Commit graph

1818 commits

Author SHA1 Message Date
Matt Caswell
43312c624d Fixed out-of-bounds read errors in ssl3_get_key_exchange.
PR#3450

Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-15 23:28:52 +01:00
Dr. Stephen Henson
5ed0b6ac0c Fix SRP authentication ciphersuites.
The addition of SRP authentication needs to be checked in various places
to work properly. Specifically:

A certificate is not sent.
A certificate request must not be sent.
Server key exchange message must not contain a signature.
If appropriate SRP authentication ciphersuites should be chosen.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 8f5a8805b82d1ae81168b11b7f1506db9e047dec)
2014-08-09 00:09:14 +01:00
Dr. Stephen Henson
bb4c9ffd02 Check SRP parameters early.
Check SRP parameters when they are received so we can send back an
appropriate alert.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2014-08-06 20:41:53 +01:00
Dr. Stephen Henson
f338c2e0c2 Fix SRP ciphersuite DoS vulnerability.
If a client attempted to use an SRP ciphersuite and it had not been
set up correctly it would crash with a null pointer read. A malicious
server could exploit this in a DoS attack.

Thanks to Joonas Kuorilehto and Riku Hietamäki from Codenomicon
for reporting this issue.

CVE-2014-2970
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-08-06 20:41:24 +01:00
Gabor Tyukasz
92aa73bcbf Fix race condition in ssl_parse_serverhello_tlsext
CVE-2014-3509
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2014-08-06 20:41:24 +01:00
Emilia Käsper
1d7d0ed9c2 Fix DTLS anonymous EC(DH) denial of service
CVE-2014-3510

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2014-08-06 20:41:24 +01:00
David Benjamin
40a2200d89 Fix protocol downgrade bug in case of fragmented packets
CVE-2014-3511

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Bodo Möller <bodo@openssl.org>
2014-08-06 20:41:24 +01:00
Adam Langley
d345a24569 Remove some duplicate DTLS code.
In a couple of functions, a sequence number would be calculated twice.

Additionally, in |dtls1_process_out_of_seq_message|, we know that
|frag_len| <= |msg_hdr->msg_len| so the later tests for |frag_len <
msg_hdr->msg_len| can be more clearly written as |frag_len !=
msg_hdr->msg_len|, since that's the only remaining case.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-06 20:41:24 +01:00
Matt Caswell
3d5dceac43 Applying same fix as in dtls1_process_out_of_seq_message. A truncated DTLS fragment would cause *ok to be clear, but the return value would still be the number of bytes read.
Problem identified by Emilia Käsper, based on previous issue/patch by Adam
Langley.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-06 20:41:23 +01:00
Adam Langley
aad61c0a57 Fix return code for truncated DTLS fragment.
Previously, a truncated DTLS fragment in
|dtls1_process_out_of_seq_message| would cause *ok to be cleared, but
the return value would still be the number of bytes read. This would
cause |dtls1_get_message| not to consider it an error and it would
continue processing as normal until the calling function noticed that
*ok was zero.

I can't see an exploit here because |dtls1_get_message| uses
|s->init_num| as the length, which will always be zero from what I can
see.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-06 20:41:23 +01:00
Adam Langley
8ca4c4b25e Fix memory leak from zero-length DTLS fragments.
The |pqueue_insert| function can fail if one attempts to insert a
duplicate sequence number. When handling a fragment of an out of
sequence message, |dtls1_process_out_of_seq_message| would not call
|dtls1_reassemble_fragment| if the fragment's length was zero. It would
then allocate a fresh fragment and attempt to insert it, but ignore the
return value, leaking the fragment.

This allows an attacker to exhaust the memory of a DTLS peer.

Fixes CVE-2014-3507

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-06 20:41:23 +01:00
Matt Caswell
0598468fc0 Fix DTLS handshake message size checks.
In |dtls1_reassemble_fragment|, the value of
|msg_hdr->frag_off+frag_len| was being checked against the maximum
handshake message size, but then |msg_len| bytes were allocated for the
fragment buffer. This means that so long as the fragment was within the
allowed size, the pending handshake message could consume 16MB + 2MB
(for the reassembly bitmap). Approx 10 outstanding handshake messages
are allowed, meaning that an attacker could consume ~180MB per DTLS
connection.

In the non-fragmented path (in |dtls1_process_out_of_seq_message|), no
check was applied.

Fixes CVE-2014-3506

Wholly based on patch by Adam Langley with one minor amendment.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-06 20:41:23 +01:00
Matt Caswell
ea7cb53974 Added comment for the frag->reassembly == NULL case as per feedback from Emilia
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-06 20:41:23 +01:00
Adam Langley
4985007555 Avoid double free when processing DTLS packets.
The |item| variable, in both of these cases, may contain a pointer to a
|pitem| structure within |s->d1->buffered_messages|. It was being freed
in the error case while still being in |buffered_messages|. When the
error later caused the |SSL*| to be destroyed, the item would be double
freed.

Thanks to Wah-Teh Chang for spotting that the fix in 1632ef74 was
inconsistent with the other error paths (but correct).

Fixes CVE-2014-3505

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-06 20:41:23 +01:00
Dr. Stephen Henson
89d2f8f1a9 make update
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-08-01 21:21:03 +01:00
Dr. Stephen Henson
789b12599d Add conditional unit testing interface.
Don't call internal functions directly call them through
SSL_test_functions(). This also makes unit testing work on
Windows and platforms that don't export internal functions
from shared libraries.

By default unit testing is not enabled: it requires the compile
time option "enable-unit-test".
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
(cherry picked from commit e0fc7961c4)

Conflicts:

	ssl/heartbeat_test.c
	ssl/ssl.h
	util/mkdef.pl
2014-07-24 19:42:26 +01:00
Dr. Stephen Henson
666a597ffb Fix DTLS certificate requesting code.
Use same logic when determining when to expect a client
certificate for both TLS and DTLS.

PR#3452
(cherry picked from commit c8d710dc5f)
2014-07-15 18:23:35 +01:00
Dr. Stephen Henson
fa2b54c83a Use more common name for GOST key exchange.
(cherry picked from commit 7aabd9c92fe6f0ea2a82869e5171dcc4518cee85)
2014-07-14 18:31:55 +01:00
Peter Mosmans
2fbd94252a Add names of GOST algorithms.
PR#3440
(cherry picked from commit 924e5eda2c)
2014-07-13 18:31:09 +01:00
Andy Polyakov
2064e2db08 Please Clang's sanitizer.
PR: #3424,#3423,#3422
(cherry picked from commit 021e5043e5)
2014-07-09 22:45:38 +02:00
Andy Polyakov
0359ccfd8b s3_pkt.c: fix typo.
(cherry picked from commit 0e7a32b55e)
2014-07-05 23:57:28 +02:00
Dr. Stephen Henson
8358302d47 Don't limit message sizes in ssl3_get_cert_verify.
PR#319 (reoponed version).
(cherry picked from commit 7f6e957864)
2014-07-05 13:30:38 +01:00
Dr. Stephen Henson
22db480daf Remove all RFC5878 code.
Remove RFC5878 code. It is no longer needed for CT and has numerous bugs.
2014-07-04 13:42:05 +01:00
Thijs Alkemade
8f243ab6c1 Make disabling last cipher work.
(cherry picked from commit 7cb472bd0d)
2014-07-02 03:32:42 +01:00
Ben Laurie
70c739b8db Fix possible buffer overrun.
(cherry picked from commit 2db3ea2929)

Conflicts:
	ssl/ssl_locl.h
	ssl/t1_lib.c
2014-07-02 00:09:39 +01:00
Dr. Stephen Henson
15de0f609c Fix memory leak.
PR#2531
(cherry picked from commit 44724beead)
2014-06-29 13:51:57 +01:00
Dr. Stephen Henson
4950a528ce Don't disable state strings with no-ssl2
Some state strings were erronously not compiled when no-ssl2
was set.

PR#3295
(cherry picked from commit 0518a3e19e)
2014-06-28 00:56:27 +01:00
yogesh nagarkar
00ab230a3f Fix compilation with -DSSL_DEBUG -DTLS_DEBUG -DKSSL_DEBUG
PR#3141
(cherry picked from commit d183545d45)
2014-06-28 00:41:31 +01:00
Ken Ballou
ec77f276e1 Remove redundant check.
PR#3174
(cherry picked from commit fd331c0bb9b557903dd2ce88398570a3327b5ef0)
2014-06-27 23:19:37 +01:00
Tomas Mraz
f4623ab996 Don't advertise ECC ciphersuits in SSLv2 compatible client hello.
PR#3374
(cherry picked from commit 0436369fcc)
2014-06-27 16:52:00 +01:00
Miod Vallat
d15f2d98ef Fix off-by-one errors in ssl_cipher_get_evp()
In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

Bug discovered and fixed by Miod Vallat from the OpenBSD team.

