the other branches to adhere to this behaviour too,
to reduce confusion. There is nothing to be gained from returning
other values.

Fixes GH#4954

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4955)

(cherry picked from commit 48345917747a34feea3da2936994a265c7f2ca11)

6 years agoCorrect the check of RSA_FLAG_SIGN_VER
John Eichenberger [Tue, 3 Apr 2018 23:08:31 +0000 (16:08 -0700)]
Correct the check of RSA_FLAG_SIGN_VER

The wrong flags were being tested. It is the rsa->meth flags not the rsa
flags that should be tested.

wpa_supplicant has a bit of code that
1. Allocates and defines a RSA_METHOD structure.
2. calls RSA_new();
3. calls RSA_set_method().

In current versions of that code the rsa_sign and rsa_verify members of
the RSA_METHOD structure are not defined, thus making it compatible
with the really old versions of OpenSSL.

But should one change it use the rsa_sign method one must set the
RSA_FLAG_SIGN_VER bit of the RSA_METHOD structure to indicate that
one or both of those new methods are required.  In doing so, OpenSSL
will not call the new methods, not without this change.

CLA: trivial

Change-Id: I6e65a80f21399f25e966466ff676e3b21f85f360

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5971)

6 years agoUpdate fingerprints.txt
Matt Caswell [Tue, 17 Apr 2018 12:40:07 +0000 (13:40 +0100)]
Update fingerprints.txt

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5988)

6 years agoIgnore the status_request extension in a resumption handshake
Matt Caswell [Fri, 6 Apr 2018 13:33:07 +0000 (14:33 +0100)]
Ignore the status_request extension in a resumption handshake

We cannot provide a certificate status on a resumption so we should
ignore this extension in that case.

Fixes #1662

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5898)

6 years agoRSA key generation: ensure BN_mod_inverse and BN_mod_exp_mont both get called with...
Billy Brumley [Wed, 11 Apr 2018 07:10:58 +0000 (10:10 +0300)]
RSA key generation: ensure BN_mod_inverse and BN_mod_exp_mont both get called with BN_FLG_CONSTTIME flag set.

CVE-2018-0737

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 6939eab03a6e23d2bd2c3f5e34fe1d48e542e787)

6 years agoClarify default section in config.pod
Daniel Bevenius [Thu, 12 Apr 2018 11:39:37 +0000 (13:39 +0200)]
Clarify default section in config.pod

This is a minor update which hopefully makes these particular lines
read a little easier.

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5938)

(cherry picked from commit 0652e8a7fe6dd8cbdf4516b221642b10bbfc68fe)
(cherry picked from commit 9e8554fca5019b81ed7659d97f103f388ea3a2bf)

6 years agoUpdated to CONTRIBUTING to reflect GitHub, etc.
Rich Salz [Sat, 7 Apr 2018 17:09:15 +0000 (13:09 -0400)]
Updated to CONTRIBUTING to reflect GitHub, etc.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5889)

(cherry picked from commit 2876872ffe5dd53ec1c446656e924ff463e5d4bf)

6 years agoUpdate the genpkey documentation
Matt Caswell [Thu, 29 Mar 2018 20:02:20 +0000 (21:02 +0100)]
Update the genpkey documentation

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5884)

6 years agoPick a q size consistent with the digest for DSA param generation
Matt Caswell [Thu, 29 Mar 2018 16:49:17 +0000 (17:49 +0100)]
Pick a q size consistent with the digest for DSA param generation

There are two undocumented DSA parameter generation options available in
the genpkey command line app:
dsa_paramgen_md and dsa_paramgen_q_bits.

These can also be accessed via the EVP API but only by using
EVP_PKEY_CTX_ctrl() or EVP_PKEY_CTX_ctrl_str() directly. There are no
helper macros for these options.

dsa_paramgen_q_bits sets the length of q in bits (default 160 bits).
dsa_paramgen_md sets the digest that is used during the parameter
generation (default SHA1). In particular the output length of the digest
used must be equal to or greater than the number of bits in q because of
this code:

            if (!EVP_Digest(seed, qsize, md, NULL, evpmd, NULL))
                goto err;
            if (!EVP_Digest(buf, qsize, buf2, NULL, evpmd, NULL))
                goto err;
            for (i = 0; i < qsize; i++)
                md[i] ^= buf2[i];

            /* step 3 */
            md[0] |= 0x80;
            md[qsize - 1] |= 0x01;
            if (!BN_bin2bn(md, qsize, q))
                goto err;

qsize here is the number of bits in q and evpmd is the digest set via
dsa_paramgen_md. md and buf2 are buffers of length SHA256_DIGEST_LENGTH.
buf2 has been filled with qsize bits of random seed data, and md is
uninitialised.

If the output size of evpmd is less than qsize then the line "md[i] ^=
buf2[i]" will be xoring an uninitialised value and the random seed data
together to form the least significant bits of q (and not using the
output of the digest at all for those bits) - which is probably not what
was intended. The same seed is then used as an input to generating p. If
the uninitialised data is actually all zeros (as seems quite likely)
then the least significant bits of q will exactly match the least
significant bits of the seed.

