OpenSSL 1.0.0f: import upstream source

26 files changed, 191 insertions, 86 deletions

diff --git a/src/lib/libcrypto/bio/bf_buff.c b/src/lib/libcrypto/bio/bf_buff.c
index c1fd75aaad..4b5a132d8a 100644
--- a/src/lib/libcrypto/bio/bf_buff.c
+++ b/src/lib/libcrypto/bio/bf_buff.c
@@ -209,7 +209,7 @@ start:
         /* add to buffer and return */
         if (i >= inl)
                 {
-                memcpy(&(ctx->obuf[ctx->obuf_len]),in,inl);
+                memcpy(&(ctx->obuf[ctx->obuf_off+ctx->obuf_len]),in,inl);
                 ctx->obuf_len+=inl;
                 return(num+inl);
                 }
@@ -219,7 +219,7 @@ start:
                 {
                 if (i > 0) /* lets fill it up if we can */
                         {
-                        memcpy(&(ctx->obuf[ctx->obuf_len]),in,i);
+                        memcpy(&(ctx->obuf[ctx->obuf_off+ctx->obuf_len]),in,i);
                         in+=i;
                         inl-=i;
                         num+=i;
@@ -294,9 +294,9 @@ static long buffer_ctrl(BIO *b, int cmd, long num, void *ptr)
         case BIO_C_GET_BUFF_NUM_LINES:
                 ret=0;
                 p1=ctx->ibuf;
-                for (i=ctx->ibuf_off; i<ctx->ibuf_len; i++)
+                for (i=0; i<ctx->ibuf_len; i++)
                         {
-                        if (p1[i] == '\n') ret++;
+                        if (p1[ctx->ibuf_off + i] == '\n') ret++;
                         }
                 break;
         case BIO_CTRL_WPENDING:
@@ -399,17 +399,18 @@ static long buffer_ctrl(BIO *b, int cmd, long num, void *ptr)
                 for (;;)
                         {
                         BIO_clear_retry_flags(b);
-                        if (ctx->obuf_len > ctx->obuf_off)
+                        if (ctx->obuf_len > 0)
                                 {
                                 r=BIO_write(b->next_bio,
                                         &(ctx->obuf[ctx->obuf_off]),
-                                        ctx->obuf_len-ctx->obuf_off);
+                                        ctx->obuf_len);
 #if 0
-fprintf(stderr,"FLUSH [%3d] %3d -> %3d\n",ctx->obuf_off,ctx->obuf_len-ctx->obuf_off,r);
+fprintf(stderr,"FLUSH [%3d] %3d -> %3d\n",ctx->obuf_off,ctx->obuf_len,r);
 #endif
                                 BIO_copy_next_retry(b);
                                 if (r <= 0) return((long)r);
                                 ctx->obuf_off+=r;
+                                ctx->obuf_len-=r;
                                 }
                         else
                                 {
diff --git a/src/lib/libcrypto/bio/bio.h b/src/lib/libcrypto/bio/bio.h
index 152802fbdf..ab47abcf14 100644
--- a/src/lib/libcrypto/bio/bio.h
+++ b/src/lib/libcrypto/bio/bio.h
@@ -306,6 +306,15 @@ DECLARE_STACK_OF(BIO)
 
 typedef struct bio_f_buffer_ctx_struct
         {
+        /* Buffers are setup like this:
+         *
+         * <---------------------- size ----------------------->
+         * +---------------------------------------------------+
+         * | consumed | remaining          | free space        |
+         * +---------------------------------------------------+
+         * <-- off --><------- len ------->
+         */
+
         /* BIO *bio; */ /* this is now in the BIO struct */
         int ibuf_size;  /* how big is the input buffer */
         int obuf_size;  /* how big is the output buffer */
diff --git a/src/lib/libcrypto/bn/asm/ppc.pl b/src/lib/libcrypto/bn/asm/ppc.pl
index 37c65d3511..f4093177e6 100644
--- a/src/lib/libcrypto/bn/asm/ppc.pl
+++ b/src/lib/libcrypto/bn/asm/ppc.pl
@@ -949,7 +949,7 @@ $data=<<EOF;
         addze   r11,r0
                                         #mul_add_c(a[3],b[2],c3,c1,c2);
         $LD     r6,`3*$BNSZ`(r4)
-        $LD     r7,`2*$BNSZ`(r4)
+        $LD     r7,`2*$BNSZ`(r5)
         $UMULL  r8,r6,r7
         $UMULH  r9,r6,r7
         addc    r12,r8,r12
diff --git a/src/lib/libcrypto/bn/asm/x86-mont.pl b/src/lib/libcrypto/bn/asm/x86-mont.pl
index 5cd3cd2ed5..e8f6b05084 100755
--- a/src/lib/libcrypto/bn/asm/x86-mont.pl
+++ b/src/lib/libcrypto/bn/asm/x86-mont.pl
@@ -527,8 +527,10 @@ $sbit=$num;
         &jle    (&label("sqradd"));
 
