Commit graph

23339 commits

Author SHA1 Message Date
Matt Caswell
f807ad17f3 Disallow Ed448 signature malleability
Check that s is less than the order before attempting to verify the
signature as per RFC8032 5.2.7

Fixes #7706

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/7748)

(cherry picked from commit 08afd2f37a)
2018-12-11 11:58:40 +00:00
Eneas U de Queiroz
488521d77f eng_devcrypto: make sure digest can do copy
Digest must be able to do partial-state copy to be used.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit 16e252a01b)
2018-12-10 13:22:14 +01:00
Eneas U de Queiroz
2887a5c8f9 eng_devcrypto: fix ctr mode
Make CTR mode behave like a stream cipher.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit b5015e834a)
2018-12-10 13:22:14 +01:00
Eneas U de Queiroz
a19d1a1d37 eng_devcrypto: add cipher CTX copy function
The engine needs a custom cipher context copy function to open a new
/dev/crypto session.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit 6d99e23839)
2018-12-10 13:22:14 +01:00
Eneas U de Queiroz
5378c582c8 eng_devcrypto: close session on cleanup, not final
Close the session in digest_cleanup instead of digest_final.  A failure
in closing the session does not mean a previous successful digest final
has failed as well.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit a67203a19d)
2018-12-10 13:22:14 +01:00
Eneas U de Queiroz
68b02a8ab7 eng_devcrypto: fix copy of unitilialized digest
If the source ctx has not been initialized, don't initialize the copy
either.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit ae8183690f)
2018-12-10 13:22:14 +01:00
Eneas U de Queiroz
add2ab1f28 eng_devcrypto: expand digest failure cases
Return failure when the digest_ctx is null in digest_update and
digest_final, and when md is null in digest_final.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit 4d9f996544)
2018-12-10 13:22:14 +01:00
Eneas U de Queiroz
be5cf61caa eng_devcrypto: don't leak methods tables
Call functions to prepare methods after confirming that /dev/crytpo was
sucessfully open and that the destroy function has been set.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit d9d4dff5c6)
2018-12-10 13:22:14 +01:00
Eneas U de Queiroz
72b8228a9c INSTALL: add note about devcrypto engine
Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7585)

(cherry picked from commit eb3fe0ee54)
2018-12-10 13:22:13 +01:00
Matt Caswell
23abea6307 Document the num_tickets s_server option
Fixes #7727

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7756)

(cherry picked from commit 7ffb7fbe8c)
2018-12-10 11:13:44 +00:00
Matt Caswell
ef97becf52 Preserve errno on dlopen
For the same reasons as in the previous commit we must preserve errno
across dlopen calls. Some implementations (e.g. solaris) do not preserve
errno even on a successful dlopen call.

Fixes #6953

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7680)

(cherry picked from commit 3cb4e7dc1c)
2018-12-10 10:22:05 +00:00
Matt Caswell
99992ad220 Make sure build_SYS_str_reasons() preserves errno
This function can end up being called during ERR_get_error() if we are
initialising. ERR_get_error() must preserve errno since it gets called via
SSL_get_error(). If that function returns SSL_ERROR_SYSCALL then you are
supposed to inspect errno.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7680)

(cherry picked from commit 71b1ceffc4)
2018-12-10 10:22:05 +00:00
Richard Levitte
4bd0db1fea make update
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7852)

(cherry picked from commit f2f734d4f9)
2018-12-10 10:08:32 +01:00
Richard Levitte
fa75ee1aec Prevent calling decryption in an encryption context and vice versa
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7852)

(cherry picked from commit a8bf2f8f24)
2018-12-10 10:08:32 +01:00
Andy Polyakov
3c1b856236 err/err.c: improve err_clear_last_constant_time's portability.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7850)

(cherry picked from commit 91d0fd1c27)
2018-12-08 12:35:45 +01:00
Richard Levitte
673273c43e Make EVP_PKEY_asn1_add0() stricter about its input
It turns out that the strictness that was implemented in
EVP_PKEY_asn1_new() (see Github openssl/openssl#6880) was badly placed
for some usages, and that it's better to do this check only when the
method is getting registered.

