David Benjamin [Wed, 26 Jul 2017 16:30:27 +0000 (12:30 -0400)]
Fix comment typo.
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4023)
(cherry picked from commit
d67e755418b62fb451ec221c126c9935a06ea63b)
Andy Polyakov [Mon, 24 Jul 2017 19:50:52 +0000 (21:50 +0200)]
x86_64 assembly pack: "optimize" for Knights Landing.
"Optimize" is in quotes because it's rather a "salvage operation"
for now. Idea is to identify processor capability flags that
drive Knights Landing to suboptimial code paths and mask them.
Two flags were identified, XSAVE and ADCX/ADOX. Former affects
choice of AES-NI code path specific for Silvermont (Knights Landing
is of Silvermont "ancestry"). And 64-bit ADCX/ADOX instructions are
effectively mishandled at decode time. In both cases we are looking
at ~2x improvement.
Hardware used for benchmarking courtesy of Atos, experiments run by
Romain Dolbeau <romain.dolbeau@atos.net>. Kudos!
This is minimalistic backpoint of
64d92d74985ebb3d0be58a9718f9e080a14a8e7f
Thanks to David Benjamin for spotting typo in Knights Landing detection!
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4006)
(cherry picked from commit
738a9dd53cacce593cd7d67e18e1273549640a79)
Simon Richter [Sun, 16 Jul 2017 20:49:36 +0000 (22:49 +0200)]
Fix installation on VC-WIN32 with nmake
Commit
b83265697 fixed whitespace handling in the copy script, which
exposes bugs in the install routine for nmake Makefiles.
This corrects the quoting around the copy invocation for the openssl.exe
binary.
CLA: trivial
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3942)
Xiaoyin Liu [Mon, 24 Jul 2017 15:28:50 +0000 (11:28 -0400)]
schlock global variable needs to be volatile
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4000)
(cherry picked from commit
e0de4dd5a2b0c0dc27e6a6ab01fabe374d657d23)
Andy Polyakov [Mon, 10 Jul 2017 13:19:45 +0000 (15:19 +0200)]
evp/e_aes_cbc_hmac_sha256.c: give SHAEXT right priority.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/3898)
(cherry picked from commit
d0f6eb1d8c84165c383a677266cfae9c0b162781)
Dr. Stephen Henson [Sat, 22 Jul 2017 14:54:48 +0000 (15:54 +0100)]
Fix RSA-PSS in FIPS mode by switching digest implementations.
Fixes #2718
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3996)
Richard Levitte [Thu, 20 Jul 2017 19:22:31 +0000 (21:22 +0200)]
Fix apps/s_client.c's XMPP client
When an error occurs during the starttls handskake, s_client gets stuck
looping around zero bytes reads, because the server won't sent anything more
after its error tag. Shutting down on the first zero byte read fixes this.
Fixes #3980
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3981)
Matt Caswell [Mon, 17 Jul 2017 15:55:32 +0000 (16:55 +0100)]
Remove some dead code
The intention of the removed code was to check if the previous operation
carried. However this does not work. The "mask" value always ends up being
a constant and is all ones - thus it has no effect. This check is no longer
required because of the previous commit.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3832)
(cherry picked from commit
d5475e319575a45b20f560bdfae56cbfb165cb01)
Matt Caswell [Wed, 28 Jun 2017 14:18:30 +0000 (15:18 +0100)]
Fix undefined behaviour in e_aes_cbc_hmac_sha256.c and e_aes_cbc_hmac_sha1.c
In TLS mode of operation the padding value "pad" is obtained along with the
maximum possible padding value "maxpad". If pad > maxpad then the data is
invalid. However we must continue anyway because this is constant time code.
We calculate the payload length like this:
inp_len = len - (SHA_DIGEST_LENGTH + pad + 1);
However if pad is invalid then inp_len ends up -ve (actually large +ve
because it is a size_t).
Later we do this:
/* verify HMAC */
out += inp_len;
len -= inp_len;
This ends up with "out" pointing before the buffer which is undefined
behaviour. Next we calculate "p" like this:
unsigned char *p =
out + len - 1 - maxpad - SHA256_DIGEST_LENGTH;
Because of the "out + len" term the -ve inp_len value is cancelled out
so "p" points to valid memory (although technically the pointer arithmetic
is undefined behaviour again).