         &mov    ($carry,"edx");
-        &lea    ("edx",&DWP(0,$sbit,"edx",2));
+        &add    ("edx","edx");
         &shr    ($carry,31);
+        &add    ("edx",$sbit);
+        &adc    ($carry,0);
 &set_label("sqrlast");
         &mov    ($word,$_n0);
         &mov    ($inp,$_np);
diff --git a/src/lib/libcrypto/bn/bn_blind.c b/src/lib/libcrypto/bn/bn_blind.c
index e060592fdc..9ed8bc2b40 100644
--- a/src/lib/libcrypto/bn/bn_blind.c
+++ b/src/lib/libcrypto/bn/bn_blind.c
@@ -126,7 +126,7 @@ struct bn_blinding_st
                                   * used only by crypto/rsa/rsa_eay.c, rsa_lib.c */
 #endif
         CRYPTO_THREADID tid;
-        unsigned int  counter;
+        int counter;
         unsigned long flags;
         BN_MONT_CTX *m_ctx;
         int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
@@ -160,7 +160,10 @@ BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, BIGNUM *mod)
         if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)
                 BN_set_flags(ret->mod, BN_FLG_CONSTTIME);
 
-        ret->counter = BN_BLINDING_COUNTER;
+        /* Set the counter to the special value -1
+         * to indicate that this is never-used fresh blinding
+         * that does not need updating before first use. */
+        ret->counter = -1;
         CRYPTO_THREADID_current(&ret->tid);
         return(ret);
 err:
@@ -190,7 +193,10 @@ int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx)
                 goto err;
                 }
 
-        if (--(b->counter) == 0 && b->e != NULL &&
+        if (b->counter == -1)
+                b->counter = 0;
+
+        if (++b->counter == BN_BLINDING_COUNTER && b->e != NULL &&
                 !(b->flags & BN_BLINDING_NO_RECREATE))
                 {
                 /* re-create blinding parameters */
@@ -205,8 +211,8 @@ int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx)
 
         ret=1;
 err:
-        if (b->counter == 0)
-                b->counter = BN_BLINDING_COUNTER;
+        if (b->counter == BN_BLINDING_COUNTER)
+                b->counter = 0;
         return(ret);
         }
 
@@ -227,6 +233,12 @@ int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx)
                 return(0);
                 }
 
+        if (b->counter == -1)
+                /* Fresh blinding, doesn't need updating. */
+                b->counter = 0;
+        else if (!BN_BLINDING_update(b,ctx))
+                return(0);
+
         if (r != NULL)
                 {
                 if (!BN_copy(r, b->Ai)) ret=0;
@@ -247,22 +259,19 @@ int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b, BN_CTX *ct
         int ret;
 
         bn_check_top(n);
-        if ((b->A == NULL) || (b->Ai == NULL))
-                {
-                BNerr(BN_F_BN_BLINDING_INVERT_EX,BN_R_NOT_INITIALIZED);
-                return(0);
-                }
 
         if (r != NULL)
                 ret = BN_mod_mul(n, n, r, b->mod, ctx);
         else
-                ret = BN_mod_mul(n, n, b->Ai, b->mod, ctx);
-
-        if (ret >= 0)
                 {
-                if (!BN_BLINDING_update(b,ctx))
+                if (b->Ai == NULL)
+                        {
+                        BNerr(BN_F_BN_BLINDING_INVERT_EX,BN_R_NOT_INITIALIZED);
                         return(0);
+                        }
+                ret = BN_mod_mul(n, n, b->Ai, b->mod, ctx);
                 }
+
         bn_check_top(n);
         return(ret);
         }
diff --git a/src/lib/libcrypto/ec/ec2_smpl.c b/src/lib/libcrypto/ec/ec2_smpl.c
index af94458ca7..03deae6674 100644
--- a/src/lib/libcrypto/ec/ec2_smpl.c
+++ b/src/lib/libcrypto/ec/ec2_smpl.c
@@ -887,7 +887,7 @@ int ec_GF2m_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point, BN_
         field_sqr = group->meth->field_sqr;     
 
