- Aug 19, 2016
-
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Update certificate and CRL time routines to match new standard. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Viktor Dukhovni authored
The DANE API supports a DANE_FLAG_NO_DANE_EE_NAMECHECKS option, but there was no way to exercise/enable it via s_client. This commit addresses that gap. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
The certificate and CRL time setting functions used similar code, combine into a single utility function. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Rich Salz authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Richard Levitte authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
FdaSilvaYY authored
... without any interruption. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1468)
-
Dr. Stephen Henson authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
-
Matt Caswell authored
A function error code needed updating due to merge issues. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Clang was complaining about some unused functions. Moving the stack declaration to the header seems to sort it. Also the certstatus variable in dtlstest needed to be declared static. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
The DTLS implementation provides some protection against replay attacks in accordance with RFC6347 section 4.1.2.6. A sliding "window" of valid record sequence numbers is maintained with the "right" hand edge of the window set to the highest sequence number we have received so far. Records that arrive that are off the "left" hand edge of the window are rejected. Records within the window are checked against a list of records received so far. If we already received it then we also reject the new record. If we have not already received the record, or the sequence number is off the right hand edge of the window then we verify the MAC of the record. If MAC verification fails then we discard the record. Otherwise we mark the record as received. If the sequence number was off the right hand edge of the window, then we slide the window along so that the right hand edge is in line with the newly received sequence number. Records may arrive for future epochs, i.e. a record from after a CCS being sent, can arrive before the CCS does if the packets get re-ordered. As we have not yet received the CCS we are not yet in a position to decrypt or validate the MAC of those records. OpenSSL places those records on an unprocessed records queue. It additionally updates the window immediately, even though we have not yet verified the MAC. This will only occur if currently in a handshake/renegotiation. This could be exploited by an attacker by sending a record for the next epoch (which does not have to decrypt or have a valid MAC), with a very large sequence number. This means the right hand edge of the window is moved very far to the right, and all subsequent legitimate packets are dropped causing a denial of service. A similar effect can be achieved during the initial handshake. In this case there is no MAC key negotiated yet. Therefore an attacker can send a message for the current epoch with a very large sequence number. The code will process the record as normal. If the hanshake message sequence number (as opposed to the record sequence number that we have been talking about so far) is in the future then the injected message is bufferred to be handled later, but the window is still updated. Therefore all subsequent legitimate handshake records are dropped. This aspect is not considered a security issue because there are many ways for an attacker to disrupt the initial handshake and prevent it from completing successfully (e.g. injection of a handshake message will cause the Finished MAC to fail and the handshake to be aborted). This issue comes about as a result of trying to do replay protection, but having no integrity mechanism in place yet. Does it even make sense to have replay protection in epoch 0? That issue isn't addressed here though. This addressed an OCAP Audit issue. CVE-2016-2181 Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Injects a record from epoch 1 during epoch 0 handshake, with a record sequence number in the future, to test that the record replay protection feature works as expected. This is described more fully in the next commit. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
During a DTLS handshake we may get records destined for the next epoch arrive before we have processed the CCS. In that case we can't decrypt or verify the record yet, so we buffer it for later use. When we do receive the CCS we work through the queue of unprocessed records and process them. Unfortunately the act of processing wipes out any existing packet data that we were still working through. This includes any records from the new epoch that were in the same packet as the CCS. We should only process the buffered records if we've not got any data left. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Add a test to inject a record from the next epoch during the handshake and make sure it doesn't get processed immediately. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Split the create_ssl_connection() helper function into two steps: one to create the SSL objects, and one to actually create the connection. This provides the ability to make changes to the SSL object before the connection is actually made. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
This adds a BIO similar to a normal mem BIO but with datagram awareness. It also has the capability to inject additional packets at arbitrary locations into the BIO, for testing purposes. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Dump out the records passed over the BIO. Only works for DTLS at the moment but could easily be extended to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Emilia Kasper authored
Reviewed-by: Stephen Henson <steve@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
Benjamin Kaduk authored
@disablables is sorted, but these were just added at the end of %disabled in commits c2e27310 and 22e3dcb7 . Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
-
- Aug 18, 2016
-
-
Viktor Dukhovni authored
The error message said "dane_tlsa_rrset" instead of "dane_tlsa_rrdata". Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Richard Levitte authored
There's no reason we should enumerate every type of IMPLEMENT_ and DECLARE_ line (and forget the ones we add a little now and then). They all start with the same first word, let's just take'm all. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Emilia Kasper authored
Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Matt Caswell authored
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
-
Emilia Kasper authored
Duplicate alerts have happened, see 70c22888 Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Emilia Kasper authored
Make maximum fragment length configurable and add various fragmentation tests, in addition to the existing multi-buffer tests. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
- Aug 17, 2016
-
-
Rich Salz authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
Richard Levitte authored
Since dasync isn't installed, and is only ever used as a dynamic engine, there's no reason to consider it for initialization when building static engines. Reviewed-by: Ben Laurie <ben@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
Dr. Stephen Henson authored
Constify X509_SIG_get0() and order arguments to mactch new standard. Add X509_SIG_get0_mutable() to support modification or initialisation of an X509_SIG structure. Reviewed-by: Matt Caswell <matt@openssl.org>
-
FdaSilvaYY authored
using util/openssl-format-source on s_derver, s_client, ca.c, speed.c only... Fix/merge some #ifndef Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
-
FdaSilvaYY authored
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
-