Andy Polyakov [Tue, 10 Nov 2015 20:11:24 +0000 (21:11 +0100)]
bn/asm/s390x.S: improve performance on z196 and z13 by up to 26%. [even z10 is couple percent faster]. Triggered by RT#4128, but solves the problem by real modulo-scheduling.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
9d0e4dc6351df7d0c08400c4b4cf17c017022e50)
Andy Polyakov [Wed, 4 Nov 2015 22:57:06 +0000 (23:57 +0100)]
aesni-sha256-x86_64.pl: fix crash on AMD Jaguar.
It was also found that stich performs suboptimally on AMD Jaguar, hence
execution is limited to XOP-capable and Intel processors.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit
a5fd24d19bbb586b1c6d235c2021e9bead22c9f5)
Graeme Perrow [Fri, 13 Nov 2015 21:56:18 +0000 (16:56 -0500)]
RT32671: wrong multiple errs TS_check_status_info
Manual cherry-pick of
0704343f138a38d3882d5af2a4ebe8821e9a8f3a.
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Andy Polyakov [Tue, 10 Nov 2015 20:57:22 +0000 (21:57 +0100)]
modes/asm/ghash-armv4.pl: make it compile by clang. RT#3989
Reviewed-by: Matt Caswell <matt@openssl.org>
Matt Caswell [Tue, 10 Nov 2015 15:17:42 +0000 (15:17 +0000)]
Stop DTLS servers asking for unsafe legacy renegotiation
If a DTLS client that does not support secure renegotiation connects to an
OpenSSL DTLS server then, by default, renegotiation is disabled. If a
server application attempts to initiate a renegotiation then OpenSSL is
supposed to prevent this. However due to a discrepancy between the TLS and
DTLS code, the server sends a HelloRequest anyway in DTLS.
This is not a security concern because the handshake will still fail later
in the process when the client responds with a ClientHello.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Matt Caswell [Tue, 3 Nov 2015 15:49:08 +0000 (15:49 +0000)]
Only call ssl3_init_finished_mac once for DTLS
In DTLS if an IO retry occurs during writing of a fragmented ClientHello
then we can end up reseting the finish mac variables on the retry, which
causes a handshake failure. We should only reset on the first attempt not
on retries.
Thanks to BoringSSL for reporting this issue.
RT#4119
Reviewed-by: Tim Hudson <tjh@openssl.org>
Matt Caswell [Mon, 9 Nov 2015 16:37:33 +0000 (16:37 +0000)]
Remove redundant check from tls1_get_curvelist
The function tls1_get_curvelist() has an explicit check to see if s->cert
is NULL or not. However the check appears *after* calling the tls1_suiteb
macro which derefs s->cert. In reality s->cert can never be NULL because
it is created in SSL_new(). If the malloc fails then the SSL_new call fails
and no SSL object is created.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit
6329b6092b28b656be8a1e4a8363d2e3bcc32053)
Conflicts:
ssl/t1_lib.c
Matt Caswell [Wed, 4 Nov 2015 15:51:02 +0000 (15:51 +0000)]
Fix missing malloc return value checks
During work on a larger change in master a number of locations were
identified where return value checks were missing. This backports the
relevant fixes.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Mon, 9 Nov 2015 08:50:56 +0000 (09:50 +0100)]
Make the match for previous cflags a bit more strict
./Configure [target] --strict-warnings -Wno-pedantic-ms-format
would not add '-pedantic' because it matches '-Wno-pedantic-ms-format',
which was added first.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
6703c4ea87b30554283deaa5df1f8d68725d3ee4)
Dr. Stephen Henson [Sun, 8 Nov 2015 13:47:53 +0000 (13:47 +0000)]
Reject TLS 1.2 ciphersuites if not allowed.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Matt Caswell [Wed, 4 Nov 2015 14:46:03 +0000 (14:46 +0000)]
Ensure the dtls1_get_*_methods work with DTLS_ANY_VERSION
The various dtls1_get*_methods did not handle the DTLS_ANY_VERSION case,
so this needed to be added.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Matt Caswell [Mon, 2 Nov 2015 15:37:45 +0000 (15:37 +0000)]
Minor EVP_SignInit_ex doc fix
EVP_SignInit_ex was missing from the NAME section of its man page so
typing "man EVP_SignInit_ex" failed to load the page.