         /* only support affine coordinates */
-        if (!point->Z_is_one) goto err;
+        if (!point->Z_is_one) return -1;
 
         if (ctx == NULL)
                 {
diff --git a/src/lib/libcrypto/opensslv.h b/src/lib/libcrypto/opensslv.h
index 310a3387be..d6d61a0c7d 100644
--- a/src/lib/libcrypto/opensslv.h
+++ b/src/lib/libcrypto/opensslv.h
@@ -25,11 +25,11 @@
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-#define OPENSSL_VERSION_NUMBER  0x1000005fL
+#define OPENSSL_VERSION_NUMBER  0x1000006fL
 #ifdef OPENSSL_FIPS
-#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0e-fips 6 Sep 2011"
+#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0f-fips 4 Jan 2012"
 #else
-#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0e 6 Sep 2011"
+#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0f 4 Jan 2012"
 #endif
 #define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
diff --git a/src/lib/libcrypto/rsa/rsa_eay.c b/src/lib/libcrypto/rsa/rsa_eay.c
index 7c941885f0..2e1ddd48d3 100644
--- a/src/lib/libcrypto/rsa/rsa_eay.c
+++ b/src/lib/libcrypto/rsa/rsa_eay.c
@@ -314,51 +314,56 @@ static BN_BLINDING *rsa_get_blinding(RSA *rsa, int *local, BN_CTX *ctx)
         return ret;
 }
 
-static int rsa_blinding_convert(BN_BLINDING *b, int local, BIGNUM *f,
-        BIGNUM *r, BN_CTX *ctx)
-{
-        if (local)
+static int rsa_blinding_convert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
+        BN_CTX *ctx)
+        {
+        if (unblind == NULL)
+                /* Local blinding: store the unblinding factor
+                 * in BN_BLINDING. */
                 return BN_BLINDING_convert_ex(f, NULL, b, ctx);
         else
                 {
-                int ret;
-                CRYPTO_r_lock(CRYPTO_LOCK_RSA_BLINDING);
-                ret = BN_BLINDING_convert_ex(f, r, b, ctx);
-                CRYPTO_r_unlock(CRYPTO_LOCK_RSA_BLINDING);
-                return ret;
-                }
-}
-
-static int rsa_blinding_invert(BN_BLINDING *b, int local, BIGNUM *f,
-        BIGNUM *r, BN_CTX *ctx)
-{
-        if (local)
-                return BN_BLINDING_invert_ex(f, NULL, b, ctx);
-        else
-                {
+                /* Shared blinding: store the unblinding factor
+                 * outside BN_BLINDING. */
                 int ret;
                 CRYPTO_w_lock(CRYPTO_LOCK_RSA_BLINDING);
-                ret = BN_BLINDING_invert_ex(f, r, b, ctx);
+                ret = BN_BLINDING_convert_ex(f, unblind, b, ctx);
                 CRYPTO_w_unlock(CRYPTO_LOCK_RSA_BLINDING);
                 return ret;
                 }
-}
+        }
+
+static int rsa_blinding_invert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
+        BN_CTX *ctx)
+        {
+        /* For local blinding, unblind is set to NULL, and BN_BLINDING_invert_ex
+         * will use the unblinding factor stored in BN_BLINDING.
+         * If BN_BLINDING is shared between threads, unblind must be non-null:
+         * BN_BLINDING_invert_ex will then use the local unblinding factor,
+         * and will only read the modulus from BN_BLINDING.
+         * In both cases it's safe to access the blinding without a lock.
+         */
+        return BN_BLINDING_invert_ex(f, unblind, b, ctx);
+        }
 
