- Jul 19, 2017
-
-
Matt Caswell authored
In TLS mode of operation the padding value "pad" is obtained along with the maximum possible padding value "maxpad". If pad > maxpad then the data is invalid. However we must continue anyway because this is constant time code. We calculate the payload length like this: inp_len = len - (SHA_DIGEST_LENGTH + pad + 1); However if pad is invalid then inp_len ends up -ve (actually large +ve because it is a size_t). Later we do this: /* verify HMAC */ out += inp_len; len -= inp_len; This ends up with "out" pointing before the buffer which is undefined behaviour. Next we calculate "p" like this: unsigned char *p = out + len - 1 - maxpad - SHA256_DIGEST_LENGTH; Because of the "out + len" term the -ve inp_len value is cancelled out so "p" points to valid memory (although technically the pointer arithmetic is undefined behaviour again). We only ever then dereference "p" and never "out" directly so there is never an invalid read based on the bad pointer - so there is no security issue. This commit fixes the undefined behaviour by ensuring we use maxpad in place of pad, if the supplied pad is invalid. With thanks to Brian Carpenter for reporting this issue. Reviewed-by:Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3832) (cherry picked from commit 335d0a46)
-
- Jul 18, 2017
-
-
Emilia Kasper authored
This is an inherent weakness of the padding mode. We can't make the implementation constant time (see the comments in rsa_pk1.c), so add a warning to the docs. Reviewed-by:
-
- Jul 17, 2017
-
-
Bernd Edlinger authored
Reviewed-by:
Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3948) (cherry picked from commit daaaa3cb)
-
- Jul 14, 2017
-
-
Bernd Edlinger authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3936)
-
Roelof duToit authored
Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3925)
-
Roelof duToit authored
This resolves the retry issue in general, but also the specific case where a TLS 1.3 server sends a post-handshake NewSessionTicket message prior to appdata. Reviewed-by:
-
- Jul 10, 2017
-
-
Bernd Edlinger authored
Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3896) (cherry picked from commit e1ca9e1f)
-
- Jul 09, 2017
-
-
Richard Levitte authored
Unsigned overflow. Found by Brian Carpenter Fixes #3889 Reviewed-by:
-
- Jul 07, 2017
-
-
Richard Levitte authored
TAP::Parser::Aggregator::has_errors may return any number, not just 0 and 1. With Perl on VMS, any number from 2 and on is interpreted as a VMS status, the 3 lower bits are the encoded severity (1 = SUCCESS, for example), so depending on what has_errors returns, a test failure might be interpreted as a success. Therefore, it's better to make sure the exit code is 0 or 1, nothing else (they are special on VMS, and mean SUCCESS or FAILURE, to match Unix conventions). Reviewed-by:
-
Richard Levitte authored
VMS renames our libraries to fit VMS conventions. This must be accounted for when we want to load them. Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
- Jul 05, 2017
-
-
Rich Salz authored
Ported GH #3842 to 1.1.0 branch Reviewed-by:
-
Matt Caswell authored
Something environmental changed in travis so that it started preferring the ubuntu clang-3.9 version instead of the llvm.org one. This breaks the sanitiser based builds. This change forces travis to de-prioritise the ubuntu clang packages. [extended tests] Reviewed-by:
-
Richard Levitte authored
- in EVP_read_pw_string_min(), the return value from UI_add_* wasn't properly checked - in UI_process(), |state| was never made NULL, which means an error when closing the session wouldn't be accurately reported. Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3849) (cherry picked from commit b96dba9e)
-
Richard Levitte authored
When tree_calculate_user_set() fails, a jump to error failed to deallocate a possibly allocated |auth_nodes|. Reviewed-by:
-
- Jul 03, 2017
-
-
Richard Levitte authored
Reviewed-by:
-
- Jul 01, 2017
-
-
Richard Levitte authored
Reviewed-by:
-
- Jun 29, 2017
-
-
Richard Levitte authored
For Windows, we care which way it is, the resulting file is just a pile of symbols. For VMS, we really need to care about the numeric ordering, and getting the symbols sorted by symbol version too didn't agree with that. Reviewed-by:
-
Richard Levitte authored