PR#3375
2014-06-22 23:18:15 +01:00
Matt Caswell
00f5ee445b Revert "Fix off-by-one errors in ssl_cipher_get_evp()"
This reverts commit 3d86077427.

Incorrect attribution.
2014-06-22 23:17:40 +01:00
Matt Caswell
e7911530a9 Fixed Windows compilation failure 2014-06-22 20:18:09 +02:00
Felix Laurie von Massenbach
1b823494de Fix signed/unsigned comparisons.
(cherry picked from commit 50cc4f7b3d)
2014-06-17 18:38:36 +01:00
Richard Levitte
23351c607b Remove unused DANE macros. This should be the last DANE stuff... 2014-06-17 12:38:20 +02:00
Richard Levitte
b9c0dae28e Spaces were added in some strings for better readability. However, those spaces do not belong in file names, so when picking out the individual parts, remove the spaces 2014-06-16 13:25:16 +02:00
Dr. Stephen Henson
90d94ce39e Accept CCS after sending finished.
Allow CCS after finished has been sent by client: at this point
keys have been correctly set up so it is OK to accept CCS from
server. Without this renegotiation can sometimes fail.

PR#3400
(cherry picked from commit 99cd6a91fcb0931feaebbb4832681d40a66fad41)
2014-06-14 22:31:28 +01:00
Richard Levitte
66a6e2b2b6 Adjust VMS build files to the Unix ones 2014-06-14 16:58:11 +02:00
Richard Levitte
1be1d05184 Make sure that disabling the MAYLOSEDATA3 warning is only done when the
compiler supports it.  Otherwise, there are warnings about it lacking
everywhere, which is quite tedious to read through while trying to check
for other warnings.
2014-06-14 16:58:11 +02:00
Matt Caswell
561ba12463 Fixed incorrect return code handling in ssl3_final_finish_mac.
Based on an original patch by Joel Sing (OpenBSD) who also originally identified the issue.
2014-06-13 15:50:58 +01:00
Matt Caswell
7f133c357b Revert "Fixed incorrect return code handling in ssl3_final_finish_mac"
This reverts commit 728bd41a15.

Missing attribution.
2014-06-13 15:50:28 +01:00
Kurt Cancemi
3d86077427 Fix off-by-one errors in ssl_cipher_get_evp()
In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

PR#3375
2014-06-12 21:12:43 +01:00
Matt Caswell
955bfbc268 Added OPENSSL_assert check as per PR#3377 reported by Rainer Jung <rainer.jung@kippdata.de> 2014-06-12 20:42:33 +01:00
Dr. Stephen Henson
5af09776ce Remove unimplemented functions. 2014-06-12 10:52:49 +01:00
Andy Polyakov
d85a772ec3 Enable multi-block support by default.
(cherry picked from commit 77a27a5066)
2014-06-11 20:41:46 +02:00
Matt Caswell
728bd41a15 Fixed incorrect return code handling in ssl3_final_finish_mac 2014-06-10 23:32:27 +01:00
Mike Bland
2fddc5fc09 Create test/testutil.h for unit test helper macros
Defines SETUP_TEST_FIXTURE and EXECUTE_TEST, and updates ssl/heartbeat_test.c
using these macros. SETUP_TEST_FIXTURE makes use of the new TEST_CASE_NAME
macro, defined to use __func__ or __FUNCTION__ on platforms that support those
symbols, or to use the file name and line number otherwise. This should fix
several reported build problems related to lack of C99 support.
2014-06-10 19:24:46 +01:00
Dr. Stephen Henson
e3beef1e1b Remove experimental DANE code.
Remove experimental DANE/dnssec code: not ready for use in an
official release yet.
2014-06-10 14:59:10 +01:00
Dr. Stephen Henson
cea5a1d5f2 Fix null pointer errors.
PR#3394
(cherry picked from commit 7a9d59c148)
2014-06-10 14:48:02 +01:00
Dr. Stephen Henson
f472ada006 SRP ciphersuite correction.
SRP ciphersuites do not have no authentication. They have authentication
based on SRP. Add new SRP authentication flag and cipher string.
(cherry picked from commit a86b88acc373ac1fb0ca709a5fb8a8fa74683f67)
2014-06-09 12:09:51 +01:00
Dr. Stephen Henson
05b2210476 Update strength_bits for 3DES.
Fix strength_bits to 112 for 3DES.
(cherry picked from commit 837c203719205ab19b5609b2df7151be8df05687)
2014-06-09 12:09:51 +01:00
Dr. Stephen Henson
a21f350a76 Make tls_session_secret_cb work with CVE-2014-0224 fix.
If application uses tls_session_secret_cb for session resumption
set the CCS_OK flag.
(cherry picked from commit 953c592572e8811b7956cc09fbd8e98037068b58)
2014-06-07 15:27:23 +01:00
Dr. Stephen Henson
eb6508d50c Fix for CVE-2014-0195
A buffer overrun attack can be triggered by sending invalid DTLS fragments
to an OpenSSL DTLS client or server. This is potentially exploitable to
run arbitrary code on a vulnerable client or server.

Fixed by adding consistency check for DTLS fragments.

Thanks to Jüri Aedla for reporting this issue.
(cherry picked from commit 1632ef7448)
2014-06-05 13:24:50 +01:00
Dr. Stephen Henson
77719aefb8 Fix for CVE-2014-0224
Only accept change cipher spec when it is expected instead of at any
time. This prevents premature setting of session keys before the master
secret is determined which an attacker could use as a MITM attack.

Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for reporting this issue
and providing the initial fix this patch is based on.
(cherry picked from commit bc8923b1ec)
2014-06-05 13:24:46 +01:00
Dr. Stephen Henson
9d2c9dd1e1 Additional CVE-2014-0224 protection.
Return a fatal error if an attempt is made to use a zero length
master secret.
(cherry picked from commit 006cd7083f)
2014-06-05 13:24:40 +01:00
Dr. Stephen Henson
8942b92c7c Fix CVE-2014-0221
Unnecessary recursion when receiving a DTLS hello request can be used to
crash a DTLS client. Fixed by handling DTLS hello request without recursion.

Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
(cherry picked from commit d3152655d5)
2014-06-05 13:24:36 +01:00
Dr. Stephen Henson
e5f706590c Fix CVE-2014-3470
Check session_cert is not NULL before dereferencing it.
(cherry picked from commit 8011cd56e3)
2014-06-05 13:24:30 +01:00
David Benjamin
56b94a38b9 Check there is enough room for extension.
(cherry picked from commit 7d89b3bf42e4b4067371ab33ef7631434e41d1e4)
2014-06-02 18:59:48 +01:00
zhu qun-ying
d52eb82781 Free up s->d1->buffered_app_data.q properly.
PR#3286
(cherry picked from commit 71e95000afb2227fe5cac1c79ae884338bcd8d0b)
2014-06-02 14:40:05 +01:00
Sami Farin
6468866823 Typo: set i to -1 before goto.
PR#3302
(cherry picked from commit 9717f01951f976f76dd40a38d9fc7307057fa4c4)
2014-06-02 13:53:54 +01:00
Matt Caswell
de8a5b523f Added SSLErr call for internal error in dtls1_buffer_record 2014-06-01 21:40:31 +01:00
David Ramos
8de85b0048 Delays the queue insertion until after the ssl3_setup_buffers() call due to use-after-free bug. PR#3362 2014-06-01 21:40:25 +01:00
Dr. Stephen Henson
623a01df49 Option to disable padding extension.
Add TLS padding extension to SSL_OP_ALL so it is used with other
"bugs" options and can be turned off.

This replaces SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG which is an ancient
option referring to SSLv2 and SSLREF.

PR#3336
(cherry picked from commit 758415b2259fa45d3fe17d8e53ae1341b7b6e482)

Conflicts:

	ssl/t1_lib.c
2014-06-01 16:50:25 +01:00
David Ramos
856a4585d6 Allocate extra space when NETSCAPE_HANG_BUG defined.
Make sure there is an extra 4 bytes for server done message when
NETSCAPE_HANG_BUG is defined.

PR#3361
(cherry picked from commit 92d81ba622)
2014-06-01 14:27:58 +01:00
Dr. Stephen Henson
87a0cbdf2e Use correct digest when exporting keying material.
PR#3319
(cherry picked from commit 84691390eae86befd33c83721dacedb539ae34e6)
2014-05-30 13:24:36 +01:00
Dr. Stephen Henson
b5bdde9e0e Don't compile heartbeat test code on Windows (for now).
(cherry picked from commit 2c575907d2c8601a18716f718ce309ed4e1f1783)
2014-05-30 13:12:26 +01:00
Mike Bland
8db2ba4b84 Fix heartbeat_test for -DOPENSSL_NO_HEARTBEATS
Replaces the entire test with a trivial implementation when
OPENSSL_NO_HEARTBEATS is defined.
2014-05-22 22:02:46 +01:00
Ben Laurie
5cd1a6fc3e Fix signed/unsigned warning. 2014-05-20 15:14:30 +01:00
Dr. Stephen Henson
81ce94f8dc For portability use BUF_strndup instead of strndup.
(cherry picked from commit dcca7b13e9)
2014-05-20 11:22:33 +01:00
Dr. Stephen Henson
feaa3b380b Adding padding extension to trace code.
(cherry picked from commit 6db14dbc51)
2014-05-20 11:22:15 +01:00
Mike Bland
2312a84ca1 Unit/regression test for TLS heartbeats.
Regression test against CVE-2014-0160 (Heartbleed).

