wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
8643 commits 20 branches 302 tags 153 MiB
Commit graph

8643 commits

This branch
This branch
All branches
Author SHA1 Message Date
Dr. Stephen Henson
c2014ae252 Clarify -Verify and PSK. 
PR#3452
(cherry picked from commit ca2015a617)
 2014-07-15 20:24:55 +01:00
Dr. Stephen Henson
c3d317b4de Fix DTLS certificate requesting code. 
Use same logic when determining when to expect a client
certificate for both TLS and DTLS.

PR#3452
(cherry picked from commit c8d710dc5f)
 2014-07-15 18:24:14 +01:00
Dr. Stephen Henson
a214feb26b Don't allow -www etc options with DTLS. 
The options which emulate a web server don't make sense when doing DTLS.
Exit with an error if an attempt is made to use them.

PR#3453
(cherry picked from commit 58a2aaeade8bdecd0f9f0df41927f7cff3012547)
 2014-07-15 12:27:29 +01:00
Dr. Stephen Henson
7a3a82dbbd Use case insensitive compare for servername. 
PR#3445
(cherry picked from commit 1c3e9a7c67)
 2014-07-15 00:00:39 +01:00
Matt Caswell
02fef91630 Fixed valgrind complaint due to BN_consttime_swap reading uninitialised data. 
This is actually ok for this function, but initialised to zero anyway if
PURIFY defined.

This does have the impact of masking any *real* unitialised data reads in bn though.

Patch based on approach suggested by Rich Salz.

PR#3415

(cherry picked from commit 77747e2d9a5573b1dbc15e247ce18c03374c760c)
 2014-07-13 22:36:03 +01:00
Richard Levitte
0b8cd5acd6 * crypto/ui/ui_lib.c: misplaced brace in switch statement. 
Detected by dcruette@qualitesys.com

(cherry picked from commit 8b5dd34091)
 2014-07-13 19:17:21 +02:00
Matt Caswell
97f4e235a1 Fix memory leak in BIO_free if there is no destroy function. 
Based on an original patch by Neitrino Photonov <neitrinoph@gmail.com>

PR#3439

(cherry picked from commit 66816c53be)
 2014-07-09 23:38:23 +01:00
David Lloyd
cfd2aeeb7c Prevent infinite loop loading config files. 
PR#2985
(cherry picked from commit 9d23f422a3)
 2014-07-07 13:51:07 +01:00
Dr. Stephen Henson
a0fdc4c6d6 Fix ECC SSLv2 exclusion on OpenSSL 0.9.8. 2014-07-07 13:00:07 +01:00
Dr. Stephen Henson
b5def0243e Update ticket callback docs. 
(cherry picked from commit a23a6e85d8)
 2014-07-06 12:43:22 +01:00
Matt Caswell
357f6d8add Fixes for newer versions of pod2man 2014-07-06 00:05:29 +01:00
Matt Caswell
19a71e8c16 Fixed error in pod files with latest versions of pod2man 
(cherry picked from commit 07255f0a76d9d349d915e14f969b9ff2ee0d1953)
 2014-07-06 00:05:29 +01:00
Alan Hryngle
7faa66433f Return smaller of ret and f. 
PR#3418.
(cherry picked from commit fdea4fff8f)
 2014-07-05 22:39:16 +01:00
Dr. Stephen Henson
1a0498769f Don't limit message sizes in ssl3_get_cert_verify. 
PR#319 (reoponed version).
(cherry picked from commit 7f6e957864)

Conflicts:

	ssl/s3_srvr.c
 2014-07-05 13:32:40 +01:00
Dr. Stephen Henson
a4dde82423 More doc fixes. 2014-07-03 21:31:51 +01:00
Rich Salz
eba0aa995d More bugfixes from the doc-fix merge; errors found by DrH, thanks. 2014-07-03 16:17:54 -04:00
Rich Salz
c9e6fffa53 Fix errors with last cherry-pick; SSL_CONF_* and s_client 
-verify_return_error aren't in this release.
 2014-07-03 14:31:04 -04:00
Rich Salz
85dcce7c63 Merge branch 'rsalz-docfixes' 
(cherry picked from commit b5071dc2f6)

