wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
10479 commits 20 branches 302 tags 153 MiB
Commit graph

10479 commits

This branch
This branch
All branches
Author SHA1 Message Date
Dr. Stephen Henson
049615e35d Prepare for 1.0.1i-dev 2014-06-05 10:45:50 +01:00
Dr. Stephen Henson
6b72417a00 Prepare for 1.0.1h release 2014-06-05 10:45:00 +01:00
Dr. Stephen Henson
aabbe99fcb Update CHANGES and NEWS 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
8011cd56e3 Fix CVE-2014-3470 
Check session_cert is not NULL before dereferencing it.
 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
d3152655d5 Fix CVE-2014-0221 
Unnecessary recursion when receiving a DTLS hello request can be used to
crash a DTLS client. Fixed by handling DTLS hello request without recursion.

Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
006cd7083f Additional CVE-2014-0224 protection. 
Return a fatal error if an attempt is made to use a zero length
master secret.
 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
bc8923b1ec Fix for CVE-2014-0224 
Only accept change cipher spec when it is expected instead of at any
time. This prevents premature setting of session keys before the master
secret is determined which an attacker could use as a MITM attack.

Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for reporting this issue
and providing the initial fix this patch is based on.
 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
1632ef7448 Fix for CVE-2014-0195 
A buffer overrun attack can be triggered by sending invalid DTLS fragments
to an OpenSSL DTLS client or server. This is potentially exploitable to
run arbitrary code on a vulnerable client or server.

Fixed by adding consistency check for DTLS fragments.

Thanks to Jüri Aedla for reporting this issue.
 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
f1f4fbde2a make update 2014-06-05 09:02:03 +01:00
Libor Krystek
1854c48005 Corrected OPENSSL_NO_EC_NISTP_64_GCC_128 usage in ec_lcl.h. PR#3370 2014-06-03 23:19:21 +01:00
David Benjamin
ebda73f867 Check there is enough room for extension. 
(cherry picked from commit 7d89b3bf42e4b4067371ab33ef7631434e41d1e4)
 2014-06-02 19:00:02 +01:00
zhu qun-ying
bcc311668e Free up s->d1->buffered_app_data.q properly. 
PR#3286
(cherry picked from commit 71e95000afb2227fe5cac1c79ae884338bcd8d0b)
 2014-06-02 14:40:18 +01:00
Sami Farin
1dd26414df Typo: set i to -1 before goto. 
PR#3302
(cherry picked from commit 9717f01951f976f76dd40a38d9fc7307057fa4c4)
 2014-06-02 14:22:06 +01:00
Matt Caswell
056389eb1c Added SSLErr call for internal error in dtls1_buffer_record 2014-06-01 21:38:01 +01:00
David Ramos
a07856a08d Delays the queue insertion until after the ssl3_setup_buffers() call due to use-after-free bug. PR#3362 2014-06-01 21:37:47 +01:00
Dr. Stephen Henson
19ce768c6b Recognise padding extension. 
(cherry picked from commit ea2bb861f0daaa20819bf9ac8c146f7593feacd4)

Conflicts:

	apps/s_cb.c
(cherry picked from commit 14dc83ca779e91a267701a1fb05b2bbcf2cb63c4)
 2014-06-01 16:50:37 +01:00
Dr. Stephen Henson
aaed77c55e Option to disable padding extension. 
Add TLS padding extension to SSL_OP_ALL so it is used with other
"bugs" options and can be turned off.

This replaces SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG which is an ancient
option referring to SSLv2 and SSLREF.

PR#3336
 2014-06-01 16:50:37 +01:00
Dr. Stephen Henson
49270d0431 Set default global mask to UTF8 only. 
(cherry picked from commit 3009244da4)
 2014-06-01 15:04:29 +01:00
David Ramos
673c42b238 Allocate extra space when NETSCAPE_HANG_BUG defined. 
Make sure there is an extra 4 bytes for server done message when
NETSCAPE_HANG_BUG is defined.

PR#3361
 2014-06-01 14:30:10 +01:00
David Ramos
5541b18ba8 Initialise alg. 
PR#3313
(cherry picked from commit 7e2c6f7eb0)
 2014-06-01 13:05:20 +01:00
Dr. Stephen Henson
28e117f49f Use correct digest when exporting keying material. 
PR#3319
(cherry picked from commit 84691390eae86befd33c83721dacedb539ae34e6)
 2014-05-31 13:43:01 +01:00
Dr. Stephen Henson
46bfc05480 Don't compile heartbeat test code on Windows (for now). 
(cherry picked from commit 2c575907d2c8601a18716f718ce309ed4e1f1783)
 2014-05-31 13:43:01 +01:00
Hubert Kario
427a37ca3f add description of -attime to man page 
the verify app man page didn't describe the usage of attime option
even though it was listed as a valid option in the -help message.

