summaryrefslogtreecommitdiffstats
path: root/ssl/t1_lib.c
AgeCommit message (Collapse)Author
2015-03-19Fix for CVE-2015-0291Dr. Stephen Henson
If a client renegotiates using an invalid signature algorithms extension it will crash a server with a NULL pointer dereference. Thanks to David Ramos of Stanford University for reporting this bug. CVE-2015-0291 Reviewed-by: Tim Hudson <tjh@openssl.org> Conflicts: ssl/t1_lib.c
2015-03-12SSL_check_chain fixMatt Caswell
If SSL_check_chain is called with a NULL X509 object or a NULL EVP_PKEY or the type of the public key is unrecognised then the local variable |cpk| in tls1_check_chain does not get initialised. Subsequently an attempt is made to deref it (after the "end" label), and a seg fault will result. Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit d813f9eb383a93e472e69750cd1edbb170205ad2)
2015-01-24Fix segfault with empty fields as last in the config.Kurt Roeckx
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-23FIPS build fixes.Dr. Stephen Henson
PR#3673 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22Re-align some comments after running the reformat script.OpenSSL_1_0_2-post-reformatMatt Caswell
This should be a one off operation (subsequent invokation of the script should not move them) This commit is for the 1.0.2 changes Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22Run util/openssl-format-source -v -c .Matt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22indent has problems with comments that are on the right hand side of a line.Matt Caswell
Sometimes it fails to format them very well, and sometimes it corrupts them! This commit moves some particularly problematic ones. Conflicts: crypto/bn/bn.h crypto/ec/ec_lcl.h crypto/rsa/rsa.h demos/engines/ibmca/hw_ibmca.c ssl/ssl.h ssl/ssl3.h Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22Fix source where indent will not be able to copeMatt Caswell
Conflicts: apps/ciphers.c ssl/s3_pkt.c Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22mark all block comments that need format preserving so thatTim Hudson
indent will not alter them when reformatting comments (cherry picked from commit 1d97c8435171a7af575f73c526d79e1ef0ee5960) Conflicts: crypto/bn/bn_lcl.h crypto/bn/bn_prime.c crypto/engine/eng_all.c crypto/rc4/rc4_utl.c crypto/sha/sha.h ssl/kssl.c ssl/t1_lib.c Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-05Fix building with no-srtpPiotr Sikora
RT3638 Reviewed-by: Emilia Käsper <emilia@openssl.org> Conflicts: ssl/t1_lib.c
2015-01-02Clear existing extension state.Dr. Stephen Henson
When parsing ClientHello clear any existing extension state from SRP login and SRTP profile. Thanks to Karthikeyan Bhargavan for reporting this issue. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 4f605ccb779e32a770093d687e0554e0bbb137d3) Conflicts: ssl/t1_lib.c
2014-12-16Add OPENSSL_NO_ECDH guardsMatt Caswell
Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit af6e2d51bfeabbae827030d4c9d58a8f7477c4a0)
2014-12-05Clarify the return values for SSL_get_shared_curve.Emilia Kasper
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 376e2ca3e3525290619602dc6013c97c9653c037)
2014-12-05Add extra checks for odd-length EC curve lists.Emilia Kasper
Odd-length lists should be rejected everywhere upon parsing. Nevertheless, be extra careful and add guards against off-by-one reads. Also, drive-by replace inexplicable double-negation with an explicit comparison. Reviewed-by: Matt Caswell <matt@openssl.org>
2014-12-05Reject elliptic curve lists of odd lengths.Emilia Kasper
The Supported Elliptic Curves extension contains a vector of NamedCurves of 2 bytes each, so the total length must be even. Accepting odd-length lists was observed to lead to a non-exploitable one-byte out-of-bounds read in the latest development branches (1.0.2 and master). Released versions of OpenSSL are not affected. Thanks to Felix Groebert of the Google Security Team for reporting this issue. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 33d5ba862939ff8db70a9e36fc9a326fab3e8d98)
2014-11-20Fix SuiteB chain checking logic.Dr. Stephen Henson
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 7255ca99df1f2d83d99d113dd5ca54b88d50e72b)
2014-11-20Ensure SSL3_FLAGS_CCS_OK (or d1->change_cipher_spec_ok for DTLS) is resetEmilia Kasper
