wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
12074 commits 20 branches 302 tags 153 MiB
Commit graph

12074 commits

This branch
This branch
All branches
Author SHA1 Message Date
Viktor Dukhovni
8abffa4a73 Multiple verifier reference identities. 
Implemented as STACK_OF(OPENSSL_STRING).
 2014-06-22 20:32:35 -04:00
Viktor Dukhovni
66d884f067 Implement sk_deep_copy. 2014-06-22 20:24:18 -04:00
Viktor Dukhovni
29edebe95c More complete input validation of X509_check_mumble 2014-06-22 20:18:53 -04:00
Viktor Dukhovni
a48fb0400c X509_check_mumble() failure is <= 0, not just 0 2014-06-22 20:14:53 -04:00
Viktor Dukhovni
b3012c698a Drop hostlen from X509_VERIFY_PARAM_ID. 
Just store NUL-terminated strings.  This works better when we add
support for multiple hostnames.
 2014-06-22 19:52:44 -04:00
Viktor Dukhovni
d241b80409 More complete X509_check_host documentation. 2014-06-22 19:50:02 -04:00
Miod Vallat
2841d6ca9f Fix off-by-one errors in ssl_cipher_get_evp() 
In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

Bug discovered and fixed by Miod Vallat from the OpenBSD team.

PR#3375
 2014-06-22 23:14:19 +01:00
Matt Caswell
cf1b08cdd7 Revert "Fix off-by-one errors in ssl_cipher_get_evp()" 
This reverts commit abfb989fe0.

Incorrect attribution
 2014-06-22 22:35:56 +01:00
Matt Caswell
339da43d6c Fixed Windows compilation failure 2014-06-22 20:16:47 +02:00
Matt Caswell
115e480924 Fix minor typos 2014-06-19 23:45:21 +01:00
Hubert Kario
e42d84be33 add references to verify(1) man page for args_verify() options 
cms, ocsp, s_client, s_server and smime tools also use args_verify()
for parsing options, that makes them most of the same options
verify tool does. Add those options to man pages and reference
their explanation in the verify man page.
 2014-06-19 23:09:21 +01:00
Hubert Kario
2866441a90 sort the options in verify man page alphabetically 
just making sure the options are listed in the alphabetical order
both in SYNOPSIS and DESCRIPTION, no text changes
 2014-06-19 23:09:21 +01:00
Hubert Kario
cd028c8e66 add description of missing options to verify man page 
The options related to policy used for verification, verification
of subject names in certificate and certificate chain handling
were missing in the verify(1) man page. This fixes this issue.
 2014-06-19 23:09:21 +01:00
Hubert Kario
ce21d108bd smime man page: add missing options in SYNOPSIS 
-CAfile and -CApath is documented in OPTIONS but is missing
in SYNOPSIS, add them there
 2014-06-19 23:09:21 +01:00
Hubert Kario
6d3d579367 Document -trusted_first option in man pages and help. 
Add -trusted_first description to help messages and man pages
of tools that deal with certificate verification.
 2014-06-19 23:09:21 +01:00
Matt Caswell
2d7153e8f9 Tidied up, added include to stdlib, removed "goto bad" usage 2014-06-17 23:35:53 +01:00
rfkrocktk
8a531c22b0 Conform to whitespace conventions 2014-06-17 23:10:14 +01:00
rfkrocktk
96fc4b7250 Added documentation for -iter for PKCS#8 2014-06-17 23:10:14 +01:00
Naftuli Tzvi Kay
8a6c6bbf21 Added custom PBKDF2 iteration count to PKCS8 tool. 2014-06-17 23:10:14 +01:00
Felix Laurie von Massenbach
50cc4f7b3d Fix signed/unsigned comparisons. 2014-06-17 17:41:46 +01:00
Felix Laurie von Massenbach
1f61d8b5b1 Fix shadow declaration. 2014-06-17 17:41:46 +01:00
Andy Polyakov
9024b84b7c aesni-sha[1|256]-x86_64.pl: fix logical error and MacOS X build. 2014-06-16 10:11:45 +02:00
Andy Polyakov
764fe518da aesp8-ppc.pl: add CTR mode. 2014-06-16 08:05:19 +02:00
Viktor Dukhovni
7241a4c7fd Enforce _X509_CHECK_FLAG_DOT_SUBDOMAINS internal-only 2014-06-14 22:31:29 +01:00
Dr. Stephen Henson
3b77f01702 Accept CCS after sending finished. 
Allow CCS after finished has been sent by client: at this point
keys have been correctly set up so it is OK to accept CCS from
server. Without this renegotiation can sometimes fail.

