| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A bug in the implementation of the Tonelli-Shanks algorithm can lead to
an infinite loop. This loop can be hit in various ways, in particular on
decompressing an elliptic curve public key via EC_POINT_oct2point() - to
do this, one must solve y^2 = x^3 + ax + b for y, given x.
If a certificate uses explicit encoding for elliptic curve parameters,
this operation needs to be done during certificate verification, leading
to a DoS. In particular, everything dealing with untrusted certificates
is affected, notably TLS servers explicitly configured to request
client certificates (httpd, smtpd, various VPN implementations, ...).
Ordinary TLS servers do not consume untrusted certificates.
The problem is that we cannot assume that x^3 + ax + b is actually a
square on untrusted input and neither can we assume that the modulus
p is a prime. Ensuring that p is a prime is too expensive (it would
likely itself lead to a DoS). To avoid the infinite loop, fix the logic
to be more resilient and explicitly limit the number of iterations that
can be done. The bug is such that the infinite loop can also be hit for
primes = 3 (mod 4) but fortunately that case is optimized earlier.
It's also worth noting that there is a size bound on the field size
enforced via OPENSSL_ECC_MAX_FIELD_BITS (= 661), which help mitigate
further DoS vectors in presence of this fix.
Reported by Tavis Ormandy and David Benjamin, Google
Patch based on the fixes by David Benjamin and Tomas Mraz, OpenSSL
ok beck inoguchi
This is errata/7.0/016_bignum.patch.sig
|
|
|
|
|
|
|
|
| |
certificate chain. This would happen when the verification callback was
in use, instructing the verifier to continue unconditionally. This could
lead to incorrect decisions being made in software.
This is patches/common/006_x509.patch.sig
|
| |
|
|
|
|
|
| |
- Fix 'Server Temp Key' check to work with both words "P-384" and "secp384r1".
- Test TLSv1 and TLSv1.1 only if OpenSSL version is 1.x.
|
|
|
|
|
|
|
| |
This matches the documented behavior more obviously and ensures that
these aren't optimized away, although this is unlikely.
Discussed with deraadt and otto
|
|
|
|
|
|
| |
Add ulimit -c unlimited before running the tests like it is done in
other places in regress.
OK bluhm@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When we finish sending a flight of records, flush the record layer output.
This effectively means calling BIO_flush() on the wbio.
Some things (such as apache2) have custom BIOs that perform buffering and
do not actually send on BIO_write(). Without BIO_flush() the server thinks
it has sent data and starts receiving records, however the client never
sends records since it never received those that the server should have
sent.
Joint work with tb@
ok tb@
|
| |
|
|
|
|
|
|
|
| |
"typedef struct ssl_st SSL;" is defined in ossl_typ.h.
This reverts part of r1.204.
ok tb@
|
|
|
|
| |
ok deraadt florian
|
| |
|
|
|
|
|
|
|
|
|
| |
The p5-Net-SSLeay test expects the info callback to be called on
connect exit. This is the behavior in the legacy stack but wasn't
implemented in the TLSv1.3 stack. With this commit, p5-Net-SSLeay
tests are happy again after the bump.
ok bluhm inoguchi jsing
|
|
|
|
|
| |
stub, written from scratch;
OK tb@ on SSL_set_psk_use_session_callback.3
|
|
|
|
|
|
| |
OpenSSL 1.1.1 branch, which is still under a free license.
A few tweaks to wording and structure by me.
OK tb@ on SSL_SESSION_is_resumable.3
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
and OPENSSL_EC_EXPLICIT_CURVE
from OpenSSL commit 146ca72c Feb 19 14:35:43 2015 +0000
after tb@ changed the default from 0 to OPENSSL_EC_NAMED_CURVE
in ec/ec_lib.c rev. 1.41,
which is the same default that OpenSSL uses since 1.1.0.
While merging, drop the description of the pre-1.1.0 behaviour.
It seems irrelevant to me because tb@ found no application in Debian
codesearch using OPENSSL_EC_EXPLICIT_CURVE. A former devious default
that was probably never relied upon by anyone does not need to be
documented.
|
|
|
|
|
|
| |
as in all other palces. Check the EXFLAG_SET flag first and if not set
grab the CRYPTO_LOCK_X509 before calling x509v3_cache_extensions().
