[openssl-commits] [openssl] OpenSSL_1_0_1-stable update
Matt Caswell
matt at openssl.org
Thu Jan 28 17:06:55 UTC 2016
The branch OpenSSL_1_0_1-stable has been updated
via 69ff2444908e73d4b973f42daf989b46c774772e (commit)
via 09ccb58518e84f76939f7e69929723263a42ca2e (commit)
via 6210c70992011d6f4c52b63b0a1da3c3471ba5b0 (commit)
via bea4cb2e804160f08bd7f10286946c422e38ac3c (commit)
via 5fed60f9622c023c358f2f8e5cb6692b5cc2d9bb (commit)
via 4040a7fd104b412bd446338c6c28a62eb7d8e852 (commit)
via 8bc643efc89cbcfba17369801cf4eeca037b6cc1 (commit)
from 126ac21c80967ec00f802d356462c1b83fa0f54c (commit)
- Log -----------------------------------------------------------------
commit 69ff2444908e73d4b973f42daf989b46c774772e
Author: Matt Caswell <matt at openssl.org>
Date: Thu Jan 28 14:22:09 2016 +0000
Prepare for 1.0.1s-dev
Reviewed-by: Richard Levitte <levitte at openssl.org>
commit 09ccb58518e84f76939f7e69929723263a42ca2e
Author: Matt Caswell <matt at openssl.org>
Date: Thu Jan 28 14:21:21 2016 +0000
Prepare for 1.0.1r release
Reviewed-by: Richard Levitte <levitte at openssl.org>
commit 6210c70992011d6f4c52b63b0a1da3c3471ba5b0
Author: Richard Levitte <levitte at openssl.org>
Date: Thu Jan 28 15:18:50 2016 +0100
TARFILE wasn't correctly set
This solves an earlier cherry-pick mistake.
Reviewed-by: Matt Caswell <matt at openssl.org>
commit bea4cb2e804160f08bd7f10286946c422e38ac3c
Author: Matt Caswell <matt at openssl.org>
Date: Thu Jan 28 12:28:53 2016 +0000
Further updates to CHANGES and NEWS
Reviewed-by: Richard Levitte <levitte at openssl.org>
commit 5fed60f9622c023c358f2f8e5cb6692b5cc2d9bb
Author: Matt Caswell <matt at openssl.org>
Date: Wed Jan 27 13:55:05 2016 +0000
Update CHANGES and NEWS ready for release
Update CHANGES and NEWS with details of the issues fixed in the forthcoming
release.
Reviewed-by: Rich Salz <rsalz at openssl.org>
commit 4040a7fd104b412bd446338c6c28a62eb7d8e852
Author: Viktor Dukhovni <openssl-users at dukhovni.org>
Date: Wed Dec 30 22:44:51 2015 -0500
Better SSLv2 cipher-suite enforcement
Based on patch by: Nimrod Aviram <nimrod.aviram at gmail.com>
CVE-2015-3197
Reviewed-by: Tim Hudson <tjh at openssl.org>
Reviewed-by: Richard Levitte <levitte at openssl.org>
commit 8bc643efc89cbcfba17369801cf4eeca037b6cc1
Author: Matt Caswell <matt at openssl.org>
Date: Thu Dec 17 02:57:20 2015 +0000
Always generate DH keys for ephemeral DH cipher suites
Modified version of the commit ffaef3f15 in the master branch by Stephen
Henson. This makes the SSL_OP_SINGLE_DH_USE option a no-op and always
generates a new DH key for every handshake regardless.
This is a follow on from CVE-2016-0701. This branch is not impacted by
that CVE because it does not support X9.42 style parameters. It is still
possible to generate parameters based on primes that are not "safe",
although by default OpenSSL does not do this. The documentation does
sign post that using such parameters is unsafe if the private DH key is
reused. However to avoid accidental problems or future attacks this commit
has been backported to this branch.
