- 04 12月, 2014 1 次提交
-
-
由 Kurt Roeckx 提交于
The only support for SSLv2 left is receiving a SSLv2 compatible client hello. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 15 10月, 2014 2 次提交
-
-
由 Geoff Thorpe 提交于
CVE-2014-3568 Reviewed-by: NEmilia Kasper <emilia@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Bodo Moeller 提交于
Reviewed-by: NStephen Henson <steve@openssl.org>
-
- 29 8月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Use the same structure for client and server custom extensions. Add utility functions in new file t1_ext.c. Use new utility functions to handle custom server and client extensions and remove a lot of code duplication. Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
- 15 8月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Move custom extension structures from SSL_CTX to CERT structure. This change means the form can be revised in future without binary compatibility issues. Also since CERT is part of SSL structures so per-SSL custom extensions could be supported in future as well as per SSL_CTX. Reviewed-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
- 04 7月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Remove RFC5878 code. It is no longer needed for CT and has numerous bugs
-
- 01 7月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
(cherry picked from commit c97ec5631bb08a2171a125008d2f0d2a75687aaa)
-
- 28 3月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
-
- 06 2月, 2014 2 次提交
-
-
由 Scott Deboy 提交于
Whitespace fixes
-
由 Scott Deboy 提交于
If multiple TLS extensions are expected but not received, the TLS extension and supplemental data 'generate' callbacks are the only chance for the receive-side to trigger a specific TLS alert during the handshake. Removed logic which no-op'd TLS extension generate callbacks (as the generate callbacks need to always be called in order to trigger alerts), and updated the serverinfo-specific custom TLS extension callbacks to track which custom TLS extensions were received by the client, where no-ops for 'generate' callbacks are appropriate.
-
- 21 10月, 2013 2 次提交
-
-
由 Ben Laurie 提交于
-
由 Nick Mathewson 提交于
Instead, send random bytes, unless SSL_SEND_{CLIENT,SERVER}RANDOM_MODE is set. This is a forward-port of commits: 4af793036f6ef4f0a1078e5d7155426a98d50e37 f4c93b46edb51da71f09eda99e83eaf193a33c08 3da721dac9382c48812c8eba455528fd59af2eef 2583270191a8b27eed303c03ece1da97b9b69fd3 While the gmt_unix_time record was added in an ostensible attempt to mitigate the dangers of a bad RNG, its presence leaks the host's view of the current time in the clear. This minor leak can help fingerprint TLS instances across networks and protocols... and what's worse, it's doubtful thet the gmt_unix_time record does any good at all for its intended purpose, since: * It's quite possible to open two TLS connections in one second. * If the PRNG output is prone to repeat itself, ephemeral handshakes (and who knows what else besides) are broken.
-
- 06 9月, 2013 1 次提交
-
-
由 Scott Deboy 提交于
Add callbacks supporting generation and retrieval of supplemental data entries, facilitating RFC 5878 (TLS auth extensions) Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API Tests exercising the new supplemental data registration and callback api can be found in ssltest.c. Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation.
-
- 31 7月, 2013 1 次提交
-
-
由 Trevor Perrin 提交于
Force no SSL2 when custom extensions in use. Don't clear extension state when cert is set. Clear on renegotiate.
-
- 08 12月, 2012 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 15 8月, 2012 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 30 5月, 2012 1 次提交
-
-
由 Ben Laurie 提交于
-
- 26 4月, 2012 1 次提交
-
-
由 Andy Polyakov 提交于
vector contiguous. PR: 2802
-
- 17 4月, 2012 2 次提交
-
-
由 Dr. Stephen Henson 提交于
If OPENSSL_MAX_TLS1_2_CIPHER_LENGTH is set then limit the size of client ciphersuites to this value. A value of 50 should be sufficient. Document workarounds in CHANGES.
-
由 Dr. Stephen Henson 提交于
Some servers hang when presented with a client hello record length exceeding 255 bytes but will work with longer client hellos if the TLS record version in client hello does not exceed TLS v1.0. Unfortunately this doesn't fix all cases...
-
- 20 5月, 2011 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 30 4月, 2011 1 次提交
-
-
由 Dr. Stephen Henson 提交于
checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
-
- 13 3月, 2011 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 16 2月, 2010 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Submitted by: Tomas Mraz <tmraz@redhat.com> Since SSLv2 doesn't support renegotiation at all don't reject it if legacy renegotiation isn't enabled. Also can now use SSL2 compatible client hello because RFC5746 supports it.
-
- 28 12月, 2009 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 07 12月, 2009 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 18 11月, 2009 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 05 8月, 2009 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 09 4月, 2009 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 30 12月, 2008 1 次提交
-
-
由 Ben Laurie 提交于
-
- 03 9月, 2008 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 03 6月, 2008 1 次提交
-
-
由 Ben Laurie 提交于
-
- 27 9月, 2007 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 21 9月, 2007 1 次提交
-
-
由 Bodo Möller 提交于
(draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
-
- 29 11月, 2006 1 次提交
-
-
由 Bodo Möller 提交于
-
- 11 1月, 2006 2 次提交
-
-
由 Bodo Möller 提交于
-
由 Bodo Möller 提交于
Submitted by: Peter Sylvester
-
- 09 1月, 2006 1 次提交
-
-
由 Bodo Möller 提交于
-
- 03 1月, 2006 2 次提交
-
-
由 Bodo Möller 提交于
- fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
-
由 Bodo Möller 提交于
Submitted by: Peter Sylvester
-