OK tb@ beck@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The pre-OpenSSL 1.1.0 default was to use explicit curve parameter
encoding. Most applications want to use named curve parameter encoding
and have to opt into this explicitly.
Stephen Henson changed this default in OpenSSL commit 86f300d3 6 years
ago and provided a new OPENSSL_EC_EXPLICIT_CURVE define to opt back into
the old default. According to Debian's codesearch, no application
currently does this, which indicates that we currently have a bad default.
In the future it is more likely that applications expect the new
default, so we follow OpenSSL to avoid problems.
Prompted by schwarze who noted that OPENSSL_EC_EXPLICIT_CURVE is missing.
ok beck inoguchi jsing
|
|
|
|
| |
from the OpenSSL 1.1.1 branch, which is still under a free license
|
|
|
|
|
|
|
|
|
| |
branch, which is still under a free license.
While here, also merge a few other improvements, mostly regarding
EC_GROUP_get_order(3) and EC_GROUP_get_cofactor(3); in particular,
some statements below RETURN VALUES were outright wrong.
This patch includes a few minor tweaks and an addition to HISTORY by me.
Feedback and OK tb@.
|
|
|
|
| |
OK tb@
|
|
|
|
|
|
|
| |
and BN_lebin2bn(3) from the OpenSSL 1.1.1 branch,
which is still under a free license.
While here, tweak a number of details for clarity.
OK tb@
|
|
|
|
| |
automatically initializes itself. OK tb@
|
|
|
|
| |
'may as well' deraadt
|
| |
|
|
|
|
| |
changes
|
| |
|
| |
|
|
|
|
| |
ok beck inoguchi jsing
|
|
|
|
| |
ok inoguchi jsing
|
|
|
|
| |
ok beck jsing
|
|
|
|
| |
ok beck jsing
|
|
|
|
| |
ok beck jsing
|
|
|
|
| |
ok beck
|
|
|
|
| |
ok jsing
|
|
|
|
| |
with/ok jsing
|
|
|
|
| |
ok jsing
|
|
|
|
| |
with/ok jsing
|
|
|
|
|
|
| |
from public visibility.
with/ok jsing
|
| |
|
|
|
|
|
|
|
|
| |
BN_rand_range()
From OpenSSL 1.1.1l
ok beck jsing
|
|
|
|
| |
ok beck jsing
|
|
|
|
| |
ok beck inoguchi
|
|
|
|
| |
ok beck jsing
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
As reported by Jeremy Harris, we inherited a strange behavior from
OpenSSL, in that we ignore the SSL_TLSEXT_ERR_FATAL return from the
ALPN callback. RFC 7301, 3.2 states: 'In the event that the server
supports no protocols that the client advertises, then the server
SHALL respond with a fatal "no_application_protocol" alert.'
Honor this requirement and succeed only on SSL_TLSEXT_ERR_{OK,NOACK}
which is the current behavior of OpenSSL. The documentation change
is taken from OpenSSL 1.1.1 as well.
As pointed out by jsing, there is more to be fixed here:
- ensure that the same protocol is selected on session resumption
- should the callback be called even if no ALPN extension was sent?
- ensure for TLSv1.2 and earlier that the SNI has already been processed
ok beck jsing
|
|
|
|
| |
ok beck jsing
|
|
|
|
| |
ok beck
|
|
|
|
| |
ok bluhm@
|
|
|
|
|
|
|
|
|
| |
has decided to change a succeess to a failure and change the error code.
Fixes a regression in the openssl-ruby tests which expect to test this
functionality.
ok tb@
|
|
|
|
|
|
|
|
|
|
|
| |
run the one failing test as a separate regress test. This way,
all regressions should be caught with REGRESS_FAIL_EARLY=yes or
on bluhm's regress webpage.
This needs an up-to-date openssl-ruby-tests package and an
upcoming commit by beck in x509_verify.c to work.
ok beck bluhm
|
| |
|