Fixes #7758

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7847)

(cherry picked from commit a860031621)
2018-12-07 11:59:11 +01:00
FdaSilvaYY
deab38a463 Doc: fix reference to deprecated methods.
Reviewed-by: Paul Yang <yang.yang@baishancloud.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7705)

(cherry picked from commit 56bc3ea0a4)
2018-12-07 09:02:16 +01:00
Dr. Matthias St. Pierre
9478b1a095 curve25519.c: improve formula alignment
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7750)

(cherry picked from commit 425dde5d75)
2018-12-06 20:55:00 +01:00
Dr. Matthias St. Pierre
6a1ed7a321 curve25519.c: reformat code to follow coding guidelines
Fixes #7698

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7750)

(cherry picked from commit 3a17b9a46e)
2018-12-06 20:54:44 +01:00
Matt Caswell
db860ea3dc Fix some SSL_export_keying_material() issues
Fix some issues in tls13_hkdf_expand() which impact the above function
for TLSv1.3. In particular test that we can use the maximum label length
in TLSv1.3.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7755)

(cherry picked from commit 0fb2815b87)
2018-12-05 10:59:08 +00:00
Matt Caswell
56e0f123dc Revert "Reduce stack usage in tls13_hkdf_expand"
This reverts commit ec0c5f5693.

SSL_export_keying_material() may use longer label lengths.

Fixes #7712

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7755)

(cherry picked from commit ed371b8cba)
2018-12-05 10:59:08 +00:00
Andy Polyakov
8df98cd988 bn/bn_{div|shift}.c: introduce fixed-top interfaces.
Fixed-top interfaces tolerate zero-padded inputs and facilitate
constant-time-ness. bn_div_fixed_top tolerates zero-padded dividend,
but not divisor. It's argued that divisor's length is public even
when value is secret.

[extended tests]

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7589)

(cherry picked from commit 3a4a88f436)
2018-12-05 10:38:22 +00:00
Andy Polyakov
a7e8ab41fd bn/bn_div.c: make conditional addition unconditional
and add template for constant-time bn_div_3_words.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7589)

(cherry picked from commit 3da2e9c4ee)
2018-12-05 10:38:22 +00:00
Andy Polyakov
2007474f19 Configure: recognize div3w modules and add -DBN_DIV3W.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7589)

(cherry picked from commit 31703da3b8)
2018-12-05 10:38:22 +00:00
Andy Polyakov
9b2a219cae Configurations/10-main.conf: remove MIPS bn_div_3_words.
It's being replaced with constant-time alternative.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7589)

(cherry picked from commit b34446cca2)
2018-12-05 10:38:22 +00:00
Matt Caswell
cc4e37f1e4 Add an Ed25519 signature maleability test
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7697)

(cherry picked from commit e65a79d2aa)
2018-12-03 14:25:20 +00:00
Matt Caswell
f3243f2229 Disallow Ed25519 signature maleability
Check that s is less than the order before attempting to verify the
signature as per RFC8032 5.1.7

Fixes #7693

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7697)

(cherry picked from commit 0ac8f35c04)
2018-12-03 14:25:20 +00:00
Richard Levitte
2561eeb6b9 Docs fixup: some man3 pages had unindented code in SYNOPSIS
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7744)

(cherry picked from commit 7b4a3515a4)
2018-12-03 11:48:48 +01:00
Andy Polyakov
f1d91b8970 rsa/rsa_ssl.c: make RSA_padding_check_SSLv23 constant-time.
Copy of RSA_padding_check_PKCS1_type_2 with a twist that rejects padding
if nul delimiter is preceded by 8 consecutive 0x03 bytes.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 603221407d)
2018-11-30 12:51:58 +00:00
Andy Polyakov
f5ebe54c00 rsa/rsa_oaep.c: remove memcpy calls from RSA_padding_check_PKCS1_OAEP.
And make RSAErr call unconditional.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 75f5e944be)
2018-11-30 12:51:58 +00:00
Andy Polyakov
db1b63f45c rsa/rsa_pk1.c: remove memcpy calls from RSA_padding_check_PKCS1_type_2.
And make RSAErr call unconditional.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit e875b0cf2f)
2018-11-30 12:51:58 +00:00
Andy Polyakov
382448f337 rsa/rsa_ossl.c: make RSAerr call in rsa_ossl_private_decrypt unconditional.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 89072e0c2a)
2018-11-30 12:51:58 +00:00
Andy Polyakov
d2cd28b99e err/err.c: add err_clear_last_constant_time.
Expected usage pattern is to unconditionally set error and then
wipe it if there was no actual error.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit f658a3b64d)
2018-11-30 12:51:58 +00:00
Richard Levitte
89cb61de2a Don't test the collected system errors when configured to not have them
Config options 'no-err' and 'no-autoerrinit'

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7711)

(cherry picked from commit f1d49ed947)
2018-11-27 09:03:59 +00:00
Paul Yang
9465e71639 Fix access zero memory if SSL_DEBUG is enabled
If compile OpenSSL with SSL_DEBUG macro, some test cases will cause the
process crashed in the debug code.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7707)