 /* signing */
 static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        BIGNUM *f, *ret, *br, *res;
+        BIGNUM *f, *ret, *res;
         int i,j,k,num=0,r= -1;
         unsigned char *buf=NULL;
         BN_CTX *ctx=NULL;
         int local_blinding = 0;
+        /* Used only if the blinding structure is shared. A non-NULL unblind
+         * instructs rsa_blinding_convert() and rsa_blinding_invert() to store
+         * the unblinding factor outside the blinding structure. */
+        BIGNUM *unblind = NULL;
         BN_BLINDING *blinding = NULL;
 
         if ((ctx=BN_CTX_new()) == NULL) goto err;
         BN_CTX_start(ctx);
         f   = BN_CTX_get(ctx);
-        br  = BN_CTX_get(ctx);
         ret = BN_CTX_get(ctx);
         num = BN_num_bytes(rsa->n);
         buf = OPENSSL_malloc(num);
@@ -406,8 +411,15 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                 }
         
         if (blinding != NULL)
-                if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
+                {
+                if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL))
+                        {
+                        RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                if (!rsa_blinding_convert(blinding, f, unblind, ctx))
                         goto err;
+                }
 
         if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
                 ((rsa->p != NULL) &&
@@ -441,7 +453,7 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                 }
 
         if (blinding)
-                if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
+                if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
                         goto err;
 
         if (padding == RSA_X931_PADDING)
@@ -480,18 +492,21 @@ err:
 static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        BIGNUM *f, *ret, *br;
+        BIGNUM *f, *ret;
         int j,num=0,r= -1;
         unsigned char *p;
         unsigned char *buf=NULL;
         BN_CTX *ctx=NULL;
         int local_blinding = 0;
+        /* Used only if the blinding structure is shared. A non-NULL unblind
+         * instructs rsa_blinding_convert() and rsa_blinding_invert() to store
+         * the unblinding factor outside the blinding structure. */
+        BIGNUM *unblind = NULL;
         BN_BLINDING *blinding = NULL;
 
         if((ctx = BN_CTX_new()) == NULL) goto err;
         BN_CTX_start(ctx);
         f   = BN_CTX_get(ctx);
-        br  = BN_CTX_get(ctx);
         ret = BN_CTX_get(ctx);
         num = BN_num_bytes(rsa->n);
         buf = OPENSSL_malloc(num);
@@ -529,8 +544,15 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                 }
         
         if (blinding != NULL)
-                if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
+                {
+                if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL))
+                        {
+                        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE);
                         goto err;
+                        }
+                if (!rsa_blinding_convert(blinding, f, unblind, ctx))
+                        goto err;
+                }
 
         /* do the decrypt */
         if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
@@ -564,7 +586,7 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                 }
 
         if (blinding)
-                if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
+                if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
                         goto err;
 
         p=buf;
diff --git a/src/lib/libcrypto/util/mkerr.pl b/src/lib/libcrypto/util/mkerr.pl
index 2c99467d34..aec401c773 100644
--- a/src/lib/libcrypto/util/mkerr.pl
+++ b/src/lib/libcrypto/util/mkerr.pl
@@ -769,7 +769,7 @@ EOF
         undef %err_reason_strings;
 }
 
-if($debug && defined(%notrans)) {
+if($debug && %notrans) {
         print STDERR "The following function codes were not translated:\n";
         foreach(sort keys %notrans)
         {
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 5a0b0249b4..701ec565e9 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -1732,7 +1732,7 @@ int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
         atm.length=sizeof(buff2);
         atm.data=(unsigned char *)buff2;
 
-        if (X509_time_adj(&atm,-offset*60, cmp_time) == NULL)
+        if (X509_time_adj(&atm, offset*60, cmp_time) == NULL)
                 return 0;
 
         if (ctm->type == V_ASN1_UTCTIME)
diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index 2180c6d4da..9f898d6997 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -158,7 +158,6 @@ static unsigned char bitmask_end_values[]   = {0xff, 0x01, 0x03, 0x07, 0x0f, 0x1
 /* XDTLS:  figure out the right values */
 static unsigned int g_probable_mtu[] = {1500 - 28, 512 - 28, 256 - 28};
 
-static unsigned int dtls1_min_mtu(void);
 static unsigned int dtls1_guess_mtu(unsigned int curr_mtu);
 static void dtls1_fix_message_header(SSL *s, unsigned long frag_off, 
         unsigned long frag_len);
@@ -264,11 +263,10 @@ int dtls1_do_write(SSL *s, int type)
                         return ret;
                 mtu = s->d1->mtu - (DTLS1_HM_HEADER_LENGTH + DTLS1_RT_HEADER_LENGTH);
                 }
-
-        OPENSSL_assert(mtu > 0);  /* should have something reasonable now */
-
 #endif
 
