Only allow ephemeral RSA keys in export ciphersuites.

OpenSSL clients would tolerate temporary RSA keys in non-export
ciphersuites. It also had an option SSL_OP_EPHEMERAL_RSA which
enabled this server side. Remove both options as they are a
protocol violation.

Thanks to Karthikeyan Bhargavan for reporting this issue.
(CVE-2015-0204)
Reviewed-by: Matt Caswell <matt@openssl.org>

ECDH downgrade bug fix.

Fix bug where an OpenSSL client would accept a handshake using an
ephemeral ECDH ciphersuites with the server key exchange message omitted.

Thanks to Karthikeyan Bhargavan for reporting this issue.

CVE-2014-3572
Reviewed-by: Matt Caswell <matt@openssl.org>

RT3546: Remove #define IRIX_CC_BUG

Leftovers from commit 448155e9bbda27cbba365ff549a7e2044a8a399f
Remove now-unused #define's

Reviewed-by: Matt Caswell <matt@openssl.org>

update ordinals

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 31c65a7bc0de7ff1446645d41af388893362f579)

Ensure that the session ID context of an SSL* is updated
when its SSL_CTX is updated.

From BoringSSL commit
https://boringssl.googlesource.com/boringssl/+/a5dc545bbcffd9c24cebe65e9ab5ce72d4535e3a

Reviewed-by: Rich Salz <rsalz@openssl.org>

Constify ASN1_TYPE_cmp add X509_ALGOR_cmp.

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Fix various certificate fingerprint issues.

By using non-DER or invalid encodings outside the signed portion of a
certificate the fingerprint can be changed without breaking the signature.
Although no details of the signed portion of the certificate can be changed
this can cause problems with some applications: e.g. those using the
certificate fingerprint for blacklists.

1. Reject signatures with non zero unused bits.

If the BIT STRING containing the signature has non zero unused bits reject
the signature. All current signature algorithms require zero unused bits.

2. Check certificate algorithm consistency.

Check the AlgorithmIdentifier inside TBS matches the one in the
certificate signature. NB: this will result in signature failure
errors for some broken certificates.

3. Check DSA/ECDSA signatures use DER.

Reencode DSA/ECDSA signatures and compare with the original received
signature. Return an error if there is a mismatch.

This will reject various cases including garbage after signature
(thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
(negative or with leading zeroes).

CVE-2014-8275
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Additional fix required for no-srtp to work

RT3638

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Fix building with no-srtp

RT3638

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add a clang build target for linux-x86_64

This change documents the world as-is, by turning all warnings on,
and then turning warnings that trigger off again.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove inconsistency in ARM support.
This facilitates "universal" builds, ones that target multiple
architectures, e.g. ARMv5 through ARMv7. See commentary in
Configure for details.

Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

ecp_nistz256-x86_64.pl: fix occasional failures.

RT: 3607
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: Emilia Kasper <emilia@openssl.org>

RT2914: NULL check missing in X509_name_canon

Check for NULL return from X509_NAME_ENTRY_new()

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

Remove SGC restart flag.

Reviewed-by: Matt Caswell <matt@openssl.org>

Remove MS SGC

MS Server gated cryptography is obsolete and dates from the time of export
restrictions on strong encryption and is only used by ancient versions of
MSIE.
Reviewed-by: Matt Caswell <matt@openssl.org>

Clear existing extension state.

When parsing ClientHello clear any existing extension state from
SRP login and SRTP profile.

Thanks to Karthikeyan Bhargavan for reporting this issue.
Reviewed-by: Matt Caswell <matt@openssl.org>

typo in s_client

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>

remove duplicate defines

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>

constify tls 1.2 lookup tables.

None of this should live in writable memory

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>

Add missing include of sys/time.h

gettimeofday was undefined

Reviewed-by: Geoff Thorpe <geoff@openssl.org>

mark all block comments that need format preserving so that
indent will not alter them when reformatting comments

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Make "run" volatile

RT#3629

Reviewed-by: Richard Levitte <levitte@openssl.org>

Document openssl dgst -hmac option

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

dlfcn: always define _GNU_SOURCE

We need this for the freebsd kernel with glibc as used in the Debian kfreebsd
ports.  There shouldn't be a problem defining this on systems not using glibc.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix memory leak in the apps

The BIO_free() allocated ex_data again that we already freed.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3548: Remove unsupported platforms

This commit removes DG-UX.
It also flushes out some left-behinds in config.
And regenerates TABLE from Configure (hadn't been done in awhile).

