Andy Polyakov [Sat, 16 Jun 2018 14:23:34 +0000 (16:23 +0200)]
sha/asm/sha{1|256}-586.pl: harmonize clang version detection.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6499)
(cherry picked from commit
b55e21b357902959ae8ec0255952402f5ccaa515)
Andy Polyakov [Sat, 16 Jun 2018 14:22:19 +0000 (16:22 +0200)]
bn/asm/rsaz-avx2.pl: harmonize clang version detection.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6499)
(cherry picked from commit
9e97f61dec312084abe03226e5c962d818c9fc2b)
Nicola Tuveri [Tue, 12 Jun 2018 13:28:25 +0000 (16:28 +0300)]
Warn against nonce reuse in DSA_sign_setup() doc
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6465)
Matt Caswell [Fri, 25 May 2018 11:10:13 +0000 (12:10 +0100)]
Add blinding to an ECDSA signature
Keegan Ryan (NCC Group) has demonstrated a side channel attack on an
ECDSA signature operation. During signing the signer calculates:
s:= k^-1 * (m + r * priv_key) mod order
The addition operation above provides a sufficient signal for a
flush+reload attack to derive the private key given sufficient signature
operations.
As a mitigation (based on a suggestion from Keegan) we add blinding to
the operation so that:
s := k^-1 * blind^-1 (blind * m + blind * r * priv_key) mod order
Since this attack is a localhost side channel only no CVE is assigned.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Guido Vranken [Mon, 11 Jun 2018 17:38:54 +0000 (19:38 +0200)]
Reject excessively large primes in DH key generation.
CVE-2018-0732
Signed-off-by: Guido Vranken <guidovranken@gmail.com>
(cherry picked from commit
91f7361f47b082ae61ffe1a7b17bb2adf213c7fe)
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6457)
Andy Polyakov [Fri, 8 Jun 2018 13:02:39 +0000 (15:02 +0200)]
bn/asm/sparcv9-mont.pl: iron another glitch in squaring code path.
This module is used only with odd input lengths, i.e. not used in normal
PKI cases, on contemporary processors. The problem was "illuminated" by
fuzzing tests.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6440)
(cherry picked from commit
f55ef97b5c0f8559f393b72ebd4b2de32ad6d231)
Ken Goldman [Sat, 2 Jun 2018 20:22:04 +0000 (16:22 -0400)]
Document failure return of ECDSA_SIG_new
ECDSA_SIG_new() returns NULL on error.
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6398)
(cherry picked from commit
6da34cfbddede5e46f9c9183b724c99999dcfb41)
Richard Levitte [Thu, 31 May 2018 09:12:34 +0000 (11:12 +0200)]
ENGINE_pkey_asn1_find_str(): don't assume an engine implements ASN1 method
Just because an engine implements algorithm methods, that doesn't mean
it also implements the ASN1 method. Therefore, be careful when looking
for an ASN1 method among all engines, don't try to use one that doesn't
exist.
Fixes #6381
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6383)
Richard Levitte [Thu, 31 May 2018 04:51:25 +0000 (06:51 +0200)]
apps: when the 'compat' nameopt has been set, leave it be
XN_FLAG_COMPAT has a unique property, its zero for value. This means
it needs special treatment; if it has been set (which can only be
determined indirectly) and set alone (*), no other flags should be
set.
(*) if any other nameopt flag has been set by the user, compatibility
mode is blown away.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6382)
(cherry picked from commit
3190d1dca43ecfd748c06aa06752de06af3768b9)
Matt Caswell [Thu, 24 May 2018 15:12:52 +0000 (16:12 +0100)]
The result of a ^ 0 mod -1 is 0 not 1
Thanks to Guido Vranken and OSSFuzz for finding this issue.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6355)
(cherry picked from commit
4aa5b725d549b3ebc3a4f2f1c44e44a11f68752b)
Matt Caswell [Tue, 22 May 2018 12:34:42 +0000 (13:34 +0100)]
Fix a bogus warning about an uninitialised var
The variable in question can never be used uninitialised, but we silence
the compiler anyway.
Fixes #6301
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6329)
Matt Caswell [Wed, 16 May 2018 10:59:47 +0000 (11:59 +0100)]
Fix undefined behaviour in X509_NAME_cmp()
If the lengths of both names is 0 then don't attempt to do a memcmp.
