wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
10404 commits 20 branches 302 tags 153 MiB
Commit graph

5384 commits

Author SHA1 Message Date
Dr. Stephen Henson
bd9fc1d667 New functions to retrieve certificate signatures and signature OID NID. 
(backport from HEAD)
 2012-12-26 14:31:05 +00:00
Dr. Stephen Henson
2b5e5c3d08 Revert incompatible OCSP_basic_verify changes. 
Make partial chain chekcing work with EE certificates only.
Remove unneeded -trust_other option from tocsp.
(Backport from HEAD)
 2012-12-26 14:12:09 +00:00
Dr. Stephen Henson
70cd3c6b95 Integrate host, email and IP address checks into X509_verify. 
Add new verify options to set checks.

(backport from HEAD)
 2012-12-19 15:14:10 +00:00
Dr. Stephen Henson
45da1efcdb Backport X509 hostname, IP address and email checking code from HEAD. 2012-12-19 15:01:59 +00:00
Dr. Stephen Henson
54a0076e94 Check chain is not NULL before assuming we have a validated chain. The 
modification to the OCSP helper purpose breaks normal OCSP verification. It is
no longer needed now we can trust partial chains.
 2012-12-19 15:01:32 +00:00
Dr. Stephen Henson
2e65277695 Use new partial chain flag instead of modifying input parameters. 
(backport from HEAD)
 2012-12-14 14:31:16 +00:00
Dr. Stephen Henson
9a1f59cd31 New verify flag to return success if we have any certificate in the trusted 
store instead of the default which is to return an error if we can't build
the complete chain. [backport from HEAD]
 2012-12-14 14:30:46 +00:00
Ben Laurie
d65b8b2162 Backport OCSP fixes. 2012-12-14 12:53:53 +00:00
Ben Laurie
2a2e537983 Ignore more. 2012-12-13 12:43:18 +00:00
Dr. Stephen Henson
e04ccbc5cc Fix two bugs which affect delta CRL handling: 
Use -1 to check all extensions in CRLs.
Always set flag for freshest CRL.
 2012-12-06 18:24:47 +00:00
Andy Polyakov
bc946bfb97 aes-s390x.pl: fix XTS bugs in z196-specific code path [from HEAD]. 2012-12-05 17:45:09 +00:00
Andy Polyakov
c5e91a9ae9 aes-s390x.pl: harmonize software-only path [from HEAD]. 2012-12-01 11:09:13 +00:00
Dr. Stephen Henson
b5f57f455a PR: 2803 
Submitted by: jean-etienne.schwartz@bull.net

In OCSP_basic_varify return an error if X509_STORE_CTX_init fails.
 2012-11-29 19:15:27 +00:00
Andy Polyakov
ad00a52f2d Intel compiler support update from HEAD. 2012-11-28 13:12:09 +00:00
Andy Polyakov
a060fc3b8e x86_64-gcc.c: resore early clobber constraint [from HEAD]. 
Submitted by: Florian Weimer
 2012-11-19 15:02:34 +00:00
Andy Polyakov
d90bf2ab21 [vp]aes-x86[_64].pl: update from HEAD. 2012-11-12 18:11:17 +00:00
Andy Polyakov
aa963813ed linux-ppc: make it more robust [from HEAD]. 2012-10-21 18:25:29 +00:00
Dr. Stephen Henson
9a6aff50ff Don't require tag before ciphertext in AESGCM mode 2012-10-16 22:46:32 +00:00
Bodo Möller
b626f0396c Fix EC_KEY initialization race. 
Submitted by: Adam Langley
 2012-10-05 20:50:38 +00:00
Dr. Stephen Henson
9d2006d8ed add -trusted_first option and verify flag (backport from HEAD) 2012-09-26 13:50:42 +00:00
Bodo Möller
abf1e32f2f Fix Valgrind warning. 
Submitted by: Adam Langley
 2012-09-24 19:49:25 +00:00
Andy Polyakov
988037fe18 MIPS assembly pack: jumbo update from HEAD. 2012-09-19 20:59:18 +00:00
Bodo Möller
9a7f80c869 Fix warning. 
Submitted by: Chromium Authors
 2012-09-17 17:23:43 +00:00
Andy Polyakov
507e5c3a61 e_aes.c: uninitialized variable in aes_ccm_init_key [from HEAD]. 
PR: 2874
Submitted by: Tomas Mraz
 2012-09-15 08:46:08 +00:00
Andy Polyakov
d46a1a6178 bn_lcl.h: gcc removed support for "h" constraint, which broke inline 
assembler [from HEAD].
 2012-09-01 13:21:24 +00:00
Andy Polyakov
3ebe87473c x86cpuid.pl: hide symbols [backport from x86_64, from HEAD]. 2012-08-29 14:24:18 +00:00
Andy Polyakov
0e05b51fe5 Add linux-x32 target [from HEAD]. 2012-08-29 14:12:10 +00:00
Dr. Stephen Henson
c759e453bc PR: 2786 
Reported by: Tomas Mraz <tmraz@redhat.com>

