Andy Polyakov
0fe17491c3
Don't switch password formats using global state.
...
To avoid possible race conditions don't switch password format using
global state in crypto/pkcs12
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-25 11:42:33 +01:00
Matt Caswell
cc06906707
Fix an uninitialised read on an error path
...
Found by Coverity.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-25 10:11:35 +01:00
Richard Levitte
5105ba5bec
NEWS: add a number of the types that were made opaque
...
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-25 10:06:55 +02:00
Viktor Dukhovni
4a7b3a7b4d
Un-delete still documented X509_STORE_CTX_set_verify
...
It should not have been removed.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-24 20:30:45 +01:00
Andy Polyakov
3188c9509e
Configurations/10-main.conf: fix solaris64-*-cc link problems.
...
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-24 20:26:42 +01:00
Andy Polyakov
d3034d31e7
ec/asm/ecp_nistz256-x86_64.pl: /cmovb/cmovc/ as nasm doesn't recognize cmovb.
...
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 17:13:09 +02:00
Matt Caswell
efba7787cd
Clarify the error messages in 08f6ae5b28
...
Ensure it is clear to the user why there has been an error.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-24 14:49:40 +01:00
Matt Caswell
0a307450bf
Fix no-ec2m
...
The new curves test did not take into account no-ec2m
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-24 14:44:19 +01:00
Richard Levitte
1beca67688
CRYPTO_atomic_add(): check that the object is lock free
...
If not, fall back to our own code, using the given mutex
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-08-24 14:37:48 +01:00
Richard Levitte
11fc6c7611
CRYPTO_atomic_add(): use acquire release memory order rather than relaxed
...
For increments, the relaxed model is fine. For decrements, it's
recommended to use the acquire release model. We therefore go for the
latter.
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-08-24 14:37:40 +01:00
Richard Levitte
cb4b54c23b
Check for __GNUC__ to use GNU C atomic buildins
...
Note: we trust any other compiler that fully implements GNU extension
to define __GNUC__
RT#4642
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-08-24 14:37:30 +01:00
Richard Levitte
63db6b772f
Trust RSA_check_key() to return correct values
...
In apps/rsa.c, we were second guessing RSA_check_key() to leave error
codes lying around without returning -1 properly. However, this also
catches other errors that are lying around and that we should not care
about.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-24 14:31:05 +01:00
Dr. Stephen Henson
55d83bf7c1
Avoid overflow in MDC2_Update()
...
Thanks to Shi Lei for reporting this issue.
CVE-2016-6303
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 14:12:51 +01:00
Rich Salz
ef28891bab
Put DES into "not default" category.
...
Add CVE to CHANGES
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-08-24 14:05:52 +01:00
Rich Salz
d33726b92e
To avoid SWEET32 attack, move 3DES to weak
...
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-08-24 14:05:52 +01:00
Rob Percival
cfd20f64cc
Typo fixes
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
ea4b7ded52
Updates the CT_POLICY_EVAL_CTX POD
...
Ownership semantics and function names have changed.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
513a3cb16b
Correct documentation about SCT setters resetting validation status
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
e12981019a
Removes the SCT_verify* POD
...
SCT_verify_v1 has been removed and SCT_verify is no longer part of the
public API.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
a0a9f36ebf
Documents the SCT validation functions
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
76bfd2ccc3
Removes {o2i,i2o}_SCT_signature from PODs
...
These functions have been removed from the public API.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
5edcadb127
Documents the CTLOG functions
...
CTLOG_new_null() has been removed from the code, so it has also been
removed from this POD.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
0e74d7ca44
Document the i2o and o2i SCT functions
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
a8d5d13a5f
Removes d2i_SCT_LIST.pod
...
This is covered by d2i_X509.pod.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
4cfdabbb09
Document that SCT_set_source returns 0 on failure.
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
882babda46
Clarifies the format of a log's public key in the CONF file
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
4a388d1e05
Refer to OPENSSLDIR rather than "the OpenSSL install directory"
...
