Matt Caswell [Thu, 9 Feb 2017 13:12:00 +0000 (13:12 +0000)]
Add the ability for a client to send a KeyUpdate message
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)
Matt Caswell [Thu, 9 Feb 2017 12:07:31 +0000 (12:07 +0000)]
Add the ability for a client to receive a KeyUpdate message
This just receives the message. It doesn't actually update any keys yet.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)
Matt Caswell [Wed, 8 Feb 2017 17:08:48 +0000 (17:08 +0000)]
Add SSL_trace() support for KeyUpdate messages
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)
Matt Caswell [Wed, 8 Feb 2017 16:52:23 +0000 (16:52 +0000)]
Add a capability to s_server to send KeyUpdate messages
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)
Matt Caswell [Wed, 8 Feb 2017 09:15:22 +0000 (09:15 +0000)]
Provide a function to send a KeyUpdate message
This implements the server side KeyUpdate sending capability as well.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)
David Benjamin [Thu, 16 Feb 2017 22:39:40 +0000 (17:39 -0500)]
Fix typo in x86_64-mont5.pl CFI directives
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2655)
Richard Levitte [Thu, 16 Feb 2017 20:07:33 +0000 (21:07 +0100)]
Add a test of the X509_STORE / X509_LOOKUP API
Fortunately, "openssl verify" makes good use of that API
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2652)
Richard Levitte [Thu, 16 Feb 2017 20:06:42 +0000 (21:06 +0100)]
test/README: clarify test number groups
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2652)
Matt Caswell [Thu, 16 Feb 2017 14:47:26 +0000 (14:47 +0000)]
Fix a mem leak in ssl_test_ctx.c
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2650)
Dr. Stephen Henson [Wed, 15 Feb 2017 22:16:09 +0000 (22:16 +0000)]
Add client auth TLS 1.3 certificate selection tests
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2643)
Dr. Stephen Henson [Wed, 15 Feb 2017 22:03:04 +0000 (22:03 +0000)]
Add ECDSA client certificates
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2643)
Dr. Stephen Henson [Wed, 15 Feb 2017 16:23:49 +0000 (16:23 +0000)]
Use tls_choose_sigalg for client auth.
For client auth call tls_choose_sigalg to select the certificate
and signature algorithm. Use the selected algorithm in
tls_construct_cert_verify.
Remove obsolete tls12_get_sigandhash.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2643)
Dr. Stephen Henson [Wed, 15 Feb 2017 16:19:43 +0000 (16:19 +0000)]
Add client side support to tls_choose_sigalg.
Select appropriate signature algorithm and certificate for client
authentication using tls_choose_sigalg.
A lot of selection logic is very similar except not finding a
certificate is not a fatal error: we just do not present a
certificate.
For TLS 1.2 and earlier we only check the current certificate
is suitable (for compatibility with previous logic) for TLS 1.3
(where there are no compatibility issues) we support multiple
client certificates for different algorithms.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2643)
lrns [Thu, 16 Feb 2017 11:27:55 +0000 (12:27 +0100)]
Change req_check_len error message, it also accepts 20 bytes, but states 'less than' in the error message
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2648)
Benjamin Kaduk [Thu, 29 Dec 2016 17:38:24 +0000 (11:38 -0600)]
Use _WIN32 over WIN32 for preprocessor conditional
The intent seems to be that the WIN32 symbol is for things that are a direct
byproduct of being a windows-variant configuration and should be used for
feature en/disablement on windows systems. Use of the _WIN32 symbol is more
widespread, being used to implement platform portability of more generic code.
We do define WIN32 in some situations in e_os.h, but that is not included
universally.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2642)
Matt Caswell [Thu, 16 Feb 2017 09:51:56 +0000 (09:51 +0000)]
Update CHANGES and NEWS for new release
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Fri, 3 Feb 2017 14:45:49 +0000 (14:45 +0000)]
Remove an OPENSSL_assert() and replace with a soft assert and check
Following on from CVE-2017-3733, this removes the OPENSSL_assert() check
that failed and replaces it with a soft assert, and an explicit check of
value with an error return if it fails.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Fri, 3 Feb 2017 14:06:20 +0000 (14:06 +0000)]
Don't change the state of the ETM flags until CCS processing
In 1.1.0 changing the ciphersuite during a renegotiation can result in
a crash leading to a DoS attack. In master this does not occur with TLS
(instead you get an internal error, which is still wrong but not a security
issue) - but the problem still exists in the DTLS code.
