Fix security hole.

87 files changed, 878 insertions, 680 deletions

diff --git a/CHANGES b/CHANGES
index 82b190b700..2a00607326 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,16 @@
 
  Changes between 0.9.1c and 0.9.2
 
+  *) Make SSL_get_peer_cert_chain() work in servers. Unfortunately, it still
+     doesn't work when the session is reused. Coming soon!
+     [Ben Laurie]
+
+  *) Fix a security hole, that allows sessions to be reused in the wrong
+     context thus bypassing client cert protection! All software that uses
+     client certs and session caches in multiple contexts NEEDS PATCHING to
+     allow session reuse! A fuller solution is in the works.
+     [Ben Laurie, problem pointed out by Holger Reif, Bodo Moeller (and ???)]
+
   *) Some more source tree cleanups (removed obsolete files
      crypto/bf/asm/bf586.pl, test/test.txt and crypto/sha/asm/f.s; changed
      permission on "config" script to be executable) and a fix for the INSTALL
diff --git a/README b/README
index 71ab13395e..b03836941d 100644
--- a/README
+++ b/README
@@ -1,5 +1,5 @@
 
- OpenSSL 0.9.2 06-Mar-1999
+ OpenSSL 0.9.2b 22 Mar 1999
 
  Copyright (c) 1998-1999 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
diff --git a/apps/Makefile.ssl b/apps/Makefile.ssl
index 8aa5c8db99..f9b16d7511 100644
--- a/apps/Makefile.ssl
+++ b/apps/Makefile.ssl
@@ -138,37 +138,38 @@ progs.h:
 # DO NOT DELETE THIS LINE -- make depend depends on it.
 
 apps.o: ../include/bio.h ../include/buffer.h ../include/crypto.h
-apps.o: ../include/e_os.h ../include/stack.h apps.h progs.h
+apps.o: ../include/e_os.h ../include/opensslv.h ../include/stack.h apps.h
+apps.o: progs.h
 asn1pars.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h
 asn1pars.o: ../include/bn.h ../include/buffer.h ../include/cast.h
 asn1pars.o: ../include/crypto.h ../include/des.h ../include/dh.h
 asn1pars.o: ../include/dsa.h ../include/e_os.h ../include/err.h
 asn1pars.o: ../include/evp.h ../include/idea.h ../include/md2.h
 asn1pars.o: ../include/md5.h ../include/mdc2.h ../include/objects.h
-asn1pars.o: ../include/pem.h ../include/pem2.h ../include/pkcs7.h
-asn1pars.o: ../include/rc2.h ../include/rc4.h ../include/rc5.h
-asn1pars.o: ../include/ripemd.h ../include/rsa.h ../include/sha.h
-asn1pars.o: ../include/stack.h ../include/x509.h ../include/x509_vfy.h apps.h
-asn1pars.o: progs.h
+asn1pars.o: ../include/opensslv.h ../include/pem.h ../include/pem2.h
+asn1pars.o: ../include/pkcs7.h ../include/rc2.h ../include/rc4.h
+asn1pars.o: ../include/rc5.h ../include/ripemd.h ../include/rsa.h
+asn1pars.o: ../include/sha.h ../include/stack.h ../include/x509.h
+asn1pars.o: ../include/x509_vfy.h apps.h progs.h
 ca.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h ../include/bn.h
 ca.o: ../include/buffer.h ../include/cast.h ../include/conf.h
 ca.o: ../include/crypto.h ../include/des.h ../include/dh.h ../include/dsa.h
 ca.o: ../include/e_os.h ../include/err.h ../include/evp.h ../include/idea.h
 ca.o: ../include/lhash.h ../include/md2.h ../include/md5.h ../include/mdc2.h
-ca.o: ../include/objects.h ../include/pem.h ../include/pem2.h
-ca.o: ../include/pkcs7.h ../include/rc2.h ../include/rc4.h ../include/rc5.h