We only ever then dereference "p" and never "out" directly so there is
never an invalid read based on the bad pointer - so there is no security
issue.
This commit fixes the undefined behaviour by ensuring we use maxpad in
place of pad, if the supplied pad is invalid.
With thanks to Brian Carpenter for reporting this issue.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3832)
(cherry picked from commit
335d0a4646981c9d96b62811bcfd69a96a1a67d9)
Emilia Kasper [Tue, 18 Jul 2017 09:26:34 +0000 (11:26 +0200)]
RSA_padding_check_PKCS1_type_2 is not constant time.
This is an inherent weakness of the padding mode. We can't make the
implementation constant time (see the comments in rsa_pk1.c), so add a
warning to the docs.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Bernd Edlinger [Fri, 14 Jul 2017 15:05:37 +0000 (17:05 +0200)]
Backport of
5b8fa43 and remove resolved TODO: see PR#3924.
Make RSA key exchange code actually constant-time.
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3935)
simon-p-r [Mon, 10 Jul 2017 22:19:33 +0000 (23:19 +0100)]
fix copy and copy-if-different whitespace problem
From https://github.com/openssl/openssl/pull/1023
CLA: trivial
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3904)
Richard Levitte [Wed, 5 Jul 2017 09:08:45 +0000 (11:08 +0200)]
Avoid possible memleak in X509_policy_check()
When tree_calculate_user_set() fails, a jump to error failed to
deallocate a possibly allocated |auth_nodes|.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3851)
Bernd Edlinger [Sat, 1 Jul 2017 07:37:44 +0000 (09:37 +0200)]
Fix a memleak in X509_PKEY_new.
Fixes #3349
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3819)
Richard Levitte [Wed, 5 Jul 2017 12:55:51 +0000 (14:55 +0200)]
Undo one UI fix
Undoing:
> - in UI_process(), |state| was never made NULL, which means an error
> when closing the session wouldn't be accurately reported.
This was a faulty cherry-pick from master
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3853)
Richard Levitte [Wed, 5 Jul 2017 08:26:25 +0000 (10:26 +0200)]
Fix small UI issues
- in EVP_read_pw_string_min(), the return value from UI_add_* wasn't
properly checked
- in UI_process(), |state| was never made NULL, which means an error
when closing the session wouldn't be accurately reported.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/3849)
(cherry picked from commit
b96dba9e5ec7afc355be1eab915f69c8c0d51741)
Rich Salz [Tue, 4 Jul 2017 22:10:40 +0000 (18:10 -0400)]
Add echo for each build phase
Port of GH#3842 to 1.0.2
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/3845)
Bernd Edlinger [Sun, 2 Jul 2017 10:32:47 +0000 (12:32 +0200)]
Fix a memleak in ec_GFp_mont_group_set_curve.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3828)
Bernd Edlinger [Sat, 1 Jul 2017 20:18:10 +0000 (22:18 +0200)]
Fix a memory leak in ecdh/ecdsa_check.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3825)
Richard Levitte [Sun, 25 Jun 2017 20:10:42 +0000 (22:10 +0200)]
tsget: remove call of WWW::Curl::Easy::global_cleanup
This function is undocumented, but similarly named functions (such as
'curl_global_cleanup') are documented as internals that should not be
called by scripts.
Fixes #3765
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3769)
Benjamin Kaduk [Tue, 20 Jun 2017 19:41:54 +0000 (14:41 -0500)]
Remove inadvertently commited test binaries
Commit
201015ee4f38e5d216a7625282c6b8a395b680b7 added some generated
files that were not part of the intended functionality; remove them.
(Only the 1.0.2 branch version of the commit was affected, probably due
to a smaller .gitignore on that branch.)
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3729)
Matt Caswell [Wed, 21 Jun 2017 12:55:02 +0000 (13:55 +0100)]
Add documentation for the SSL_export_keying_material() function
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3738)
Bernd Edlinger [Wed, 14 Jun 2017 19:54:15 +0000 (21:54 +0200)]
Remove a pointless "#if 0" block from BN_mul.
