wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
10947 commits 20 branches 302 tags 153 MiB
Commit graph

10947 commits

This branch
This branch
All branches
Author SHA1 Message Date
Matt Caswell
9fb77b8e0d More indent fixes for STACK_OF 
Conflicts:
	ssl/s3_lib.c

Conflicts:
	apps/cms.c
	crypto/x509/x509_lu.c
	crypto/x509/x509_vfy.h
	ssl/s3_lib.c

Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:35:51 +00:00
Matt Caswell
3bb069d808 Fix indent issue with functions using STACK_OF 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:35:42 +00:00
Matt Caswell
7962ea7aa6 Fix indent issue with engine.h 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:35:36 +00:00
Matt Caswell
cbb5afdc34 Fix logic to check for indent.pro 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:35:27 +00:00
Andy Polyakov
f9189b79bf crypto/cryptlib.c: make it indent-friendly. 
Conflicts:
	crypto/cryptlib.c

Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:35:20 +00:00
Andy Polyakov
d68e7df7ab bn/bntest.c: make it indent-friendly. 
Conflicts:
	crypto/bn/bntest.c

Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:35:12 +00:00
Andy Polyakov
1c246f6bef bn/bn_recp.c: make it indent-friendly. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:35:06 +00:00
Andy Polyakov
802e6cfc05 engines/e_ubsec.c: make it indent-friendly. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:35:00 +00:00
Andy Polyakov
b2aec696f2 apps/speed.c: make it indent-friendly. 
Conflicts:
	apps/speed.c

Conflicts:
	apps/speed.c

Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:34:53 +00:00
Matt Caswell
18d3333cfd Fix make errors 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:34:48 +00:00
Richard Levitte
196767e08b Make the script a little more location agnostic 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:34:43 +00:00
Matt Caswell
2e7341ec5a Provide script for filtering data initialisers for structs/unions. indent just can't handle it. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:34:35 +00:00
Dr. Stephen Henson
3aac5918b1 Script fixes. 
Don't use double newline for headers.
Don't interpret ASN1_PCTX as start of an ASN.1 module.

Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:34:29 +00:00
Richard Levitte
ed4260b4a0 Run expand before perl, to make sure things are properly aligned 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:34:24 +00:00
Richard Levitte
4cf7ba6cce Force the use of our indent profile 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:34:17 +00:00
Tim Hudson
0ddec4259d Provide source reformating script. Requires GNU indent to be 
available.

Script written by Tim Hudson, with amendments by Steve Henson, Rich Salz and
Matt Caswell

Reviewed-by: Matt Caswell <matt@openssl.org>
 2015-01-22 09:34:02 +00:00
Matt Caswell
1566497495 Fix source where indent will not be able to cope 
Conflicts:
	apps/ciphers.c
	ssl/s3_pkt.c

Conflicts:
	crypto/ec/ec_curve.c

Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:33:54 +00:00
Matt Caswell
712548231e Additional comment changes for reformat of 1.0.1 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:33:47 +00:00
Matt Caswell
ac84cb4cfe Further comment changes for reformat 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:33:38 +00:00
Tim Hudson
3e9a08ecb1 mark all block comments that need format preserving so that 
indent will not alter them when reformatting comments

(cherry picked from commit 1d97c84351)

Conflicts:
	crypto/bn/bn_lcl.h
	crypto/bn/bn_prime.c
	crypto/engine/eng_all.c
	crypto/rc4/rc4_utl.c
	crypto/sha/sha.h
	ssl/kssl.c
	ssl/t1_lib.c

Conflicts:
	crypto/rc4/rc4_enc.c
	crypto/x509v3/v3_scts.c
	crypto/x509v3/v3nametest.c
	ssl/d1_both.c
	ssl/s3_srvr.c
	ssl/ssl.h
	ssl/ssl_locl.h
	ssl/ssltest.c
	ssl/t1_lib.c

Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:33:23 +00:00
Matt Caswell
3a9a032163 Prepare for 1.0.1m-dev 
Reviewed-by: Stephen Henson <steve@openssl.org>
 2015-01-15 14:49:54 +00:00
Matt Caswell
b83ceba7d5 Prepare for 1.0.1l release 
Reviewed-by: Stephen Henson <steve@openssl.org>
 2015-01-15 14:45:15 +00:00
Matt Caswell
d9738d5f07 make update 
Reviewed-by: Stephen Henson <steve@openssl.org>
 2015-01-15 14:45:15 +00:00
Matt Caswell
583f0bc402 Updates to CHANGES and NEWS 
Reviewed-by: Dr Stephen Henson <steve@openssl.org>
 2015-01-15 13:17:18 +00:00
Richard Levitte
e8e878bec7 Define CFLAGS as cflags on VMS as well 
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 43257b9f51)
 2015-01-14 00:16:21 +01:00
Matt Caswell
6099e629f5 Make output from openssl version -f consistent with previous versions 
Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 2d2671790e)
 2015-01-13 11:29:11 +00:00
Matt Caswell
3570086760 Fix warning where BIO_FLAGS_UPLINK was being redefined. 
This warning breaks the build in 1.0.0 and 0.9.8

Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit b1ffc6ca1c)
 2015-01-13 11:25:33 +00:00
Matt Caswell
acb341eb6e Avoid deprecation problems in Visual Studio 13 
Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 86d21d0b95)
 2015-01-13 09:47:47 +00:00
Dr. Stephen Henson
8fb2c9922a RT3662: Allow leading . in nameConstraints 
Change by SteveH from original by John Denker (in the RT)

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 77ff1f3b8b)
 2015-01-10 16:03:05 -05:00
Matt Caswell
a97c208c5a Further windows specific .gitignore entries 
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 41c9cfbc4e)
 2015-01-09 23:40:51 +00:00
Matt Caswell
cc6e9f9abb Update .gitignore with windows files to be excluded from git 
Reviewed-by: Tim Hudson <tjh@openssl.org>

Conflicts:
	.gitignore

(cherry picked from commit 04f670cf3d)
 2015-01-09 11:30:31 +00:00
Matt Caswell
56cd740449 Fix build failure on Windows due to undefined cflags identifier 
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 5c5e7e1a7e)
 2015-01-08 19:26:28 +00:00
Matt Caswell
8437225d34 Prepare for 1.0.1l-dev 
Reviewed-by: Stephen Henson <steve@openssl.org>
 2015-01-08 14:07:43 +00:00
Matt Caswell
b4a57c4c41 Prepare for 1.0.1k release 
Reviewed-by: Stephen Henson <steve@openssl.org>
 2015-01-08 14:03:40 +00:00
Matt Caswell
faa8038edd make update 
Reviewed-by: Stephen Henson <steve@openssl.org>
 2015-01-08 14:03:39 +00:00
Matt Caswell
e02863b5ac CHANGES and NEWS updates for release 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Steve Henson <steve@openssl.org>
 2015-01-08 13:51:50 +00:00
Matt Caswell
04685bc949 A memory leak can occur in dtls1_buffer_record if either of the calls to 
ssl3_setup_buffers or pqueue_insert fail. The former will fail if there is a
malloc failure, whilst the latter will fail if attempting to add a duplicate
record to the queue. This should never happen because duplicate records should
be detected and dropped before any attempt to add them to the queue.
Unfortunately records that arrive that are for the next epoch are not being
recorded correctly, and therefore replays are not being detected.
Additionally, these "should not happen" failures that can occur in
dtls1_buffer_record are not being treated as fatal and therefore an attacker
could exploit this by sending repeated replay records for the next epoch,
eventually causing a DoS through memory exhaustion.

Thanks to Chris Mueller for reporting this issue and providing initial
analysis and a patch. Further analysis and the final patch was performed by
Matt Caswell from the OpenSSL development team.