This problem only occurs if you use these undocumented and difficult to
find options and you set the size of q to be greater than the message
digest output size. This is for parameter generation only not key
generation. This scenario is considered highly unlikely and
therefore the security risk of this is considered negligible.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5884)

6 years agoDon't crash if an unrecognised digest is used with dsa_paramgen_md
Matt Caswell [Thu, 29 Mar 2018 16:48:28 +0000 (17:48 +0100)]
Don't crash if an unrecognised digest is used with dsa_paramgen_md

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5884)

6 years agoChange the "offset too large" message to more generic wording
Bernd Edlinger [Mon, 2 Apr 2018 08:54:52 +0000 (10:54 +0200)]
Change the "offset too large" message to more generic wording

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5826)

(cherry picked from commit 1518c55a796b058eff01f3cbf177f4b726c01d7c)

6 years agoFix range checks with -offset and -length in asn1parse
Bernd Edlinger [Mon, 2 Apr 2018 07:13:49 +0000 (09:13 +0200)]
Fix range checks with -offset and -length in asn1parse

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5826)

(cherry picked from commit 16e1eea6a67c85c9d786f3c4448182b1aca101b8)

6 years agoFix a crash in the asn1parse command
Bernd Edlinger [Sat, 31 Mar 2018 19:09:32 +0000 (21:09 +0200)]
Fix a crash in the asn1parse command

Thanks to Sem Voigtländer for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5826)

(cherry picked from commit 752837e0664e990b5edf6f0b69e1b4612efadce0)

6 years agoo_time.c: use gmtime_s with MSVC
Miroslav Suk [Thu, 22 Mar 2018 08:20:43 +0000 (09:20 +0100)]
o_time.c: use gmtime_s with MSVC

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5719)

6 years agoAdds multiple checks to avoid buffer over reads
Philippe Antoine [Mon, 26 Mar 2018 08:25:55 +0000 (10:25 +0200)]
Adds multiple checks to avoid buffer over reads

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/5687)

6 years agoDon't write out a bad OID
Matt Caswell [Thu, 22 Mar 2018 14:33:05 +0000 (14:33 +0000)]
Don't write out a bad OID

If we don't have OID data for an object then we should fail if we
are asked to encode the ASN.1 for that OID.

Fixes #5723

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5725)

(cherry picked from commit 53c9818e970fc0c22d77e19fda3b3e6f6c9e759d)

6 years agoPrepare for 1.0.2p-dev
Matt Caswell [Tue, 27 Mar 2018 13:56:15 +0000 (14:56 +0100)]
Prepare for 1.0.2p-dev

Reviewed-by: Richard Levitte <levitte@openssl.org>
6 years agoPrepare for 1.0.2o release OpenSSL_1_0_2o
Matt Caswell [Tue, 27 Mar 2018 13:55:22 +0000 (14:55 +0100)]
Prepare for 1.0.2o release

Reviewed-by: Richard Levitte <levitte@openssl.org>
6 years agomake update
Matt Caswell [Tue, 27 Mar 2018 13:55:22 +0000 (14:55 +0100)]
make update

Reviewed-by: Richard Levitte <levitte@openssl.org>
6 years agoUpdate copyright year
Matt Caswell [Tue, 27 Mar 2018 12:46:45 +0000 (13:46 +0100)]
Update copyright year

Reviewed-by: Richard Levitte <levitte@openssl.org>
6 years agoUpdate CHANGES and NEWS for the new release
Matt Caswell [Tue, 27 Mar 2018 09:58:34 +0000 (10:58 +0100)]
Update CHANGES and NEWS for the new release

Reviewed-by: Richard Levitte <levitte@openssl.org>
6 years agoLimit ASN.1 constructed types recursive definition depth
Matt Caswell [Thu, 22 Mar 2018 10:05:40 +0000 (10:05 +0000)]
Limit ASN.1 constructed types recursive definition depth

Constructed types with a recursive definition (such as can be found in
PKCS7) could eventually exceed the stack given malicious input with
excessive recursion. Therefore we limit the stack depth.

CVE-2018-0739

Credit to OSSFuzz for finding this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
6 years agoFix dsaparam -genkey with DER outform
Bernd Edlinger [Sun, 25 Mar 2018 10:50:17 +0000 (12:50 +0200)]
Fix dsaparam -genkey with DER outform

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5744)

(cherry picked from commit 5281435258b5d8201a00b4a9781bb724d99630f0)

6 years agoFix ecparam -genkey with point compression or DER outform
Bernd Edlinger [Sat, 24 Mar 2018 14:17:11 +0000 (15:17 +0100)]
Fix ecparam -genkey with point compression or DER outform

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5741)

(cherry picked from commit 4bdc25b07f007d9c383fbad159f81543f2e95965)

6 years agoThe default conv_form is uncompressed
Matt Caswell [Wed, 21 Mar 2018 16:27:55 +0000 (16:27 +0000)]
The default conv_form is uncompressed

Fixes #5711

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5712)

(cherry picked from commit ab0a3914a64d8f1fce22795c02269e1288df52b1)

6 years agoconsttime flag changed
Samuel Weiser [Fri, 9 Feb 2018 13:11:47 +0000 (14:11 +0100)]
consttime flag changed