Treat a NULL value passed to drbg_free_entropy callback as non-op. This
can happen if the call to fips_get_entropy fails.
 2012-08-22 22:43:03 +00:00
Andy Polyakov
40ce8fca73 sha1-armv4-large.pl: comply with ABI [from HEAD]. 2012-08-17 19:58:34 +00:00
Andy Polyakov
8e1c33e160 MIPS assembly pack updates from HEAD. 2012-08-17 09:41:30 +00:00
Andy Polyakov
13b0cae256 aes-mips.pl: harmonize with fips module. 
PR: 2863
Submitted by: Duane Sand
 2012-08-17 09:03:57 +00:00
Andy Polyakov
ae92994645 bss_dgram.c: fix compilation failure and warning on Windows with 
contemporary SDK [from HEAD].
 2012-08-14 09:53:41 +00:00
Andy Polyakov
f0a069c1a2 gcm128.c: fix AAD-only case with AAD length not divisible by 16 [from HEAD]. 
PR: 2859
Submitted by: John Foley
 2012-08-13 15:31:10 +00:00
Dr. Stephen Henson
5b4b9ce976 Don't ignore (!) reference count in X509_STORE_free. 2012-07-19 12:48:02 +00:00
Dr. Stephen Henson
7fbcc2f24a type 2012-07-13 11:17:56 +00:00
Richard Levitte
e4be79a383 Add the missing dh_rfc5114 and evp_cnf. 2012-07-05 13:00:45 +00:00
Richard Levitte
658604473f Added aliases for symbols longer than 31 chars. 2012-07-05 09:08:18 +00:00
Richard Levitte
86bea6455c remove duplicate symbol in crypto/symhacks.h 
Have the new names start in column 48, that makes it easy to see when
the 31 character limit is reached (on a 80 column display, do the math)
 2012-07-05 08:53:43 +00:00
Dr. Stephen Henson
1e4a6e7b7f add missing evp_cnf.c file 2012-07-04 13:14:44 +00:00
Andy Polyakov
fd6a72fa1c crypto/bn/*.h: move PTR_SIZE_INT to private header [from HEAD]. 2012-07-04 08:51:44 +00:00
Dr. Stephen Henson
74d89b0d93 PR: 2840 
Reported by: David McCullough <david_mccullough@mcafee.com>

Restore fips configuration module from 0.9.8.
 2012-07-03 20:20:11 +00:00
Andy Polyakov
5b7af6de43 bn_nist.c: harmonize buf in BN_nist_mod_256 with other mod functions and 
compensate for VC buf [from HEAD].

PR: 2837
 2012-07-02 14:38:22 +00:00
Andy Polyakov
ae414a0e42 bss_dgram.c: fix typos in Windows code [from HEAD]. 2012-07-01 09:12:03 +00:00
Andy Polyakov
8b654459be x86_64 assembly pack: make it possible to compile with Perl located 
on path with spaces [from HEAD].

PR: 2835
 2012-06-27 12:48:50 +00:00
Andy Polyakov
3e8b4b5055 bss_dgram.c: add BIO_CTRL_DGRAM_SET_DONT_FRAG, fix bugs [from HEAD]. 
PR: 2830, 2833
 2012-06-19 12:28:47 +00:00
Dr. Stephen Henson
e51ec51af9 revert more "version skew" changes that break FIPS builds 2012-06-10 23:02:06 +00:00
Dr. Stephen Henson
ff1c55e983 Revert "version skew" patches that break FIPS compilation 2012-06-09 23:36:38 +00:00
Ben Laurie
ff46820da6 Version skew reduction. 2012-06-06 12:41:46 +00:00
Andy Polyakov
6fba65e20d x86gas.pl: update from HEAD. 2012-06-04 22:14:25 +00:00
Ben Laurie
68d2cf51bc Reduce version skew: trivia (I hope). 2012-06-03 22:03:37 +00:00
Ben Laurie
0de5a0feee Work around macro issue with FreeBSD and gcc 4.6. 2012-05-18 12:40:28 +00:00
Andy Polyakov
67fda0c12e ppccap.c: assume no features under 32-bit AIX kernel [from HEAD]. 
PR: 2810
 2012-05-16 18:18:14 +00:00
Dr. Stephen Henson
1dded7f7e8 Experimental multi-implementation support for FIPS capable OpenSSL. 
When in FIPS mode the approved implementations are used as normal,
when not in FIPS mode the internal unapproved versions are used instead.
This means that the FIPS capable OpenSSL isn't forced to use the
(often lower perfomance) FIPS implementations outside FIPS mode.
 2012-05-13 18:40:12 +00:00
Dr. Stephen Henson
482f238069 PR: 2813 
Reported by: Constantine Sapuntzakis <csapuntz@gmail.com>