Issue reported by Simon Friedberger, Robert Merget and Juraj Somorovsky.
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6291)
(cherry picked from commit
511190b691183a1fb160e7e05e2974dc73cab0c6)
Andy Polyakov [Tue, 15 May 2018 18:31:04 +0000 (20:31 +0200)]
util/domd: harmonize with compiler detection in Configure.
Configure detects if compiler can generate dependency lists for any
command name, while this script didn't quite tolerate arbitrary one.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6261)
Matt Caswell [Wed, 16 May 2018 08:58:27 +0000 (09:58 +0100)]
Make BN_GF2m_mod_arr more constant time
Experiments have shown that the lookup table used by BN_GF2m_mod_arr
introduces sufficient timing signal to recover the private key for an
attacker with access to cache timing information on the victim's host.
This only affects binary curves (which are less frequently used).
No CVE is considered necessary for this issue.
The fix is to replace the lookup table with an on-the-fly calculation of
the value from the table instead, which can be performed in constant time.
Thanks to Youngjoo Shin for reporting this issue.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6270)
(cherry picked from commit
b336ce57f2d5cca803a920d2a9e622b588cead3c)
Richard Levitte [Mon, 14 May 2018 03:01:54 +0000 (05:01 +0200)]
When configuring 'no-comp', zlib support should be disabled too
Fixes #6241
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6248)
Richard Levitte [Wed, 2 May 2018 12:28:53 +0000 (14:28 +0200)]
UI console: Restore tty settings, do not force ECHO after prompt
The Console UI method always set echo on after prompting without
echo. However, echo might not have been on originally, so just
restore the original TTY settings.
Fixes #2373
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6158)
Pavel Kopyl [Fri, 3 Nov 2017 15:18:59 +0000 (18:18 +0300)]
Fix memory leaks in CA related functions.
(cherry picked from commit
aebd0e5ca12d1ba0b229a4121a54afa5ea2d8aa1)
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6238)
Matt Caswell [Fri, 11 May 2018 09:28:47 +0000 (10:28 +0100)]
Don't memcpy the contents of an empty fragment
In DTLS if we have buffered a fragment for a zero length message (e.g.
ServerHelloDone) then, when we unbuffered the fragment, we were attempting
to memcpy the contents of the fragment which is zero length and a NULL
pointer. This is undefined behaviour. We should check first whether we
have a zero length fragment.
Fixes a travis issue.
[extended tests]
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6225)
Richard Levitte [Fri, 4 May 2018 12:19:44 +0000 (14:19 +0200)]
In cases where we ask PEM_def_callback for minimum 0 length, accept 0 length
Fixes #4716
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6173)
(cherry picked from commit
c82c3462267afdbbaa53e11da0508ce4e03c02b3)
Dr. Matthias St. Pierre [Fri, 11 May 2018 14:58:44 +0000 (16:58 +0200)]
Fix typo 'is an error occurred' in documentation
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6231)
Emilia Kasper [Fri, 17 Feb 2017 18:00:15 +0000 (19:00 +0100)]
X509 time: tighten validation per RFC 5280
- Reject fractional seconds
- Reject offsets
- Check that the date/time digits are in valid range.
- Add documentation for X509_cmp_time
GH issue 2620
Backported from
80770da39e
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6182)
Richard Levitte [Fri, 4 May 2018 12:44:19 +0000 (14:44 +0200)]
BIO_s_mem() write: Skip early when input length is zero
When the input length is zero, just return zero early. Otherwise,
there's a small chance that memory allocation is engaged, fails and
returns -1, which is a bit confusing when nothing should be written.
Fixes #4782 #4827
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/6175)
(cherry picked from commit
0d94212a046e87fafea6e83e8ea2b2a58db49979)
Andy Polyakov [Mon, 30 Apr 2018 20:59:51 +0000 (22:59 +0200)]
bn/asm/*-mont.pl: harmonize with BN_from_montgomery_word.
Montgomery multiplication post-conditions in some of code paths were
formally non-constant time. Cache access pattern was result-neutral,
but a little bit asymmetric, which might have produced a signal [if
processor reordered load and stores at run-time].
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6163)
(cherry picked from commit
774ff8fed67e19d4f5f0df2f59050f2737abab2a)
Resolved conflicts in ppc-mont.pl and x86_64-mont.pl.