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5170)

(cherry picked from commit 7150a4720af7913cae16f2e4eaf768b578c0b298)

6 years agoused ERR set/pop mark
Samuel Weiser [Wed, 31 Jan 2018 12:10:55 +0000 (13:10 +0100)]
used ERR set/pop mark

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5170)

(cherry picked from commit 011f82e66f4bf131c733fd41a8390039859aafb2)

6 years agoReplaced variable-time GCD with consttime inversion to avoid side-channel attacks...
Samuel Weiser [Tue, 5 Dec 2017 14:55:17 +0000 (15:55 +0100)]
Replaced variable-time GCD with consttime inversion to avoid side-channel attacks on RSA key generation

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5170)

(cherry picked from commit 9db724cfede4ba7a3668bff533973ee70145ec07)

6 years agoFix some bugs with the cfb1 bitsize handling
Bernd Edlinger [Wed, 21 Feb 2018 14:48:02 +0000 (15:48 +0100)]
Fix some bugs with the cfb1 bitsize handling

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5450)

6 years agoFix a memory leak in the ca application
Matt Caswell [Wed, 14 Mar 2018 14:40:18 +0000 (14:40 +0000)]
Fix a memory leak in the ca application

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5445)

6 years agoAllow multiple entries without a Subject even if unique_subject == yes
Matt Caswell [Fri, 23 Feb 2018 19:48:11 +0000 (19:48 +0000)]
Allow multiple entries without a Subject even if unique_subject == yes

It is quite likely for there to be multiple certificates with empty
subjects, which are still distinct because of subjectAltName. Therefore
we allow multiple certificates with an empty Subject even if
unique_subject is set to yes.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5445)

6 years agoReport a readable error on a duplicate cert in ca app
Matt Caswell [Thu, 8 Mar 2018 15:55:46 +0000 (15:55 +0000)]
Report a readable error on a duplicate cert in ca app

Commit 87e8fec (16 years ago!) introduced a bug where if we are
attempting to insert a cert with a duplicate subject name, and
duplicate subject names are not allowed (which is the default),
then we get an unhelpful error message back (error number 2). Prior
to that commit we got a helpful error message which displayed details
of the conflicting entry in the database.

That commit was itself attempting to fix a bug with the noemailDN option
where we were setting the subject field in the database too early
(before extensions had made any amendments to it).

This PR moves the check for a conflicting Subject name until after all
changes to the Subject have been made by extensions etc.

This also, co-incidentally Fixes the ca crashing bug described in issue
5109.

Fixes #5109

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5445)

6 years agoRevert "Don't crash on a missing Subject in index.txt"
Matt Caswell [Fri, 23 Feb 2018 11:05:24 +0000 (11:05 +0000)]
Revert "Don't crash on a missing Subject in index.txt"

This reverts commit a3d684ffca282796511cb8f3593a59a80109eed8.

Empty Subjects are permissible

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5445)

6 years agoRevert "Don't allow an empty Subject when creating a Certificate"
Matt Caswell [Fri, 23 Feb 2018 11:05:01 +0000 (11:05 +0000)]
Revert "Don't allow an empty Subject when creating a Certificate"

This reverts commit dd37f6f12cc14cc4710289746b112eb0fed3b0b7.

Empty Subjects are permissible.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5445)

6 years agocrypto/engine/eng_cryptodev.c: don't treat a void* like an array
Richard Levitte [Wed, 14 Mar 2018 10:35:53 +0000 (11:35 +0100)]
crypto/engine/eng_cryptodev.c: don't treat a void* like an array

The void* needs to be cast to a char* first.

Fixes #5614

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5615)

6 years agoFree the correct type in OBJ_add_object()
Matt Caswell [Mon, 12 Mar 2018 15:24:29 +0000 (15:24 +0000)]
Free the correct type in OBJ_add_object()

We should be using ASN1_OBJECT_free() not OPENSSL_free().

Fixes #5568

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5599)

6 years agoImprove error handling in pk7_doit
Matt Caswell [Mon, 12 Mar 2018 13:56:34 +0000 (13:56 +0000)]
Improve error handling in pk7_doit

If a mem allocation failed we would ignore it. This commit fixes it to
always check.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5596)

(cherry picked from commit 4718f449a3ecd5efac62b22d0fa9a759a7895dbc)

6 years agoFix propotype to include the const qualifier
Kurt Roeckx [Sat, 10 Mar 2018 15:32:55 +0000 (16:32 +0100)]
Fix propotype to include the const qualifier

Reviewed-by: Andy Polyakov <appro@openssl.org>
GH: #5582

6 years agoRemove useless -D_ENDIAN from MPE/iX-gcc config
Richard Levitte [Thu, 8 Mar 2018 21:05:31 +0000 (22:05 +0100)]
Remove useless -D_ENDIAN from MPE/iX-gcc config

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5566)

6 years agoBIO_s_mem.pod: fix indirection for out parameter **pp
Dr. Matthias St. Pierre [Wed, 7 Mar 2018 13:37:23 +0000 (14:37 +0100)]
BIO_s_mem.pod: fix indirection for out parameter **pp