-ca.o: ../include/ripemd.h ../include/rsa.h ../include/sha.h ../include/stack.h
-ca.o: ../include/txt_db.h ../include/x509.h ../include/x509_vfy.h
-ca.o: ../include/x509v3.h apps.h progs.h
+ca.o: ../include/objects.h ../include/opensslv.h ../include/pem.h
+ca.o: ../include/pem2.h ../include/pkcs7.h ../include/rc2.h ../include/rc4.h
+ca.o: ../include/rc5.h ../include/ripemd.h ../include/rsa.h ../include/sha.h
+ca.o: ../include/stack.h ../include/txt_db.h ../include/x509.h
+ca.o: ../include/x509_vfy.h ../include/x509v3.h apps.h progs.h
 ciphers.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h
 ciphers.o: ../include/bn.h ../include/buffer.h ../include/cast.h
 ciphers.o: ../include/crypto.h ../include/des.h ../include/dh.h
 ciphers.o: ../include/dsa.h ../include/e_os.h ../include/err.h ../include/evp.h
 ciphers.o: ../include/idea.h ../include/lhash.h ../include/md2.h
 ciphers.o: ../include/md5.h ../include/mdc2.h ../include/objects.h
-ciphers.o: ../include/pkcs7.h ../include/rc2.h ../include/rc4.h
-ciphers.o: ../include/rc5.h ../include/ripemd.h ../include/rsa.h
-ciphers.o: ../include/sha.h ../include/ssl.h ../include/ssl2.h
+ciphers.o: ../include/opensslv.h ../include/pkcs7.h ../include/rc2.h
+ciphers.o: ../include/rc4.h ../include/rc5.h ../include/ripemd.h
+ciphers.o: ../include/rsa.h ../include/sha.h ../include/ssl.h ../include/ssl2.h
 ciphers.o: ../include/ssl23.h ../include/ssl3.h ../include/stack.h
 ciphers.o: ../include/tls1.h ../include/x509.h ../include/x509_vfy.h apps.h
 ciphers.o: progs.h
@@ -176,75 +177,77 @@ crl.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h ../include/bn.h
 crl.o: ../include/buffer.h ../include/cast.h ../include/crypto.h
 crl.o: ../include/des.h ../include/dh.h ../include/dsa.h ../include/e_os.h
 crl.o: ../include/err.h ../include/evp.h ../include/idea.h ../include/md2.h
-crl.o: ../include/md5.h ../include/mdc2.h ../include/objects.h ../include/pem.h
-crl.o: ../include/pem2.h ../include/pkcs7.h ../include/rc2.h ../include/rc4.h
-crl.o: ../include/rc5.h ../include/ripemd.h ../include/rsa.h ../include/sha.h
-crl.o: ../include/stack.h ../include/x509.h ../include/x509_vfy.h
-crl.o: ../include/x509v3.h apps.h progs.h
+crl.o: ../include/md5.h ../include/mdc2.h ../include/objects.h
+crl.o: ../include/opensslv.h ../include/pem.h ../include/pem2.h
+crl.o: ../include/pkcs7.h ../include/rc2.h ../include/rc4.h ../include/rc5.h
+crl.o: ../include/ripemd.h ../include/rsa.h ../include/sha.h ../include/stack.h
+crl.o: ../include/x509.h ../include/x509_vfy.h ../include/x509v3.h apps.h
+crl.o: progs.h
 crl2p7.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h
 crl2p7.o: ../include/bn.h ../include/buffer.h ../include/cast.h
 crl2p7.o: ../include/crypto.h ../include/des.h ../include/dh.h ../include/dsa.h
 crl2p7.o: ../include/e_os.h ../include/err.h ../include/evp.h ../include/idea.h
 crl2p7.o: ../include/md2.h ../include/md5.h ../include/mdc2.h
-crl2p7.o: ../include/objects.h ../include/pem.h ../include/pem2.h
-crl2p7.o: ../include/pkcs7.h ../include/rc2.h ../include/rc4.h ../include/rc5.h
-crl2p7.o: ../include/ripemd.h ../include/rsa.h ../include/sha.h
