wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
8672 commits 20 branches 302 tags 153 MiB
Commit graph

8672 commits

This branch
This branch
All branches
Author SHA1 Message Date
Dr. Stephen Henson
00e86a74bd ASN1 sanity check. 
Primitive encodings shouldn't use indefinite length constructed
form.

PR#2438 (partial).
(cherry picked from commit 398e99fe5e)
 2014-07-02 01:01:55 +01:00
Dr. Stephen Henson
9e6857a358 Fix memory leak. 
PR#2531.
(cherry picked from commit 59899c4d1b)
 2014-06-29 13:54:21 +01:00
Ken Ballou
715258486c Typo. 
PR#3173
(cherry picked from commit 76ed5a42ea)
 2014-06-29 13:39:32 +01:00
Dr. Stephen Henson
2daec41e25 Show errors on CSR verification failure. 
If CSR verify fails in ca utility print out error messages.
Otherwise some errors give misleading output: for example
if the key size exceeds the library limit.

PR#2875
(cherry picked from commit a30bdb55d1)
 2014-06-29 13:35:18 +01:00
Dr. Stephen Henson
8519635923 Typo. 
PR#3107
(cherry picked from commit 7c206db928)
 2014-06-28 12:43:50 +01:00
Dr. Stephen Henson
d0bdfdd830 Don't disable state strings with no-ssl2 
Some state strings were erronously not compiled when no-ssl2
was set.

PR#3295
(cherry picked from commit 0518a3e19e)
 2014-06-28 00:57:18 +01:00
Andreas Westfeld
4b98488eb0 Fix typo in ideatest.c 
(cherry picked from commit d1d4382dcb)
 2014-06-28 00:07:02 +01:00
Ken Ballou
0e2458e187 Remove redundant check. 
PR#3174
(cherry picked from commit fd331c0bb9b557903dd2ce88398570a3327b5ef0)
 2014-06-27 23:18:40 +01:00
Tom Greenslade
326de18955 Handle IPv6 addresses in OCSP_parse_url. 
PR#2783
(cherry picked from commit b36f35cda9)
 2014-06-27 17:31:55 +01:00
Tomas Mraz
1fcfd61ee7 Don't advertise ECC ciphersuits in SSLv2 compatible client hello. 
PR#3374
(cherry picked from commit 0436369fcc)
 2014-06-27 16:52:15 +01:00
Jeffrey Walton
121f386ec7 Clarify docs. 
Document that the certificate passed to SSL_CTX_add_extra_chain_cert()
should not be freed by the application.

PR#3409

Add restrictions section present in other branches.

(cherry picked from commit 86cac6d3b2)
 2014-06-27 16:44:14 +01:00
Dr. Stephen Henson
9fb10cfe6b Memory leak and NULL dereference fixes. 
PR#3403
(cherry picked from commit d2aea03829)

Conflicts:

	apps/crl2p7.c
	crypto/asn1/a_utctm.c
	crypto/asn1/ameth_lib.c
	crypto/asn1/bio_asn1.c
 2014-06-27 15:33:18 +01:00
Dr. Stephen Henson
a20a6366c8 Remove ancient obsolete files under pkcs7. 
(cherry picked from commit 7be6b27aaf)
 2014-06-27 14:04:35 +01:00
Huzaifa Sidhpurwala
54985b5061 Make sure BN_sqr can never return a negative value. 
PR#3410
(cherry picked from commit e14e764c0d5d469da63d0819c6ffc0e1e9e7f0bb)
 2014-06-26 23:52:18 +01:00
Miod Vallat
b09db677d5 Fix off-by-one errors in ssl_cipher_get_evp() 
In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

    Bug discovered and fixed by Miod Vallat from the OpenBSD team.

    PR#3375
 2014-06-22 23:26:33 +01:00
Matt Caswell
cdc596567d Revert " Fix off-by-one errors in ssl_cipher_get_evp()" 
This reverts commit def1490717.

Incorrect attribution
 2014-06-22 23:24:52 +01:00
Dr. Stephen Henson
70d923fb03 Accept CCS after sending finished. 
Allow CCS after finished has been sent by client: at this point
keys have been correctly set up so it is OK to accept CCS from
server. Without this renegotiation can sometimes fail.

PR#3400
(cherry picked from commit 99cd6a91fcb0931feaebbb4832681d40a66fad41)
 2014-06-14 22:26:56 +01:00
Kurt Cancemi
def1490717 Fix off-by-one errors in ssl_cipher_get_evp() 
In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

    PR#3375
 2014-06-12 21:25:07 +01:00
Ben Laurie
7697d9b587 Allow the maximum value. 
(Backported as a result of PR#3377 reported by Rainer Jung <rainer.jung@kippdata.de>)
 2014-06-12 20:52:30 +01:00
Dr. Stephen Henson
0345354fe0 Fix null pointer errors. 
PR#3394
(cherry picked from commit 7a9d59c148)
 2014-06-10 14:48:19 +01:00
Dr. Stephen Henson
90aef4431b Clarify NEWS. 2014-06-09 09:40:25 +01:00
Dr. Stephen Henson
602689074a Use correct wording for website scripts. 2014-06-06 13:26:31 +01:00
Dr. Stephen Henson
810d2c7f6e Add two known issues to NEWS. 2014-06-06 12:31:13 +01:00
Dr. Stephen Henson
0a9b8dd1b4 Fix 0.9.8 FIPS capable OpenSSL build. 
The object file bn_lib.o is excluded from FIPS builds which causes
a linker error for BN_consttime_swap. So move definition from bn_lib.c
to bn_gf2m.c

