Eric S. Raymond [Mon, 29 Feb 2016 19:54:47 +0000 (14:54 -0500)]
RT4358: Extra ] in doc/ocsp.pod
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 1 Mar 2016 13:37:56 +0000 (13:37 +0000)]
Prepare for 1.0.2h-dev
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 1 Mar 2016 13:36:54 +0000 (13:36 +0000)]
Prepare for 1.0.2g release
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 1 Mar 2016 13:36:54 +0000 (13:36 +0000)]
make update
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 1 Mar 2016 12:08:33 +0000 (12:08 +0000)]
Ensure mk1mf.pl is aware of no-weak-ssl-ciphers option
Update mk1mf.pl to properly handle no-weak-ssl-ciphers
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Tue, 1 Mar 2016 11:00:48 +0000 (11:00 +0000)]
Update CHANGES and NEWS for new release
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Tue, 26 Jan 2016 15:50:10 +0000 (16:50 +0100)]
bn/asm/x86_64-mont5.pl: unify gather procedure in hardly used path
and reorganize/harmonize post-conditions.
Additional hardening following on from CVE-2016-0702
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from master)
Andy Polyakov [Mon, 25 Jan 2016 22:41:01 +0000 (23:41 +0100)]
crypto/bn/x86_64-mont5.pl: constant-time gather procedure.
At the same time remove miniscule bias in final subtraction.
Performance penalty varies from platform to platform, and even with
key length. For rsa2048 sign it was observed to be 4% for Sandy
Bridge and 7% on Broadwell.
CVE-2016-0702
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from master)
Andy Polyakov [Mon, 25 Jan 2016 22:25:40 +0000 (23:25 +0100)]
bn/asm/rsaz-avx2.pl: constant-time gather procedure.
Performance penalty is 2%.
CVE-2016-0702
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from master)
Andy Polyakov [Mon, 25 Jan 2016 22:06:45 +0000 (23:06 +0100)]
bn/asm/rsax-x86_64.pl: constant-time gather procedure.
Performance penalty is 2% on Linux and 5% on Windows.
CVE-2016-0702
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from master)
Andy Polyakov [Mon, 25 Jan 2016 19:38:38 +0000 (20:38 +0100)]
bn/bn_exp.c: constant-time MOD_EXP_CTIME_COPY_FROM_PREBUF.
Performance penalty varies from platform to platform, and even
key length. For rsa2048 sign it was observed to reach almost 10%.
CVE-2016-0702
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from master)
Resolved conflicts:
crypto/bn/bn_exp.c
Viktor Dukhovni [Fri, 19 Feb 2016 18:05:11 +0000 (13:05 -0500)]
Disable EXPORT and LOW SSLv3+ ciphers by default
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Matt Caswell [Fri, 19 Feb 2016 11:38:25 +0000 (11:38 +0000)]
Add a test for SSLv2 configuration
SSLv2 should be off by default. You can only turn it on if you have called
SSL_CTX_clear_options(SSL_OP_NO_SSLv2) or
SSL_clear_options(SSL_OP_NO_SSLv2). You should not be able to inadvertantly
turn it on again via SSL_CONF without having done that first.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Viktor Dukhovni [Thu, 18 Feb 2016 04:38:55 +0000 (23:38 -0500)]
Bring SSL method documentation up to date
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Viktor Dukhovni [Thu, 18 Feb 2016 02:07:48 +0000 (21:07 -0500)]
Disable SSLv2 default build, default negotiation and weak ciphers.
SSLv2 is by default disabled at build-time. Builds that are not
configured with "enable-ssl2" will not support SSLv2. Even if
"enable-ssl2" is used, users who want to negotiate SSLv2 via the
version-flexible SSLv23_method() will need to explicitly call either
of:
SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
or
SSL_clear_options(ssl, SSL_OP_NO_SSLv2);
as appropriate. Even if either of those is used, or the application
explicitly uses the version-specific SSLv2_method() or its client
or server variants, SSLv2 ciphers vulnerable to exhaustive search
key recovery have been removed. Specifically, the SSLv2 40-bit
EXPORT ciphers, and SSLv2 56-bit DES are no longer available.
