Commit graph

22600 commits

Author SHA1 Message Date
Matt Caswell
5d263fb78b Make the anti-replay feature optional
Fixes #6389

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6469)
2018-07-02 15:06:12 +01:00
Matt Caswell
b6ff436fcb Fix a NULL ptr deref in error path in tls_process_cke_dhe()
Fixes #6574

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6593)
2018-07-02 14:42:13 +01:00
Benjamin Kaduk
5281bb2252 Address coverity-reported NULL dereference in SSL_SESSION_print()
We need to check the provided SSL_SESSION* for NULL before
attempting to derference it to see if it's a TLS 1.3 session.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/6622)
2018-07-01 18:20:11 -05:00
Pauli
8794be2ed8 Remove development artifacts.
The issue was discovered on the x86/64 when attempting to include
libcrypto inside another shared library.  A relocation of type
R_X86_64_PC32 was generated which causes a linker error.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6595)
2018-07-02 07:21:26 +10:00
Andy Polyakov
a0e53000a8 rand/rand_unix.c: address macro redifinition warning.
Occasionally, e.g. when compiling for elderly glibc, you end up passing
-D_GNU_SOURCE on command line, and doing so triggered warning...

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6616)
2018-07-01 12:05:54 +02:00
Andy Polyakov
ce5eb5e814 modes/asm/ghash-armv4.pl: address "infixes are deprecated" warnings.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6615)
2018-07-01 11:51:44 +02:00
Andy Polyakov
a091e212fc evp/e_chacha20_poly1305.c: improve performance for short TLS records.
Inputs not longer than 64 bytes are processed ~10% faster, longer
lengths not divisble by 64, e.g. 255, up to ~20%. Unfortunately it's
impossible to measure with apps/speed.c, -aead benchmarks TLS-like
call sequence, but not exact. It took specially crafted code path...

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6597)
2018-06-29 12:39:11 +02:00
Billy Brumley
249330de02 More EVP ECC testing: positive and negative
1. For every named curve, two "golden" keypair positive tests.
2. Also two "golden" stock ECDH positive tests.
3. For named curves with non-trivial cofactors, additionally two "golden"
   ECC CDH positive tests.
4. For named curves with non-trivial cofactors, additionally two negative
   tests.

There is some overlap with existing EVP tests, especially for the NIST
curves (for example, positive testing ECC CDH KATs for NIST curves).

"Golden" here means all the values are independent from OpenSSL's ECC
code. I used sage to calculate them. What comes from OpenSSL is:

1. The OIDs (parsed by tooling)
2. The curve parameters (parsing ecparam output with tooling)

The values inside the PEMs (private keys, public keys) and shared keys
are from sage. The PEMs themselves are the output of asn1parse, with
input taken from sage.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6608)
2018-06-29 12:29:12 +02:00
Pauli
8eab767a71 Check return from BN_set_word.
In ssl/t1_lib.c.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6613)
2018-06-29 13:21:06 +10:00
Rich Salz
10c3c1c1ec Zero-fill IV by default.
Fixes uninitialized memory read reported by Nick Mathewson

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6603)
2018-06-28 18:13:54 -04:00
Matt Caswell
358ffa05cd Return a fatal error if application data is encountered during shutdown
Currently if you encounter application data while waiting for a
close_notify from the peer, and you have called SSL_shutdown() then
you will get a -1 return (fatal error) and SSL_ERROR_SYSCALL from
SSL_get_error(). This isn't accurate (it should be SSL_ERROR_SSL) and
isn't persistent (you can call SSL_shutdown() again and it might then work).

We change this into a proper fatal error that is persistent.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/6340)
2018-06-27 10:03:37 +01:00
Matt Caswell
ba70904949 Return SSL_ERROR_WANT_READ if SSL_shutdown() encounters handshake data
In the case where we are shutdown for writing and awaiting a close_notify
back from a subsequent SSL_shutdown() call we skip over handshake data
that is received. This should not be treated as an error - instead it
should be signalled with SSL_ERROR_WANT_READ.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/6340)
2018-06-27 10:03:20 +01:00
Matt Caswell
c748834ff7 Add a bi-directional shutdown test
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/6340)
2018-06-27 10:03:20 +01:00
Matt Caswell
93f528f36e Auto retry if we ditch records during shutdown
If we've sent a close_notify and we're waiting for one back we drop
incoming records until we see the close_notify we're looking for. If
SSL_MODE_AUTO_RETRY is on, then we should immediately try and read the
next record.