Fix possible deadlock when decoding public keys.
 2012-05-11 13:53:23 +00:00
Dr. Stephen Henson
24547c23ca Reported by: Solar Designer of Openwall 
Make sure tkeylen is initialised properly when encrypting CMS messages.
 2012-05-10 13:44:24 +00:00
Andy Polyakov
95416ce5b3 ppccpuid.pl: branch hints in OPENSSL_cleanse impact small block performance 
of digest algorithms, mosty SHA, on Power7. Mystery of century, why SHA,
why slower algorithm are affected more... [from HEAD].
PR: 2794
Submitted by: Ashley Lai
 2012-04-27 20:19:23 +00:00
Andy Polyakov
8e7ccf6ff7 objxref.pl: improve portability [from HEAD]. 2012-04-22 21:19:41 +00:00
Dr. Stephen Henson
51b77c0337 correct error code 2012-04-22 13:31:19 +00:00
Dr. Stephen Henson
1cc8410e36 PR: 2239 
Submitted by: Dominik Oepen <oepen@informatik.hu-berlin.de>

Add Brainpool curves from RFC5639.

Original patch by Annie Yousar <a.yousar@informatik.hu-berlin.de>
 2012-04-22 13:11:48 +00:00
Andy Polyakov
6ca7af9ec0 e_rc4_hmac_md5.c: reapply commit#21726, which was erroneously omitted [from 1.0.1]. 
PR: 2797, 2792
 2012-04-20 21:45:21 +00:00
Dr. Stephen Henson
bc2c8efc80 call OPENSSL_init when calling FIPS_mode too 2012-04-20 14:43:14 +00:00
Dr. Stephen Henson
00bb875240 make ciphers work again for FIPS builds 2012-04-20 00:08:32 +00:00
Andy Polyakov
c3cb563d87 e_rc4_hmac_md5.c: last commit was inappropriate for non-x86[_64] platforms 
[from HEAD].
PR: 2792
 2012-04-19 20:42:24 +00:00
Dr. Stephen Henson
564a503b1b Check for potentially exploitable overflows in asn1_d2i_read_bio 
BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
in CRYPTO_realloc_clean.

Thanks to Tavis Ormandy, Google Security Team, for discovering this
issue and to Adam Langley <agl@chromium.org> for fixing it. (CVE-2012-2110)
 2012-04-19 16:19:07 +00:00
Dr. Stephen Henson
068fc255ac only call FIPS_cipherinit in FIPS mode 2012-04-18 22:42:06 +00:00
Andy Polyakov
cc8f2fb917 e_rc4_hmac_md5.c: update from HEAD, fixes crash on legacy Intel CPUs. 
PR: 2792
 2012-04-18 17:51:26 +00:00
Dr. Stephen Henson
b583ebb7dd recognise X9.42 DH certificates on servers 2012-04-18 17:03:45 +00:00
Andy Polyakov
f6a1939f0f OPENSSL_NO_SOCK fixes [from HEAD]. 
PR: 2791
Submitted by: Ben Noordhuis
 2012-04-16 17:43:02 +00:00
Andy Polyakov
94c666479d Minor compatibility fixes [from HEAD]. 
PR: 2790
Submitted by: Alexei Khlebnikov
 2012-04-16 17:35:48 +00:00
Andy Polyakov
eb8a65db16 e_aes_cbc_hmac_sha1.c: handle zero-length payload and engage empty frag 
countermeasure [from HEAD].