Mitigation for CVE-2016-0800
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Matt Caswell [Mon, 22 Feb 2016 10:27:18 +0000 (10:27 +0000)]
Fix BN_hex2bn/BN_dec2bn NULL ptr/heap corruption
In the BN_hex2bn function the number of hex digits is calculated using
an int value |i|. Later |bn_expand| is called with a value of |i * 4|.
For large values of |i| this can result in |bn_expand| not allocating any
memory because |i * 4| is negative. This leaves ret->d as NULL leading
to a subsequent NULL ptr deref. For very large values of |i|, the
calculation |i * 4| could be a positive value smaller than |i|. In this
case memory is allocated to ret->d, but it is insufficiently sized
leading to heap corruption. A similar issue exists in BN_dec2bn.
This could have security consequences if BN_hex2bn/BN_dec2bn is ever
called by user applications with very large untrusted hex/dec data. This is
anticipated to be a rare occurrence.
All OpenSSL internal usage of this function uses data that is not expected
to be untrusted, e.g. config file data or application command line
arguments. If user developed applications generate config file data based
on untrusted data then it is possible that this could also lead to security
consequences. This is also anticipated to be a rare.
Issue reported by Guido Vranken.
CVE-2016-0797
Reviewed-by: Andy Polyakov <appro@openssl.org>
Kurt Roeckx [Sun, 28 Feb 2016 10:40:12 +0000 (11:40 +0100)]
Fix invalid free
Also removes an extra initializer, the master branch has a extra field.
Reviewed-by: Rich Salz <rsalz@openssl.org>
FdaSilvaYY [Fri, 29 Jan 2016 18:53:28 +0000 (19:53 +0100)]
Fix two possible leaks
Backport of
98637bd
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
FdaSilvaYY [Fri, 29 Jan 2016 18:49:38 +0000 (19:49 +0100)]
Fix possible memory leak on BUF_MEM_grow_clean failure
backport of
3eb70c5ebae6f2b5fd6034ed5af14910c8479688
shorter changes
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Wed, 24 Feb 2016 19:07:06 +0000 (20:07 +0100)]
modes/asm/ghash-x86_64.pl: refine GNU assembler version detection.
Even though AVX support was added in GAS 2.19 vpclmulqdq was apparently
added in 2.20.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
d3cdab17362b9ab0f1a0525b736c862937a9cd2f)
Kurt Roeckx [Sat, 20 Feb 2016 14:29:45 +0000 (15:29 +0100)]
Revert "Don't check RSA_FLAG_SIGN_VER."
This reverts commit
6656ba7152dfe4bba865e327dd362ea08544aa80.
This broke existing engines that didn't properly implement the sign and verify
functions.
Reviewed-by: Richard Levitte <levitte@openssl.org>
MR: #2077
Matt Caswell [Thu, 25 Feb 2016 13:09:46 +0000 (13:09 +0000)]
Fix memory issues in BIO_*printf functions
The internal |fmtstr| function used in processing a "%s" format string
in the BIO_*printf functions could overflow while calculating the length
of a string and cause an OOB read when printing very long strings.
Additionally the internal |doapr_outch| function can attempt to write to
an OOB memory location (at an offset from the NULL pointer) in the event of
a memory allocation failure. In 1.0.2 and below this could be caused where
the size of a buffer to be allocated is greater than INT_MAX. E.g. this
could be in processing a very long "%s" format string. Memory leaks can also
occur.
These issues will only occur on certain platforms where sizeof(size_t) >
sizeof(int). E.g. many 64 bit systems. The first issue may mask the second
issue dependent on compiler behaviour.
These problems could enable attacks where large amounts of untrusted data
is passed to the BIO_*printf functions. If applications use these functions
in this way then they could be vulnerable. OpenSSL itself uses these
functions when printing out human-readable dumps of ASN.1 data. Therefore
applications that print this data could be vulnerable if the data is from
untrusted sources. OpenSSL command line applications could also be
vulnerable where they print out ASN.1 data, or if untrusted data is passed
as command line arguments.
