- Oct 27, 2018
-
-
Dr. Matthias St. Pierre authored
Commit 5b4cb385c18a (#7382) introduced a bug which had the effect that RAND_add()/RAND_seed() failed for buffer sizes less than 32 bytes. The reason was that now the added random data was used exlusively as entropy source for reseeding. When the random input was too short or contained not enough entropy, the DRBG failed without querying the available entropy sources. This commit makes drbg_add() act smarter: it checks the entropy requirements explicitely. If the random input fails this check, it won't be added as entropy input, but only as additional data. More precisely, the behaviour depends on whether an os entropy source was configured (which is the default on most os): - If an os entropy source is avaible then we declare the buffer content as additional data by setting randomness to zero and trigger a regular reseeding. - If no os entropy source is available, a reseeding will fail inevitably. So drbg_add() uses a trick to mix the buffer contents into the DRBG state without forcing a reseeding: it generates a dummy random byte, using the buffer content as additional data. Related-to: #7449 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7456) (cherry picked from commit 8817215d5c52a76f2b184b624bde4df8556dee6d)
-
- Oct 26, 2018
-
-
Dr. Matthias St. Pierre authored
In commit 8bf366519661 some renamings andd typo fixes were made while adding back the DRBG-HMAC and DRBG-HASH implementation. Since the commit could not be backported, a lot of unnecessary differences between master and 1.1.1 were introduced. These differences result in tiresome merge conflicts when cherry-picking. To minimize these merge-conflicts, this patch ports all 'non-feature' changes of commit 8bf366519661 (e.g., renamings of private variables, fixes of typographical errors, comment changes) manually back to 1.1.1. The commits a83dc59afa2e (#7399) and 8817215d5c52 (#7456) failed to cherry-pick previously to 1.1.1, with this patch they both cherry-pick without conflicts. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7505)
-
Matt Caswell authored
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7414) (cherry picked from commit f1358634af5b84be22cb20fff3dcb613f5f8c978)
-
Matt Caswell authored
Since 1fb9fdc3 we may attempt to buffer a record from the next epoch that has already been buffered. Prior to that this never occurred. We simply ignore a failure to buffer a duplicated record. Fixes #6902 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7414) (cherry picked from commit 840facc3)
-
Bernd Edlinger authored
Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7474) (cherry picked from commit 21311777ad8b8c2f2fb8eb7a4f9618ceae1e043d)
-
Dr. Matthias St. Pierre authored
In commit 820e414d (pr #5247) the summary output of the Configure command was optimized towards instructing people how to create issue reports. It turned out that the wording of this message can confuse new OpenSSL users and make them think that they are seeing an error message. This commit makes the summary output start with a success to prevent a misunderstanding. Also it gives more hints to new OpenSSL users. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7499) (cherry picked from commit 41349b5e6dbd72bfbeaf3cf189d64914240628e3)
-
Dr. Matthias St. Pierre authored
Increase the load buffer size such that it exceeds the chunk size by a comfortable amount. This is done to avoid calling RAND_add() with a small final chunk. Instead, such a small final chunk will be added together with the previous chunk (unless it's the only one). Related-to: #7449 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7456)
-
Dr. Matthias St. Pierre authored
The failure of RAND_load_file was only noticed because of the heap corruption which was reported in #7499 and fixed in commit 5b4cb385c18a. To prevent this in the future, RAND_load_file() now explicitly checks RAND_status() and reports an error if it fails. Related-to: #7449 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7456)
-
- Oct 25, 2018
-
-
Richard Levitte authored
When building shared libraries on Windows, we had a clash between 'libcrypto.lib' the static routine library and 'libcrypto.lib' the import library. We now change it so the static versions of our libraries get '_static' appended to their names. These will never get installed, but can still be used for our internal purposes, such as internal tests. When building non-shared, the renaming mechanism doesn't come into play. In that case, the static libraries 'libcrypto.lib' and 'libssl.lib' are installed, just as always. Fixes #7492 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7496) (cherry picked from commit b3023ced)
-
- Oct 23, 2018
-
-
Richard Levitte authored
This value is used to set DRBG_MAX_LENGTH Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7467) (cherry picked from commit f81b043a)
-
- Oct 22, 2018
-
-
Dr. Matthias St. Pierre authored
This bug was introduced by #7382 which enhanced RAND_add() to accept large buffer sizes. As a consequence, RAND_add() now fails for buffer sizes less than 32 bytes (i.e. less than 256 bits). In addition, rand_drbg_get_entropy() forgets to reset the attached drbg->pool in the case of an error, which leads to the heap corruption. The problem occurred with RAND_load_file(), which reads the file in chunks of 1024 bytes each. If the size of the final chunk is less than 32 bytes, then RAND_add() fails, whence RAND_load_file() fails silently for buffer sizes n = k * 1024 + r with r = 1,...,31. This commit fixes the heap corruption only. The other issues will be addressed in a separate pull request. Thanks to Gisle Vanem for reporting this issue. Fixes #7449 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7455) (cherry picked from commit 5b4cb385)