Reviewed-by: Stephen Henson <steve@openssl.org>
(cherry picked from commit
3d866ea67e8b19777e88ac2a78ee4188e0983168)
Matt Caswell [Sun, 1 Nov 2015 14:41:29 +0000 (14:41 +0000)]
Clarify the preferred way of creating patch files
Clarify that git format-patch output is preferred for creating patch files.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
f89ee71bc81017e04ac50f570d8aed87f495bcf2)
Rich Salz [Sun, 1 Nov 2015 13:38:42 +0000 (08:38 -0500)]
Various README and CONTRIBUTING updates
Close GH Issue 69
Close GH PR 457/RT4113
Some other updates
By Rich Salz, Alessandro Ghedini, Steve Marquess, Collin Anderson
(manual cherry-pick of
a2aaf8be7e3c22a61ef89f273aa85f482b955336 and
b06935f439af7150d3ae566922353c3f210e63ed)
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Pascal Cuoq [Mon, 12 Oct 2015 10:19:19 +0000 (12:19 +0200)]
BN_GF2m_mod_inv(): check bn_wexpand return value
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@akamai.com>
MR #1276, RT #4107
(cherry picked from commit
94b3664a528258df5ebcaae213d19bf6568cc47d)
Alessandro Ghedini [Thu, 8 Oct 2015 20:00:27 +0000 (22:00 +0200)]
Remove useless code
RT#4081
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
070c23325af4526c9a8532a60d63522c58d5554b)
Alessandro Ghedini [Thu, 8 Oct 2015 12:50:27 +0000 (14:50 +0200)]
Check memory allocation
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
8cf9d71a3a43d9b98a8a278d47dc08088a954a7b)
Alessandro Ghedini [Thu, 8 Oct 2015 12:41:09 +0000 (14:41 +0200)]
Fix references to various RFCs
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
3240e7cf5f651d9d94814b4d494fbe294e463b72)
Alessandro Ghedini [Thu, 8 Oct 2015 12:40:42 +0000 (14:40 +0200)]
Fix typos
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
d900a015b5a89ea2018e6122dd2738925e4d68ab)
Alessandro Ghedini [Thu, 8 Oct 2015 12:39:58 +0000 (14:39 +0200)]
Set salt length after the malloc has succeeded
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
c2319cf9fce87a2e82efb6e58ced11a85190dc3d)
Alessandro Ghedini [Thu, 8 Oct 2015 12:38:57 +0000 (14:38 +0200)]
Fix memory leaks and other mistakes on errors
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
3f6c7691870d1cd2ad0e0c83638cef3f35a0b548)
Alessandro Ghedini [Thu, 8 Oct 2015 12:37:21 +0000 (14:37 +0200)]
Replace malloc+strlcpy with strdup
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
8acaabec429b39f9436f6a88006384d72d292539)
Alessandro Ghedini [Fri, 2 Oct 2015 13:16:08 +0000 (15:16 +0200)]
Do not treat 0 return value from BIO_get_fd() as error
0 is a valid file descriptor.
RT#4068
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
4428c7dba8f6f407d915c1226f4e0f673e8be241)
Adam Eijdenberg [Mon, 19 Oct 2015 18:16:25 +0000 (11:16 -0700)]
Clarify return values for EVP_DigestVerifyFinal.
Previous language was unclear. New language isn't pretty but I believe
it is more accurate.
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
8cbb048c3ea416f2bd8a3706d027f3aa26ef08d9)
Dr. Stephen Henson [Wed, 5 Aug 2015 02:21:40 +0000 (03:21 +0100)]
Fix self signed handling.
Don't mark a certificate as self signed if keyUsage is present and
certificate signing not asserted.
PR#3979
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
f51e5ed6b4b91d12228da873db72aa28109d1797)
Emilia Kasper [Fri, 9 Oct 2015 18:00:53 +0000 (20:00 +0200)]
make depend: prefer clang over makedepend
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Mon, 12 Oct 2015 20:14:04 +0000 (21:14 +0100)]
RFC5753 compliance.