Libssl is not considered directly vulnerable. Additionally certificates etc
received via remote connections via libssl are also unlikely to be able to
trigger these issues because of message size limits enforced within libssl.
CVE-2016-0799
Issue reported by Guido Vranken.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Emilia Kasper [Wed, 24 Feb 2016 11:59:59 +0000 (12:59 +0100)]
CVE-2016-0798: avoid memory leak in SRP
The SRP user database lookup method SRP_VBASE_get_by_user had confusing
memory management semantics; the returned pointer was sometimes newly
allocated, and sometimes owned by the callee. The calling code has no
way of distinguishing these two cases.
Specifically, SRP servers that configure a secret seed to hide valid
login information are vulnerable to a memory leak: an attacker
connecting with an invalid username can cause a memory leak of around
300 bytes per connection.
Servers that do not configure SRP, or configure SRP but do not configure
a seed are not vulnerable.
In Apache, the seed directive is known as SSLSRPUnknownUserSeed.
To mitigate the memory leak, the seed handling in SRP_VBASE_get_by_user
is now disabled even if the user has configured a seed.
Applications are advised to migrate to SRP_VBASE_get1_by_user. However,
note that OpenSSL makes no strong guarantees about the
indistinguishability of valid and invalid logins. In particular,
computations are currently not carried out in constant time.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Wed, 3 Feb 2016 10:26:11 +0000 (11:26 +0100)]
ec/asm/ecp_nistz256-x86_64.pl: get corner case logic right.
RT#4284
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
d93753412b455907b4dc09427ccd2382209d9af2)
FdaSilvaYY [Fri, 19 Feb 2016 22:28:52 +0000 (23:28 +0100)]
GH714: missing field initialisation
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
David Woodhouse [Tue, 23 Feb 2016 14:00:03 +0000 (14:00 +0000)]
RT4175: Fix PKCS7_verify() regression with Authenticode signatures
This is a partial revert of commit
c8491de39 ("GH354: Memory leak fixes"),
which was cherry-picked from commit
55500ea7c in OpenSSL 1.1.
That commit introduced a change in behaviour which is a regression for
software implementing Microsoft Authenticode — which requires a PKCS#7
signature to be validated against explicit external data, even though
it's a non-detached signature with its own embedded data.
The is fixed differently in OpenSSL 1.1 by commit
6b2ebe433 ("Add
PKCS7_NO_DUAL_CONTENT flag"), but that approach isn't viable in the
1.0.2 stable branch, so just comment the offending check back out again.
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Corinna Vinschen [Sat, 16 Jan 2016 18:36:15 +0000 (19:36 +0100)]
Don't strip object files on Cygwin
Building for the Cygwin distro requires to be able to build debuginfo
files. This in turn requires to build object files without stripping.
The stripping is performed by the next step after building which creates
the debuginfo files.
Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
(cherry picked from commit
42b8f1427a8cdf320e51374a5fbfefc74bec0519)
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Mon, 22 Feb 2016 10:02:03 +0000 (11:02 +0100)]
Recognise Cygwin-x86_64 in config
In response to RT#4326
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Thu, 18 Feb 2016 12:47:23 +0000 (12:47 +0000)]
Fix double free in DSA private key parsing.
Fix double free bug when parsing malformed DSA private keys.
Thanks to Adam Langley (Google/BoringSSL) for discovering this bug using
libFuzzer.
CVE-2016-0705
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Andy Polyakov [Fri, 19 Feb 2016 12:40:58 +0000 (13:40 +0100)]
Makefile.shared: limit .dll image base pinning to FIPS builds.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Thu, 18 Feb 2016 13:08:55 +0000 (14:08 +0100)]
evp/e_des3.c: address compiler warning.
In backporting from master one modification was mistreated.
