wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
10487 commits 20 branches 302 tags 153 MiB
Commit graph

10487 commits

This branch
This branch
All branches
Author SHA1 Message Date
Dr. Stephen Henson
aa59369b4c Fix null pointer errors. 
PR#3394
(cherry picked from commit 7a9d59c148)
 2014-06-10 14:48:07 +01:00
Dr. Stephen Henson
18c7f2fce8 SRP ciphersuite correction. 
SRP ciphersuites do not have no authentication. They have authentication
based on SRP. Add new SRP authentication flag and cipher string.
(cherry picked from commit a86b88acc373ac1fb0ca709a5fb8a8fa74683f67)
 2014-06-09 12:09:49 +01:00
Dr. Stephen Henson
6a8d6f039a Update strength_bits for 3DES. 
Fix strength_bits to 112 for 3DES.
(cherry picked from commit 837c203719205ab19b5609b2df7151be8df05687)
 2014-06-09 12:09:49 +01:00
Kurt Roeckx
5ff9c21f72 Link heartbeat_test with the static version of the libraries 
It's using an internal API that that might not be available in the shared
library.
 2014-06-09 00:13:06 +01:00
Jakub Wilk
5c52c04650 Create ~/.rnd with mode 0600 instead of 0666 
Because of a missing include <fcntl.h> we don't have O_CREATE and don't create
the file with open() using mode 0600 but fall back to using fopen() with the
default umask followed by a chmod().

Problem found by Jakub Wilk <jwilk@debian.org>.
 2014-06-08 21:25:43 +01:00
Dr. Stephen Henson
6c86bf7a1e update NEWS 2014-06-07 18:19:03 +01:00
Dr. Stephen Henson
0d4d2e02eb Make tls_session_secret_cb work with CVE-2014-0224 fix. 
If application uses tls_session_secret_cb for session resumption
set the CCS_OK flag.
(cherry picked from commit 953c592572e8811b7956cc09fbd8e98037068b58)
 2014-06-07 15:27:21 +01:00
Matt Caswell
151399a944 Fixed minor duplication in docs 2014-06-07 12:32:00 +01:00
Dr. Stephen Henson
049615e35d Prepare for 1.0.1i-dev 2014-06-05 10:45:50 +01:00
Dr. Stephen Henson
6b72417a00 Prepare for 1.0.1h release 2014-06-05 10:45:00 +01:00
Dr. Stephen Henson
aabbe99fcb Update CHANGES and NEWS 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
8011cd56e3 Fix CVE-2014-3470 
Check session_cert is not NULL before dereferencing it.
 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
d3152655d5 Fix CVE-2014-0221 
Unnecessary recursion when receiving a DTLS hello request can be used to
crash a DTLS client. Fixed by handling DTLS hello request without recursion.

Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
006cd7083f Additional CVE-2014-0224 protection. 
Return a fatal error if an attempt is made to use a zero length
master secret.
 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
bc8923b1ec Fix for CVE-2014-0224 
Only accept change cipher spec when it is expected instead of at any
time. This prevents premature setting of session keys before the master
secret is determined which an attacker could use as a MITM attack.

Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for reporting this issue
and providing the initial fix this patch is based on.
 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
1632ef7448 Fix for CVE-2014-0195 
A buffer overrun attack can be triggered by sending invalid DTLS fragments
to an OpenSSL DTLS client or server. This is potentially exploitable to
run arbitrary code on a vulnerable client or server.

Fixed by adding consistency check for DTLS fragments.

Thanks to Jüri Aedla for reporting this issue.
 2014-06-05 09:04:27 +01:00
Dr. Stephen Henson
f1f4fbde2a make update 2014-06-05 09:02:03 +01:00
Libor Krystek
1854c48005 Corrected OPENSSL_NO_EC_NISTP_64_GCC_128 usage in ec_lcl.h. PR#3370 2014-06-03 23:19:21 +01:00
David Benjamin
ebda73f867 Check there is enough room for extension. 
(cherry picked from commit 7d89b3bf42e4b4067371ab33ef7631434e41d1e4)
 2014-06-02 19:00:02 +01:00
zhu qun-ying
bcc311668e Free up s->d1->buffered_app_data.q properly. 
PR#3286
(cherry picked from commit 71e95000afb2227fe5cac1c79ae884338bcd8d0b)
 2014-06-02 14:40:18 +01:00
Sami Farin
1dd26414df Typo: set i to -1 before goto. 
PR#3302
(cherry picked from commit 9717f01951f976f76dd40a38d9fc7307057fa4c4)
 2014-06-02 14:22:06 +01:00
Matt Caswell
056389eb1c Added SSLErr call for internal error in dtls1_buffer_record 2014-06-01 21:38:01 +01:00
David Ramos
a07856a08d Delays the queue insertion until after the ssl3_setup_buffers() call due to use-after-free bug. PR#3362 2014-06-01 21:37:47 +01:00
Dr. Stephen Henson
19ce768c6b Recognise padding extension. 
(cherry picked from commit ea2bb861f0daaa20819bf9ac8c146f7593feacd4)

Conflicts:

	apps/s_cb.c
(cherry picked from commit 14dc83ca779e91a267701a1fb05b2bbcf2cb63c4)
 2014-06-01 16:50:37 +01:00
Dr. Stephen Henson
aaed77c55e Option to disable padding extension. 
Add TLS padding extension to SSL_OP_ALL so it is used with other
"bugs" options and can be turned off.