Issue reported by Antonio Sanso
Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
-----------------------------------------------------------------------
Summary of changes:
CHANGES | 25 ++++++++++++++++++++++++-
Makefile.org | 2 +-
NEWS | 7 ++++++-
README | 2 +-
crypto/opensslv.h | 6 +++---
doc/ssl/SSL_CTX_set_tmp_dh_callback.pod | 29 +++++------------------------
openssl.spec | 2 +-
ssl/s2_srvr.c | 15 +++++++++++++--
ssl/s3_lib.c | 14 --------------
ssl/s3_srvr.c | 17 +++--------------
ssl/ssl.h | 2 +-
11 files changed, 58 insertions(+), 63 deletions(-)
diff --git a/CHANGES b/CHANGES
index 23ca912..39ab8bd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,30 @@
OpenSSL CHANGES
_______________
- Changes between 1.0.1q and 1.0.1r [xx XXX xxxx]
+ Changes between 1.0.1r and 1.0.1s [xx XXX xxxx]
+
+ *)
+
+ Changes between 1.0.1q and 1.0.1r [28 Jan 2016]
+
+ *) Protection for DH small subgroup attacks
+
+ As a precautionary measure the SSL_OP_SINGLE_DH_USE option has been
+ switched on by default and cannot be disabled. This could have some
+ performance impact.
+ [Matt Caswell]
+
+ *) SSLv2 doesn't block disabled ciphers
+
+ A malicious client can negotiate SSLv2 ciphers that have been disabled on
+ the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
+ been disabled, provided that the SSLv2 protocol was not also disabled via
+ SSL_OP_NO_SSLv2.
+
+ This issue was reported to OpenSSL on 26th December 2015 by Nimrod Aviram
+ and Sebastian Schinzel.
+ (CVE-2015-3197)
+ [Viktor Dukhovni]
*) Reject DH handshakes with parameters shorter than 1024 bits.
[Kurt Roeckx]
diff --git a/Makefile.org b/Makefile.org
index b0e0f3d..bc1c3be 100644
--- a/Makefile.org
+++ b/Makefile.org
@@ -179,7 +179,7 @@ SHARED_LDFLAGS=
GENERAL= Makefile
BASENAME= openssl
NAME= $(BASENAME)-$(VERSION)
-TARFILE= $(NAME).tar
+TARFILE= ../$(NAME).tar
EXHEADER= e_os2.h
HEADER= e_os.h
diff --git a/NEWS b/NEWS
index e712f14..4340554 100644
--- a/NEWS
+++ b/NEWS
@@ -5,10 +5,15 @@
This file gives a brief overview of the major changes between each OpenSSL
release. For more details please read the CHANGES file.
- Major changes between OpenSSL 1.0.1q and OpenSSL 1.0.1r [under development]
+ Major changes between OpenSSL 1.0.1r and OpenSSL 1.0.1s [under development]
o
+ Major changes between OpenSSL 1.0.1q and OpenSSL 1.0.1r [28 Jan 2016]
+
+ o Protection for DH small subgroup attacks
+ o SSLv2 doesn't block disabled ciphers (CVE-2015-3197)
+
Major changes between OpenSSL 1.0.1p and OpenSSL 1.0.1q [3 Dec 2015]
o Certificate verify crash with missing PSS parameter (CVE-2015-3194)
diff --git a/README b/README
index 13d7b2c..642ed55 100644
--- a/README
+++ b/README
@@ -1,5 +1,5 @@
- OpenSSL 1.0.1r-dev
+ OpenSSL 1.0.1s-dev
Copyright (c) 1998-2015 The OpenSSL Project
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
diff --git a/crypto/opensslv.h b/crypto/opensslv.h
index 0bb1bc1..471767c 100644
--- a/crypto/opensslv.h
+++ b/crypto/opensslv.h
@@ -30,11 +30,11 @@ extern "C" {
* (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
* major minor fix final patch/beta)
*/
-# define OPENSSL_VERSION_NUMBER 0x10001120L
+# define OPENSSL_VERSION_NUMBER 0x10001130L
# ifdef OPENSSL_FIPS
-# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1r-fips-dev xx XXX xxxx"
+# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1s-fips-dev xx XXX xxxx"
# else
-# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1r-dev xx XXX xxxx"
+# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1s-dev xx XXX xxxx"
# endif
# define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT
diff --git a/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod b/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod
index b754c16..234fbc8 100644
--- a/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod
+++ b/doc/ssl/SSL_CTX_set_tmp_dh_callback.pod
@@ -48,25 +48,8 @@ even if he gets hold of the normal (certified) key, as this key was
only used for signing.
