- Mar 18, 2019
-
-
Daniel Axtens authored
There are two copy-paste errors in handling CTR mode. When dealing with a 2 or 3 block tail, the code branches to the CBC decryption exit path, rather than to the CTR exit path. This can lead to data corruption: in the Linux kernel we have a copy of this file, and the bug leads to corruption of the IV, which leads to data corruption when we call the encryption function again later to encrypt subsequent blocks. Originally reported to the Linux kernel by Ondrej Mosnáček <omosnacek@gmail.com> CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8510) (cherry picked from commit f643deac417a3ccb27f77670bb2b136de49079d9)
-
Shane Lontis authored
Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8508) (cherry picked from commit e2f5081116d8b3dadd602fcf611bc6584ab395f7)
-
- Mar 15, 2019
-
-
Dr. Matthias St. Pierre authored
Fixes #8487 Amends #7230 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8488) (cherry picked from commit 355417eb4611014767480e5d3e96b1b08eb02700)
-
- Mar 13, 2019
-
-
Nicola Tuveri authored
Fixes #8462 (cherry picked from commit 81d61a62faa809e6c51f5fc2b86fb0d31146fd5e) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8466)
-
Matt Caswell authored
Also make various changes to bring the file into line with current coding style. Fixes #8456 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/8457) (cherry picked from commit 81cd023f1dc5a8c9094f8e91c1e85e3c9b98a551)
-
- Mar 11, 2019
-
-
Shane Lontis authored
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8417) (cherry picked from commit 98f29466dc1ed7f80b9b8750309a41b5a1150d25)
-
- Mar 10, 2019
-
-
A. Schulze authored
CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8447) (cherry picked from commit 3dcbb6c4a395d56dfa561145d89017ff958bb18e)
-
- Mar 07, 2019
-
-
Bernd Edlinger authored
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8365) (cherry picked from commit f0e4a860)
-
Bernd Edlinger authored
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8365) (cherry picked from commit 049e64cbb08df1fbf256bb79e950e8d0959de091)
-
Bernd Edlinger authored
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8365) (cherry picked from commit ac6fff700a9799c25902165e2594fd46826f3ee3)
-
Bernd Edlinger authored
of RSA_private_decrypt/RSA_public_encrypt. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8365) (cherry picked from commit b89fdeb2)
-
Bernd Edlinger authored
Fixes #8364 and #8357 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8365) (cherry picked from commit d7f5e5ae)
-
Bernd Edlinger authored
Fixes #8416 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8428) (cherry picked from commit 596521f48826892ddd62322726f6f2a2a52db652)
-
Matt Caswell authored
The previous commit fixed an underflow that may occur in ecp_nistp521.c. This commit adds a test for that condition. It is heavily based on an original test harness by Billy Brumley. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8405) (cherry picked from commit 6855b496b205c067ecb276221c31c6212f4fdbae)
-
Matt Caswell authored
The function felem_diff_128_64 in ecp_nistp521.c substracts the number |in| from |out| mod p. In order to avoid underflow it first adds 32p mod p (which is equivalent to 0 mod p) to |out|. The comments and variable naming suggest that the original author intended to add 64p mod p. In fact it has been shown that with certain unusual co-ordinates it is possible to cause an underflow in this function when only adding 32p mod p while performing a point double operation. By changing this to 64p mod p the underflow is avoided. It turns out to be quite difficult to construct points that satisfy the underflow criteria although this has been done and the underflow demonstrated. However none of these points are actually on the curve. Finding points that satisfy the underflow criteria and are also *on* the curve is considered significantly more difficult. For this reason we do not believe that this issue is currently practically exploitable and therefore no CVE has been assigned. This only impacts builds using the enable-ec_nistp_64_gcc_128 Configure option. With thanks to Bo-Yin Yang, Billy Brumley and Dr Liu for their significant help in investigating this issue. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8405) (cherry picked from commit 13fbce17fc9f02e2401fc3868f3f8e02d6647e5f)
-
- Mar 06, 2019
-
-
Matt Caswell authored
Correctly describe the maximum IV length. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8406) (cherry picked from commit 27d56312)
-
Matt Caswell authored
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8406) (cherry picked from commit a4f0b50eafb256bb802f2724fc7f7580fb0fbabc)
-
Matt Caswell authored
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. CVE-2019-1543 Fixes #8345 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8406) (cherry picked from commit 2a3d0ee9d59156c48973592331404471aca886d6)
-
- Mar 05, 2019
-
-
Matt Caswell authored