Conflicts:

	doc/apps/s_client.pod
	doc/apps/verify.pod
	doc/apps/x509v3_config.pod
	doc/crypto/ASN1_generate_nconf.pod
	doc/ssl/SSL_CONF_CTX_set_ssl_ctx.pod
	doc/ssl/SSL_CONF_cmd.pod
	doc/ssl/SSL_CONF_cmd_argv.pod
	doc/ssl/SSL_CTX_set_cert_cb.pod
	doc/ssl/SSL_CTX_set_security_level.pod
 2014-07-03 12:35:40 -04:00
Rich Salz
2ed29615cb Close 3170, remove reference to Ariel Glenn's old 0.9.8 doc 
(cherry picked from commit f1112985e8)
 2014-07-03 12:28:54 -04:00
Matt Smart
d7080d624b Fix doc typo. 
ERR_get_error(3) references the non-existent
ERR_get_last_error_line_data instead of the one that does exist,
ERR_peek_last_error_line_data.

PR#3283
(cherry picked from commit 5cc99c6cf5)
 2014-07-02 03:45:21 +01:00
Geoff Thorpe
5d7c8a48db util/mkerr.pl: fix perl warning 
Gets rid of this;

defined(@array) is deprecated at ../util/mkerr.pl line 792.
        (Maybe you should just omit the defined()?)
defined(@array) is deprecated at ../util/mkerr.pl line 800.
        (Maybe you should just omit the defined()?)

Signed-off-by: Geoff Thorpe <geoff@openssl.org>
(cherry picked from commit 647f360e2e)
 2014-07-02 01:51:04 +01:00
Dr. Stephen Henson
00e86a74bd ASN1 sanity check. 
Primitive encodings shouldn't use indefinite length constructed
form.

PR#2438 (partial).
(cherry picked from commit 398e99fe5e)
 2014-07-02 01:01:55 +01:00
Dr. Stephen Henson
9e6857a358 Fix memory leak. 
PR#2531.
(cherry picked from commit 59899c4d1b)
 2014-06-29 13:54:21 +01:00
Ken Ballou
715258486c Typo. 
PR#3173
(cherry picked from commit 76ed5a42ea)
 2014-06-29 13:39:32 +01:00
Dr. Stephen Henson
2daec41e25 Show errors on CSR verification failure. 
If CSR verify fails in ca utility print out error messages.
Otherwise some errors give misleading output: for example
if the key size exceeds the library limit.

PR#2875
(cherry picked from commit a30bdb55d1)
 2014-06-29 13:35:18 +01:00
Dr. Stephen Henson
8519635923 Typo. 
PR#3107
(cherry picked from commit 7c206db928)
 2014-06-28 12:43:50 +01:00
Dr. Stephen Henson
d0bdfdd830 Don't disable state strings with no-ssl2 
Some state strings were erronously not compiled when no-ssl2
was set.

PR#3295
(cherry picked from commit 0518a3e19e)
 2014-06-28 00:57:18 +01:00
Andreas Westfeld
4b98488eb0 Fix typo in ideatest.c 
(cherry picked from commit d1d4382dcb)
 2014-06-28 00:07:02 +01:00
Ken Ballou
0e2458e187 Remove redundant check. 
PR#3174
(cherry picked from commit fd331c0bb9b557903dd2ce88398570a3327b5ef0)
 2014-06-27 23:18:40 +01:00
Tom Greenslade
326de18955 Handle IPv6 addresses in OCSP_parse_url. 
PR#2783
(cherry picked from commit b36f35cda9)
 2014-06-27 17:31:55 +01:00
Tomas Mraz
1fcfd61ee7 Don't advertise ECC ciphersuits in SSLv2 compatible client hello. 
PR#3374
(cherry picked from commit 0436369fcc)
 2014-06-27 16:52:15 +01:00
Jeffrey Walton
121f386ec7 Clarify docs. 
Document that the certificate passed to SSL_CTX_add_extra_chain_cert()
should not be freed by the application.