RT#4210
Reviewed-by: Matt Caswell <matt@openssl.org>
Dr. Stephen Henson [Thu, 18 Feb 2016 02:49:14 +0000 (02:49 +0000)]
typo
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
f6fb7f1856d443185c23f1a5968c08b4269dd37d)
Dr. Stephen Henson [Tue, 16 Feb 2016 22:17:43 +0000 (22:17 +0000)]
Switch to FIPS implementation for CMAC.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Andy Polyakov [Fri, 12 Feb 2016 13:46:02 +0000 (14:46 +0100)]
evp/e_des[3].c: address compiler warnings, fix formatting.
RT#4210
(1.0.2-specific adaptation of
7687f5255011a5a3ca75e8c5427683d58ae411c0)
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Fri, 12 Feb 2016 13:07:27 +0000 (14:07 +0100)]
modes/ctr128.c: pay attention to ecount_buf alignment in CRYPTO_ctr128_encrypt.
It's never problem if CRYPTO_ctr128_encrypt is called from EVP, because
buffer in question is always aligned within EVP_CIPHER_CTX structure.
RT#4218
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
5e4bbeb49fb6522d858703201b5adee9611e7b7b)
Emilia Kasper [Tue, 2 Feb 2016 16:12:45 +0000 (17:12 +0100)]
RT 3854: Update apps/req
Change the default keysize to 2048 bits, and the minimum to 512 bits.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
a76265574398944d686d2d0de9bacca162f555ca)
Andy Polyakov [Wed, 10 Feb 2016 14:11:40 +0000 (15:11 +0100)]
perlasm/x86_64-xlate.pl: pass pure constants verbatim.
RT#3885
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
fd7dc201d3b9d43972de6a0e659f7ef6421c99cc)
Andy Polyakov [Wed, 3 Feb 2016 17:21:00 +0000 (18:21 +0100)]
util/mk1mf.pl: use LINK_CMD instead of LINK variable.
Trouble is that LINK variable assignment in make-file interferes with
LINK environment variable, which can be used to modify Microsoft's
LINK.EXE behaviour.
RT#4289
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
d44bb1c31ca00f4359090daa15659c0dd1a08f0d)
Resolved conflicts:
util/pl/VC-32.pl
Andy Polyakov [Tue, 9 Feb 2016 10:53:11 +0000 (11:53 +0100)]
ms/uplink-x86.pl: make it work.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
740b2b9a6cf31b02916a4d18f868e8a95934c083)
Matt Caswell [Tue, 2 Feb 2016 10:05:43 +0000 (10:05 +0000)]
Handle SSL_shutdown while in init more appropriately #2
Previous commit
f73c737c7 attempted to "fix" a problem with the way
SSL_shutdown() behaved whilst in mid-handshake. The original behaviour had
SSL_shutdown() return immediately having taken no action if called mid-
handshake with a return value of 1 (meaning everything was shutdown
successfully). In fact the shutdown has not been successful.
Commit
f73c737c7 changed that to send a close_notify anyway and then
return. This seems to be causing some problems for some applications so
perhaps a better (much simpler) approach is revert to the previous
behaviour (no attempt at a shutdown), but return -1 (meaning the shutdown
was not successful).
This also fixes a bug where SSL_shutdown always returns 0 when shutdown
*very* early in the handshake (i.e. we are still using SSLv23_method).
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Dr. Stephen Henson [Sat, 6 Feb 2016 17:07:58 +0000 (17:07 +0000)]
if no comparison function set make sk_sort no op
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
0ca2e82ab1575f9c4eed259c4d66ca9372a45bf5)
Viktor Dukhovni [Tue, 2 Feb 2016 09:35:27 +0000 (04:35 -0500)]
Fix missing ok=0 with locally blacklisted CAs
Also in X509_verify_cert() avoid using "i" not only as a loop
counter, but also as a trust outcome and as an error ordinal.
Finally, make sure that all "goto end" jumps return an error, with
"end" renamed to "err" accordingly.