BIO_get_mem_data() and BIO_get_mem_ptr() assign to *pp, not pp

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5544)

6 years agoMinor style fixup on recent commit
Bernd Edlinger [Sun, 4 Mar 2018 12:09:29 +0000 (13:09 +0100)]
Minor style fixup on recent commit
99bb59d at ssl_scan_clienthello_tlsext

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/5507)

6 years agoFix credit for SRP code
Rich Salz [Sun, 4 Mar 2018 23:54:42 +0000 (18:54 -0500)]
Fix credit for SRP code

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5504)

6 years agoFix a possible memory leak in engine_table_register
Bernd Edlinger [Fri, 2 Mar 2018 08:27:39 +0000 (09:27 +0100)]
Fix a possible memory leak in engine_table_register

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5489)

(cherry picked from commit 55a7f77d72930f9aee1a51e0af9658b2728be127)

6 years agoFix wrong case in documentation of -CRLfile option
Viktor Dukhovni [Fri, 2 Mar 2018 15:30:04 +0000 (10:30 -0500)]
Fix wrong case in documentation of -CRLfile option

Reviewed-by: Rich Salz <rsalz@openssl.org>
6 years agoFix typo in ASN1_STRING_length doc
Ivan Filenko [Sun, 25 Feb 2018 13:49:27 +0000 (16:49 +0300)]
Fix typo in ASN1_STRING_length doc

CLA: trivial

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5458)

6 years agobio_b64.c: prevent base64 filter BIO from decoding out-of-bound data
Dr. Matthias St. Pierre [Wed, 21 Feb 2018 00:45:14 +0000 (01:45 +0100)]
bio_b64.c: prevent base64 filter BIO from decoding out-of-bound data

Fixes #5405, #1381

The base64 filter BIO reads its input in chunks of B64_BLOCK_SIZE bytes.
When processing input in PEM format it can happen in rare cases that

- the trailing PEM marker crosses the boundary of a chunk, and
- the beginning of the following chunk contains valid base64 encoded data.

This happened in issue #5405, where the PEM marker was split into
"-----END CER" and "TIFICATE-----" at the end of the first chunk.

The decoding of the first chunk terminated correctly at the '-' character,
which is treated as an EOF marker, and b64_read() returned. However,
when called the second time, b64_read() read the next chunk and interpreted
the string "TIFICATE" as valid base64 encoded data, adding 6 extra bytes
'4c 81 48 08 04 c4'.

This patch restores the assignment of the error code to 'ctx->cont', which
was deleted accidentally in commit 5562cfaca4f3 and which prevents b64_read()
from reading additional data on subsequent calls.

This issue was observed and reported by Annie Yousar.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5422)

6 years agoUpdate s_client doc adding xmpp as value for -starttls
White_Rabbit [Thu, 22 Feb 2018 18:58:19 +0000 (13:58 -0500)]
Update s_client doc adding xmpp as value for -starttls

CLA: trivial

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5407)

6 years agoChecks ec_points_format extension size
Philippe Antoine [Thu, 22 Feb 2018 18:56:40 +0000 (13:56 -0500)]
Checks ec_points_format extension size

Before reading first byte as length

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5410)

6 years agodo_body: fix heap-use-after-free.
Pavel Kopyl [Sun, 10 Dec 2017 19:57:43 +0000 (22:57 +0300)]
do_body: fix heap-use-after-free.

The memory pointed to by the 'push' is freed by the
X509_NAME_ENTRY_free() in do_body(). The second time
it is referenced to (indirectly) in certify_cert:X509_REQ_free().

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4896)

6 years agoX509V3_EXT_add_nconf_sk, X509v3_add_ext: fix errors handling
Pavel Kopyl [Sun, 10 Dec 2017 19:49:42 +0000 (22:49 +0300)]
X509V3_EXT_add_nconf_sk, X509v3_add_ext: fix errors handling

X509v3_add_ext: free 'sk' if the memory pointed to by it
was malloc-ed inside this function.
X509V3_EXT_add_nconf_sk: return an error if X509v3_add_ext() fails.
This prevents use of a freed memory in do_body:sk_X509_EXTENSION_num().

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4896)

6 years agoSanity check the ticket length before using key name/IV
Matt Caswell [Tue, 20 Feb 2018 10:20:20 +0000 (10:20 +0000)]
Sanity check the ticket length before using key name/IV

This could in theory result in an overread - but due to the over allocation
of the underlying buffer does not represent a security issue.

Thanks to Fedor Indutny for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5417)

6 years agoRemove code that prints "<SPACES/NULS>" in hexdumps
Bernd Edlinger [Mon, 12 Feb 2018 08:28:33 +0000 (09:28 +0100)]
Remove code that prints "<SPACES/NULS>" in hexdumps
when the data block ends with SPACEs or NULs.

The problem is, you can't see if the data ends
with SPACE or NUL or a combination of both.