PR#3409

Add restrictions section present in other branches.

(cherry picked from commit 86cac6d3b2)
 2014-06-27 16:44:14 +01:00
Dr. Stephen Henson
9fb10cfe6b Memory leak and NULL dereference fixes. 
PR#3403
(cherry picked from commit d2aea03829)

Conflicts:

	apps/crl2p7.c
	crypto/asn1/a_utctm.c
	crypto/asn1/ameth_lib.c
	crypto/asn1/bio_asn1.c
 2014-06-27 15:33:18 +01:00
Dr. Stephen Henson
a20a6366c8 Remove ancient obsolete files under pkcs7. 
(cherry picked from commit 7be6b27aaf)
 2014-06-27 14:04:35 +01:00
Huzaifa Sidhpurwala
54985b5061 Make sure BN_sqr can never return a negative value. 
PR#3410
(cherry picked from commit e14e764c0d5d469da63d0819c6ffc0e1e9e7f0bb)
 2014-06-26 23:52:18 +01:00
Miod Vallat
b09db677d5 Fix off-by-one errors in ssl_cipher_get_evp() 
In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

    Bug discovered and fixed by Miod Vallat from the OpenBSD team.

    PR#3375
 2014-06-22 23:26:33 +01:00
Matt Caswell
cdc596567d Revert " Fix off-by-one errors in ssl_cipher_get_evp()" 
This reverts commit def1490717.

Incorrect attribution
 2014-06-22 23:24:52 +01:00
Dr. Stephen Henson
70d923fb03 Accept CCS after sending finished. 
Allow CCS after finished has been sent by client: at this point
keys have been correctly set up so it is OK to accept CCS from
server. Without this renegotiation can sometimes fail.

PR#3400
(cherry picked from commit 99cd6a91fcb0931feaebbb4832681d40a66fad41)
 2014-06-14 22:26:56 +01:00
Kurt Cancemi
def1490717 Fix off-by-one errors in ssl_cipher_get_evp() 
In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

    PR#3375
 2014-06-12 21:25:07 +01:00
Ben Laurie
7697d9b587 Allow the maximum value. 
(Backported as a result of PR#3377 reported by Rainer Jung <rainer.jung@kippdata.de>)
 2014-06-12 20:52:30 +01:00
Dr. Stephen Henson
0345354fe0 Fix null pointer errors. 
PR#3394
(cherry picked from commit 7a9d59c148)
 2014-06-10 14:48:19 +01:00
Dr. Stephen Henson
90aef4431b Clarify NEWS. 2014-06-09 09:40:25 +01:00
Dr. Stephen Henson
602689074a Use correct wording for website scripts. 2014-06-06 13:26:31 +01:00
Dr. Stephen Henson
810d2c7f6e Add two known issues to NEWS. 2014-06-06 12:31:13 +01:00
Dr. Stephen Henson
0a9b8dd1b4 Fix 0.9.8 FIPS capable OpenSSL build. 
The object file bn_lib.o is excluded from FIPS builds which causes
a linker error for BN_consttime_swap. So move definition from bn_lib.c
to bn_gf2m.c

This change is *only* needed for OpenSSL 0.9.8 which uses the 1.2
FIPS module.
 2014-06-06 12:31:13 +01:00
Matt Caswell
bfce4e5d6e Fixed Windows compilation failure 2014-06-05 20:27:14 +01:00
Dr. Stephen Henson
4a1190beca Prepare for 0.9.8zb-dev 2014-06-05 10:40:11 +01:00
Dr. Stephen Henson
047ec5d196 Prepare for 0.9.8za release 2014-06-05 10:38:57 +01:00
Dr. Stephen Henson
bb59889305 Update CHANGES and NEWS 2014-06-05 09:08:27 +01:00
Dr. Stephen Henson
141a5482fd Fix CVE-2014-3470 
Check session_cert is not NULL before dereferencing it.
 2014-06-03 16:30:23 +01:00