openssl/ssl, branch OpenSSL_1_0_2i

Avoid KCI attack for GOST

2016-09-22T08:22:05Z

Russian GOST ciphersuites are vulnerable to the KCI attack because they use long-term keys to establish the connection when ssl client authorization is on. This change brings the GOST implementation into line with the latest specs in order to avoid the attack. It should not break backwards compatibility. Reviewed-by: Rich Salz Reviewed-by: Richard Levitte Reviewed-by: Matt Caswell

Fix a mem leak in NPN handling

2016-09-22T08:22:05Z

If a server sent multiple NPN extensions in a single ClientHello then a mem leak can occur. This will only happen where the client has requested NPN in the first place. It does not occur during renegotiation. Therefore the maximum that could be leaked in a single connection with a malicious server is 64k (the maximum size of the ServerHello extensions section). As this is client side, only occurs if NPN has been requested and does not occur during renegotiation this is unlikely to be exploitable. Issue reported by Shi Lei. Reviewed-by: Rich Salz

Fix OCSP Status Request extension unbounded memory growth

2016-09-22T08:22:05Z

A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service attack through memory exhaustion. Servers with a default configuration are vulnerable even if they do not support OCSP. Builds using the "no-ocsp" build time option are not affected. I have also checked other extensions to see if they suffer from a similar problem but I could not find any other issues. CVE-2016-6304 Issue reported by Shi Lei. Reviewed-by: Rich Salz

Don't allow too many consecutive warning alerts

2016-09-21T19:14:16Z

Certain warning alerts are ignored if they are received. This can mean that no progress will be made if one peer continually sends those warning alerts. Implement a count so that we abort the connection if we receive too many. Issue reported by Shi Lei. Reviewed-by: Rich Salz

Make message buffer slightly larger than message.

2016-09-21T18:56:05Z

Grow TLS/DTLS 16 bytes more than strictly necessary as a precaution against OOB reads. In most cases this will have no effect because the message buffer will be large enough already. Reviewed-by: Matt Caswell

Use SSL3_HM_HEADER_LENGTH instead of 4.

2016-09-21T18:56:05Z

Reviewed-by: Matt Caswell

Remove unnecessary check.

2016-09-21T18:56:05Z

The overflow check will never be triggered because the the n2l3 result is always less than 2^24. Reviewed-by: Matt Caswell

Fix small OOB reads.

2016-09-21T13:10:59Z

In ssl3_get_client_certificate, ssl3_get_server_certificate and ssl3_get_certificate_request check we have enough room before reading a length. Thanks to Shi Lei (Gear Team, Qihoo 360 Inc.) for reporting these bugs. CVE-2016-6306 Reviewed-by: Richard Levitte Reviewed-by: Matt Caswell

Revert "Abort on unrecognised warning alerts"

2016-09-15T21:53:27Z

This reverts commit 15d81749322c3498027105f8ee44e8c25479d475. There were some unexpected side effects to this commit, e.g. in SSLv3 a warning alert gets sent "no_certificate" if a client does not send a Certificate during Client Auth. With the above commit this causes the connection to abort, which is incorrect. There may be some other edge cases like this so we need to have a rethink on this. Reviewed-by: Tim Hudson

Fix memory leak on realloc error.

2016-09-15T11:49:00Z

Backport leak fix from master branch. Thanks to Shi Lei (Gear Team, Qihoo 360 Inc.) for reporting this bug. Reviewed-by: Rich Salz