-crl2p7.o: ../include/stack.h ../include/x509.h ../include/x509_vfy.h apps.h
-crl2p7.o: progs.h
+crl2p7.o: ../include/objects.h ../include/opensslv.h ../include/pem.h
+crl2p7.o: ../include/pem2.h ../include/pkcs7.h ../include/rc2.h
+crl2p7.o: ../include/rc4.h ../include/rc5.h ../include/ripemd.h
+crl2p7.o: ../include/rsa.h ../include/sha.h ../include/stack.h
+crl2p7.o: ../include/x509.h ../include/x509_vfy.h apps.h progs.h
 dgst.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h
 dgst.o: ../include/bn.h ../include/buffer.h ../include/cast.h
 dgst.o: ../include/crypto.h ../include/des.h ../include/dh.h ../include/dsa.h
 dgst.o: ../include/e_os.h ../include/err.h ../include/evp.h ../include/idea.h
 dgst.o: ../include/md2.h ../include/md5.h ../include/mdc2.h
-dgst.o: ../include/objects.h ../include/pem.h ../include/pem2.h
-dgst.o: ../include/pkcs7.h ../include/rc2.h ../include/rc4.h ../include/rc5.h
-dgst.o: ../include/ripemd.h ../include/rsa.h ../include/sha.h
+dgst.o: ../include/objects.h ../include/opensslv.h ../include/pem.h
+dgst.o: ../include/pem2.h ../include/pkcs7.h ../include/rc2.h ../include/rc4.h
+dgst.o: ../include/rc5.h ../include/ripemd.h ../include/rsa.h ../include/sha.h
 dgst.o: ../include/stack.h ../include/x509.h ../include/x509_vfy.h apps.h
 dgst.o: progs.h
 dh.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h ../include/bn.h
 dh.o: ../include/buffer.h ../include/cast.h ../include/crypto.h
 dh.o: ../include/des.h ../include/dh.h ../include/dsa.h ../include/e_os.h
 dh.o: ../include/err.h ../include/evp.h ../include/idea.h ../include/md2.h
-dh.o: ../include/md5.h ../include/mdc2.h ../include/objects.h ../include/pem.h
-dh.o: ../include/pem2.h ../include/pkcs7.h ../include/rc2.h ../include/rc4.h
-dh.o: ../include/rc5.h ../include/ripemd.h ../include/rsa.h ../include/sha.h
-dh.o: ../include/stack.h ../include/x509.h ../include/x509_vfy.h apps.h progs.h
+dh.o: ../include/md5.h ../include/mdc2.h ../include/objects.h
+dh.o: ../include/opensslv.h ../include/pem.h ../include/pem2.h
+dh.o: ../include/pkcs7.h ../include/rc2.h ../include/rc4.h ../include/rc5.h
+dh.o: ../include/ripemd.h ../include/rsa.h ../include/sha.h ../include/stack.h
+dh.o: ../include/x509.h ../include/x509_vfy.h apps.h progs.h
 dsa.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h ../include/bn.h
 dsa.o: ../include/buffer.h ../include/cast.h ../include/crypto.h
 dsa.o: ../include/des.h ../include/dh.h ../include/dsa.h ../include/e_os.h
 dsa.o: ../include/err.h ../include/evp.h ../include/idea.h ../include/md2.h
-dsa.o: ../include/md5.h ../include/mdc2.h ../include/objects.h ../include/pem.h
-dsa.o: ../include/pem2.h ../include/pkcs7.h ../include/rc2.h ../include/rc4.h
-dsa.o: ../include/rc5.h ../include/ripemd.h ../include/rsa.h ../include/sha.h
-dsa.o: ../include/stack.h ../include/x509.h ../include/x509_vfy.h apps.h
-dsa.o: progs.h
+dsa.o: ../include/md5.h ../include/mdc2.h ../include/objects.h
+dsa.o: ../include/opensslv.h ../include/pem.h ../include/pem2.h
+dsa.o: ../include/pkcs7.h ../include/rc2.h ../include/rc4.h ../include/rc5.h
+dsa.o: ../include/ripemd.h ../include/rsa.h ../include/sha.h ../include/stack.h
+dsa.o: ../include/x509.h ../include/x509_vfy.h apps.h progs.h