RFC5753 requires that we omit parameters for AES key wrap and set them
to NULL for 3DES wrap. OpenSSL decrypt uses the received algorithm
parameters so can transparently handle either form.
Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit
4ec36aff2a3c221b640dafa56ac838312e6724f4)
Peter Mosmans [Tue, 27 May 2014 22:26:11 +0000 (23:26 +0100)]
RT3346: Fix test_bn regexp for Windows using MSYS.
(cherry picked from commit
028bac0670c167f154438742eb4d0fbed73df209)
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Dr. Stephen Henson [Sat, 10 Oct 2015 23:06:56 +0000 (00:06 +0100)]
Typo.
PR#4079
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit
c69ce9351336f5b4a8b33890756b3fd185528210)
Matt Caswell [Thu, 8 Oct 2015 12:36:10 +0000 (13:36 +0100)]
Don't treat a bare OCTETSTRING as DigestInfo in int_rsa_verify
The function int_rsa_verify is an internal function used for verifying an
RSA signature. It takes an argument |dtype| which indicates the digest type
that was used. Dependant on that digest type the processing of the
signature data will vary. In particular if |dtype == NID_mdc2| and the
signature data is a bare OCTETSTRING then it is treated differently to the
default case where the signature data is treated as a DigestInfo (X509_SIG).
Due to a missing "else" keyword the logic actually correctly processes the
OCTETSTRING format signature first, and then attempts to continue and
process it as DigestInfo. This will invariably fail because we already know
that it is a bare OCTETSTRING.
This failure doesn't actualy make a real difference because it ends up at
the |err| label regardless and still returns a "success" result. This patch
just cleans things up to make it look a bit more sane.
RT#4076
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
dffe51091f412dcbc18f6641132f0b4f0def6bce)
Richard Levitte [Thu, 8 Oct 2015 09:53:07 +0000 (11:53 +0200)]
When ENGINE_add finds that id or name is missing, actually return
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
5850cc75ea0c1581a9034390f1ca77cadc596238)
Alessandro Ghedini [Wed, 7 Oct 2015 20:40:37 +0000 (16:40 -0400)]
Fix travis 1.0.2 builds
Disable -Wshadow error when building with GCC
Add support for linu-x86_64-clang debug; this is needed for Travis CI.
Disable linux-clang and mingw debug builds on Travis CI; not supported.
Fix Travis email notifications config
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Pascal Cuoq [Tue, 5 May 2015 09:20:39 +0000 (11:20 +0200)]
Move BN_CTX_start() call so the error case can always call BN_CTX_end().
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1231
(cherry picked from commit
99c203337574d967c86ffbfa13f40ace51048485)
Pascal Cuoq [Wed, 6 May 2015 07:55:28 +0000 (09:55 +0200)]
Properly check return type of DH_compute_key()
It returns -1 on error, not 0.
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1231
(cherry picked from commit
d6e92c0bd6c36fc68291e79ef5753fd7f0420695)
Pascal Cuoq [Wed, 6 May 2015 09:31:27 +0000 (11:31 +0200)]
Set flags to 0 before calling BN_with_flags()
BN_with_flags() will read the dest->flags to keep the BN_FLG_MALLOCED but
overwrites everything else.
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1231
(cherry picked from commit
f92768e6f5259069bd21dbed2b98b3423c1dfca4)
Dr. Stephen Henson [Tue, 6 Oct 2015 13:15:14 +0000 (14:15 +0100)]
Don't try and parse boolean type.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
e58c4d3cdde7a0a01df2884bfeec31a2b07be22d)
Matt Caswell [Mon, 5 Oct 2015 13:12:05 +0000 (14:12 +0100)]
Change functions to pass in a limit rather than calculate it
Some extension handling functions were passing in a pointer to the start
of the data, plus the length in order to calculate the end, rather than
just passing in the end to start with. This change makes things a little
more readable.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Alessandro Ghedini [Fri, 2 Oct 2015 12:38:30 +0000 (14:38 +0200)]
Validate ClientHello extension field length
RT#4069
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Kurt Roeckx [Tue, 29 Sep 2015 17:59:48 +0000 (19:59 +0200)]
Fix more d2i cases to properly update the input pointer
Thanks to David Benjamin <davidben@google.com> for pointing them out.