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3548: unsupported platforms

This commit removes Sinix/ReliantUNIX RM400
(And a missed piece of BEOS fluff)

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3548: Remove unsupported platforms.

This commit removes MPE/iX

Reviewed-by: Andy Polyakov <appro@openssl.org>

Improves certificates HOWTO

* adds links to various related documents.
* fixes a few typos.
* rewords a few sentences.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Small typo

Reviewed-by: Stephen Henson <steve@openssl.org>

RT3548: Remvoe unsupported platforms

This commit removes SunOS (a sentimental favorite of mine).

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix incorrect OPENSSL_assert() usage.

Return an error code for I/O errors instead of an assertion failure.

PR#3470
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

RT3548: Remove outdated platforms

This commit removes all mention of NeXT and NextStep.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix a problem if CFLAGS is too long cversion.c fails to compile when config
is run with --strict-warnings.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Made it an error to define OPENSSL_USE_DEPRECATED if OpenSSL has been built
with OPENSSL_NO_DEPRECATED defined

Reviewed-by: Rich Salz <rsalz@openssl.org>

Update CHANGES for deprecated updates

Reviewed-by: Rich Salz <rsalz@openssl.org>

make update following changes to default config settings

Reviewed-by: Rich Salz <rsalz@openssl.org>

Change all instances of OPENSSL_NO_DEPRECATED to OPENSSL_USE_DEPRECATED
Introduce use of DECLARE_DEPRECATED

Reviewed-by: Rich Salz <rsalz@openssl.org>

Remove redundant OPENSSL_NO_DEPRECATED suppression

Reviewed-by: Rich Salz <rsalz@openssl.org>

Turn on OPENSSL_NO_DEPRECATED by default.
Also introduce OPENSSL_USE_DEPRECATED. If OPENSSL_NO_DEPRECATED is
defined at config stage then OPENSSL_USE_DEPRECATED has no effect -
deprecated functions are not available.
If OPENSSL_NO_DEPRECATED is not defined at config stage then
applications must define OPENSSL_USE_DEPRECATED in order to access
deprecated functions.
Also introduce compiler warnings for gcc for applications using
deprecated functions

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT3548: Remove some obsolete platforms

This commit removes Sony NEWS4

Reviewed-by: Richard Levitte <levitte@openssl.org>

Return error when a bit string indicates an invalid amount of bits left

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix yet anoither 'make clean' breakage.

Reviewed-by: Tim Hudson <tjh@openssl.org>

RT3548: Remove some obsolete platforms

This commit removes BEOS.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3544: Restore MWERKS for NetWare

Reviewed-by: Richard Levitte <levitte@openssl.org>

Reject invalid constructed encodings.

According to X6.90 null, object identifier, boolean, integer and enumerated
types can only have primitive encodings: return an error if any of
these are received with a constructed encoding.
Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add a comment noting the padding oracle.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Revert "RT3425: constant-time evp_enc"

Causes more problems than it fixes: even though error codes
are not part of the stable API, several users rely on the
specific error code, and the change breaks them. Conversely,
we don't have any concrete use-cases for constant-time behaviour here.

This reverts commit 4aac102f75b517bdb56b1bcfd0a856052d559f6e.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Build fixes

Various build fixes, mostly uncovered by clang's unused-const-variable
and unused-function errors.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit 0e1c318ece3c82e96ae95a34a1badf58198d6b28)

Premaster secret handling fixes

From BoringSSL
- Send an alert when the client key exchange isn't correctly formatted.
- Reject overly short RSA ciphertexts to avoid a (benign) out-of-bounds memory access.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Clear warnings/errors within RL_DEBUG code sections (RL_DEBUG should be renamed)

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within TLS_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within KSSL_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within CIPHER_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within CIPHER_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within BN_CTX_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Check for invalid divisors in BN_div.

Invalid zero-padding in the divisor could cause a division by 0.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit a43bcd9e96c5180e5c6c82164ece643c0097485e)

The dtls1_output_cert_chain function no longer exists so remove it from
ssl_locl.h

Reviewed-by: Tim Hudson <tjh@openssl.org>

Don't set client_version to the ServerHello version.

