Don't set client_version to the ServerHello version.

The client_version needs to be preserved for the RSA key exchange.

This change also means that renegotiation will, like TLS, repeat the old
client_version rather than advertise only the final version. (Either way,
version change on renego is not allowed.) This is necessary in TLS to work
around an SChannel bug, but it's not strictly necessary in DTLS.

(From BoringSSL)

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add more meaningful OPENSSL_NO_ECDH error message for suite b mode

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Rename gost2814789t.c to gost2814789test.c. The old name caused problems
for dummytest if gost is compiled out, since the name of the test is not
standard (dummytest segfaults). Also the old name caused problems for git
because the executable was not in the .gitignore file

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add missing OPENSSL_NO_EC guards

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add OPENSSL_NO_ECDH guards

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Remove extraneous white space, and add some braces

Reviewed-by: Emilia Käsper <emilia@openssl.org>

DTLS fixes for signed/unsigned issues

Reviewed-by: Emilia Käsper <emilia@openssl.org>

RT3497: The ticket that keeps on giving.

Don't remove c_rehash that wasn't created by make; this script
is created by configure.

This fix brought to you by the letter "f" and
Reviewed-by: Emilia Kasper <emilia@openssl.org>

Allow using -SSLv2 again when setting Protocol in the config.

RT#3625

Reviewed-by: Emilia Käsper <emilia@openssl.org>

RT3497: Fix; don't remove header files

Doing 'config ; make clean' broke because clean removed
header files that normal build didn't create.  So don't
remove those files.  Hopefully will be better addressed by
Geoff's no-symlinks patch.

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix unused variable warning

The temporary variable causes unused variable warnings in opt mode with clang,
because the subsequent assert is compiled out.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fixed memory leak if BUF_MEM_grow fails

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

RT1688: Add dependencies for parallel make

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

make update

Reviewed-by: Tim Hudson <tjh@openssl.org>

Minor doc fixes.

In EVP_EncryptInit remove duplicate mention of EVP_idea_cbc()
In EVP_PKEY_CTX_ctrl.pod remove EVP_PKEY_get_default_digest_nid
since it is documented elsewhere.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3497: Clean up "dclean" targets

Some Makefiles had actions for "dclean" that really belonged
to the "clean" target.  This is wrong because clean ends up,
well, not really cleaning everything.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3543: Remove #ifdef LINT

I also replaced some exit/return wrappers in various
programs (from main) to standardize on return.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove old private pod2man

Include Richard's point to remove the 'sh -c' wrapper

Reviewed-by: Richard Levitte <levitte@openssl.org>

capi_ctrl, capi_vtrace: check for NULL after allocating and free it

Reviewed-by: Matt Caswell <matt@openssl.org>

tree_print: check for NULL after allocating err

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

tls1_heartbeat: check for NULL after allocating buf

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

tls1_process_heartbeat: check for NULL after allocating buffer

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

SSL_set_session: check for NULL after allocating s->kssl_ctx->client_princ

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

serverinfo_process_buffer: check result of realloc(ctx->cert->key->serverinfo) and don't leak memory if it fails

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

ssl3_digest_cached_records: check for NULL after allocating s->s3->handshake_dgst

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

ssl3_get_certificate_request: check for NULL after allocating s->cert->ctypes

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

SSL_COMP_add_compression_method: exit if allocating the new compression method struct fails

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

Move bn internal functions into bn_int.h and bn_lcl.h

Reviewed-by: Tim Hudson <tjh@openssl.org>

Update documentation following BN opaquify

Reviewed-by: Tim Hudson <tjh@openssl.org>

Make bn opaque

Reviewed-by: Tim Hudson <tjh@openssl.org>

Update apps for bn opaque change

Reviewed-by: Tim Hudson <tjh@openssl.org>

Disable engines that will fail to build when bn is made opaque

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from ts

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from srp

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from rsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from evp

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from ec

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from dsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from dh

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from asn1

Reviewed-by: Tim Hudson <tjh@openssl.org>

Prepare exptest for bn opaquify

Reviewed-by: Tim Hudson <tjh@openssl.org>

Prepare for bn opaquify. Implement internal helper functions.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove internal bn dependancies from speed.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

Include <openssl/foo.h> instead of "foo.h"

Exported headers shouldn't be included as "foo.h" by code from the same
module, it should only do so for module-internal headers. This is
because the symlinking of exported headers (from include/openssl/foo.h
to crypto/foo/foo.h) is being removed, and the exported headers are
being moved to the include/openssl/ directory instead.

Change-Id: I4c1d80849544713308ddc6999a549848afc25f94
Signed-off-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Fixed memory leak in the event of a failure of BUF_MEM_grow

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix memory leak in SSL_new if errors occur.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove fips directories from mkfiles.pl

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove references to deleted fips directory from Makefile.org

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove OPENSSL_FIPSAPI

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS_*_SIZE_T

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/evp

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/bn

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/ecdh

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/ecdsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove FIPS module code from crypto/dh

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/dsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/rsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove FIPS error library from openssl.ec mkerr.pl

Reviewed-by: Tim Hudson <tjh@openssl.org>

make depend

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove fips.h reference.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove fips_constseg references.