This can happen for instance with
openssl rsautl -decrypt -hexdump

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5332)

(cherry picked from commit 751485c6522f10006ba9f6cf90d719ea190e2201)

6 years agoSwap the check in ssl3_write_pending to avoid using
Bernd Edlinger [Fri, 9 Feb 2018 18:31:36 +0000 (19:31 +0100)]
Swap the check in ssl3_write_pending to avoid using
the possibly indeterminate pointer value in wpend_buf.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5309)

6 years agoFix timing leak in BN_from_montgomery_word.
Andy Polyakov [Thu, 1 Feb 2018 21:03:59 +0000 (22:03 +0100)]
Fix timing leak in BN_from_montgomery_word.

BN_from_montgomery_word doesn't have a constant memory access pattern.
Replace the pointer trick with a constant-time select. There is, of
course, still the bn_correct_top leak pervasive in BIGNUM itself.

See also https://boringssl-review.googlesource.com/22904 from BoringSSL.

(backport from f345b1f39d9b4e4c9ef07e7522e9b2a870c9ca09 signed off by
David Benjamin <davidben@google.com>)

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
6 years agoDon't leak the exponent bit width in BN_mod_exp_mont_consttime.
David Benjamin [Tue, 23 Jan 2018 18:57:10 +0000 (13:57 -0500)]
Don't leak the exponent bit width in BN_mod_exp_mont_consttime.

The exponent here is one of d, dmp1, or dmq1 for RSA. This value and its
bit length are both secret. The only public upper bound is the bit width
of the corresponding modulus (RSA n, p, and q, respectively).

Although BN_num_bits is constant-time (sort of; see bn_correct_top notes
in preceding patch), this does not fix the root problem, which is that
the windows are based on the minimal bit width, not the upper bound. We
could use BN_num_bits(m), but BN_mod_exp_mont_consttime is public API
and may be called with larger exponents. Instead, use all top*BN_BITS2
bits in the BIGNUM. This is still sensitive to the long-standing
bn_correct_top leak, but we need to fix that regardless.

This may cause us to do a handful of extra multiplications for RSA keys
which are just above a whole number of words, but that is not a standard
RSA key size.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5154)

(cherry picked from commit 39eeb64f59ff838f976ad305de7d15747d47a41c)

6 years agoMake BN_num_bits_word constant-time.
David Benjamin [Tue, 23 Jan 2018 18:46:53 +0000 (13:46 -0500)]
Make BN_num_bits_word constant-time.

(This patch was written by Andy Polyakov. I only wrote the commit
message. Mistakes in the analysis are my fault.)

BN_num_bits, by way of BN_num_bits_word, currently leaks the
most-significant word of its argument via branching and memory access
pattern.

BN_num_bits is called on RSA prime factors in various places. These have
public bit lengths, but all bits beyond the high bit are secret. This
fully resolves those cases.

There are a few places where BN_num_bits is called on an input where the
bit length is also secret. This does *not* fully resolve those cases as
we still only look at the top word. Today, that is guaranteed to be
non-zero, but only because of the long-standing bn_correct_top timing
leak. Once that is fixed, a constant-time BN_num_bits on such inputs
must count bits on each word.

Instead, those cases should not call BN_num_bits at all. In particular,
BN_mod_exp_mont_consttime uses the exponent bit width to pick windows,
but it should be using the maximum bit width. The next patch will fix
this.

Thanks to Dinghao Wu, Danfeng Zhang, Shuai Wang, Pei Wang, and Xiao Liu
for reporting this issue.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5154)

(cherry picked from commit 972c87dfc7e765bd28a4964519c362f0d3a58ca4)

6 years agoMake sure we check an incoming reneg ClientHello in DTLS
Matt Caswell [Mon, 29 Jan 2018 14:55:44 +0000 (14:55 +0000)]
Make sure we check an incoming reneg ClientHello in DTLS

In TLS we have a check to make sure an incoming reneg ClientHello is
acceptable. The equivalent check is missing in the DTLS code. This means
that if a client does not signal the ability to handle secure reneg in the
initial handshake, then a subsequent reneg handshake should be rejected by
the server. In the DTLS case the reneg was being allowed if the the 2nd
ClientHello had a renegotiation_info extension. This is incorrect.

While incorrect, this does not represent a security issue because if
the renegotiation_info extension is present in the second ClientHello it
also has to be *correct*. Therefore this will only work if both the client
and server believe they are renegotiating, and both know the previous
Finished result. This is not the case in an insecure rengotiation attack.

I have also tidied up the check in the TLS code and given a better check
for determining whether we are renegotiating or not.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5192)

6 years agoAdd warnings to thread doc.
Rich Salz [Wed, 24 Jan 2018 22:28:45 +0000 (17:28 -0500)]
Add warnings to thread doc.

Thanks to Yun Jiang for pointing this out.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5164)

6 years agoFix BN doc
Rich Salz [Tue, 23 Jan 2018 14:58:33 +0000 (09:58 -0500)]
Fix BN doc

Backport from https://github.com/openssl/openssl/pull/5141

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/5151)

(cherry picked from commit 8b2124aba357a928fec6d7a3bafe186fc83080fc)

6 years agoFix error-path memory leak in asn_mime.c
Todd Short [Mon, 22 Jan 2018 19:30:24 +0000 (14:30 -0500)]
Fix error-path memory leak in asn_mime.c

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5142)

(cherry picked from commit a26dd465b21d8def440c16b6bd90227b03e12e02)

6 years agoChanged OPENSSL_gmtime so macOS uses threadsafe gmtime_r instead of gmtime.
Jonathan Scalise [Fri, 2 Jun 2017 20:47:03 +0000 (16:47 -0400)]
Changed OPENSSL_gmtime so macOS uses threadsafe gmtime_r instead of gmtime.