This patch fixes this omission.
 2014-05-30 23:33:10 +01:00
Hubert Kario
39ae3b338f add description of -no_ecdhe option to s_server man page 
While the -help message references this option, the man page
doesn't mention the -no_ecdhe option.
This patch fixes this omission.
 2014-05-30 23:32:54 +01:00
Dr. Stephen Henson
48f5b3efce Set version number correctly. 
PR#3249
(cherry picked from commit 8909bf20269035d295743fca559207ef2eb84eb3)
 2014-05-29 14:12:14 +01:00
František Bořánek
f8dc000699 Fix memory leak. 
PR#3278
(cherry picked from commit de56fe797081fc09ebd1add06d6e2df42a324fd5)
 2014-05-29 14:12:14 +01:00
Martin Kaiser
bf8d6f9ab8 remove duplicate 0x for default RSASSA-PSS salt len 
(cherry picked from commit 3820fec3a09faecba7fe9912aa20ef7fcda8337b)
 2014-05-29 14:12:14 +01:00
Peter Mosmans
17e844a450 Fix for test_bn regular expression to work on Windows using MSYS. PR#3346 2014-05-27 23:26:11 +01:00
Matt Caswell
8ca7d12430 Fixed Windows compilation failure 2014-05-27 00:26:55 +01:00
Matt Caswell
67b9c82ea2 Fixed error in args for SSL_set_msg_callback and SSL_set_msg_callback_arg 2014-05-25 23:48:15 +01:00
Matt Caswell
a6f5b991eb Fix for non compilation with TLS_DEBUG defined 2014-05-24 23:56:58 +01:00
Mike Bland
756587dcb9 Fix heartbeat_test for -DOPENSSL_NO_HEARTBEATS 
Replaces the entire test with a trivial implementation when
OPENSSL_NO_HEARTBEATS is defined.
 2014-05-22 22:05:26 +01:00
Matt Caswell
0a084f7b3a Fixed minor copy&paste error, and stray space causing rendering problem 2014-05-22 00:12:14 +01:00
Dr. Stephen Henson
da0a95b23a Fix for PKCS12_create if no-rc2 specified. 
Use triple DES for certificate encryption if no-rc2 is
specified.

PR#3357
(cherry picked from commit 4689c08453e95eeefcc88c9f32dc6e509f95caff)
 2014-05-21 11:14:33 +01:00
Dr. Stephen Henson
599fe418a1 Change default cipher in smime app to des3. 
PR#3357
(cherry picked from commit ca3ffd9670f2b589bf8cc04923f953e06d6fbc58)
 2014-05-21 11:14:33 +01:00
Dr. Stephen Henson
4519e7b839 For portability use BUF_strndup instead of strndup. 
(cherry picked from commit dcca7b13e9)
 2014-05-20 11:23:23 +01:00
Janpopan
4659b53e7d Fix a wrong parameter count ERR_add_error_data 2014-05-19 22:17:00 +01:00
Ben Laurie
dc22495d35 Merge branch 'mbland-heartbeat-test-1.0.1' into OpenSSL_1_0_1-stable 2014-05-19 18:26:04 +01:00
Mike Bland
ab0d964259 Unit/regression test for TLS heartbeats. 
Regression test against CVE-2014-0160 (Heartbleed).

More info: http://mike-bland.com/tags/heartbleed.html

(based on commit 35cb55988b75573105eefd00d27d0138eebe40b1)
 2014-05-19 18:23:24 +01:00
Ben Laurie
dac3654e2d Allow the maximum value. 2014-05-19 18:21:39 +01:00
Ben Laurie
989d87cb1a Fix signed/unsigned warning. 2014-05-19 18:20:54 +01:00
Matt Caswell
d6934a02b5 Moved note about lack of support for AEAD modes out of BUGS section to SUPPORTED CIPHERS section (bug has been fixed, but still no support for AEAD) 2014-05-15 21:17:19 +01:00
Dr. Stephen Henson
f9986e9abf Enc doesn't support AEAD ciphers. 2014-05-15 14:16:44 +01:00
Jeffrey Walton
1f5e321ec1 Fix grammar error in verify pod. PR#3355 2014-05-14 22:59:48 +01:00
Jeffrey Walton
b6adb6ef58 Add information to BUGS section of enc documentation. PR#3354 2014-05-14 22:59:48 +01:00
Michal Bozon
bfdaf45141 Corrected POD syntax errors. PR#3353 2014-05-14 22:59:48 +01:00
Kurt Roeckx
69526a354d Check sk_SSL_CIPHER_num() after assigning sk. 2014-05-12 23:01:06 +01:00
Jean-Paul Calderone
778f2b648c Correct the return type on the signature for X509_STORE_CTX_get_ex_data given in the pod file. 2014-05-12 22:48:34 +01:00
Serguei E. Leontiev
2223317bef Replace manual ASN1 decoder with ASN1_get_object 
Replace manual ASN.1 decoder with ASN1_get object. This
will decode the tag and length properly and check against
it does not exceed the supplied buffer length.

PR#3335
(cherry picked from commit b0308dddd1cc6a8e1de803ef29ba6da25ee072c2)
 2014-05-12 18:41:50 +01:00
Matt Caswell
b107586c0c Fixed NULL pointer dereference. See PR#3321 2014-05-12 00:43:33 +01:00