1. 28 9月, 2019 3 次提交
    • D
      Fix header file include guard names · fbbfd128
      Dr. Matthias St. Pierre 提交于
      Make the include guards consistent by renaming them systematically according
      to the naming conventions below
      
      The public header files (in the 'include/openssl' directory) are not changed
      in 1.1.1, because it is a stable release.
      
      For the private header files files, the guard names try to match the path
      specified in the include directives, with all letters converted to upper case
      and '/' and '.' replaced by '_'. An extra 'OSSL_' is added as prefix.
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9681)
      fbbfd128
    • D
      Reorganize local header files · b5acbf91
      Dr. Matthias St. Pierre 提交于
      Apart from public and internal header files, there is a third type called
      local header files, which are located next to source files in the source
      directory. Currently, they have different suffixes like
      
        '*_lcl.h', '*_local.h', or '*_int.h'
      
      This commit changes the different suffixes to '*_local.h' uniformly.
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9681)
      b5acbf91
    • D
      Reorganize private crypto header files · 0c994d54
      Dr. Matthias St. Pierre 提交于
      Currently, there are two different directories which contain internal
      header files of libcrypto which are meant to be shared internally:
      
      While header files in 'include/internal' are intended to be shared
      between libcrypto and libssl, the files in 'crypto/include/internal'
      are intended to be shared inside libcrypto only.
      
      To make things complicated, the include search path is set up in such
      a way that the directive #include "internal/file.h" could refer to
      a file in either of these two directoroes. This makes it necessary
      in some cases to add a '_int.h' suffix to some files to resolve this
      ambiguity:
      
        #include "internal/file.h"      # located in 'include/internal'
        #include "internal/file_int.h"  # located in 'crypto/include/internal'
      
      This commit moves the private crypto headers from
      
        'crypto/include/internal'  to  'include/crypto'
      
      As a result, the include directives become unambiguous
      
        #include "internal/file.h"       # located in 'include/internal'
        #include "crypto/file.h"         # located in 'include/crypto'
      
      hence the superfluous '_int.h' suffixes can be stripped.
      
      The files 'store_int.h' and 'store.h' need to be treated specially;
      they are joined into a single file.
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9681)
      0c994d54
  2. 10 9月, 2019 2 次提交
  3. 09 9月, 2019 3 次提交
    • B
      [test] ECC: check the bounds for auto computing cofactor · 73a683b7
      Billy Brumley 提交于
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NNicola Tuveri <nic.tuv@gmail.com>
      (Merged from https://github.com/openssl/openssl/pull/9821)
      
      (cherry picked from commit 1d3cd983f56e0a580ee4216692ee3c9c7bf14de9)
      73a683b7
    • N
      Fix spacing nit in test/ectest.c · 288241b6
      Nicola Tuveri 提交于
      (cherry picked from commit 65936a56461fe09e8c81bca45122af5adcfabb00)
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de>
      (Merged from https://github.com/openssl/openssl/pull/9813)
      288241b6
    • N
      [ec] Match built-in curves on EC_GROUP_new_from_ecparameters · 9a43a733
      Nicola Tuveri 提交于
      Description
      -----------
      
      Upon `EC_GROUP_new_from_ecparameters()` check if the parameters match any
      of the built-in curves. If that is the case, return a new
      `EC_GROUP_new_by_curve_name()` object instead of the explicit parameters
      `EC_GROUP`.
      
      This affects all users of `EC_GROUP_new_from_ecparameters()`:
      - direct calls to `EC_GROUP_new_from_ecparameters()`
      - direct calls to `EC_GROUP_new_from_ecpkparameters()` with an explicit
        parameters argument
      - ASN.1 parsing of explicit parameters keys (as it eventually
        ends up calling `EC_GROUP_new_from_ecpkparameters()`)
      
      A parsed explicit parameter key will still be marked with the
      `OPENSSL_EC_EXPLICIT_CURVE` ASN.1 flag on load, so, unless
      programmatically forced otherwise, if the key is eventually serialized
      the output will still be encoded with explicit parameters, even if
      internally it is treated as a named curve `EC_GROUP`.
      
      Before this change, creating any `EC_GROUP` object using
      `EC_GROUP_new_from_ecparameters()`, yielded an object associated with
      the default generic `EC_METHOD`, but this was never guaranteed in the
      documentation.
      After this commit, users of the library that intentionally want to
      create an `EC_GROUP` object using a specific `EC_METHOD` can still
      explicitly call `EC_GROUP_new(foo_method)` and then manually set the
      curve parameters using `EC_GROUP_set_*()`.
      
      Motivation
      ----------
      
      This has obvious performance benefits for the built-in curves with
      specialized `EC_METHOD`s and subtle but important security benefits:
      - the specialized methods have better security hardening than the
        generic implementations
      - optional fields in the parameter encoding, like the `cofactor`, cannot
        be leveraged by an attacker to force execution of the less secure
        code-paths for single point scalar multiplication
      - in general, this leads to reducing the attack surface
      
      Check the manuscript at https://arxiv.org/abs/1909.01785 for an in depth
      analysis of the issues related to this commit.
      
      It should be noted that `libssl` does not allow to negotiate explicit
      parameters (as per RFC 8422), so it is not directly affected by the
      consequences of using explicit parameters that this commit fixes.
      On the other hand, we detected external applications and users in the
      wild that use explicit parameters by default (and sometimes using 0 as
      the cofactor value, which is technically not a valid value per the
      specification, but is tolerated by parsers for wider compatibility given
      that the field is optional).
      These external users of `libcrypto` are exposed to these vulnerabilities
      and their security will benefit from this commit.
      