once the ChangeCipherSpec message is received. Previously, the server would set the flag once at SSL3_ST_SR_CERT_VRFY and again at SSL3_ST_SR_FINISHED. This would allow a second CCS to arrive and would corrupt the server state. (Because the first CCS would latch the correct keys and subsequent CCS messages would have to be encrypted, a MitM attacker cannot exploit this, though.) Thanks to Joeri de Ruiter for reporting this issue. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit e94a6c0ede623960728415b68650a595e48f5a43)
2014-11-20Reset s->tlsext_ticket_expected in ssl_scan_serverhello_tlsext.Emilia Kasper
This ensures that it's zeroed even if the SSL object is reused (as in ssltest.c). It also ensures that it applies to DTLS, too. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit a06cd5d056c6a5b1d161786873e21a5e53d554d8)
2014-11-19Process signature algorithms before deciding on certificate.Dr. Stephen Henson
The supported signature algorithms extension needs to be processed before the certificate to use is decided and before a cipher is selected (as the set of shared signature algorithms supported may impact the choice). Reviewed-by: Matt Caswell <matt@openssl.org>
2014-11-18Added RFC 7027 referencesMatt Caswell
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2014-11-18Added OPENSSL_NO_EC2M guards around the default EC curvesMatt Caswell
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2014-10-24Process signature algorithms in ClientHello late.Dr. Stephen Henson
Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit c800c27a8c47c8e63254ec594682452c296f1e8e) Conflicts: ssl/ssl.h ssl/ssl_err.c ssl/ssl_locl.h
2014-10-23Parse custom extensions after SNI.Dr. Stephen Henson
Since SNI will typically switch the SSL_CTX structure to the one corresponding to the appopriate server we need to parse custom extensions using the switched SSL_CTX not the original one. This is done by parsing custom extensions *after* SNI. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-10-15Fix for session tickets memory leak.Dr. Stephen Henson
CVE-2014-3567 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 5dc6070a03779cd524f0e67f76c945cb0ac38320)
2014-10-15Fix for SRTP Memory LeakMatt Caswell
CVE-2014-3513 This issue was reported to OpenSSL on 26th September 2014, based on an original issue and patch developed by the LibreSSL project. Further analysis of the issue was performed by the OpenSSL team. The fix was developed by the OpenSSL team. Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-09-25Don't allow non-FIPS curves in FIPS mode.Dr. Stephen Henson
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-08-28New extension callback features.Dr. Stephen Henson
Support separate parse and add callback arguments. Add new callback so an application can free extension data. Change return value for send functions so < 0 is an error 0 omits extension and > 0 includes it. This is more consistent with the behaviour of other functions in OpenSSL. Modify parse_cb handling so <= 0 is an error. Make SSL_CTX_set_custom_cli_ext and SSL_CTX_set_custom_cli_ext argument order consistent. NOTE: these changes WILL break existing code. Remove (now inaccurate) in line documentation. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 33f653adf3bff5b0795e22de1f54b7c5472252d0)
2014-08-28Remove serverinfo checks.Dr. Stephen Henson
Since sanity checks are performed for all custom extensions the serverinfo checks are no longer needed. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 707b026d7871eb12c23671c975e6a15a8c331785) Conflicts: ssl/ssl3.h ssl/t1_lib.c
2014-08-28Add custom extension sanity checks.Dr. Stephen Henson
Reject attempts to use extensions handled internally. Add flags to each extension structure to indicate if an extension has been sent or received. Enforce RFC5246 compliance by rejecting duplicate extensions and unsolicited extensions and only send a server extension if we have sent the corresponding client extension. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 28ea0a0c6a5e4e217c405340fa22a8503c7a17db)
2014-08-28Custom extension revision.Dr. Stephen Henson
Use the same structure for client and server custom extensions. Add utility functions in new file t1_ext.c. Use new utility functions to handle custom server and client extensions and remove a lot of code duplication. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit ecf4d660902dcef6e0afc51d52926f00d409ee6b) Conflicts: ssl/ssl_lib.c ssl/ssl_locl.h ssl/t1_lib.c
2014-08-28Revision of custom extension code.Dr. Stephen Henson