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3683)
(cherry picked from commit
93a8b3ba793c769a3634e56642dac55a8d44023f)
Bernd Edlinger [Tue, 13 Jun 2017 19:22:45 +0000 (21:22 +0200)]
Fix a possible crash in dsa_builtin_paramgen2.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3675)
(cherry picked from commit
fb0a64126b8c11a6961dfa1323c3602b591af7df)
Bernd Edlinger [Tue, 13 Jun 2017 20:34:30 +0000 (22:34 +0200)]
Fix possible crash in X931 code.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3675)
(cherry picked from commit
5419dadd4bd1f7abbfa23326ca766d2c143f257c)
Bernd Edlinger [Wed, 14 Jun 2017 08:16:15 +0000 (10:16 +0200)]
Remove the fallback from ERR_get_state because the
return value is now checked at the callers.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3678)
Bernd Edlinger [Tue, 13 Jun 2017 17:00:35 +0000 (19:00 +0200)]
Fix a possible crash in the error handling.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3672)
(cherry picked from commit
4fc426b78964b3d234cb7b1b6112c9b80e16a13a)
Rich Salz [Sat, 10 Jun 2017 19:25:56 +0000 (15:25 -0400)]
Remove needless type casting.
CLA: trivial
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3627)
(cherry picked from commit
a020f54c25985fc83e809daa15a3920731d39612)
Paul Yang [Fri, 9 Jun 2017 18:22:22 +0000 (02:22 +0800)]
Fix possible usage of NULL pointers in apps/spkac.c
Check return value of NETSCAPE_SPKI_new() and
NETSCAPE_SPKI_b64_encode(), and also clean up coding style incidentally.
Signed-off-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3647)
(cherry picked from commit
f2582f08d5167ee84b7b313fd1435fe91ee44880)
Jonathan Protzenko [Wed, 17 May 2017 16:09:01 +0000 (09:09 -0700)]
Fix speed command for alternation of ciphers and digests.
CLA: trivial
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3487)
(cherry picked from commit
9ae4e664da0692f27bfe0d1a34db29ed815203c8)
Benjamin Kaduk [Thu, 8 Jun 2017 20:55:30 +0000 (15:55 -0500)]
Remove stale note from s_server.pod
Modern browsers are now, well, pretty modern.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3644)
(cherry picked from commit
36c438514db71eba3e8062fef7869b9211630a19)
Rich Salz [Thu, 8 Jun 2017 20:05:52 +0000 (16:05 -0400)]
Fix a read off the end of the input buffer
when building with OPENSSL_SMALL_FOOTPRINT defined.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3533)
(cherry picked from commit
0b20ad127ce86b05a854f31d51d91312c86ccc74)
Rich Salz [Fri, 2 Jun 2017 20:05:37 +0000 (16:05 -0400)]
Document default client -psk_identity
Document that -psk is required to use PSK cipher
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3607)
(cherry picked from commit
9d772829c9e4f202460acb43f9e073841a7cb9db)
(cherry picked from commit
c1abfde735eca6346eb2c0641b67b11d0e68b94c)
Andy Polyakov [Sat, 3 Jun 2017 19:08:57 +0000 (21:08 +0200)]
ec/asm/ecp_nistz256-x86_64.pl: minor sqr_montx cleanup.
Drop some redundant instructions in reduction in ecp_nistz256_sqr_montx.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
8fc063dcc9668589fd95533d25932396d60987f9)
Rich Salz [Fri, 2 Jun 2017 14:30:44 +0000 (10:30 -0400)]
Add text pointing to full change list.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3606)
(cherry picked from commit
01dfaa08b1960049f91485f2e5eec6c6bd03db39)
Todd Short [Fri, 26 May 2017 12:42:21 +0000 (08:42 -0400)]
Fix ex_data memory leak
Code was added in commit
62f488d that overwrite the last ex_data valye
using CRYPTO_dup_ex_data() causing a memory leak and potentially
confusing the ex_data dup() callback.
In ssl_session_dup(), new-up the ex_data before calling
CRYPTO_dup_ex_data(); all the other structures that dup ex_data have
the destination ex_data new'd before the dup.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3568)
Diego Santa Cruz [Tue, 16 May 2017 14:05:19 +0000 (16:05 +0200)]
Fix srp app missing NULL termination with password callback
The password_callback() function does not necessarily NULL terminate
the password buffer, the caller must use the returned length but the
srp app uses this function as if it was doing NULL termination.
