Add a comment noting the padding oracle.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Revert "RT3425: constant-time evp_enc"

Causes more problems than it fixes: even though error codes
are not part of the stable API, several users rely on the
specific error code, and the change breaks them. Conversely,
we don't have any concrete use-cases for constant-time behaviour here.

This reverts commit 4aac102f75b517bdb56b1bcfd0a856052d559f6e.

Reviewed-by: Andy Polyakov <appro@openssl.org>

Build fixes

Various build fixes, mostly uncovered by clang's unused-const-variable
and unused-function errors.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit 0e1c318ece3c82e96ae95a34a1badf58198d6b28)

Premaster secret handling fixes

From BoringSSL
- Send an alert when the client key exchange isn't correctly formatted.
- Reject overly short RSA ciphertexts to avoid a (benign) out-of-bounds memory access.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Clear warnings/errors within RL_DEBUG code sections (RL_DEBUG should be renamed)

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within TLS_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within KSSL_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within CIPHER_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within CIPHER_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clear warnings/errors within BN_CTX_DEBUG code sections

Reviewed-by: Tim Hudson <tjh@openssl.org>

Check for invalid divisors in BN_div.

Invalid zero-padding in the divisor could cause a division by 0.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit a43bcd9e96c5180e5c6c82164ece643c0097485e)

The dtls1_output_cert_chain function no longer exists so remove it from
ssl_locl.h

Reviewed-by: Tim Hudson <tjh@openssl.org>

Don't set client_version to the ServerHello version.

The client_version needs to be preserved for the RSA key exchange.

This change also means that renegotiation will, like TLS, repeat the old
client_version rather than advertise only the final version. (Either way,
version change on renego is not allowed.) This is necessary in TLS to work
around an SChannel bug, but it's not strictly necessary in DTLS.

(From BoringSSL)

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add more meaningful OPENSSL_NO_ECDH error message for suite b mode

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Rename gost2814789t.c to gost2814789test.c. The old name caused problems
for dummytest if gost is compiled out, since the name of the test is not
standard (dummytest segfaults). Also the old name caused problems for git
because the executable was not in the .gitignore file

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add missing OPENSSL_NO_EC guards

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Add OPENSSL_NO_ECDH guards

Reviewed-by: Emilia Käsper <emilia@openssl.org>

Remove extraneous white space, and add some braces

Reviewed-by: Emilia Käsper <emilia@openssl.org>

DTLS fixes for signed/unsigned issues

Reviewed-by: Emilia Käsper <emilia@openssl.org>

RT3497: The ticket that keeps on giving.

Don't remove c_rehash that wasn't created by make; this script
is created by configure.

This fix brought to you by the letter "f" and
Reviewed-by: Emilia Kasper <emilia@openssl.org>

Allow using -SSLv2 again when setting Protocol in the config.

RT#3625

Reviewed-by: Emilia Käsper <emilia@openssl.org>

RT3497: Fix; don't remove header files

Doing 'config ; make clean' broke because clean removed
header files that normal build didn't create.  So don't
remove those files.  Hopefully will be better addressed by
Geoff's no-symlinks patch.

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix unused variable warning

The temporary variable causes unused variable warnings in opt mode with clang,
because the subsequent assert is compiled out.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Fixed memory leak if BUF_MEM_grow fails

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

RT1688: Add dependencies for parallel make

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

make update

Reviewed-by: Tim Hudson <tjh@openssl.org>

Minor doc fixes.

In EVP_EncryptInit remove duplicate mention of EVP_idea_cbc()
In EVP_PKEY_CTX_ctrl.pod remove EVP_PKEY_get_default_digest_nid
since it is documented elsewhere.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3497: Clean up "dclean" targets

Some Makefiles had actions for "dclean" that really belonged
to the "clean" target.  This is wrong because clean ends up,
well, not really cleaning everything.

Reviewed-by: Richard Levitte <levitte@openssl.org>

RT3543: Remove #ifdef LINT

I also replaced some exit/return wrappers in various
programs (from main) to standardize on return.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove old private pod2man

Include Richard's point to remove the 'sh -c' wrapper

Reviewed-by: Richard Levitte <levitte@openssl.org>

capi_ctrl, capi_vtrace: check for NULL after allocating and free it

Reviewed-by: Matt Caswell <matt@openssl.org>

tree_print: check for NULL after allocating err

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

tls1_heartbeat: check for NULL after allocating buf

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

tls1_process_heartbeat: check for NULL after allocating buffer

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

SSL_set_session: check for NULL after allocating s->kssl_ctx->client_princ

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

serverinfo_process_buffer: check result of realloc(ctx->cert->key->serverinfo) and don't leak memory if it fails

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

ssl3_digest_cached_records: check for NULL after allocating s->s3->handshake_dgst

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

ssl3_get_certificate_request: check for NULL after allocating s->cert->ctypes

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

SSL_COMP_add_compression_method: exit if allocating the new compression method struct fails

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>

Move bn internal functions into bn_int.h and bn_lcl.h

Reviewed-by: Tim Hudson <tjh@openssl.org>

Update documentation following BN opaquify

Reviewed-by: Tim Hudson <tjh@openssl.org>

Make bn opaque

Reviewed-by: Tim Hudson <tjh@openssl.org>

Update apps for bn opaque change

Reviewed-by: Tim Hudson <tjh@openssl.org>

Disable engines that will fail to build when bn is made opaque

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from ts

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from srp

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from rsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from evp