(cherry picked from commit
d067ba3bcc4944140578bdbf857affa6faf9e8c1)
Dr. Matthias St. Pierre [Wed, 2 May 2018 21:06:15 +0000 (23:06 +0200)]
v3_purp.c: add locking to x509v3_cache_extensions()
Fixes #6121
Thanks to Mingtao Yang for reporting this bug.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6164)
Todd Short [Mon, 23 Apr 2018 18:06:22 +0000 (14:06 -0400)]
Configure: fix Mac OS X builds that still require makedepend
Earlier Apple Xcode compilers, e.g. one targeting Mac OS X 10.7, don't
support dependency generation and one still has to use makedepend. It's
unclear when it was fixed, but all clang-based Apple compilers seem to
support -M options.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6073)
Matt Caswell [Fri, 27 Apr 2018 10:38:19 +0000 (11:38 +0100)]
Add some documentation for SSL_get_shared_ciphers()
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6115)
Matt Caswell [Fri, 27 Apr 2018 10:24:01 +0000 (11:24 +0100)]
Fix comment in ssl.h
The ciphers field in a session contains the stack of ciphers offered by
the client.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6115)
Matt Caswell [Fri, 27 Apr 2018 10:20:52 +0000 (11:20 +0100)]
Fix SSL_get_shared_ciphers()
The function SSL_get_shared_ciphers() is supposed to return ciphers shared
by the client and the server. However it only ever returned the client
ciphers.
Fixes #5317
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6115)
Dr. Matthias St. Pierre [Thu, 26 Apr 2018 18:36:41 +0000 (20:36 +0200)]
a_strex.c: prevent out of bound read in do_buf()
which is used for ASN1_STRING_print_ex*() and X509_NAME_print_ex*().
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6118)
Matt Caswell [Mon, 30 Apr 2018 14:05:45 +0000 (15:05 +0100)]
Clarify BN_mod_exp docs
Specifically this is not supported with an even modulus and
BN_FLG_CONSTTIME.
Fixes #5082
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6138)
(cherry picked from commit
966b3df182b9c8644c154f1c3e686027d37acb05)
Matt Caswell [Mon, 30 Apr 2018 11:05:42 +0000 (12:05 +0100)]
Fix some errors and missing info in the CMS docs
Fixes #5063
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6136)
Matt Caswell [Thu, 19 Apr 2018 12:32:45 +0000 (13:32 +0100)]
Update version docs
Make it clear that you should not attempt to get the version before the
first handshake is complete.
Fixes #2893
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6015)
Richard Levitte [Fri, 27 Apr 2018 04:05:49 +0000 (06:05 +0200)]
Skip the CMS test if configured 'no-cms'
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6108)
Billy Brumley [Thu, 26 Apr 2018 16:08:59 +0000 (19:08 +0300)]
fix: BN_swap mishandles flags (1.0.2)
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6102)
Cristian Stoica [Wed, 29 Jun 2016 14:45:59 +0000 (17:45 +0300)]
s_server: fix warnings unused-but-set-variable (no-dh)
This patch fixes the following two warnings when OpenSSL is built with no-dh option:
s_server.c: In function 's_server_main':
s_server.c:1105:25: warning: variable 'no_dhe' set but not used [-Wunused-but-set-variable]
int no_tmp_rsa = 0, no_dhe = 0, no_ecdhe = 0, nocert = 0;
^
s_server.c:1101:11: warning: variable 'dhfile' set but not used [-Wunused-but-set-variable]
char *dhfile = NULL;
^
CLA: trivial
Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6087)
Cristian Stoica [Wed, 29 Jun 2016 15:34:33 +0000 (18:34 +0300)]
fix warning unused-but-set-variable 'alg_k' (no-dh and no-ec)
This patch fixes the following warning when OpenSSL is configured with
no-dh and no-ec:
./Configure no-ec no-dh linux-x86_64
...
s3_lib.c: In function 'ssl3_get_req_cert_type':
s3_lib.c:4234:19: warning: variable 'alg_k' set but not used [-Wunused-but-set-variable]
unsigned long alg_k;
CLA: trivial
Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6087)
Cristian Stoica [Wed, 29 Jun 2016 15:30:58 +0000 (18:30 +0300)]
fix warning unused-but-set-variable 'nostrict' (no-dh and no-ec)
This patch fixes the following warning when OpenSSL is configured with
no-dh and no-ec:
./Configure no-ec no-dh linux-x86_64
...
s3_lib.c:4231:9: warning: variable 'nostrict' set but not used [-Wunused-but-set-variable]
int nostrict = 1;
^
CLA: trivial
Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6087)
Matt Caswell [Thu, 26 Apr 2018 13:05:40 +0000 (14:05 +0100)]
Update the *use_certificate* docs
Note that calling the *use_certificate* functions will replace any existing
certificate of the same type. The same thing applies for private keys.
