aboutsummaryrefslogtreecommitdiffstats
path: root/ssl
Commit message (Collapse)AuthorAgeFilesLines
* Add DTLS replay protection testMatt Caswell2016-08-191-4/+16
| | | | | | | | Injects a record from epoch 1 during epoch 0 handshake, with a record sequence number in the future, to test that the record replay protection feature works as expected. This is described more fully in the next commit. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix DTLS unprocessed records bugMatt Caswell2016-08-191-2/+21
| | | | | | | | | | | | | | During a DTLS handshake we may get records destined for the next epoch arrive before we have processed the CCS. In that case we can't decrypt or verify the record yet, so we buffer it for later use. When we do receive the CCS we work through the queue of unprocessed records and process them. Unfortunately the act of processing wipes out any existing packet data that we were still working through. This includes any records from the new epoch that were in the same packet as the CCS. We should only process the buffered records if we've not got any data left. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add a DTLS unprocesed records testMatt Caswell2016-08-192-1/+136
| | | | | | | Add a test to inject a record from the next epoch during the handshake and make sure it doesn't get processed immediately. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add missing casts.Rich Salz2016-07-281-2/+3
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Send alert for bad DH CKEDr. Stephen Henson2016-07-221-2/+4
| | | | | | RT#4511 Reviewed-by: Matt Caswell <matt@openssl.org>
* Sanity check in ssl_get_algorithm2().Dr. Stephen Henson2016-07-201-1/+4
| | | | | | | | | | RT#4600 Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 52eede5a970fdb30c4ed6d3663e51f36bd1b1c73) Conflicts: ssl/s3_lib.c
* Send alert on CKE error.Dr. Stephen Henson2016-07-191-3/+5
| | | | | | RT#4610 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Avoid an overflow in constructing the ServerKeyExchange messageMatt Caswell2016-07-011-0/+5
| | | | | | | | | | | | | We calculate the size required for the ServerKeyExchange message and then call BUF_MEM_grow_clean() on the buffer. However we fail to take account of 2 bytes required for the signature algorithm and 2 bytes for the signature length, i.e. we could overflow by 4 bytes. In reality this won't happen because the buffer is pre-allocated to a large size that means it should be big enough anyway. Addresses an OCAP Audit issue. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Change usage of RAND_pseudo_bytes to RAND_bytesMatt Caswell2016-06-278-27/+20
| | | | | | | | | RAND_pseudo_bytes() allows random data to be returned even in low entropy conditions. Sometimes this is ok. Many times it is not. For the avoidance of any doubt, replace existing usage of RAND_pseudo_bytes() with RAND_bytes(). Reviewed-by: Rich Salz <rsalz@openssl.org>
* Avoid some undefined pointer arithmeticMatt Caswell2016-06-013-34/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | A common idiom in the codebase is: if (p + len > limit) { return; /* Too long */ } Where "p" points to some malloc'd data of SIZE bytes and limit == p + SIZE "len" here could be from some externally supplied data (e.g. from a TLS message). The rules of C pointer arithmetic are such that "p + len" is only well defined where len <= SIZE. Therefore the above idiom is actually undefined behaviour. For example this could cause problems if some malloc implementation provides an address for "p" such that "p + len" actually overflows for values of len that are too big and therefore p + len < limit! Issue reported by Guido Vranken. CVE-2016-2177 Reviewed-by: Rich Salz <rsalz@openssl.org>
* The ssl3_digest_cached_records() function does not handle errors properlyMatt Caswell2016-05-261-2/+6
| | | | | | | | | | The ssl3_digest_cached_records() function was failing to handle errors that might be returned from EVP_DigestSignInit() and EVP_DigestSignUpdate(). RT#4180 Reviewed-by: Stephen Henson <steve@openssl.org>
* Ensure verify error is set when X509_verify_cert() failsViktor Dukhovni2016-05-191-0/+6
| | | | | | | | | | | | | | | Set ctx->error = X509_V_ERR_OUT_OF_MEM when verificaiton cannot continue due to malloc failure. Similarly for issuer lookup failures and caller errors (bad parameters or invalid state). Also, when X509_verify_cert() returns <= 0 make sure that the verification status does not remain X509_V_OK, as a last resort set it it to X509_V_ERR_UNSPECIFIED, just in case some code path returns an error without setting an appropriate value of ctx->error. Add new and some missing error codes to X509 error -> SSL alert switch. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix a double free in tls1_setup_key_blockMatt Caswell2016-05-191-1/+0