This made the -passin and -passout options of "openssl srp"
fail inexpicably and randomly or even crash.
Fixed by enlarging the buffer by one, so that the maximum password length
remains unchanged, and adding NULL termination upon return.
[Rearrange code for coding style compliance in process.]
This backport of
0e83981d61fc435f42d4bb4d774272b69556b7bc.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3579)
Matt Caswell [Thu, 1 Jun 2017 09:31:56 +0000 (10:31 +0100)]
Send a protocol version alert
If we fail to negotiate a version then we should send a protocol version
alert.
Fixes #3595
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3598)
Todd Short [Mon, 22 May 2017 15:24:59 +0000 (11:24 -0400)]
Fix inconsistent check of UNSAFE_LEGACY_RENEGOTIATION (1.0.2)
The check for SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION is
inconsistent. Most places check SSL->options, one place is checking
SSL_CTX->options; fix that.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
GH: #3521
Matt Caswell [Thu, 25 May 2017 14:18:22 +0000 (15:18 +0100)]
Document that HMAC() with a NULL md is not thread safe
Fixes #3541
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3555)
Matt Caswell [Thu, 25 May 2017 12:57:07 +0000 (13:57 +0100)]
Prepare for 1.0.2m-dev
Reviewed-by: Stephen Henson <steve@openssl.org>
Matt Caswell [Thu, 25 May 2017 12:55:36 +0000 (13:55 +0100)]
Prepare for 1.0.2l release
Reviewed-by: Stephen Henson <steve@openssl.org>
Matt Caswell [Thu, 25 May 2017 12:55:36 +0000 (13:55 +0100)]
make update
Reviewed-by: Stephen Henson <steve@openssl.org>
Matt Caswell [Thu, 25 May 2017 09:57:25 +0000 (10:57 +0100)]
Update CHANGES and NEWS for new release
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3548)
Bernd Edlinger [Thu, 25 May 2017 06:46:49 +0000 (08:46 +0200)]
Ignore -rle and -comp when compiled with OPENSSL_NO_COMP.
Fixes make test when configured with no-comp.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3545)
Tomas Mraz [Wed, 17 May 2017 13:37:39 +0000 (15:37 +0200)]
Fix regression in openssl req -x509 behaviour.
Allow conversion of existing requests to certificates again.
Fixes the issue #3396
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3485)
Richard Levitte [Wed, 17 May 2017 06:28:55 +0000 (08:28 +0200)]
Remove notification settings from appveyor.yml
Notifications can be (and should be) configured on account basis on
the CI web site. This avoids getting emails to openssl-commits for
personal accounts that also build OpenSSL stuff.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3484)
(cherry picked from commit
7a94f5b0f7c878b1056a08f659ce23aa97bfa3ad)
Pauli [Thu, 11 May 2017 00:45:38 +0000 (10:45 +1000)]
Remove dead code.
The second BN_is_zero test can never be true.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3434)
(cherry picked from commit
3f97052392cb10fca5309212bf720685262ad4a6)
Matt Caswell [Wed, 10 May 2017 10:28:53 +0000 (11:28 +0100)]
Copy custom extension flags in a call to SSL_set_SSL_CTX()
The function SSL_set_SSL_CTX() can be used to swap the SSL_CTX used for
a connection as part of an SNI callback. One result of this is that the
s->cert structure is replaced. However this structure contains information
about any custom extensions that have been loaded. In particular flags are
set indicating whether a particular extension has been received in the
ClientHello. By replacing the s->cert structure we lose the custom
extension flag values, and it appears as if a client has not sent those
extensions.
SSL_set_SSL_CTX() should copy any flags for custom extensions that appear
in both the old and the new cert structure.
Fixes #2180
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3427)
Andy Polyakov [Thu, 4 May 2017 13:54:29 +0000 (15:54 +0200)]
perlasm/x86_64-xlate.pl: work around problem with hex constants in masm.
