Date: Fri, 6 Jun 2014 20:59:29 +0000 (UTC) From: Jung-uk Kim <jkim@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-vendor@freebsd.org Subject: svn commit: r267188 - in vendor-crypto/openssl/dist: . apps crypto crypto/asn1 crypto/bio crypto/bn crypto/cms crypto/dso crypto/ec crypto/evp crypto/pkcs12 crypto/pkcs7 crypto/rsa crypto/srp crypt... Message-ID: <201406062059.s56KxTj7048744@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jkim Date: Fri Jun 6 20:59:29 2014 New Revision: 267188 URL: http://svnweb.freebsd.org/changeset/base/267188 Log: Import OpenSSL 1.0.1h. Approved by: so (delphij) Added: vendor-crypto/openssl/dist/ssl/heartbeat_test.c (contents, props changed) Modified: vendor-crypto/openssl/dist/ACKNOWLEDGMENTS vendor-crypto/openssl/dist/CHANGES vendor-crypto/openssl/dist/FREEBSD-upgrade vendor-crypto/openssl/dist/Makefile vendor-crypto/openssl/dist/NEWS vendor-crypto/openssl/dist/README vendor-crypto/openssl/dist/apps/enc.c vendor-crypto/openssl/dist/apps/ocsp.c vendor-crypto/openssl/dist/apps/req.c vendor-crypto/openssl/dist/apps/s_cb.c vendor-crypto/openssl/dist/apps/s_socket.c vendor-crypto/openssl/dist/apps/smime.c vendor-crypto/openssl/dist/crypto/asn1/a_strnid.c vendor-crypto/openssl/dist/crypto/bio/bss_dgram.c vendor-crypto/openssl/dist/crypto/bn/bn_mont.c vendor-crypto/openssl/dist/crypto/cms/cms_env.c vendor-crypto/openssl/dist/crypto/cms/cms_sd.c vendor-crypto/openssl/dist/crypto/cms/cms_smime.c vendor-crypto/openssl/dist/crypto/dso/dso_dlfcn.c vendor-crypto/openssl/dist/crypto/ec/ec_ameth.c vendor-crypto/openssl/dist/crypto/ec/ec_asn1.c vendor-crypto/openssl/dist/crypto/ec/ec_lcl.h vendor-crypto/openssl/dist/crypto/evp/bio_b64.c vendor-crypto/openssl/dist/crypto/evp/encode.c vendor-crypto/openssl/dist/crypto/opensslv.h vendor-crypto/openssl/dist/crypto/pkcs12/p12_crt.c vendor-crypto/openssl/dist/crypto/pkcs12/p12_kiss.c vendor-crypto/openssl/dist/crypto/pkcs7/pk7_doit.c vendor-crypto/openssl/dist/crypto/pkcs7/pkcs7.h vendor-crypto/openssl/dist/crypto/pkcs7/pkcs7err.c vendor-crypto/openssl/dist/crypto/rsa/rsa_ameth.c vendor-crypto/openssl/dist/crypto/srp/srp_vfy.c vendor-crypto/openssl/dist/crypto/ts/ts_rsp_verify.c vendor-crypto/openssl/dist/crypto/x509v3/v3_purp.c vendor-crypto/openssl/dist/doc/apps/cms.pod vendor-crypto/openssl/dist/doc/apps/enc.pod vendor-crypto/openssl/dist/doc/apps/s_server.pod vendor-crypto/openssl/dist/doc/apps/smime.pod vendor-crypto/openssl/dist/doc/apps/verify.pod vendor-crypto/openssl/dist/doc/apps/version.pod vendor-crypto/openssl/dist/doc/apps/x509v3_config.pod vendor-crypto/openssl/dist/doc/crypto/CMS_decrypt.pod vendor-crypto/openssl/dist/doc/crypto/CONF_modules_free.pod vendor-crypto/openssl/dist/doc/crypto/CONF_modules_load_file.pod vendor-crypto/openssl/dist/doc/crypto/OPENSSL_config.pod vendor-crypto/openssl/dist/doc/crypto/X509_NAME_ENTRY_get_object.pod vendor-crypto/openssl/dist/doc/crypto/X509_STORE_CTX_get_ex_new_index.pod vendor-crypto/openssl/dist/doc/fingerprints.txt vendor-crypto/openssl/dist/doc/ssl/SSL_COMP_add_compression_method.pod vendor-crypto/openssl/dist/doc/ssl/SSL_CTX_add_session.pod vendor-crypto/openssl/dist/doc/ssl/SSL_CTX_load_verify_locations.pod vendor-crypto/openssl/dist/doc/ssl/SSL_CTX_set_client_CA_list.pod vendor-crypto/openssl/dist/doc/ssl/SSL_CTX_set_msg_callback.pod vendor-crypto/openssl/dist/doc/ssl/SSL_CTX_set_options.pod vendor-crypto/openssl/dist/doc/ssl/SSL_CTX_set_session_id_context.pod vendor-crypto/openssl/dist/doc/ssl/SSL_CTX_set_ssl_version.pod vendor-crypto/openssl/dist/doc/ssl/SSL_CTX_use_psk_identity_hint.pod vendor-crypto/openssl/dist/doc/ssl/SSL_accept.pod vendor-crypto/openssl/dist/doc/ssl/SSL_clear.pod vendor-crypto/openssl/dist/doc/ssl/SSL_connect.pod vendor-crypto/openssl/dist/doc/ssl/SSL_do_handshake.pod vendor-crypto/openssl/dist/doc/ssl/SSL_get_peer_cert_chain.pod vendor-crypto/openssl/dist/doc/ssl/SSL_read.pod vendor-crypto/openssl/dist/doc/ssl/SSL_session_reused.pod vendor-crypto/openssl/dist/doc/ssl/SSL_set_fd.pod vendor-crypto/openssl/dist/doc/ssl/SSL_set_session.pod vendor-crypto/openssl/dist/doc/ssl/SSL_shutdown.pod vendor-crypto/openssl/dist/doc/ssl/SSL_write.pod vendor-crypto/openssl/dist/engines/ccgost/gost_ameth.c vendor-crypto/openssl/dist/ssl/Makefile vendor-crypto/openssl/dist/ssl/d1_both.c vendor-crypto/openssl/dist/ssl/d1_lib.c vendor-crypto/openssl/dist/ssl/d1_pkt.c vendor-crypto/openssl/dist/ssl/d1_srvr.c vendor-crypto/openssl/dist/ssl/s3_clnt.c vendor-crypto/openssl/dist/ssl/s3_pkt.c vendor-crypto/openssl/dist/ssl/s3_srvr.c vendor-crypto/openssl/dist/ssl/ssl.h vendor-crypto/openssl/dist/ssl/ssl3.h vendor-crypto/openssl/dist/ssl/ssl_asn1.c vendor-crypto/openssl/dist/ssl/ssl_err.c vendor-crypto/openssl/dist/ssl/ssl_lib.c vendor-crypto/openssl/dist/ssl/t1_enc.c vendor-crypto/openssl/dist/ssl/t1_lib.c Modified: vendor-crypto/openssl/dist/ACKNOWLEDGMENTS ============================================================================== --- vendor-crypto/openssl/dist/ACKNOWLEDGMENTS Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/ACKNOWLEDGMENTS Fri Jun 6 20:59:29 2014 (r267188) @@ -10,13 +10,18 @@ OpenSSL project. We would like to identify and thank the following such sponsors for their past or current significant support of the OpenSSL project: +Major support: + + Qualys http://www.qualys.com/ + Very significant support: - OpenGear: www.opengear.com + OpenGear: http://www.opengear.com/ Significant support: - PSW Group: www.psw.net + PSW Group: http://www.psw.net/ + Acano Ltd. http://acano.com/ Please note that we ask permission to identify sponsors and that some sponsors we consider eligible for inclusion here have requested to remain anonymous. Modified: vendor-crypto/openssl/dist/CHANGES ============================================================================== --- vendor-crypto/openssl/dist/CHANGES Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/CHANGES Fri Jun 6 20:59:29 2014 (r267188) @@ -2,6 +2,50 @@ OpenSSL CHANGES _______________ + Changes between 1.0.1g and 1.0.1h [5 Jun 2014] + + *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted + handshake can force the use of weak keying material in OpenSSL + SSL/TLS clients and servers. + + Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and + researching this issue. (CVE-2014-0224) + [KIKUCHI Masashi, Steve Henson] + + *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an + OpenSSL DTLS client the code can be made to recurse eventually crashing + in a DoS attack. + + Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue. + (CVE-2014-0221) + [Imre Rad, Steve Henson] + + *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can + be triggered by sending invalid DTLS fragments to an OpenSSL DTLS + client or server. This is potentially exploitable to run arbitrary + code on a vulnerable client or server. + + Thanks to Jüri Aedla for reporting this issue. (CVE-2014-0195) + [Jüri Aedla, Steve Henson] + + *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites + are subject to a denial of service attack. + + Thanks to Felix Gröbert and Ivan Fratric at Google for discovering + this issue. (CVE-2014-3470) + [Felix Gröbert, Ivan Fratric, Steve Henson] + + *) Harmonize version and its documentation. -f flag is used to display + compilation flags. + [mancha <mancha1@zoho.com>] + + *) Fix eckey_priv_encode so it immediately returns an error upon a failure + in i2d_ECPrivateKey. + [mancha <mancha1@zoho.com>] + + *) Fix some double frees. These are not thought to be exploitable. + [mancha <mancha1@zoho.com>] + Changes between 1.0.1f and 1.0.1g [7 Apr 2014] *) A missing bounds check in the handling of the TLS heartbeat extension Modified: vendor-crypto/openssl/dist/FREEBSD-upgrade ============================================================================== --- vendor-crypto/openssl/dist/FREEBSD-upgrade Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/FREEBSD-upgrade Fri Jun 6 20:59:29 2014 (r267188) @@ -11,8 +11,8 @@ First, read http://wiki.freebsd.org/Subv # Xlist setenv XLIST /FreeBSD/work/openssl/svn-FREEBSD-files/FREEBSD-Xlist setenv FSVN "svn+ssh://svn.freebsd.org/base" -setenv OSSLVER 1.0.1g -# OSSLTAG format: v1_0_1g +setenv OSSLVER 1.0.1h +# OSSLTAG format: v1_0_1h ###setenv OSSLTAG v`echo ${OSSLVER} | tr . _` Modified: vendor-crypto/openssl/dist/Makefile ============================================================================== --- vendor-crypto/openssl/dist/Makefile Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/Makefile Fri Jun 6 20:59:29 2014 (r267188) @@ -4,7 +4,7 @@ ## Makefile for OpenSSL ## -VERSION=1.0.1g +VERSION=1.0.1h MAJOR=1 MINOR=0.1 SHLIB_VERSION_NUMBER=1.0.0 Modified: vendor-crypto/openssl/dist/NEWS ============================================================================== --- vendor-crypto/openssl/dist/NEWS Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/NEWS Fri Jun 6 20:59:29 2014 (r267188) @@ -5,6 +5,14 @@ This file gives a brief overview of the major changes between each OpenSSL release. For more details please read the CHANGES file. + Major changes between OpenSSL 1.0.1g and OpenSSL 1.0.1h [5 Jun 2014] + + o Fix for CVE-2014-0224 + o Fix for CVE-2014-0221 + o Fix for CVE-2014-0195 + o Fix for CVE-2014-3470 + o Fix for CVE-2010-5298 + Major changes between OpenSSL 1.0.1f and OpenSSL 1.0.1g [7 Apr 2014] o Fix for CVE-2014-0160 Modified: vendor-crypto/openssl/dist/README ============================================================================== --- vendor-crypto/openssl/dist/README Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/README Fri Jun 6 20:59:29 2014 (r267188) @@ -1,5 +1,5 @@ - OpenSSL 1.0.1g 7 Apr 2014 + OpenSSL 1.0.1h 5 Jun 2014 Copyright (c) 1998-2011 The OpenSSL Project Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson Modified: vendor-crypto/openssl/dist/apps/enc.c ============================================================================== --- vendor-crypto/openssl/dist/apps/enc.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/apps/enc.c Fri Jun 6 20:59:29 2014 (r267188) @@ -331,6 +331,12 @@ bad: setup_engine(bio_err, engine, 0); #endif + if (cipher && EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) + { + BIO_printf(bio_err, "AEAD ciphers not supported by the enc utility\n"); + goto end; + } + if (md && (dgst=EVP_get_digestbyname(md)) == NULL) { BIO_printf(bio_err,"%s is an unsupported message digest type\n",md); Modified: vendor-crypto/openssl/dist/apps/ocsp.c ============================================================================== --- vendor-crypto/openssl/dist/apps/ocsp.