The problem is caused by changing the flag indicating whether to use ETM
or not immediately on negotiation of ETM, rather than at CCS. Therefore,
during a renegotiation, if the ETM state is changing (usually due to a
change of ciphersuite), then an error/crash will occur.
Due to the fact that there are separate CCS messages for read and write
we actually now need two flags to determine whether to use ETM or not.
CVE-2017-3733
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Fri, 3 Feb 2017 11:21:07 +0000 (11:21 +0000)]
Provide a test for the Encrypt-Then-Mac renegotiation crash
In 1.1.0 changing the ciphersuite during a renegotiation can result in
a crash leading to a DoS attack. In master this does not occur with TLS
(instead you get an internal error, which is still wrong but not a security
issue) - but the problem still exists in the DTLS code.
This commit provides a test for the issue.
CVE-2017-3733
Reviewed-by: Richard Levitte <levitte@openssl.org>
Dr. Stephen Henson [Thu, 16 Feb 2017 01:29:14 +0000 (01:29 +0000)]
Fix warning
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2644)
Robert Scheck [Tue, 14 Feb 2017 20:47:25 +0000 (21:47 +0100)]
Handle negative reply for NNTP STARTTLS in s_client
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2629)
Kazuki Yamaguchi [Thu, 26 Jan 2017 04:01:30 +0000 (13:01 +0900)]
Properly zero cipher_data for ChaCha20-Poly1305 on cleanup
Fix a typo. Probably this has not been found because EVP_CIPHER_CTX is
smaller than EVP_CHACHA_AEAD_CTX and heap overflow does not occur.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2294)
Andy Polyakov [Wed, 15 Feb 2017 11:01:09 +0000 (12:01 +0100)]
crypto/armcap.c: short-circuit processor capability probe in iOS builds.
Capability probing by catching SIGILL appears to be problematic
on iOS. But since Apple universe is "monocultural", it's actually
possible to simply set pre-defined processor capability mask.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2617)
Andy Polyakov [Mon, 13 Feb 2017 17:16:16 +0000 (18:16 +0100)]
ARMv4 assembly pack: harmonize Thumb-ification of iOS build.
Three modules were left behind in
a285992763f3961f69a8d86bf7dfff020a08cef9.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2617)
Dr. Stephen Henson [Wed, 15 Feb 2017 15:28:56 +0000 (15:28 +0000)]
Set current certificate to selected certificate.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2637)
Andy Polyakov [Mon, 13 Feb 2017 21:34:51 +0000 (22:34 +0100)]
sha/asm/*-x86_64.pl: add CFI annotations.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Bernd Edlinger [Wed, 15 Feb 2017 10:36:17 +0000 (11:36 +0100)]
Rework error handling of custom_ext_meth_add towards strong exception safety.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2636)
Matt Caswell [Wed, 15 Feb 2017 09:44:46 +0000 (09:44 +0000)]
Fix merge issue
Causes make update to fail.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2634)
Dr. Stephen Henson [Tue, 14 Feb 2017 14:27:15 +0000 (14:27 +0000)]
Skip curve check if sigalg doesn't specify a curve.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)
Dr. Stephen Henson [Tue, 14 Feb 2017 00:35:26 +0000 (00:35 +0000)]
Use CERT_PKEY pointer instead of index
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)
Dr. Stephen Henson [Mon, 13 Feb 2017 18:07:00 +0000 (18:07 +0000)]
Simplify tls_construct_server_key_exchange
Use negotiated signature algorithm and certificate index in
tls_construct_key_exchange instead of recalculating it.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)
Dr. Stephen Henson [Mon, 13 Feb 2017 16:32:06 +0000 (16:32 +0000)]
Use cert_index and sigalg
Now the certificate and signature algorithm is set in one place we
can use it directly insetad of recalculating it. The old functions
ssl_get_server_send_pkey() and ssl_get_server_cert_index() are no
longer required.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)
Dr. Stephen Henson [Mon, 13 Feb 2017 16:04:07 +0000 (16:04 +0000)]
Add sigalg for earlier TLS versions
Update tls_choose_sigalg to choose a signature algorithm for all
versions of TLS not just 1.3.