Perl, multiple versions, for some reason occasionally takes issue with
letter b[?] in ox([0-9a-f]+) regex. As result some constants, such as
0xb1 came out wrong when generating code for MASM. Fixes GH#3241.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3385)
(cherry picked from commit
c47aea8af1e28e46e1ad5e2e7468b49fec3f4f29)
Matt Caswell [Tue, 2 May 2017 12:47:31 +0000 (13:47 +0100)]
Fix some error path logic in i2v_AUTHORITY_INFO_ACCESS and i2v_GENERAL_NAME
Fixes #1653 reported by Guido Vranken
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3362)
(cherry picked from commit
75a3e39288feeeefde5ed1f96ff9faeba0d2b233)
Rich Salz [Thu, 23 Jun 2016 14:03:50 +0000 (10:03 -0400)]
RT2867: des_ede3_cfb1 ignored "size in bits" flag
Code by Steve Henson. Backport to 1.0.2 from commit
fe2d149119
Fixes #2346
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3364)
Rich Salz [Tue, 2 May 2017 14:53:10 +0000 (10:53 -0400)]
Fix URL links in comment
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3365)
(cherry picked from commit
dea0eb2c5452cd4c2160a64a6868e79efeca6e9d)
Todd Short [Thu, 16 Feb 2017 21:08:02 +0000 (16:08 -0500)]
Fix time offset calculation.
ASN1_GENERALIZEDTIME and ASN1_UTCTIME may be specified using offsets,
even though that's not supported within certificates.
To convert the offset time back to GMT, the offsets are supposed to be
subtracted, not added. e.g. 1759-0500 == 2359+0100 == 2259Z.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3335)
(cherry picked from commit
ae32742e3db45a19aead2c42e30072882492be1d)
Rich Salz [Sun, 30 Apr 2017 14:11:07 +0000 (10:11 -0400)]
Check fflush on BIO_ctrl call
Bug found and fix suggested by Julian Rüth.
Push error if fflush fails
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3266)
(cherry picked from commit
595b2a42375427a254ad5a8c85870efea839a9b9)
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3348)
Bernd Edlinger [Wed, 26 Apr 2017 07:59:18 +0000 (09:59 +0200)]
Remove unnecessary loop in pkey_rsa_decrypt.
It is not necessary to remove leading zeros here because
RSA_padding_check_PKCS1_OAEP_mgf1 appends them again. As this was not done
in constant time, this might have leaked timing information.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3313)
(cherry picked from commit
237bc6c997e42295eeb32c8c1c709e6e6042b839)
Rich Salz [Mon, 24 Apr 2017 14:30:26 +0000 (10:30 -0400)]
check length sanity before correcting in EVP_CTRL_AEAD_TLS1_AAD
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3276)
Alex Gaynor [Mon, 24 Apr 2017 01:09:12 +0000 (21:09 -0400)]
Annotate ASN.1 attributes of the jurisdictionCountryName NID
EV Guidelines section 9.2.5 says jurisdictionCountryName follows the
same ASN.1 encoding rules as countryName.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3284)
(cherry picked from commit
52c0c4d13e8220f19eb2b205dc0c30508c4a51a9)
Camille Guérin [Fri, 21 Apr 2017 11:35:51 +0000 (13:35 +0200)]
Fixed typo in X509_STORE_CTX_new description
'X509_XTORE_CTX_cleanup' -> 'X509_STORE_CTX_cleanup'
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3271)
(cherry picked from commit
7643a1723ef8eb4e542e57dfadeeb8eff788ec05)
(cherry picked from commit
2c0b8d2872057fdda22d3f41c3d4e59835b414b4)
David Benjamin [Fri, 21 Apr 2017 16:07:03 +0000 (12:07 -0400)]
Numbers greater than 1 are usually non-negative.
BN_is_prime_fasttest_ex begins by rejecting if a <= 1. Then it goes to
set A := abs(a), but a cannot be negative at this point.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3275)
(cherry picked from commit
8b24f94209676bbe9933affd2879a686b1ed044d)
junfx [Thu, 13 Apr 2017 07:56:50 +0000 (15:56 +0800)]
pkeyutl exit with 0 if the verification succeeded
If exiting non-zero, which not consistent with shell conventions,
the shells/scripts treat the cmd as failed.
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3213)
Rich Salz [Tue, 11 Apr 2017 16:17:54 +0000 (12:17 -0400)]
Additional check to handle BAD SSL_write retry
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3122)
Andy Polyakov [Sun, 2 Apr 2017 20:00:15 +0000 (22:00 +0200)]
crypto/ppccap.c: SIGILL-free processor capabilities detection on MacOS X.
