- 12 8月, 2015 14 次提交
-
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Rich Salz 提交于
This was obsolete in 2001. This is not the same as Gost94 digest. Thanks to Dmitry Belyavsky <beldmit@gmail.com> for review and advice. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Matt Caswell 提交于
When config'd with "sctp" running "make test" causes a seg fault. This is actually due to the way ssltest works - it dives under the covers and frees up BIOs manually and so some BIOs are NULL when the SCTP code does not expect it. The simplest fix is just to add some sanity checks to make sure the BIOs aren't NULL before we use them. This problem occurs in master and 1.0.2. The fix has also been applied to 1.0.1 to keep the code in sync. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
There are some missing return value checks in the SCTP code. In master this was causing a compilation failure when config'd with "--strict-warnings sctp". Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
Run a "make update" for the OSSLTest Engine changes Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Richard Levitte 提交于
Use a dynamic engine for ossltest engine so that we can build it without subsequently deploying it during install. We do not want people accidentally using this engine. Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Matt Caswell 提交于
When using an anon DH ciphersuite a client should reject a 0 value for p. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Add ServerHello parsing to TLSProxy. Also add some (very) limited ServerKeyExchange parsing. Add the capability to set client and server cipher lists Fix a bug with fragment lengths Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Two tests are added: one is a simple version tolerance test; the second is a test to ensure that OpenSSL operates correctly in the case of a zero length extensions block. The latter was broken inadvertently (now fixed) and it would have been helpful to have a test case for it. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
This commit provides a set of perl modules that support the testing of libssl. The test harness operates as a man-in-the-middle proxy between s_server and s_client. Both s_server and s_client must be started using the "-testmode" option which loads the new OSSLTEST engine. The test harness enables scripts to be written that can examine the packets sent during a handshake, as well as (potentially) modifying them so that otherwise illegal handshake messages can be sent. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
This engine is for testing purposes only. It provides crippled crypto implementations and therefore must not be used in any instance where security is required. This will be used by the forthcoming libssl test harness which will operate as a man-in-the-middle proxy. The test harness will be able to modify TLS packets and read their contents. By using this test engine packets are not encrypted and MAC codes always verify. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
The function BN_MONT_CTX_set was assuming that the modulus was non-zero and therefore that |mod->top| > 0. In an error situation that may not be the case and could cause a seg fault. This is a follow on from CVE-2015-1794. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Guy Leaver (guleaver) 提交于
If a client receives a ServerKeyExchange for an anon DH ciphersuite with the value of p set to 0 then a seg fault can occur. This commits adds a test to reject p, g and pub key parameters that have a 0 value (in accordance with RFC 5246) The security vulnerability only affects master and 1.0.2, but the fix is additionally applied to 1.0.1 for additional confidence. CVE-2015-1794 Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Matt Caswell 提交于
make errors wants things in a different order to the way things are currently defined in the header files. The easiest fix is to just let it reorder it. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 11 8月, 2015 3 次提交
-
-
由 Rich Salz 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Rich Salz 提交于
Especially since after the #ifdef cleanups this is not useful. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Rich Salz 提交于
Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
- 10 8月, 2015 1 次提交
-
-
由 Ben Laurie 提交于
Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 09 8月, 2015 2 次提交
-
-
由 bluelineXY 提交于
Add Host Header in OCSP query if no host header is set via -header Signed-off-by: NRich Salz <rsalz@akamai.com> Reviewed-by: NBen Laurie <ben@openssl.org>
-
由 David Woodhouse 提交于
Signed-off-by: NRich Salz <rsalz@akamai.com> Reviewed-by: NBen Laurie <ben@openssl.org>
-
- 07 8月, 2015 3 次提交
-
-
由 Adam Eijdenberg 提交于
We could just initialize it, but to be consistent with the rest of the file it seemed to make more sense to just drop. Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Matt Caswell 提交于
This reverts commit 704563f0. Reverting in favour of the next commit which removes the underlying cause of the warning. Reviewed-by: NBen Laurie <ben@openssl.org>
-
由 Ben Laurie 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 06 8月, 2015 1 次提交
-
-
由 Anton Blanchard 提交于
Signed-off-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 05 8月, 2015 3 次提交
-
-
由 Adam Eijdenberg 提交于
Reviewed-by: NTim Hudson <tjh@openssl.org> Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Adam Eijdenberg 提交于
--strict-warnings started showing warnings for this today... Surely an error should be raised if these reads fail? Reviewed-by: NTim Hudson <tjh@openssl.org> Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Matt Caswell 提交于
The -use_srtp s_client/s_server option is supposed to take a colon separated string as an argument. In master this was incorrectly set to expect a filename. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 04 8月, 2015 5 次提交
-
-
由 Matt Caswell 提交于
Change NextProto message processing to use the PACKET API. Reviewed-by: NStephen Henson <steve@openssl.org>
-
由 Matt Caswell 提交于
Modify CertificateVerify processing to use the new PACKET API. Reviewed-by: NStephen Henson <steve@openssl.org>
-
由 Matt Caswell 提交于
Use the PACKET API for processing ClientCertificate messages Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
Some of the PACKET functions were returning incorrect data. An unfortunate choice of test data in the unit test was masking the failure. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
EC_KEY_set_public_key_affine_coordinates was using some variables that only apply if OPENSSL_NO_EC2M is not defined. Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
- 03 8月, 2015 7 次提交
-
-
由 Matt Caswell 提交于
The move of CCS into the state machine was causing make errors to fail. This fixes it. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
The move of CCS into the state machine introduced a bug in ssl3_read_bytes. The value of |recvd_type| was not being set if we are satisfying the request from handshake fragment storage. This can occur, for example, with renegotiation and causes the handshake to fail. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
Continuing on from the previous commit this moves the processing of DTLS CCS messages out of the record layer and into the state machine. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
The handling of incoming CCS records is a little strange. Since CCS is not a handshake message it is handled differently to normal handshake messages. Unfortunately whilst technically it is not a handhshake message the reality is that it must be processed in accordance with the state of the handshake. Currently CCS records are processed entirely within the record layer. In order to ensure that it is handled in accordance with the handshake state a flag is used to indicate that it is an acceptable time to receive a CCS. Previously this flag did not exist (see CVE-2014-0224), but the flag should only really be considered a workaround for the problem that CCS is not visible to the state machine. Outgoing CCS messages are already handled within the state machine. This patch makes CCS visible to the TLS state machine. A separate commit will handle DTLS. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
Uses the new PACKET code to process the incoming ClientHello including all extensions etc. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
Add some unit tests for the new PACKET API Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
Provide more robust (inline) functions to replace n2s, n2l, etc. These functions do the same thing as the previous macros, but also keep track of the amount of data remaining and return an error if we try to read more data than we've got. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 02 8月, 2015 1 次提交
-
-
由 Ben Laurie 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-