openssl/crypto, branch OpenSSL_1_1_1e

Update copyright year

2020-03-17T13:59:29Z

Reviewed-by: Paul Yang (Merged from https://github.com/openssl/openssl/pull/11344)

Code to thread-safety in ChangeCipherState

2020-03-13T23:11:45Z

The server-side ChangeCipherState processing stores the new cipher in the SSL_SESSION object, so that the new state can be used if this session gets resumed. However, writing to the session is only thread-safe for initial handshakes, as at other times the session object may be in a shared cache and in use by another thread at the same time. Reflect this invariant in the code by only writing to s->session->cipher when it is currently NULL (we do not cache sessions with no cipher). The code prior to this change would never actually change the (non-NULL) cipher value in a session object, since our server enforces that (pre-TLS-1.3) resumptions use the exact same cipher as the initial connection, and non-abbreviated renegotiations have produced a new session object before we get to this point. Regardless, include logic to detect such a condition and abort the handshake if it occurs, to avoid any risk of inadvertently using the wrong cipher on a connection. Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/10943) (cherry picked from commit 2e3ec2e1578977fca830a47fd7f521e290540e6d)

Revert "Stop accepting certificates signed using SHA1 at security level 1"

2020-03-11T14:56:05Z

This reverts commit 68436f0a8964e911eb4f864bc8b31d7ca4d29585. The OMC did not vote in favour of backporting this to 1.1.1, so this change should be reverted. Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/11282)

crypto/ec/curve448/eddsa.c: fix EBCDIC platforms

2020-03-05T16:33:35Z

Signed-off-by: Patrick Steuer Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/11229) (cherry picked from commit af7f656cd91d99d62567e2b20c61f07cb4d81d0b)

aes-s390x.pl: fix stg offset caused by typo in perlasm

2020-03-05T16:24:43Z

Signed-off-by: Patrick Steuer Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/11234) (cherry picked from commit 7b2ce4a6e817e4385ff77fea0c6e349294c7b756)

This works around a gcc-9 crash

2020-03-05T15:04:36Z

It happens when configured with ./config -ftest-coverage see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94029 Reviewed-by: Tomas Mraz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/11246)

Fix comment placement in ecp_nistp256.ci

2020-02-27T23:41:26Z

CLA: trivial Reviewed-by: Shane Lontis Reviewed-by: Matthias St. Pierre (Merged from https://github.com/openssl/openssl/pull/11175) (cherry picked from commit c590be6f12d0b725863961e41bc64a81c8cf30d6)

Teach more BIOs how to handle BIO_CTRL_EOF

2020-02-20T17:02:31Z

Reviewed-by: Tomas Mraz Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/10882)

Detect EOF while reading in libssl

2020-02-20T17:02:30Z

If we hit an EOF while reading in libssl then we will report an error back to the application (SSL_ERROR_SYSCALL) but errno will be 0. We add an error to the stack (which means we instead return SSL_ERROR_SSL) and therefore give a hint as to what went wrong. Contains a partial fix for #10880 Reviewed-by: Tomas Mraz Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/10882)

Do not silently truncate files on perlasm errors

2020-02-17T02:21:27Z

If one of the perlasm xlate drivers crashes, OpenSSL's build will currently swallow the error and silently truncate the output to however far the driver got. This will hopefully fail to build, but better to check such things. Handle this by checking for errors when closing STDOUT (which is a pipe to the xlate driver). This is the OpenSSL 1.1.1 version of https://github.com/openssl/openssl/pull/10883 and https://github.com/openssl/openssl/pull/10930. Reviewed-by: Mark J. Cox Reviewed-by: Paul Dale David Benjamin (Merged from https://github.com/openssl/openssl/pull/10931)