More info: http://mike-bland.com/tags/heartbleed.html

(based on commit 35cb55988b75573105eefd00d27d0138eebe40b1)
2014-05-18 10:23:59 -04:00
Kurt Roeckx
1f5bce2dce Check sk_SSL_CIPHER_num() after assigning sk. 2014-05-12 22:59:11 +01:00
Serguei E. Leontiev
d6e55b4001 Replace manual ASN1 decoder with ASN1_get_object
Replace manual ASN.1 decoder with ASN1_get object. This
will decode the tag and length properly and check against
it does not exceed the supplied buffer length.

PR#3335
(cherry picked from commit b0308dddd1cc6a8e1de803ef29ba6da25ee072c2)
2014-05-12 18:41:51 +01:00
Matt Caswell
f710c3f198 Fixed NULL pointer dereference. See PR#3321 2014-05-12 00:39:43 +01:00
Günther Noack
8571902e23 Avoid out-of-bounds write in SSL_get_shared_ciphers
PR: 3317
2014-05-11 23:55:06 +01:00
Matt Caswell
f2ebe2a60e Move length check earlier to ensure we don't go beyond the end of the user's buffer. PR#3320 2014-05-11 11:32:17 +01:00
Tim Hudson
011ee91105 safety check to ensure we dont send out beyond the users buffer 2014-05-11 11:32:17 +01:00
Tim Hudson
afe343c3a7 fix coverity issue 966597 - error line is not always initialised 2014-05-07 23:57:00 +01:00
Matt Caswell
7441e7dbe9 Fixed spelling error in error message. Fix supplied by Marcos Marado 2014-05-01 00:27:02 +01:00
Ben Laurie
a0fe2e72c4 Fix use after free. 2014-04-23 07:30:16 +01:00
Kaspar Brand
5aeb43393b Fix SSL_CTX_get{first,next}_certificate.
Fix typo that stopped SSL_CTX_get_{first,next}_certificate from working.
(cherry picked from commit 9330a85e04)
2014-04-21 16:53:48 +01:00
Steven M. Schweda
6ef9d9bacf VMS build fix #2.
(cherry picked from commit a74bee5fc7)
2014-04-08 17:28:23 +01:00
Steven M. Schweda
40a44a7c3d VMS build fix for older compilers.
(cherry picked from commit 55c9e24875)
2014-04-07 23:15:31 +01:00
Dr. Stephen Henson
7e840163c0 Add heartbeat extension bounds check.
A missing bounds check in the handling of the TLS heartbeat extension
can be used to reveal up to 64k of memory to a connected client or
server.

Thanks for Neel Mehta of Google Security for discovering this bug and to
Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
preparing the fix (CVE-2014-0160)
(cherry picked from commit 96db9023b8)
2014-04-07 19:25:34 +01:00
Dr. Stephen Henson
6411b83e52 Set TLS padding extension value.
Enable TLS padding extension using official value from:

http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
(cherry picked from commit cd6bd5ffda)

Conflicts:

	CHANGES
2014-04-05 20:49:09 +01:00
Dr. Stephen Henson
bc5ec653ba Fix memory leak with client auth. 2014-03-27 16:10:50 +00:00
Dr. Stephen Henson
1f44dac24d Add -no_resumption_on_reneg to SSL_CONF. 2014-03-27 15:51:25 +00:00
Dr. Stephen Henson
2dd6976f6d Update chain building function.
Don't clear verification errors from the error queue unless
SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR is set.

If errors occur during verification and SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR
is set return 2 so applications can issue warnings.
2014-03-27 14:23:46 +00:00
Emilia Kasper
662239183d Allow duplicate certs in ssl_build_cert_chain 2014-03-25 17:28:04 +00:00
Piotr Sikora
aa10982c49 Retry callback only after ClientHello received.
(cherry picked from commit f04665a653)
2014-03-18 23:58:39 +00:00
Dr. Stephen Henson
44f7e399d3 typo
(cherry picked from commit a029788b0e)
2014-03-10 15:48:12 +00:00
Andy Polyakov
25ebd9e3ce bss_dgram.c,d1_lib.c: make it compile with mingw.
Submitted by: Roumen Petrov
(cherry picked from commit 972b0dc350)
2014-03-06 14:07:16 +01:00
Dr. Stephen Henson
976c58302b Add function to free compression methods.
Although the memory allocated by compression methods is fixed and
cannot grow over time it can cause warnings in some leak checking
tools. The function SSL_COMP_free_compression_methods() will free
and zero the list of supported compression methods. This should
*only* be called in a single threaded context when an application
is shutting down to avoid interfering with existing contexts
attempting to look up compression methods.
2014-03-01 23:14:08 +00:00
Dr. Stephen Henson
d1201e3195 Fix compilation errors with no-nextprotoneg 2014-02-28 13:35:30 +00:00
Dr. Stephen Henson
73be56a21d Fix for WIN32 builds with KRB5 2014-02-26 15:33:10 +00:00
Andy Polyakov
8d08627c94 ssl/t1_enc.c: check EVP_MD_CTX_copy return value.
PR: 3201
(cherry picked from commit 03da57fe14)
2014-02-25 22:23:49 +01:00
Dr. Stephen Henson
3678161d71 Don't use BN_ULLONG in n2l8 use SCTS_TIMESTAMP. 2014-02-25 15:05:08 +00:00
Dr. Stephen Henson
c3f5d3d93a Only set current certificate to valid values.
When setting the current certificate check that it has a corresponding
private key.
(cherry picked from commit 358d352aa2)
2014-02-23 13:49:21 +00:00
Dr. Stephen Henson
c5ea65b157 New chain building flags.
New flags to build certificate chains. The can be used to rearrange
the chain so all an application needs to do is add all certificates
in arbitrary order and then build the chain to check and correct them.

Add verify error code when building chain.

Update docs.
(cherry picked from commit 13dc3ce9ab)
2014-02-23 13:49:21 +00:00
Dr. Stephen Henson
58b86e4235 Option to set current cert to server certificate.
(cherry picked from commit daddd9a950)
2014-02-23 13:49:21 +00:00
Ben Laurie
a466be6243 Fix typo. 2014-02-23 11:21:39 +00:00
Andy Polyakov
6b3b6beaa1 ssl/ssl_cert.c: DANE update. 2014-02-21 12:12:25 +01:00
Dr. Stephen Henson
b709f8ef54 fix WIN32 warnings 2014-02-20 22:41:06 +00:00
Rob Stradling
c74ce24cd2 Show the contents of the RFC6962 Signed Certificate Timestamp List Certificate/OCSP Extensions.
Add the RFC6962 OIDs to the objects table.
(backport from master branch)
2014-02-20 21:43:54 +00:00
Dr. Stephen Henson
d69acceca9 Fix error discrepancy with 1.0.1 2014-02-14 17:50:20 +00:00
Andy Polyakov
aff78bb39a ssl/s3_pkt.c: detect RAND_bytes error in multi-block.
(cherry picked from commit 701134320a)
2014-02-14 17:45:33 +01:00
Andy Polyakov
d59d0b7c21 ssl/ssl[3].h: retain binary compatibility. 2014-02-13 17:03:14 +01:00
Dr. Stephen Henson
a2317c3ffd fix error discrepancy 2014-02-09 21:12:12 +00:00
Dr. Stephen Henson
295fd057ce fix error number clash 2014-02-09 19:57:27 +00:00
Ben Laurie
8acf1ff4b4 More cleanup.
(cherry picked from commit 5eda213ebe)
Conflicts:
	apps/s_client.c
	apps/s_server.c
2014-02-09 08:07:04 -08:00
Ben Laurie
8b41df41c2 Make it build.
(cherry picked from commit a6a48e87bc)
Conflicts:
	ssl/s3_clnt.c
	ssl/t1_lib.c
2014-02-09 08:02:40 -08:00
Scott Deboy
c32ebefaa8 Reverting 1.0.2-only changes supporting the prior authz RFC5878-based tests from commit 835d104f46 2014-02-09 07:49:44 -08:00
Scott Deboy
5a32dd8930 Don't break out of the custom extension callback loop - continue instead
The contract for custom extension callbacks has changed - all custom extension callbacks are triggered
2014-02-08 16:19:30 -08:00
Ben Laurie
130ebe34c8 Fix whitespace, new-style comments. 2014-02-08 16:19:30 -08:00
Scott Deboy
7612511b3b Re-add alert variables removed during rebase
Whitespace fixes

(cherry picked from commit e9add063b5)
Conflicts:
	ssl/s3_clnt.c
2014-02-08 16:19:01 -08:00
Scott Deboy
19a28a8aa3 Updating DTCP authorization type to expected value 2014-02-08 16:18:11 -08:00
Scott Deboy
fc213217e8 Update custom TLS extension and supplemental data 'generate' callbacks to support sending an alert.
If multiple TLS extensions are expected but not received, the TLS extension and supplemental data 'generate' callbacks are the only chance for the receive-side to trigger a specific TLS alert during the handshake.