+        OPENSSL_assert(s->d1->mtu >= dtls1_min_mtu());  /* should have something reasonable now */
+
         if ( s->init_off == 0  && type == SSL3_RT_HANDSHAKE)
                 OPENSSL_assert(s->init_num == 
                         (int)s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH);
@@ -795,7 +793,13 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
                 *ok = 0;
                 return i;
                 }
-        OPENSSL_assert(i == DTLS1_HM_HEADER_LENGTH);
+        /* Handshake fails if message header is incomplete */
+        if (i != DTLS1_HM_HEADER_LENGTH)
+                {
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_UNEXPECTED_MESSAGE);
+                goto f_err;
+                }
 
         /* parse the message fragment header */
         dtls1_get_message_header(wire, &msg_hdr);
@@ -867,7 +871,12 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
 
         /* XDTLS:  an incorrectly formatted fragment should cause the 
          * handshake to fail */
-        OPENSSL_assert(i == (int)frag_len);
+        if (i != (int)frag_len)
+                {
+                al=SSL3_AD_ILLEGAL_PARAMETER;
+                SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL3_AD_ILLEGAL_PARAMETER);
+                goto f_err;
+                }
 
         *ok = 1;
 
@@ -1367,7 +1376,7 @@ dtls1_write_message_header(SSL *s, unsigned char *p)
         return p;
         }
 
-static unsigned int 
+unsigned int 
 dtls1_min_mtu(void)
         {
         return (g_probable_mtu[(sizeof(g_probable_mtu) / 
diff --git a/src/lib/libssl/d1_lib.c b/src/lib/libssl/d1_lib.c
index 48e8b6ffbb..c3b77c889b 100644
--- a/src/lib/libssl/d1_lib.c
+++ b/src/lib/libssl/d1_lib.c
@@ -204,7 +204,8 @@ void dtls1_clear(SSL *s)
     pqueue buffered_messages;
         pqueue sent_messages;
         pqueue buffered_app_data;
-        
+        unsigned int mtu;
+
         if (s->d1)
                 {
                 unprocessed_rcds = s->d1->unprocessed_rcds.q;
@@ -212,6 +213,7 @@ void dtls1_clear(SSL *s)
                 buffered_messages = s->d1->buffered_messages;
                 sent_messages = s->d1->sent_messages;
                 buffered_app_data = s->d1->buffered_app_data.q;
+                mtu = s->d1->mtu;
 
                 dtls1_clear_queues(s);
 
@@ -222,6 +224,11 @@ void dtls1_clear(SSL *s)
                         s->d1->cookie_len = sizeof(s->d1->cookie);
                         }
 
+                if (SSL_get_options(s) & SSL_OP_NO_QUERY_MTU)
+                        {
+                        s->d1->mtu = mtu;
+                        }
+
                 s->d1->unprocessed_rcds.q = unprocessed_rcds;
                 s->d1->processed_rcds.q = processed_rcds;
                 s->d1->buffered_messages = buffered_messages;
diff --git a/src/lib/libssl/d1_pkt.c b/src/lib/libssl/d1_pkt.c
index 39aac73e10..e0c0f0cc9a 100644
--- a/src/lib/libssl/d1_pkt.c
+++ b/src/lib/libssl/d1_pkt.c
@@ -375,6 +375,7 @@ dtls1_process_record(SSL *s)
         SSL3_RECORD *rr;
         unsigned int mac_size;
         unsigned char md[EVP_MAX_MD_SIZE];
+        int decryption_failed_or_bad_record_mac = 0;
 
 
         rr= &(s->s3->rrec);
@@ -409,13 +410,10 @@ dtls1_process_record(SSL *s)
         enc_err = s->method->ssl3_enc->enc(s,0);
         if (enc_err <= 0)
                 {
-                /* decryption failed, silently discard message */
-                if (enc_err < 0)
-                        {
-                        rr->length = 0;
-                        s->packet_length = 0;
-                        }
-                goto err;
+                /* To minimize information leaked via timing, we will always
+                 * perform all computations before discarding the message.
+                 */
+                decryption_failed_or_bad_record_mac = 1;
                 }
 
 #ifdef TLS_DEBUG
@@ -445,7 +443,7 @@ printf("\n");
                         SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
                         goto f_err;
 #else
-                        goto err;
+                        decryption_failed_or_bad_record_mac = 1;
 #endif                  
                         }
                 /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
@@ -456,17 +454,25 @@ printf("\n");
                         SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT);
                         goto f_err;
 #else
-                        goto err;
+                        decryption_failed_or_bad_record_mac = 1;
 #endif
                         }
                 rr->length-=mac_size;
                 i=s->method->ssl3_enc->mac(s,md,0);
                 if (i < 0 || memcmp(md,&(rr->data[rr->length]),mac_size) != 0)
                         {
-                        goto err;
+                        decryption_failed_or_bad_record_mac = 1;
                         }
                 }
 