In order to perform a DH key exchange the server must use a DH group
-(DH parameters) and generate a DH key.
-The server will always generate a new DH key during the negotiation
-if either the DH parameters are supplied via callback or the
-SSL_OP_SINGLE_DH_USE option of SSL_CTX_set_options(3) is set (or both).
-It will immediately create a DH key if DH parameters are supplied via
-SSL_CTX_set_tmp_dh() and SSL_OP_SINGLE_DH_USE is not set.
-In this case,
-it may happen that a key is generated on initialization without later
-being needed, while on the other hand the computer time during the
-negotiation is being saved.
-
-If "strong" primes were used to generate the DH parameters, it is not strictly
-necessary to generate a new key for each handshake but it does improve forward
-secrecy. If it is not assured that "strong" primes were used,
-SSL_OP_SINGLE_DH_USE must be used in order to prevent small subgroup
-attacks. Always using SSL_OP_SINGLE_DH_USE has an impact on the
-computer time needed during negotiation, but it is not very large, so
-application authors/users should consider always enabling this option.
-The option is required to implement perfect forward secrecy (PFS).
+(DH parameters) and generate a DH key. The server will always generate
+a new DH key during the negotiation.
As generating DH parameters is extremely time consuming, an application
should not generate the parameters on the fly but supply the parameters.
@@ -93,10 +76,9 @@ can supply the DH parameters via a callback function.
Previous versions of the callback used B<is_export> and B<keylength>
parameters to control parameter generation for export and non-export
cipher suites. Modern servers that do not support export ciphersuites
-are advised to either use SSL_CTX_set_tmp_dh() in combination with
-SSL_OP_SINGLE_DH_USE, or alternatively, use the callback but ignore
-B<keylength> and B<is_export> and simply supply at least 2048-bit
-parameters in the callback.
+are advised to either use SSL_CTX_set_tmp_dh() or alternatively, use
+the callback but ignore B<keylength> and B<is_export> and simply
+supply at least 2048-bit parameters in the callback.
=head1 EXAMPLES
@@ -128,7 +110,6 @@ partly left out.)
if (SSL_CTX_set_tmp_dh(ctx, dh_2048) != 1) {
/* Error. */
}
- SSL_CTX_set_options(ctx, SSL_OP_SINGLE_DH_USE);
...