CVE-2015-0206

Reviewed-by: Dr Stephen Henson <steve@openssl.org>
 2015-01-08 13:43:20 +00:00
Dr. Stephen Henson
98a0f9660d Unauthenticated DH client certificate fix. 
Fix to prevent use of DH client certificates without sending
certificate verify message.

If we've used a client certificate to generate the premaster secret
ssl3_get_client_key_exchange returns 2 and ssl3_get_cert_verify is
never called.

We can only skip the certificate verify message in
ssl3_get_cert_verify if the client didn't send a certificate.

Thanks to Karthikeyan Bhargavan for reporting this issue.
CVE-2015-0205
Reviewed-by: Matt Caswell <matt@openssl.org>
 2015-01-08 13:43:20 +00:00
Matt Caswell
45fe66b8ba Follow on from CVE-2014-3571. This fixes the code that was the original source 
of the crash due to p being NULL. Steve's fix prevents this situation from
occuring - however this is by no means obvious by looking at the code for
dtls1_get_record. This fix just makes things look a bit more sane.

Reviewed-by: Dr Steve Henson <steve@openssl.org>
 2015-01-08 13:43:20 +00:00
Dr. Stephen Henson
8d7aab986b Fix crash in dtls1_get_record whilst in the listen state where you get two 
separate reads performed - one for the header and one for the body of the
handshake record.

CVE-2014-3571

Reviewed-by: Matt Caswell <matt@openssl.org>
 2015-01-08 13:43:20 +00:00
Andy Polyakov
e078642dde Fix for CVE-2014-3570. 
Reviewed-by: Emilia Kasper <emilia@openssl.org>
(cherry picked from commit e793809ba50c1e90ab592fb640a856168e50f3de)
(with 1.0.1-specific addendum)
 2015-01-08 13:43:20 +00:00
Dr. Stephen Henson
ffd14272c4 fix error discrepancy 
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 4a4d415857)
 2015-01-07 18:10:51 +00:00
Andy Polyakov
f16f3ac559 Fix irix-cc build. 
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit e464403d0b)
 2015-01-07 18:43:34 +01:00
Richard Levitte
4fb433d221 VMS fixups for 1.0.1 
Reviewed-by: Rich Salz <rsalz@openssl.org>
 2015-01-07 16:45:10 +01:00
Dr. Stephen Henson
293c1e2235 use correct credit in CHANGES 
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 4138e38825)
 2015-01-06 22:41:36 +00:00
Emilia Kasper
d5e16a711e Only inherit the session ID context in SSL_set_SSL_CTX if the existing 
context was also inherited (matches that of the existing SSL_CTX).

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit ac8e9cbe14)
 2015-01-06 23:10:09 +01:00
Dr. Stephen Henson
178c562a46 use correct function name 
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit cb62ab4b17)
 2015-01-06 21:04:50 +00:00
Martin Brejcha
61052e891e Fix memory leak. 
Fix memory leak by freeing up saved_message.data if it is not NULL.

PR#3489
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

(cherry picked from commit 41cd41c441)
 2015-01-06 16:49:49 +00:00
Matt Caswell
cb951e336b Remove blank line from start of cflags character array in buildinf.h 
Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit b691154e18)
 2015-01-06 15:37:12 +00:00
Dr. Stephen Henson
37580f43b5 Only allow ephemeral RSA keys in export ciphersuites. 
OpenSSL clients would tolerate temporary RSA keys in non-export
ciphersuites. It also had an option SSL_OP_EPHEMERAL_RSA which
enabled this server side. Remove both options as they are a
protocol violation.

Thanks to Karthikeyan Bhargavan for reporting this issue.
(CVE-2015-0204)
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>

(cherry picked from commit 4b4c1fcc88)

Conflicts:
	doc/ssl/SSL_CTX_set_options.pod
 2015-01-06 13:14:05 +00:00