PR: 2778
 2012-04-15 14:23:26 +00:00
Andy Polyakov
e6255a7d1e s390x asm pack: fix typos. 2012-04-12 06:46:49 +00:00
Dr. Stephen Henson
65331f225a oops, macro not present in OpenSSL 1.0.2 2012-04-11 15:10:48 +00:00
Dr. Stephen Henson
64e8dc7981 fix reset fix 2012-04-11 15:05:33 +00:00
Dr. Stephen Henson
737fe7ea29 make reinitialisation work for CMAC 2012-04-11 12:26:27 +00:00
Andy Polyakov
bc0f56d6d7 aes-s390x.pl: fix crash in AES_set_decrypt_key in linux32-s390x build [from HEAD]. 2012-04-09 15:12:30 +00:00
Dr. Stephen Henson
c3cb069108 transparently handle X9.42 DH parameters 
(backport from HEAD)
 2012-04-07 20:42:44 +00:00
Dr. Stephen Henson
491734eb21 Initial experimental support for X9.42 DH parameter format to handle 
RFC5114 parameters and X9.42 DH public and private keys.
(backport from HEAD)
 2012-04-07 20:22:11 +00:00
Dr. Stephen Henson
4e891a191d branches: 1.2.2; 
Correct some parameter values.
(backport from HEAD)
 2012-04-07 17:41:51 +00:00
Dr. Stephen Henson
b73a69a9c2 Update DH_check() to peform sensible checks when q parameter is present. 
(backport from HEAD)
 2012-04-07 17:40:08 +00:00
Dr. Stephen Henson
e811eff5a9 Add RFC5114 DH parameters to OpenSSL. Add test data to dhtest. 
(backport from HEAD)
 2012-04-07 12:19:50 +00:00
Dr. Stephen Henson
a068a1d0e3 Add new APIs EC_curve_nist2nid and EC_curve_nid2nist which convert 
between NIDs and the more common NIST names such as "P-256". Enhance
ecparam utility and ECC method to recognise the NIST names for curves.
(backport from HEAD)
 2012-04-06 17:35:01 +00:00
Dr. Stephen Henson
0cb9dbed4e Backport: allow key agreement in SSL/TLS certificates (from HEAD) 2012-04-06 11:36:35 +00:00
Andy Polyakov
8cd2ea552e aes-armv4.pl: make it more foolproof [inspired by aes-s390x.pl in 1.0.1]. 2012-04-05 08:32:08 +00:00
Andy Polyakov
3f0becbf75 aes-s390x.pl: fix endless loop in linux32-s390x build [from 1.0.1]. 2012-04-05 08:17:47 +00:00
Andy Polyakov
7b087bf4a9 modes_lcl.h: make it work on i386 [from HEAD]. 
PR: 2780
 2012-03-31 17:03:43 +00:00
Andy Polyakov
9df9c9d102 vpaes-x86[_64].pl: handle zero length in vpaes_cbc_encrypt [from HEAD]. 
PR: 2775
 2012-03-31 16:55:34 +00:00
Andy Polyakov
265863c6a4 bn/bn_gf2m.c: make new BN_GF2m_mod_inv work with BN_DEBUG_RAND [from HEAD]. 2012-03-30 17:41:00 +00:00
Andy Polyakov
2fee1e0666 ans1/tasn_prn.c: avoid bool in variable names [from HEAD]. 
PR: 2776
 2012-03-29 19:11:59 +00:00
Andy Polyakov
b4ff166cbc perlasm/x86masm.pl: fix last fix [from HEAD]. 2012-03-29 19:11:08 +00:00
Dr. Stephen Henson
861a0722c2 fix leak 2012-03-22 16:28:21 +00:00
Dr. Stephen Henson
b1cef8d984 Submitted by: Markus Friedl <mfriedl@gmail.com> 
Fix memory leaks in 'goto err' cases.
 2012-03-22 15:43:28 +00:00
Dr. Stephen Henson
b911523977 set version to 1.0.2-dev 2012-03-22 15:29:21 +00:00
Andy Polyakov
d68d160cb7 bsaes-x86_64.pl: optimize key conversion [from HEAD]. 2012-03-16 21:45:51 +00:00
Dr. Stephen Henson
f3dcae15ac prepare for 1.0.1 release 2012-03-14 12:04:40 +00:00
Andy Polyakov
bcf9cf89e7 x86_64-xlate.pl: remove old kludge. 
PR: 2435,2440
 2012-03-13 19:19:31 +00:00
Dr. Stephen Henson
f0729fc3e0 corrected fix to PR#2711 and also cover mime_param_cmp 2012-03-12 16:29:47 +00:00
Dr. Stephen Henson
8186c00ef3 Fix for CMS/PKCS7 MMA. If RSA decryption fails use a random key and 
continue with symmetric decryption process to avoid leaking timing
information to an attacker.

Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering
this issue. (CVE-2012-0884)
 2012-03-12 16:27:50 +00:00
Dr. Stephen Henson
66fdb1c0d4 check return value of BIO_write in PKCS7_decrypt 2012-03-08 14:02:51 +00:00
Dr. Stephen Henson
25bfdca16a PR: 2755 
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Reduce MTU after failed transmissions.
 2012-03-06 13:47:27 +00:00
Richard Levitte
70505bc334 For OpenVMS, use inttypes.h instead of stdint.h 2012-03-01 21:29:16 +00:00