openssl/ssl, branch OpenSSL_1_1_1t

Update copyright year

2023-02-07T11:55:04Z

Reviewed-by: Tomas Mraz Release: yes

Ensure our buffer allocation allows for the Explicit IV

2023-01-24T10:24:35Z

Some ciphers/protocol versions have an explicit IV. We need to make sure we have sufficient room for it in the underlying buffer. Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz Reviewed-by: Hugo Landau (Merged from https://github.com/openssl/openssl/pull/20087)

Fix the ceiling on how much encryption growth we can have

2022-12-05T11:10:55Z

Stitched ciphersuites can grow by more during encryption than the code allowed for. We fix the calculation and add an assert to check we go it right. Also if we are adding the MAC independently of the cipher algorithm then the encryption growth will not include that MAC so we should remove it from the amount of bytes that we reserve for that growth. Otherwise we might exceed our buffer size and the WPACKET_reserve operation will fail. Note that this is not a security issue. Even though we can overflow the amount of bytes reserved in the WPACKET for the encryption, the underlying buffer is still big enough. Reviewed-by: Tomas Mraz Reviewed-by: Hugo Landau (Merged from https://github.com/openssl/openssl/pull/19585)

Update copyright year

2022-11-01T12:28:05Z

Reviewed-by: Richard Levitte Release: yes (Merged from https://github.com/openssl/openssl/pull/19560)

ssl_cipher_process_rulestr: don't read outside rule_str buffer

2022-10-26T10:52:23Z

If rule_str ended in a "-", "l" was incremented one byte past the end of the buffer. This resulted in an out-of-bounds read when "l" is dereferenced at the end of the loop. It is safest to just return early in this case since the condition occurs inside a nested loop. CLA: trivial Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/19166) (cherry picked from commit 428511ca66670e169a0e1b12e7540714b0be4cf8)

Update copyright year

2022-10-11T12:26:59Z

Reviewed-by: Richard Levitte Release: yes (Merged from https://github.com/openssl/openssl/pull/19383)

Convert serverinfo in SSL_CTX_use_serverinfo() to v2.

2022-09-09T12:10:03Z

Fixes #18183. Reviewed-by: Matt Caswell Reviewed-by: Paul Dale Reviewed-by: Hugo Landau (Merged from https://github.com/openssl/openssl/pull/19081)

Coverity 1508506: misuse of time_t

2022-08-22T04:46:00Z

Fixes a bug in the cookie code which would have caused problems for ten minutes before and after the lower 32 bits of time_t rolled over. Reviewed-by: Ben Kaduk Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/19022)

Coverity 1508534 & 1508540: misuses of time_t

2022-08-18T22:40:35Z

Avoid problems when the lower 32 bits of time_t roll over by delaying the cast to integer until after the time delta has been computed. Reviewed-by: Ben Kaduk Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/19004) (cherry picked from commit a6cadcbdc3b4f3fbd0fd228e41177f0661b68264)

Fix SSL_pending() and SSL_has_pending() with DTLS

2022-08-10T10:39:26Z

If app data is received before a Finished message in DTLS then we buffer it to return later. The function SSL_pending() is supposed to tell you how much processed app data we have already buffered, and SSL_has_pending() is supposed to tell you if we have any data buffered (whether processed or not, and whether app data or not). Neither SSL_pending() or SSL_has_pending() were taking account of this DTLS specific app data buffer. Reviewed-by: Hugo Landau Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/18976)