For TLS 1.2 we choose the highest preference signature algorithm
for the chosen ciphersuite.
For TLS 1.1 and earlier the signature algorithm is determined by
the ciphersuite alone. For RSA we use a special MD5+SHA1 signature
algorithm.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)
Dr. Stephen Henson [Mon, 13 Feb 2017 15:50:43 +0000 (15:50 +0000)]
Change tls_choose_sigalg so it can set errors and alerts.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)
Dr. Stephen Henson [Mon, 13 Feb 2017 15:40:21 +0000 (15:40 +0000)]
add ssl_has_cert
Add inline function ssl_has_cert which checks to see if a certificate and
private key for a given index are not NULL.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2623)
FdaSilvaYY [Mon, 6 Feb 2017 23:05:06 +0000 (00:05 +0100)]
Fix a few typos
[skip ci]
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2571)
Guido Vranken [Sat, 11 Feb 2017 21:41:38 +0000 (22:41 +0100)]
Remove obsolete comment
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1613)
Guido Vranken [Thu, 22 Sep 2016 20:48:44 +0000 (22:48 +0200)]
Prevents that OPENSSL_gmtime incorrectly signals success if gmtime_r fails, and that struct* tm result's possibly uninitialized content is used
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1613)
Bernd Edlinger [Mon, 13 Feb 2017 17:36:13 +0000 (18:36 +0100)]
Use TLSEXT_KEYNAME_LENGTH in tls_decrypt_ticket.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2618)
Guido Vranken [Mon, 13 Feb 2017 00:36:43 +0000 (01:36 +0100)]
Prevent allocations of size 0 in sh_init, which are not possible with the default OPENSSL_zalloc, but are possible if the user has installed their own allocator using CRYPTO_set_mem_functions. If the 0-allocations succeeds, the secure heap code will later access (at least) the first byte of that space, which is technically an OOB access. This could lead to problems with some custom allocators that only return a valid pointer for subsequent free()-ing, and do not expect that the pointer is actually dereferenced.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2605)
Robert Scheck [Thu, 9 Feb 2017 21:20:59 +0000 (22:20 +0100)]
Add Sieve support (RFC 5804) to s_client ("-starttls sieve")
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2300)
Rich Salz [Tue, 14 Feb 2017 16:51:22 +0000 (11:51 -0500)]
Add no-ec build
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2626)
Dr. Stephen Henson [Tue, 14 Feb 2017 17:18:00 +0000 (17:18 +0000)]
Make -xcert work again.
