Commit graph

8676 commits

Author SHA1 Message Date
Dr. Stephen Henson
b7d222c519 Merge branch 'OpenSSL_0_9_8-stable' of /home/steve/src/git/openssl into OpenSSL_0_9_8-stable 2013-02-26 17:13:37 +00:00
Geoff Lowe
a93cc7c573 Use orig_len, not rec->orig_len 2013-02-26 17:12:13 +00:00
Nick Alcock
8988407a0b Fix POD errors to stop make install_docs dying with pod2man 2.5.0+
podlators 2.5.0 has switched to dying on POD syntax errors. This means
that a bunch of long-standing erroneous POD in the openssl documentation
now leads to fatal errors from pod2man, halting installation.

Unfortunately POD constraints mean that you have to sort numeric lists
in ascending order if they start with 1: you cannot do 1, 0, 2 even if
you want 1 to appear first. I've reshuffled such (alas, I wish there
were a better way but I don't know of one).
2013-02-15 19:43:49 +01:00
Andy Polyakov
b2afc0a9dc cms-test.pl: make it work with not-so-latest perl.
(cherry picked from commit 9c437e2fad)
2013-02-14 16:40:55 +01:00
David Woodhouse
a8655eb21a Check DTLS_BAD_VER for version number.
Need to check DTLS_BAD_VER as well as DTLS1_VERSION.
PR:2984
(cherry picked from commit 6a14feb048)
2013-02-12 15:12:52 +00:00
Dr. Stephen Henson
f751dc4759 Fix for SSL_get_certificate
Now we set the current certificate to the one used by a server
there is no need to call ssl_get_server_send_cert which will
fail if we haven't sent a certificate yet.
(cherry picked from commit 147dbb2fe3)
2013-02-11 18:27:41 +00:00
Dr. Stephen Henson
fbe621d08f Fix in ssltest is no-ssl2 configured
(cherry picked from commit cbf9b4aed3)
2013-02-11 18:27:33 +00:00
Dr. Stephen Henson
2e9fd4301f use 10240 for tar record size 2013-02-11 15:20:57 +00:00
Lutz Jaenicke
1638ce7212 FAQ/README: we are now using Git instead of CVS
(cherry picked from commit f88dbb8385)

Conflicts:

	INSTALL.W32
2013-02-11 11:31:48 +01:00
Dr. Stephen Henson
7ecd974f5f Set next version.
Note: it was decided that after 0.9.8y it should be 0.9.8za then
0.9.8zb etc.
2013-02-10 13:30:04 +00:00
Andy Polyakov
db731da802 ssl/s3_[clnt|srvr].c: fix warning and linking error.
PR: 2979
2013-02-09 19:38:47 +01:00
Andy Polyakov
5864fd2061 s3_cbc.c: make CBC_MAC_ROTATE_IN_PLACE universal.
(cherry picked from commit f93a41877d)
2013-02-08 21:38:06 +01:00
Andy Polyakov
ff58eaa4b6 s3_cbc.c: get rid of expensive divisions [from master].
(cherry picked from commit e9baceab5a)
2013-02-08 17:01:55 +01:00
Andy Polyakov
76c61a5d1a ssl/s3_enc.c: remove artefact. 2013-02-08 12:03:16 +01:00
Andy Polyakov
4ea7019165 ssl/[d1|s3]_pkt.c: harmomize orig_len handling.
(cherry picked from commit 8545f73b89)
2013-02-08 11:51:09 +01:00
Dr. Stephen Henson
59b1129e0a Fix IV check and padding removal.
Fix the calculation that checks there is enough room in a record
after removing padding and optional explicit IV. (by Steve)