Updated uses of gmtime to now call OPENSSL_gmtime instead.

Used similar preprocessor logic to make sure localtime_r is called instead
of localtime when applicable.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3609)

6 years agoCleanup ctxs if callback fail to retrieve session ticket
J Mohan Rao Arisankala [Fri, 21 Apr 2017 16:03:46 +0000 (21:33 +0530)]
Cleanup ctxs if callback fail to retrieve session ticket

If tlsext ticket decrypt callback returns error, cleanup ctxs

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3273)

6 years agofix several typos in README.gost
Cristian Stoica [Fri, 12 Aug 2016 15:01:04 +0000 (18:01 +0300)]
fix several typos in README.gost

CLA: trivial

Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1449)

6 years agomerge two mutual exclusive #ifdefs to improve clarity
Cristian Stoica [Fri, 12 Aug 2016 14:53:25 +0000 (17:53 +0300)]
merge two mutual exclusive #ifdefs to improve clarity

CLA: trivial

Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1449)

6 years agoDon't crash on a missing Subject in index.txt
Matt Caswell [Fri, 19 Jan 2018 14:48:45 +0000 (14:48 +0000)]
Don't crash on a missing Subject in index.txt

An index.txt entry which has an empty Subject name field will cause ca
to crash. Therefore check it when we load it to make sure its not empty.

Fixes #5109

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5115)

6 years agoDon't allow an empty Subject when creating a Certificate
Matt Caswell [Fri, 19 Jan 2018 14:34:56 +0000 (14:34 +0000)]
Don't allow an empty Subject when creating a Certificate

Misconfiguration (e.g. an empty policy section in the config file) can
lead to an empty Subject. Since certificates should have unique Subjects
this should not be allowed.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5115)

6 years agoUpdate the license end year
Richard Levitte [Sat, 20 Jan 2018 09:02:23 +0000 (10:02 +0100)]
Update the license end year

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5121)

(cherry picked from commit 7c24f9d21cddd2bb30167153b05168fee7e3cf0b)

6 years agoRevert BN_copy() flag copy semantics change
Matt Caswell [Mon, 15 Jan 2018 11:23:07 +0000 (11:23 +0000)]
Revert BN_copy() flag copy semantics change

Commit 9f9442918a changed the semantics of BN_copy() to additionally
copy the BN_FLG_CONSTTIME flag if it is set. This turns out to be
ill advised as it has unintended consequences. For example calling
BN_mod_inverse_no_branch() can sometimes return a result with the flag
set and sometimes not as a result. This can lead to later failures if we
go down code branches that do not support constant time, but check for
the presence of the flag.

The original commit was made due to an issue in BN_MOD_CTX_set(). The
original PR fixed the problem in that function, but it was changed in
review to fix it in BN_copy() instead. The solution seems to be to revert
the BN_copy() change and go back to the originally proposed way.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/5080)

(cherry picked from commit 7d461736f7bd3af3c2f266f8541034ecf6f41ed9)

6 years agoTolerate DTLS alerts with an incorrect version number
Matt Caswell [Fri, 5 Jan 2018 10:12:29 +0000 (10:12 +0000)]
Tolerate DTLS alerts with an incorrect version number

In the case of a protocol version alert being sent by a peer the record
version number may not be what we are expecting. In DTLS records with an
unexpected version number are silently discarded. This probably isn't
appropriate for alerts, so we tolerate a mismatch in the minor version
number.

This resolves an issue reported on openssl-users where an OpenSSL server
chose DTLS1.0 but the client was DTLS1.2 only and sent a protocol_version
alert with a 1.2 record number. This was silently ignored by the server.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5019)

6 years agoAdd fingerprint text, remove MD5
Rich Salz [Sun, 7 Jan 2018 03:32:59 +0000 (22:32 -0500)]
Add fingerprint text, remove MD5

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/4906)
(cherry picked from commit 794bf5f756ad4748735e9b333c40d2b1bf685c36)

6 years agotest/maketests.com: remove irrelevant comment
Richard Levitte [Sat, 6 Jan 2018 11:32:36 +0000 (12:32 +0100)]
test/maketests.com: remove irrelevant comment

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5017)

6 years agoAdd missing tests to the VMS test scripts
Richard Levitte [Thu, 4 Jan 2018 21:37:34 +0000 (22:37 +0100)]
Add missing tests to the VMS test scripts

Thanks to Douglas Fyfe @ VSI for making me aware of this

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5017)

6 years agoCorrected 'cms' exit status when key or certificate cannot be opened
Konstantin Shemyak [Thu, 28 Dec 2017 21:12:59 +0000 (23:12 +0200)]
Corrected 'cms' exit status when key or certificate cannot be opened

A backport of #4997.
Fixes #4996.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/5020)