[ The 1.1.0 version of X509_verify_cert() is major rewrite,
which addresses these issues in a more systemic way. ]
Reviewed-by: Rich Salz <rsalz@openssl.org>
Kurt Roeckx [Wed, 3 Feb 2016 17:54:02 +0000 (18:54 +0100)]
Restore xmm7 from the correct address on win64
Reviewed-by: Richard Levitte <levitte@openssl.org>
RT: #4288, MR: #1831
(cherry picked from commit
df057ea6c8a20e4babc047689507dfafde59ffd6)
Viktor Dukhovni [Tue, 2 Feb 2016 04:37:42 +0000 (23:37 -0500)]
Fix pkeyutl/rsautl empty encrypt-input/decrypt-output handling
Also fix option processing in pkeyutl to allow use of (formerly)
"out-of-order" switches that were needless implementation limitations.
RT2018
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Tue, 2 Feb 2016 17:16:10 +0000 (12:16 -0500)]
GH611: s_client help message bug
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Hubert Kario [Mon, 1 Feb 2016 16:14:34 +0000 (11:14 -0500)]
GH554: Improve pkeyutl doc
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit
53619f9f40740ae8b256998574758aa191635db8)
Daniel Kahn Gillmor [Sun, 31 Jan 2016 01:38:08 +0000 (20:38 -0500)]
RT4129: BUF_new_mem_buf should take const void *
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit
8ab31975bacb9c907261088937d3aa4102e3af84)
Rich Salz [Fri, 29 Jan 2016 17:09:05 +0000 (12:09 -0500)]
GH102: Add volatile to CRYPTO_memcmp
Can't hurt and seems to prevent problems from some over-aggressive
(LTO?) compilers.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
98ab57644f44d2d83595c2d0f69138a284d6096b)
Dr. Stephen Henson [Thu, 21 Jan 2016 14:29:16 +0000 (14:29 +0000)]
Backport SHA2 support for capi engine
Reviewed-by: Andy Polyakov <appro@openssl.org>
Matt Caswell [Wed, 4 Nov 2015 22:54:29 +0000 (22:54 +0000)]
Add have_precompute_mult tests
Add tests for have_precompute_mult for the optimised curves (nistp224,
nistp256 and nistp521) if present
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
8ce4e7e605577cb5818de068e2c6da60901cddba)
Matt Caswell [Wed, 4 Nov 2015 17:30:22 +0000 (17:30 +0000)]
Fix bug in nistp224/256/521 where have_precompute_mult always returns 0
During precomputation if the group given is well known then we memcpy a
well known precomputation. However we go the wrong label in the code and
don't store the data properly. Consequently if we call have_precompute_mult
the data isn't there and we return 0.
RT#3600
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
615614c8862fb89dcf1551a4e113be0789dddf5f)
Matt Caswell [Fri, 29 Jan 2016 09:40:03 +0000 (09:40 +0000)]
Add missing return value checks
The function DH_check_pub_key() was missing some return value checks in
some calls to BN functions.
RT#4278
Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit
f5a12207eccfd814bde68b880a96910dfa25f164)
Matt Caswell [Fri, 29 Jan 2016 09:38:06 +0000 (09:38 +0000)]
Correct value of DH_CHECK_PUBKEY_INVALID
A new return value for DH_check_pub_key was recently added:
DH_CHECK_PUBKEY_INVALID. As this is a flag which can be ORed with other
return values it should have been set to the value 4 not 3.