It seems to be problematic to probe processor capabilities with SIGILL
on MacOS X. The problem should be limited to cases when application code
is debugged, but crashes were reported even during normal execution...
[backport of
0bd93bbe4ae60e5f318b298bfe617e468a7b71d0]
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Mon, 3 Apr 2017 11:42:58 +0000 (12:42 +0100)]
Ensure dhparams can handle X9.42 params in DER
dhparams correctly handles X9.42 params in PEM format. However it failed
to correctly processes them when reading/writing DER format.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3112)
Matt Caswell [Mon, 3 Apr 2017 11:41:04 +0000 (12:41 +0100)]
Add missing macros for DHxparams
DHparams has d2i_DHparams_fp, d2i_DHxparams_bio etc, but the equivalent
macros for DHxparams were omitted.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3112)
Jon Spillett [Thu, 30 Mar 2017 04:13:44 +0000 (14:13 +1000)]
Fix for #2730. Add CRLDP extension to list of supported extensions
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3087)
(cherry picked from commit
e6f648fd880369e186039501c960809b17f96e88)
Matt Caswell [Mon, 27 Mar 2017 09:21:59 +0000 (10:21 +0100)]
Free the compression methods in s_server and s_client
This causes a minor (64 bytes on my machine) mem leak in s_server/s_client.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3040)
Steven Collison [Tue, 28 Mar 2017 19:46:07 +0000 (12:46 -0700)]
doc: Add stitched ciphers to EVP_EncryptInit.pod
These ciphers don't appear to be documented anywhere. Given the
performance[1] benefits I think it makes sense to expose them.
[1] https://software.intel.com/sites/default/files/open-ssl-performance-paper.pdf
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3067)
(cherry picked from commit
209fac9f8a24000beaa8a438517115b42ca7e7c6)
Steven Collison [Tue, 28 Mar 2017 16:02:37 +0000 (09:02 -0700)]
doc: Add missing options in s_{server,client}
These were added to the help in
ad775e04f6dab but not the pods.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3065)
(cherry picked from commit
254b58fd7335fa3c58e2535d46658109ffd8bdcd)
Bernd Edlinger [Mon, 20 Mar 2017 19:50:23 +0000 (20:50 +0100)]
Fix the error handling in CRYPTO_dup_ex_data.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2998)
Jon Spillett [Tue, 28 Mar 2017 22:34:37 +0000 (08:34 +1000)]
Add documentation for SNI APIs
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3071)
(cherry picked from commit
8c55c4614731487449a02f90ff9a209ff6c63447)
Andy Polyakov [Sat, 25 Mar 2017 09:58:57 +0000 (10:58 +0100)]
aes/asm/bsaes-armv7.pl: relax stack alignment requirement.
Even though Apple refers to Procedure Call Standard for ARM Architecture
(AAPCS), they apparently adhere to custom version that doesn't follow
stack alignment constraints in the said standard. [Why or why? If it's
vendor lock-in thing, then it would be like worst spot ever.] And since
bsaes-armv7 relied on standard alignment, it became problematic to
execute the code on iOS.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
0822d41b6d54132df96c02cc6f6fa9b179378351)
Bernd Edlinger [Fri, 24 Mar 2017 12:18:22 +0000 (13:18 +0100)]
Fixed a gcc-7-strict-warnings issue.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3026)
Bernd Edlinger [Fri, 24 Mar 2017 12:09:43 +0000 (13:09 +0100)]
Don't access memory before checking the correct length in aesni_cbc_hmac_sha256_ctrl in case EVP_CTRL_AEAD_TLS1_AAD.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3025)
Andy Polyakov [Wed, 22 Mar 2017 09:51:25 +0000 (10:51 +0100)]
bn/asm/sparcv9-mont.pl: fix squaring code path.
This module is used only with odd input lengths, i.e. not used in normal
PKI cases, on contemporary processors. The problem was "illuminated" by
fuzzing tests.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
120a9e1a825bd0407639bedb1e8e15823cf7a545)
Richard Levitte [Thu, 23 Mar 2017 13:26:43 +0000 (14:26 +0100)]
Guard last few debugging printfs in libssl
Fixes #2542
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3018)
Andy Polyakov [Mon, 20 Mar 2017 10:38:25 +0000 (11:38 +0100)]
aes/asm/aesni-sha*-x86_64.pl: fix IV handling in SHAEXT paths.