6 years agoec/ecp_nistp*.c: sanitize for undefined/implmentation-specific behaviour.
Andy Polyakov [Sat, 23 Dec 2017 14:15:30 +0000 (15:15 +0100)]
ec/ecp_nistp*.c: sanitize for undefined/implmentation-specific behaviour.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/4974)

(cherry picked from commit 8af7e94d7b720224547efa7e3364857f7f666dd4)

6 years agoAdd missing comma between references
Viktor Dukhovni [Wed, 13 Dec 2017 15:56:44 +0000 (10:56 -0500)]
Add missing comma between references

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
6 years agoDocument the X509_V_FLAG_PARTIAL_CHAIN flag
Viktor Dukhovni [Tue, 12 Dec 2017 00:05:35 +0000 (19:05 -0500)]
Document the X509_V_FLAG_PARTIAL_CHAIN flag

Also documented X509_V_FLAG_TRUSTED_FIRST

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
6 years agoFix a switch statement fallthrough
Matt Caswell [Sun, 10 Dec 2017 09:55:08 +0000 (09:55 +0000)]
Fix a switch statement fallthrough

SSL_trace() has a case which was inadvertently falling through.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4888)

(cherry picked from commit 5bfb357a0d2046fc75daf67a5bc019eb87443729)

6 years agoConfigure: use a better method to identify gcc and derivates
Richard Levitte [Sat, 18 Nov 2017 16:54:57 +0000 (17:54 +0100)]
Configure: use a better method to identify gcc and derivates

Looking for 'gcc' and 'clang' in the output from the C compiler is
uncertain.  Some versions report argv[0], which might be /usr/bin/cc
(for example), and others might mention gcc without being gcc or a
derivate.

Better then to fetch predefined macros and checking if __GNUC__ and
__clang__ are defined.

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4755)

6 years agoRemove three test programs that snuck in
Richard Levitte [Sat, 9 Dec 2017 23:09:25 +0000 (00:09 +0100)]
Remove three test programs that snuck in

They are from the 1.1.0 or master branches

Fixes #4863

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4887)

6 years agoStandardize syntax around sizeof(foo)
Rich Salz [Fri, 8 Dec 2017 20:08:43 +0000 (15:08 -0500)]
Standardize syntax around sizeof(foo)

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4875)

6 years agoFix an incoherent test.
FdaSilvaYY [Fri, 8 Dec 2017 15:25:38 +0000 (10:25 -0500)]
Fix an incoherent test.

Pointer 'o' is set inside a local buffer, so it can't be NULL.
Also fix coding style and add comments

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4754)
(cherry picked from commit cef115ff0ca4255d3decc1dda87c5418a961fd2c)

6 years agoRemove unicode characters from source
Richard Levitte [Fri, 8 Dec 2017 10:40:30 +0000 (11:40 +0100)]
Remove unicode characters from source

Some compilers react badly to non-ASCII characters

Fixes #4877

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4879)

6 years agoAdd missing prototype for FIPS callback
Dr. Matthias St. Pierre [Mon, 26 Sep 2016 12:23:29 +0000 (14:23 +0200)]
Add missing prototype for FIPS callback

Fixes #2533

The call to FIPS_crypto_set_id_callback() was added in revision a43cfd7bb1fc681d563e,
but there is no prototype for it in <openssl/fips.h>.

Signed-off-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4870)

6 years agoFix the buffer sizing in the fatalerrtest
Matt Caswell [Thu, 7 Dec 2017 14:41:21 +0000 (14:41 +0000)]
Fix the buffer sizing in the fatalerrtest

Fixes #4865

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4866)

6 years agoFix initialisation in fatalerrtest
Matt Caswell [Thu, 7 Dec 2017 14:40:49 +0000 (14:40 +0000)]
Fix initialisation in fatalerrtest

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4866)

6 years agoPrepare for 1.0.2o-dev
Matt Caswell [Thu, 7 Dec 2017 13:20:44 +0000 (13:20 +0000)]
Prepare for 1.0.2o-dev

Reviewed-by: Andy Polyakov <appro@openssl.org>
6 years agoPrepare for 1.0.2n release OpenSSL_1_0_2n
Matt Caswell [Thu, 7 Dec 2017 13:19:36 +0000 (13:19 +0000)]
Prepare for 1.0.2n release

Reviewed-by: Andy Polyakov <appro@openssl.org>
6 years agoUpdate CHANGES and NEWS for the new release
Matt Caswell [Wed, 6 Dec 2017 13:54:37 +0000 (13:54 +0000)]
Update CHANGES and NEWS for the new release

Reviewed-by: Rich Salz <rsalz@openssl.org>
6 years agoFix linking of fatalerrtest in VisualStudio
Matt Caswell [Thu, 7 Dec 2017 11:17:22 +0000 (11:17 +0000)]
Fix linking of fatalerrtest in VisualStudio

Reviewed-by: Andy Polyakov <appro@openssl.org>
6 years agoAdd a test for CVE-2017-3737
Matt Caswell [Wed, 29 Nov 2017 13:56:15 +0000 (13:56 +0000)]
Add a test for CVE-2017-3737

Test reading/writing to an SSL object after a fatal error has been
detected.