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from ec

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from dsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from dh

Reviewed-by: Tim Hudson <tjh@openssl.org>

Implement internally opaque bn access from asn1

Reviewed-by: Tim Hudson <tjh@openssl.org>

Prepare exptest for bn opaquify

Reviewed-by: Tim Hudson <tjh@openssl.org>

Prepare for bn opaquify. Implement internal helper functions.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove internal bn dependancies from speed.c

Reviewed-by: Tim Hudson <tjh@openssl.org>

Include <openssl/foo.h> instead of "foo.h"

Exported headers shouldn't be included as "foo.h" by code from the same
module, it should only do so for module-internal headers. This is
because the symlinking of exported headers (from include/openssl/foo.h
to crypto/foo/foo.h) is being removed, and the exported headers are
being moved to the include/openssl/ directory instead.

Change-Id: I4c1d80849544713308ddc6999a549848afc25f94
Signed-off-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

Fixed memory leak in the event of a failure of BUF_MEM_grow

Reviewed-by: Richard Levitte <levitte@openssl.org>

Fix memory leak in SSL_new if errors occur.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Remove fips directories from mkfiles.pl

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove references to deleted fips directory from Makefile.org

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove OPENSSL_FIPSAPI

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS_*_SIZE_T

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/evp

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/bn

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/ecdh

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/ecdsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove FIPS module code from crypto/dh

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/dsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove FIPS module code from crypto/rsa

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove FIPS error library from openssl.ec mkerr.pl

Reviewed-by: Tim Hudson <tjh@openssl.org>

make depend

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove fips.h reference.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove fips_constseg references.

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove another FIPSCANISTER reference

Reviewed-by: Tim Hudson <tjh@openssl.org>

remove unnecessary OPENSSL_FIPS reference

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove OPENSSL_FIPSCANISTER code.

OPENSSL_FIPSCANISTER is only set if the fips module is being built
(as opposed to being used). Since the fips module wont be built in
master this is redundant.
Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove FIPSCANISTERINTERNAL reference.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove fips utility build rules from test/Makefile

The fips test utilities are only build if an FIPS module is being
built from source. As this isn't done in master these are redundant.
Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove fipscanister build functionality from makefiles.

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove fipscanister from Configure, delete fips directory

Reviewed-by: Tim Hudson <tjh@openssl.org>

Remove some unnecessary OPENSSL_FIPS references

FIPS_mode() exists in all versions of OpenSSL but always returns 0 if OpenSSL is not FIPS
capable.
Reviewed-by: Tim Hudson <tjh@openssl.org>

Add CHANGES entry for OCB

Reviewed-by: Tim Hudson <tjh@openssl.org>

Added OPENSSL_NO_OCB guards

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add documentation for OCB mode

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add tests for OCB mode

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add EVP support for OCB mode

Reviewed-by: Tim Hudson <tjh@openssl.org>

Add support for OCB mode as per RFC7253

Reviewed-by: Tim Hudson <tjh@openssl.org>

Clarify the return values for SSL_get_shared_curve.

Reviewed-by: Matt Caswell <matt@openssl.org>

Add extra checks for odd-length EC curve lists.

Odd-length lists should be rejected everywhere upon parsing. Nevertheless,
be extra careful and add guards against off-by-one reads.

Also, drive-by replace inexplicable double-negation with an explicit comparison.

Reviewed-by: Matt Caswell <matt@openssl.org>

Reject elliptic curve lists of odd lengths.

The Supported Elliptic Curves extension contains a vector of NamedCurves
of 2 bytes each, so the total length must be even. Accepting odd-length
lists was observed to lead to a non-exploitable one-byte out-of-bounds
read in the latest development branches (1.0.2 and master). Released
versions of OpenSSL are not affected.

Thanks to Felix Groebert of the Google Security Team for reporting this issue.

Reviewed-by: Matt Caswell <matt@openssl.org>

Fix broken build

Add includes missing from commit 33eab3f6af51c6d7fe68ee4960930df4f1616bd5

Reviewed-by: Geoff Thorpe <geoff@openssl.org>

Replace GOST_R_MALLOC_FAILURE and GOST_R_NO_MEMORY with ERR_R_MALLOC_FAILURE

Reviewed-by: Richard Levitte <levitte@openssl.org>

capi_get_provname: Check return values

Reviewed-by: Richard Levitte <levitte@openssl.org>

ssl_create_cipher_list: check whether push onto cipherstack succeeds

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

ssl_cert_dup: Fix memory leak

Always use goto err on failure and call ssl_cert_free() on the error path so all
fields and "ret" itself are freed

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

dtls1_new: free s on error path

Reviewed-by: Richard Levitte <levitte@openssl.org>

dtls1_heartbeat: check for NULL after allocating s->cert->ctypes

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

dtls1_process_heartbeat: check for NULL after allocating buffer

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

capi_get_key: check for NULL after allocating key

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>

capi_cert_get_fname: check for NULL after allocating wfname

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>