+        if (decryption_failed_or_bad_record_mac)
+                {
+                /* decryption failed, silently discard message */
+                rr->length = 0;
+                s->packet_length = 0;
+                goto err;
+                }
+
         /* r->length is now just compressed */
         if (s->expand != NULL)
                 {
diff --git a/src/lib/libssl/d1_srvr.c b/src/lib/libssl/d1_srvr.c
index a6a4c87ea6..149983be30 100644
--- a/src/lib/libssl/d1_srvr.c
+++ b/src/lib/libssl/d1_srvr.c
@@ -1271,7 +1271,7 @@ int dtls1_send_server_key_exchange(SSL *s)
                                 EVP_SignInit_ex(&md_ctx,EVP_ecdsa(), NULL);
                                 EVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
                                 EVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
-                                EVP_SignUpdate(&md_ctx,&(d[4]),n);
+                                EVP_SignUpdate(&md_ctx,&(d[DTLS1_HM_HEADER_LENGTH]),n);
                                 if (!EVP_SignFinal(&md_ctx,&(p[2]),
                                         (unsigned int *)&i,pkey))
                                         {
diff --git a/src/lib/libssl/doc/openssl.cnf b/src/lib/libssl/doc/openssl.cnf
index 9d2cd5bfa5..18760c6e67 100644
--- a/src/lib/libssl/doc/openssl.cnf
+++ b/src/lib/libssl/doc/openssl.cnf
@@ -145,7 +145,7 @@ localityName			= Locality Name (eg, city)
 organizationalUnitName          = Organizational Unit Name (eg, section)
 #organizationalUnitName_default =
 
-commonName                      = Common Name (eg, YOUR name)
+commonName                      = Common Name (e.g. server FQDN or YOUR name)
 commonName_max                  = 64
 
 emailAddress                    = Email Address
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index 50bd415b56..53223bd38d 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -953,7 +953,7 @@ int ssl3_get_server_hello(SSL *s)
                 /* wrong packet length */
                 al=SSL_AD_DECODE_ERROR;
                 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_PACKET_LENGTH);
-                goto err;
+                goto f_err;
                 }
 
         return(1);
@@ -1837,7 +1837,7 @@ int ssl3_get_new_session_ticket(SSL *s)
         if (n < 6)
                 {
                 /* need at least ticket_lifetime_hint + ticket length */
-                al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
+                al = SSL_AD_DECODE_ERROR;
                 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
                 goto f_err;
                 }
@@ -1848,7 +1848,7 @@ int ssl3_get_new_session_ticket(SSL *s)
         /* ticket_lifetime_hint + ticket_length + ticket */
         if (ticklen + 6 != n)
                 {
-                al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
+                al = SSL_AD_DECODE_ERROR;
                 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
                 goto f_err;
                 }
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 62c791cb72..1130244aeb 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -2177,6 +2177,7 @@ void ssl3_clear(SSL *s)
         {
         unsigned char *rp,*wp;
         size_t rlen, wlen;
+        int init_extra;
 
 #ifdef TLSEXT_TYPE_opaque_prf_input
         if (s->s3->client_opaque_prf_input != NULL)
@@ -2215,6 +2216,7 @@ void ssl3_clear(SSL *s)
         wp = s->s3->wbuf.buf;
         rlen = s->s3->rbuf.len;
         wlen = s->s3->wbuf.len;
+        init_extra = s->s3->init_extra;
         if (s->s3->handshake_buffer) {
                 BIO_free(s->s3->handshake_buffer);
                 s->s3->handshake_buffer = NULL;
@@ -2227,6 +2229,7 @@ void ssl3_clear(SSL *s)
         s->s3->wbuf.buf = wp;
         s->s3->rbuf.len = rlen;
         s->s3->wbuf.len = wlen;
+        s->s3->init_extra = init_extra;
 
         ssl_free_wbio_buffer(s);
 
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index c3b5ff33ff..d734c359fb 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -258,6 +258,7 @@ int ssl3_accept(SSL *s)
                                 }
 
                         s->init_num=0;
+                        s->s3->flags &= ~SSL3_FLAGS_SGC_RESTART_DONE;
 
