generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
10,765 Commits 16 Branches 258 Tags
Commit Graph

1476 Commits

Author SHA1 Message Date
Andy Polyakov
d5371324d9 s3/s3_cbc.c: allow for compilations with NO_SHA256|512. 2013-02-01 10:31:59 +01:00
Andy Polyakov
36260233e7 ssl/s3_cbc.c: md_state alignment portability fix. 
RISCs are picky and alignment granted by compiler for md_state can be
insufficient for SHA512.
 2013-02-01 10:31:52 +01:00
Andy Polyakov
cab13fc847 ssl/s3_cbc.c: uint64_t portability fix. 
Break dependency on uint64_t. It's possible to declare bits as
unsigned int, because TLS packets are limited in size and 32-bit
value can't overflow.
 2013-02-01 10:31:23 +01:00
Dr. Stephen Henson
34ab3c8c71 typo. 2013-01-31 23:04:39 +00:00
Dr. Stephen Henson
b908e88ec1 Timing fix mitigation for FIPS mode. 
We have to use EVP in FIPS mode so we can only partially mitigate
timing differences.

Make an extra call to EVP_DigestSignUpdate to hash additonal blocks
to cover any timing differences caused by removal of padding.
 2013-01-31 12:34:10 +00:00
Ben Laurie
014265eb02 Oops. Add missing file. 2013-01-28 18:24:55 +00:00
Ben Laurie
9f27de170d Update DTLS code to match CBC decoding in TLS. 
This change updates the DTLS code to match the constant-time CBC
behaviour in the TLS.
 2013-01-28 17:34:33 +00:00
Ben Laurie
6cb19b7681 Don't crash when processing a zero-length, TLS >= 1.1 record. 
The previous CBC patch was bugged in that there was a path through enc()
in s3_pkt.c/d1_pkt.c which didn't set orig_len. orig_len would be left
at the previous value which could suggest that the packet was a
sufficient length when it wasn't.
 2013-01-28 17:33:18 +00:00
Ben Laurie
e130841bcc Make CBC decoding constant time. 
This patch makes the decoding of SSLv3 and TLS CBC records constant
time. Without this, a timing side-channel can be used to build a padding
oracle and mount Vaudenay's attack.

This patch also disables the stitched AESNI+SHA mode pending a similar
fix to that code.

In order to be easy to backport, this change is implemented in ssl/,
rather than as a generic AEAD mode. In the future this should be changed
around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
 2013-01-28 17:31:49 +00:00
Ben Laurie
2ee798880a Add and use a constant-time memcmp. 
This change adds CRYPTO_memcmp, which compares two vectors of bytes in
an amount of time that's independent of their contents. It also changes
several MAC compares in the code to use this over the standard memcmp,
which may leak information about the size of a matching prefix.
 2013-01-28 17:30:38 +00:00
Dr. Stephen Henson
7c3562947a reject zero length point format list or supported curves extensions 2012-11-22 14:15:25 +00:00
Dr. Stephen Henson
07eaaab2f6 add "missing" TLSv1.2 cipher alias 2012-11-15 19:15:20 +00:00
Dr. Stephen Henson
353e845120 Minor enhancement to PR#2836 fix. Instead of modifying SSL_get_certificate 
change the current certificate (in s->cert->key) to the one used and then
SSL_get_certificate and SSL_get_privatekey will automatically work.

Note for 1.0.1 and earlier also includes backport of the function
ssl_get_server_send_pkey.
 2012-09-21 14:01:59 +00:00
Richard Levitte
d1451f18d9 * ssl/t1_enc.c (tls1_change_cipher_state): Stupid bug. Fortunately in 
debugging code that's seldom used.
 2012-09-21 13:08:28 +00:00
Ben Laurie
70d91d60bc Call OCSP Stapling callback after ciphersuite has been chosen, so the 
right response is stapled. Also change SSL_get_certificate() so it
returns the certificate actually sent.

See http://rt.openssl.org/Ticket/Display.html?id=2836.
 2012-09-17 14:39:38 +00:00
Dr. Stephen Henson
c64c0e03d3 don't use pseudo digests for default values of keys 2012-06-27 14:11:40 +00:00
Ben Laurie
af454b5bb0 Reduce version skew. 2012-06-08 09:18:47 +00:00
Andy Polyakov
5b2bbf37fa s2_clnt.c: compensate for compiler bug [from HEAD]. 2012-05-16 18:22:27 +00:00
Dr. Stephen Henson
6e164e5c3d PR: 2811 
Reported by: Phil Pennock <openssl-dev@spodhuis.org>

Make renegotiation work for TLS 1.2, 1.1 by not using a lower record
version client hello workaround if renegotiating.
 2012-05-11 13:32:26 +00:00
Dr. Stephen Henson
1b452133ae PR: 2806 
Submitted by: PK <runningdoglackey@yahoo.com>

Correct ciphersuite signature algorithm definitions.
 2012-05-10 18:24:32 +00:00
Dr. Stephen Henson
d414a5a0f0 Sanity check record length before skipping explicit IV in TLS 1.2, 1.1 and 
DTLS to fix DoS attack.

Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
fuzzing as a service testing platform.
(CVE-2012-2333)
 2012-05-10 15:10:15 +00:00
Richard Levitte
9eb4460e68 Don't forget to install srtp.h as well 2012-05-10 15:01:22 +00:00
Dr. Stephen Henson
6984d16671 oops, revert unrelated change 2012-05-10 13:38:18 +00:00
Dr. Stephen Henson
5b9d0995a1 Reported by: Solar Designer of Openwall 
Make sure tkeylen is initialised properly when encrypting CMS messages.
 2012-05-10 13:34:22 +00:00
Dr. Stephen Henson
c76b7a1a82 Don't try to use unvalidated composite ciphers in FIPS mode 2012-04-26 18:49:45 +00:00
Dr. Stephen Henson
502dfeb8de Change value of SSL_OP_NO_TLSv1_1 to avoid clash with SSL_OP_ALL and 
OpenSSL 1.0.0. Add CHANGES entry noting the consequences.
 2012-04-25 23:08:44 +00:00
Andy Polyakov
5bbed29518 s23_clnt.c: ensure interoperability by maitaining client "version capability" 
vector contiguous [from HEAD].
PR: 2802
 2012-04-25 22:07:23 +00:00
Dr. Stephen Henson
dedfe959dd correct error code 2012-04-18 14:53:48 +00:00
Bodo Möller
4d936ace08 Disable SHA-2 ciphersuites in < TLS 1.2 connections. 
(TLS 1.2 clients could end up negotiating these with an OpenSSL server
with TLS 1.2 disabled, which is problematic.)

Submitted by: Adam Langley
 2012-04-17 15:20:17 +00:00
Dr. Stephen Henson
89bd25eb26 Additional workaround for PR#2771 
If OPENSSL_MAX_TLS1_2_CIPHER_LENGTH is set then limit the size of client
ciphersuites to this value. A value of 50 should be sufficient.

Document workarounds in CHANGES.
 2012-04-17 14:41:23 +00:00
Dr. Stephen Henson
4a1cf50187 Partial workaround for PR#2771. 
Some servers hang when presented with a client hello record length exceeding
255 bytes but will work with longer client hellos if the TLS record version
in client hello does not exceed TLS v1.0. Unfortunately this doesn't fix all
cases...
 2012-04-17 13:20:19 +00:00
Andy Polyakov
32e12316e5 OPENSSL_NO_SOCK fixes [from HEAD]. 
PR: 2791
Submitted by: Ben Noordhuis
 2012-04-16 17:43:15 +00:00
Andy Polyakov
c2770c0e0e s3_srvr.c: fix typo [from HEAD]. 
PR: 2538
 2012-04-15 17:23:41 +00:00
Andy Polyakov
371056f2b9 e_aes_cbc_hmac_sha1.c: handle zero-length payload and engage empty frag 
countermeasure [from HEAD].

PR: 2778
 2012-04-15 14:23:03 +00:00
Andy Polyakov
3f98d7c0b5 ssl/ssl_ciph.c: interim solution for assertion in d1_pkt.c(444) [from HEAD]. 
PR: 2778
 2012-04-04 20:51:27 +00:00
Dr. Stephen Henson
63e8f16737 PR: 2778(part) 
Submitted by: John Fitzgibbon <john_fitzgibbon@yahoo.com>

Time is always encoded as 4 bytes, not sizeof(Time).
 2012-03-31 18:02:43 +00:00
Dr. Stephen Henson
418044cbab Experimental workaround to large client hello issue (see PR#2771). 
If OPENSSL_NO_TLS1_2_CLIENT is set then TLS v1.2 is disabled for clients
only.
 2012-03-29 19:08:54 +00:00
Dr. Stephen Henson
78c5d2a9bb use client version when deciding whether to send supported signature algorithms extension 2012-03-21 21:32:57 +00:00
Andy Polyakov
9cc42cb091 ssl/t1_enc.c: pay attention to EVP_CIPH_FLAG_CUSTOM_CIPHER [from HEAD]. 2012-03-13 19:21:15 +00:00
Dr. Stephen Henson
267c950c5f Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> 
Add more extension names in s_cb.c extension printing code.
 2012-03-09 18:37:41 +00:00
Dr. Stephen Henson
ce1605b508 PR: 2756 
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Fix DTLS timeout handling.
 2012-03-09 15:52:20 +00:00
Dr. Stephen Henson
25bfdca16a PR: 2755 
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Reduce MTU after failed transmissions.
 2012-03-06 13:47:27 +00:00
Dr. Stephen Henson
9c284f9651 PR: 2748 
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Fix possible DTLS timer deadlock.
 2012-03-06 13:24:16 +00:00
Dr. Stephen Henson
a54ce007e6 PR: 2739 
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Fix padding bugs in Heartbeat support.
 2012-02-27 16:38:10 +00:00
Dr. Stephen Henson
f1fa05b407 ABI compliance fixes. 
Move new structure fields to end of structures.

Import library codes from 1.0.0 and recreate new ones.
 2012-02-22 14:01:44 +00:00
Dr. Stephen Henson
b935714237 typo 2012-02-17 17:31:32 +00:00
Dr. Stephen Henson
a8314df902 Fix bug in CVE-2011-4619: check we have really received a client hello 
before rejecting multiple SGC restarts.
 2012-02-16 15:25:39 +00:00
Dr. Stephen Henson
d40abf1689 Submitted by: Eric Rescorla <ekr@rtfm.com> 
Further fixes for use_srtp extension.
 2012-02-11 22:53:48 +00:00
Dr. Stephen Henson
c489ea7d01 PR: 2704 
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>

Fix srp extension.
 2012-02-10 20:08:49 +00:00
Dr. Stephen Henson
943cc09d8a Submitted by: Eric Rescorla <ekr@rtfm.com> 
Fix encoding of use_srtp extension to be compliant with RFC5764
 2012-02-10 00:03:37 +00:00