Commit Graph

190 Commits

Author SHA1 Message Date
Andriy Gapon
056f620e09 openssl: change SHLIB_VERSION_NUMBER to reflect the reality
Some consumers actually use this definition.

We probably need some procedure to ensure that SHLIB_VERSION_NUMBER
is updated whenever we change the library version in
secure/lib/libssl/Makefile.
2016-06-03 14:09:38 +00:00
Jung-uk Kim
b8721c1643 Merge OpenSSL 1.0.2h.
Relnotes:	yes
2016-05-03 18:50:10 +00:00
Jung-uk Kim
4c6a0400b9 Merge OpenSSL 1.0.2g.
Relnotes:	yes
2016-03-01 22:08:28 +00:00
Jung-uk Kim
8180e704ac Merge OpenSSL 1.0.2f.
Relnotes:	yes
2016-01-28 20:15:22 +00:00
Jung-uk Kim
80815a778e Merge OpenSSL 1.0.2e. 2015-12-03 21:13:35 +00:00
Jung-uk Kim
2409c5b0cc Remove duplicate manual pages.
Reported by:	brd
2015-11-16 21:36:15 +00:00
Jung-uk Kim
7bded2db17 Merge OpenSSL 1.0.2d. 2015-10-30 20:51:33 +00:00
Jung-uk Kim
45c1772ea0 Merge OpenSSL 1.0.1p. 2015-07-09 17:07:45 +00:00
Jung-uk Kim
d47910c6ed Merge OpenSSL 1.0.1o. 2015-06-12 16:48:26 +00:00
Jung-uk Kim
ed6b93be54 Merge OpenSSL 1.0.1n. 2015-06-11 19:00:55 +00:00
Jung-uk Kim
6f9291cea8 Merge OpenSSL 1.0.1m. 2015-03-20 19:16:18 +00:00
Jung-uk Kim
dc2b908f54 Merge OpenSSL 1.0.1l.
MFC after:	1 week
Relnotes:	yes
2015-01-16 21:03:23 +00:00
Jung-uk Kim
de496999fe MFV: r276862
Fix build.
2015-01-09 00:42:10 +00:00
Jung-uk Kim
751d29910b Merge OpenSSL 1.0.1k. 2015-01-08 23:42:41 +00:00
Jung-uk Kim
fa5fddf171 Merge OpenSSL 1.0.1j. 2014-10-15 19:12:05 +00:00
Jung-uk Kim
a93cbc2be8 Merge OpenSSL 1.0.1i. 2014-08-07 18:56:10 +00:00
Jung-uk Kim
94ad176c68 Merge OpenSSL 1.0.1h.
Approved by:	so (delphij)
2014-06-09 05:50:57 +00:00
Xin LI
4a448cff07 Fix OpenSSL multiple vulnerabilities.
Security:	CVE-2014-0195, CVE-2014-0221, CVE-2014-0224,
		CVE-2014-3470
Security:	SA-14:14.openssl
Approved by:	so
2014-06-05 12:32:16 +00:00
Xin LI
f5da602e47 Fix OpenSSL NULL pointer deference vulnerability.
Obtained from:	OpenBSD
Security:	FreeBSD-SA-14:09.openssl
Security:	CVE-2014-0198
2014-05-13 23:17:24 +00:00
Xin LI
e38c714ed3 Fix OpenSSL use-after-free vulnerability.
Obtained from:	OpenBSD
Security:	FreeBSD-SA-14:09.openssl
Security:	CVE-2010-5298
2014-04-30 04:02:36 +00:00
Jung-uk Kim
560ede85d4 Merge OpenSSL 1.0.1g.
Approved by:	benl (maintainer)
2014-04-08 21:06:58 +00:00
Xin LI
25bfde79d6 Fix NFS deadlock vulnerability. [SA-14:05]
Fix "Heartbleed" vulnerability and ECDSA Cache Side-channel
Attack in OpenSSL. [SA-14:06]
2014-04-08 18:27:32 +00:00
Jung-uk Kim
de78d5d8fd Merge OpenSSL 1.0.1f.
Approved by:	so (delphij), benl (silence)
2014-01-22 19:57:11 +00:00
Xin LI
246aa294d7 MFV r260399:
Apply vendor commits:

197e0ea	Fix for TLS record tampering bug.  (CVE-2013-4353).
3462896	For DTLS we might need to retransmit messages from the
	previous session so keep a copy of write context in DTLS
	retransmission buffers instead of replacing it after
	sending CCS.  (CVE-2013-6450).
ca98926 When deciding whether to use TLS 1.2 PRF and record hash
	algorithms use the version number in the corresponding
	SSL_METHOD structure instead of the SSL structure.  The
	SSL structure version is sometimes inaccurate.
	Note: OpenSSL 1.0.2 and later effectively do this already.
	(CVE-2013-6449).