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove another FIPSCANISTER reference

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove unnecessary OPENSSL_FIPS reference

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove OPENSSL_FIPSCANISTER code.

OPENSSL_FIPSCANISTER is only set if the fips module is being built
(as opposed to being used). Since the fips module wont be built in
master this is redundant.
Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove FIPSCANISTERINTERNAL reference.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove fips utility build rules from test/Makefile

The fips test utilities are only build if an FIPS module is being
built from source. As this isn't done in master these are redundant.
Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove fipscanister build functionality from makefiles.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove fipscanister from Configure, delete fips directory

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove some unnecessary OPENSSL_FIPS references

FIPS_mode() exists in all versions of OpenSSL but always returns 0 if OpenSSL is not FIPS
capable.
Reviewed-by: Tim Hudson <tjh@openssl.org>

Add CHANGES entry for OCB

Reviewed-by: Tim Hudson <tjh@openssl.org>

Added OPENSSL_NO_OCB guards

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add documentation for OCB mode

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add tests for OCB mode

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add EVP support for OCB mode

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add support for OCB mode as per RFC7253

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clarify the return values for SSL_get_shared_curve.

Reviewed-by: Matt Caswell <matt@openssl.org>

Add extra checks for odd-length EC curve lists.

Odd-length lists should be rejected everywhere upon parsing. Nevertheless,
be extra careful and add guards against off-by-one reads.

Also, drive-by replace inexplicable double-negation with an explicit comparison.

Reviewed-by: Matt Caswell <matt@openssl.org>

Reject elliptic curve lists of odd lengths.

The Supported Elliptic Curves extension contains a vector of NamedCurves
of 2 bytes each, so the total length must be even. Accepting odd-length
lists was observed to lead to a non-exploitable one-byte out-of-bounds
read in the latest development branches (1.0.2 and master). Released
versions of OpenSSL are not affected.

Thanks to Felix Groebert of the Google Security Team for reporting this issue.

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix broken build

Add includes missing from commit 33eab3f6af51c6d7fe68ee4960930df4f1616bd5

Reviewed-by: Geoff Thorpe <geoff@openssl.org>

Replace GOST_R_MALLOC_FAILURE and GOST_R_NO_MEMORY with ERR_R_MALLOC_FAILURE

Reviewed-by: Richard Levitte <levitte@openssl.org>

capi_get_provname: Check return values

Reviewed-by: Richard Levitte <levitte@openssl.org>

ssl_create_cipher_list: check whether push onto cipherstack succeeds

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

ssl_cert_dup: Fix memory leak

Always use goto err on failure and call ssl_cert_free() on the error path so all
fields and "ret" itself are freed

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

dtls1_new: free s on error path

Reviewed-by: Richard Levitte <levitte@openssl.org>

dtls1_heartbeat: check for NULL after allocating s->cert->ctypes

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

dtls1_process_heartbeat: check for NULL after allocating buffer

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

capi_get_key: check for NULL after allocating key

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

capi_cert_get_fname: check for NULL after allocating wfname

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

capi_get_provname: free name on error if it was malloc'ed

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

pkey_gost_mac_keygen: check for NULL after allocating keydata

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

pkey_gost_ctrl: check for NULL after allocating pctx->shared_ukm

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Update changes to indicate that SSLv2 support has been removed

Reviewed-by: Matt Caswell <matt@openssl.org>

Remove incorrect code inadvertently introduced through commit 59669b6ab.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove SSLv2 support

The only support for SSLv2 left is receiving a SSLv2 compatible client hello.

Reviewed-by: Richard Levitte <levitte@openssl.org>

New location on website for binaries.

Reviewed-by: Bodo Moeller <bodo@openssl.org>

Remove "#if 0" code

Reviewed-by: Tim Hudson <tjh@openssl.org>

Only use the fallback mtu after 2 unsuccessful retransmissions if it is less
than the mtu we are already using

Reviewed-by: Tim Hudson <tjh@openssl.org>

Updates to s_client and s_server to remove the constant 28 (for IPv4 header
and UDP header) when setting an mtu. This constant is not always correct (e.g.
if using IPv6). Use the new DTLS_CTRL functions instead.

Reviewed-by: Tim Hudson <tjh@openssl.org>

If we really get a situation where the underlying mtu is less than the minimum
we will support then dtls1_do_write can go into an infinite loop. This commit
fixes that.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Fix dtls_query_mtu so that it will always either complete with an mtu that is
at least the minimum or it will fail.
There were some instances in dtls1_query_mtu where the final mtu can end up
being less than the minimum, i.e. where the user has set an mtu manually. This
shouldn't be allowed. Also remove dtls1_guess_mtu that, despite having
logic for guessing an mtu, was actually only ever used to work out the minimum
mtu to use.

Reviewed-by: Tim Hudson <tjh@openssl.org>