Removed logic which no-op'd TLS extension generate callbacks (as the generate callbacks need to always be called in order to trigger alerts), and updated the serverinfo-specific custom TLS extension callbacks to track which custom TLS extensions were received by the client, where no-ops for 'generate' callbacks are appropriate.

(cherry picked from commit ac20719d99)
Conflicts:
	ssl/t1_lib.c
2014-02-08 16:17:24 -08:00
Trevor Perrin
7198c5af1f Redo deletion of some serverinfo code that supplemental data code mistakenly reinstated. 2014-02-08 16:15:10 -08:00
Scott Deboy
038bec784e Add callbacks supporting generation and retrieval of supplemental data entries, facilitating RFC 5878 (TLS auth extensions)
Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API
Tests exercising the new supplemental data registration and callback api can be found in ssltest.c.
Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation.

(cherry picked from commit 36086186a9)
Conflicts:
	Configure
	apps/s_client.c
	apps/s_server.c
	ssl/ssl.h
	ssl/ssl3.h
	ssl/ssltest.c
2014-02-08 16:12:15 -08:00
Dr. Stephen Henson
c41e242e5c Return previous compression methods when setting them.
(cherry picked from commit b45e874d7c)
2014-02-06 13:58:18 +00:00
Andy Polyakov
9578319394 ssl/s3_pkt.c: add multi-block processing [from master]. 2014-02-05 21:43:17 +01:00
Dr. Stephen Henson
3bff195dca Oops, get selection logic right.
(cherry picked from commit 3880579240d476d21f68fd01a391dd325920f479)
2014-02-05 18:57:23 +00:00
Dr. Stephen Henson
e0d4272a58 Return per-certificate chain if extra chain is NULL.
If an application calls the macro SSL_CTX_get_extra_chain_certs
return either the old "shared" extra certificates or those associated
with the current certificate.

This means applications which call SSL_CTX_use_certificate_chain_file
and retrieve the additional chain using SSL_CTX_get_extra_chain_certs
will still work. An application which only wants to check the shared
extra certificates can call the new macro
SSL_CTX_get_extra_chain_certs_only
(cherry picked from commit a51f767645)
2014-02-05 17:06:56 +00:00
Dr. Stephen Henson
e2f06800bc New ctrl to set current certificate.
New ctrl sets current certificate based on certain criteria. Currently
two options: set the first valid certificate as current and set the
next valid certificate as current. Using these an application can
iterate over all certificates in an SSL_CTX or SSL structure.
(cherry picked from commit 0f78819c8c)
2014-02-02 23:12:06 +00:00
Andy Polyakov
9071b36d9a Add AES-NI+SHA256 stitch registrations (from master). 2014-02-02 00:05:02 +01:00
Andy Polyakov
2cc5142fb1 Improve WINCE support.
Submitted by: Pierre Delaage
(cherry picked from commit a006fef78e)

Resolved conflicts:

	crypto/bio/bss_dgram.c
	ssl/d1_lib.c
	util/pl/VC-32.pl
2014-02-01 22:48:56 +01:00
Dr. Stephen Henson
a99540a6de Check i before r[i].
PR#3244
(cherry picked from commit 9614d2c676)
2014-01-28 15:14:47 +00:00
Dr. Stephen Henson
ede90b1121 Support retries in certificate callback
(cherry picked from commit 0ebc965b9c)

Conflicts:

	ssl/s3_srvr.c
	ssl/ssl3.h
2014-01-27 14:41:38 +00:00
Dr. Stephen Henson
9f1979b94a New function to set compression methods so they can be safely freed.
(cherry picked from commit cbb6744827)
2014-01-27 14:32:44 +00:00
Dr. Stephen Henson
c4f01c533b Add new function SSL_CTX_get_ssl_method().
Partial fix for PR#3183.
(cherry picked from commit ba168244a1)
2014-01-16 14:08:42 +00:00
Kaspar Brand
b7a8550988 Omit initial status request callback check.
PR#3178
(cherry picked from commit d0b039d4a3)
2014-01-16 13:48:23 +00:00
Zoltan Arpadffy
e775891708 VMS fixes 2014-01-11 22:44:04 +00:00
Dr. Stephen Henson
2f972419a3 Add fix for CVE-2013-4353 2014-01-07 15:41:11 +00:00
Dr. Stephen Henson
b17d6b8d1d Restore SSL_OP_MSIE_SSLV2_RSA_PADDING
The flag SSL_OP_MSIE_SSLV2_RSA_PADDING hasn't done anything since OpenSSL
0.9.7h but deleting it will break source compatibility with any software
that references it. Restore it but #define to zero.
2014-01-04 13:58:51 +00:00
Dr. Stephen Henson
b9fa413a08 Use algorithm specific chains for certificates.
Fix a limitation in SSL_CTX_use_certificate_chain_file(): use algorithm
specific chains instead of the shared chain.

Update docs.
(cherry picked from commit a4339ea3ba)

Conflicts:

	CHANGES
2014-01-03 22:45:20 +00:00
Andy Polyakov
4abe148444 ssl/t1_enc.c: optimize PRF (suggested by Intel).
(cherry picked from commit e8b0dd57c0)
2014-01-03 21:56:03 +01:00
Dr. Stephen Henson
8511b5f594 Don't change version number if session established
When sending an invalid version number alert don't change the
version number to the client version if a session is already
established.

Thanks to Marek Majkowski for additional analysis of this issue.

PR#3191
(cherry picked from commit b77b58a398)
2014-01-02 15:07:51 +00:00
Dr. Stephen Henson
546d6760b9 Update curve list size. 2013-12-29 16:30:34 +00:00
Dr. Stephen Henson
80b6d97585 Fix DTLS retransmission from previous session.
For DTLS we might need to retransmit messages from the previous session
so keep a copy of write context in DTLS retransmission buffers instead
of replacing it after sending CCS. CVE-2013-6450.
(cherry picked from commit 34628967f1)
2013-12-20 23:25:41 +00:00
Dr. Stephen Henson
a32ba49352 Check EVP errors for handshake digests.
Partial mitigation of PR#3200
(cherry picked from commit 0294b2be5f)
2013-12-18 13:27:15 +00:00
Dr. Stephen Henson
8c6d8c2a49 Backport TLS padding extension from master. 2013-12-13 15:29:26 +00:00
Dr. Stephen Henson
bf4863b3f5 Verify parameter retrieval functions.
New functions to retrieve internal pointers to X509_VERIFY_PARAM
for SSL_CTX and SSL structures.
2013-12-13 15:29:26 +00:00
Dr. Stephen Henson
c97ec5631b Fix warning. 2013-12-01 23:30:21 +00:00
Dr. Stephen Henson
fdb0d5dd8f Change header order to pick up OPENSSL_SYS_WIN32 2013-12-01 23:29:40 +00:00
Dr. Stephen Henson
bc35b8e435 make update 2013-12-01 23:09:44 +00:00
Dr. Stephen Henson
6859f3fc12 Fix warnings. 2013-12-01 23:08:13 +00:00
Dr. Stephen Henson
8b2d5cc4a7 WIN32 fixes. 2013-12-01 23:07:18 +00:00
Dr. Stephen Henson
2a1b7bd380 New functions to retrieve certificate from SSL_CTX
New functions to retrieve current certificate or private key
from an SSL_CTX.

Constify SSL_get_private_key().
(cherry picked from commit a25f9adc77)
2013-11-18 18:59:18 +00:00
Dr. Stephen Henson
4bba0bda61 Don't define SSL_select_next_proto if OPENSSL_NO_TLSEXT set
(cherry picked from commit 60aeb18750)
2013-11-18 18:59:03 +00:00
Dr. Stephen Henson
27baa8317a Use correct header length in ssl3_send_certifcate_request
(cherry picked from commit fdeaf55bf9)
2013-11-17 17:50:11 +00:00
Piotr Sikora
edc687ba0f Fix compilation with no-nextprotoneg.
PR#3106
2013-11-14 01:20:58 +00:00
Dr. Stephen Henson
ff0bdbed85 Allow match selecting of current certificate.
If pointer comparison for current certificate fails check
to see if a match using X509_cmp succeeds for the current
certificate: this is useful for cases where the certificate
pointer is not available.
(cherry picked from commit 6856b288a6e66edd23907b7fa264f42e05ac9fc7)
2013-11-13 23:47:49 +00:00
Rob Stradling
dc4bdf592f Additional "chain_cert" functions.
PR#3169

This patch, which currently applies successfully against master and
1_0_2, adds the following functions:

SSL_[CTX_]select_current_cert() - set the current certificate without
disturbing the existing structure.

