Skip to content

Conversation

@clopez
Copy link
Contributor

@clopez clopez commented May 27, 2013

I submit this patches time ago to the openssl mailing list but got not answer.
I have rebased the patches on top of current master and I'm retrying submitting it here with the hope that it will caught more attention.

This pull request fixes the support for XMPP on openssl s_client. A number of reports on Internet complain about this. Examples:

clopez added 4 commits May 27, 2013 23:47
 * Some XMPP Servers (OpenFire) use double quotes.
 * This makes s_client starttls work with this servers.
 * Tested with OpenFire servers from http://xmpp.net/ ::

     openssl s_client -connect coderollers.com:5222 -starttls xmpp
 * When the host used in "-connect" is not what the remote XMPP server expects
   the server will return an error like this:
     <stream:error>
       <host-unknown xmlns='urn:ietf:params:xml:ns:xmpp-streams'/>
     </stream:error>
 * But the actual code will stay on the loop forever because the stop condition
   "/stream:features>" will never happen,
 * Make this more robust: The stop condition should be that BIO_read failed
 * Test if for example with ::

    openssl s_client  -connect random.jabb3r.net:5222 -starttls xmpp
 * Many XMPP servers are configured with multiple domains (virtual hosts)
 * In order to establish successfully the TLS connection you have to specify
   which virtual host you are trying to connect.
 * Test this, for example with ::
   * Fail:
       openssl s_client -connect talk.google.com:5222 -starttls xmpp
   * Works:
       openssl s_client -connect talk.google.com:5222 -starttls xmpp -xmpphost gmail.com
@benlaurie
Copy link
Contributor

Merged.

@benlaurie benlaurie closed this Sep 5, 2013
snhenson pushed a commit that referenced this pull request Apr 8, 2014
snhenson pushed a commit that referenced this pull request Apr 8, 2014
(cherry picked from commit a74bee5)
levitte pushed a commit that referenced this pull request Feb 8, 2016
Previous commit 7bb196a attempted to "fix" a problem with the way
SSL_shutdown() behaved whilst in mid-handshake. The original behaviour had
SSL_shutdown() return immediately having taken no action if called mid-
handshake with a return value of 1 (meaning everything was shutdown
successfully). In fact the shutdown has not been successful.

Commit 7bb196a changed that to send a close_notify anyway and then
return. This seems to be causing some problems for some applications so
perhaps a better (much simpler) approach is revert to the previous
behaviour (no attempt at a shutdown), but return -1 (meaning the shutdown
was not successful).

This also fixes a bug where SSL_shutdown always returns 0 when shutdown
*very* early in the handshake (i.e. we are still using SSLv23_method).

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
levitte pushed a commit that referenced this pull request Feb 8, 2016
Previous commit f73c737 attempted to "fix" a problem with the way
SSL_shutdown() behaved whilst in mid-handshake. The original behaviour had
SSL_shutdown() return immediately having taken no action if called mid-
handshake with a return value of 1 (meaning everything was shutdown
successfully). In fact the shutdown has not been successful.

Commit f73c737 changed that to send a close_notify anyway and then
return. This seems to be causing some problems for some applications so
perhaps a better (much simpler) approach is revert to the previous
behaviour (no attempt at a shutdown), but return -1 (meaning the shutdown
was not successful).

This also fixes a bug where SSL_shutdown always returns 0 when shutdown
*very* early in the handshake (i.e. we are still using SSLv23_method).

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Tatsuya-Nonogaki added a commit to Tatsuya-Nonogaki/openssl that referenced this pull request Mar 22, 2016
Tatsuya-Nonogaki added a commit to Tatsuya-Nonogaki/openssl that referenced this pull request Mar 24, 2016
Added functions to create, delete a set of cert/key and PKCS#12, which can be used to manage a lot of auth-client key sets.

Revert some unnecessary changes

Revert some unnecessary changes openssl#2

Pair-Bag total manage capability added to CA.pl
@paulidale paulidale mentioned this pull request Jul 18, 2017
simo5 pushed a commit to simo5/openssl that referenced this pull request Mar 25, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request Apr 1, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request Apr 1, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request Apr 3, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request Apr 9, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request Apr 14, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request Apr 15, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
Sashan pushed a commit to Sashan/openssl that referenced this pull request Apr 23, 2025
Here the undefined value "npa" passed to a function
WPACKET_sub_memcpy_u16(pkt, npa, npalen).
However the value is not really used, because "npalen" is zero,
but the call statememt itself is considered an invalid operation
by the new sanitizer.