Reviewed-by: Steve Henson <steve@openssl.org>
MR #1198
(cherry picked from commit
605236f6a8fe0743af2f63d93239a74c69dae137)
Dr. Stephen Henson [Mon, 28 Sep 2015 13:14:10 +0000 (14:14 +0100)]
Link in applink with fips_premain_dso
PR#4042
Reviewed-by: Tim Hudson <tjh@openssl.org>
Ismo Puustinen [Fri, 18 Sep 2015 20:07:23 +0000 (16:07 -0400)]
GH367: use random data if seed too short.
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Emilia Kasper [Wed, 23 Sep 2015 17:29:18 +0000 (19:29 +0200)]
RT2772: accept empty SessionTicket
RFC 5077 section 3.3 says: If the server determines that it does not
want to include a ticket after it has included the SessionTicket
extension in the ServerHello, then it sends a zero-length ticket in the
NewSessionTicket handshake message.
Previously the client would fail upon attempting to allocate a
zero-length buffer. Now, we have the client ignore the empty ticket and
keep the existing session.
Reviewed-by: Matt Caswell <matt@openssl.org>
Dr. Stephen Henson [Mon, 28 Sep 2015 13:31:53 +0000 (14:31 +0100)]
SRP memory leak fix
Reviewed-by: Richard Levitte <levitte@openssl.org>
Rich Salz [Fri, 25 Sep 2015 15:44:28 +0000 (11:44 -0400)]
Fix typo in previous merge.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Rich Salz [Fri, 25 Sep 2015 15:38:43 +0000 (11:38 -0400)]
Change --debug to -d for compat with old releases.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit
1d4ddb4e1a088f1333c4bb155c52c7f94e572bca)
Emilia Kasper [Thu, 17 Sep 2015 11:55:09 +0000 (13:55 +0200)]
Document BUF_strnlen
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
21b0fa91186ff1c1c3d956c0593ef4ac02521695)
Emilia Kasper [Thu, 17 Sep 2015 11:50:34 +0000 (13:50 +0200)]
BUF_strdup and friends: update docs
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
58e3457a82e8940ff36b36949f9c7a60e7614b2c)
Emilia Kasper [Thu, 17 Sep 2015 11:27:05 +0000 (13:27 +0200)]
BUF_strndup: tidy
Fix comment, add another overflow check, tidy style
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
de8883e11befde31d9b6cfbbd1fc017c365e0bbf)
Alessandro Ghedini [Wed, 16 Sep 2015 15:54:05 +0000 (17:54 +0200)]
Make BUF_strndup() read-safe on arbitrary inputs
BUF_strndup was calling strlen through BUF_strlcpy, and ended up reading
past the input if the input was not a C string.
Make it explicitly part of BUF_strndup's contract to never read more
than |siz| input bytes. This augments the standard strndup contract to
be safer.
The commit also adds a check for siz overflow and some brief documentation
for BUF_strndup().
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
110f7b37de9feecfb64950601cc7cec77cf6130b)
Rich Salz [Mon, 21 Sep 2015 23:54:36 +0000 (19:54 -0400)]
GH398: Add mingw cross-compile, etc.
For all release branches. It adds travis build support. If you don't
have a config file it uses the default (because we enabled travis for the
project), which uses ruby/rake/rakefiles, and you get confusing "build
still failing" messages.
Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit
db9defdfe306e1adf0af7188b187d535eb0268da)
David Woodhouse [Wed, 9 Sep 2015 19:49:01 +0000 (15:49 -0400)]
RT3479: Add UTF8 support to BIO_read_filename()
If we use BIO_new_file(), on Windows it'll jump through hoops to work
around their unusual charset/Unicode handling. it'll convert a UTF-8
filename to UCS-16LE and attempt to use _wfopen().
If you use BIO_read_filename(), it doesn't do this. Shouldn't it be
consistent?
It would certainly be nice if SSL_use_certificate_chain_file() worked.