SSL_[CTX_]get0_chain_certs() - get the current certificate's chain.

SSL_[CTX_]clear_chain_certs() - clear the current certificate's chain.

The patch also adds these functions to, and fixes some existing errors
in, SSL_CTX_add1_chain_cert.pod.
(cherry picked from commit 2f56c9c015dbca45379c9a725915b3b8e765a119)
2013-11-13 23:47:37 +00:00
Krzysztof Kwiatkowski
b03d0513d0 Delete duplicate entry.
PR#3172
(cherry picked from commit 4f055e34c3598cad00fca097d812fa3e6436d967)
2013-11-13 23:47:26 +00:00
Dr. Stephen Henson
63fe69c12e Enable PSK in FIPS mode.
Enable PSK ciphersuites with AES or DES3 in FIPS mode.
(cherry picked from commit e0ffd129c1)
2013-11-06 14:39:41 +00:00
Dr. Stephen Henson
bd80d0229c Add brainpool curves to trace output. 2013-11-02 14:07:21 +00:00
Dr. Stephen Henson
163d794845 Fix warning.
(cherry picked from commit 96e16bddb4)
2013-11-02 14:02:00 +00:00
Dr. Stephen Henson
0b33466b3f Add SSL_CONF command to set DH Parameters.
(cherry picked from commit c557f921dc)
2013-11-02 13:42:03 +00:00
Dr. Stephen Henson
bed27f4db3 Fix argument processing.
(cherry picked from commit abf840e4f7)
2013-11-02 13:41:51 +00:00
Dr. Stephen Henson
738a224bd0 Constification.
(cherry picked from commit 27f3b65f49)
2013-11-02 13:41:38 +00:00
Dr. Stephen Henson
044f8ca87d Extend SSL_CONF
Extend SSL_CONF to return command value types.

Add certificate and key options.

Update documentation.
(cherry picked from commit ec2f7e568e)
2013-11-02 13:41:19 +00:00
Dr. Stephen Henson
45ee08d99b Typo.
(cherry picked from commit 13af145159)
2013-11-02 13:41:06 +00:00
Piotr Sikora
5ff68e8f6d Fix SSL_OP_SINGLE_ECDH_USE
Don't require a public key in tls1_set_ec_id if compression status is
not needed. This fixes a bug where SSL_OP_SINGLE_ECDH_USE wouldn't work.
2013-11-01 21:37:46 +00:00
Dr. Stephen Henson
f14a4a861d Add -ecdh_single option.
Add -ecdh_single option to set SSL_OP_SINGLE_ECDH_USE on the command line.
2013-11-01 21:35:00 +00:00
Robin Seggelmann
9fb523adce DTLS/SCTP Finished Auth Bug
PR: 2808

With DTLS/SCTP the SCTP extension SCTP-AUTH is used to protect DATA and
FORWARD-TSN chunks. The key for this extension is derived from the
master secret and changed with the next ChangeCipherSpec, whenever a new
key has been negotiated. The following Finished then already uses the
new key.  Unfortunately, the ChangeCipherSpec and Finished are part of
the same flight as the ClientKeyExchange, which is necessary for the
computation of the new secret. Hence, these messages are sent
immediately following each other, leaving the server very little time to
compute the new secret and pass it to SCTP before the finished arrives.
So the Finished is likely to be discarded by SCTP and a retransmission
becomes necessary. To prevent this issue, the Finished of the client is
still sent with the old key.
2013-10-30 14:37:22 +00:00
Ben Laurie
cecf4d98d0 Remove unused variable. 2013-10-21 03:34:00 +01:00
Nick Mathewson
070e40e2f5 Fix another gmt_unix_time case in server_random 2013-10-20 15:08:58 -07:00
Nick Mathewson
d757097bbc Do not include a timestamp in the Client/ServerHello Random field.
Instead, send random bytes, unless SSL_SEND_{CLIENT,SERVER}RANDOM_MODE
is set.

This is a forward-port of commits:
  4af793036f
  f4c93b46ed
  3da721dac9
  2583270191

While the gmt_unix_time record was added in an ostensible attempt to
mitigate the dangers of a bad RNG, its presence leaks the host's view
of the current time in the clear.  This minor leak can help
fingerprint TLS instances across networks and protocols... and what's
worse, it's doubtful thet the gmt_unix_time record does any good at
all for its intended purpose, since:

    * It's quite possible to open two TLS connections in one second.

    * If the PRNG output is prone to repeat itself, ephemeral
      handshakes (and who knows what else besides) are broken.
2013-10-20 15:03:24 -07:00
Dr. Stephen Henson
3495842bb0 Prevent use of RSA+MD5 in TLS 1.2 by default.
Removing RSA+MD5 from the default signature algorithm list
prevents its use by default.

If a broken implementation attempts to use RSA+MD5 anyway the sanity
checking of signature algorithms will cause a fatal alert.
(cherry picked from commit 77a0f740d00ecf8f6b01c0685a2f858c3f65a3dd)
2013-10-20 22:07:33 +01:00
Dr. Stephen Henson
3a55a42bff Add brainpool curves to NID table too.
(cherry picked from commit 6699cb8491)
2013-10-15 12:09:54 +01:00
Dr. Stephen Henson
469bcb0c24 RFC7027 (Brainpool for TLS) support.
(cherry picked from commit 695e8c36528f9c3275f5f56e9633ac6a0c11f2e3)
2013-10-15 11:33:58 +01:00
Ben Laurie
3a8b23bfd9 Re-add accidentally deleted #endif. 2013-10-01 12:34:44 +01:00
Ben Laurie
63fe322160 Merge remote-tracking branch 'agl/1.0.2alpn' into agl-alpn
Conflicts:
	ssl/ssl3.h
	ssl/t1_lib.c
2013-10-01 12:20:02 +01:00
Ben Laurie
379f21ce5c Show useful errors. 2013-09-24 23:13:22 +01:00
Ben Laurie
4f8a706dc7 Merge remote-tracking branch 'trevp/pemfix' into trev-pem-fix 2013-09-20 15:39:08 -07:00
Dr. Stephen Henson
1dfb1b103c DTLS version usage fixes.
Make DTLS behave like TLS when negotiating version: record layer has
DTLS 1.0, message version is 1.2.

Tolerate different version numbers if version hasn't been negotiated
yet.
(cherry picked from commit 40088d8b81)
2013-09-18 13:47:05 +01:00
Dr. Stephen Henson
6e1987ca1d DTLS trace support.
Add DTLS record header parsing, different client hello format and add
HelloVerifyRequest message type.

Add code to d1_pkt.c to send message headers to the message callback.
(cherry picked from commit 890f2f8b92)

Conflicts:

	ssl/ssl_locl.h
2013-09-18 13:46:03 +01:00
Dr. Stephen Henson
d307176931 Suite B support for DTLS 1.2
Check for Suite B support using method flags instead of version numbers:
anything supporting TLS 1.2 cipher suites will also support Suite B.

Return an error if an attempt to use DTLS 1.0 is made in Suite B mode.
(cherry picked from commit 4544f0a691)
2013-09-18 13:46:03 +01:00
Dr. Stephen Henson
c391a74266 Always return errors in ssl3_get_client_hello
If we successfully match a cookie don't set return value to 2 as this
results in other error conditions returning 2 as well.

Instead set return value to -2 which can be checked later if everything
else is OK.
(cherry picked from commit c56f5b8edf)
2013-09-18 13:46:02 +01:00
Dr. Stephen Henson
65a87d3cc3 Dual DTLS version methods.
Add new methods DTLS_*_method() which support both DTLS 1.0 and DTLS 1.2 and
pick the highest version the peer supports during negotiation.

As with SSL/TLS options can change this behaviour specifically
SSL_OP_NO_DTLSv1 and SSL_OP_NO_DTLSv1_2.
(cherry picked from commit c6913eeb76)

Conflicts:

	CHANGES
2013-09-18 13:46:02 +01:00
Dr. Stephen Henson
b60b9e7afe Enable TLS 1.2 ciphers in DTLS 1.2.
Port TLS 1.2 GCM code to DTLS. Enable use of TLS 1.2 only ciphers when in
DTLS 1.2 mode too.
(cherry picked from commit 4221c0dd30)
2013-09-18 13:46:02 +01:00
Dr. Stephen Henson
919834dc84 Update fixed DH requirements.
The relaxed signing requirements for fixed DH certificates apply to DTLS 1.2
too.
(cherry picked from commit fbbaaccaca)
2013-09-18 13:46:02 +01:00
Dr. Stephen Henson
efc17286f8 DTLS 1.2 cached record support.
Add DTLS1.2 support for cached records when computing handshake macs
instead of the MD5+SHA1 case for DTLS < 1.2 (this is a port of the
equivalent TLS 1.2 code to DTLS).
(cherry picked from commit 04fac50045)
2013-09-18 13:46:02 +01:00
Dr. Stephen Henson
acec5a6244 Provisional DTLS 1.2 support.
Add correct flags for DTLS 1.2, update s_server and s_client to handle
DTLS 1.2 methods.

