openssl, branch OpenSSL_1_1_1b

Prepare for 1.1.1b release

2019-02-26T14:15:30Z

Reviewed-by: Richard Levitte

Clarify that SSL_shutdown() must not be called after a fatal error

2019-02-26T14:12:48Z

Follow on from CVE-2019-1559 Reviewed-by: Richard Levitte

Update copyright year

2019-02-26T14:05:09Z

Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/8347)

e_devcrypto: set digest input_blocksize

2019-02-26T13:38:53Z

This restores the behavior of previous versions of the /dev/crypto engine, in alignment with the default implementation. Reported-by: Gerard Looije Signed-off-by: Eneas U de Queiroz Reviewed-by: Richard Levitte Reviewed-by: Nicola Tuveri (Merged from https://github.com/openssl/openssl/pull/8306)

eng_devcrypto: close open session on init

2019-02-26T13:38:53Z

cipher_init may be called on an already initialized context, without a necessary cleanup. This separates cleanup from initialization, closing an eventual open session before creating a new one. Move the /dev/crypto session cleanup code to its own function. Signed-off-by: Eneas U de Queiroz Reviewed-by: Richard Levitte Reviewed-by: Nicola Tuveri (Merged from https://github.com/openssl/openssl/pull/8306)

Update NEWS for new release

2019-02-26T10:46:41Z

Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/8344)

Disable 02-test_errstr.t on msys/mingw as well as MSWin32

2019-02-26T10:44:23Z

There is too high a risk that perl and OpenSSL are linked with different C RTLs, and thereby get different messages for even the most mundane error numbers. Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/8343) (cherry picked from commit 565a19eef35926b4b9675f6cc3964fb290a5b380)

VMS: disable the shlibload test for now

2019-02-26T10:02:45Z

test/shlibloadtest.c needs added code for VMS shared libraries Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/8342)

Rearrange the inclusion of curve448/curve448_lcl.h

2019-02-25T18:37:01Z

The real cause for this change is that test/ec_internal_test.c includes ec_lcl.h, and including curve448/curve448_lcl.h from there doesn't work so well with compilers who always do inclusions relative to the C file being compiled. Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/8334)

Ensure bn_cmp_words can handle the case where n == 0

2019-02-25T16:32:23Z

Thanks to David Benjamin who reported this, performed the analysis and suggested the patch. I have incorporated some of his analysis in the comments below. This issue can cause an out-of-bounds read. It is believed that this was not reachable until the recent "fixed top" changes. Analysis has so far only identified one code path that can encounter this - although it is possible that others may be found. The one code path only impacts 1.0.2 in certain builds. The fuzzer found a path in RSA where iqmp is too large. If the input is all zeros, the RSA CRT logic will multiply a padded zero by iqmp. Two mitigating factors: - Private keys which trip this are invalid (iqmp is not reduced mod p). Only systems which take untrusted private keys care. - In OpenSSL 1.1.x, there is a check which rejects the oversize iqmp, so the bug is only reproducible in 1.0.2 so far. Fortunately, the bug appears to be relatively harmless. The consequences of bn_cmp_word's misbehavior are: - OpenSSL may crash if the buffers are page-aligned and the previous page is non-existent. - OpenSSL will incorrectly treat two BN_ULONG buffers as not equal when they are equal. - Side channel concerns. The first is indeed a concern and is a DoS bug. The second is fine in this context. bn_cmp_word and bn_cmp_part_words are used to compute abs(a0 - a1) in Karatsuba. If a0 = a1, it does not matter whether we use a0 - a1 or a1 - a0. The third would be worth thinking about, but it is overshadowed by the entire Karatsuba implementation not being constant time. Due to the difficulty of tripping this and the low impact no CVE is felt necessary for this issue. Reviewed-by: Paul Dale Reviewed-by: Viktor Dukhovni (Merged from https://github.com/openssl/openssl/pull/8326) (cherry picked from commit 576129cd72ae054d246221f111aabf42b9c6d76d)