RT#4278
Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit
cb389fe80462e20daba30835a9e86354451bd14f)
Kurt Roeckx [Wed, 27 Jan 2016 19:31:57 +0000 (20:31 +0100)]
Fix CHANGES entry about DSA_generate_parameters_ex
Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org>
Richard Levitte [Thu, 28 Jan 2016 16:55:11 +0000 (17:55 +0100)]
Correct number of arguments in BIO_get_conn_int_port macro
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit
41a28cb2944a4e1c9d13889757a3bd9f72abeca1)
Matt Caswell [Thu, 28 Jan 2016 13:58:24 +0000 (13:58 +0000)]
Prepare for 1.0.2g-dev
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Thu, 28 Jan 2016 13:57:22 +0000 (13:57 +0000)]
Prepare for 1.0.2f release
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Wed, 27 Jan 2016 13:52:29 +0000 (13:52 +0000)]
Update CHANGES and NEWS for release
Add details about the latest issues into CHANGES and NEWS ready for the
next release.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Wed, 20 Jan 2016 11:56:28 +0000 (11:56 +0000)]
Add a test for small subgroup attacks on DH/DHE
Following on from the previous commit, add a test to ensure that
DH_compute_key correctly fails if passed a bad y such that:
y^q (mod p) != 1
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Matt Caswell [Thu, 17 Dec 2015 02:57:20 +0000 (02:57 +0000)]
Always generate DH keys for ephemeral DH cipher suites
Modified version of the commit
ffaef3f15 in the master branch by Stephen
Henson. This makes the SSL_OP_SINGLE_DH_USE option a no-op and always
generates a new DH key for every handshake regardless.
CVE-2016-0701 (fix part 2 or 2)
Issue reported by Antonio Sanso
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Matt Caswell [Mon, 18 Jan 2016 11:31:58 +0000 (11:31 +0000)]
Prevent small subgroup attacks on DH/DHE
Historically OpenSSL only ever generated DH parameters based on "safe"
primes. More recently (in version 1.0.2) support was provided for
generating X9.42 style parameter files such as those required for RFC
5114 support. The primes used in such files may not be "safe". Where an
application is using DH configured with parameters based on primes that
are not "safe" then an attacker could use this fact to find a peer's
private DH exponent. This attack requires that the attacker complete
multiple handshakes in which the peer uses the same DH exponent.
A simple mitigation is to ensure that y^q (mod p) == 1
CVE-2016-0701 (fix part 1 of 2)
Issue reported by Antonio Sanso.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Viktor Dukhovni [Thu, 31 Dec 2015 03:44:51 +0000 (22:44 -0500)]
Better SSLv2 cipher-suite enforcement
Based on patch by: Nimrod Aviram <nimrod.aviram@gmail.com>
CVE-2015-3197
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Mouse [Sat, 16 Jan 2016 03:13:00 +0000 (22:13 -0500)]
pkeyutl: allow peerkey for EC_DERIVE to reside on a hardware token (public key for now)
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Billy Brumley [Thu, 21 Jan 2016 12:06:57 +0000 (14:06 +0200)]
RT3863 ECC: Add missing NULL check. Set a flag
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
dd67493c344d9d98413d2ee7fd2b6fa9411d975c)
Rich Salz [Wed, 20 Jan 2016 23:52:18 +0000 (18:52 -0500)]
GH issue 572: Error in help message
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Matt Caswell [Mon, 7 Dec 2015 16:50:38 +0000 (16:50 +0000)]
Handle SSL_shutdown while in init more appropriately
Calling SSL_shutdown while in init previously gave a "1" response, meaning
everything was successfully closed down (even though it wasn't). Better is
to send our close_notify, but fail when trying to receive one.
The problem with doing a shutdown while in the middle of a handshake is
that once our close_notify is sent we shouldn't really do anything else
(including process handshake/CCS messages) until we've received a
close_notify back from the peer. However the peer might send a CCS before
acting on our close_notify - so we won't be able to read it because we're
not acting on CCS messages!