Currently no support for version negotiation: i.e. if client/server selects
DTLS 1.2 it is that or nothing.
(cherry picked from commit c3b344e36a)

Conflicts:

	apps/s_server.c
2013-09-18 13:46:02 +01:00
Dr. Stephen Henson
68039af3e7 Remove versions test from dtls1_buffer_message
Since this is always called from DTLS code it is safe to assume the header
length should be the DTLS value. This avoids the need to check the version
number and should work with any version of DTLS (not just 1.0).
(cherry picked from commit 9cf0f18754)
2013-09-18 13:46:02 +01:00
Dr. Stephen Henson
da1247d653 Extend DTLS method macros.
Extend DTLS method creation macros to support version numbers and encryption
methods. Update existing code.
(cherry picked from commit cfd298b7ae)
2013-09-18 13:46:02 +01:00
Dr. Stephen Henson
052d0358f2 Enable various DTLS extensions.
Some TLS extensions were disabled for DTLS. Possibly because they caused
problems with the old duplicated code. Enable them again.
(cherry picked from commit 874a18cfad)
2013-09-18 13:46:02 +01:00
Dr. Stephen Henson
1b6ab411d3 Use enc_flags when deciding protocol variations.
Use the enc_flags field to determine whether we should use explicit IV,
signature algorithms or SHA256 default PRF instead of hard coding which
versions support each requirement.
(cherry picked from commit cbd64894ec)

Conflicts:

	ssl/ssl_locl.h
2013-09-18 13:46:02 +01:00
Dr. Stephen Henson
d88d98edd3 Use appropriate versions of SSL3_ENC_METHOD
(cherry picked from commit 6de2649a6b)
2013-09-18 13:46:02 +01:00
Dr. Stephen Henson
741c9959f6 DTLS revision.
Revise DTLS code. There was a *lot* of code duplication in the
DTLS code that generates records. This makes it harder to maintain and
sometimes a TLS update is omitted by accident from the DTLS code.

Specifically almost all of the record generation functions have code like
this:

some_pointer = buffer + HANDSHAKE_HEADER_LENGTH;
... Record creation stuff ...
set_handshake_header(ssl, SSL_MT_SOMETHING, message_len);

...

write_handshake_message(ssl);

Where the "Record creation stuff" is identical between SSL/TLS and DTLS or
in some cases has very minor differences.

By adding a few fields to SSL3_ENC to include the header length, some flags
and function pointers for handshake header setting and handshake writing the
code can cope with both cases.

(cherry picked from commit 173e72e64c)
2013-09-18 13:46:02 +01:00
Trevor Perrin
6da498991c Various custom extension fixes.
Force no SSL2 when custom extensions in use.
Don't clear extension state when cert is set.
Clear on renegotiate.

Conflicts:
	ssl/t1_lib.c
2013-09-16 18:40:53 +01:00
Rob Stradling
9409e18179 Tidy up comments. 2013-09-16 14:03:21 +01:00
Rob Stradling
6a0b803fc0 Use TLS version supplied by client when fingerprinting Safari. 2013-09-16 14:03:21 +01:00
Rob Stradling
5fa3b54788 Fix compilation with no-ec and/or no-tlsext. 2013-09-16 14:03:21 +01:00
Rob Stradling
07df5018be Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X.
OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
2013-09-16 14:03:21 +01:00
Dr. Stephen Henson
a41735288c Add missing code from SSL_CONF backport. 2013-09-14 13:53:44 +01:00
Adam Langley
cb3cec4adf Add tests for ALPN functionality.
Cherry-picked from a898936218.
2013-09-13 11:27:26 -04:00
Adam Langley
b0d6f3c58f Support ALPN.
This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF
blessed version of NPN and we'll be supporting both ALPN and NPN for
some time yet.

Cherry-picked from 6f017a8f9d.

[1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00
2013-09-13 11:27:22 -04:00
Dr. Stephen Henson
5b430cfc44 Make no-ec compilation work.
(cherry picked from commit 14536c8c9c)
2013-08-19 14:13:38 +01:00
Dr. Stephen Henson
5085e57fb5 Return 1 when setting ECDH auto mode.
(cherry picked from commit 42082eda6f)
2013-08-18 13:53:00 +01:00
Michael Tuexen
75b81247a0 DTLS message_sequence number wrong in rehandshake ServerHello
This fix ensures that
* A HelloRequest is retransmitted if not responded by a ClientHello
* The HelloRequest "consumes" the sequence number 0. The subsequent
ServerHello uses the sequence number 1.
* The client also expects the sequence number of the ServerHello to
be 1 if a HelloRequest was received earlier.
This patch fixes the RFC violation.
(cherry picked from commit b62f4daac0)
2013-08-13 18:55:16 +01:00
Michael Tuexen
2c1a5c1039 DTLS handshake fix.
Reported by: Prashant Jaikumar <rmstar@gmail.com>

Fix handling of application data received before a handshake.
(cherry picked from commit 0c75eeacd3)
2013-08-08 13:31:54 +01:00
Trevor
355a6236be Cosmetic touchups. 2013-07-31 16:38:43 +01:00
Trevor
e27711cfdd Trying cherrypick:
Add support for arbitrary TLS extensions.

Contributed by Trevor Perrin.

Conflicts:

	CHANGES
	ssl/ssl.h
	ssl/ssltest.c
	test/testssl

Fix compilation due to #endif.

Cherrypicking more stuff.

Cleanup of custom extension stuff.

serverinfo rejects non-empty extensions.

Omit extension if no relevant serverinfo data.

Improve error-handling in serverinfo callback.

Cosmetic cleanups.

s_client documentation.

s_server documentation.

SSL_CTX_serverinfo documentation.

Cleaup -1 and NULL callback handling for custom extensions, add tests.

Cleanup ssl_rsa.c serverinfo code.

Whitespace cleanup.

Improve comments in ssl.h for serverinfo.

Whitespace.

Cosmetic cleanup.

Reject non-zero-len serverinfo extensions.

Whitespace.

Make it build.

Conflicts:

	test/testssl
2013-07-03 11:53:30 +01:00
Ben Laurie
01bc7dcafc Header needed for SOCK_STREAM on FreeBSD. 2013-06-04 16:27:05 +01:00
Ben Laurie
83e2ff8c51 Fix missing/incorrect prototype. 2013-06-04 16:17:30 +01:00
Andy Polyakov
e815d72b1f RFC6689 support: add missing commit (git noob alert). 2013-05-15 20:41:51 +02:00
Andy Polyakov
ddf918673d ssl/dnssec.c: compilation errors. 2013-05-15 20:38:58 +02:00
Andy Polyakov
8517d0c00d Initial support for RFC6689, a.k.a. DANE.
Note that it initially applies to 1.0.2, and not to HEAD. This is
in order to allow development with existing libunbound installations
that are dependent on OpenSSL 1.0.x. More details in RT.

RT: 3003
2013-05-13 15:36:06 +02:00
Dr. Stephen Henson
e9a3aa9721 Set s->d1 to NULL after freeing it.
(cherry picked from commit 04638f2fc3)
2013-04-08 18:39:52 +01:00
Dr. Stephen Henson
e14b8410ca Disable compression for DTLS.
The only standard compression method is stateful and is incompatible with
DTLS.
2013-03-19 13:46:57 +00:00
Michael Tuexen
3f84d34c37 Avoid unnecessary fragmentation.
(cherry picked from commit 80ccc66d7e)
2013-03-18 14:32:59 +00:00
Dr. Stephen Henson
3c53fd892c Fix error codes.
(cherry picked from commit 388aff08dc)
2013-02-26 17:05:39 +00:00
David Woodhouse
3a3a1af1da Check DTLS_BAD_VER for version number.
The version check for DTLS1_VERSION was redundant as
DTLS1_VERSION > TLS1_1_VERSION, however we do need to
check for DTLS1_BAD_VER for compatibility.

