openssl, branch OpenSSL_1_1_1d

Prepare for 1.1.1d release

2019-09-10T13:13:07Z

Reviewed-by: Richard Levitte

Update copyright year

2019-09-10T12:56:40Z

Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/9847)

Remove duplicate CHANGES entry

2019-09-10T11:08:15Z

Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/9844)

Fix a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey

2019-09-10T10:41:20Z

An attack is simple, if the first CMS_recipientInfo is valid but the second CMS_recipientInfo is chosen ciphertext. If the second recipientInfo decodes to PKCS #1 v1.5 form plaintext, the correct encryption key will be replaced by garbage, and the message cannot be decoded, but if the RSA decryption fails, the correct encryption key is used and the recipient will not notice the attack. As a work around for this potential attack the length of the decrypted key must be equal to the cipher default key length, in case the certifiate is not given and all recipientInfo are tried out. The old behaviour can be re-enabled in the CMS code by setting the CMS_DEBUG_DECRYPT flag. Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/9777) (cherry picked from commit 5840ed0cd1e6487d247efbc1a04136a41d7b3a37)

Update CHANGES and NEWS for the new release

2019-09-10T09:51:54Z

Reviewed-by: Paul Dale Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/9841)

Fix a potential crash in rand_unix.c

2019-09-10T09:03:04Z

Due to the dynamic allocation that was added to rand_pool_add_begin this function could now return a null pointer where it was previously guaranteed to succeed. But the return value of this function does not need to be checked by design. Move rand_pool_grow from rand_pool_add_begin to rand_pool_bytes_needed. Make an allocation error persistent to avoid falling back to less secure or blocking entropy sources. Fixes: a6a66e4511ee ("Make rand_pool buffers more dynamic in their sizing.") Reviewed-by: Matthias St. Pierre Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/9687) (cherry picked from commit fa3eb248e29ca8031e6a14e8a2c6f3cd58b5450e)

Fix a strict warnings error in rand_pool_acquire_entropy

2019-09-10T09:03:04Z

There was a warning about unused variables in this config: ./config --strict-warnings --with-rand-seed=rdcpu Reviewed-by: Matthias St. Pierre Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/9687) (cherry picked from commit e301c147a763f67dcc5ba63eb7e2ae40d83a68aa)

drbg: fix issue where DRBG_CTR fails if NO_DF is used (2nd attempt)

2019-09-09T16:09:06Z

Since commit 7c226dfc434d a chained DRBG does not add additional data anymore when reseeding from its parent. The reason is that the size of the additional data exceeded the allowed size when no derivation function was used. This commit provides an alternative fix: instead of adding the entire DRBG's complete state, we just add the DRBG's address in memory, thereby providing some distinction between the different DRBG instances. Reviewed-by: Paul Dale Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/9802)

drbg: add fork id to additional data on UNIX systems

2019-09-09T16:09:06Z

Provides a little extra fork-safety on UNIX systems, adding to the fact that all DRBGs reseed automatically when the fork_id changes. Reviewed-by: Paul Dale Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/9802)

drbg: ensure fork-safety without using a pthread_atfork handler

2019-09-09T16:09:06Z

When the new OpenSSL CSPRNG was introduced in version 1.1.1, it was announced in the release notes that it would be fork-safe, which the old CSPRNG hadn't been. The fork-safety was implemented using a fork count, which was incremented by a pthread_atfork handler. Initially, this handler was enabled by default. Unfortunately, the default behaviour had to be changed for other reasons in commit b5319bdbd095, so the new OpenSSL CSPRNG failed to keep its promise. This commit restores the fork-safety using a different approach. It replaces the fork count by a fork id, which coincides with the process id on UNIX-like operating systems and is zero on other operating systems. It is used to detect when an automatic reseed after a fork is necessary. To prevent a future regression, it also adds a test to verify that the child reseeds after fork. CVE-2019-1549 Reviewed-by: Paul Dale Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/9802)