Initial IV was disregarded on SHAEXT-capable processors. Amazingly
enough bulk AES128-SHA* talk-to-yourself tests were passing.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2992)
(cherry picked from commit
08d09628d2c9f3ef599399d8cad021a07ab98347)
Matt Caswell [Tue, 21 Mar 2017 16:12:37 +0000 (16:12 +0000)]
Fix BAD CCS alert in DTLS
Set the correct variable, and then actually send the alert!
Found by, and fix suggested by, Raja Ashok.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3009)
Matt Caswell [Tue, 21 Mar 2017 09:07:17 +0000 (09:07 +0000)]
Fix error paths in ASN1_TIME_to_generalizedtime
We should not write to |out| in error cases, so we should defer doing this
until the "done" block.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3002)
Matt Caswell [Tue, 21 Mar 2017 09:53:02 +0000 (09:53 +0000)]
Avoid a mem leak on error
An internal error path could result in a memory leak. Also remove some redundant
code.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3003)
Richard Levitte [Mon, 20 Mar 2017 20:31:02 +0000 (21:31 +0100)]
Fix decoding of ASN.1 LONG and ZLONG items
LONG and ZLONG items (which are OpenSSL private special cases of
ASN1_INTEGER) are encoded into DER with padding if the leading octet
has the high bit set, where the padding can be 0x00 (for positive
numbers) or 0xff (for negative ones).
When decoding DER to LONG or ZLONG, the padding wasn't taken in
account at all, which means that if the encoded size with padding
is one byte more than the size of long, decoding fails. This change
fixes that issue.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3000)
(cherry picked from commit
ca2045dc545ba4afe8abbe29d0316ee3d36da7df)
Kurt Roeckx [Sun, 15 Jan 2017 11:33:45 +0000 (12:33 +0100)]
Fix VC warnings about unary minus to an unsigned type.
Reviewed-by: Andy Polyakov <appro@openssl.org>
GH: #2230
(partial cherry pick from commit
68d4bcfd0651c7ea5d37ca52abc0d2e6e6b3bd20)
Kurt Roeckx [Sun, 17 Jul 2016 13:28:09 +0000 (15:28 +0200)]
Cast to an unsigned type before negating
llvm's ubsan reported:
runtime error: negation of -
9223372036854775808 cannot be represented in type
'long'; cast to an unsigned type to negate this value to itself
Found using afl
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1325
(cherry picked from commit
1618679ac478c8f41fc5f320fb4d8a33883b3868)
Kurt Roeckx [Thu, 23 Jun 2016 07:37:51 +0000 (09:37 +0200)]
Avoid signed overflow
Found by afl
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #3013
(cherry picked from commit
5bea15ebb359c91a1bb7569620ead14bb71cfb81)
Bernd Edlinger [Tue, 14 Mar 2017 14:10:52 +0000 (15:10 +0100)]
Fixed a crash in print_notice.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2935)
(cherry picked from commit
29d1fad78899e5ae2997b19937a175784b21c996)
Bernd Edlinger [Wed, 8 Mar 2017 17:53:36 +0000 (18:53 +0100)]
Fix a crash or unbounded allocation in RSA_padding_add_PKCS1_PSS_mgf1
and RSA_verify_PKCS1_PSS_mgf1 with 512-bit RSA vs. sha-512.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2881)
(cherry picked from commit
e653b6cd74f70c04b0b96b07df00680b427603af)
Richard Levitte [Mon, 13 Mar 2017 20:25:37 +0000 (21:25 +0100)]
Better way to recognise mingw64 in config script
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2922)
(cherry picked from commit
41bee3e8fb749504f21f78dbf3eca85e5b84820b)
Andy Polyakov [Sun, 12 Mar 2017 13:45:06 +0000 (14:45 +0100)]
crypto/x86*cpuid.pl: move extended feature detection.