Also made BIO_C_SET_FILENAME work (rsalz)
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit
ff03599a2f518dbdf13bca0bb0208e431b892fe9)
Gunnar Kudrjavets [Mon, 27 Apr 2015 18:14:45 +0000 (11:14 -0700)]
RT3823: Improve the robustness of event logging
There are a couple of minor fixes here:
1) Handle the case when RegisterEventSource() fails (which it may for
various reasons) and do the work of logging the event only if it succeeds.
2) Handle the case when ReportEvent() fails and do our best in debug builds
to at least attempt somehow indicate that something has gone wrong. The
typical situation would be someone running tools like DbMon, DBWin32,
DebugView or just having the debugger attached. The intent is to make sure
that at least some data will be captured so that we can save hours and days
of debugging time.
3) Minor fix to change the MessageBox() flag to MB_ICONERROR. Though the
value of MB_ICONERROR is the same value as MB_ICONSTOP, the intent is
better conveyed by using MB_ICONERROR.
Testing performed:
1) Clean compilation for debug-VC-WIN32 and VC-WIN32.
2) Good test results (nmake -f ms\ntdll.mak test) for debug-VC-WIN32 and
VC-WIN32.
3) Stepped through relevant changes using WinDBG and exercised the impacted
code paths.
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
4cd94416a452c3a3e0df24c297f7d2f0e6d5bb5f)
Matt Caswell [Wed, 16 Sep 2015 09:24:37 +0000 (10:24 +0100)]
Fix SRP memory leaks
There were some memory leaks in the creation of an SRP verifier (both on
successful completion and also on some error paths).
Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit
bf95cde28712cfcad90cb3975cdcb8e5c0f20fde)
Dr. Stephen Henson [Sun, 13 Sep 2015 18:04:58 +0000 (19:04 +0100)]
Handle SSL_ERROR_WANT_X509_LOOKUP
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
f1c412c9e63f7c9cac2c723bff09cce563dda1b0)
Dr. Stephen Henson [Sat, 12 Sep 2015 01:37:48 +0000 (02:37 +0100)]
Make SRP work with -www
PR#3817
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
4e7e623012e1604d985e2ef362c2957d464f3f01)
Viktor Dukhovni [Sat, 19 Sep 2015 01:15:42 +0000 (21:15 -0400)]
Fix indentation
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
4fe1cbdff89768c5d1983988ce1022674a438bbb)
Rich Salz [Fri, 18 Sep 2015 01:53:43 +0000 (21:53 -0400)]
This undoes GH367 for non-master
Was only approved for master, to avoid compatibility issues on
previous releases.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Matt Caswell [Wed, 16 Sep 2015 09:47:15 +0000 (10:47 +0100)]
Make sure OPENSSL_cleanse checks for NULL
In master we have the function OPENSSL_clear_free(x,y), which immediately
returns if x == NULL. In <=1.0.2 this function does not exist so we have to
do:
OPENSSL_cleanse(x, y);
OPENSSL_free(x);
However, previously, OPENSSL_cleanse did not check that if x == NULL, so
the real equivalent check would have to be:
if (x != NULL)
OPENSSL_cleanse(x, y);
OPENSSL_free(x);
It would be easy to get this wrong during cherry-picking to other branches
and therefore, for safety, it is best to just ensure OPENSSL_cleanse also
checks for NULL.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
020d8fc83fe1a94232db1ee1166309e2458a8a18)
Emilia Kasper [Thu, 17 Sep 2015 18:08:48 +0000 (20:08 +0200)]
base64 decode: check for high bit
Previously, the conversion would silently coerce to ASCII. Now, we error
out.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
b785504a10310cb2872270eb409b70971be5e76e)
Emilia Kasper [Wed, 2 Sep 2015 13:31:28 +0000 (15:31 +0200)]
RT3757: base64 encoding bugs
Rewrite EVP_DecodeUpdate.
In particular: reject extra trailing padding, and padding in the middle
of the content. Don't limit line length. Add tests.
Previously, the behaviour was ill-defined, and depended on the position
of the padding within the input.
In addition, this appears to fix a possible two-byte oob read.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Dr Stephen Henson <steve@openssl.org>
(cherry picked from commit
3cdd1e94b1d71f2ce3002738f9506da91fe2af45)
Kurt Roeckx [Tue, 15 Sep 2015 19:26:32 +0000 (21:26 +0200)]
Fix return values when adding serverinfo fails.