 dsaparam.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h
 dsaparam.o: ../include/bn.h ../include/buffer.h ../include/cast.h
 dsaparam.o: ../include/crypto.h ../include/des.h ../include/dh.h
 dsaparam.o: ../include/dsa.h ../include/e_os.h ../include/err.h
 dsaparam.o: ../include/evp.h ../include/idea.h ../include/md2.h
 dsaparam.o: ../include/md5.h ../include/mdc2.h ../include/objects.h
-dsaparam.o: ../include/pem.h ../include/pem2.h ../include/pkcs7.h
-dsaparam.o: ../include/rand.h ../include/rc2.h ../include/rc4.h
-dsaparam.o: ../include/rc5.h ../include/ripemd.h ../include/rsa.h
-dsaparam.o: ../include/sha.h ../include/stack.h ../include/x509.h
-dsaparam.o: ../include/x509_vfy.h apps.h progs.h
+dsaparam.o: ../include/opensslv.h ../include/pem.h ../include/pem2.h
+dsaparam.o: ../include/pkcs7.h ../include/rand.h ../include/rc2.h
+dsaparam.o: ../include/rc4.h ../include/rc5.h ../include/ripemd.h
+dsaparam.o: ../include/rsa.h ../include/sha.h ../include/stack.h
+dsaparam.o: ../include/x509.h ../include/x509_vfy.h apps.h progs.h
 enc.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h ../include/bn.h
 enc.o: ../include/buffer.h ../include/cast.h ../include/crypto.h
 enc.o: ../include/des.h ../include/dh.h ../include/dsa.h ../include/e_os.h
 enc.o: ../include/err.h ../include/evp.h ../include/idea.h ../include/md2.h
-enc.o: ../include/md5.h ../include/mdc2.h ../include/objects.h ../include/pem.h
-enc.o: ../include/pem2.h ../include/pkcs7.h ../include/rc2.h ../include/rc4.h
-enc.o: ../include/rc5.h ../include/ripemd.h ../include/rsa.h ../include/sha.h
-enc.o: ../include/stack.h ../include/x509.h ../include/x509_vfy.h apps.h
-enc.o: progs.h
+enc.o: ../include/md5.h ../include/mdc2.h ../include/objects.h
+enc.o: ../include/opensslv.h ../include/pem.h ../include/pem2.h
+enc.o: ../include/pkcs7.h ../include/rc2.h ../include/rc4.h ../include/rc5.h
+enc.o: ../include/ripemd.h ../include/rsa.h ../include/sha.h ../include/stack.h
+enc.o: ../include/x509.h ../include/x509_vfy.h apps.h progs.h
 errstr.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h
 errstr.o: ../include/bn.h ../include/buffer.h ../include/cast.h
 errstr.o: ../include/crypto.h ../include/des.h ../include/dh.h ../include/dsa.h
 errstr.o: ../include/e_os.h ../include/err.h ../include/evp.h ../include/idea.h
 errstr.o: ../include/lhash.h ../include/md2.h ../include/md5.h
-errstr.o: ../include/mdc2.h ../include/objects.h ../include/pkcs7.h
-errstr.o: ../include/rc2.h ../include/rc4.h ../include/rc5.h
+errstr.o: ../include/mdc2.h ../include/objects.h ../include/opensslv.h
+errstr.o: ../include/pkcs7.h ../include/rc2.h ../include/rc4.h ../include/rc5.h
 errstr.o: ../include/ripemd.h ../include/rsa.h ../include/sha.h
 errstr.o: ../include/ssl.h ../include/ssl2.h ../include/ssl23.h
 errstr.o: ../include/ssl3.h ../include/stack.h ../include/tls1.h
@@ -254,39 +257,41 @@ gendh.o: ../include/bn.h ../include/buffer.h ../include/cast.h
 gendh.o: ../include/crypto.h ../include/des.h ../include/dh.h ../include/dsa.h
 gendh.o: ../include/e_os.h ../include/err.h ../include/evp.h ../include/idea.h
 gendh.o: ../include/md2.h ../include/md5.h ../include/mdc2.h