The client_version needs to be preserved for the RSA key exchange.

This change also means that renegotiation will, like TLS, repeat the old
client_version rather than advertise only the final version. (Either way,
version change on renego is not allowed.) This is necessary in TLS to work
around an SChannel bug, but it's not strictly necessary in DTLS.

(From BoringSSL)

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add more meaningful OPENSSL_NO_ECDH error message for suite b mode

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Rename gost2814789t.c to gost2814789test.c. The old name caused problems
for dummytest if gost is compiled out, since the name of the test is not
standard (dummytest segfaults). Also the old name caused problems for git
because the executable was not in the .gitignore file

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add missing OPENSSL_NO_EC guards

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add OPENSSL_NO_ECDH guards

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Remove extraneous white space, and add some braces

Reviewed-by: Emilia Käsper <emilia@openssl.org>

DTLS fixes for signed/unsigned issues

Reviewed-by: Emilia Käsper <emilia@openssl.org>

RT3497: The ticket that keeps on giving.

Don't remove c_rehash that wasn't created by make; this script
is created by configure.

This fix brought to you by the letter "f" and
Reviewed-by: Emilia Kasper <emilia@openssl.org>

Allow using -SSLv2 again when setting Protocol in the config.

RT#3625

Reviewed-by: Emilia Käsper <emilia@openssl.org>

RT3497: Fix; don't remove header files

Doing 'config ; make clean' broke because clean removed
header files that normal build didn't create.  So don't
remove those files.  Hopefully will be better addressed by
Geoff's no-symlinks patch.

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix unused variable warning

The temporary variable causes unused variable warnings in opt mode with clang,
because the subsequent assert is compiled out.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fixed memory leak if BUF_MEM_grow fails

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

RT1688: Add dependencies for parallel make

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

make update

Reviewed-by: Tim Hudson <tjh@openssl.org>

Minor doc fixes.

In EVP_EncryptInit remove duplicate mention of EVP_idea_cbc()
In EVP_PKEY_CTX_ctrl.pod remove EVP_PKEY_get_default_digest_nid
since it is documented elsewhere.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3497: Clean up "dclean" targets

Some Makefiles had actions for "dclean" that really belonged
to the "clean" target.  This is wrong because clean ends up,
well, not really cleaning everything.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3543: Remove #ifdef LINT

I also replaced some exit/return wrappers in various
programs (from main) to standardize on return.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove old private pod2man

Include Richard's point to remove the 'sh -c' wrapper

Reviewed-by: Richard Levitte <levitte@openssl.org>

capi_ctrl, capi_vtrace: check for NULL after allocating and free it

Reviewed-by: Matt Caswell <matt@openssl.org>

tree_print: check for NULL after allocating err

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

tls1_heartbeat: check for NULL after allocating buf

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

tls1_process_heartbeat: check for NULL after allocating buffer

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

SSL_set_session: check for NULL after allocating s->kssl_ctx->client_princ

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

serverinfo_process_buffer: check result of realloc(ctx->cert->key->serverinfo) and don't leak memory if it fails

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

ssl3_digest_cached_records: check for NULL after allocating s->s3->handshake_dgst

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

ssl3_get_certificate_request: check for NULL after allocating s->cert->ctypes

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

SSL_COMP_add_compression_method: exit if allocating the new compression method struct fails

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

Move bn internal functions into bn_int.h and bn_lcl.h

Reviewed-by: Tim Hudson <tjh@openssl.org>

Update documentation following BN opaquify

Reviewed-by: Tim Hudson <tjh@openssl.org>

Make bn opaque

Reviewed-by: Tim Hudson <tjh@openssl.org>

Update apps for bn opaque change

Reviewed-by: Tim Hudson <tjh@openssl.org>

Disable engines that will fail to build when bn is made opaque

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from ts

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from srp

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from rsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from evp

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from ec

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from dsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from dh

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from asn1

Reviewed-by: Tim Hudson <tjh@openssl.org>

Prepare exptest for bn opaquify

Reviewed-by: Tim Hudson <tjh@openssl.org>

Prepare for bn opaquify. Implement internal helper functions.

Reviewed-by: Tim Hudson <tjh@openssl.org>