Fixes #2147
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6093)
(cherry picked from commit
db747425b0caae12e73c680799b57bdfcc72dbb4)
Richard Levitte [Wed, 25 Apr 2018 20:53:40 +0000 (22:53 +0200)]
PEM_def_callback(): use same parameter names as for pem_password_cb
Add a bit more commentary to explain what's going on.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6080)
(cherry picked from commit
d6d94d339756332bbabe2a1032ac511ae31b3fdc)
Richard Levitte [Wed, 25 Apr 2018 11:57:39 +0000 (13:57 +0200)]
PEM_def_callback(): don't loop because of too short password given
That error is already caught by EVP_read_pw_string_min, and causes
this function to return -1, so the code detecting too short passwords
in this function is practically dead.
Fixes #5465
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6080)
(cherry picked from commit
4977b4e9281c981efcf6a8b31378b8bbd6a8a96f)
Matt Caswell [Tue, 24 Apr 2018 09:27:32 +0000 (10:27 +0100)]
Fix documentation for the -showcerts s_client option
This option shows the certificates as sent by the server. It is not the
full verified chain.
Fixes #4933
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6069)
Matt Caswell [Mon, 23 Apr 2018 10:23:43 +0000 (11:23 +0100)]
Document when a session gets removed from cache
Document the fact that if a session is not closed down cleanly then the
session gets removed from the cache and marked as non-resumable.
Fixes #4720
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6054)
(cherry picked from commit
0abb903b7618ad404c83ac9b44b2c1bf162b90de)
Matt Caswell [Thu, 19 Apr 2018 09:38:57 +0000 (10:38 +0100)]
Fix the alert sent if no shared sig algs
We were sending illegal parameter. This isn't correct. The parameters are
legal, we just don't have an overlap. A more appropriate alert is
handshake failure.
Fixes #2919
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6011)
Richard Levitte [Thu, 19 Apr 2018 14:35:37 +0000 (16:35 +0200)]
apps/s_socket.c: Fix do_accept
do_accept() checked that the peer IP address had a PTR record, and would
fail if not. The retrieved named was then never used, even though passed
around. All this is unnecessary, so we remove it.
Fixes #3407
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6018)
Matt Caswell [Wed, 18 Apr 2018 13:20:29 +0000 (14:20 +0100)]
Don't crash if there are no trusted certs
The X509_STORE_CTX_init() docs explicitly allow a NULL parameter for the
X509_STORE. Therefore we shouldn't crash if we subsequently call
X509_verify_cert() and no X509_STORE has been set.
Fixes #2462
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6003)
Matt Caswell [Wed, 18 Apr 2018 11:03:41 +0000 (12:03 +0100)]
Return 0 on a non-matching kdf_type
If we have a non-matching kdf_type then pkey_dh_derive silently succeeds.
It should fail. This is a "should not happen" condition anyway so the
impact is negligible.
Fixes #2440
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6000)
Matt Caswell [Wed, 18 Apr 2018 10:07:18 +0000 (11:07 +0100)]
Fix ocsp app exit code
If we run the ocsp command line app and the responder returns a
non-successful status code then the app should exit with a failure code.
Based on an original patch by Tatsuhiro Tsujikawa.
Fixes #2387
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5999)
(cherry picked from commit
2add645dfc364cfc609e6138de1bf43c217bb557)
Emilia Kasper [Mon, 18 Dec 2017 17:41:05 +0000 (18:41 +0100)]
X509_cmp_time: only return 1, 0, -1.
The behaviour of X509_cmp_time used to be undocumented.
The new behaviour, documented in master, is to return only 0, 1, or -1.
Make the code in the other branches to adhere to this behaviour too,
to reduce confusion. There is nothing to be gained from returning
other values.