The prior wording was less accurate.
See https://github.com/openssl/openssl/pull/1372#discussion_r73127000 .
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
32fa3da8b1
Adds history section to CT PODs
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
e469945f2c
Fixes final issue in CT PODs highlighted by util/find-doc-nits.pl
...
Fixes complaint "ct missing from SYNOPSIS".
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
4eabbe9d59
Renames CT_POLICY_EVAL_CTX.pod to CT_POLICY_EVAL_CTX_new.pod
...
util/fix-doc-nits.pl complains that
"CT_POLICY_EVAL_CTX (filename) missing from NAME section".
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
7a2c739c00
Adds copyright section to ct.pod
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
6c3e9a71ab
Adds newline after =cut in PODs
...
util/find-doc-nits.pl complains that the file "doesn't end with =cut".
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
cb8145ff4a
Adds missing function names to NAME section of PODs
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
ae97a654ca
Add enum definitions to CT pods
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
8b12a3e75b
Remove unnecessary bold tags in CT pods
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
b4a986163c
Add comment about calling CT_POLICY_EVAL_CTX_free
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
efa00a46c5
Fix comment about what SCT_LIST_validate does.
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
0620ecdcd2
Add SSL_get0_peer_scts to ssl.pod
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
6b13bd1dc2
Fix comment about return value of ct_extract_tls_extension_scts
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Rob Percival
56f3f714ef
First draft of CT documentation
...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-24 13:58:19 +01:00
Matt Caswell
c42b8a6e4b
Remove some dead code from rec_layer_s3.c
...
It is never valid to call ssl3_read_bytes with
type == SSL3_RT_CHANGE_CIPHER_SPEC, and in fact we check for valid values
for type near the beginning of the function. Therefore this check will never
be true and can be removed.
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-08-24 11:28:58 +01:00
Matt Caswell
fe81a1b051
Remove useless assignment
...
The variable assignment c1 is never read before it is overwritten.
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-08-24 11:25:23 +01:00
Matt Caswell
08f6ae5b28
Fix some resource leaks in the apps
...
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-08-24 11:22:47 +01:00
Andy Polyakov
c74aea8d6c
ec/ecp_nistz256: harmonize is_infinity with ec_GFp_simple_is_at_infinity.
...
RT#4625
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-24 10:55:11 +01:00
Andy Polyakov
e3057a57ca
ec/ecp_nistz256: harmonize is_infinity with ec_GFp_simple_is_at_infinity.
...
RT#4625
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-24 10:55:02 +01:00
Andy Polyakov
dfde4219fd
ec/asm/ecp_nistz256-*.pl: addition to perform stricter reduction.
...
Addition was not preserving inputs' property of being fully reduced.
Thanks to Brian Smith for reporting this.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-24 10:44:56 +01:00
Andy Polyakov
b62b2454fa
ec/asm/ecp_nistz256-x86_64.pl: addition to perform stricter reduction.
...
Addition was not preserving inputs' property of being fully reduced.
Thanks to Brian Smith for reporting this.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-24 10:44:48 +01:00
Andy Polyakov
9e421962e1
evp/bio_enc.c: stop using pointer arithmetic for error detection.
...
Thanks to David Benjamin for reporting this.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-24 10:34:27 +01:00
Matt Caswell
44cb4f5b5f
Fix no-sock
...
The declaration of bio_type_lock is independent of no-sock so should not be
inside OPENSSL_NO_SOCK guards.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-24 09:25:53 +01:00
Dr. Stephen Henson
e97763c92c
Sanity check ticket length.
...
If a ticket callback changes the HMAC digest to SHA512 the existing
sanity checks are not sufficient and an attacker could perform a DoS
attack with a malformed ticket. Add additional checks based on
HMAC size.
Thanks to Shi Lei for reporting this bug.
CVE-2016-6302
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-08-23 23:16:24 +01:00