-
- Oct 21, 2018
-
-
Richard Levitte authored
We only had targets for the "simple" shared library names (libfoo.so and not libfoo.so.x.y on Unix, import library libfoo.lib but not libfoo.dll on Windows). This has created some confusion why it wasn't possible to rebuild the less "simple" name directly (just as an example, someone who mistook the import library on Windows for a static library, removed the DLL and then found it was difficult to rebuild directly), so we change the target to include all possible names. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7451) (cherry picked from commit d8cac50b)
-
- Oct 19, 2018
-
-
Matt Caswell authored
An unknown PSK identity could be because its actually a session resumption attempt. Sessions resumptions and external PSKs are indistinguishable so the callbacks need to fail gracefully if they don't recognise the identity. Fixes #7433 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7434) (cherry picked from commit 2d015189)
-
Matt Caswell authored
Previously when a ClientHello arrives with a valid cookie using DTLSv1_listen() we only "peeked" at the message and left it on the underlying fd. This works fine for single threaded applications but for multi-threaded apps this does not work since the fd is typically reused for the server thread, while a new fd is created and connected for the client. By "peeking" we leave the message on the server fd, and consequently we think we've received another valid ClientHello and so we create yet another fd for the client, and so on until we run out of fds. In this new approach we remove the ClientHello and buffer it in the SSL object. Fixes #6934 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/7375) (cherry picked from commit 079ef6bd)
-
Matt Caswell authored
Rather than using init_buf we use the record layer read and write buffers in DTLSv1_listen(). These seem more appropriate anyway and will help with the next commit. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/7375) (cherry picked from commit 2fc4c77c)
-
Matt Caswell authored
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7431) (cherry picked from commit edcd29ef)
-
Matt Caswell authored
Fixes #7428 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7431) (cherry picked from commit 01666a8c)
-
Andy Polyakov authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7400) (cherry picked from commit 03ad7c00)
-
Andy Polyakov authored
{make|swap|get|set}context are removed in POSIX.1-2008, but glibc apparently keeps providing it. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7420) (cherry picked from commit 9d71a24e)
-
- Oct 18, 2018
-
-
armfazh authored
The formula used for this is now kVarianceBlocks = ((255 + 1 + md_size + md_block_size - 1) / md_block_size) + 1 Notice that md_block_size=64 for SHA256, which results on the magic constant kVarianceBlocks = 6. However, md_block_size=128 for SHA384 leading to kVarianceBlocks = 4. CLA:trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7342) (cherry picked from commit cb8164b0)
-
Viktor Dukhovni authored
Also, some readers of the code find starting the count at 1 for EE cert confusing (since RFC5280 counts only non-self-issued intermediate CAs, but we also counted the leaf). Therefore, never count the EE cert, and adjust the path length comparison accordinly. This may be more clear to the reader. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit dc5831da)
-
Viktor Dukhovni authored
At the bottom of https://tools.ietf.org/html/rfc5280#page-12 and top of https://tools.ietf.org/html/rfc5280#page-13 (last paragraph of above https://tools.ietf.org/html/rfc5280#section-3.3), we see: This specification covers two classes of certificates: CA certificates and end entity certificates. CA certificates may be further divided into three classes: cross-certificates, self-issued certificates, and self-signed certificates. Cross-certificates are CA certificates in which the issuer and subject are different entities. Cross-certificates describe a trust relationship between the two CAs. Self-issued certificates are CA certificates in which the issuer and subject are the same entity. Self-issued certificates are generated to support changes in policy or operations. Self- signed certificates are self-issued certificates where the digital signature may be verified by the public key bound into the certificate. Self-signed certificates are used to convey a public key for use to begin certification paths. End entity certificates are issued to subjects that are not authorized to issue certificates. that the term "self-issued" is only applicable to CAs, not end-entity certificates. In https://tools.ietf.org/html/rfc5280#section-4.2.1.9 the description of path length constraints says: The pathLenConstraint field is meaningful only if the cA boolean is asserted and the key usage extension, if present, asserts the keyCertSign bit (Section 4.2.1.3). In this case, it gives the maximum number of non-self-issued intermediate certificates that may follow this certificate in a valid certification path. (Note: The last certificate in the certification path is not an intermediate certificate, and is not included in this limit. Usually, the last certificate is an end entity certificate, but it can be a CA certificate.) This makes it clear that exclusion of self-issued certificates from the path length count applies only to some *intermediate* CA certificates. A leaf certificate whether it has identical issuer and subject or whether it is a CA or not is never part of the intermediate certificate count. The handling of all leaf certificates must be the same, in the case of our code to post-increment the path count by 1, so that we ultimately reach a non-self-issued intermediate it will be the first one (not zeroth) in the chain of intermediates. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit ed422a2d0196ada0f5c1b6e296f4a4e5ed69577f)
