- 06 3月, 2016 1 次提交
-
-
由 Rich Salz 提交于
Signed-off-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
- 05 3月, 2016 10 次提交
-
-
由 Richard Levitte 提交于
When object files with common block symbols are added to static libraries on Darwin, those symbols are invisible to the linker that tries to use them. Our solution was to use -fno-common when compiling C source. Unfortunately, there is assembler code that defines OPENSSL_ia32cap_P as a common block symbol, unconditionally, and in some cases, there is no other definition. -fno-common doesn't help in this case. However, 'ranlib -c' adds common block symbols to the index of the static library, which makes them visible to the linker using it, and that solves the problem we've seen. The common conclusion is, either use -fno-common or ranlib -c on Darwin. Since we have common block symbols unconditionally, choosing the method for our source is easy. Reviewed-by: NKurt Roeckx <kurt@openssl.org>
-
由 Richard Levitte 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Richard Levitte 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Richard Levitte 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Dr. Stephen Henson 提交于
Thanks to Colin Percival for reporting this issue. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Kurt Roeckx 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NEmilia Kasper <emilia@openssl.org> MR: #2203
-
由 Kurt Roeckx 提交于
They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT Reviewed-by: NRich Salz <rsalz@openssl.org> MR: #2202
-
由 Emilia Kasper 提交于
Clang is permissive of this, but gcc fails. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Dr. Stephen Henson 提交于
Add support for application supplied any defined by callback. An application can change the selector value if it wishes. This is mainly intended for values which are only known at runtime, for example dynamically created OIDs. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Dmitry-Me 提交于
Signed-off-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
- 04 3月, 2016 24 次提交
-
-
由 Rob Percival 提交于
Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rob Percival 提交于
Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rob Percival 提交于
Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rob Percival 提交于
Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rob Percival 提交于
e.g. "enabled_logs = foo,,bar" Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rob Percival 提交于
Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rob Percival 提交于
Previously, the remaining CT log entries would not be loaded. Also, CTLOG_STORE_load_file would return 1 even if a log entry was invalid, resulting in no errors being shown. Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rob Percival 提交于
Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rob Percival 提交于
Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rob Percival 提交于
Disabled by default, but can be enabled by setting the ct_validation_callback on a SSL or SSL_CTX. Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rich Salz 提交于
Change the ECC default curve list to be this, in order: x25519, secp256r1, secp521r1, secp384r1, brainpoolP256r1, brainpoolP384r1, and brainpool512r1. Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
由 Emilia Kasper 提交于
Appease the sanitizer: avoid left shifts of negative values. This could've been done entirely with casts to uint and back, but using masks seemed slightly more readable. There are also implementation-defined signed right shifts in this code. Those remain. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Andy Polyakov 提交于
RT#4365 Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
RC4 based ciphersuites in libssl have been disabled by default. They can be added back by building OpenSSL with the "enable-weak-ssl-ciphers" Configure option at compile time. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Viktor Dukhovni 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Richard Levitte 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Richard Levitte 提交于
The proper logic is that both zlib and zlib-dynamic are disabled by default and that enabling zlib-dynamic would enable zlib. Somewhere along the way, the logic got changed, zlib-dynamic was enabled by default and zlib didn't get automatically enabled. This change restores the original logic. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Dr. Stephen Henson 提交于
PVK files with abnormally large length or salt fields can cause an integer overflow which can result in an OOB read and heap corruption. However this is an rarely used format and private key files do not normally come from untrusted sources the security implications not significant. Fix by limiting PVK length field to 100K and salt to 10K: these should be more than enough to cover any files encountered in practice. Issue reported by Guido Vranken. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 FdaSilvaYY 提交于
Signed-off-by: NRich Salz <rsalz@akamai.com> Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Viktor Szakats 提交于
Signed-off-by: NRich Salz <rsalz@akamai.com> Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Dmitry-Me 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org> Signed-off-by: NRich Salz <rsalz@akamai.com>
-
由 Alessandro Ghedini 提交于
This patch implements the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) as defined in RFC 5869. It is required to implement the QUIC and TLS 1.3 protocols (among others). Signed-off-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
由 Richard Levitte 提交于
This construct in a Makefile is a bit overzealous: @echo FOO @FOO Cleaned up. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 03 3月, 2016 5 次提交
-
-
由 Emilia Kasper 提交于
- Remove OPENSSL_X25519_X86_64 which never worked, because we don't have the assembly. - Also remove OPENSSL_SMALL (which should have been OPENSSL_SMALL_FOOTPRINT) which isn't a priority at the moment. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Emilia Kasper 提交于
1) Simplify code with better PACKET methods. 2) Make broken SNI parsing explicit. SNI was intended to be extensible to new name types but RFC 4366 defined the syntax inextensibly, and OpenSSL has never parsed SNI in a way that would allow adding a new name type. RFC 6066 fixed the definition but due to broken implementations being widespread, it appears impossible to ever extend SNI. 3) Annotate resumption behaviour. OpenSSL doesn't currently handle all extensions correctly upon resumption. Annotate for further clean-up. 4) Send an alert on ALPN protocol mismatch. Reviewed-by: NKurt Roeckx <kurt@openssl.org>
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-