Changeset 808 for openssl/trunk/crypto/pkcs7/pk7_doit.c

Timestamp:

Aug 7, 2014, 8:25:37 PM (11 years ago)

Author:

dmik

Message:

openssl: Merge version 1.0.0n from vendor to trunk.

Location:

openssl/trunk

Files:

• . (modified) (1 prop)
• crypto/pkcs7/pk7_doit.c (modified) (14 diffs)

openssl/trunk/crypto/pkcs7/pk7_doit.c ¶

@@ -205 +205 @@
         size_t eklen;
 
-        int ret = 0;
+        int ret = -1;
 
         pctx = EVP_PKEY_CTX_new(pkey, NULL);
         if (!pctx)
-                return 0;
+                return -1;
 
         if (EVP_PKEY_decrypt_init(pctx) <= 0)
@@ -236 +236 @@
                                 ri->enc_key->data, ri->enc_key->length) <= 0)
                 {
+                ret = 0;
                 PKCS7err(PKCS7_F_PKCS7_DECRYPT_RINFO, ERR_R_EVP_LIB);
                 goto err;
@@ -241 +242 @@
 
         ret = 1;
+
+        if (*pek)
+                {
+                OPENSSL_cleanse(*pek, *peklen);
+                OPENSSL_free(*pek);
+                }
 
         *pek = ek;
@@ -423 +430 @@
         STACK_OF(X509_ALGOR) *md_sk=NULL;
         STACK_OF(PKCS7_RECIP_INFO) *rsk=NULL;
-        X509_ALGOR *xalg=NULL;
         PKCS7_RECIP_INFO *ri=NULL;
+       unsigned char *ek = NULL, *tkey = NULL;
+       int eklen = 0, tkeylen = 0;
 
         i=OBJ_obj2nid(p7->type);
@@ -433 +441 @@
         case NID_pkcs7_signed:
                 data_body=PKCS7_get_octet_string(p7->d.sign->contents);
+                if (!PKCS7_is_detached(p7) && data_body == NULL)
+                        {
+                        PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_INVALID_SIGNED_DATA_TYPE);
+                        goto err;
+                        }
                 md_sk=p7->d.sign->md_algs;
                 break;
@@ -446 +459 @@
                         goto err;
                         }
-                xalg=p7->d.signed_and_enveloped->enc_data->algorithm;
                 break;
         case NID_pkcs7_enveloped:
@@ -458 +470 @@
                         goto err;
                         }
-                xalg=p7->d.enveloped->enc_data->algorithm;
                 break;
         default:
@@ -504 +515 @@
                 X509_OBJECT ret;
 #endif
-                unsigned char *ek = NULL;
-                int eklen;
 
                 if ((etmp=BIO_new(BIO_f_cipher())) == NULL)
@@ -538 +547 @@
 
                 /* If we haven't got a certificate try each ri in turn */
-
                 if (pcert == NULL)
                         {
+                        /* Always attempt to decrypt all rinfo even
+                         * after sucess as a defence against MMA timing
+                         * attacks.
+                         */
                         for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++)
                                 {
                                 ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
+                                
                                 if (pkcs7_decrypt_rinfo(&ek, &eklen,
-                                                        ri, pkey) > 0)
-                                        break;
+                                                        ri, pkey) < 0)
+                                        goto err;
                                 ERR_clear_error();
-                                ri = NULL;
                                 }
-                        if (ri == NULL)
-                                {
-                                PKCS7err(PKCS7_F_PKCS7_DATADECODE,
-                                      PKCS7_R_NO_RECIPIENT_MATCHES_KEY);
+                        }
+                else
+                        {
+                        /* Only exit on fatal errors, not decrypt failure */
+                        if (pkcs7_decrypt_rinfo(&ek, &eklen, ri, pkey) < 0)
                                 goto err;
-                                }
-                        }
-                else
-                        {
-                        if (pkcs7_decrypt_rinfo(&ek, &eklen, ri, pkey) <= 0)
-                                goto err;
+                        ERR_clear_error();
                         }
 
@@ -569 +577 @@
                 if (EVP_CIPHER_asn1_to_param(evp_ctx,enc_alg->parameter) < 0)
                         goto err;
+                /* Generate random key as MMA defence */
+                tkeylen = EVP_CIPHER_CTX_key_length(evp_ctx);
+                tkey = OPENSSL_malloc(tkeylen);
+                if (!tkey)
+                        goto err;
+                if (EVP_CIPHER_CTX_rand_key(evp_ctx, tkey) <= 0)
+                        goto err;
+                if (ek == NULL)
+                        {
+                        ek = tkey;
+                        eklen = tkeylen;
+                        tkey = NULL;
+                        }
 
                 if (eklen != EVP_CIPHER_CTX_key_length(evp_ctx)) {
@@ -577 +598 @@
                         if(!EVP_CIPHER_CTX_set_key_length(evp_ctx, eklen))
                                 {
-                                PKCS7err(PKCS7_F_PKCS7_DATADECODE,
-                                        PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH);
-                                goto err;
+                                /* Use random key as MMA defence */
+                                OPENSSL_cleanse(ek, eklen);
+                                OPENSSL_free(ek);
+                                ek = tkey;
+                                eklen = tkeylen;
+                                tkey = NULL;
                                 }
                 } 
+                /* Clear errors so we don't leak information useful in MMA */
+                ERR_clear_error();
                 if (EVP_CipherInit_ex(evp_ctx,NULL,NULL,ek,NULL,0) <= 0)
                         goto err;
@@ -589 +615 @@
                         OPENSSL_cleanse(ek,eklen);
                         OPENSSL_free(ek);
+                       ek = NULL;
+                        }
+                if (tkey)
+                        {
+                        OPENSSL_cleanse(tkey,tkeylen);
+                        OPENSSL_free(tkey);
+                       tkey = NULL;
                         }
 
@@ -631 +664 @@
                 {
 err:
+               if (ek)
+                       {
+                       OPENSSL_cleanse(ek,eklen);
+                       OPENSSL_free(ek);
+                       }
+               if (tkey)
+                       {
+                       OPENSSL_cleanse(tkey,tkeylen);
+                       OPENSSL_free(tkey);
+                       }
                 if (out != NULL) BIO_free_all(out);
                 if (btmp != NULL) BIO_free_all(btmp);
@@ -885 +928 @@
                 goto err;
         OPENSSL_free(abuf);
+        abuf = NULL;
         if (EVP_DigestSignFinal(&mctx, NULL, &siglen) <= 0)
                 goto err;