      Related commits
      ---------------
      
      While this commit is beneficial for users using built-in curves and
      explicit parameters encoding for serialized keys, commit
      b783beeadf6b80bc431e6f3230b5d5585c87ef87 (and its equivalents for the
      1.0.2, 1.1.0 and 1.1.1 stable branches) fixes the consequences of the
      invalid cofactor values more in general also for other curves
      (CVE-2019-1547).
      
      The following list covers commits in `master` that are related to the
      vulnerabilities presented in the manuscript motivating this commit:
      
      - d2baf88c43 [crypto/rsa] Set the constant-time flag in multi-prime RSA too
      - 311e903d84 [crypto/asn1] Fix multiple SCA vulnerabilities during RSA key validation.
      - b783beeadf [crypto/ec] for ECC parameters with NULL or zero cofactor, compute it
      - 724339ff44 Fix SCA vulnerability when using PVK and MSBLOB key formats
      
      Note that the PRs that contributed the listed commits also include other
      commits providing related testing and documentation, in addition to
      links to PRs and commits backporting the fixes to the 1.0.2, 1.1.0 and
      1.1.1 branches.
      
      This commit includes a partial backport of
      https://github.com/openssl/openssl/pull/8555
      (commit 8402cd5f75f8c2f60d8bd39775b24b03dd8b3b38)
      for which the main author is Shane Lontis.
      
      Responsible Disclosure
      ----------------------
      
      This and the other issues presented in https://arxiv.org/abs/1909.01785
      were reported by Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri,
      Iaroslav Gridin, Alejandro Cabrera Aldaya and Billy Bob Brumley from the
      NISEC group at Tampere University, FINLAND.
      
      The OpenSSL Security Team evaluated the security risk for this
      vulnerability as low, and encouraged to propose fixes using public Pull
      Requests.
      
      _______________________________________________________________________________
      Co-authored-by: NShane Lontis <shane.lontis@oracle.com>
      
      (Backport from https://github.com/openssl/openssl/pull/9808)
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9809)
      9a43a733
  4. 07 9月, 2019 1 次提交
  5. 06 9月, 2019 1 次提交
  6. 04 9月, 2019 1 次提交
  7. 24 8月, 2019 1 次提交
    • R
      test/evp_test.c: distinguish parsing errors from processing errors · 738da3d0
      Richard Levitte 提交于
      Parsing functions are at liberty to return:
      
      1:  when parsing on processing of the parsed value succeeded
      0:  when the parsed keyword is unknown
      -1: when the parsed value processing failed
      
      Some parsing functions didn't do this quite right, they returned 0
      when they should have returned -1, causing a message like this:
      
          Line 123: unknown keyword PeerKey
      
      When this message (which is displayed when the parsing function
      returns -1) would have been more appropriate:
      
          Line 123: error processing keyword PeerKey = ffdhe2048-2-pub
      Reviewed-by: NTomas Mraz <tmraz@fedoraproject.org>
      (Merged from https://github.com/openssl/openssl/pull/9682)
      
      (cherry picked from commit f42c225d7f9a0bce0bf46103343402d3f0ad742f)
      738da3d0
  8. 19 8月, 2019 1 次提交
  9. 14 8月, 2019 1 次提交
  10. 09 8月, 2019 2 次提交
  11. 01 8月, 2019 1 次提交
  12. 29 7月, 2019 1 次提交
  13. 24 7月, 2019 1 次提交
  14. 20 7月, 2019 1 次提交
  15. 07 7月, 2019 1 次提交
  16. 01 7月, 2019 1 次提交
  17. 25 6月, 2019 1 次提交
  18. 27 6月, 2019 1 次提交
    • B
      Add regression test for #9099 · 9863b419
      Benjamin Kaduk 提交于
      Augment the cert_cb sslapitest to include a run that uses
      SSL_check_chain() to inspect the certificate prior to installing
      it on the SSL object.  If the check shows the certificate as not
      valid in that context, we do not install a certificate at all, so
      the handshake will fail later on in processing (tls_choose_sigalg()),
      exposing the indicated regression.
      
      Currently it fails, since we have not yet set the shared sigalgs
      by the time the cert_cb runs.
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9157)
      
      (cherry picked from commit 7cb8fb07e8b71dc1fdcb0de10af7fed4347f6ea4)
      9863b419
  19. 24 6月, 2019 1 次提交
  20. 19 6月, 2019 1 次提交
  21. 07 6月, 2019 1 次提交
  22. 03 6月, 2019 2 次提交
  23. 28 5月, 2019 2 次提交
  24. 27 5月, 2019 1 次提交
  25. 23 5月, 2019 1 次提交
  26. 08 5月, 2019 1 次提交
    • T
      Allow specifying the tag after AAD in CCM mode · b48e3be9
      Tobias Nießen 提交于
      This change allows to pass the authentication tag after specifying
      the AAD in CCM mode. This is already true for the other two supported
      AEAD modes (GCM and OCB) and it seems appropriate to match the
      behavior.
      
      GCM and OCB also support to set the tag at any point before the call
      to `EVP_*Final`, but this won't work for CCM due to a restriction
      imposed by section 2.6 of RFC3610: The tag must be set before
      actually decrypting data.
      
      This commit also adds a test case for setting the tag after supplying
      plaintext length and AAD.
      Reviewed-by: NPaul Dale <paul.dale@oracle.com>
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/7243)
      
      (cherry picked from commit 67c81ec311d696464bdbf4c6d6f8a887a3ddf9f8)
      b48e3be9
  27. 03 5月, 2019 1 次提交
  28. 26 4月, 2019 1 次提交
  29. 25 4月, 2019 1 次提交
  30. 19 4月, 2019 1 次提交
  31. 16 4月, 2019 2 次提交