When a certificate is prepended update the list pointer.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2628)
Matt Caswell [Tue, 14 Feb 2017 15:57:50 +0000 (15:57 +0000)]
Fix no-ec compilation
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2624)
Matt Caswell [Wed, 8 Feb 2017 17:27:09 +0000 (17:27 +0000)]
Remove a double call to ssl3_send_alert()
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Wed, 8 Feb 2017 17:16:25 +0000 (17:16 +0000)]
Fix a bogus uninit variable warning
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Mon, 6 Feb 2017 16:52:38 +0000 (16:52 +0000)]
Add a bytestogroup macro
For converting the 2 byte group id into an unsigned int.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Mon, 6 Feb 2017 16:47:29 +0000 (16:47 +0000)]
Various style fixes following review feedback
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Thu, 2 Feb 2017 16:28:45 +0000 (16:28 +0000)]
Update the tls13messages test to add some HRR scenarios
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Thu, 2 Feb 2017 16:06:50 +0000 (16:06 +0000)]
Update the kex modes tests to check various HRR scenarios
Make sure we get an HRR in the right circumstances based on kex mode.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Thu, 2 Feb 2017 16:06:28 +0000 (16:06 +0000)]
Update TLSProxy to know about HelloRetryRequest messages
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Thu, 2 Feb 2017 14:54:24 +0000 (14:54 +0000)]
Update test counting in checkhandshake.pm
Previously counting the number of tests in checkhandshake.pm took an
initial guess and then modified it based on various known special
cases. That is becoming increasingly untenable, so this changes it to
properly calculate the number of tests we expect to run.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Thu, 2 Feb 2017 13:12:08 +0000 (13:12 +0000)]
Update the key_share tests for HelloRetryRequest
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Thu, 2 Feb 2017 11:16:25 +0000 (11:16 +0000)]
Add trace support for HelloRetryRequest
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Wed, 1 Feb 2017 17:10:45 +0000 (17:10 +0000)]
Implement support for resumption with a HelloRetryRequest
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Wed, 1 Feb 2017 13:31:27 +0000 (13:31 +0000)]
Add client side support for parsing Hello Retry Request
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Mon, 30 Jan 2017 16:16:28 +0000 (16:16 +0000)]
Add server side support for creating the Hello Retry Request message
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Matt Caswell [Tue, 31 Jan 2017 17:00:12 +0000 (17:00 +0000)]
Make the context available to the extensions parse and construction funcs
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
Yuchi [Mon, 6 Feb 2017 00:33:47 +0000 (19:33 -0500)]
mem leak on error path and error propagation fix
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2559)
Andy Polyakov [Fri, 10 Feb 2017 10:02:09 +0000 (11:02 +0100)]
aes/asm/*-x86_64.pl: add CFI annotations.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Fri, 10 Feb 2017 09:59:45 +0000 (10:59 +0100)]
perlasm/x86_64-xlate.pl: recognize even offset(%reg) in cfa_expression.
This is handy when "offset(%reg)" is a perl variable.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Fri, 10 Feb 2017 11:20:18 +0000 (12:20 +0100)]
ec/asm/ecp_nistz256-x86_64.pl: add CFI directives.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Fri, 10 Feb 2017 10:43:42 +0000 (11:43 +0100)]
ec/asm/ecp_nistz256-x86_64.pl: fix typo-bug in Win64 SE handler.
Thanks to Jun Sun for spotting this.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andrea Grandi [Fri, 10 Feb 2017 10:23:21 +0000 (10:23 +0000)]
Further improvements to ASYNC_WAIT_CTX_clear_fd
Remove call to cleanup function
Use only one loop to find previous element
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2581)
Andrea Grandi [Fri, 3 Feb 2017 05:46:17 +0000 (05:46 +0000)]
Remove fd from the list when the engine clears the wait context before pause
This fixes the num of fds added/removed returned by ASYNC_WAIT_CTX_get_changed_fds
Previously, the numbers were not consistent with the fds actually written in
the buffers since the fds that have been both added and removed are explicitly
ignored in the loop.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2581)
Andrea Grandi [Thu, 26 Jan 2017 03:17:54 +0000 (03:17 +0000)]
Add test to show wrong behavior of ASYNC_WAIT_CTX
This happens when a fd is added and then immediately removed from the
ASYNC_WAIT_CTX before pausing the job.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2581)
Andy Polyakov [Sat, 11 Feb 2017 21:31:47 +0000 (22:31 +0100)]
{md5,rc4}/asm/*-x86_64.pl: add CFI annotations.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Sat, 11 Feb 2017 21:08:12 +0000 (22:08 +0100)]
modes/asm/*-x86_64.pl: add CFI annotations.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Darren Tucker [Sun, 12 Feb 2017 23:36:29 +0000 (10:36 +1100)]
DES keys are not 7 days long.
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2604)
Richard Levitte [Fri, 10 Feb 2017 21:50:24 +0000 (22:50 +0100)]
test_rehash does nothing, have it do something
test/recipes/40-test_rehash.t uses test files from certs/demo, which
doesn't exist any longer. Have it use PEM files from test/ instead.