This change is *only* needed for OpenSSL 0.9.8 which uses the 1.2
FIPS module.
 2014-06-06 12:31:13 +01:00
Matt Caswell
bfce4e5d6e Fixed Windows compilation failure 2014-06-05 20:27:14 +01:00
Dr. Stephen Henson
4a1190beca Prepare for 0.9.8zb-dev 2014-06-05 10:40:11 +01:00
Dr. Stephen Henson
047ec5d196 Prepare for 0.9.8za release 2014-06-05 10:38:57 +01:00
Dr. Stephen Henson
bb59889305 Update CHANGES and NEWS 2014-06-05 09:08:27 +01:00
Dr. Stephen Henson
141a5482fd Fix CVE-2014-3470 
Check session_cert is not NULL before dereferencing it.
 2014-06-03 16:30:23 +01:00
Dr. Stephen Henson
de2422affb Fix CVE-2014-0221 
Unnecessary recursion when receiving a DTLS hello request can be used to
crash a DTLS client. Fixed by handling DTLS hello request without recursion.

Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
 2014-06-03 16:30:23 +01:00
Dr. Stephen Henson
897169fdf0 Additional CVE-2014-0224 protection. 
Return a fatal error if an attempt is made to use a zero length
master secret.
 2014-06-03 16:30:23 +01:00
Dr. Stephen Henson
410a49a4fa Fix for CVE-2014-0224 
Only accept change cipher spec when it is expected instead of at any
time. This prevents premature setting of session keys before the master
secret is determined which an attacker could use as a MITM attack.

Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for reporting this issue
and providing the initial fix this patch is based on.
 2014-06-03 16:30:23 +01:00
Dr. Stephen Henson
82ba68c42d Fix for CVE-2014-0195 
A buffer overrun attack can be triggered by sending invalid DTLS fragments
to an OpenSSL DTLS client or server. This is potentially exploitable to
run arbitrary code on a vulnerable client or server.

Fixed by adding consistency check for DTLS fragments.

Thanks to Jüri Aedla for reporting this issue.
 2014-06-03 16:30:23 +01:00
zhu qun-ying
4b258e73ae Free up s->d1->buffered_app_data.q properly. 
PR#3286
(cherry picked from commit 71e95000afb2227fe5cac1c79ae884338bcd8d0b)
 2014-06-02 14:40:45 +01:00
Andy Polyakov
6ac2f67882 ecdsa.pod: typo. 
PR: 2678
Submitted by: Annie Yousar
(cherry picked from commit d572544a2c)
 2014-06-02 13:59:53 +01:00
Sami Farin
bea1d1cbd8 Typo: set i to -1 before goto. 
PR#3302
(cherry picked from commit 9717f01951f976f76dd40a38d9fc7307057fa4c4)
 2014-06-02 12:28:50 +01:00
Dr. Stephen Henson
61e6e80fe5 Set default global mask to UTF8 only. 
(cherry picked from commit 3009244da4)
 2014-06-01 15:04:49 +01:00
David Ramos
2ce540743e Allocate extra space when NETSCAPE_HANG_BUG defined. 
Make sure there is an extra 4 bytes for server done message when
NETSCAPE_HANG_BUG is defined.

PR#3361
(cherry picked from commit 673c42b238)
 2014-06-01 14:31:57 +01:00
Ben Laurie
8e928aab02 Fix signed/unsigned warning. 
(cherry picked from commit 989d87cb1a)
 2014-05-29 14:16:21 +01:00
Dr. Stephen Henson
105e52bf23 Set version number correctly. 
PR#3249
(cherry picked from commit 8909bf20269035d295743fca559207ef2eb84eb3)
 2014-05-29 14:12:11 +01:00
František Bořánek
492a5010a4 Fix memory leak. 
PR#3278
(cherry picked from commit de56fe797081fc09ebd1add06d6e2df42a324fd5)
 2014-05-29 14:12:11 +01:00
Peter Mosmans
53b0b0a330 Fix for test_bn regular expression to work on Windows using MSYS. PR#3346 2014-05-27 23:30:17 +01:00
Matt Caswell
677c117419 Fixed error in args for SSL_set_msg_callback and SSL_set_msg_callback_arg 2014-05-25 23:48:57 +01:00
Matt Caswell
bb50d30f35 Fix for non compilation with TLS_DEBUG defined 2014-05-25 00:02:38 +01:00
Dr. Stephen Henson
8323996d99 Fix for PKCS12_create if no-rc2 specified. 
Use triple DES for certificate encryption if no-rc2 is
specified.

PR#3357
(cherry picked from commit 03b5b78c09)
 2014-05-21 11:30:34 +01:00
Dr. Stephen Henson
ee14e33c35 Change default cipher in smime app to des3. 
PR#3357
(cherry picked from commit ca3ffd9670f2b589bf8cc04923f953e06d6fbc58)

Conflicts:

	doc/apps/smime.pod
 2014-05-21 11:21:12 +01:00
Matt Caswell
1bcb94a721 Removed note in BUGS section about AEAD ciphers - inadvertently added to wrong branch 2014-05-15 21:24:07 +01:00
Jeffrey Walton
9658c634a2 Fix grammar error in verify pod. PR#3355 2014-05-14 23:00:57 +01:00
Jeffrey Walton
7ee8b27267 Add information to BUGS section of enc documentation. PR#3354 2014-05-14 23:00:57 +01:00
Michal Bozon
e4ea6f0c76 Corrected POD syntax errors. PR#3353 2014-05-14 23:00:56 +01:00