                         if (s->state != SSL_ST_RENEGOTIATE)
                                 {
@@ -755,6 +756,14 @@ int ssl3_check_client_hello(SSL *s)
         int ok;
         long n;
 
+        /* We only allow the client to restart the handshake once per
+         * negotiation. */
+        if (s->s3->flags & SSL3_FLAGS_SGC_RESTART_DONE)
+                {
+                SSLerr(SSL_F_SSL3_CHECK_CLIENT_HELLO, SSL_R_MULTIPLE_SGC_RESTARTS);
+                return -1;
+                }
+
         /* this function is called when we really expect a Certificate message,
          * so permit appropriate message length */
         n=s->method->ssl_get_message(s,
@@ -783,6 +792,7 @@ int ssl3_check_client_hello(SSL *s)
                         s->s3->tmp.ecdh = NULL;
                         }
 #endif
+                s->s3->flags |= SSL3_FLAGS_SGC_RESTART_DONE;
                 return 2;
                 }
         return 1;
@@ -2130,6 +2140,7 @@ int ssl3_get_client_key_exchange(SSL *s)
                 if (i <= 0)
                         {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
+                        BN_clear_free(pub);
                         goto err;
                         }
 
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index e4c3f65010..8f922eea72 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -1882,6 +1882,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL3_CALLBACK_CTRL                         233
 #define SSL_F_SSL3_CHANGE_CIPHER_STATE                   129
 #define SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM              130
+#define SSL_F_SSL3_CHECK_CLIENT_HELLO                    304
 #define SSL_F_SSL3_CLIENT_HELLO                          131
 #define SSL_F_SSL3_CONNECT                               132
 #define SSL_F_SSL3_CTRL                                  213
@@ -2139,6 +2140,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_MISSING_TMP_RSA_KEY                        172
 #define SSL_R_MISSING_TMP_RSA_PKEY                       173
 #define SSL_R_MISSING_VERIFY_MESSAGE                     174
+#define SSL_R_MULTIPLE_SGC_RESTARTS                      346
 #define SSL_R_NON_SSLV2_INITIAL_PACKET                   175
 #define SSL_R_NO_CERTIFICATES_RETURNED                   176
 #define SSL_R_NO_CERTIFICATE_ASSIGNED                    177
diff --git a/src/lib/libssl/ssl3.h b/src/lib/libssl/ssl3.h
index baaa89e717..9c2c41287a 100644
--- a/src/lib/libssl/ssl3.h
+++ b/src/lib/libssl/ssl3.h
@@ -379,6 +379,17 @@ typedef struct ssl3_buffer_st
 #define SSL3_FLAGS_POP_BUFFER                   0x0004
 #define TLS1_FLAGS_TLS_PADDING_BUG              0x0008
 #define TLS1_FLAGS_SKIP_CERT_VERIFY             0x0010
+ 
+/* SSL3_FLAGS_SGC_RESTART_DONE is set when we
+ * restart a handshake because of MS SGC and so prevents us
+ * from restarting the handshake in a loop. It's reset on a
+ * renegotiation, so effectively limits the client to one restart
+ * per negotiation. This limits the possibility of a DDoS
+ * attack where the client handshakes in a loop using SGC to
+ * restart. Servers which permit renegotiation can still be
+ * effected, but we can't prevent that.
+ */
+#define SSL3_FLAGS_SGC_RESTART_DONE             0x0040
 