Fixes GH#4954
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4955)
(cherry picked from commit
48345917747a34feea3da2936994a265c7f2ca11)
John Eichenberger [Tue, 3 Apr 2018 23:08:31 +0000 (16:08 -0700)]
Correct the check of RSA_FLAG_SIGN_VER
The wrong flags were being tested. It is the rsa->meth flags not the rsa
flags that should be tested.
wpa_supplicant has a bit of code that
1. Allocates and defines a RSA_METHOD structure.
2. calls RSA_new();
3. calls RSA_set_method().
In current versions of that code the rsa_sign and rsa_verify members of
the RSA_METHOD structure are not defined, thus making it compatible
with the really old versions of OpenSSL.
But should one change it use the rsa_sign method one must set the
RSA_FLAG_SIGN_VER bit of the RSA_METHOD structure to indicate that
one or both of those new methods are required. In doing so, OpenSSL
will not call the new methods, not without this change.
CLA: trivial
Change-Id: I6e65a80f21399f25e966466ff676e3b21f85f360
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5971)
Matt Caswell [Tue, 17 Apr 2018 12:40:07 +0000 (13:40 +0100)]
Update fingerprints.txt
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5988)
Matt Caswell [Fri, 6 Apr 2018 13:33:07 +0000 (14:33 +0100)]
Ignore the status_request extension in a resumption handshake
We cannot provide a certificate status on a resumption so we should
ignore this extension in that case.
Fixes #1662
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5898)
Billy Brumley [Wed, 11 Apr 2018 07:10:58 +0000 (10:10 +0300)]
RSA key generation: ensure BN_mod_inverse and BN_mod_exp_mont both get called with BN_FLG_CONSTTIME flag set.
CVE-2018-0737
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
6939eab03a6e23d2bd2c3f5e34fe1d48e542e787)
Daniel Bevenius [Thu, 12 Apr 2018 11:39:37 +0000 (13:39 +0200)]
Clarify default section in config.pod
This is a minor update which hopefully makes these particular lines
read a little easier.
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5938)
(cherry picked from commit
0652e8a7fe6dd8cbdf4516b221642b10bbfc68fe)
(cherry picked from commit
9e8554fca5019b81ed7659d97f103f388ea3a2bf)
Rich Salz [Sat, 7 Apr 2018 17:09:15 +0000 (13:09 -0400)]
Updated to CONTRIBUTING to reflect GitHub, etc.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5889)
(cherry picked from commit
2876872ffe5dd53ec1c446656e924ff463e5d4bf)
Matt Caswell [Thu, 29 Mar 2018 20:02:20 +0000 (21:02 +0100)]
Update the genpkey documentation
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5884)
Matt Caswell [Thu, 29 Mar 2018 16:49:17 +0000 (17:49 +0100)]
Pick a q size consistent with the digest for DSA param generation
There are two undocumented DSA parameter generation options available in
the genpkey command line app:
dsa_paramgen_md and dsa_paramgen_q_bits.
These can also be accessed via the EVP API but only by using
EVP_PKEY_CTX_ctrl() or EVP_PKEY_CTX_ctrl_str() directly. There are no
helper macros for these options.
dsa_paramgen_q_bits sets the length of q in bits (default 160 bits).
dsa_paramgen_md sets the digest that is used during the parameter
generation (default SHA1). In particular the output length of the digest
used must be equal to or greater than the number of bits in q because of
this code:
if (!EVP_Digest(seed, qsize, md, NULL, evpmd, NULL))
goto err;
if (!EVP_Digest(buf, qsize, buf2, NULL, evpmd, NULL))
goto err;
for (i = 0; i < qsize; i++)
md[i] ^= buf2[i];
/* step 3 */
md[0] |= 0x80;
md[qsize - 1] |= 0x01;
if (!BN_bin2bn(md, qsize, q))
goto err;
qsize here is the number of bits in q and evpmd is the digest set via
dsa_paramgen_md. md and buf2 are buffers of length SHA256_DIGEST_LENGTH.
buf2 has been filled with qsize bits of random seed data, and md is
uninitialised.