This replaces SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG which is an ancient
option referring to SSLv2 and SSLREF.

PR#3336
 2014-06-01 16:50:37 +01:00
Dr. Stephen Henson
49270d0431 Set default global mask to UTF8 only. 
(cherry picked from commit 3009244da4)
 2014-06-01 15:04:29 +01:00
David Ramos
673c42b238 Allocate extra space when NETSCAPE_HANG_BUG defined. 
Make sure there is an extra 4 bytes for server done message when
NETSCAPE_HANG_BUG is defined.

PR#3361
 2014-06-01 14:30:10 +01:00
David Ramos
5541b18ba8 Initialise alg. 
PR#3313
(cherry picked from commit 7e2c6f7eb0)
 2014-06-01 13:05:20 +01:00
Dr. Stephen Henson
28e117f49f Use correct digest when exporting keying material. 
PR#3319
(cherry picked from commit 84691390eae86befd33c83721dacedb539ae34e6)
 2014-05-31 13:43:01 +01:00
Dr. Stephen Henson
46bfc05480 Don't compile heartbeat test code on Windows (for now). 
(cherry picked from commit 2c575907d2c8601a18716f718ce309ed4e1f1783)
 2014-05-31 13:43:01 +01:00
Hubert Kario
427a37ca3f add description of -attime to man page 
the verify app man page didn't describe the usage of attime option
even though it was listed as a valid option in the -help message.

This patch fixes this omission.
 2014-05-30 23:33:10 +01:00
Hubert Kario
39ae3b338f add description of -no_ecdhe option to s_server man page 
While the -help message references this option, the man page
doesn't mention the -no_ecdhe option.
This patch fixes this omission.
 2014-05-30 23:32:54 +01:00
Dr. Stephen Henson
48f5b3efce Set version number correctly. 
PR#3249
(cherry picked from commit 8909bf20269035d295743fca559207ef2eb84eb3)
 2014-05-29 14:12:14 +01:00
František Bořánek
f8dc000699 Fix memory leak. 
PR#3278
(cherry picked from commit de56fe797081fc09ebd1add06d6e2df42a324fd5)
 2014-05-29 14:12:14 +01:00
Martin Kaiser
bf8d6f9ab8 remove duplicate 0x for default RSASSA-PSS salt len 
(cherry picked from commit 3820fec3a09faecba7fe9912aa20ef7fcda8337b)
 2014-05-29 14:12:14 +01:00
Peter Mosmans
17e844a450 Fix for test_bn regular expression to work on Windows using MSYS. PR#3346 2014-05-27 23:26:11 +01:00
Matt Caswell
8ca7d12430 Fixed Windows compilation failure 2014-05-27 00:26:55 +01:00
Matt Caswell
67b9c82ea2 Fixed error in args for SSL_set_msg_callback and SSL_set_msg_callback_arg 2014-05-25 23:48:15 +01:00
Matt Caswell
a6f5b991eb Fix for non compilation with TLS_DEBUG defined 2014-05-24 23:56:58 +01:00
Mike Bland
756587dcb9 Fix heartbeat_test for -DOPENSSL_NO_HEARTBEATS 
Replaces the entire test with a trivial implementation when
OPENSSL_NO_HEARTBEATS is defined.
 2014-05-22 22:05:26 +01:00
Matt Caswell
0a084f7b3a Fixed minor copy&paste error, and stray space causing rendering problem 2014-05-22 00:12:14 +01:00
Dr. Stephen Henson
da0a95b23a Fix for PKCS12_create if no-rc2 specified. 
Use triple DES for certificate encryption if no-rc2 is
specified.

PR#3357
(cherry picked from commit 4689c08453e95eeefcc88c9f32dc6e509f95caff)
 2014-05-21 11:14:33 +01:00
Dr. Stephen Henson
599fe418a1 Change default cipher in smime app to des3. 
PR#3357
(cherry picked from commit ca3ffd9670f2b589bf8cc04923f953e06d6fbc58)
 2014-05-21 11:14:33 +01:00
Dr. Stephen Henson
4519e7b839 For portability use BUF_strndup instead of strndup. 
(cherry picked from commit dcca7b13e9)
 2014-05-20 11:23:23 +01:00
Janpopan
4659b53e7d Fix a wrong parameter count ERR_add_error_data 2014-05-19 22:17:00 +01:00
Ben Laurie
dc22495d35 Merge branch 'mbland-heartbeat-test-1.0.1' into OpenSSL_1_0_1-stable 2014-05-19 18:26:04 +01:00
Mike Bland
ab0d964259 Unit/regression test for TLS heartbeats. 
Regression test against CVE-2014-0160 (Heartbleed).

More info: http://mike-bland.com/tags/heartbleed.html

(based on commit 35cb55988b75573105eefd00d27d0138eebe40b1)
 2014-05-19 18:23:24 +01:00
Ben Laurie
dac3654e2d Allow the maximum value. 2014-05-19 18:21:39 +01:00
Ben Laurie
989d87cb1a Fix signed/unsigned warning. 2014-05-19 18:20:54 +01:00
Matt Caswell
d6934a02b5 Moved note about lack of support for AEAD modes out of BUGS section to SUPPORTED CIPHERS section (bug has been fixed, but still no support for AEAD) 2014-05-15 21:17:19 +01:00