PR:2984
(cherry picked from commit d980abb22e)
2013-02-12 15:15:32 +00:00
Dr. Stephen Henson
0ced72c608 Fix in ssltest is no-ssl2 configured
(cherry picked from commit cbf9b4aed3)
2013-02-11 18:28:48 +00:00
Andy Polyakov
919eab8a8b s3_cbc.c: make CBC_MAC_ROTATE_IN_PLACE universal.
(cherry picked from commit f93a41877d)
2013-02-08 21:36:06 +01:00
Andy Polyakov
e9baceab5a s3_cbc.c: get rid of expensive divisions [from master]. 2013-02-08 16:59:26 +01:00
Andy Polyakov
b05561c4b7 ssl/[d1|s3]_pkt.c: harmomize orig_len handling.
(cherry picked from commit 8545f73b89)
2013-02-08 10:40:51 +01:00
Dr. Stephen Henson
b7355af421 Fix IV check and padding removal.
Fix the calculation that checks there is enough room in a record
after removing padding and optional explicit IV. (by Steve)

For AEAD remove the correct number of padding bytes (by Andy)
(cherry picked from commit 32cc2479b4)
2013-02-08 10:40:39 +01:00
Adam Langley
0462eedf5e Fix for EXP-RC2-CBC-MD5
MD5 should use little endian order. Fortunately the only ciphersuite
affected is EXP-RC2-CBC-MD5 (TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5) which
is a rarely used export grade ciphersuite.
(cherry picked from commit f306b87d76)
2013-02-08 10:40:13 +01:00
Andy Polyakov
5966f4d973 e_aes_cbc_hmac_sha1.c: address the CBC decrypt timing issues.
Address CBC decrypt timing issues and reenable the AESNI+SHA1 stitch.
(cherry picked from commit 125093b59f)
2013-02-06 13:56:15 +00:00
Andy Polyakov
eeb486a5f4 ssl/*: remove SSL3_RECORD->orig_len to restore binary compatibility.
Kludge alert. This is arranged by passing padding length in unused
bits of SSL3_RECORD->type, so that orig_len can be reconstructed.
(cherry picked from commit 8bfd4c659f)
2013-02-06 13:56:15 +00:00
Dr. Stephen Henson
d7f55e76f2 Don't access EVP_MD_CTX internals directly.
(cherry picked from commit 04e45b52ee)
2013-02-06 13:56:14 +00:00
Andy Polyakov
7d9e781a1d s3/s3_cbc.c: allow for compilations with NO_SHA256|512.
(cherry picked from commit d5371324d9)
2013-02-06 13:56:14 +00:00
Andy Polyakov
e0c21a0b6b ssl/s3_cbc.c: md_state alignment portability fix.
RISCs are picky and alignment granted by compiler for md_state can be
insufficient for SHA512.
(cherry picked from commit 36260233e7)
2013-02-06 13:56:14 +00:00
Andy Polyakov
1dfb4b9400 ssl/s3_cbc.c: uint64_t portability fix.
Break dependency on uint64_t. It's possible to declare bits as
unsigned int, because TLS packets are limited in size and 32-bit
value can't overflow.
(cherry picked from commit cab13fc847)
2013-02-06 13:56:14 +00:00
Dr. Stephen Henson
e5cb774323 typo.
(cherry picked from commit 34ab3c8c71)
2013-02-06 13:56:14 +00:00
Dr. Stephen Henson
d91d9acc58 Timing fix mitigation for FIPS mode.
We have to use EVP in FIPS mode so we can only partially mitigate
timing differences.

Make an extra call to EVP_DigestSignUpdate to hash additonal blocks
to cover any timing differences caused by removal of padding.
(cherry picked from commit b908e88ec1)
2013-02-06 13:56:13 +00:00
Ben Laurie
820988a0c0 Oops. Add missing file.
(cherry picked from commit 014265eb02)
2013-02-06 13:56:13 +00:00
Ben Laurie
1326a64a33 Update DTLS code to match CBC decoding in TLS.
This change updates the DTLS code to match the constant-time CBC
behaviour in the TLS.
(cherry picked from commit 9f27de170d)
2013-02-06 13:56:13 +00:00
Ben Laurie
e0da2c2ed2 Don't crash when processing a zero-length, TLS >= 1.1 record.
The previous CBC patch was bugged in that there was a path through enc()
in s3_pkt.c/d1_pkt.c which didn't set orig_len. orig_len would be left
at the previous value which could suggest that the packet was a
sufficient length when it wasn't.
(cherry picked from commit 6cb19b7681)
2013-02-06 13:56:13 +00:00
Ben Laurie
fb0a59cc58 Make CBC decoding constant time.
This patch makes the decoding of SSLv3 and TLS CBC records constant
time. Without this, a timing side-channel can be used to build a padding
oracle and mount Vaudenay's attack.

This patch also disables the stitched AESNI+SHA mode pending a similar
fix to that code.

In order to be easy to backport, this change is implemented in ssl/,
rather than as a generic AEAD mode. In the future this should be changed
around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
(cherry picked from commit e130841bcc)
2013-02-06 13:56:12 +00:00
Ben Laurie
f5cd3561ba Add and use a constant-time memcmp.
This change adds CRYPTO_memcmp, which compares two vectors of bytes in
an amount of time that's independent of their contents. It also changes
several MAC compares in the code to use this over the standard memcmp,
which may leak information about the size of a matching prefix.
(cherry picked from commit 2ee798880a)
2013-02-06 13:56:12 +00:00
Dr. Stephen Henson
c867d87180 Fix for trace code: SSL3 doesn't include a length value for
encrypted premaster secret value.
(cherry picked from commit ea34a58385)
2013-02-04 15:14:00 +00:00
Dr. Stephen Henson
f8435919a1 Fix warning: lenmax isn't used any more. 2013-01-24 14:08:28 +00:00
Ben Laurie
92745f8116 Remove extraneous brackets (clang doesn't like them). 2013-01-19 18:24:00 +00:00
Ben Laurie
9ccc6f4382 Can't check a size_t for < 0. 2013-01-19 15:01:18 +00:00
Dr. Stephen Henson
75a8ff9263 make update 2013-01-15 16:24:07 +00:00
Dr. Stephen Henson
50b5966e57 Add support for broken protocol tests (backport from master branch) 2013-01-15 16:18:13 +00:00
Dr. Stephen Henson
8eb4456f93 Make whitespace consistent with master branch. 2013-01-15 15:55:54 +00:00
Dr. Stephen Henson
2e00f46b51 stop warning when compiling with no-comp 2012-12-30 01:12:19 +00:00
Dr. Stephen Henson
49ef33fa34 add SSL_CONF functions and documentation (backport from HEAD) 2012-12-29 13:30:56 +00:00
Dr. Stephen Henson
bc200e691c SSL/TLS record tracing code (backport from HEAD). 2012-12-26 22:40:46 +00:00
Dr. Stephen Henson
a08f8d73cc Reject zero length ec point format list.
Give more meaningful error is attempt made to use incorrect curve.

(from HEAD)
2012-12-26 18:26:11 +00:00
Dr. Stephen Henson
b52f12b3ba handle point format list retrieval for clients too (from HEAD) 2012-12-26 18:20:07 +00:00
Dr. Stephen Henson
78b5d89ddf Add support for printing out and retrieving EC point formats extension.
(backport from HEAD)
2012-12-26 18:13:49 +00:00
Dr. Stephen Henson
b79df62eff return error if Suite B mode is selected and TLS 1.2 can't be used.
(backport from HEAD)
2012-12-26 17:39:02 +00:00
Dr. Stephen Henson
e3c76874ad set auto ecdh parameter selction for Suite B
(backport from HEAD)
2012-12-26 17:35:02 +00:00
Dr. Stephen Henson
4347394a27 add Suite B 128 bit mode offering only combination 2
(backport from HEAD)
2012-12-26 17:34:50 +00:00
Dr. Stephen Henson
53bb723834 Use client version when deciding which cipher suites to disable.
(backport from HEAD)
2012-12-26 17:09:39 +00:00
Dr. Stephen Henson
684a2264c5 Use default point formats extension for server side as well as client
side, if possible.

Don't advertise compressed char2 for SuiteB as it is not supported.
(backport from HEAD)
2012-12-26 17:09:14 +00:00
Dr. Stephen Henson
1520e6c084 Add ctrl and utility functions to retrieve raw cipher list sent by client in
client hello message. Previously this could only be retrieved on an initial
connection and it was impossible to determine the cipher IDs of any uknown
ciphersuites.
(backport from HEAD)
2012-12-26 16:25:06 +00:00
Dr. Stephen Henson
2001129f09 new ctrl to retrive value of received temporary key in server key exchange message, print out details in s_client
(backport from HEAD)
2012-12-26 16:23:36 +00:00
Dr. Stephen Henson
a50ecaee56 store and print out message digest peer signed with in TLS 1.2
(backport from HEAD)
2012-12-26 16:23:13 +00:00
Dr. Stephen Henson
67d9dcf003 perform sanity checks on server certificate type as soon as it is received instead of waiting until server key exchange
(backport from HEAD)
2012-12-26 16:22:19 +00:00
Dr. Stephen Henson
79dcae32ef give more meaningful error if presented with wrong certificate type by server
(backport from HEAD)
2012-12-26 16:18:15 +00:00
Dr. Stephen Henson
ccf6a19e2d Add three Suite B modes to TLS code, supporting RFC6460.
(backport from HEAD)
2012-12-26 16:17:40 +00:00
Dr. Stephen Henson
8d2dbe6ac0 New function X509_chain_up_ref to dup and up the reference count of
a STACK_OF(X509): replace equivalent functionality in several places
by the equivalent call.
(backport from HEAD)
2012-12-26 16:04:03 +00:00
Dr. Stephen Henson
6660baee66 Make tls1_check_chain return a set of flags indicating checks passed
by a certificate chain. Add additional tests to handle client
certificates: checks for matching certificate type and issuer name
comparison.