If the output size of evpmd is less than qsize then the line "md[i] ^=
buf2[i]" will be xoring an uninitialised value and the random seed data
together to form the least significant bits of q (and not using the
output of the digest at all for those bits) - which is probably not what
was intended. The same seed is then used as an input to generating p. If
the uninitialised data is actually all zeros (as seems quite likely)
then the least significant bits of q will exactly match the least
significant bits of the seed.
This problem only occurs if you use these undocumented and difficult to
find options and you set the size of q to be greater than the message
digest output size. This is for parameter generation only not key
generation. This scenario is considered highly unlikely and
therefore the security risk of this is considered negligible.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5884)
Matt Caswell [Thu, 29 Mar 2018 16:48:28 +0000 (17:48 +0100)]
Don't crash if an unrecognised digest is used with dsa_paramgen_md
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5884)
Bernd Edlinger [Mon, 2 Apr 2018 08:54:52 +0000 (10:54 +0200)]
Change the "offset too large" message to more generic wording
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5826)
(cherry picked from commit
1518c55a796b058eff01f3cbf177f4b726c01d7c)
Bernd Edlinger [Mon, 2 Apr 2018 07:13:49 +0000 (09:13 +0200)]
Fix range checks with -offset and -length in asn1parse
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5826)
(cherry picked from commit
16e1eea6a67c85c9d786f3c4448182b1aca101b8)
Bernd Edlinger [Sat, 31 Mar 2018 19:09:32 +0000 (21:09 +0200)]
Fix a crash in the asn1parse command
Thanks to Sem Voigtländer for reporting this issue.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5826)
(cherry picked from commit
752837e0664e990b5edf6f0b69e1b4612efadce0)
Miroslav Suk [Thu, 22 Mar 2018 08:20:43 +0000 (09:20 +0100)]
o_time.c: use gmtime_s with MSVC
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5719)
Philippe Antoine [Mon, 26 Mar 2018 08:25:55 +0000 (10:25 +0200)]
Adds multiple checks to avoid buffer over reads
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/5687)
Matt Caswell [Thu, 22 Mar 2018 14:33:05 +0000 (14:33 +0000)]
Don't write out a bad OID
If we don't have OID data for an object then we should fail if we
are asked to encode the ASN.1 for that OID.
Fixes #5723
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5725)
(cherry picked from commit
53c9818e970fc0c22d77e19fda3b3e6f6c9e759d)
Matt Caswell [Tue, 27 Mar 2018 13:56:15 +0000 (14:56 +0100)]
Prepare for 1.0.2p-dev
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 27 Mar 2018 13:55:22 +0000 (14:55 +0100)]
Prepare for 1.0.2o release
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 27 Mar 2018 13:55:22 +0000 (14:55 +0100)]
make update
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 27 Mar 2018 12:46:45 +0000 (13:46 +0100)]
Update copyright year
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 27 Mar 2018 09:58:34 +0000 (10:58 +0100)]
Update CHANGES and NEWS for the new release
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Thu, 22 Mar 2018 10:05:40 +0000 (10:05 +0000)]
Limit ASN.1 constructed types recursive definition depth
Constructed types with a recursive definition (such as can be found in
PKCS7) could eventually exceed the stack given malicious input with
excessive recursion. Therefore we limit the stack depth.