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Richard Levitte [Tue, 19 Jan 2016 19:35:41 +0000 (20:35 +0100)]
Fix BSD -rpath parameter
For BSD systems, Configure adds a shared_ldflags including a reference
to the Makefile variable LIBRPATH, but since it must be passed down to
Makefile.shared, care must be taken so the value of LIBRPATH doesn't
get expanded too early, or it ends up giving an empty string.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(cherry picked from commit
c64879d3f3cc4c7f1c436a9fe3bd109847a23629)
Alessandro Ghedini [Wed, 13 Jan 2016 12:49:24 +0000 (12:49 +0000)]
Validate ClientHello session_id field length and send alert on failure
RT#4080
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Prayag Verma [Mon, 18 Jan 2016 03:19:09 +0000 (08:49 +0530)]
Update license year range to 2016
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit
02f70372470b4dd3b21443bb615292175f5d2c88)
Kristian Amlie [Mon, 18 Jan 2016 14:18:56 +0000 (15:18 +0100)]
Don't use "grep -q", "-q" is not POSIX, and fails on Solaris.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Viktor Dukhovni [Sat, 16 Jan 2016 17:57:24 +0000 (12:57 -0500)]
Empty SNI names are not valid
While empty inputs to SSL_set1_host() clear the reference identifier
list.
(cherry-picked from 1.1.0-dev)
Reviewed-by: Rich Salz <rsalz@openssl.org>
Zi Lin [Fri, 15 Jan 2016 18:19:42 +0000 (13:19 -0500)]
NGX-2040 - fix wildcard match on punycode/IDNA DNS names
- bugfix: should not treat '--' as invalid domain substring.
- '-' should not be the first letter of a domain
Signed-off-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Thu, 14 Jan 2016 00:25:25 +0000 (00:25 +0000)]
To avoid possible time_t overflow use X509_time_adj_ex()
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(cherry picked from commit
9aa00b187a65b1f30789d6274ec31ea86efe7973)
Conflicts:
apps/x509.c
Mouse [Tue, 12 Jan 2016 14:09:48 +0000 (09:09 -0500)]
Root cause discovered and fixed, this fix became unnecessary
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Uri Blumenthal [Mon, 11 Jan 2016 20:23:15 +0000 (15:23 -0500)]
Changed help output
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Mouse [Tue, 5 Jan 2016 04:49:00 +0000 (23:49 -0500)]
Pass engine=NULL to EVP_PKEY_CTX_new(), unless "-engine_impl" was given
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Mouse [Sun, 3 Jan 2016 23:47:57 +0000 (18:47 -0500)]
Remove unnecessary debugging fprintf
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Mouse [Sat, 2 Jan 2016 04:30:02 +0000 (23:30 -0500)]
Fixed crash (SIGSEGV) when freeing of ex_data stumbles upon a NULL-pointer.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Mouse [Sat, 2 Jan 2016 04:27:49 +0000 (23:27 -0500)]
Fixed a bug preventing pkeyutl from accessing keys directly on the token via engine_pkcs11
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
arijitnayak [Thu, 31 Dec 2015 07:38:54 +0000 (13:08 +0530)]
Wrong definition of the macro SSL_set1_sigalgs in ssl.h
Error in the definition of the macro SSL_set1_sigalgs(ctx, slist,
slistlen): the third parameter 'slistlen' not used in the substitution
code; used 'clistlen' instead. As a result of this, compilation error
occurs when any application uses this macro.
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Kurt Roeckx [Sun, 10 Jan 2016 12:55:08 +0000 (13:55 +0100)]
Change minimum DH size from 768 to 1024
Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org>
Kurt Roeckx [Sat, 2 Jan 2016 19:42:27 +0000 (20:42 +0100)]
File is about s_time, not s_client
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit
1918e01c9f915e2eba31a5e2f86f0a5daa4fafb6)
Viktor Dukhovni [Fri, 1 Jan 2016 05:51:12 +0000 (00:51 -0500)]
Fix X509_STORE_CTX_cleanup()
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Rich Salz [Mon, 28 Dec 2015 19:58:23 +0000 (14:58 -0500)]
RT4202: Update rt URL's.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
41977c53cd04f52b2b5e56d31ace782577620ac3)
Matt Caswell [Mon, 30 Nov 2015 16:04:51 +0000 (16:04 +0000)]
Add some documentation for the OCSP callback functions
Describe the usage of the OCSP callback functions on both the client and
the server side.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Matt Caswell [Mon, 30 Nov 2015 13:29:41 +0000 (13:29 +0000)]
Ensure we don't call the OCSP callback if resuming a session
It makes no sense to call the OCSP status callback if we are resuming a
session because no certificates will be sent.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Matt Caswell [Thu, 5 Nov 2015 14:52:27 +0000 (14:52 +0000)]
Fix error when server does not send CertificateStatus message
If a server sends the status_request extension then it may choose
to send the CertificateStatus message. However this is optional.