Exteneded feature flags were not pulled on AMD processors, as result
a number of extensions were effectively masked on Ryzen. Original fix
for x86_64cpuid.pl addressed this problem, but messed up processor
vendor detection. This fix moves extended feature detection past
basic feature detection where it belongs. 32-bit counterpart is
harmonized too.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
1aed5e1ac28790cc915ad03e86e2d5e896a4ea13)
Richard Levitte [Mon, 13 Mar 2017 12:20:55 +0000 (13:20 +0100)]
Document in CHANGES that config now recognises 64-bit mingw
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2917)
(cherry picked from commit
b1fa4031feb94e1406f3bd2ba0f771e48d0407b5)
(cherry picked from commit
e342f396142331aa58187afa441581590bc80af9)
Bernd Edlinger [Fri, 3 Mar 2017 10:17:03 +0000 (11:17 +0100)]
Fix a memory leak in X509_STORE_add_cert/crl error handling.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2837)
Matt Caswell [Mon, 13 Mar 2017 10:30:49 +0000 (10:30 +0000)]
Fix DTLSv1_listen() sequence numbers
DTLSv1_listen() is stateless. We never increment the record read sequence
while listening, and we reflect the incoming record's sequence number in our
write sequence.
The logic for doing the write sequence reflection was *after* we had
finished processing the incoming ClientHello and before we write the
ServerHello. In the normal course of events this is fine. However if we
need to write an early alert during ClientHello processing (e.g. no shared
cipher), then we haven't done the write sequence reflection yet. This means
the alert gets written with the wrong sequence number (it will just be set
to whatever value we left it in the last time we wrote something). If the
sequence number is less than expected then the client will believe that the
incoming alert is a retransmit and will therefore drop it, causing the
client to hang waiting for a response from the server.
Fixes #2886
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2915)
Richard Levitte [Mon, 13 Mar 2017 08:09:43 +0000 (09:09 +0100)]
Recognise mingw64 in config script
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2914)
Matt Caswell [Fri, 10 Mar 2017 10:51:35 +0000 (10:51 +0000)]
Fix out-of-memory condition in conf
conf has the ability to expand variables in config files. Repeatedly doing
this can lead to an exponential increase in the amount of memory required.
This places a limit on the length of a value that can result from an
expansion.
Credit to OSS-Fuzz for finding this problem.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2894)
(cherry picked from commit
8a585601fea1091022034dd14b961c1ecd5916c3)
Richard Levitte [Sat, 11 Mar 2017 10:19:20 +0000 (11:19 +0100)]
Revert "Use the callbacks from the SSL object instead of the SSL_CTX object"
This shouldn't have been applied to the 1.0.2 branch.
This reverts commit
5247c0388610bfdcc8f44b777d75ab681120753d.
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2907)
Richard Levitte [Fri, 10 Mar 2017 23:54:52 +0000 (00:54 +0100)]
Fix UI_get0_action_string()
It shouldn't try to return an action description for UIT_PROMPT type
UI strings.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2904)
(cherry picked from commit
6e470e190853f59a394dc92fefd74666c94266f4)
(cherry picked from commit
f31c714e923e76f54ff3b492f646662ef57f7d59)
Pauli [Tue, 7 Mar 2017 05:36:16 +0000 (15:36 +1000)]
Use the callbacks from the SSL object instead of the SSL_CTX object
... in functions dealing with the SSL object rather than the context.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2870)
(cherry picked from commit
d61461a7525322d188f9c6e3f90cfc93916cc636)
Bernd Edlinger [Fri, 10 Mar 2017 14:10:41 +0000 (15:10 +0100)]
Avoid questionable use of the value of a pointer
that refers to space
deallocated by a call to the free function in tls_decrypt_ticket.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2897)
(cherry picked from commit
13ed1afa923f4ffb553e389de08f26e9ce84e8a2)
Richard Levitte [Fri, 10 Mar 2017 07:19:17 +0000 (08:19 +0100)]
make update
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2889)
Richard Levitte [Fri, 10 Mar 2017 07:18:12 +0000 (08:18 +0100)]
Fix apps/progs.pl to generate correctly formatted progs.h
It was still generating EAY style source.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2889)
Richard Levitte [Thu, 9 Mar 2017 23:43:21 +0000 (00:43 +0100)]
Fix crypto/bn/bn_prime.pl to generate correctly formatted bn_prime.h
It was still generating EAY style source.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2889)