Security:	CVE-2013-4353
Security:	CVE-2013-6449
Security:	CVE-2013-6450
2014-01-07 19:58:45 +00:00
Xin LI
14bf23ce31 MFV r254106 (OpenSSL bugfix for RT #2984):
Check DTLS_BAD_VER for version number.

The version check for DTLS1_VERSION was redundant as
DTLS1_VERSION > TLS1_1_VERSION, however we do need to
check for DTLS1_BAD_VER for compatibility.

Requested by:	zi
Approved by:	benl
2013-08-08 22:29:35 +00:00
Jung-uk Kim
09286989d3 Merge OpenSSL 1.0.1e.
Approved by:	secteam (simon), benl (silence)
2013-02-13 23:07:20 +00:00
Jung-uk Kim
b39da7f721 Change "the the" to "the". It is a continuation of r226436 and missed in
r237658.

Approved by:	benl (maintainer, implicit)
2013-02-13 22:38:20 +00:00
Pedro F. Giffuni
646a7fea0c Clean some 'svn:executable' properties in the tree.
Submitted by:	Christoph Mallon
MFC after:	3 days
2013-01-26 22:08:21 +00:00
Xin LI
7acf1c9d2e Indicate that we are using OpenSSL with some local modifications.
X-MFC after:	with r244974
2013-01-02 21:00:00 +00:00
Xin LI
2079cf0127 MFV r244973:
Integrate OpenSSL changeset 22950 (appro):

        bn_word.c: fix overflow bug in BN_add_word.

MFC after:	2 weeks
2013-01-02 20:58:46 +00:00
Eitan Adler
37a6031461 Clean up hardcoded ar(1) flags in the tree to use the global ARFLAGS in
share/mk/sys.mk instead.

This is part of a medium term project to permit deterministic builds of
FreeBSD.

Submitted by:	Erik Cederstrand <erik@cederstrand.dk>
Reviewed by:	imp, toolchain@
Approved by:	cperciva
MFC after:	2 weeks
2012-12-06 01:31:25 +00:00
Pawel Jakub Dawidek
c71baf2689 Allow OpenSSL to use arc4random(3) on FreeBSD. arc4random(3) was modified
some time ago to use sysctl instead of /dev/random to get random data,
so is now much better choice, especially for sandboxed processes that have
no direct access to /dev/random.

Approved by:	benl
MFC after:	2 weeks
2012-11-30 22:23:23 +00:00
Andriy Gapon
ff065ad3b5 openssl: change SHLIB_VERSION_NUMBER to reflect the reality
Note: I timed out waiting for an exp-run for this change but I survived
having it locally for quite a long time.

MFC after:	1 month
X-MFC note:	SHLIB_MAJOR is 6 in stable/8 and stable/9
2012-09-11 06:10:49 +00:00
Jung-uk Kim
1f13597d10 Merge OpenSSL 1.0.1c.
Approved by:	benl (maintainer)
2012-07-12 19:30:53 +00:00
Jung-uk Kim
77db8b179b Partially redo r226436, i. e., change "the the" to "the". ca(1), dgst(1),
and engine(3) are generated from these pod files during merge process and
we do not want to re-apply these changes over and over again.

Approved by:	benl (maintainer, implicit)
2012-06-27 19:23:29 +00:00
Jung-uk Kim
12de4ed299 Merge OpenSSL 0.9.8x.
Reviewed by:	stas
Approved by:	benl (maintainer)
MFC after:	3 days
2012-06-27 18:44:36 +00:00
Bjoern A. Zeeb
071183ef48 Update the previous openssl fix. [12:01]
Fix a bug in crypt(3) ignoring characters of a passphrase. [12:02]

Security:	FreeBSD-SA-12:01.openssl (revised)
Security:	FreeBSD-SA-12:02.crypt
Approved by:	so (bz, simon)
2012-05-30 12:01:28 +00:00
Bjoern A. Zeeb
a95abaf173 Fix multiple OpenSSL vulnerabilities.
Security:	CVE-2011-4576, CVE-2011-4619, CVE-2011-4109
Security:	CVE-2012-0884, CVE-2012-2110
Security:	FreeBSD-SA-12:01.openssl
Approved by:	so (bz,simon)
2012-05-03 15:25:11 +00:00
Xin LI
dfdd332056 Fix SSL memory handlig for (EC)DH cipher suites, in particular for
multi-threaded use of ECDH.