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/apps/ocsp.c Fri Jun 6 20:59:29 2014 (r267188) @@ -127,6 +127,7 @@ int MAIN(int argc, char **argv) ENGINE *e = NULL; char **args; char *host = NULL, *port = NULL, *path = "/"; + char *thost = NULL, *tport = NULL, *tpath = NULL; char *reqin = NULL, *respin = NULL; char *reqout = NULL, *respout = NULL; char *signfile = NULL, *keyfile = NULL; @@ -204,6 +205,12 @@ int MAIN(int argc, char **argv) } else if (!strcmp(*args, "-url")) { + if (thost) + OPENSSL_free(thost); + if (tport) + OPENSSL_free(tport); + if (tpath) + OPENSSL_free(tpath); if (args[1]) { args++; @@ -212,6 +219,9 @@ int MAIN(int argc, char **argv) BIO_printf(bio_err, "Error parsing URL\n"); badarg = 1; } + thost = host; + tport = port; + tpath = path; } else badarg = 1; } @@ -920,12 +930,12 @@ end: sk_X509_pop_free(verify_other, X509_free); sk_CONF_VALUE_pop_free(headers, X509V3_conf_free); - if (use_ssl != -1) - { - OPENSSL_free(host); - OPENSSL_free(port); - OPENSSL_free(path); - } + if (thost) + OPENSSL_free(thost); + if (tport) + OPENSSL_free(tport); + if (tpath) + OPENSSL_free(tpath); OPENSSL_EXIT(ret); } Modified: vendor-crypto/openssl/dist/apps/req.c ============================================================================== --- vendor-crypto/openssl/dist/apps/req.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/apps/req.c Fri Jun 6 20:59:29 2014 (r267188) @@ -1489,7 +1489,13 @@ start: #ifdef CHARSET_EBCDIC ebcdic2ascii(buf, buf, i); #endif - if(!req_check_len(i, n_min, n_max)) goto start; + if(!req_check_len(i, n_min, n_max)) + { + if (batch || value) + return 0; + goto start; + } + if (!X509_NAME_add_entry_by_NID(n,nid, chtype, (unsigned char *) buf, -1,-1,mval)) goto err; ret=1; @@ -1548,7 +1554,12 @@ start: #ifdef CHARSET_EBCDIC ebcdic2ascii(buf, buf, i); #endif - if(!req_check_len(i, n_min, n_max)) goto start; + if(!req_check_len(i, n_min, n_max)) + { + if (batch || value) + return 0; + goto start; + } if(!X509_REQ_add1_attr_by_NID(req, nid, chtype, (unsigned char *)buf, -1)) { Modified: vendor-crypto/openssl/dist/apps/s_cb.c ============================================================================== --- vendor-crypto/openssl/dist/apps/s_cb.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/apps/s_cb.c Fri Jun 6 20:59:29 2014 (r267188) @@ -747,6 +747,10 @@ void MS_CALLBACK tlsext_cb(SSL *s, int c break; #endif + case TLSEXT_TYPE_padding: + extname = "TLS padding"; + break; + default: extname = "unknown"; break; Modified: vendor-crypto/openssl/dist/apps/s_socket.c ============================================================================== --- vendor-crypto/openssl/dist/apps/s_socket.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/apps/s_socket.c Fri Jun 6 20:59:29 2014 (r267188) @@ -274,7 +274,7 @@ static int init_client_ip(int *sock, uns { i=0; i=setsockopt(s,SOL_SOCKET,SO_KEEPALIVE,(char *)&i,sizeof(i)); - if (i < 0) { perror("keepalive"); return(0); } + if (i < 0) { closesocket(s); perror("keepalive"); return(0); } } #endif @@ -450,6 +450,7 @@ redoit: if ((*host=(char *)OPENSSL_malloc(strlen(h1->h_name)+1)) == NULL) { perror("OPENSSL_malloc"); + closesocket(ret); return(0); } BUF_strlcpy(*host,h1->h_name,strlen(h1->h_name)+1); @@ -458,11 +459,13 @@ redoit: if (h2 == NULL) { BIO_printf(bio_err,"gethostbyname failure\n"); + closesocket(ret); return(0); } if (h2->h_addrtype != AF_INET) { BIO_printf(bio_err,"gethostbyname addr is not AF_INET\n"); + closesocket(ret); return(0); } } Modified: vendor-crypto/openssl/dist/apps/smime.c ============================================================================== --- vendor-crypto/openssl/dist/apps/smime.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/apps/smime.c Fri Jun 6 20:59:29 2014 (r267188) @@ -541,8 +541,8 @@ int MAIN(int argc, char **argv) { if (!cipher) { -#ifndef OPENSSL_NO_RC2 - cipher = EVP_rc2_40_cbc(); +#ifndef OPENSSL_NO_DES + cipher = EVP_des_ede3_cbc(); #else BIO_printf(bio_err, "No cipher selected\n"); goto end; Modified: vendor-crypto/openssl/dist/crypto/asn1/a_strnid.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/asn1/a_strnid.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/asn1/a_strnid.c Fri Jun 6 20:59:29 2014 (r267188) @@ -74,7 +74,7 @@ static int sk_table_cmp(const ASN1_STRIN * certain software (e.g. Netscape) has problems with them. */ -static unsigned long global_mask = 0xFFFFFFFFL; +static unsigned long global_mask = B_ASN1_UTF8STRING; void ASN1_STRING_set_default_mask(unsigned long mask) { Modified: vendor-crypto/openssl/dist/crypto/bio/bss_dgram.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/bio/bss_dgram.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/bio/bss_dgram.c Fri Jun 6 20:59:29 2014 (r267188) @@ -1333,7 +1333,7 @@ static long dgram_sctp_ctrl(BIO *b, int bio_dgram_sctp_data *data = NULL; socklen_t sockopt_len = 0; struct sctp_authkeyid authkeyid; - struct sctp_authkey *authkey; + struct sctp_authkey *authkey = NULL; data = (bio_dgram_sctp_data *)b->ptr; @@ -1388,6 +1388,11 @@ static long dgram_sctp_ctrl(BIO *b, int /* Add new key */ sockopt_len = sizeof(struct sctp_authkey) + 64 * sizeof(uint8_t); authkey = OPENSSL_malloc(sockopt_len); + if (authkey == NULL) + { + ret = -1; + break; + } memset(authkey, 0x00, sockopt_len); authkey->sca_keynumber = authkeyid.scact_keynumber + 1; #ifndef __FreeBSD__ @@ -1399,6 +1404,8 @@ static long dgram_sctp_ctrl(BIO *b, int memcpy(&authkey->sca_key[0], ptr, 64 * sizeof(uint8_t)); ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_KEY, authkey, sockopt_len); + OPENSSL_free(authkey); + authkey = NULL; if (ret < 0) break; /* Reset active key */ Modified: vendor-crypto/openssl/dist/crypto/bn/bn_mont.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/bn/bn_mont.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/bn/bn_mont.c Fri Jun 6 20:59:29 2014 (r267188) @@ -478,32 +478,38 @@ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CT BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, int lock, const BIGNUM *mod, BN_CTX *ctx) { - int got_write_lock = 0; BN_MONT_CTX *ret; CRYPTO_r_lock(lock); - if (!*pmont) + ret = *pmont; + CRYPTO_r_unlock(lock); + if (ret) + return ret; + + /* We don't want to serialise globally while doing our lazy-init math in + * BN_MONT_CTX_set. That punishes threads that are doing independent + * things. Instead, punish the case where more than one thread tries to + * lazy-init the same 'pmont', by having each do the lazy-init math work + * independently and only use the one from the thread that wins the race + * (the losers throw away the work they've done). */ + ret = BN_MONT_CTX_new(); + if (!ret) + return NULL; + if (!BN_MONT_CTX_set(ret, mod, ctx)) { - CRYPTO_r_unlock(lock); - CRYPTO_w_lock(lock); - got_write_lock = 1; + BN_MONT_CTX_free(ret); + return NULL; + } - if (!*pmont) - { - ret = BN_MONT_CTX_new(); - if (ret && !BN_MONT_CTX_set(ret, mod, ctx)) - BN_MONT_CTX_free(ret); - else - *pmont = ret; - } + /* The locked compare-and-set, after the local work is done. */ + CRYPTO_w_lock(lock); + if (*pmont) + { + BN_MONT_CTX_free(ret); + ret = *pmont; } - - ret = *pmont; - - if (got_write_lock) - CRYPTO_w_unlock(lock); else - CRYPTO_r_unlock(lock); - + *pmont = ret; + CRYPTO_w_unlock(lock); return ret; } Modified: vendor-crypto/openssl/dist/crypto/cms/cms_env.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/cms/cms_env.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/cms/cms_env.c Fri Jun 6 20:59:29 2014 (r267188) @@ -185,6 +185,8 @@ CMS_RecipientInfo *CMS_add1_recipient_ce if (flags & CMS_USE_KEYID) { ktri->version = 2; + if (env->version < 2) + env->version = 2; type = CMS_RECIPINFO_KEYIDENTIFIER; } else Modified: vendor-crypto/openssl/dist/crypto/cms/cms_sd.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/cms/cms_sd.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/cms/cms_sd.c Fri Jun 6 20:59:29 2014 (r267188) @@ -158,8 +158,8 @@ static void cms_sd_set_version(CMS_Signe if (sd->version < 3) sd->version = 3; } - else - sd->version = 1; + else if (si->version < 1) + si->version = 1; } if (sd->version < 1) Modified: vendor-crypto/openssl/dist/crypto/cms/cms_smime.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/cms/cms_smime.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/cms/cms_smime.c Fri Jun 6 20:59:29 2014 (r267188) @@ -611,7 +611,7 @@ int CMS_decrypt_set1_pkey(CMS_ContentInf STACK_OF(CMS_RecipientInfo) *ris; CMS_RecipientInfo *ri; int i, r; - int debug = 0; + int debug = 0, ri_match = 0; ris = CMS_get0_RecipientInfos(cms); if (ris) debug = cms->d.envelopedData->encryptedContentInfo->debug; @@ -620,6 +620,7 @@ int CMS_decrypt_set1_pkey(CMS_ContentInf ri = sk_CMS_RecipientInfo_value(ris, i); if (CMS_RecipientInfo_type(ri) != CMS_RECIPINFO_TRANS) continue; + ri_match = 1; /* If we have a cert try matching RecipientInfo * otherwise try them all. */ @@ -655,7 +656,7 @@ int CMS_decrypt_set1_pkey(CMS_ContentInf } } /* If no cert and not debugging always return success */ - if (!cert && !debug) + if (ri_match && !cert && !debug) { ERR_clear_error(); return 1; Modified: vendor-crypto/openssl/dist/crypto/dso/dso_dlfcn.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/dso/dso_dlfcn.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/dso/dso_dlfcn.c Fri Jun 6 20:59:29 2014 (r267188) @@ -464,7 +464,7 @@ static int dlfcn_pathbyaddr(void *addr,c return len; } - ERR_add_error_data(4, "dlfcn_pathbyaddr(): ", dlerror()); + ERR_add_error_data(2, "dlfcn_pathbyaddr(): ", dlerror()); #endif return -1; } Modified: vendor-crypto/openssl/dist/crypto/ec/ec_ameth.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/ec/ec_ameth.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/ec/ec_ameth.c Fri Jun 6 20:59:29 2014 (r267188) @@ -352,6 +352,7 @@ static int eckey_priv_encode(PKCS8_PRIV_ EC_KEY_set_enc_flags(ec_key, old_flags); OPENSSL_free(ep); ECerr(EC_F_ECKEY_PRIV_ENCODE, ERR_R_EC_LIB); + return 0; } /* restore old encoding flags */ EC_KEY_set_enc_flags(ec_key, old_flags); Modified: vendor-crypto/openssl/dist/crypto/ec/ec_asn1.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/ec/ec_asn1.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/ec/ec_asn1.c Fri Jun 6 20:59:29 2014 (r267188) @@ -1435,8 +1435,11 @@ int i2o_ECPublicKey(EC_KEY *a, unsigned *out, buf_len, NULL)) { ECerr(EC_F_I2O_ECPUBLICKEY, ERR_R_EC_LIB); - OPENSSL_free(*out); - *out = NULL; + if (new_buffer) + { + OPENSSL_free(*out); + *out = NULL; + } return 0; } if (!new_buffer) Modified: vendor-crypto/openssl/dist/crypto/ec/ec_lcl.h ============================================================================== --- vendor-crypto/openssl/dist/crypto/ec/ec_lcl.h Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/ec/ec_lcl.h Fri Jun 6 20:59:29 2014 (r267188) @@ -404,7 +404,7 @@ int ec_GF2m_simple_mul(const EC_GROUP *g int ec_GF2m_precompute_mult(EC_GROUP *group, BN_CTX *ctx); int ec_GF2m_have_precompute_mult(const EC_GROUP *group); -#ifndef OPENSSL_EC_NISTP_64_GCC_128 +#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128 /* method functions in ecp_nistp224.c */ int ec_GFp_nistp224_group_init(EC_GROUP *group); int ec_GFp_nistp224_group_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *n, BN_CTX *); Modified: vendor-crypto/openssl/dist/crypto/evp/bio_b64.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/evp/bio_b64.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/evp/bio_b64.c Fri Jun 6 20:59:29 2014 (r267188) @@ -226,6 +226,7 @@ static int b64_read(BIO *b, char *out, i else if (ctx->start) { q=p=(unsigned char *)ctx->tmp; + num = 0; for (j=0; j<i; j++) { if (*(q++) != '\n') continue; Modified: vendor-crypto/openssl/dist/crypto/evp/encode.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/evp/encode.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/evp/encode.c Fri Jun 6 20:59:29 2014 (r267188) @@ -324,6 +324,7 @@ int EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx v=EVP_DecodeBlock(out,d,n); n=0; if (v < 0) { rv=0; goto end; } + if (eof > v) { rv=-1; goto end; } ret+=(v-eof); } else Modified: vendor-crypto/openssl/dist/crypto/opensslv.h ============================================================================== --- vendor-crypto/openssl/dist/crypto/opensslv.h Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/opensslv.h Fri Jun 6 20:59:29 2014 (r267188) @@ -25,11 +25,11 @@ * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for * major minor fix final patch/beta) */ -#define OPENSSL_VERSION_NUMBER 0x1000107fL +#define OPENSSL_VERSION_NUMBER 0x1000108fL #ifdef OPENSSL_FIPS -#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1g-fips 7 Apr 2014" +#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1h-fips 5 Jun 2014" #else -#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1g 7 Apr 2014" +#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1h 5 Jun 2014" #endif #define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT Modified: vendor-crypto/openssl/dist/crypto/pkcs12/p12_crt.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/pkcs12/p12_crt.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/pkcs12/p12_crt.c Fri Jun 6 20:59:29 2014 (r267188) @@ -96,7 +96,11 @@ PKCS12 *PKCS12_create(char *pass, char * nid_cert = NID_pbe_WithSHA1And3_Key_TripleDES_CBC; else #endif +#ifdef OPENSSL_NO_RC2 + nid_cert = NID_pbe_WithSHA1And3_Key_TripleDES_CBC; +#else nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC; +#endif } if (!nid_key) nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC; @@ -286,7 +290,11 @@ int PKCS12_add_safe(STACK_OF(PKCS7) **ps free_safes = 0; if (nid_safe == 0) +#ifdef OPENSSL_NO_RC2 + nid_safe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC; +#else nid_safe = NID_pbe_WithSHA1And40BitRC2_CBC; +#endif if (nid_safe == -1) p7 = PKCS12_pack_p7data(bags); Modified: vendor-crypto/openssl/dist/crypto/pkcs12/p12_kiss.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/pkcs12/p12_kiss.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/pkcs12/p12_kiss.c Fri Jun 6 20:59:29 2014 (r267188) @@ -269,7 +269,7 @@ static int parse_bag(PKCS12_SAFEBAG *bag int len, r; unsigned char *data; len = ASN1_STRING_to_UTF8(&data, fname); - if(len > 0) { + if(len >= 0) { r = X509_alias_set1(x509, data, len); OPENSSL_free(data); if (!r) Modified: vendor-crypto/openssl/dist/crypto/pkcs7/pk7_doit.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/pkcs7/pk7_doit.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/pkcs7/pk7_doit.c Fri Jun 6 20:59:29 2014 (r267188) @@ -440,6 +440,11 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKE { case NID_pkcs7_signed: data_body=PKCS7_get_octet_string(p7->d.sign->contents); + if (!PKCS7_is_detached(p7) && data_body == NULL) + { + PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_INVALID_SIGNED_DATA_TYPE); + goto err; + } md_sk=p7->d.sign->md_algs; break; case NID_pkcs7_signedAndEnveloped: @@ -928,6 +933,7 @@ int PKCS7_SIGNER_INFO_sign(PKCS7_SIGNER_ if (EVP_DigestSignUpdate(&mctx,abuf,alen) <= 0) goto err; OPENSSL_free(abuf); + abuf = NULL; if (EVP_DigestSignFinal(&mctx, NULL, &siglen) <= 0) goto err; abuf = OPENSSL_malloc(siglen); Modified: vendor-crypto/openssl/dist/crypto/pkcs7/pkcs7.h ============================================================================== --- vendor-crypto/openssl/dist/crypto/pkcs7/pkcs7.h Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/pkcs7/pkcs7.h Fri Jun 6 20:59:29 2014 (r267188) @@ -453,6 +453,7 @@ void ERR_load_PKCS7_strings(void); #define PKCS7_R_ERROR_SETTING_CIPHER 121 #define PKCS7_R_INVALID_MIME_TYPE 131 #define PKCS7_R_INVALID_NULL_POINTER 143 +#define PKCS7_R_INVALID_SIGNED_DATA_TYPE 155 #define PKCS7_R_MIME_NO_CONTENT_TYPE 132 #define PKCS7_R_MIME_PARSE_ERROR 133 #define PKCS7_R_MIME_SIG_PARSE_ERROR 134 Modified: vendor-crypto/openssl/dist/crypto/pkcs7/pkcs7err.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/pkcs7/pkcs7err.