Two tests are added: one is a simple version tolerance test; the second is
a test to ensure that OpenSSL operates correctly in the case of a zero
length extensions block. The latter was broken inadvertently (now fixed)
and it would have been helpful to have a test case for it.
Reviewed-by: NRichard Levitte <levitte@openssl.org>

This commit provides a set of perl modules that support the testing of
libssl. The test harness operates as a man-in-the-middle proxy between
s_server and s_client. Both s_server and s_client must be started using the
"-testmode" option which loads the new OSSLTEST engine.

The test harness enables scripts to be written that can examine the packets
sent during a handshake, as well as (potentially) modifying them so that
otherwise illegal handshake messages can be sent.
Reviewed-by: NRichard Levitte <levitte@openssl.org>

This engine is for testing purposes only. It provides crippled crypto
implementations and therefore must not be used in any instance where
security is required.

This will be used by the forthcoming libssl test harness which will operate
as a man-in-the-middle proxy. The test harness will be able to modify
TLS packets and read their contents. By using this test engine packets are
not encrypted and MAC codes always verify.
Reviewed-by: NRichard Levitte <levitte@openssl.org>

The function BN_MONT_CTX_set was assuming that the modulus was non-zero
and therefore that |mod->top| > 0. In an error situation that may not be
the case and could cause a seg fault.

This is a follow on from CVE-2015-1794.
Reviewed-by: NRichard Levitte <levitte@openssl.org>

If a client receives a ServerKeyExchange for an anon DH ciphersuite with the
value of p set to 0 then a seg fault can occur. This commits adds a test to
reject p, g and pub key parameters that have a 0 value (in accordance with
RFC 5246)

The security vulnerability only affects master and 1.0.2, but the fix is
additionally applied to 1.0.1 for additional confidence.

CVE-2015-1794
Reviewed-by: NRichard Levitte <levitte@openssl.org>
Reviewed-by: NMatt Caswell <matt@openssl.org>

make errors wants things in a different order to the way things are
currently defined in the header files. The easiest fix is to just let it
reorder it.
Reviewed-by: NRichard Levitte <levitte@openssl.org>

Reviewed-by: NMatt Caswell <matt@openssl.org>

Especially since after the #ifdef cleanups this is not useful.
Reviewed-by: NMatt Caswell <matt@openssl.org>

Reviewed-by: NViktor Dukhovni <viktor@openssl.org>

Reviewed-by: NTim Hudson <tjh@openssl.org>

Add Host Header in OCSP query if no host header is set via -header
Signed-off-by: NRich Salz <rsalz@akamai.com>
Reviewed-by: NBen Laurie <ben@openssl.org>

Signed-off-by: NRich Salz <rsalz@akamai.com>
Reviewed-by: NBen Laurie <ben@openssl.org>

We could just initialize it, but to be consistent with the rest of the file
it seemed to make more sense to just drop.
Reviewed-by: NBen Laurie <ben@openssl.org>
Reviewed-by: NMatt Caswell <matt@openssl.org>

This reverts commit 704563f0.

Reverting in favour of the next commit which removes the underlying cause
of the warning.
Reviewed-by: NBen Laurie <ben@openssl.org>

Reviewed-by: NRich Salz <rsalz@openssl.org>

Signed-off-by: NRich Salz <rsalz@openssl.org>
Reviewed-by: NTim Hudson <tjh@openssl.org>

Reviewed-by: NTim Hudson <tjh@openssl.org>
Reviewed-by: NMatt Caswell <matt@openssl.org>

--strict-warnings started showing warnings for this today...

Surely an error should be raised if these reads fail?
Reviewed-by: NTim Hudson <tjh@openssl.org>
Reviewed-by: NMatt Caswell <matt@openssl.org>

The -use_srtp s_client/s_server option is supposed to take a colon
separated string as an argument. In master this was incorrectly set to
expect a filename.
Reviewed-by: NRich Salz <rsalz@openssl.org>

Change NextProto message processing to use the PACKET API.
Reviewed-by: NStephen Henson <steve@openssl.org>

Modify CertificateVerify processing to use the new PACKET API.
Reviewed-by: NStephen Henson <steve@openssl.org>

Use the PACKET API for processing ClientCertificate messages
Reviewed-by: NTim Hudson <tjh@openssl.org>

Some of the PACKET functions were returning incorrect data. An unfortunate
choice of test data in the unit test was masking the failure.
Reviewed-by: NTim Hudson <tjh@openssl.org>

EC_KEY_set_public_key_affine_coordinates was using some variables that only
apply if OPENSSL_NO_EC2M is not defined.
Reviewed-by: NViktor Dukhovni <viktor@openssl.org>

The move of CCS into the state machine was causing make errors to fail. This
fixes it.
Reviewed-by: NTim Hudson <tjh@openssl.org>

The move of CCS into the state machine introduced a bug in ssl3_read_bytes.
The value of |recvd_type| was not being set if we are satisfying the request
from handshake fragment storage. This can occur, for example, with
renegotiation and causes the handshake to fail.
Reviewed-by: NTim Hudson <tjh@openssl.org>

Continuing on from the previous commit this moves the processing of DTLS
CCS messages out of the record layer and into the state machine.
Reviewed-by: NTim Hudson <tjh@openssl.org>

The handling of incoming CCS records is a little strange. Since CCS is not
a handshake message it is handled differently to normal handshake messages.
Unfortunately whilst technically it is not a handhshake message the reality
is that it must be processed in accordance with the state of the handshake.
Currently CCS records are processed entirely within the record layer. In
order to ensure that it is handled in accordance with the handshake state
a flag is used to indicate that it is an acceptable time to receive a CCS.

Previously this flag did not exist (see CVE-2014-0224), but the flag should
only really be considered a workaround for the problem that CCS is not
visible to the state machine.

Outgoing CCS messages are already handled within the state machine.

This patch makes CCS visible to the TLS state machine. A separate commit
will handle DTLS.
Reviewed-by: NTim Hudson <tjh@openssl.org>

Uses the new PACKET code to process the incoming ClientHello including all
extensions etc.
Reviewed-by: NTim Hudson <tjh@openssl.org>

Add some unit tests for the new PACKET API
Reviewed-by: NTim Hudson <tjh@openssl.org>

Provide more robust (inline) functions to replace n2s, n2l, etc. These
functions do the same thing as the previous macros, but also keep track
of the amount of data remaining and return an error if we try to read more
data than we've got.
Reviewed-by: NTim Hudson <tjh@openssl.org>

Reviewed-by: NRich Salz <rsalz@openssl.org>

Reviewed-by: NRichard Levitte <levitte@openssl.org>

Reviewed-by: NRich Salz <rsalz@openssl.org>

Reviewed-by: NRich Salz <rsalz@openssl.org>

Reviewed-by: Richard Levitte

Reviewed-by: NRichard Levitte <levitte@openssl.org>

Reviewed-by: NRich Salz <rsalz@openssl.org>

Commit e481f9b9 removed OPENSSL_NO_TLSEXT from the code.

Previously if OPENSSL_NO_TLSEXT *was not* defined then the server random was
filled during getting of the ClientHello. If it *was* defined then the
server random would be filled in ssl3_send_server_hello(). Unfortunately in
commit e481f9b9 the OPENSSL_NO_TLSEXT guards were removed but *both*
server random fillings were left in. This could cause problems for session
ticket callbacks.
Reviewed-by: NStephen Henson <steve@openssl.org>

From a CloudFlare patch.
Reviewed-by: NDr. Stephen Henson <steve@openssl.org>