Reviewed-by: Rich Salz <rsalz@openssl.org>
6 years agoDon't allow read/write after fatal error
Matt Caswell [Wed, 29 Nov 2017 14:04:01 +0000 (14:04 +0000)]
Don't allow read/write after fatal error

OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state"
mechanism. The intent was that if a fatal error occurred during a handshake
then OpenSSL would move into the error state and would immediately fail if
you attempted to continue the handshake. This works as designed for the
explicit handshake functions (SSL_do_handshake(), SSL_accept() and
SSL_connect()), however due to a bug it does not work correctly if
SSL_read() or SSL_write() is called directly. In that scenario, if the
handshake fails then a fatal error will be returned in the initial function
call. If SSL_read()/SSL_write() is subsequently called by the application
for the same SSL object then it will succeed and the data is passed without
being decrypted/encrypted directly from the SSL/TLS record layer.

In order to exploit this issue an attacker would have to trick an
application into behaving incorrectly by issuing an SSL_read()/SSL_write()
after having already received a fatal error.

Thanks to David Benjamin (Google) for reporting this issue and suggesting
this fix.

CVE-2017-3737

Reviewed-by: Rich Salz <rsalz@openssl.org>
6 years agobn/asm/rsaz-avx2.pl: fix digit correction bug in rsaz_1024_mul_avx2.
Andy Polyakov [Fri, 24 Nov 2017 10:35:50 +0000 (11:35 +0100)]
bn/asm/rsaz-avx2.pl: fix digit correction bug in rsaz_1024_mul_avx2.

Credit to OSS-Fuzz for finding this.

CVE-2017-3738

Reviewed-by: Rich Salz <rsalz@openssl.org>
6 years agoUpdate eng_fat.c
MerQGh [Mon, 4 Dec 2017 06:20:51 +0000 (09:20 +0300)]
Update eng_fat.c

This line will allow use private keys, which created by Crypto Pro, to
sign with OpenSSL.

CLA: trivial

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4836)

(cherry picked from commit b35bb37a3d6ecf11b43ef8717600ab61718c3cc2)

6 years agoFix docs for EVP_EncryptUpdate and EVP_DecryptUpdate
FdaSilvaYY [Tue, 28 Nov 2017 22:16:02 +0000 (23:16 +0100)]
Fix docs for EVP_EncryptUpdate and EVP_DecryptUpdate

Fixes #4775

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4815)

(cherry picked from commit a61c15eb9b8d0ef513d695c854516958e2ccf1eb)

7 years agoFix possible leaks on sk_X509_EXTENSION_push() failure ...
FdaSilvaYY [Mon, 6 Nov 2017 11:56:58 +0000 (12:56 +0100)]
Fix possible leaks on sk_X509_EXTENSION_push() failure ...

Backport of #4677 / 1687aa760cdd164b12c5b70e65cadcbce1e7ccfa

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4715)

7 years agoDon't use SSLv3_client_method internally with no-ssl3
Richard Levitte [Tue, 14 Nov 2017 04:03:19 +0000 (05:03 +0100)]
Don't use SSLv3_client_method internally with no-ssl3

Fixes #4734 #4649

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4735)

7 years agoConfigure: add back /WX to VC-WIN32.
Andy Polyakov [Sat, 11 Nov 2017 15:27:48 +0000 (16:27 +0100)]
Configure: add back /WX to VC-WIN32.

We had /WX (treat warnings as errors) in VC-WIN32 for long time. At
some point it was somehow omitted. It's argued that it allows to
keep better focus on new code, which motivates the comeback...

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4718)

7 years agoResolve warnings in VC-WIN32 build, which allows to add /WX.
Andy Polyakov [Sat, 11 Nov 2017 15:35:46 +0000 (16:35 +0100)]
Resolve warnings in VC-WIN32 build, which allows to add /WX.

It's argued that /WX allows to keep better focus on new code, which
motivates its comeback...

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4718)

7 years agolhash.c: Replace Unicode EN DASH with the ASCII char '-'.
Long Qin [Tue, 7 Nov 2017 06:59:20 +0000 (14:59 +0800)]
lhash.c: Replace Unicode EN DASH with the ASCII char '-'.

 * addressing", Proc. 6th Conference on Very Large Databases: 212–223
                                                                 ^
The EN DASH ('–') in this line is one UTF-8 character (hex: e2 80 93).
Under some code page setting (e.g. 936), Visual Studio may report C4819
warning: The file contains a character that cannot be represented in the
current code page.

Replace this character with the ASCII char '-' (Hex Code: 2D).

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4691)

(cherry picked from commit b4d0fa49d9d1a43792e58b0c8066bb23b9e53ef4)

7 years agossltest.c: cb_ticket2 appears to not return a value when it "should"
Richard Levitte [Fri, 10 Nov 2017 12:26:10 +0000 (13:26 +0100)]
ssltest.c: cb_ticket2 appears to not return a value when it "should"

cb_ticket2() does an exit, and should therefore not need to return anything.
Some compilers don't detect that, or don't care, and warn about a non-void
function without a return statement.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4713)