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/pkcs7/pkcs7err.c Fri Jun 6 20:59:29 2014 (r267188) @@ -1,6 +1,6 @@ /* crypto/pkcs7/pkcs7err.c */ /* ==================================================================== - * Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved. + * Copyright (c) 1999-2014 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -130,6 +130,7 @@ static ERR_STRING_DATA PKCS7_str_reasons {ERR_REASON(PKCS7_R_ERROR_SETTING_CIPHER),"error setting cipher"}, {ERR_REASON(PKCS7_R_INVALID_MIME_TYPE) ,"invalid mime type"}, {ERR_REASON(PKCS7_R_INVALID_NULL_POINTER),"invalid null pointer"}, +{ERR_REASON(PKCS7_R_INVALID_SIGNED_DATA_TYPE),"invalid signed data type"}, {ERR_REASON(PKCS7_R_MIME_NO_CONTENT_TYPE),"mime no content type"}, {ERR_REASON(PKCS7_R_MIME_PARSE_ERROR) ,"mime parse error"}, {ERR_REASON(PKCS7_R_MIME_SIG_PARSE_ERROR),"mime sig parse error"}, Modified: vendor-crypto/openssl/dist/crypto/rsa/rsa_ameth.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/rsa/rsa_ameth.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/rsa/rsa_ameth.c Fri Jun 6 20:59:29 2014 (r267188) @@ -358,7 +358,7 @@ static int rsa_pss_param_print(BIO *bp, if (i2a_ASN1_INTEGER(bp, pss->saltLength) <= 0) goto err; } - else if (BIO_puts(bp, "0x14 (default)") <= 0) + else if (BIO_puts(bp, "14 (default)") <= 0) goto err; BIO_puts(bp, "\n"); Modified: vendor-crypto/openssl/dist/crypto/srp/srp_vfy.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/srp/srp_vfy.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/srp/srp_vfy.c Fri Jun 6 20:59:29 2014 (r267188) @@ -93,6 +93,9 @@ static int t_fromb64(unsigned char *a, c else a[i] = loc - b64table; ++i; } + /* if nothing valid to process we have a zero length response */ + if (i == 0) + return 0; size = i; i = size - 1; j = size; Modified: vendor-crypto/openssl/dist/crypto/ts/ts_rsp_verify.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/ts/ts_rsp_verify.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/ts/ts_rsp_verify.c Fri Jun 6 20:59:29 2014 (r267188) @@ -629,6 +629,7 @@ static int TS_compute_imprint(BIO *data, X509_ALGOR_free(*md_alg); OPENSSL_free(*imprint); *imprint_len = 0; + *imprint = NULL; return 0; } Modified: vendor-crypto/openssl/dist/crypto/x509v3/v3_purp.c ============================================================================== --- vendor-crypto/openssl/dist/crypto/x509v3/v3_purp.c Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/crypto/x509v3/v3_purp.c Fri Jun 6 20:59:29 2014 (r267188) @@ -389,8 +389,8 @@ static void x509v3_cache_extensions(X509 /* Handle proxy certificates */ if((pci=X509_get_ext_d2i(x, NID_proxyCertInfo, NULL, NULL))) { if (x->ex_flags & EXFLAG_CA - || X509_get_ext_by_NID(x, NID_subject_alt_name, 0) >= 0 - || X509_get_ext_by_NID(x, NID_issuer_alt_name, 0) >= 0) { + || X509_get_ext_by_NID(x, NID_subject_alt_name, -1) >= 0 + || X509_get_ext_by_NID(x, NID_issuer_alt_name, -1) >= 0) { x->ex_flags |= EXFLAG_INVALID; } if (pci->pcPathLengthConstraint) { @@ -670,7 +670,7 @@ static int check_purpose_timestamp_sign( return 0; /* Extended Key Usage MUST be critical */ - i_ext = X509_get_ext_by_NID((X509 *) x, NID_ext_key_usage, 0); + i_ext = X509_get_ext_by_NID((X509 *) x, NID_ext_key_usage, -1); if (i_ext >= 0) { X509_EXTENSION *ext = X509_get_ext((X509 *) x, i_ext); Modified: vendor-crypto/openssl/dist/doc/apps/cms.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/apps/cms.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/apps/cms.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -90,6 +90,11 @@ decrypt mail using the supplied certific encrypted mail message in MIME format for the input file. The decrypted mail is written to the output file. +=item B<-debug_decrypt> + +this option sets the B<CMS_DEBUG_DECRYPT> flag. This option should be used +with caution: see the notes section below. + =item B<-sign> sign mail using the supplied certificate and private key. Input file is @@ -446,32 +451,42 @@ Streaming is always used for the B<-sign since the content is no longer part of the CMS structure the encoding remains DER. +If the B<-decrypt> option is used without a recipient certificate then an +attempt is made to locate the recipient by trying each potential recipient +in turn using the supplied private key. To thwart the MMA attack +(Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) all recipients are +tried whether they succeed or not and if no recipients match the message +is "decrypted" using a random key which will typically output garbage. +The B<-debug_decrypt> option can be used to disable the MMA attack protection +and return an error if no recipient can be found: this option should be used +with caution. For a fuller description see L<CMS_decrypt(3)|CMS_decrypt(3)>). + =head1 EXIT CODES =over 4 -=item 0 +=item Z<>0 the operation was completely successfully. -=item 1 +=item Z<>1 an error occurred parsing the command options. -=item 2 +=item Z<>2 one of the input files could not be read. -=item 3 +=item Z<>3 an error occurred creating the CMS file or when reading the MIME message. -=item 4 +=item Z<>4 an error occurred decrypting or verifying the message. -=item 5 +=item Z<>5 the message was verified correctly but an error occurred writing out the signers certificates. Modified: vendor-crypto/openssl/dist/doc/apps/enc.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/apps/enc.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/apps/enc.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -215,6 +215,10 @@ unsupported options (for example B<opens list of ciphers, supported by your versesion of OpenSSL, including ones provided by configured engines. +The B<enc> program does not support authenticated encryption modes +like CCM and GCM. The utility does not store or retrieve the +authentication tag. + base64 Base 64 Modified: vendor-crypto/openssl/dist/doc/apps/s_server.