CVE-2018-0739
Credit to OSSFuzz for finding this issue.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Bernd Edlinger [Sun, 25 Mar 2018 10:50:17 +0000 (12:50 +0200)]
Fix dsaparam -genkey with DER outform
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5744)
(cherry picked from commit
5281435258b5d8201a00b4a9781bb724d99630f0)
Bernd Edlinger [Sat, 24 Mar 2018 14:17:11 +0000 (15:17 +0100)]
Fix ecparam -genkey with point compression or DER outform
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5741)
(cherry picked from commit
4bdc25b07f007d9c383fbad159f81543f2e95965)
Matt Caswell [Wed, 21 Mar 2018 16:27:55 +0000 (16:27 +0000)]
The default conv_form is uncompressed
Fixes #5711
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5712)
(cherry picked from commit
ab0a3914a64d8f1fce22795c02269e1288df52b1)
Samuel Weiser [Fri, 9 Feb 2018 13:11:47 +0000 (14:11 +0100)]
consttime flag changed
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5170)
(cherry picked from commit
7150a4720af7913cae16f2e4eaf768b578c0b298)
Samuel Weiser [Wed, 31 Jan 2018 12:10:55 +0000 (13:10 +0100)]
used ERR set/pop mark
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5170)
(cherry picked from commit
011f82e66f4bf131c733fd41a8390039859aafb2)
Samuel Weiser [Tue, 5 Dec 2017 14:55:17 +0000 (15:55 +0100)]
Replaced variable-time GCD with consttime inversion to avoid side-channel attacks on RSA key generation
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5170)
(cherry picked from commit
9db724cfede4ba7a3668bff533973ee70145ec07)
Bernd Edlinger [Wed, 21 Feb 2018 14:48:02 +0000 (15:48 +0100)]
Fix some bugs with the cfb1 bitsize handling
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5450)
Matt Caswell [Wed, 14 Mar 2018 14:40:18 +0000 (14:40 +0000)]
Fix a memory leak in the ca application
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5445)
Matt Caswell [Fri, 23 Feb 2018 19:48:11 +0000 (19:48 +0000)]
Allow multiple entries without a Subject even if unique_subject == yes
It is quite likely for there to be multiple certificates with empty
subjects, which are still distinct because of subjectAltName. Therefore
we allow multiple certificates with an empty Subject even if
unique_subject is set to yes.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5445)
Matt Caswell [Thu, 8 Mar 2018 15:55:46 +0000 (15:55 +0000)]
Report a readable error on a duplicate cert in ca app
Commit
87e8fec (16 years ago!) introduced a bug where if we are
attempting to insert a cert with a duplicate subject name, and
duplicate subject names are not allowed (which is the default),
then we get an unhelpful error message back (error number 2). Prior
to that commit we got a helpful error message which displayed details
of the conflicting entry in the database.
That commit was itself attempting to fix a bug with the noemailDN option
where we were setting the subject field in the database too early
(before extensions had made any amendments to it).
This PR moves the check for a conflicting Subject name until after all
changes to the Subject have been made by extensions etc.
This also, co-incidentally Fixes the ca crashing bug described in issue
5109.
Fixes #5109
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5445)
Matt Caswell [Fri, 23 Feb 2018 11:05:24 +0000 (11:05 +0000)]
Revert "Don't crash on a missing Subject in index.txt"
This reverts commit
a3d684ffca282796511cb8f3593a59a80109eed8.
Empty Subjects are permissible
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5445)
Matt Caswell [Fri, 23 Feb 2018 11:05:01 +0000 (11:05 +0000)]
Revert "Don't allow an empty Subject when creating a Certificate"
This reverts commit
dd37f6f12cc14cc4710289746b112eb0fed3b0b7.
Empty Subjects are permissible.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5445)
Richard Levitte [Wed, 14 Mar 2018 10:35:53 +0000 (11:35 +0100)]
crypto/engine/eng_cryptodev.c: don't treat a void* like an array
The void* needs to be cast to a char* first.
Fixes #5614
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5615)
Matt Caswell [Mon, 12 Mar 2018 15:24:29 +0000 (15:24 +0000)]
Free the correct type in OBJ_add_object()
We should be using ASN1_OBJECT_free() not OPENSSL_free().
Fixes #5568
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5599)
Matt Caswell [Mon, 12 Mar 2018 13:56:34 +0000 (13:56 +0000)]
Improve error handling in pk7_doit
If a mem allocation failed we would ignore it. This commit fixes it to
always check.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5596)
(cherry picked from commit
4718f449a3ecd5efac62b22d0fa9a759a7895dbc)
Kurt Roeckx [Sat, 10 Mar 2018 15:32:55 +0000 (16:32 +0100)]
Fix propotype to include the const qualifier
Reviewed-by: Andy Polyakov <appro@openssl.org>
GH: #5582
Richard Levitte [Thu, 8 Mar 2018 21:05:31 +0000 (22:05 +0100)]
Remove useless -D_ENDIAN from MPE/iX-gcc config
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5566)
Dr. Matthias St. Pierre [Wed, 7 Mar 2018 13:37:23 +0000 (14:37 +0100)]
BIO_s_mem.pod: fix indirection for out parameter **pp
BIO_get_mem_data() and BIO_get_mem_ptr() assign to *pp, not pp
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5544)
Bernd Edlinger [Sun, 4 Mar 2018 12:09:29 +0000 (13:09 +0100)]
Minor style fixup on recent commit
99bb59d at ssl_scan_clienthello_tlsext
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/5507)
Rich Salz [Sun, 4 Mar 2018 23:54:42 +0000 (18:54 -0500)]
Fix credit for SRP code
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5504)
Bernd Edlinger [Fri, 2 Mar 2018 08:27:39 +0000 (09:27 +0100)]
Fix a possible memory leak in engine_table_register
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5489)
(cherry picked from commit
55a7f77d72930f9aee1a51e0af9658b2728be127)
Viktor Dukhovni [Fri, 2 Mar 2018 15:30:04 +0000 (10:30 -0500)]
Fix wrong case in documentation of -CRLfile option
Reviewed-by: Rich Salz <rsalz@openssl.org>
Ivan Filenko [Sun, 25 Feb 2018 13:49:27 +0000 (16:49 +0300)]
Fix typo in ASN1_STRING_length doc
CLA: trivial
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5458)
Dr. Matthias St. Pierre [Wed, 21 Feb 2018 00:45:14 +0000 (01:45 +0100)]
bio_b64.c: prevent base64 filter BIO from decoding out-of-bound data
Fixes #5405, #1381
The base64 filter BIO reads its input in chunks of B64_BLOCK_SIZE bytes.