Fixes #6262

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/6340)
2018-06-27 10:03:20 +01:00
Pauli
c7504aeb64 Modify the DEVRANDOM source so that the files are kept open persistently.
This allows operation inside a chroot environment without having the
random device present.

A new call, RAND_keep_random_devices_open(), has been introduced that can
be used to control file descriptor use by the random seed sources. Some
seed sources maintain open file descriptors by default, which allows
such sources to operate in a chroot(2) jail without the associated device
nodes being available.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6432)
2018-06-27 07:15:36 +10:00
Matt Caswell
41145c35bf Document changes to SSL_OP_NO_TICKET for TLSv1.3
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6563)
2018-06-26 18:09:46 +01:00
Matt Caswell
e880d4e58d Use stateful tickets if we are doing anti-replay
During anti-replay we cache the ticket anyway, so there is no point in
using a full stateless ticket.

Fixes #6391

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6563)
2018-06-26 18:09:46 +01:00
Matt Caswell
6cc0b3c217 Respect SSL_OP_NO_TICKET in TLSv1.3
Implement support for stateful TLSv1.3 tickets, and use them if
SSL_OP_NO_TICKET is set.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6563)
2018-06-26 18:09:46 +01:00
Matt Caswell
6a11d5c5ed Restructure the ticket construction code
Separate out as a new function the code to write out data which is specific
to a stateless ticket.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6563)
2018-06-26 18:09:46 +01:00
Andy Polyakov
2c879241ba NOTES.UNIX: add "Linking your application" paragraph
... and mention more runtime search path flags.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6587)
2018-06-26 12:28:06 +02:00
Matt Caswell
32f803d88e Update SSL_SESSION_print for TLSv1.3
Make SSL_SESSION_print() show a bit more information for TLSv1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6590)
2018-06-26 10:07:01 +01:00
Matt Caswell
20c0bce506 Only dump session data after we have received it
s_client was dumping session data at the end of the handshake. In TLSv1.3
we don't have session data until receipt of a NewSessionTicket message
which happens post-handshake. Therefore we delay dumping the session data
until that message has arrived if TLSv1.3 has been negotiated.

Fixes #6482

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6590)
2018-06-26 10:07:01 +01:00
Richard Levitte
71419442a2 OpenSSL_add_ssl_algorithm-is-deprecated() is deprecated, make it so
This function is documented to be deprecated since OpenSSL 1.1.0.  We
need to make it so in openssl/ssl.h as well.

Fixes #6565

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6588)
2018-06-25 17:10:02 +02:00
Andy Polyakov
fa339c69a6 store/loader_file.c: fix char-subscripts warning.
This happens on systems that perform is* character classifictions as
array lookup, e.g. NetBSD.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/6584)
2018-06-25 16:47:36 +02:00
Andy Polyakov
1753d12374 PA-RISC assembly pack: make it work with GNU assembler for HP-UX.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6583)
2018-06-25 16:45:48 +02:00
Andy Polyakov
8d58f0171e rand/rand_unix.c: mask getentropy ELF detection on HP-UX.
Unlike other ELF systems, HP-UX run-time linker fails to detect symbol
availability through weak declaration.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6583)
2018-06-25 16:45:09 +02:00
Andy Polyakov
95a3705745 ec/ec_pmeth.c: minor cleanups and readability fixes.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6562)
2018-06-25 16:42:43 +02:00
Nicola Tuveri
469c2c4a45 Use ec_group_do_inverse_ord() in SM2
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6521)
2018-06-25 16:40:51 +02:00
Nicola Tuveri
5a2124620c Add inter-module private header for EC functions
Internal submodules of libcrypto may require non-public functions from
the EC submodule.

In preparation to use `ec_group_do_inverse_ord()` (from #6116) inside
the SM2 submodule to apply a SCA mitigation on the modular inversion,
this commit moves the `ec_group_do_inverse_ord()` prototype declaration
from the EC-local `crypto/ec/ec_lcl.h` header to the
`crypto/include/internal/ec_int.h` inter-module private header.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6521)
2018-06-25 16:40:00 +02:00
Matt Caswell
c35e96691f Don't change a session once its in the cache
Sessions should be immutable once they are in the cache because they could
be shared with other threads. If you change them then this can cause
corruptions and races

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6561)
2018-06-25 12:08:53 +01:00
捷成吴
3445872e22 apps/speed.c: add missing checks for RAND_bytes()
Function RAND_bytes() may return 0 or -1 on error, simply
goto end label when it fails.

