openssl/ssl, branch OpenSSL_1_0_2k

Better check of DH parameters in TLS data

2017-01-26T10:56:29Z

When the client reads DH parameters from the TLS stream, we only checked that they all are non-zero. This change updates the check as follows: check that p is odd check that 1 < g < p - 1 Reviewed-by: Matt Caswell

Fix a ssl session leak due to OOM in lh_SSL_SESSION_insert

2017-01-24T14:07:33Z

- s == NULL can mean c is a new session *or* lh_insert was unable to create a hash entry. - use lh_SSL_SESSION_retrieve to check for this error condition. - If it happens simply remove the extra reference again. Reviewed-by: Rich Salz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/2138) (cherry picked from commit 38088ce9934a90d4aea486edbff864f3935342e6)

Fix SSL_VERIFY_CLIENT_ONCE

2017-01-23T14:13:14Z

The flag SSL_VERIFY_CLIENT_ONCE is documented as follows: B only request a client certificate on the initial TLS/SSL handshake. Do not ask for a client certificate again in case of a renegotiation. This flag must be used together with SSL_VERIFY_PEER. B ignored But the implementation actually did nothing. After the server sends its ServerKeyExchange message, the code was checking s->session->peer to see if it is NULL. If it was set then it did not ask for another client certificate. However s->session->peer will only be set in the event of a resumption, but a ServerKeyExchange message is only sent in the event of a full handshake (i.e. no resumption). The documentation suggests that the original intention was for this to have an effect on renegotiation, and resumption doesn't come into it. The fix is to properly check for renegotiation, not whether there is already a client certificate in the session. As far as I can tell this has been broken for a *long* time. Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/1984)

Fix error handling in SSL_CTX_new

2017-01-10T21:34:17Z

Dont free rbuf_freelist here, SSL_CTX_free will do that. Signed-off-by: Kurt Roeckx Reviewed-by: Rich Salz GH: #2129

zero pad DHE public key in ServerKeyExchange message for interop

2016-12-14T17:52:44Z

Some versions of the Microsoft TLS stack have problems when the DHE public key is encoded with fewer bytes than the DHE prime. (Backported from master) Reviewed-by: Matt Caswell Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/1350)

Fix ssl_cert_dup: change one 'return NULL' to 'goto err'

2016-12-14T13:19:01Z

Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/2082)

Make 'err' lable in ssl_cert_dup unconditional

2016-12-14T13:19:01Z

Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/2082)

Fix a bug in clienthello processing

2016-12-13T14:41:20Z

- Always process ALPN (previously there was an early return in the certificate status handling) 1.0.2 did not have the double-alert issue from master, but it seems cleanest to pull in the structural change to alert handling anyway and jump to f_err instead of err to send the alert in the caller. (cherry picked from commit 70c22888c1648fe8652e77107f3c74bf2212de36) Reviewed-by: Emilia Käsper Reviewed-by: Matt Caswell

Revert "Fix heartbeat_test"

2016-11-29T09:54:58Z

Commit fa4c37457 got reverted, so this one also needs to be reverted as a result. This reverts commit ad69a30323cbc6723c2387d6ce546a51b10c42d0. Reviewed-by: Richard Levitte

Make SSL_read and SSL_write return the old behaviour and document it.

2016-11-21T21:00:43Z

Backport of beacb0f0c1ae7b0542fe053b95307f515b578eb7, revert of fa4c374572e94f467900f5820cd1d00af2470a17 Fixes: #1903 Reviewed-by: Matt Caswell GH: #1967