When processing input in PEM format it can happen in rare cases that
- the trailing PEM marker crosses the boundary of a chunk, and
- the beginning of the following chunk contains valid base64 encoded data.
This happened in issue #5405, where the PEM marker was split into
"-----END CER" and "TIFICATE-----" at the end of the first chunk.
The decoding of the first chunk terminated correctly at the '-' character,
which is treated as an EOF marker, and b64_read() returned. However,
when called the second time, b64_read() read the next chunk and interpreted
the string "TIFICATE" as valid base64 encoded data, adding 6 extra bytes
'4c 81 48 08 04 c4'.
This patch restores the assignment of the error code to 'ctx->cont', which
was deleted accidentally in commit
5562cfaca4f3 and which prevents b64_read()
from reading additional data on subsequent calls.
This issue was observed and reported by Annie Yousar.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5422)
White_Rabbit [Thu, 22 Feb 2018 18:58:19 +0000 (13:58 -0500)]
Update s_client doc adding xmpp as value for -starttls
CLA: trivial
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5407)
Philippe Antoine [Thu, 22 Feb 2018 18:56:40 +0000 (13:56 -0500)]
Checks ec_points_format extension size
Before reading first byte as length
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5410)
Pavel Kopyl [Sun, 10 Dec 2017 19:57:43 +0000 (22:57 +0300)]
do_body: fix heap-use-after-free.
The memory pointed to by the 'push' is freed by the
X509_NAME_ENTRY_free() in do_body(). The second time
it is referenced to (indirectly) in certify_cert:X509_REQ_free().
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4896)
Pavel Kopyl [Sun, 10 Dec 2017 19:49:42 +0000 (22:49 +0300)]
X509V3_EXT_add_nconf_sk, X509v3_add_ext: fix errors handling
X509v3_add_ext: free 'sk' if the memory pointed to by it
was malloc-ed inside this function.
X509V3_EXT_add_nconf_sk: return an error if X509v3_add_ext() fails.
This prevents use of a freed memory in do_body:sk_X509_EXTENSION_num().
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4896)
Matt Caswell [Tue, 20 Feb 2018 10:20:20 +0000 (10:20 +0000)]
Sanity check the ticket length before using key name/IV
This could in theory result in an overread - but due to the over allocation
of the underlying buffer does not represent a security issue.
Thanks to Fedor Indutny for reporting this issue.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5417)
Bernd Edlinger [Mon, 12 Feb 2018 08:28:33 +0000 (09:28 +0100)]
Remove code that prints "<SPACES/NULS>" in hexdumps
when the data block ends with SPACEs or NULs.
The problem is, you can't see if the data ends
with SPACE or NUL or a combination of both.
This can happen for instance with
openssl rsautl -decrypt -hexdump
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5332)
(cherry picked from commit
751485c6522f10006ba9f6cf90d719ea190e2201)
Bernd Edlinger [Fri, 9 Feb 2018 18:31:36 +0000 (19:31 +0100)]
Swap the check in ssl3_write_pending to avoid using
the possibly indeterminate pointer value in wpend_buf.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5309)