Sessions must be immutable once they can be shared with multiple threads. We were breaking that rule by writing the ticket index into it during the handshake. This can lead to incorrect behaviour, including failed connections in multi-threaded environments. Reported by David Benjamin. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8383) (cherry picked from commit c96ce52ce293785b54a42d119c457aef739cc2ce)
-
- Mar 04, 2019
-
-
Vitezslav Cizek authored
GNU strerror_r may return either a pointer to a string that the function stores in buf, or a pointer to some (immutable) static string in which case buf is unused. In such a case we need to set buf manually. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8371) (cherry picked from commit e3b35d2b)
-
- Mar 01, 2019
-
-
Bernd Edlinger authored
Use select to wait for /dev/random in readable state, but do not actually read anything from /dev/random, use /dev/urandom first. Use linux define __NR_getrandom instead of the glibc define SYS_getrandom, in case the kernel headers are more current than the glibc headers. Fixes #8215 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8251) (cherry picked from commit 38023b87f037f4b832c236dfce2a76272be08763)
-
Shigeki Ohtsu authored
Generate asm files with Makefile rules. From: - https://github.com/nodejs/node/commit/0d9a86c7cb3566b22becc656691282402f5026c0 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8351)
-
- Feb 28, 2019
-
-
Richard Levitte authored
CFLAGS, CXXFLAGS, CPPFLAGS, LDFLAGS, and LDLIBS (cherry picked from commit 8e7984e5783877c58cddc7b4e668401580ab4467) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8359)
-
Richard Levitte authored
For C, -ansi is equivalent to -std=c90 For C++, -ansi is equivalent to -std=c++98 We also place -ansi in CPPFLAGS instead of the usual command line config, to avoid getting it when linking (clang complains) (cherry picked from commit 874f785988c17991051d36a0407a87b36c463a94) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8359)
-
Richard Levitte authored
Some of the devteam flags are not for C++ (cherry picked from commit e373c70a ) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8359)
-
Richard Levitte authored
This ensures that we don't mistakenly use C++ keywords anywhere public. Related to #8313 (cherry picked from commit 9f27d4bf ) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8359)
-
Richard Levitte authored
This makes `--strict-warnings` into a compiler pseudo-option, i.e. it gets treated the same way as any other compiler option given on the configuration command line, but is retroactively replaced by actual compiler warning options, depending on what compiler is used. This makes it easier to see in what order options are given to the compiler from the configuration command line, i.e. this: ./config -Wall --strict-warnings would give the compiler flags in the same order as they're given, i.e.: -Wall -Werror -Wno-whatever ... instead of what we got previously: -Werror -Wno-whatever ... -Wall (cherry picked from commit fcee53948b7f9a5951d42f4ee321e706ea6b4b84) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8359)
-
- Feb 27, 2019
-
-
Shane Lontis authored
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8281) (cherry picked from commit 54d00677)
-
Richard Levitte authored
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8220) (cherry picked from commit 149c12d5e41b238ce4af6d1b6b3a767b40293bd7)
-
Richard Levitte authored
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8220) (cherry picked from commit 2fce15b5)
-
Richard Levitte authored
Since the padlock code is an engine, the assembler is for a module, not a library link to when building a program... there's a distinction. Fixes #2311 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8220) (cherry picked from commit 88780b1c5f6000fe6731fec74efe697bcf493b6c)
-
Paul Yang authored
Currently SM2 shares the ameth with EC, so the current default digest algorithm returned is SHA256. This fixes the default digest algorithm of SM2 to SM3, which is the only valid digest algorithm for SM2 signature. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8186) (cherry picked from commit e766f4a0531bffdab8ad2038279b755928d7a40a)
-
- Feb 26, 2019
-
-
Richard Levitte authored
Github PR #8246 provides a better solution to the problem. This reverts commit f11ffa505f8a9345145a26a05bf77b012b6941bd. [extended tests] Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8247) (cherry picked from commit 4089b4340701e3c13e07169e67a7d14519c98658)
-
Billy Brumley authored
(cherry picked from commit 1a31d801 ) Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8314)
-
Nicola Tuveri authored
(cherry picked from commit b3883f77 ) Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8319)
-
Matt Caswell authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Follow on from CVE-2019-1559 Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8347)
-
Eneas U de Queiroz authored
This restores the behavior of previous versions of the /dev/crypto engine, in alignment with the default implementation. Reported-by: Gerard Looije <lglooije@hotmail.com> Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8306)
-