wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
10973 commits 20 branches 302 tags 153 MiB
Commit graph

1509 commits

Author SHA1 Message Date
Sami Farin
6468866823 Typo: set i to -1 before goto. 
PR#3302
(cherry picked from commit 9717f01951f976f76dd40a38d9fc7307057fa4c4)
 2014-06-02 13:53:54 +01:00
Matt Caswell
de8a5b523f Added SSLErr call for internal error in dtls1_buffer_record 2014-06-01 21:40:31 +01:00
David Ramos
8de85b0048 Delays the queue insertion until after the ssl3_setup_buffers() call due to use-after-free bug. PR#3362 2014-06-01 21:40:25 +01:00
Dr. Stephen Henson
623a01df49 Option to disable padding extension. 
Add TLS padding extension to SSL_OP_ALL so it is used with other
"bugs" options and can be turned off.

This replaces SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG which is an ancient
option referring to SSLv2 and SSLREF.

PR#3336
(cherry picked from commit 758415b2259fa45d3fe17d8e53ae1341b7b6e482)

Conflicts:

	ssl/t1_lib.c
 2014-06-01 16:50:25 +01:00
David Ramos
856a4585d6 Allocate extra space when NETSCAPE_HANG_BUG defined. 
Make sure there is an extra 4 bytes for server done message when
NETSCAPE_HANG_BUG is defined.

PR#3361
(cherry picked from commit 92d81ba622)
 2014-06-01 14:27:58 +01:00
Dr. Stephen Henson
87a0cbdf2e Use correct digest when exporting keying material. 
PR#3319
(cherry picked from commit 84691390eae86befd33c83721dacedb539ae34e6)
 2014-05-30 13:24:36 +01:00
Dr. Stephen Henson
b5bdde9e0e Don't compile heartbeat test code on Windows (for now). 
(cherry picked from commit 2c575907d2c8601a18716f718ce309ed4e1f1783)
 2014-05-30 13:12:26 +01:00
Mike Bland
8db2ba4b84 Fix heartbeat_test for -DOPENSSL_NO_HEARTBEATS 
Replaces the entire test with a trivial implementation when
OPENSSL_NO_HEARTBEATS is defined.
 2014-05-22 22:02:46 +01:00
Ben Laurie
5cd1a6fc3e Fix signed/unsigned warning. 2014-05-20 15:14:30 +01:00
Dr. Stephen Henson
81ce94f8dc For portability use BUF_strndup instead of strndup. 
(cherry picked from commit dcca7b13e9)
 2014-05-20 11:22:33 +01:00
Dr. Stephen Henson
feaa3b380b Adding padding extension to trace code. 
(cherry picked from commit 6db14dbc51)
 2014-05-20 11:22:15 +01:00
Mike Bland
2312a84ca1 Unit/regression test for TLS heartbeats. 
Regression test against CVE-2014-0160 (Heartbleed).

More info: http://mike-bland.com/tags/heartbleed.html

(based on commit 35cb55988b75573105eefd00d27d0138eebe40b1)
 2014-05-18 10:23:59 -04:00
Kurt Roeckx
1f5bce2dce Check sk_SSL_CIPHER_num() after assigning sk. 2014-05-12 22:59:11 +01:00
Serguei E. Leontiev
d6e55b4001 Replace manual ASN1 decoder with ASN1_get_object 
Replace manual ASN.1 decoder with ASN1_get object. This
will decode the tag and length properly and check against
it does not exceed the supplied buffer length.

PR#3335
(cherry picked from commit b0308dddd1cc6a8e1de803ef29ba6da25ee072c2)
 2014-05-12 18:41:51 +01:00
Matt Caswell
f710c3f198 Fixed NULL pointer dereference. See PR#3321 2014-05-12 00:39:43 +01:00
Günther Noack
8571902e23 Avoid out-of-bounds write in SSL_get_shared_ciphers 
PR: 3317
 2014-05-11 23:55:06 +01:00
Matt Caswell
f2ebe2a60e Move length check earlier to ensure we don't go beyond the end of the user's buffer. PR#3320 2014-05-11 11:32:17 +01:00
Tim Hudson
011ee91105 safety check to ensure we dont send out beyond the users buffer 2014-05-11 11:32:17 +01:00
Tim Hudson
afe343c3a7 fix coverity issue 966597 - error line is not always initialised 2014-05-07 23:57:00 +01:00
Matt Caswell
7441e7dbe9 Fixed spelling error in error message. Fix supplied by Marcos Marado 2014-05-01 00:27:02 +01:00
Ben Laurie
a0fe2e72c4 Fix use after free. 2014-04-23 07:30:16 +01:00
Kaspar Brand
5aeb43393b Fix SSL_CTX_get{first,next}_certificate. 
Fix typo that stopped SSL_CTX_get_{first,next}_certificate from working.
(cherry picked from commit 9330a85e04)
 2014-04-21 16:53:48 +01:00
Steven M. Schweda
6ef9d9bacf VMS build fix #2. 
(cherry picked from commit a74bee5fc7)
 2014-04-08 17:28:23 +01:00
Steven M. Schweda
40a44a7c3d VMS build fix for older compilers. 
(cherry picked from commit 55c9e24875)
 2014-04-07 23:15:31 +01:00
Dr. Stephen Henson
7e840163c0 Add heartbeat extension bounds check. 
A missing bounds check in the handling of the TLS heartbeat extension
can be used to reveal up to 64k of memory to a connected client or
server.