=head1 RETURN VALUES
diff --git a/openssl.spec b/openssl.spec
index 386f9f6..67a2a33 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -7,7 +7,7 @@ Release: 1
Summary: Secure Sockets Layer and cryptography libraries and tools
Name: openssl
#Version: %{libmaj}.%{libmin}.%{librel}
-Version: 1.0.1r
+Version: 1.0.1s
Source0: ftp://ftp.openssl.org/source/%{name}-%{version}.tar.gz
License: OpenSSL
Group: System Environment/Libraries
diff --git a/ssl/s2_srvr.c b/ssl/s2_srvr.c
index 5e2e0ac..07e9df8 100644
--- a/ssl/s2_srvr.c
+++ b/ssl/s2_srvr.c
@@ -402,7 +402,7 @@ static int get_client_master_key(SSL *s)
}
cp = ssl2_get_cipher_by_char(p);
- if (cp == NULL) {
+ if (cp == NULL || sk_SSL_CIPHER_find(s->session->ciphers, cp) < 0) {
ssl2_return_error(s, SSL2_PE_NO_CIPHER);
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_NO_CIPHER_MATCH);
return (-1);
@@ -692,8 +692,12 @@ static int get_client_hello(SSL *s)
prio = cs;
allow = cl;
}
+
+ /* Generate list of SSLv2 ciphers shared between client and server */
for (z = 0; z < sk_SSL_CIPHER_num(prio); z++) {
- if (sk_SSL_CIPHER_find(allow, sk_SSL_CIPHER_value(prio, z)) < 0) {
+ const SSL_CIPHER *cp = sk_SSL_CIPHER_value(prio, z);
+ if ((cp->algorithm_ssl & SSL_SSLV2) == 0 ||
+ sk_SSL_CIPHER_find(allow, cp) < 0) {
(void)sk_SSL_CIPHER_delete(prio, z);
z--;
}
@@ -702,6 +706,13 @@ static int get_client_hello(SSL *s)
sk_SSL_CIPHER_free(s->session->ciphers);
s->session->ciphers = prio;
}
+
+ /* Make sure we have at least one cipher in common */
+ if (sk_SSL_CIPHER_num(s->session->ciphers) == 0) {
+ ssl2_return_error(s, SSL2_PE_NO_CIPHER);
+ SSLerr(SSL_F_GET_CLIENT_HELLO, SSL_R_NO_CIPHER_MATCH);
+ return -1;
+ }
/*
* s->session->ciphers should now have a list of ciphers that are on
* both the client and server. This list is ordered by the order the
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index d3d8221..167e3cc 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -3164,13 +3164,6 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
return (ret);
}
- if (!(s->options & SSL_OP_SINGLE_DH_USE)) {
- if (!DH_generate_key(dh)) {
- DH_free(dh);
- SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
- return (ret);
- }
- }
if (s->cert->dh_tmp != NULL)
DH_free(s->cert->dh_tmp);
s->cert->dh_tmp = dh;
@@ -3482,13 +3475,6 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_DH_LIB);
return 0;
}
- if (!(ctx->options & SSL_OP_SINGLE_DH_USE)) {
- if (!DH_generate_key(new)) {
- SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_DH_LIB);
- DH_free(new);
- return 0;
- }
- }
if (cert->dh_tmp != NULL)
DH_free(cert->dh_tmp);
cert->dh_tmp = new;
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 7eb7ea6..04cf93a 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -1729,20 +1729,9 @@ int ssl3_send_server_key_exchange(SSL *s)
}
s->s3->tmp.dh = dh;
- if ((dhp->pub_key == NULL ||
- dhp->priv_key == NULL ||
- (s->options & SSL_OP_SINGLE_DH_USE))) {
- if (!DH_generate_key(dh)) {
- SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB);
- goto err;
- }
- } else {
- dh->pub_key = BN_dup(dhp->pub_key);
- dh->priv_key = BN_dup(dhp->priv_key);
- if ((dh->pub_key == NULL) || (dh->priv_key == NULL)) {
- SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB);
- goto err;
- }
+ if (!DH_generate_key(dh)) {
+ SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB);
+ goto err;
}
r[0] = dh->p;
r[1] = dh->g;
diff --git a/ssl/ssl.h b/ssl/ssl.h
index b8456c6..105047e 100644
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -602,7 +602,7 @@ struct ssl_session_st {
# define SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION 0x00040000L
/* If set, always create a new key when using tmp_ecdh parameters */
# define SSL_OP_SINGLE_ECDH_USE 0x00080000L
-/* If set, always create a new key when using tmp_dh parameters */
+/* Does nothing: retained for compatibility */
# define SSL_OP_SINGLE_DH_USE 0x00100000L
/* Does nothing: retained for compatibiity */
# define SSL_OP_EPHEMERAL_RSA 0x0
More information about the openssl-commits
mailing list