-gendh.o: ../include/objects.h ../include/pem.h ../include/pem2.h
-gendh.o: ../include/pkcs7.h ../include/rand.h ../include/rc2.h ../include/rc4.h
-gendh.o: ../include/rc5.h ../include/ripemd.h ../include/rsa.h ../include/sha.h
-gendh.o: ../include/stack.h ../include/x509.h ../include/x509_vfy.h apps.h
-gendh.o: progs.h
+gendh.o: ../include/objects.h ../include/opensslv.h ../include/pem.h
+gendh.o: ../include/pem2.h ../include/pkcs7.h ../include/rand.h
+gendh.o: ../include/rc2.h ../include/rc4.h ../include/rc5.h ../include/ripemd.h
+gendh.o: ../include/rsa.h ../include/sha.h ../include/stack.h ../include/x509.h
+gendh.o: ../include/x509_vfy.h apps.h progs.h
 gendsa.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h
 gendsa.o: ../include/bn.h ../include/buffer.h ../include/cast.h
 gendsa.o: ../include/crypto.h ../include/des.h ../include/dh.h ../include/dsa.h
 gendsa.o: ../include/e_os.h ../include/err.h ../include/evp.h ../include/idea.h
 gendsa.o: ../include/md2.h ../include/md5.h ../include/mdc2.h
-gendsa.o: ../include/objects.h ../include/pem.h ../include/pem2.h
-gendsa.o: ../include/pkcs7.h ../include/rand.h ../include/rc2.h
-gendsa.o: ../include/rc4.h ../include/rc5.h ../include/ripemd.h
-gendsa.o: ../include/rsa.h ../include/sha.h ../include/stack.h
-gendsa.o: ../include/x509.h ../include/x509_vfy.h apps.h progs.h
+gendsa.o: ../include/objects.h ../include/opensslv.h ../include/pem.h
+gendsa.o: ../include/pem2.h ../include/pkcs7.h ../include/rand.h
+gendsa.o: ../include/rc2.h ../include/rc4.h ../include/rc5.h
+gendsa.o: ../include/ripemd.h ../include/rsa.h ../include/sha.h
+gendsa.o: ../include/stack.h ../include/x509.h ../include/x509_vfy.h apps.h
+gendsa.o: progs.h
 genrsa.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h
 genrsa.o: ../include/bn.h ../include/buffer.h ../include/cast.h
 genrsa.o: ../include/crypto.h ../include/des.h ../include/dh.h ../include/dsa.h
 genrsa.o: ../include/e_os.h ../include/err.h ../include/evp.h ../include/idea.h
 genrsa.o: ../include/md2.h ../include/md5.h ../include/mdc2.h
-genrsa.o: ../include/objects.h ../include/pem.h ../include/pem2.h
-genrsa.o: ../include/pkcs7.h ../include/rand.h ../include/rc2.h
-genrsa.o: ../include/rc4.h ../include/rc5.h ../include/ripemd.h
-genrsa.o: ../include/rsa.h ../include/sha.h ../include/stack.h
-genrsa.o: ../include/x509.h ../include/x509_vfy.h apps.h progs.h
+genrsa.o: ../include/objects.h ../include/opensslv.h ../include/pem.h
+genrsa.o: ../include/pem2.h ../include/pkcs7.h ../include/rand.h
+genrsa.o: ../include/rc2.h ../include/rc4.h ../include/rc5.h
+genrsa.o: ../include/ripemd.h ../include/rsa.h ../include/sha.h
+genrsa.o: ../include/stack.h ../include/x509.h ../include/x509_vfy.h apps.h
+genrsa.o: progs.h
 nseq.o: ../include/asn1.h ../include/bio.h ../include/blowfish.h
 nseq.o: ../include/bn.h ../include/buffer.h ../include/cast.h
 nseq.o: ../include/crypto.h ../include/des.h ../include/dh.h ../include/dsa.h
 nseq.o: ../include/e_os.h ../include/err.h ../include/evp.h ../include/idea.h
 nseq.o: ../include/md2.h ../include/md5.h ../include/mdc2.h
-nseq.o: ../include/objects.h ../include/pem.h ../include/pem2.h