Thanks for Neel Mehta of Google Security for discovering this bug and to
Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
preparing the fix (CVE-2014-0160)
(cherry picked from commit 96db9023b8)
 2014-04-07 19:25:34 +01:00
Dr. Stephen Henson
6411b83e52 Set TLS padding extension value. 
Enable TLS padding extension using official value from:

http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
(cherry picked from commit cd6bd5ffda)

Conflicts:

	CHANGES
 2014-04-05 20:49:09 +01:00
Dr. Stephen Henson
bc5ec653ba Fix memory leak with client auth. 2014-03-27 16:10:50 +00:00
Dr. Stephen Henson
1f44dac24d Add -no_resumption_on_reneg to SSL_CONF. 2014-03-27 15:51:25 +00:00
Dr. Stephen Henson
2dd6976f6d Update chain building function. 
Don't clear verification errors from the error queue unless
SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR is set.

If errors occur during verification and SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR
is set return 2 so applications can issue warnings.
 2014-03-27 14:23:46 +00:00
Emilia Kasper
662239183d Allow duplicate certs in ssl_build_cert_chain 2014-03-25 17:28:04 +00:00
Piotr Sikora
aa10982c49 Retry callback only after ClientHello received. 
(cherry picked from commit f04665a653)
 2014-03-18 23:58:39 +00:00
Dr. Stephen Henson
44f7e399d3 typo 
(cherry picked from commit a029788b0e)
 2014-03-10 15:48:12 +00:00
Andy Polyakov
25ebd9e3ce bss_dgram.c,d1_lib.c: make it compile with mingw. 
Submitted by: Roumen Petrov
(cherry picked from commit 972b0dc350)
 2014-03-06 14:07:16 +01:00
Dr. Stephen Henson
976c58302b Add function to free compression methods. 
Although the memory allocated by compression methods is fixed and
cannot grow over time it can cause warnings in some leak checking
tools. The function SSL_COMP_free_compression_methods() will free
and zero the list of supported compression methods. This should
*only* be called in a single threaded context when an application
is shutting down to avoid interfering with existing contexts
attempting to look up compression methods.
 2014-03-01 23:14:08 +00:00
Dr. Stephen Henson
d1201e3195 Fix compilation errors with no-nextprotoneg 2014-02-28 13:35:30 +00:00
Dr. Stephen Henson
73be56a21d Fix for WIN32 builds with KRB5 2014-02-26 15:33:10 +00:00
Andy Polyakov
8d08627c94 ssl/t1_enc.c: check EVP_MD_CTX_copy return value. 
PR: 3201
(cherry picked from commit 03da57fe14)
 2014-02-25 22:23:49 +01:00
Dr. Stephen Henson
3678161d71 Don't use BN_ULLONG in n2l8 use SCTS_TIMESTAMP. 2014-02-25 15:05:08 +00:00
Dr. Stephen Henson
c3f5d3d93a Only set current certificate to valid values. 
When setting the current certificate check that it has a corresponding
private key.
(cherry picked from commit 358d352aa2)
 2014-02-23 13:49:21 +00:00
Dr. Stephen Henson
c5ea65b157 New chain building flags. 
New flags to build certificate chains. The can be used to rearrange
the chain so all an application needs to do is add all certificates
in arbitrary order and then build the chain to check and correct them.

Add verify error code when building chain.

Update docs.
(cherry picked from commit 13dc3ce9ab)
 2014-02-23 13:49:21 +00:00
Dr. Stephen Henson
58b86e4235 Option to set current cert to server certificate. 
(cherry picked from commit daddd9a950)
 2014-02-23 13:49:21 +00:00
Ben Laurie
a466be6243 Fix typo. 2014-02-23 11:21:39 +00:00
Andy Polyakov
6b3b6beaa1 ssl/ssl_cert.c: DANE update. 2014-02-21 12:12:25 +01:00
Dr. Stephen Henson
b709f8ef54 fix WIN32 warnings 2014-02-20 22:41:06 +00:00
Rob Stradling
c74ce24cd2 Show the contents of the RFC6962 Signed Certificate Timestamp List Certificate/OCSP Extensions. 
Add the RFC6962 OIDs to the objects table.
(backport from master branch)
 2014-02-20 21:43:54 +00:00
Dr. Stephen Henson
d69acceca9 Fix error discrepancy with 1.0.1 2014-02-14 17:50:20 +00:00
Andy Polyakov
aff78bb39a ssl/s3_pkt.c: detect RAND_bytes error in multi-block. 
(cherry picked from commit 701134320a)
 2014-02-14 17:45:33 +01:00
Andy Polyakov
d59d0b7c21 ssl/ssl[3].h: retain binary compatibility. 2014-02-13 17:03:14 +01:00
Dr. Stephen Henson
a2317c3ffd fix error discrepancy 2014-02-09 21:12:12 +00:00
Dr. Stephen Henson
295fd057ce fix error number clash 2014-02-09 19:57:27 +00:00