Because rehash wants only one certificate or CRL per file, we must
also filter those PEM files to produce test files with a single object
each.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2594)
Adam Langley [Fri, 10 Feb 2017 18:19:06 +0000 (10:19 -0800)]
sha/asm/sha1-x86_64.pl: add CFI annotations.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2590)
Dr. Stephen Henson [Fri, 10 Feb 2017 04:23:53 +0000 (04:23 +0000)]
Replace SSL_PKEY_RSA_ENC, SSL_PKEY_RSA_SIGN
The original intent of SSL_PKEY_RSA_SIGN and SSL_PKEY_RSA_ENC was to
support two different keys for RSA signing and decrypt. However this
was never implemented and we only ever set one key and the other was
always NULL. Replace with single SSL_PKEY_RSA type.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2587)
Dr. Stephen Henson [Fri, 10 Feb 2017 04:22:18 +0000 (04:22 +0000)]
Check index >= 0 as 0 is a valid index.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2587)
Andy Polyakov [Fri, 10 Feb 2017 10:27:54 +0000 (11:27 +0100)]
perlasm/x86_64-xlate.pl: fix pair of typo-bugs in the new cfi_directive.
.cfi_{start|end}proc and .cfi_def_cfa were not tracked.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2585)
Adam Langley [Thu, 9 Feb 2017 22:37:01 +0000 (14:37 -0800)]
perlasm/x86_64-xlate.pl: typo fix in comment.
CLA: trivial
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2584)
Adam Langley [Thu, 9 Feb 2017 20:02:08 +0000 (12:02 -0800)]
Fix copy-pasteism in CFI directives.
I don't think this actually affects anything since the cfi_restore
directives aren't strictly needed anyway. (The old values are still in
memory so either will do.)
CLA: trivial
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2582)
Lukasz Pawelczyk [Thu, 17 Nov 2016 09:31:39 +0000 (10:31 +0100)]
Restore EVP_CIPH_FLAG_LENGTH_BITS working properly
EVP_CIPH_FLAG_LENGTH_BITS flag for CFB1 has been broken with the
introduction of the is_partially_overlapping() check that did not take
it into the account (treating number of bits passed as bytes). This
remedies that and allows this flag to work as intended.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1942)
Cristian Stoica [Tue, 2 Aug 2016 08:41:30 +0000 (11:41 +0300)]
speed.c: simplify aggregation of ecdh --multi results
CLA: trivial
Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1377)
Cristian Stoica [Tue, 2 Aug 2016 08:38:45 +0000 (11:38 +0300)]
speed.c: simplify aggregation of ecdsa --multi results
CLA: trivial
Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1377)
Cristian Stoica [Tue, 2 Aug 2016 08:22:27 +0000 (11:22 +0300)]
speed.c: simplify aggregation of dsa --multi results
CLA: trivial
Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1377)
Cristian Stoica [Tue, 2 Aug 2016 08:13:00 +0000 (11:13 +0300)]
speed.c: simplify aggregation of rsa --multi results
CLA: trivial
Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1377)
David Benjamin [Thu, 9 Feb 2017 20:13:13 +0000 (15:13 -0500)]
Don't read uninitialised data for short session IDs.
While it's always safe to read |SSL_MAX_SSL_SESSION_ID_LENGTH| bytes
from an |SSL_SESSION|'s |session_id| array, the hash function would do
so with without considering if all those bytes had been written to.
This change checks |session_id_length| before possibly reading
uninitialised memory. Since the result of the hash function was already
attacker controlled, and since a lookup of a short session ID will
always fail, it doesn't appear that this is anything more than a clean
up.
In particular, |ssl_get_prev_session| uses a stack-allocated placeholder
|SSL_SESSION| as a lookup key, so the |session_id| array may be
uninitialised.
This was originally found with libFuzzer and MSan in
https://boringssl.googlesource.com/boringssl/+/
e976e4349d693b4bbb97e1694f45be5a1b22c8c7,
then by Robert Swiecki with honggfuzz and MSan here. Thanks to both.
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2583)
Andy Polyakov [Wed, 8 Feb 2017 09:12:28 +0000 (10:12 +0100)]
bn/asm/x86_64*: add DWARF CFI directives.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Mon, 6 Feb 2017 07:58:34 +0000 (08:58 +0100)]
perlasm/x86_64-xlate.pl: recognize DWARF CFI directives.