We were treating it as mandatory and the connection was failing.
Thanks to BoringSSL for reporting this issue.
RT#4120
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Daniel Kahn Gillmor [Wed, 23 Dec 2015 20:03:32 +0000 (21:03 +0100)]
The functions take a SSL *, not a SSL_CTX *
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
RT: #4192, MR: #1533
(cherry picked from commit
d938e8dfee16e6bb5427eac7bda32337634ce130)
David Benjamin [Thu, 17 Dec 2015 19:11:11 +0000 (20:11 +0100)]
Fix memory leak in DSA redo case.
Found by clang scan-build.
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>
RT: #4184, MR: #1496
(cherry picked from commit
679d87515d23ca31491effdc264edc81c695a72a)
Dr. Stephen Henson [Sun, 20 Dec 2015 18:18:43 +0000 (18:18 +0000)]
Don't check RSA_FLAG_SIGN_VER.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Mon, 2 Nov 2015 15:43:28 +0000 (16:43 +0100)]
BIO_s_datagram() ctrl doesn't support SEEK/TELL, so don't pretend it does
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Sun, 1 Nov 2015 14:56:21 +0000 (15:56 +0100)]
Correct or add comments indicating what controls belong to what
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Sun, 1 Nov 2015 14:45:49 +0000 (15:45 +0100)]
Document how BIO_get_conn_ip and BIO_get_conn_int_port actually work
No dummy arguments.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Sun, 1 Nov 2015 14:42:04 +0000 (15:42 +0100)]
Have BIO_get_conn_int_port use BIO_ctrl instead BIO_int_ctrl
BIO_int_ctrl isn't made for the purpose BIO_get_conn_int_port used it
for.
This also changes BIO_C_GET_CONNECT to actually return the port
instead of assigning it to a pointer that was never returned back to
the caller.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Sat, 19 Dec 2015 14:42:06 +0000 (14:42 +0000)]
Fix more URLs mangled by reformat
Fix some more URLs mangled by indent in the reformat. These ones don't exist
in master so we have a separate commit. Based on a patch supplied by Arnaud
Lacombe <al@aerilon.ca>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Sat, 19 Dec 2015 14:38:17 +0000 (14:38 +0000)]
Fix URLs mangled by reformat
Some URLs in the source code ended up getting mangled by indent. This fixes
it. Based on a patch supplied by Arnaud Lacombe <al@aerilon.ca>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Fri, 18 Dec 2015 12:12:58 +0000 (13:12 +0100)]
Remove the "eay" c-file-style indicators
Since we don't use the eay style any more, there's no point tryint to
tell emacs to use it.
Reviewed-by: Ben Laurie <ben@openssl.org>
Rich Salz [Thu, 10 Dec 2015 17:31:01 +0000 (12:31 -0500)]
Provide better "make depend" warning.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit
2e31ef0366d368ac8cf7f5ecc9052bff27337799)
Emilia Kasper [Mon, 14 Dec 2015 15:38:15 +0000 (16:38 +0100)]
Fix a ** 0 mod 1 = 0 for real this time.
Commit
2b0180c37fa6ffc48ee40caa831ca398b828e680 attempted to do this but
only hit one of many BN_mod_exp codepaths. Fix remaining variants and add
a test for each method.
Thanks to Hanno Boeck for reporting this issue.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit
d911097d7c93e4cfeab624b34d73fe51da158b69)
Richard Levitte [Mon, 14 Dec 2015 02:53:06 +0000 (03:53 +0100)]
Fix tarball production to keep test/bctest and util/pod2mantest
Reviewed-by: Matt Caswell <matt@openssl.org>