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/apps/s_server.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/apps/s_server.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -44,6 +44,7 @@ B<openssl> B<s_server> [B<-no_ssl3>] [B<-no_tls1>] [B<-no_dhe>] +[B<-no_ecdhe>] [B<-bugs>] [B<-hack>] [B<-www>] @@ -131,6 +132,11 @@ a static set of parameters hard coded in if this option is set then no DH parameters will be loaded effectively disabling the ephemeral DH cipher suites. +=item B<-no_ecdhe> + +if this option is set then no ECDH parameters will be loaded effectively +disabling the ephemeral ECDH cipher suites. + =item B<-no_tmp_rsa> certain export cipher suites sometimes use a temporary RSA key, this option Modified: vendor-crypto/openssl/dist/doc/apps/smime.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/apps/smime.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/apps/smime.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -159,7 +159,7 @@ EVP_get_cipherbyname() function) can als example B<-aes_128_cbc>. See L<B<enc>|enc(1)> for list of ciphers supported by your version of OpenSSL. -If not specified 40 bit RC2 is used. Only used with B<-encrypt>. +If not specified triple DES is used. Only used with B<-encrypt>. =item B<-nointern> @@ -308,28 +308,28 @@ remains DER. =over 4 -=item 0 +=item Z<>0 the operation was completely successfully. -=item 1 +=item Z<>1 an error occurred parsing the command options. -=item 2 +=item Z<>2 one of the input files could not be read. -=item 3 +=item Z<>3 an error occurred creating the PKCS#7 file or when reading the MIME message. -=item 4 +=item Z<>4 an error occurred decrypting or verifying the message. -=item 5 +=item Z<>5 the message was verified correctly but an error occurred writing out the signers certificates. Modified: vendor-crypto/openssl/dist/doc/apps/verify.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/apps/verify.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/apps/verify.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -25,6 +25,7 @@ B<openssl> B<verify> [B<-untrusted file>] [B<-help>] [B<-issuer_checks>] +[B<-attime timestamp>] [B<-verbose>] [B<->] [certificates] @@ -80,6 +81,12 @@ rejected. The presence of rejection mess anything is wrong; during the normal verification process, several rejections may take place. +=item B<-attime timestamp> + +Perform validation checks using time specified by B<timestamp> and not +current system time. B<timestamp> is the number of seconds since +01.01.1970 (UNIX time). + =item B<-policy arg> Enable policy processing and add B<arg> to the user-initial-policy-set (see @@ -386,7 +393,7 @@ an application specific error. Unused. =head1 BUGS -Although the issuer checks are a considerably improvement over the old technique they still +Although the issuer checks are a considerable improvement over the old technique they still suffer from limitations in the underlying X509_LOOKUP API. One consequence of this is that trusted certificates with matching subject name must either appear in a file (as specified by the B<-CAfile> option) or a directory (as specified by B<-CApath>. If they occur in both then only Modified: vendor-crypto/openssl/dist/doc/apps/version.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/apps/version.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/apps/version.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -13,6 +13,7 @@ B<openssl version> [B<-o>] [B<-f>] [B<-p>] +[B<-d>] =head1 DESCRIPTION @@ -38,7 +39,7 @@ the date the current version of OpenSSL option information: various options set when the library was built. -=item B<-c> +=item B<-f> compilation flags. Modified: vendor-crypto/openssl/dist/doc/apps/x509v3_config.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/apps/x509v3_config.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/apps/x509v3_config.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -301,7 +301,7 @@ Example: O=Organisation CN=Some Name - + =head2 Certificate Policies. This is a I<raw> extension. All the fields of this extension can be set by @@ -390,7 +390,7 @@ Examples: nameConstraints=permitted;email:.somedomain.com nameConstraints=excluded;email:.com -issuingDistributionPoint = idp_section + =head2 OCSP No Check Modified: vendor-crypto/openssl/dist/doc/crypto/CMS_decrypt.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/crypto/CMS_decrypt.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/crypto/CMS_decrypt.