| | | | | | | | If p2 == NULL then p1 can get freed twice and a crash could occur. Issue reported by Shi Lei (Qihoo 360 Inc) Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix SSL compression symbol exportingMatt Caswell2016-05-173-13/+15
| | | | | | | | Some compression related functions in libssl have dummy versions to be used when compiled with no-comp. However those dummy functions were not being exported on Windows so they are unusable when dynamically linked. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Don't send signature algorithms when client_version is below TLS 1.2.David Benjamin2016-05-092-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | Per RFC 5246, Note: this extension is not meaningful for TLS versions prior to 1.2. Clients MUST NOT offer it if they are offering prior versions. However, even if clients do offer it, the rules specified in [TLSEXT] require servers to ignore extensions they do not understand. Although second sentence would suggest that there would be no interop problems in always offering the extension, WebRTC has reported issues with Bouncy Castle on < TLS 1.2 ClientHellos that still include signature_algorithms. See also https://bugs.chromium.org/p/webrtc/issues/detail?id=4223 RT#4390 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org> (cherry picked from commit f7aa318552c4ef62d902c480b59bd7c4513c0009) Conflicts: ssl/ssl_locl.h
* Remove confusing comment.TJ Saunders2016-05-021-1/+0
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Issue #719:TJ Saunders2016-05-021-7/+22
| | | | | | | | | | | | | | | If no serverinfo extension is found in some cases, do not abort the handshake, but simply omit/skip that extension. Check for already-registered serverinfo callbacks during serverinfo registration. Update SSL_CTX_use_serverinfo() documentation to mention the need to reload the same serverinfo per certificate, for servers with multiple server certificates. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Ensure we check i2d_X509 return valMatt Caswell2016-04-261-2/+7
| | | | | | | | | | The i2d_X509() function can return a negative value on error. Therefore we should make sure we check it. Issue reported by Yuan Jochen Kang. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 446ba8de9af9aa4fa3debc7c76a38f4efed47a62)
* Fix memory leak on invalid CertificateRequest.David Benjamin2016-04-071-0/+2
| | | | | | | | | | | | | | Free up parsed X509_NAME structure if the CertificateRequest message contains excess data. The security impact is considered insignificant. This is a client side only leak and a large number of connections to malicious servers would be needed to have a significant impact. This was found by libFuzzer. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
* Fix ALPNTodd Short2016-04-045-42/+250
| | | | | | | | | | | | | | * Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * document ALPN functions * unit tests Backport of commit 817cd0d52f0462039d1fe60462150be7f59d2002 Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Add a check for a failed mallocMatt Caswell2016-03-182-0/+4
| | | | | | | | Ensure we check for a NULL return from OPENSSL_malloc Issue reported by Guido Vranken. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Ensure that memory allocated for the ticket is freedMatt Caswell2016-03-181-1/+3
| | | | | | | | | If a call to EVP_DecryptUpdate fails then a memory leak could occur. Ensure that the memory is freed appropriately. Issue reported by Guido Vranken. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add no-ssl2-methodKurt Roeckx2016-03-142-2/+14
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #2341
* expose SSLv2 method prototypesViktor Dukhovni2016-03-092-5/+3
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Retain SSLv2 methods as functions that return NULLViktor Dukhovni2016-03-081-3/+3
| | | | | | This improves ABI compatibility when symbol resolution is not lazy. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove LOW from the defaultKurt Roeckx2016-03-075-62/+63
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* make updateMatt Caswell2016-03-011-34/+33
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Disable EXPORT and LOW SSLv3+ ciphers by defaultViktor Dukhovni2016-03-011-0/+54
| | | | Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Add a test for SSLv2 configurationMatt Caswell2016-03-012-1/+232
| | | | | | | | | SSLv2 should be off by default. You can only turn it on if you have called SSL_CTX_clear_options(SSL_OP_NO_SSLv2) or SSL_clear_options(SSL_OP_NO_SSLv2). You should not be able to inadvertantly turn it on again via SSL_CONF without having done that first. Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Disable SSLv2 default build, default negotiation and weak ciphers.Viktor Dukhovni2016-03-013-1/+22
| | | | | | | | | | | | | | | | | | | | | | SSLv2 is by default disabled at build-time. Builds that are not configured with "enable-ssl2" will not support SSLv2. Even if "enable-ssl2" is used, users who want to negotiate SSLv2 via the version-flexible SSLv23_method() will need to explicitly call either of: SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2); or SSL_clear_options(ssl, SSL_OP_NO_SSLv2); as appropriate. Even if either of those is used, or the application explicitly uses the version-specific SSLv2_method() or its client or server variants, SSLv2 ciphers vulnerable to exhaustive search key recovery have been removed. Specifically, the SSLv2 40-bit EXPORT ciphers, and SSLv2 56-bit DES are no longer available. Mitigation for CVE-2016-0800 Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Handle SSL_shutdown while in init more appropriately #2Matt Caswell2016-02-084-18/+6
| | | | | | | | | | | | | | | | | | | Previous commit f73c737c7 attempted to "fix" a problem with the way SSL_shutdown() behaved whilst in mid-handshake. The original behaviour had SSL_shutdown() return immediately having taken no action if called mid- handshake with a return value of 1 (meaning everything was shutdown successfully). In fact the shutdown has not been successful. Commit f73c737c7 changed that to send a close_notify anyway and then return. This seems to be causing some problems for some applications so perhaps a better (much simpler) approach is revert to the previous behaviour (no attempt at a shutdown), but return -1 (meaning the shutdown was not successful). This also fixes a bug where SSL_shutdown always returns 0 when shutdown *very* early in the handshake (i.e. we are still using SSLv23_method). Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Always generate DH keys for ephemeral DH cipher suitesMatt Caswell2016-01-283-29/+4
| | | | | | | | | | | | Modified version of the commit ffaef3f15 in the master branch by Stephen Henson. This makes the SSL_OP_SINGLE_DH_USE option a no-op and always generates a new DH key for every handshake regardless. CVE-2016-0701 (fix part 2 or 2) Issue reported by Antonio Sanso Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Better SSLv2 cipher-suite enforcementViktor Dukhovni2016-01-281-2/+13
| | | | | | | | | Based on patch by: Nimrod Aviram <nimrod.aviram@gmail.com> CVE-2015-3197 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Handle SSL_shutdown while in init more appropriatelyMatt Caswell2016-01-204-4/+20
| | | | | | | | | | | | | | | Calling SSL_shutdown while in init previously gave a "1" response, meaning everything was successfully closed down (even though it wasn't). Better is to send our close_notify, but fail when trying to receive one. The problem with doing a shutdown while in the middle of a handshake is that once our close_notify is sent we shouldn't really do anything else (including process handshake/CCS messages) until we've received a close_notify back from the peer. However the peer might send a CCS before acting on our close_notify - so we won't be able to read it because we're not acting on CCS messages! Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Validate ClientHello session_id field length and send alert on failureAlessandro Ghedini2016-01-193-3/+11
| | | | | | | RT#4080 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Empty SNI names are not validViktor Dukhovni2016-01-171-1/+4
| | | | | | | | | While empty inputs to SSL_set1_host() clear the reference identifier list. (cherry-picked from 1.1.0-dev) Reviewed-by: Rich Salz <rsalz@openssl.org>
* Wrong definition of the macro SSL_set1_sigalgs in ssl.harijitnayak2016-01-121-1/+1
| | | | | | | | | | Error in the definition of the macro SSL_set1_sigalgs(ctx, slist, slistlen): the third parameter 'slistlen' not used in the substitution code; used 'clistlen' instead. As a result of this, compilation error occurs when any application uses this macro. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Change minimum DH size from 768 to 1024Kurt Roeckx2016-01-111-1/+1
| | | | Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org>
* Ensure we don't call the OCSP callback if resuming a sessionMatt Caswell2015-12-271-1/+1
| | | | | | | It makes no sense to call the OCSP status callback if we are resuming a session because no certificates will be sent. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix error when server does not send CertificateStatus messageMatt Caswell2015-12-272-34/+39
| | | | | | | | | | | | If a server sends the status_request extension then it may choose to send the CertificateStatus message. However this is optional. We were treating it as mandatory and the connection was failing. Thanks to BoringSSL for reporting this issue. RT#4120 Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix more URLs mangled by reformatMatt Caswell2015-12-191-1/+1
| | | | | | | | Fix some more URLs mangled by indent in the reformat. These ones don't exist in master so we have a separate commit. Based on a patch supplied by Arnaud Lacombe <al@aerilon.ca> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove the "eay" c-file-style indicatorsRichard Levitte2015-12-184-4/+4
| | | | | | | Since we don't use the eay style any more, there's no point tryint to tell emacs to use it. Reviewed-by: Ben Laurie <ben@openssl.org>
* Ensure |rwstate| is set correctly on BIO_flushMatt Caswell2015-12-101-1/+5
| | | | | | | | | A BIO_flush call in the DTLS code was not correctly setting the |rwstate| variable to SSL_WRITING. This means that SSL_get_error() will not return SSL_ERROR_WANT_WRITE in the event of an IO retry. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 67f60be8c9ae5ff3129fcd6238baf124385a41d8)
* Fix DTLS handshake fragment retriesMatt Caswell2015-12-101-20/+44
| | | | | | | | | | If using DTLS and NBIO then if a second or subsequent handshake message fragment hits a retry, then the retry attempt uses the wrong fragment offset value. This commit restores the fragment offset from the last attempt. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 2ad226e88bee97847496e542d63c67997d5beda6)
* Add a return value checkMatt Caswell2015-12-101-4/+4
| | | | | | | | If the call to OBJ_find_sigid_by_algs fails to find the relevant NID then we should set the NID to NID_undef. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 330dcb09b2df7e1e6d1d3d14a5df7269aebd9a68)
* _BSD_SOURCE is deprecated, use _DEFAULT_SOURCE insteadRichard Levitte2015-12-021-0/+1
| | | | | | | | | The feature_test_macros(7) manual tells us that _BSD_SOURCE is deprecated since glibc 2.20 and that the compiler will warn about it being used, unless _DEFAULT_SOURCE is defined as well. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit f9fd35248c9a3b1125d9ab82ffb19d62e86533ac)
* Remove cookie validation return value trickMatt Caswell2015-12-011-6/+4
| | | | | | | | | | | | In the DTLS ClientHello processing the return value is stored in |ret| which by default is -1. |ret| is only updated to a positive value once we are past all points where we could hit an error. We wish to return 1 on success or 2 on success *and* we have validated the DTLS cookie. Previously on successful validation of the cookie we were setting |ret| to -2, and then once we were past all error points we set |ret = -ret|. This is non-obvious behaviour and could be error prone. This commit tries to make this a bit more intuitive. Reviewed-by: Andy Polyakov <appro@openssl.org>
* ssl3_free(): Return if it wasn't createdPascal Cuoq2015-11-241-1/+1
| | | | | | | | | | | If somewhere in SSL_new() there is a memory allocation failure, ssl3_free() can get called with s->s3 still being NULL. Patch also provided by Willy Tarreau <wtarreau@haproxy.com> Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org> (cherry picked from commit 3e7bd2ce0b16f8611298175d6dc7cb35ee06ea6d)
* Set reference count earlierKurt Roeckx2015-11-242-2/+2
| | | | | | | | Backport of 0e04674e964b905e67e3d215bcf888932c92765f Reviewed-by: Steve Henson <steve@openssl.org> RT #4047, #4110, MR #1356
* Good hygiene with size_t output argument.Viktor Dukhovni2015-11-211-1/+1
| | | | | | | | | Though the callers check the function return value and ignore the size_t output argument on failure, it is still often not ideal to store -1 in a size_t on error. That might signal an unduly large buffer. Instead set the size_t to 0, to indicate no space. Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-24 16:42:58 +0000