 typedef struct ssl3_state_st
         {
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
index a8ce186b78..54ba7ef5b4 100644
--- a/src/lib/libssl/ssl_ciph.c
+++ b/src/lib/libssl/ssl_ciph.c
@@ -446,6 +446,7 @@ static void load_builtin_compressions(void)
                                                 sk_SSL_COMP_push(ssl_comp_methods,comp);
                                                 }
                                         }
+                                        sk_SSL_COMP_sort(ssl_comp_methods);
                                 }
                         MemCheck_on();
                         }
diff --git a/src/lib/libssl/ssl_err.c b/src/lib/libssl/ssl_err.c
index 0eed464749..e9be77109f 100644
--- a/src/lib/libssl/ssl_err.c
+++ b/src/lib/libssl/ssl_err.c
@@ -1,6 +1,6 @@
 /* ssl/ssl_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2009 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -137,6 +137,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL3_CALLBACK_CTRL),    "SSL3_CALLBACK_CTRL"},
 {ERR_FUNC(SSL_F_SSL3_CHANGE_CIPHER_STATE),      "SSL3_CHANGE_CIPHER_STATE"},
 {ERR_FUNC(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM), "SSL3_CHECK_CERT_AND_ALGORITHM"},
+{ERR_FUNC(SSL_F_SSL3_CHECK_CLIENT_HELLO),       "SSL3_CHECK_CLIENT_HELLO"},
 {ERR_FUNC(SSL_F_SSL3_CLIENT_HELLO),     "SSL3_CLIENT_HELLO"},
 {ERR_FUNC(SSL_F_SSL3_CONNECT),  "SSL3_CONNECT"},
 {ERR_FUNC(SSL_F_SSL3_CTRL),     "SSL3_CTRL"},
@@ -397,6 +398,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_MISSING_TMP_RSA_KEY)   ,"missing tmp rsa key"},
 {ERR_REASON(SSL_R_MISSING_TMP_RSA_PKEY)  ,"missing tmp rsa pkey"},
 {ERR_REASON(SSL_R_MISSING_VERIFY_MESSAGE),"missing verify message"},
+{ERR_REASON(SSL_R_MULTIPLE_SGC_RESTARTS) ,"multiple sgc restarts"},
 {ERR_REASON(SSL_R_NON_SSLV2_INITIAL_PACKET),"non sslv2 initial packet"},
 {ERR_REASON(SSL_R_NO_CERTIFICATES_RETURNED),"no certificates returned"},
 {ERR_REASON(SSL_R_NO_CERTIFICATE_ASSIGNED),"no certificate assigned"},
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 46732791fd..8e89911f48 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1054,6 +1054,9 @@ long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)
                 s->max_cert_list=larg;
                 return(l);
         case SSL_CTRL_SET_MTU:
+                if (larg < (long)dtls1_min_mtu())
+                        return 0;
+
                 if (SSL_version(s) == DTLS1_VERSION ||
                     SSL_version(s) == DTLS1_BAD_VER)
                         {
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index 4c78393f3f..cea622a2a6 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -950,6 +950,7 @@ void dtls1_stop_timer(SSL *s);
 int dtls1_is_timer_expired(SSL *s);
 void dtls1_double_timeout(SSL *s);
 int dtls1_send_newsession_ticket(SSL *s);
+unsigned int dtls1_min_mtu(void);
 
 /* some client-only functions */
 int ssl3_client_hello(SSL *s);
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 85371c87b8..26cbae449e 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -971,6 +971,12 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                                 sdata = data;
                                 if (dsize > 0)
                                         {
+                                        if (s->tlsext_ocsp_exts)
+                                                {
+                                                sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
+                                                                           X509_EXTENSION_free);
+                                                }
+
                                         s->tlsext_ocsp_exts =
                                                 d2i_X509_EXTENSIONS(NULL,
                                                         &sdata, dsize);
diff --git a/src/lib/libssl/test/testssl b/src/lib/libssl/test/testssl
index f9d7c5d65f..b55364ae88 100644
--- a/src/lib/libssl/test/testssl
+++ b/src/lib/libssl/test/testssl
@@ -100,8 +100,8 @@ echo test sslv2/sslv3 via BIO pair
 $ssltest $extra || exit 1
 
 if [ $dsa_cert = NO ]; then
-  echo test sslv2/sslv3 w/o DHE via BIO pair
-  $ssltest -bio_pair -no_dhe $extra || exit 1
+  echo 'test sslv2/sslv3 w/o (EC)DHE via BIO pair'
+  $ssltest -bio_pair -no_dhe -no_ecdhe $extra || exit 1
 fi
 
 echo test sslv2/sslv3 with 1024bit DHE via BIO pair
@@ -131,8 +131,8 @@ fi
 if ../util/shlib_wrap.sh ../apps/openssl no-rsa; then
   echo skipping RSA tests
 else
-  echo test tls1 with 1024bit RSA, no DHE, multiple handshakes
-  ../util/shlib_wrap.sh ./ssltest -v -bio_pair -tls1 -cert ../apps/server2.pem -no_dhe -num 10 -f -time $extra || exit 1
+  echo 'test tls1 with 1024bit RSA, no (EC)DHE, multiple handshakes'
+  ../util/shlib_wrap.sh ./ssltest -v -bio_pair -tls1 -cert ../apps/server2.pem -no_dhe -no_ecdhe -num 10 -f -time $extra || exit 1
 
   if ../util/shlib_wrap.sh ../apps/openssl no-dh; then
     echo skipping RSA+DHE tests