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -27,7 +27,21 @@ function or errors about unknown algorit Although the recipients certificate is not needed to decrypt the data it is needed to locate the appropriate (of possible several) recipients in the CMS -structure. If B<cert> is set to NULL all possible recipients are tried. +structure. + +If B<cert> is set to NULL all possible recipients are tried. This case however +is problematic. To thwart the MMA attack (Bleichenbacher's attack on +PKCS #1 v1.5 RSA padding) all recipients are tried whether they succeed or +not. If no recipient succeeds then a random symmetric key is used to decrypt +the content: this will typically output garbage and may (but is not guaranteed +to) ultimately return a padding error only. If CMS_decrypt() just returned an +error when all recipient encrypted keys failed to decrypt an attacker could +use this in a timing attack. If the special flag B<CMS_DEBUG_DECRYPT> is set +then the above behaviour is modified and an error B<is> returned if no +recipient encrypted key can be decrypted B<without> generating a random +content encryption key. Applications should use this flag with +B<extreme caution> especially in automated gateways as it can leave them +open to attack. It is possible to determine the correct recipient key by other means (for example looking them up in a database) and setting them in the CMS structure Modified: vendor-crypto/openssl/dist/doc/crypto/CONF_modules_free.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/crypto/CONF_modules_free.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/crypto/CONF_modules_free.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -37,7 +37,7 @@ None of the functions return a value. =head1 SEE ALSO L<conf(5)|conf(5)>, L<OPENSSL_config(3)|OPENSSL_config(3)>, -L<CONF_modules_load_file(3), CONF_modules_load_file(3)> +L<CONF_modules_load_file(3)|CONF_modules_load_file(3)> =head1 HISTORY Modified: vendor-crypto/openssl/dist/doc/crypto/CONF_modules_load_file.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/crypto/CONF_modules_load_file.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/crypto/CONF_modules_load_file.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -51,7 +51,7 @@ return value of the failing module (this =head1 SEE ALSO L<conf(5)|conf(5)>, L<OPENSSL_config(3)|OPENSSL_config(3)>, -L<CONF_free(3), CONF_free(3)>, L<err(3),err(3)> +L<CONF_free(3)|CONF_free(3)>, L<err(3)|err(3)> =head1 HISTORY Modified: vendor-crypto/openssl/dist/doc/crypto/OPENSSL_config.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/crypto/OPENSSL_config.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/crypto/OPENSSL_config.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -73,7 +73,7 @@ Neither OPENSSL_config() nor OPENSSL_no_ =head1 SEE ALSO L<conf(5)|conf(5)>, L<CONF_load_modules_file(3)|CONF_load_modules_file(3)>, -L<CONF_modules_free(3),CONF_modules_free(3)> +L<CONF_modules_free(3)|CONF_modules_free(3)> =head1 HISTORY Modified: vendor-crypto/openssl/dist/doc/crypto/X509_NAME_ENTRY_get_object.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/crypto/X509_NAME_ENTRY_get_object.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/crypto/X509_NAME_ENTRY_get_object.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -65,7 +65,7 @@ set first so the relevant field informat =head1 SEE ALSO L<ERR_get_error(3)|ERR_get_error(3)>, L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>, -L<OBJ_nid2obj(3),OBJ_nid2obj(3)> +L<OBJ_nid2obj(3)|OBJ_nid2obj(3)> =head1 HISTORY Modified: vendor-crypto/openssl/dist/doc/crypto/X509_STORE_CTX_get_ex_new_index.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/crypto/X509_STORE_CTX_get_ex_new_index.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/crypto/X509_STORE_CTX_get_ex_new_index.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -15,7 +15,7 @@ X509_STORE_CTX_get_ex_new_index, X509_ST int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *d, int idx, void *arg); - char *X509_STORE_CTX_get_ex_data(X509_STORE_CTX *d, int idx); + void *X509_STORE_CTX_get_ex_data(X509_STORE_CTX *d, int idx); =head1 DESCRIPTION Modified: vendor-crypto/openssl/dist/doc/fingerprints.txt ============================================================================== --- vendor-crypto/openssl/dist/doc/fingerprints.txt Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/fingerprints.txt Fri Jun 6 20:59:29 2014 (r267188) @@ -21,6 +21,13 @@ pub 2048R/F295C759 1998-12-13 Key fingerprint = D0 5D 8C 61 6E 27 E6 60 41 EC B1 B8 D5 7E E5 97 uid Dr S N Henson <shenson@drh-consultancy.demon.co.uk> +pub 4096R/FA40E9E2 2005-03-19 + Key fingerprint = 6260 5AA4 334A F9F0 DDE5 D349 D357 7507 FA40 E9E2 +uid Dr Stephen Henson <shenson@opensslfoundation.com> +uid Dr Stephen Henson <shenson@drh-consultancy.co.uk> +uid Dr Stephen N Henson <steve@openssl.org> +sub 4096R/8811F530 2005-03-19 + pub 1024R/49A563D9 1997-02-24 Key fingerprint = 7B 79 19 FA 71 6B 87 25 0E 77 21 E5 52 D9 83 BF uid Mark Cox <mjc@redhat.com> Modified: vendor-crypto/openssl/dist/doc/ssl/SSL_COMP_add_compression_method.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/ssl/SSL_COMP_add_compression_method.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/ssl/SSL_COMP_add_compression_method.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -53,11 +53,11 @@ SSL_COMP_add_compression_method() may re =over 4 -=item 0 +=item Z<>0 The operation succeeded. -=item 1 +=item Z<>1 The operation failed. Check the error queue to find out the reason. Modified: vendor-crypto/openssl/dist/doc/ssl/SSL_CTX_add_session.pod ============================================================================== --- vendor-crypto/openssl/dist/doc/ssl/SSL_CTX_add_session.pod Fri Jun 6 20:49:56 2014 (r267187) +++ vendor-crypto/openssl/dist/doc/ssl/SSL_CTX_add_session.pod Fri Jun 6 20:59:29 2014 (r267188) @@ -52,13 +52,13 @@ The following values are returned by all =over 4 -=item 0 *** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201406062059.s56KxTj7048744>