Security:	CVE-2011-3210
Reviewed by:	stas
Obtained from:	OpenSSL CVS
Approved by:	re (kib)
2011-09-08 09:33:49 +00:00
Simon L. B. Nielsen
0a70456882 Fix Incorrectly formatted ClientHello SSL/TLS handshake messages could
cause OpenSSL to parse past the end of the message.

Note: Applications are only affected if they act as a server and call
SSL_CTX_set_tlsext_status_cb on the server's SSL_CTX. This includes
Apache httpd >= 2.3.3, if configured with "SSLUseStapling On".

Security:	http://www.openssl.org/news/secadv_20110208.txt
Security:	CVE-2011-0014
Obtained from:	OpenSSL CVS
2011-02-12 21:30:46 +00:00
Simon L. B. Nielsen
72b8021a0a Merge OpenSSL 0.9.8q into head.
Security:	CVE-2010-4180
Security:	http://www.openssl.org/news/secadv_20101202.txt
MFC after:	3 days
2010-12-03 22:59:54 +00:00
Simon L. B. Nielsen
a3ddd25aba Merge OpenSSL 0.9.8p into head.
Security:	CVE-2010-3864
Security:	http://www.openssl.org/news/secadv_20101116.txt
2010-11-22 18:23:44 +00:00
Simon L. B. Nielsen
8dced518a6 Fix double-free in OpenSSL's SSL ECDH code.
It has yet to be determined if this warrants a FreeBSD Security
Advisory, but we might as well get it fixed in the normal branches.

Obtained from:	OpenSSL CVS
Security:	CVE-2010-2939
X-MFC after:	Not long...
2010-11-14 09:33:47 +00:00
Rui Paulo
62ec0abc3c Bring in OpenSSL checkin 19821:
Make inline assembler clang-friendly [from HEAD].

 openssl/crypto/md32_common.h     	1.45.2.1 -> 1.45.2.2
 openssl/crypto/rc5/rc5_locl.h     	1.8 -> 1.8.8.1

Approved by:	simon
2010-09-21 10:22:29 +00:00
Simon L. B. Nielsen
ab8565e267 Merge OpenSSL 0.9.8n into head.
This fixes CVE-2010-0740 which only affected -CURRENT (OpenSSL 0.9.8m)
but not -STABLE branches.

I have not yet been able to find out if CVE-2010-0433 impacts FreeBSD.
This will be investigated further.

Security:	CVE-2010-0433, CVE-2010-0740
Security:	http://www.openssl.org/news/secadv_20100324.txt
2010-04-01 15:19:51 +00:00
Simon L. B. Nielsen
ac7fbc6abd Readd $FreeBSD$ to the OpenSSL config file as that's useful for
mergemaster.

Suggested by:	dougb
2010-03-13 22:37:07 +00:00
Simon L. B. Nielsen
6a599222bb Merge OpenSSL 0.9.8m into head.
This also "reverts" some FreeBSD local changes so we should now
be back to using entirely stock OpenSSL.  The local changes were
simple $FreeBSD$ lines additions, which were required in the CVS
days, and the patch for FreeBSD-SA-09:15.ssl which has been
superseded with OpenSSL 0.9.8m's RFC5746 'TLS renegotiation
extension' support.

MFC after:	3 weeks
2010-03-13 19:22:41 +00:00
Colin Percival
a235643007 Disable SSL renegotiation in order to protect against a serious
protocol flaw. [09:15]

Correctly handle failures from unsetenv resulting from a corrupt
environment in rtld-elf. [09:16]

Fix permissions in freebsd-update in order to prevent leakage of
sensitive files. [09:17]

Approved by:	so (cperciva)
Security:	FreeBSD-SA-09:15.ssl
Security:	FreeBSD-SA-09:16.rtld
Security:	FreeBSD-SA-09:17.freebsd-udpate
2009-12-03 09:18:40 +00:00
Simon L. B. Nielsen
2f1ff7669c Merge DTLS fixes from vendor-crypto/openssl/dist:
- Fix memory consumption bug with "future epoch" DTLS records.
- Fix fragment handling memory leak.
- Do not access freed data structure.
- Fix DTLS fragment bug - out-of-sequence message handling which could
  result in NULL pointer dereference in
  dtls1_process_out_of_seq_message().

Note that this will not get FreeBSD Security Advisory as DTLS is
experimental in OpenSSL.

MFC after:	1 week
Security:	CVE-2009-1377 CVE-2009-1378 CVE-2009-1379 CVE-2009-1387
2009-08-23 16:29:47 +00:00
Simon L. B. Nielsen
829d7315d7 Remove symlinks in OpenSSL's testing framework. These are not required
for normal build, and doesn't export well to CVS.

If they are needed later a script will be added to recreate the symlinks
when needed at build time.

Approved by:	re (rwatson)
2009-08-12 12:10:00 +00:00