PR#3400
 2014-06-14 22:31:28 +01:00
Andy Polyakov
ce00c64df9 evp/e_aes_cbc_sha[1|256].c: fix -DPEDANTIC build. 2014-06-14 23:15:39 +02:00
Andy Polyakov
91a6bf80f8 aesni-sha256-x86_64.pl: add missing rex in shaext. 
PR: 3405
 2014-06-14 16:03:06 +02:00
Andy Polyakov
c9cf29cca2 sha1-x86_64.pl: add missing rex prefix in shaext. 
PR: 3405
 2014-06-14 15:27:54 +02:00
Matt Caswell
687721a7dc Fixed incorrect return code handling in ssl3_final_finish_mac. 
Based on an original patch by Joel Sing (OpenBSD) who also originally identified the issue.
 2014-06-13 15:36:20 +01:00
Matt Caswell
043fd64689 Revert "Fixed incorrect return code handling in ssl3_final_finish_mac" 
This reverts commit 2f1dffa88e.

Missing attribution.
 2014-06-13 15:35:20 +01:00
Viktor Dukhovni
a09e4d24ad Client-side namecheck wildcards. 
A client reference identity of ".example.com" matches a server
certificate presented identity that is any sub-domain of "example.com"
(e.g. "www.sub.example.com).

With the X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS flag, it matches
only direct child sub-domains (e.g. "www.sub.example.com").
 2014-06-12 23:19:25 +01:00
Kurt Cancemi
abfb989fe0 Fix off-by-one errors in ssl_cipher_get_evp() 
In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

PR#3375
 2014-06-12 21:11:00 +01:00
Andy Polyakov
977f32e852 Facilitate back-porting of AESNI and SHA modules. 
Fix SEH and stack handling in Win64 build.
 2014-06-12 21:45:41 +02:00
Matt Caswell
d84ba7ea23 Added OPENSSL_assert check as per PR#3377 reported by Rainer Jung <rainer.jung@kippdata.de> 2014-06-12 20:40:54 +01:00
Dr. Stephen Henson
a50f71868e Fix Windows build. 
(cherry picked from commit 5f4c5a902b0508eab235adecb34b236cdc0048a5)
 2014-06-12 10:58:12 +01:00
Andy Polyakov
77a27a5066 Enable multi-block support by default. 2014-06-11 20:40:51 +02:00
Dr. Stephen Henson
9494e99b40 Fix compilation with no-comp 2014-06-11 14:41:00 +01:00
Andy Polyakov
1cf8f57b43 ghash-x86_64.pl: optimize for upcoming Atom. 2014-06-11 11:34:18 +02:00
Andy Polyakov
619b94667c Add support for Intel SHA extension. 2014-06-11 10:27:45 +02:00
Rob Stradling
fd2309aa29 Separate the SCT List parser from the SCT List viewer 2014-06-10 23:44:13 +01:00
Matt Caswell
2f1dffa88e Fixed incorrect return code handling in ssl3_final_finish_mac 2014-06-10 23:31:50 +01:00
Andy Polyakov
e2eabed110 aesni-mb-x86_64.pl: add Win64 SEH. 2014-06-10 23:08:06 +02:00
Hubert Kario
343e5cf194 add ECC strings to ciphers(1), point out difference between DH and ECDH 
* Make a clear distinction between DH and ECDH key exchange.
 * Group all key exchange cipher suite identifiers, first DH then ECDH
 * add descriptions for all supported *DH* identifiers
 * add ECDSA authentication descriptions
 * add example showing how to disable all suites that offer no
   authentication or encryption
 2014-06-10 20:53:07 +01:00
Mike Bland
3ead9f3798 Create test/testutil.h for unit test helper macros 
Defines SETUP_TEST_FIXTURE and EXECUTE_TEST, and updates ssl/heartbeat_test.c
using these macros. SETUP_TEST_FIXTURE makes use of the new TEST_CASE_NAME
macro, defined to use __func__ or __FUNCTION__ on platforms that support those
symbols, or to use the file name and line number otherwise. This should fix
several reported build problems related to lack of C99 support.
 2014-06-10 19:20:25 +01:00
Dr. Stephen Henson
7a9d59c148 Fix null pointer errors. 
PR#3394
 2014-06-10 14:47:29 +01:00
Dr. Stephen Henson
447280ca7b SRP ciphersuite correction. 
SRP ciphersuites do not have no authentication. They have authentication
based on SRP. Add new SRP authentication flag and cipher string.
 2014-06-09 12:09:52 +01:00
Dr. Stephen Henson
1bea384fd5 Update strength_bits for 3DES. 
Fix strength_bits to 112 for 3DES.
 2014-06-09 12:09:52 +01:00
Kurt Roeckx
95fe635d90 Link heartbeat_test with the static version of the libraries 
It's using an internal API that that might not be available in the shared
library.
 2014-06-09 00:10:24 +01:00
Jakub Wilk
7be1d8764d Create ~/.rnd with mode 0600 instead of 0666 
Because of a missing include <fcntl.h> we don't have O_CREATE and don't create
the file with open() using mode 0600 but fall back to using fopen() with the
default umask followed by a chmod().

Problem found by Jakub Wilk <jwilk@debian.org>.
 2014-06-08 21:15:48 +01:00
Dr. Stephen Henson
fb8d9ddb9d Make tls_session_secret_cb work with CVE-2014-0224 fix. 
If application uses tls_session_secret_cb for session resumption
set the CCS_OK flag.
 2014-06-07 15:27:23 +01:00