Move custom extension structures from SSL_CTX to CERT structure. This change means the form can be revised in future without binary compatibility issues. Also since CERT is part of SSL structures so per-SSL custom extensions could be supported in future as well as per SSL_CTX. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit b83294fe3022b9d5d525ccdcfeb53d39c25b05bd) Conflicts: ssl/ssl.h ssl/ssl_cert.c ssl/ssl_locl.h
2014-08-06Fix SRP ciphersuite DoS vulnerability.Dr. Stephen Henson
If a client attempted to use an SRP ciphersuite and it had not been set up correctly it would crash with a null pointer read. A malicious server could exploit this in a DoS attack. Thanks to Joonas Kuorilehto and Riku Hietamäki from Codenomicon for reporting this issue. CVE-2014-2970 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-08-06Fix race condition in ssl_parse_serverhello_tlsextGabor Tyukasz
CVE-2014-3509 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2014-07-02Fix possible buffer overrun.Ben Laurie
(cherry picked from commit 2db3ea29298bdc347f15fbfab6d5746022f05101) Conflicts: ssl/ssl_locl.h ssl/t1_lib.c
2014-06-29Fix memory leak.Dr. Stephen Henson
PR#2531 (cherry picked from commit 44724beeadf95712a42a8b21dc71bf110e89a262)
2014-06-02Check there is enough room for extension.David Benjamin
(cherry picked from commit 7d89b3bf42e4b4067371ab33ef7631434e41d1e4)
2014-06-01Option to disable padding extension.Dr. Stephen Henson
Add TLS padding extension to SSL_OP_ALL so it is used with other "bugs" options and can be turned off. This replaces SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG which is an ancient option referring to SSLv2 and SSLREF. PR#3336 (cherry picked from commit 758415b2259fa45d3fe17d8e53ae1341b7b6e482) Conflicts: ssl/t1_lib.c
2014-04-07Add heartbeat extension bounds check.Dr. Stephen Henson
A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. Thanks for Neel Mehta of Google Security for discovering this bug and to Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for preparing the fix (CVE-2014-0160) (cherry picked from commit 96db9023b881d7cd9f379b0c154650d6c108e9a3)
2014-04-05Set TLS padding extension value.Dr. Stephen Henson
Enable TLS padding extension using official value from: http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml (cherry picked from commit cd6bd5ffda616822b52104fee0c4c7d623fd4f53) Conflicts: CHANGES
2014-03-27Fix memory leak with client auth.Dr. Stephen Henson
2014-02-09Make it build.Ben Laurie
(cherry picked from commit a6a48e87bc469f37ed1c53d0e4d22faaa0a5adf3) Conflicts: ssl/s3_clnt.c ssl/t1_lib.c
2014-02-08Don't break out of the custom extension callback loop - continue insteadScott Deboy
The contract for custom extension callbacks has changed - all custom extension callbacks are triggered
2014-02-08Fix whitespace, new-style comments.Ben Laurie
2014-02-08Re-add alert variables removed during rebaseScott Deboy
Whitespace fixes (cherry picked from commit e9add063b50e8a460d5636055156d2760c2fe29f) Conflicts: ssl/s3_clnt.c
2014-02-08Update custom TLS extension and supplemental data 'generate' callbacks to ↵Scott Deboy
support sending an alert. If multiple TLS extensions are expected but not received, the TLS extension and supplemental data 'generate' callbacks are the only chance for the receive-side to trigger a specific TLS alert during the handshake. Removed logic which no-op'd TLS extension generate callbacks (as the generate callbacks need to always be called in order to trigger alerts), and updated the serverinfo-specific custom TLS extension callbacks to track which custom TLS extensions were received by the client, where no-ops for 'generate' callbacks are appropriate. (cherry picked from commit ac20719d994729970eb3b775c7bffa81f0e9f960) Conflicts: ssl/t1_lib.c
2014-02-08Add callbacks supporting generation and retrieval of supplemental data ↵Scott Deboy
entries, facilitating RFC 5878 (TLS auth extensions) Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API Tests exercising the new supplemental data registration and callback api can be found in ssltest.c. Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation. (cherry picked from commit 36086186a9b90cdad0d2cd0a598a10f03f8f4bcc) Conflicts: Configure apps/s_client.c apps/s_server.c ssl/ssl.h ssl/ssl3.h ssl/ssltest.c
2014-01-16Omit initial status request callback check.Kaspar Brand
PR#3178 (cherry picked from commit d0b039d4a3a19b106cc2cb938125b86aca4974aa)
2013-12-29Update curve list size.Dr. Stephen Henson
2013-12-13Backport TLS padding extension from master.Dr. Stephen Henson
2013-11-14Fix compilation with no-nextprotoneg.Piotr Sikora
PR#3106
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-03 01:10:45 +0000