wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
10349 commits 20 branches 302 tags 153 MiB
Commit graph

10349 commits

This branch
This branch
All branches
Author SHA1 Message Date
Dr. Stephen Henson
531c6fc8f3 prepare for 1.0.1a release 2012-04-19 12:17:19 +00:00
Dr. Stephen Henson
e011d0a3c4 update NEWS 2012-04-19 12:14:28 +00:00
Dr. Stephen Henson
8d5505d099 Check for potentially exploitable overflows in asn1_d2i_read_bio 
BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
in CRYPTO_realloc_clean.

Thanks to Tavis Ormandy, Google Security Team, for discovering this
issue and to Adam Langley <agl@chromium.org> for fixing it. (CVE-2012-2110)
 2012-04-19 12:13:59 +00:00
Andy Polyakov
d36e0ee460 Makefile.org: clear yet another environment variable [from HEAD]. 
PR: 2793
 2012-04-19 06:40:36 +00:00
Dr. Stephen Henson
143619ccf6 only call FIPS_cipherinit in FIPS mode 2012-04-18 22:41:50 +00:00
Andy Polyakov
9f339d75b5 e_rc4_hmac_md5.c: update from HEAD, fixes crash on legacy Intel CPUs. 
PR: 2792
 2012-04-18 17:51:33 +00:00
Dr. Stephen Henson
28583660fb update NEWS 2012-04-18 17:30:20 +00:00
Dr. Stephen Henson
dedfe959dd correct error code 2012-04-18 14:53:48 +00:00
Bodo Möller
4d936ace08 Disable SHA-2 ciphersuites in < TLS 1.2 connections. 
(TLS 1.2 clients could end up negotiating these with an OpenSSL server
with TLS 1.2 disabled, which is problematic.)

Submitted by: Adam Langley
 2012-04-17 15:20:17 +00:00
Dr. Stephen Henson
89bd25eb26 Additional workaround for PR#2771 
If OPENSSL_MAX_TLS1_2_CIPHER_LENGTH is set then limit the size of client
ciphersuites to this value. A value of 50 should be sufficient.

Document workarounds in CHANGES.
 2012-04-17 14:41:23 +00:00
Dr. Stephen Henson
4a1cf50187 Partial workaround for PR#2771. 
Some servers hang when presented with a client hello record length exceeding
255 bytes but will work with longer client hellos if the TLS record version
in client hello does not exceed TLS v1.0. Unfortunately this doesn't fix all
cases...
 2012-04-17 13:20:19 +00:00
Andy Polyakov
32e12316e5 OPENSSL_NO_SOCK fixes [from HEAD]. 
PR: 2791
Submitted by: Ben Noordhuis
 2012-04-16 17:43:15 +00:00
Andy Polyakov
ad7b24f145 Minor compatibility fixes [from HEAD]. 
PR: 2790
Submitted by: Alexei Khlebnikov
 2012-04-16 17:36:12 +00:00
Andy Polyakov
c2770c0e0e s3_srvr.c: fix typo [from HEAD]. 
PR: 2538
 2012-04-15 17:23:41 +00:00
Andy Polyakov
371056f2b9 e_aes_cbc_hmac_sha1.c: handle zero-length payload and engage empty frag 
countermeasure [from HEAD].

PR: 2778
 2012-04-15 14:23:03 +00:00
Andy Polyakov
2d613908e8 s390x asm pack: fix typos. 2012-04-12 06:47:01 +00:00
Dr. Stephen Henson
18fb1fae08 oops, macro not present in OpenSSL 1.0.2 2012-04-11 15:11:16 +00:00
Dr. Stephen Henson
39ef161c72 fix reset fix 2012-04-11 15:05:45 +00:00
Dr. Stephen Henson
a7612c5066 make reinitialisation work for CMAC 2012-04-11 12:26:13 +00:00
Dr. Stephen Henson
6cbae10b5e update rather ancient EVP digest documentation 2012-04-10 22:28:22 +00:00
Andy Polyakov
ebe81134c0 aes-s390x.pl: fix crash in AES_set_decrypt_key in linux32-s390x build [from HEAD]. 2012-04-09 15:12:45 +00:00
Andy Polyakov
a1d573e282 aes-armv4.pl: make it more foolproof [inspired by aes-s390x.pl in 1.0.1]. 2012-04-05 08:31:37 +00:00
Andy Polyakov
e959e24b47 aes-s390x.pl: fix endless loop in linux32-s390x build. 2012-04-05 08:17:21 +00:00
Andy Polyakov
3f98d7c0b5 ssl/ssl_ciph.c: interim solution for assertion in d1_pkt.c(444) [from HEAD]. 
PR: 2778
 2012-04-04 20:51:27 +00:00
Andy Polyakov
d2f950c984 CHANGES: mention vpaes fix and harmonize with 1.0.0. 
PR: 2775
 2012-03-31 18:55:41 +00:00
Dr. Stephen Henson
63e8f16737 PR: 2778(part) 
Submitted by: John Fitzgibbon <john_fitzgibbon@yahoo.com>