This allows us to guard Unix specific functions with #ifndef / #ifdef OPENSSL_SYS_UNIX Reviewed-by:
-
- Jun 25, 2017
-
-
Richard Levitte authored
This function is undocumented, but similarly named functions (such as 'curl_global_cleanup') are documented as internals that should not be called by scripts. Fixes #3765 Reviewed-by:
-
- Jun 22, 2017
-
-
Matt Caswell authored
In 1.0.2 and before OBJ_create() allowed the sn or ln parameter to be NULL. Commit 52832e47 changed that so that it crashed if they were NULL. This was causing problems with the built-in config oid module. If a long name was provided OBJ_create() is initially called with a NULL ln and therefore causes a crash. Fixes #3733 Reviewed-by:
-
David Benjamin authored
Per RFC 7905, the cipher suite names end in "_SHA256". The original implementation targeted the -03 draft, but there was a -04 draft right before the RFC was published to make the names consistent. Reviewed-by:
-
- Jun 21, 2017
-
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
The value of BIO_CTRL_DGRAM_SET_PEEK_MODE was clashing with the value for BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE. In an SCTP enabled build BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE was used unconditionally with the reasoning that it would be ignored if SCTP wasn't in use. Unfortunately due to this clash, this wasn't the case. The BIO ended up going into peek mode and was continually reading the same data over and over - throwing it away as a replay. Fixes #3723 Reviewed-by:
-
Matt Caswell authored
ECDHE is not properly defined for SSLv3. Commit fe55c4a2 prevented ECDHE from being selected in that protocol. However, historically, servers do still select ECDHE anyway so that commit causes interoperability problems. Clients that previously worked when talking to an SSLv3 server could now fail. This commit introduces an exception which enables a client to continue in SSLv3 if the server selected ECDHE. (cherry picked from commit 8af91fd9 ) Reviewed-by:
-
- Jun 20, 2017
-
-
Bernd Edlinger authored
Reviewed-by:
-
Benjamin Kaduk authored
Since the clang_devteam_warnings are appended to the gcc_devteam_warnings when strict-warnings are requested, any items present in both the gcc and clang variables will be duplicated in the cflags used for clang builds. Remove the extra copy from the clang-specific flags in favor of the gcc_devteam_warnings that are used for all strict-warnings builds. Reviewed-by:
-
Benjamin Kaduk authored
gcc's -Wextra pulls in -Wold-style-declaration, which triggers when a declaration has a storage-class specifier as a non-initial qualifier. The ISO C formal grammar requires the storage-class to be the first component of the declaration, if present. Seeint as the register storage-class specifier does not really have any effect anymore with modern compilers, remove it entirely while we're here, instead of fixing up the order. Interestingly, the gcc devteam warnings do not pull in -Wextra, though the clang ones do. [extended tests] Reviewed-by:
-
Benjamin Kaduk authored
clang already has it; let's flip the switch and deal with the fallout. Exclude -Wunused-parameter, as we have many places where we keep unused parameters to conform to a uniform vtable-like interface. Also exclude -Wmissing-field-initializers; it's okay to rely on the standard-mandated behavior of filling out with 0/NULL. Reviewed-by:
-
- Jun 19, 2017
-
-
Bernd Edlinger authored
Reviewed-by:
-
Bernd Edlinger authored
- Ignoring the return code of ossl_init_thread_start created a memory leak. Reviewed-by:
-
- Jun 17, 2017
-
-
Paul Yang authored
For DES and 3DES based ciphers are also enabled by this option. Reviewed-by:
-
Bernd Edlinger authored
Reviewed-by:
-
- Jun 15, 2017
-
-
Todd Short authored
Reviewed-by:
-
Richard Levitte authored
Because apps/progs.h isn't configuration agnostic, it's not at all suited for 'make update' or being versioned, so change it to be dynamically generated. Reviewed-by:
-
Richard Levitte authored
If it did, it really is something that should be checked in, and should therefore make a CI build fail. Reviewed-by:
-
- Jun 14, 2017
-
-
Bernd Edlinger authored
Reviewed-by:
-
Bernd Edlinger authored
Reviewed-by:
-
Bernd Edlinger authored
Reviewed-by:
-
Bernd Edlinger authored
Reviewed-by:
-