(cherry picked from commit 5a4481f0e0)
2018-11-27 11:27:18 +08:00
Richard Levitte
156c4d6290 VMS build: don't forget the generation marker when removing files
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7703)

(cherry picked from commit f19d20b60f)
2018-11-27 03:12:10 +00:00
Richard Levitte
316fe11b0a VMS build: in descrip.mms.tmpl's src2obj, do .S -> .asm too
We only convert lowercase .s to .asm, that turned out not to be sufficient.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7703)

(cherry picked from commit c739e676eb)
2018-11-27 03:12:10 +00:00
Billy Brumley
37b07c68ef Clean up BN_consttime_swap.
Updated "condition" logic lifted from Theo Buehler's LibreSSL commit 517358603b

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/7619)

(cherry picked from commit 900fd8f375)
2018-11-26 17:54:08 +02:00
Richard Levitte
ca554c02df Avoid test_errstr in a cross compiled configuration
There's too high a chance that the openssl app and perl get different
messages for some error numbers.

[extended tests]

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7699)

(cherry picked from commit 0777de15ff)
2018-11-24 18:49:23 +01:00
Richard Levitte
97afd2b6b1 Have util/mktar.sh display the absolute path to the tarball
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7696)

(cherry picked from commit 3be389435f)
2018-11-24 18:43:54 +01:00
Richard Levitte
d4fd899968 Make sure to run util/mktar.sh from the source directory
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7696)

(cherry picked from commit b741f153b2)
2018-11-24 18:43:54 +01:00
Richard Levitte
105d4c0cdf Don't export the submodules 'boringssl', 'krb5' and 'pyca-cryptography'
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7696)

(cherry picked from commit 76bc401cc6)
2018-11-24 18:43:54 +01:00
Richard Levitte
a6d4cc8257 Don't export util/mktar.sh
When creating a tarball, it's pointless to include scripts that assume
a git workspace.

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7696)

(cherry picked from commit b9a6947179)
2018-11-24 18:43:54 +01:00
Richard Levitte
909ecd4f37 Document the removed 'dist' target
Also adds missing copyright boilerplate to util/mktar.sh

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/7696)

(cherry picked from commit b42922ea2f)
2018-11-24 18:43:49 +01:00
Richard Levitte
5f90d1b882 VMS config: Typo fix, as -> AS
This typo prevented ia64 assembler to be compiled on VMS

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7700)

(cherry picked from commit 04375857cf)
2018-11-24 18:37:16 +01:00
Richard Levitte
1119d4e7f4 VMS: fix collected error strings
It turns out that on VMS, strerror() returns messages with added
spaces at the end.

We wouldn't had noticed if it wasn't for perl trimming those spaces
off for its own sake and thereby having test/recipes/02-test_errstr.t
fail on VMS.

The safe fix is to do the same trimming ourselves.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7701)

(cherry picked from commit 9f15e5b911)
2018-11-24 17:43:30 +01:00
David Woodhouse
6aca8d1a5f Honour mandatory digest on private key in has_usable_cert()
If the private key says it can only support one specific digest, then
don't ask it to perform a different one.

Fixes: #7348

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>

(cherry picked from commit 2d263a4a73)

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7609)
2018-11-24 08:49:32 +02:00
David Woodhouse
abaa2311ad Stop marking default digest for EC keys as mandatory
ASN1_PKEY_CTRL_DEFAULT_MD_NID is documented to return 2 for a mandatory
digest algorithm, when the key can't support any others. That isn't true
here, so return 1 instead.

Partially fixes #7348

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>

(cherry picked from commit eb7eb1378c)

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7609)
2018-11-24 08:49:32 +02:00
Richard Levitte
415c4a4669 Remove all 'make dist' artifacts
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7692)

(cherry picked from commit 8d9535ec3e)
2018-11-23 12:42:21 +01:00
Richard Levitte
48c813ef3a Change tarball making procedure
Since recently, OpenSSL tarballs are produced with 'make tar' rather
than 'make dist', as the latter has turned out to be more troublesome
than useful.

The next step to look at is why we would need to configure at all to
produce a Makefile just to produce a tarball.  After all, the tarball
should now only contain source files that are present even without
configuring.

Furthermore, the current method for producing tarballs is a bit
complex, and can be greatly simplified with the right tools.  Since we
have everything versioned with git, we might as well use the tool that
comes with it.

Added: util/mktar.sh, a simple script to produce OpenSSL tarballs.  It
takes the options --name to modify the prefix of the distribution, and
--tarfile tp modify the tarball file name specifically.

This also adds a few entries in .gitattributes to specify files that
should never end up in a distribution tarball.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7692)

(cherry picked from commit 8c209eeef4)
2018-11-23 12:42:21 +01:00