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1128
(cherry picked from commit
fae11ec714ac8e71d95e824d7102ab5b2ec2e256)
Ivo Raisr [Fri, 11 Sep 2015 16:24:33 +0000 (17:24 +0100)]
Make no-psk compile without warnings.
PR#4035
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
Rich Salz [Tue, 15 Sep 2015 16:01:30 +0000 (12:01 -0400)]
RT4044: Remove .cvsignore files.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
83fcd322f7b398534fba7816ca3c0896f529c7c0)
Rich Salz [Tue, 15 Sep 2015 15:49:42 +0000 (11:49 -0400)]
RT4044: Remove .cvsignore files.
Reviewed-by: Matt Caswell <matt@openssl.org>
Kurt Roeckx [Mon, 14 Sep 2015 22:07:02 +0000 (00:07 +0200)]
d2i: don't update input pointer on failure
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
MR #1005
(cherry picked from commit
a46c9789ce2aecedceef119e9883513c7a49f1ca)
Dr. Stephen Henson [Sat, 12 Sep 2015 00:53:52 +0000 (01:53 +0100)]
Constify ECDSA_METHOD_new.
PR#3920.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
aabd49232025807babe995006a46c4c7815ce868)
Dr. Stephen Henson [Fri, 11 Sep 2015 23:44:07 +0000 (00:44 +0100)]
Check for FIPS mode after loading config.
PR#3958
Reviewed-by: Rich Salz <rsalz@openssl.org>
John Foley [Fri, 11 Sep 2015 23:11:23 +0000 (00:11 +0100)]
Use memmove instead of memcpy.
PR#4036
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
Dr. Stephen Henson [Fri, 11 Sep 2015 15:13:52 +0000 (16:13 +0100)]
Use default field separator.
If the field separator isn't specified through -nameopt then use
XN_FLAG_SEP_CPLUS_SPC instead of printing nothing and returing an error.
PR#2397
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit
03706afa30aeb4407287171a9d6f9a765395d0a2)
Emilia Kasper [Tue, 1 Sep 2015 14:31:55 +0000 (16:31 +0200)]
RT3754: check for NULL pointer
Fix both the caller to error out on malloc failure, as well as the
eventual callee to handle a NULL gracefully.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Rich Salz [Tue, 8 Sep 2015 15:37:05 +0000 (11:37 -0400)]
Remove bogus CHANGES entries
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Dr. Stephen Henson [Thu, 3 Sep 2015 23:20:34 +0000 (00:20 +0100)]
Match SUITEB strings at start of cipher list.
PR#4009.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
13e228d6845aff7e454eea7c9ddd392ebfbd2868)
Conflicts:
ssl/ssl_ciph.c
Alessandro Ghedini [Wed, 19 Aug 2015 22:12:29 +0000 (00:12 +0200)]
Add initial Travis CI configuration
Closes #63
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Laurie <ben@openssl.org>
(cherry picked from commit
66c103bdaba21749555c8073a3f20b7741fa5869)
Viktor Dukhovni [Wed, 2 Sep 2015 01:59:08 +0000 (21:59 -0400)]
Cleaner handling of "cnid" in do_x509_check
Avoid using cnid = 0, use NID_undef instead, and return early instead
of trying to find an instance of that in the subject DN.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
fffc2faeb2b5cad4516cc624352d445284aa7522)
Viktor Dukhovni [Wed, 2 Sep 2015 01:47:12 +0000 (21:47 -0400)]
Better handling of verify param id peername field
Initialize pointers in param id by the book (explicit NULL assignment,
rather than just memset 0).
In x509_verify_param_zero() set peername to NULL after freeing it.