For AEAD remove the correct number of padding bytes (by Andy)
(cherry picked from commit be125aa5ba)
2013-02-08 11:49:41 +01:00
Andy Polyakov
fb092ef4fc ssl/*: remove SSL3_RECORD->orig_len to restore binary compatibility.
Kludge alert. This is arranged by passing padding length in unused
bits of SSL3_RECORD->type, so that orig_len can be reconstructed.
(cherry picked from commit 413cbfe68d)
2013-02-07 15:03:00 +00:00
Adam Langley
6351adecb4 Fix for EXP-RC2-CBC-MD5
MD5 should use little endian order. Fortunately the only ciphersuite
affected is EXP-RC2-CBC-MD5 (TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5) which
is a rarely used export grade ciphersuite.
(cherry picked from commit ee463921ed)
2013-02-06 16:12:49 +00:00
Dr. Stephen Henson
8964efc413 prepare for release 2013-02-05 16:50:37 +00:00
Dr. Stephen Henson
430b637bd5 make update 2013-02-05 16:50:36 +00:00
Dr. Stephen Henson
ca3b81c858 Fix error codes.
(cherry picked from commit 35d732fc2e)
2013-02-05 16:50:36 +00:00
Dr. Stephen Henson
031cbecf86 update NEWS and CHANGES 2013-02-05 16:50:36 +00:00
Andy Polyakov
1213e6c3c2 bn_word.c: fix overflow bug in BN_add_word.
(cherry picked from commit 134c00659a)
2013-02-05 16:50:36 +00:00
Dr. Stephen Henson
32619893b4 update NEWS 2013-02-05 16:50:35 +00:00
Andy Polyakov
40e0de0395 s3/s3_cbc.c: allow for compilations with NO_SHA256|512.
(cherry picked from commit d5371324d9)
2013-02-05 16:50:35 +00:00
Andy Polyakov
5f9345a2f0 ssl/s3_cbc.c: md_state alignment portability fix.
RISCs are picky and alignment granted by compiler for md_state can be
insufficient for SHA512.
(cherry picked from commit 36260233e7)
2013-02-05 16:50:35 +00:00
Andy Polyakov
33ccde59a1 ssl/s3_cbc.c: uint64_t portability fix.
Break dependency on uint64_t. It's possible to declare bits as
unsigned int, because TLS packets are limited in size and 32-bit
value can't overflow.
(cherry picked from commit cab13fc847)
2013-02-05 16:50:35 +00:00
Dr. Stephen Henson
1909df070f Don't access EVP_MD internals directly. 2013-02-05 16:50:35 +00:00
Dr. Stephen Henson
c23a745820 Add ordinal for CRYPTO_memcmp: since this will affect multiple
branches it needs to be in a "gap".
2013-02-05 16:50:34 +00:00
Dr. Stephen Henson
924b117422 Timing fix mitigation for FIPS mode.
We have to use EVP in FIPS mode so we can only partially mitigate
timing differences.

Make an extra call to HMAC_Update to hash additonal blocks
to cover any timing differences caused by removal of padding.
2013-02-05 16:50:34 +00:00
Dr. Stephen Henson
24b2806097 Move CRYPTO_memcmp to o_init.c when compiling with fips: cryptlib.o
is in the fips module for fips capable builds.
2013-02-05 16:50:34 +00:00
Dr. Stephen Henson
99f5093347 The cbc functions shouldn't be inside #ifdef OPENSSL_NO_TLSEXT 2013-02-05 16:50:34 +00:00
Ben Laurie
be88529753 Update DTLS code to match CBC decoding in TLS.
This change updates the DTLS code to match the constant-time CBC
behaviour in the TLS.
(cherry picked from commit 9f27de170d)
(cherry picked from commit 5e4ca556e970edb8a7f364fcb6ee6818a965a60b)

Conflicts:
	ssl/d1_enc.c
	ssl/d1_pkt.c
	ssl/s3_pkt.c
2013-02-05 16:50:33 +00:00
Ben Laurie
b3a959a337 Don't crash when processing a zero-length, TLS >= 1.1 record.
The previous CBC patch was bugged in that there was a path through enc()
in s3_pkt.c/d1_pkt.c which didn't set orig_len. orig_len would be left
at the previous value which could suggest that the packet was a
sufficient length when it wasn't.
(cherry picked from commit 6cb19b7681)
(cherry picked from commit 2c948c1bb218f4ae126e14fd3453d42c62b93235)