Print out results of checks for each candidate chain tested in
s_server/s_client.
(backport from HEAD)
2012-12-26 15:27:44 +00:00
Dr. Stephen Henson
25d4c9254c Abort handshake if signature algorithm used not supported by peer.
(backport from HEAD)
2012-12-26 15:27:24 +00:00
Dr. Stephen Henson
44adfeb6c0 check EC tmp key matches preferences
(backport from HEAD)
2012-12-26 15:27:04 +00:00
Dr. Stephen Henson
5ff2ef79e6 typo 2012-12-26 15:23:16 +00:00
Dr. Stephen Henson
b762acadeb Add support for certificate stores in CERT structure. This makes it
possible to have different stores per SSL structure or one store in
the parent SSL_CTX. Include distint stores for certificate chain
verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN
to build and store a certificate chain in CERT structure: returing
an error if the chain cannot be built: this will allow applications
to test if a chain is correctly configured.

Note: if the CERT based stores are not set then the parent SSL_CTX
store is used to retain compatibility with existing behaviour.
(backport from HEAD)
2012-12-26 15:21:53 +00:00
Dr. Stephen Henson
7d779eefb4 add ssl_locl.h to err header files, rebuild ssl error strings
(backport from HEAD)
2012-12-26 15:09:16 +00:00
Dr. Stephen Henson
35b7757f9b set ciphers to NULL before calling cert_cb
(backport from HEAD)
2012-12-26 14:56:40 +00:00
Dr. Stephen Henson
23195e4dcc stop warning
(backport from HEAD)
2012-12-26 14:56:27 +00:00
Dr. Stephen Henson
b28fbdfa7d New function ssl_set_client_disabled to set masks for any ciphersuites
that are disabled for this session (as opposed to always disabled by
configuration).
(backport from HEAD)
2012-12-26 14:55:46 +00:00
Dr. Stephen Henson
a897502cd9 Add new ctrl to retrieve client certificate types, print out
details in s_client.

Also add ctrl to set client certificate types. If not used sensible values
will be included based on supported signature algorithms: for example if
we don't include any DSA signing algorithms the DSA certificate type is
omitted.

Fix restriction in old code where certificate types would be truncated
if it exceeded TLS_CT_NUMBER.
(backport from HEAD)
2012-12-26 14:51:37 +00:00
Dr. Stephen Henson
731abd3bd7 new function SSL_is_server to which returns 1 is the corresponding SSL context is for a server
(backport from HEAD)
2012-12-26 14:45:46 +00:00
Dr. Stephen Henson
7531dd18dc no need to check s->server as default_nid is never used for TLS 1.2 client authentication
(backport from HEAD)
2012-12-26 14:45:27 +00:00
Dr. Stephen Henson
04c32cddaa Separate client and server permitted signature algorithm support: by default
the permitted signature algorithms for server and client authentication
are the same but it is now possible to set different algorithms for client
authentication only.
(backport from HEAD)
2012-12-26 14:44:56 +00:00
Dr. Stephen Henson
623a5e24cb Add certificate callback. If set this is called whenever a certificate
is required by client or server. An application can decide which
certificate chain to present based on arbitrary criteria: for example
supported signature algorithms. Add very simple example to s_server.
This fixes many of the problems and restrictions of the existing client
certificate callback: for example you can now clear existing certificates
and specify the whole chain.
(backport from HEAD)
2012-12-26 14:43:51 +00:00
Dr. Stephen Henson
c550f2e37b Function tls1_check_ec_server_key is now redundant as we make
appropriate checks in tls1_check_chain.
(backport from HEAD)
2012-12-26 14:27:27 +00:00
Dr. Stephen Henson
484f876235 Add new "valid_flags" field to CERT_PKEY structure which determines what
the certificate can be used for (if anything). Set valid_flags field
in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
to have similar checks in it.

Add new "cert_flags" field to CERT structure and include a "strict mode".
This enforces some TLS certificate requirements (such as only permitting
certificate signature algorithms contained in the supported algorithms
extension) which some implementations ignore: this option should be used
with caution as it could cause interoperability issues.
(backport from HEAD)
2012-12-26 14:26:53 +00:00
Dr. Stephen Henson
c70a1fee71 Reorganise supported signature algorithm extension processing.
Only store encoded versions of peer and configured signature algorithms.
Determine shared signature algorithms and cache the result along with NID
equivalents of each algorithm.
(backport from HEAD)
2012-12-26 14:26:16 +00:00
Dr. Stephen Henson
0b362de5f5 Add support for application defined signature algorithms for use with
TLS v1.2. These are sent as an extension for clients and during a certificate
request for servers.

TODO: add support for shared signature algorithms, respect shared algorithms
when deciding which ciphersuites and certificates to permit.
(backport from HEAD)
2012-12-26 14:25:29 +00:00
Dr. Stephen Henson
d312f7be37 Make it possible to delete all certificates from an SSL structure.
(backport from HEAD)
2012-12-26 14:18:50 +00:00
Dr. Stephen Henson
e6b650df0a oops, revert 2012-12-20 19:01:34 +00:00
Dr. Stephen Henson
7b7b667ddc apps/ocsp.c 2012-12-20 18:59:09 +00:00
Dr. Stephen Henson
e08c7f15b4 change inaccurate error message 2012-11-26 15:47:44 +00:00
Dr. Stephen Henson
7469af4484 reject zero length point format list or supported curves extensions 2012-11-22 14:15:36 +00:00
Dr. Stephen Henson
6f539399ef add "missing" TLSv1.2 cipher alias 2012-11-15 19:15:07 +00:00
Richard Levitte
451cec33df * ssl/t1_enc.c (tls1_change_cipher_state): Stupid bug. Fortunately in
debugging code that's seldom used.
2012-09-21 13:08:30 +00:00
Dr. Stephen Henson
dc14441757 Minor enhancement to PR#2836 fix. Instead of modifying SSL_get_certificate
change the current certificate (in s->cert->key) to the one used and then
SSL_get_certificate and SSL_get_privatekey will automatically work.
2012-09-11 13:35:14 +00:00
Ben Laurie
da8512aaff Call OCSP Stapling callback after ciphersuite has been chosen, so the
right response is stapled. Also change SSL_get_certificate() so it
returns the certificate actually sent.  See
http://rt.openssl.org/Ticket/Display.html?id=2836.
2012-09-11 12:00:25 +00:00
Dr. Stephen Henson
ccffdb3fdc revert unrelated test code 2012-07-03 20:21:35 +00:00
Dr. Stephen Henson
74d89b0d93 PR: 2840
Reported by: David McCullough <david_mccullough@mcafee.com>

Restore fips configuration module from 0.9.8.
2012-07-03 20:20:11 +00:00
Dr. Stephen Henson
a240ea8ab8 don't use pseudo digests for default values of keys 2012-06-27 14:12:01 +00:00
Ben Laurie
3c56d65a41 Fix memory leak. 2012-06-11 09:23:38 +00:00
Ben Laurie
835d104f46 Rearrange and test authz extension. 2012-06-07 13:20:20 +00:00
Ben Laurie
aeba1ef352 Fix memory leak. 2012-06-06 12:58:35 +00:00
Ben Laurie
49e9f751a4 Fix authz parsing. 2012-06-06 12:45:14 +00:00
Ben Laurie
ff46820da6 Version skew reduction. 2012-06-06 12:41:46 +00:00
Ben Laurie
68d2cf51bc Reduce version skew: trivia (I hope). 2012-06-03 22:03:37 +00:00
Ben Laurie
19eedffcaf Don't insert in the middle. 2012-05-29 18:58:43 +00:00
Ben Laurie
8a02a46a5c RFC 5878 support. 2012-05-29 17:27:48 +00:00
Andy Polyakov
4d321e0767 s2_clnt.c: compensate for compiler bug [from HEAD]. 2012-05-16 18:22:15 +00:00
Dr. Stephen Henson
5e145e54cc PR: 2811
Reported by: Phil Pennock <openssl-dev@spodhuis.org>

Make renegotiation work for TLS 1.2, 1.1 by not using a lower record
version client hello workaround if renegotiating.
2012-05-11 13:33:34 +00:00
Dr. Stephen Henson
df73e68a43 PR: 2806
Submitted by: PK <runningdoglackey@yahoo.com>

Correct ciphersuite signature algorithm definitions.
2012-05-10 18:25:31 +00:00
Dr. Stephen Henson
e7c8483891 Sanity check record length before skipping explicit IV in TLS 1.2, 1.1 and
DTLS to fix DoS attack.

Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
fuzzing as a service testing platform.
(CVE-2012-2333)
2012-05-10 16:03:36 +00:00