Time is always encoded as 4 bytes, not sizeof(Time).
 2012-03-31 18:02:43 +00:00
Andy Polyakov
9bf5fd894f modes_lcl.h: make it work on i386 [from HEAD]. 
PR: 2780
 2012-03-31 17:03:54 +00:00
Andy Polyakov
6296729fae vpaes-x86[_64].pl: handle zero length in vpaes_cbc_encrypt [from HEAD]. 
PR: 2775
 2012-03-31 16:55:18 +00:00
Andy Polyakov
67d216801b util/cygwin.sh update [from HEAD]. 
PR: 2761
Submitted by: Corinna Vinschen
 2012-03-31 11:07:28 +00:00
Andy Polyakov
0a5575f3f6 bn/bn_gf2m.c: make new BN_GF2m_mod_inv work with BN_DEBUG_RAND [from HEAD]. 2012-03-30 17:40:52 +00:00
Dr. Stephen Henson
418044cbab Experimental workaround to large client hello issue (see PR#2771). 
If OPENSSL_NO_TLS1_2_CLIENT is set then TLS v1.2 is disabled for clients
only.
 2012-03-29 19:08:54 +00:00
Andy Polyakov
8c67b13407 perlasm/x86masm.pl: fix last fix [from HEAD]. 2012-03-29 18:11:21 +00:00
Andy Polyakov
2a477ccf0b ans1/tasn_prn.c: avoid bool in variable names [from HEAD]. 
PR: 2776
 2012-03-29 17:48:43 +00:00
Dr. Stephen Henson
c34137bef9 fix leak 2012-03-22 16:28:51 +00:00
Dr. Stephen Henson
914d91c5b3 Submitted by: Markus Friedl <mfriedl@gmail.com> 
Fix memory leaks in 'goto err' cases.
 2012-03-22 15:43:19 +00:00
Dr. Stephen Henson
e733dea3ce update version to 1.0.1a-dev 2012-03-22 15:18:19 +00:00
Dr. Stephen Henson
78c5d2a9bb use client version when deciding whether to send supported signature algorithms extension 2012-03-21 21:32:57 +00:00
Dr. Stephen Henson
3bf4e14cc3 Always use SSLv23_{client,server}_method in s_client.c and s_server.c, 
the old code came from SSLeay days before TLS was even supported.
 2012-03-18 18:16:05 +00:00
Andy Polyakov
d68d160cb7 bsaes-x86_64.pl: optimize key conversion [from HEAD]. 2012-03-16 21:45:51 +00:00
Dr. Stephen Henson
202cb42fbb remove trailing slash 2012-03-14 22:20:40 +00:00
Richard Levitte
49f6cb968f cipher should only be set to PSK if JPAKE is used. 2012-03-14 12:39:00 +00:00
Dr. Stephen Henson
07e120b7da update STATUS 2012-03-14 12:14:06 +00:00
Dr. Stephen Henson
f3dcae15ac prepare for 1.0.1 release 2012-03-14 12:04:40 +00:00
Dr. Stephen Henson
25ec498dc7 update NEWS 2012-03-13 22:49:27 +00:00
Andy Polyakov
9cc42cb091 ssl/t1_enc.c: pay attention to EVP_CIPH_FLAG_CUSTOM_CIPHER [from HEAD]. 2012-03-13 19:21:15 +00:00
Andy Polyakov
bcf9cf89e7 x86_64-xlate.pl: remove old kludge. 
PR: 2435,2440
 2012-03-13 19:19:31 +00:00
Dr. Stephen Henson
f0729fc3e0 corrected fix to PR#2711 and also cover mime_param_cmp 2012-03-12 16:29:47 +00:00
Dr. Stephen Henson
8186c00ef3 Fix for CMS/PKCS7 MMA. If RSA decryption fails use a random key and 
continue with symmetric decryption process to avoid leaking timing
information to an attacker.

Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering
this issue. (CVE-2012-0884)
 2012-03-12 16:27:50 +00:00
Dr. Stephen Henson
c0b31ccb87 PR: 2744 
Submitted by: Dmitry Belyavsky <beldmit@gmail.com>

CMS support for ccgost engine
 2012-03-11 13:40:05 +00:00
Dr. Stephen Henson
267c950c5f Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> 
Add more extension names in s_cb.c extension printing code.
 2012-03-09 18:37:41 +00:00