Conflicts:
	ssl/s3_enc.c
2013-02-05 16:50:33 +00:00
Ben Laurie
2928cb4c82 Fixups. 2013-02-05 16:50:33 +00:00
Ben Laurie
a33e6702a0 Oops. Add missing file.
(cherry picked from commit 014265eb02)
(cherry picked from commit 7721c53e5e9fe4c90be420d7613559935a96a4fb)
2013-02-05 16:50:33 +00:00
Ben Laurie
35a65e814b Make CBC decoding constant time.
This patch makes the decoding of SSLv3 and TLS CBC records constant
time. Without this, a timing side-channel can be used to build a padding
oracle and mount Vaudenay's attack.

This patch also disables the stitched AESNI+SHA mode pending a similar
fix to that code.

In order to be easy to backport, this change is implemented in ssl/,
rather than as a generic AEAD mode. In the future this should be changed
around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
(cherry picked from commit e130841bcc)

Conflicts:
	crypto/evp/c_allc.c
	ssl/ssl_algs.c
	ssl/ssl_locl.h
	ssl/t1_enc.c
(cherry picked from commit 3622239826698a0e534dcf0473204c724bb9b4b4)

Conflicts:
	ssl/d1_enc.c
	ssl/s3_enc.c
	ssl/s3_pkt.c
	ssl/ssl3.h
	ssl/ssl_algs.c
	ssl/t1_enc.c
2013-02-05 16:50:32 +00:00
Andy Polyakov
7ad132b133 .gitignore adjustments 2013-02-05 16:50:32 +00:00
Ben Laurie
2708813166 Add and use a constant-time memcmp.
This change adds CRYPTO_memcmp, which compares two vectors of bytes in
an amount of time that's independent of their contents. It also changes
several MAC compares in the code to use this over the standard memcmp,
which may leak information about the size of a matching prefix.
(cherry picked from commit 2ee798880a)

Conflicts:
	crypto/crypto.h
	ssl/t1_lib.c
(cherry picked from commit dc406b59f3169fe191e58906df08dce97edb727c)

Conflicts:
	crypto/crypto.h
	ssl/d1_pkt.c
	ssl/s3_pkt.c
2013-02-05 16:50:32 +00:00
Ben Laurie
affe98998a Add target so I can build. 2013-02-05 16:50:32 +00:00
Dr. Stephen Henson
66e8211c0b Don't try and verify signatures if key is NULL (CVE-2013-0166)
Add additional check to catch this in ASN1_item_verify too.
2013-02-05 16:50:31 +00:00
Dr. Stephen Henson
dd2dee60f3 Don't include comp.h in cmd_cd.c if OPENSSL_NO_COMP set 2013-01-23 01:16:59 +00:00
Dr. Stephen Henson
6495179af6 Don't include comp.h if no-comp set. 2013-01-20 01:16:25 +00:00
Dr. Stephen Henson
61b8c79d15 Add .gitignore 2013-01-11 23:21:19 +00:00
Dr. Stephen Henson
42aa3ec4f2 PR: 2888
Reported by: Daniel Black <daniel.black@openquery.com>

Support renewing session tickets (backport from HEAD).
2012-12-10 16:45:39 +00:00
Dr. Stephen Henson
bb152dae8f check mval for NULL too 2012-12-04 17:26:36 +00:00
Dr. Stephen Henson
c42ab44087 fix leak 2012-12-03 16:33:54 +00:00
Dr. Stephen Henson
42e10c3fd6 PR: 2803
Submitted by: jean-etienne.schwartz@bull.net

In OCSP_basic_varify return an error if X509_STORE_CTX_init fails.
2012-11-29 19:16:01 +00:00
Dr. Stephen Henson
c571a3e984 PR: 2908
Submitted by: Dmitry Belyavsky <beldmit@gmail.com>

Fix DH double free if parameter generation fails.
2012-11-21 14:01:38 +00:00
Dr. Stephen Henson
e55988bb60 correct docs 2012-11-19 20:07:23 +00:00