-
- Oct 17, 2018
-
-
Antoine Salon authored
Replace ECDH_KDF_X9_62() with internal ecdh_KDF_X9_63() Signed-off-by: Antoine Salon <asalon@vmware.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7345) (cherry picked from commit ffd89124bdfc9e69349492c3f15383bb35520a11)
-
Dr. Matthias St. Pierre authored
Commit ffb46830 introduced the 'rand_serial' option. When it is used, the 'serialfile' does not get initialized, i.e. it remains a NULL pointer. This causes a crash when the NULL pointer is passed to the rotate_serial() call. This commit fixes the crash and unifies the pointer checking before calling the rotate_serial() and save_serial() commands. Fixes #7412 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7417) (cherry picked from commit aeec793b)
-
Richard Levitte authored
When looking at configured macro definitions, we must look at both what comes from the config target AND what comes from user configuration. Fixes #7396 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/7402) (cherry picked from commit 92ebf6c4c21ff4b41ba1fd69af74b2039e138114)
-
Mansour Ahmadi authored
Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7405) (cherry picked from commit 61bef9bd)
-
cclauss authored
CLA: trivial Discovered via #7410 @ https://travis-ci.org/openssl/openssl/jobs/442003489#L440 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7403) (cherry picked from commit 83e4533a)
-
- Oct 16, 2018
-
-
Dr. Matthias St. Pierre authored
In pull request #4328 the seeding of the DRBG via RAND_add()/RAND_seed() was implemented by buffering the data in a random pool where it is picked up later by the rand_drbg_get_entropy() callback. This buffer was limited to the size of 4096 bytes. When a larger input was added via RAND_add() or RAND_seed() to the DRBG, the reseeding failed, but the error returned by the DRBG was ignored by the two calling functions, which both don't return an error code. As a consequence, the data provided by the application was effectively ignored. This commit fixes the problem by a more efficient implementation which does not copy the data in memory and by raising the buffer the size limit to INT32_MAX (2 gigabytes). This is less than the NIST limit of 2^35 bits but it was chosen intentionally to avoid platform dependent problems like integer sizes and/or signed/unsigned conversion. Additionally, the DRBG is now less permissive on errors: In addition to pushing a message to the openssl error stack, it enters the error state, which forces a reinstantiation on next call. Thanks go to Dr. Falko Strenzke for reporting this issue to the openssl-security mailing list. After internal discussion the issue has been categorized as not being security relevant, because the DRBG reseeds automatically and is fully functional even without additional randomness provided by the application. Fixes #7381 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7382) (cherry picked from commit 3064b55134434a0b2850f07eff57120f35bb269a)
-
- Oct 15, 2018
-
-
Matt Caswell authored
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7365) (cherry picked from commit 5f9f67b9)
-
Pauli authored
The PR #7329 left some indentation slightly off. This fixes it. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7360) (cherry picked from commit 5b639d4c)
-
Mykola Baibuz authored
Hash can be longer than EC group degree and it will be truncated. CLA: trivial Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7329) (cherry picked from commit b770a80f)
-
Matt Caswell authored
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7306) (cherry picked from commit 734af93a)
-
Matt Caswell authored
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7308) (cherry picked from commit 7f1d923a)
-
- Oct 13, 2018
-
-
Mykola Baibuz authored
We don't need to use secure clean for public key. CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7363) (cherry picked from commit c033101d)
-
Tomas Mraz authored
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7377) (cherry picked from commit 628ee796)
-
- Oct 12, 2018
-
-
Andy Polyakov authored
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7123) (cherry picked from commit d1c008f6)
-
Andy Polyakov authored
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7085) (cherry picked from commit 7d0effea)
-
Andy Polyakov authored
Negative displacement in memory references was not originally specified, so that for maximum coverage one should abstain from it, just like with any other extension. [Unless it's guarded by run-time switch, but there is no switch in keccak1600-s390x.] Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7239) (cherry picked from commit fc97c882)
-
Matt Caswell authored
Fixes #7385 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7385) (cherry picked from commit 990fe909)
-
- Oct 11, 2018
-
-
Paul Yang authored
The example code in EVP_DigestInit.pod generates warnings if users try to compile it. [skip ci] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7362) (cherry picked from commit 19ac1bf2)
-