Fixes #6567

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6582)
2018-06-24 20:26:37 +02:00
Bernd Edlinger
dc6c374bdb Fix a new gcc-9 warning [-Wstringop-truncation]
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6581)
2018-06-24 18:01:12 +02:00
Ana María Martínez Gómez
f223e8fd1c Support directories with "." in x509_load_serial()
Use `strrchr` to get a pointer to the last occurrence of `.` in the
path string, instead of the first one with `strchr`.  This prevent the
path to be wrongly split if it contains several `.`, and not only the
one for the extension.

Fixes https://github.com/openssl/openssl/issues/6489.

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6566)
2018-06-24 15:42:28 +02:00
Kurt Roeckx
eaf39a9fe6 Fix prototype of ASN1_INTEGER_get and ASN1_INTEGER_set
The parameters where switched

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #6578
2018-06-23 20:29:11 +02:00
Bernd Edlinger
24fa4b8df0 Replace accidentally used C99 macro __func__ with __FILE__/__LINE__
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6558)
2018-06-23 19:18:30 +02:00
Paul Kehrer
a6efd86241 fix pyca/cryptography test suite failure
[extended tests]

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/6540)
2018-06-23 18:29:32 +02:00
Richard Levitte
8973112884 OpenSSL-II style for emacs: don't indent because of extern block
We don't want an indentation step inside a 'extern "C" {' .. '}'
block.  Apparently, cc-mode has a c-offsets-alist keyword to allow
exactly this.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6557)
2018-06-23 07:59:06 +02:00
Benjamin Kaduk
5295b99b56 ecdsa_ossl: address coverity nit
BN_CTX_end() does not handle NULL input, so we must manually check
before calling from the cleanup handler.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6502)
2018-06-22 11:54:30 -05:00
Bernd Edlinger
09fb65d5e4 Fix negative test result in sm2 test
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/6548)
2018-06-22 14:55:28 +02:00
Andy Polyakov
2e51557bc9 sha/asm/sha{256|512}-armv4.pl: harmonize thumb2 support with the rest.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2018-06-22 14:28:08 +02:00
Matt Caswell
3aab9c4011 Add a high level note about the various SCA mitigations
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/6550)
2018-06-22 11:37:03 +01:00
Nicola Tuveri
34446a8524 Remove __cplusplus preamble from internal headers
These headers are internal and never exposed to a cpp compiler, hence no
need for the preamble.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6554)
2018-06-22 12:24:59 +02:00
Andy Polyakov
07e4dc341f Configure,util/shlib_wrap.sh: harmonize -Wl and -rpath handling.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6515)
2018-06-22 11:17:57 +02:00
Andy Polyakov
8b2f413e8f CHANGES: mention AIX shared library support overhaul.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6487)
2018-06-22 10:58:05 +02:00
Andy Polyakov
bd3d8c1260 recipes/90-test_shlibload.t: disable tests on AIX till further notice.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6487)
2018-06-22 10:58:00 +02:00
Andy Polyakov
8f29569ef3 Configurations/10-main.conf: always pass -bsrv4 to AIX linker.
This makes AIX build procedure behave more like e.g. Solaris. Most
notably this makes it possible to pass -Wl,-R,'$(LIBRPATH)' at config
time to embed installation destination as library search path into
openssl binary. This doesn't imply that other applications have to be
linked with -bsvr4, they are free to choose whatever appropriate for
given circumstances.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6487)
2018-06-22 10:57:31 +02:00
Andy Polyakov
cff89b179c Configurations/unix-Makefile.tmpl: switch to "natural" AIX shared libraries.
AIX treats its shared libraries in unique manner, by placing multiple
shared objects of different versions and bitnesses, into .a file.
So far we have been naively linking with version-less libcrypto|ssl.so,
which poses long-term maintenance problems. One could choose to link
straight with libcrypto.so.X.Y [or libcrypto.X.Y.so], but it would be
inconsistent with the way AIX [or Unix] does things.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6487)
2018-06-22 10:57:01 +02:00
Andy Polyakov
b48d4397b8 Configure: allow some file extensions to be overridden by target config.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6487)
2018-06-22 10:56:17 +02:00
Nicola Tuveri
3f5abab941 enable-ec_nistp_64_gcc_128: Fix function prototype warning [-Wstrict-prototypes]
Fix prototype warnings triggered by -Wstrict-prototypes when configuring
with `enable-ec_nistp_64_gcc_128`

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/6556)
2018-06-22 08:08:01 +02:00
Dr. Matthias St. Pierre
12bd4e141e testutil/driver.c: Fix function prototype warning [-Wstrict-prototypes]
(introduced by commit 9186016582, which added -Wstrict-prototypes)

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/6555)
2018-06-22 01:04:34 +02:00