openssl, branch OpenSSL_1_0_2i

Prepare for 1.0.2i release

2016-09-22T10:24:53Z

Reviewed-by: Richard Levitte

Updates CHANGES and NEWS for new release

2016-09-22T08:22:05Z

Reviewed-by: Richard Levitte

Avoid KCI attack for GOST

2016-09-22T08:22:05Z

Russian GOST ciphersuites are vulnerable to the KCI attack because they use long-term keys to establish the connection when ssl client authorization is on. This change brings the GOST implementation into line with the latest specs in order to avoid the attack. It should not break backwards compatibility. Reviewed-by: Rich Salz Reviewed-by: Richard Levitte Reviewed-by: Matt Caswell

Fix a mem leak in NPN handling

2016-09-22T08:22:05Z

If a server sent multiple NPN extensions in a single ClientHello then a mem leak can occur. This will only happen where the client has requested NPN in the first place. It does not occur during renegotiation. Therefore the maximum that could be leaked in a single connection with a malicious server is 64k (the maximum size of the ServerHello extensions section). As this is client side, only occurs if NPN has been requested and does not occur during renegotiation this is unlikely to be exploitable. Issue reported by Shi Lei. Reviewed-by: Rich Salz

Fix OCSP Status Request extension unbounded memory growth

2016-09-22T08:22:05Z

A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service attack through memory exhaustion. Servers with a default configuration are vulnerable even if they do not support OCSP. Builds using the "no-ocsp" build time option are not affected. I have also checked other extensions to see if they suffer from a similar problem but I could not find any other issues. CVE-2016-6304 Issue reported by Shi Lei. Reviewed-by: Rich Salz

mk1mf.pl: check for no-tls1 here as well

2016-09-22T08:16:08Z

Reviewed-by: Matt Caswell

Don't allow too many consecutive warning alerts

2016-09-21T19:14:16Z

Certain warning alerts are ignored if they are received. This can mean that no progress will be made if one peer continually sends those warning alerts. Implement a count so that we abort the connection if we receive too many. Issue reported by Shi Lei. Reviewed-by: Rich Salz

Make message buffer slightly larger than message.

2016-09-21T18:56:05Z

Grow TLS/DTLS 16 bytes more than strictly necessary as a precaution against OOB reads. In most cases this will have no effect because the message buffer will be large enough already. Reviewed-by: Matt Caswell

Use SSL3_HM_HEADER_LENGTH instead of 4.

2016-09-21T18:56:05Z

Reviewed-by: Matt Caswell

Remove unnecessary check.

2016-09-21T18:56:05Z

The overflow check will never be triggered because the the n2l3 result is always less than 2^24. Reviewed-by: Matt Caswell