In x509_vfy.c's internal check_hosts(), avoid potential leak of
possibly already non-NULL peername. This is only set when a check
succeeds, so don't need to do this repeatedly in the loop.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
a0724ef1c9b9e2090bdd96b784f492b6a3952957)
Rich Salz [Thu, 27 Aug 2015 04:10:55 +0000 (00:10 -0400)]
RT3767: openssl_button.gif should be PNG
No, we should just delete it. And updated the README
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
8db78781069697cfa30a2261413f33f5055a2838)
Hiroyuki YAMAMORI [Wed, 26 Aug 2015 14:06:22 +0000 (15:06 +0100)]
Fix DTLS1.2 compression
Backport of equivalent fix from master. The only compression
method is stateful and hence incompatible with DTLS. The DTLS
test was not working for DTLS1.2
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Hiroyuki YAMAMORI [Wed, 26 Aug 2015 14:04:09 +0000 (15:04 +0100)]
Fix DTLS1.2 buffers
Fix the setup of DTLS1.2 buffers to take account of the Header
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Matt Caswell [Wed, 5 Aug 2015 12:33:52 +0000 (13:33 +0100)]
Fix session resumption
Commit
f0348c842e7 introduced a problem with session resumption. The
version for the session is fixed when the session is created. By moving
the creation of the session earlier in the process the version is fixed
*before* version negotiation has completed when processing the ServerHello
on the client side. This fix updates the session version after version neg
has completed.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Matt Caswell [Tue, 16 Jun 2015 18:17:24 +0000 (14:17 -0400)]
Fix building with OPENSSL_NO_TLSEXT.
Builds using no-tlsext in 1.0.0 and 0.9.8 are broken. This commit fixes the
issue. The same commit is applied to 1.0.1 and 1.0.2 branches for code
consistency. However this commit will not fix no-tlsext in those branches
which have always been broken for other reasons. The commit is not applied
to master at all, because no-tlsext has been completely removed from that
branch.
Based on a patch by Marc Branchaud <marcnarc@xiplink.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Tim Zhang [Mon, 11 May 2015 09:58:51 +0000 (10:58 +0100)]
Fix the comment for POINT_CONVERSION_UNCOMPRESSED
The |z| value should be 0x04 not 0x02
RT#3838
Signed-off-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
91d2728b38b1df930f337e163816a0fc9580b6a6)
Emilia Kasper [Tue, 1 Sep 2015 15:13:02 +0000 (17:13 +0200)]
Add missing CHANGES entry for 1.0.2
Reviewed-by: Rich Salz <rsalz@openssl.org>
Emilia Kasper [Tue, 1 Sep 2015 12:56:58 +0000 (14:56 +0200)]
RT4002: check for NULL cipher in p12_crpt.c
The NULL cipher case can't actually happen because we have no
EVP_PBE_CTL combinations where cipher_nid is -1 and keygen is
PKCS12_PBE_keyivgen. But make the code more obviously correct.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
394f7b6fcc38132b8ccff0a3253b9dd15640cfc0)
Emilia Kasper [Tue, 1 Sep 2015 11:19:15 +0000 (13:19 +0200)]
RT 3493: fix RSA test
- Pass in the right ciphertext length to ensure we're indeed testing
ciphertext corruption (and not truncation).
- Only test one mutation per byte to not make the test too slow.
- Add a separate test for truncated ciphertexts.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
25d6b3401ca40c9a2cbe5080449c1c2a37037777)
Richard Levitte [Mon, 31 Aug 2015 19:45:56 +0000 (21:45 +0200)]
Ignore .dir-locals.el
Because we recently encourage people to have a .dir-locals.el, it's a good
idea to ignore it on a git level.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
d7c02691a5e6f2716759eacb6f48c39f15ee57c8)
mrpre [Fri, 28 Aug 2015 08:12:51 +0000 (16:12 +0800)]
check bn_new return value
Slightly modified from the original PR.
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
a7e974c7be90e2c9673e2ce6215a70f734eb8ad4)
Ben Kaduk [Fri, 28 Aug 2015 16:41:50 +0000 (12:41 -0400)]
GH367 follow-up, for more clarity
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit
36ac7bc8a9c856bcdff6eecdaca128ccc5430a1e)
Emilia Kasper [Mon, 31 Aug 2015 13:51:27 +0000 (15:51 +0200)]
BN_mod_exp_mont_consttime: check for zero modulus.
Don't dereference |d| when |top| is zero. Also test that various BIGNUM methods behave correctly on zero/even inputs.