CFI directives annotate instructions that are significant for stack
unwinding procedure. In addition to directives recognized by GNU
assembler this module implements three synthetic ones:
- .cfi_push annotates push instructions in prologue and translates to
.cfi_adjust_cfa_offset (if needed) and .cfi_offset;
- .cfi_pop annotates pop instructions in epilogue and translates to
.cfi_adjust_cfs_offset (if needed) and .cfi_restore;
- .cfi_cfa_expression encodes DW_CFA_def_cfa_expression and passes it
to .cfi_escape as byte vector;
CFA expression syntax is made up mix of DWARF operator suffixes [subset
of] and references to registers with optional bias. Following example
describes offloaded original stack pointer at specific offset from
current stack pointer:
.cfi_cfa_expression %rsp+40,deref,+8
Final +8 has everything to do with the fact that CFA, Canonical Frame
Address, is reference to top of caller's stack, and on x86_64 call to
subroutine pushes 8-byte return address.
Triggered by request from Adam Langley.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Sat, 4 Feb 2017 12:26:15 +0000 (13:26 +0100)]
perlasm/x86_64-xlate.pl: remove obsolete .picmeup synthetic directive.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Sat, 4 Feb 2017 12:24:42 +0000 (13:24 +0100)]
perlasm/x86_64-xlate.pl: minor readability updates.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Wed, 8 Feb 2017 09:09:21 +0000 (10:09 +0100)]
bn/asm/rsaz-avx2.pl: refine Win64 SE handler.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Tue, 7 Feb 2017 14:17:57 +0000 (14:17 +0000)]
Fix a typo in the X509_get0_subject_key_id() documentation
Fixes a copy&paste error
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2568)
Richard Levitte [Thu, 9 Feb 2017 09:30:44 +0000 (10:30 +0100)]
Add needed module in 25-test_sid.t
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2579)
Peter Wu [Thu, 2 Feb 2017 11:11:10 +0000 (12:11 +0100)]
SSL_get_shared_sigalgs: handle negative idx parameter
When idx is negative (as is the case with do_print_sigalgs in
apps/s_cb.c), AddressSanitizer complains about a buffer overflow (read).
Even if the pointer is not dereferenced, this is undefined behavior.
Change the user not to use "-1" as index since the function is
documented to return 0 on out-of-range values.
Tested with `openssl s_server` and `curl -k https://localhost:4433`.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2349)
Richard Levitte [Mon, 6 Feb 2017 16:49:41 +0000 (17:49 +0100)]
Because our test sid file contains EC, don't try it when configured no-ec
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2564)
Matt Caswell [Wed, 8 Feb 2017 09:33:44 +0000 (09:33 +0000)]
Fix crash in tls13_enc
If s->s3->tmp.new_cipher is NULL then a crash can occur. This can happen
if an alert gets sent after version negotiation (i.e. we have selected
TLSv1.3 and ended up in tls13_enc), but before a ciphersuite has been
selected.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2575)
Dr. Stephen Henson [Sat, 4 Feb 2017 13:12:49 +0000 (13:12 +0000)]
Update documentation
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Sat, 4 Feb 2017 18:25:09 +0000 (18:25 +0000)]
update test
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Thu, 2 Feb 2017 23:11:07 +0000 (23:11 +0000)]
Add remaining TLS1.3 ciphersuites
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Fri, 3 Feb 2017 02:49:26 +0000 (02:49 +0000)]
Call EVP_CipherFinal in CCM mode for tests.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Fri, 3 Feb 2017 02:47:56 +0000 (02:47 +0000)]
Make EVP_*Final work for CCM ciphers
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Mon, 6 Feb 2017 19:25:34 +0000 (19:25 +0000)]
Use contants for Chacha/Poly, redo algorithm expressions.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Fri, 3 Feb 2017 02:44:15 +0000 (02:44 +0000)]
Add CCM mode support for TLS 1.3
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)
Dr. Stephen Henson [Fri, 3 Feb 2017 02:43:03 +0000 (02:43 +0000)]
Add constants to CCM and TLS.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2550)