openssl, branch OpenSSL_1_0_2k

Prepare for 1.0.2k release

2017-01-26T13:22:36Z

Reviewed-by: Richard Levitte

Update CHANGES and NEWS for new release

2017-01-26T11:02:44Z

Reviewed-by: Richard Levitte

Better check of DH parameters in TLS data

2017-01-26T10:56:29Z

When the client reads DH parameters from the TLS stream, we only checked that they all are non-zero. This change updates the check as follows: check that p is odd check that 1 < g < p - 1 Reviewed-by: Matt Caswell

bn/asm/x86_64-mont5.pl: fix carry bug in bn_sqr8x_internal.

2017-01-26T10:55:03Z

CVE-2017-3732 Reviewed-by: Rich Salz

crypto/evp: harden RC4_MD5 cipher.

2017-01-26T10:55:03Z

Originally a crash in 32-bit build was reported CHACHA20-POLY1305 cipher. The crash is triggered by truncated packet and is result of excessive hashing to the edge of accessible memory (or bogus MAC value is produced if x86 MD5 assembly module is involved). Since hash operation is read-only it is not considered to be exploitable beyond a DoS condition. Thanks to Robert Święcki for report. CVE-2017-3731 Reviewed-by: Rich Salz

Fix error handling in compute_key, BN_CTX_get can return NULL

2017-01-24T17:27:10Z

Reviewed-by: Rich Salz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/2132) (cherry picked from commit 7928ee4d685b727619555bc1ec0aee805f6fc8c4)

Fix a ssl session leak due to OOM in lh_SSL_SESSION_insert

2017-01-24T14:07:33Z

- s == NULL can mean c is a new session *or* lh_insert was unable to create a hash entry. - use lh_SSL_SESSION_retrieve to check for this error condition. - If it happens simply remove the extra reference again. Reviewed-by: Rich Salz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/2138) (cherry picked from commit 38088ce9934a90d4aea486edbff864f3935342e6)

Fix SSL_VERIFY_CLIENT_ONCE

2017-01-23T14:13:14Z

The flag SSL_VERIFY_CLIENT_ONCE is documented as follows: B only request a client certificate on the initial TLS/SSL handshake. Do not ask for a client certificate again in case of a renegotiation. This flag must be used together with SSL_VERIFY_PEER. B ignored But the implementation actually did nothing. After the server sends its ServerKeyExchange message, the code was checking s->session->peer to see if it is NULL. If it was set then it did not ask for another client certificate. However s->session->peer will only be set in the event of a resumption, but a ServerKeyExchange message is only sent in the event of a full handshake (i.e. no resumption). The documentation suggests that the original intention was for this to have an effect on renegotiation, and resumption doesn't come into it. The fix is to properly check for renegotiation, not whether there is already a client certificate in the session. As far as I can tell this has been broken for a *long* time. Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/1984)

Add missing va_end

2017-01-20T18:37:52Z

Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/2267)

Fix DSA parameter generation control error

2017-01-20T07:30:41Z

When setting the digest parameter for DSA parameter generation, the signature MD was set instead of the parameter generation one. Fortunately, that's also the one that was used for parameter generation, but it ultimately meant the parameter generator MD and the signature MD would always be the same. Fixes github issue #2016 Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/2250) (cherry picked from commit 8a05c4d3b5a1bfb9193ea24e71735e11de7168d2)