Follow-up to
b11980d79a52ec08844f08bea0e66c04b691840b
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Mon, 31 Aug 2015 15:58:53 +0000 (17:58 +0200)]
Remove auto-fill-mode
Apparently, emacs sees changes to auto-fill-mode as insecure
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
6dc08048d93ff35de882878f190ae49aa698b5d2)
Richard Levitte [Mon, 31 Aug 2015 15:25:17 +0000 (17:25 +0200)]
Add an example .dir-locals.el
This file, when copied to .dir-locals.el in the OpenSSL source top,
will make sure that the CC mode style "OpenSSL-II" will be used for
all C files.
Additionally, I makes sure that tabs are never used as indentation
character, regardless of the emacs mode, and that the fill column is
78.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
0927f0d822b1e0f55cb7d8bacf9004ad3495514b)
Richard Levitte [Mon, 31 Aug 2015 15:12:37 +0000 (17:12 +0200)]
Add emacs CC mode style for OpenSSL
This hopefully conforms closely enough to the current code style.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
d9b3554b2d9724bc2d1621a026ddaf0223e2d191)
Emilia Kasper [Mon, 31 Aug 2015 11:57:44 +0000 (13:57 +0200)]
bntest: don't dereference the |d| array for a zero BIGNUM.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
4d04226c2ec7e7f69f6234def63631648e35e828)
Rich Salz [Fri, 28 Aug 2015 21:49:30 +0000 (17:49 -0400)]
Remove the "times" directory.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit
9db0c91c39fb548c36d6c3c944f50d4c068eefb7)
Alessandro Ghedini [Fri, 28 Aug 2015 03:07:07 +0000 (23:07 -0400)]
GH354: Memory leak fixes
Fix more potential leaks in X509_verify_cert()
Fix memory leak in ClientHello test
Fix memory leak in gost2814789 test
Fix potential memory leak in PKCS7_verify()
Fix potential memory leaks in X509_add1_reject_object()
Refactor to use "goto err" in cleanup.
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit
55500ea7c46c27a150a46832e1260891aaad8e52)
Ismo Puustinen [Sat, 8 Aug 2015 02:14:47 +0000 (22:14 -0400)]
GH367: Fix dsa keygen for too-short seed
If the seed value for dsa key generation is too short (< qsize),
return an error. Also update the documentation.
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit
f00a10b89734e84fe80f98ad9e2e77b557c701ae)
Hubert Kario [Fri, 31 Jul 2015 17:02:07 +0000 (19:02 +0200)]
GH351: -help text for some s_client/s_server flags
add -help descriptions of -curves, -sigalgs, -client_sigalgs
to s_client and s_server
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
David Brodski [Tue, 13 May 2014 16:06:27 +0000 (18:06 +0200)]
Fixed problem with multiple load-unload of comp zlib
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit
8cbb153357896c4b224e0678550944f7851bc3b2)
Viktor Dukhovni [Thu, 24 Apr 2014 01:58:30 +0000 (21:58 -0400)]
GH correct organizationalUnitName
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit
208b2d541dcb3b8f62639d2a8cc5771af4ba8755)
Alessandro Ghedini [Wed, 19 Aug 2015 15:12:31 +0000 (17:12 +0200)]
GH371: Print debug info for ALPN extension
Also known as RT 4106
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
b48357d9953decc43333979ca11ebc1500040f4e)
Matt Caswell [Thu, 13 Aug 2015 09:06:30 +0000 (10:06 +0100)]
Fix DTLS session ticket renewal
A DTLS client will abort a handshake if the server attempts to renew the
session ticket. This is caused by a state machine discrepancy between DTLS
and TLS discovered during the state machine rewrite work.
The bug can be demonstrated as follows:
Start a DTLS s_server instance:
openssl s_server -dtls
Start a client and obtain a session but no ticket:
openssl s_client -dtls -sess_out session.pem -no_ticket
Now start a client reusing the session, but allow a ticket:
openssl s_client -dtls -sess_in session.pem
The client will abort the handshake.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit
ee4ffd6fccd169775ba74afb1dbfecff48ee413d)
Conflicts:
ssl/d1_clnt.c