The original sanitizer error report was:

==49175==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x55a276b29d6f in tls_construct_stoc_next_proto_neg /home/runner/work/openssl/openssl/ssl/statem/extensions_srvr.c:1518:21
    openssl#1 0x55a276b15d7d in tls_construct_extensions /home/runner/work/openssl/openssl/ssl/statem/extensions.c:909:15
    openssl#2 0x55a276b513dc in tls_construct_server_hello /home/runner/work/openssl/openssl/ssl/statem/statem_srvr.c:2471:10
    openssl#3 0x55a276b2e160 in write_state_machine /home/runner/work/openssl/openssl/ssl/statem/statem.c:896:26
    openssl#4 0x55a276b2e160 in state_machine /home/runner/work/openssl/openssl/ssl/statem/statem.c:490:21
    openssl#5 0x55a276b2f562 in ossl_statem_accept /home/runner/work/openssl/openssl/ssl/statem/statem.c:309:12
    openssl#6 0x55a276a9f867 in SSL_do_handshake /home/runner/work/openssl/openssl/ssl/ssl_lib.c:4890:19
    openssl#7 0x55a276a9f605 in SSL_accept /home/runner/work/openssl/openssl/ssl/ssl_lib.c:2169:12
    openssl#8 0x55a276a3d4db in create_bare_ssl_connection /home/runner/work/openssl/openssl/test/helpers/ssltestlib.c:1281:24
    openssl#9 0x55a276a3d7cb in create_ssl_connection /home/runner/work/openssl/openssl/test/helpers/ssltestlib.c:1350:10
    openssl#10 0x55a276a64c0b in test_npn /home/runner/work/openssl/openssl/test/sslapitest.c:12266:14
    openssl#11 0x55a276b9fc20 in run_tests /home/runner/work/openssl/openssl/test/testutil/driver.c:377:21
    openssl#12 0x55a276ba0b10 in main /home/runner/work/openssl/openssl/test/testutil/main.c:31:15

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from openssl#26269)
simo5 pushed a commit to simo5/openssl that referenced this pull request Apr 25, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request May 12, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request Jul 17, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request Jul 23, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
npajkovsky pushed a commit to npajkovsky/openssl that referenced this pull request Jul 29, 2025
the self_test_digest_sig() test fails when EC PCT is enabled because
ossl_ec_key_pairwise_check() consumes entropy when

  generator * priv_key = pub_key

is calculated in EC_POINT_mul().

  #0  RAND_priv_bytes_ex
  openssl#1  bnrand
  openssl#2  BN_priv_rand_ex
  openssl#3  ec_GF2m_simple_ladder_pre
  openssl#4  ec_point_ladder_pre
  openssl#5  ossl_ec_scalar_mul_ladder
  openssl#6  ec_GF2m_simple_points_mul
  openssl#7  EC_POINT_mul
  openssl#8  ossl_ec_key_pairwise_check

which led to the different signature then expected in the
ecdsa_prime_expected_sig.

Moving set_kat_drbg() after the EVP_PKEY_fromdata() fixed the problem.

Fixes openssl/project#1302
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
andrewkdinh added a commit to andrewkdinh/openssl that referenced this pull request Aug 5, 2025
andrewkdinh added a commit to andrewkdinh/openssl that referenced this pull request Aug 5, 2025
andrewkdinh added a commit to andrewkdinh/openssl that referenced this pull request Aug 6, 2025
openssl-machine pushed a commit that referenced this pull request Aug 9, 2025
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z     #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z     #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z     #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z     #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z     #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z     #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z     #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z     #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z     #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z     #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z     #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z     #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z     #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z     #13 0x7fb88d42a1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z     #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z     #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)

It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.

fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.

Fixes openssl/project#1315

Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from #28195)
simo5 pushed a commit to simo5/openssl that referenced this pull request Oct 15, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request Oct 30, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
Max-Deng-203 pushed a commit to Max-Deng-203/openssl that referenced this pull request Nov 23, 2025
Fix critical memory bug in ascon_aead128_dupctx causing double-free errors
esyr pushed a commit to esyr/openssl that referenced this pull request Dec 10, 2025
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request Jan 8, 2026
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
simo5 pushed a commit to simo5/openssl that referenced this pull request Jan 13, 2026
Patch-name: 0010-Add-changes-to-ectest-and-eccurve.patch
Patch-id: 10
Patch-status: |
    # # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so
    # # that new modifications made to these files by upstream are not lost.
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce

commit openssl#2:
Patch-name: 0011-Remove-EC-curves.patch
Patch-id: 11
Patch-status: |
    # # remove unsupported EC curves
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants