- 28 5月, 2019 1 次提交
-
-
由 z00415736 提交于
This reverts commit 487cd50bbe2cd30aedfcb35fda706061c05628e9. Change-Id: I03d4dcc6246c1037abc8afc34ddec50ba0a8451f Reviewed-on: http://mgit-tm.rnd.huawei.com/5004161Tested-by: Npublic jenkins <public_jenkins@notesmail.huawei.com> Reviewed-by: Ngaokui 00368537 <gaokui1@huawei.com> Reviewed-by: Nliwei 00495960 <sirius.liwei@huawei.com>
-
- 27 5月, 2019 1 次提交
-
-
由 z00415736 提交于
Description:D-Transport: Connection Setup on Server side Team:OTHERS Feature or Bugfix:Feature Binary Source:No PrivateCode(Yes/No):No Change-Id: I1214f2f74b233555f2903a23990640852e42cca6 Reviewed-on: http://mgit-tm.rnd.huawei.com/4999713Reviewed-by: Nwangyanbo 00291255 <wangyanbo3@huawei.com> Tested-by: Npublic jenkins <public_jenkins@notesmail.huawei.com> Reviewed-by: Ngaokui 00368537 <gaokui1@huawei.com> Reviewed-by: Ntenghui 00211420 <th.tenghui@huawei.com>
-
- 20 4月, 2019 1 次提交
-
-
由 g00368537 提交于
Description: Prevent over long nonces in ChaCha20-Poly1305 ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. CVE-2019-1543 Team:PDU_DRV Feature or Bugfix:Feature Binary Source:No PrivateCode(Yes/No):No Change-Id: I5085b1e79835cfae4d7122311d857c09a14e2420 Reviewed-on: http://mgit-tm.rnd.huawei.com/4573465Tested-by: Npublic jenkins <public_jenkins@notesmail.huawei.com> Reviewed-by: Nwangyanbo 00291255 <wangyanbo3@huawei.com> Reviewed-by: Nxiaofuzhou 00203296 <xiaofuzhou@huawei.com>
-
- 18 4月, 2019 1 次提交
-
-
由 w00291255 提交于
Description:openssl code Team:PDU_DRV Feature or Bugfix:Feature Binary Source:No PrivateCode(Yes/No):No Change-Id: I12fb83105e4aa3c64bb744fe6da458fb6809f1db Reviewed-on: http://mgit-tm.rnd.huawei.com/4532569Tested-by: Npublic jenkins <public_jenkins@notesmail.huawei.com> Reviewed-by: Ngaokui 00368537 <gaokui1@huawei.com>
-
- 20 11月, 2018 4 次提交
-
-
由 Matt Caswell 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7669)
-
由 Matt Caswell 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NNicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7664)
-
由 Richard Levitte 提交于
Without this precaution, we end up having directory targets depend on shlib object files for which there are no rules. Reviewed-by: NTim Hudson <tjh@openssl.org> Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7645)
-
- 19 11月, 2018 1 次提交
-
-
由 Richard Levitte 提交于
Mingw and Cygwin builds install the DLLs in the application directory, not the library directory, so ensure that one is created for them when installing the DLLs. Fixes #7653 Reviewed-by: NTim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7654) (cherry picked from commit 9694ebf753e571a55935a63b4df8016e7bd3248d)
-
- 16 11月, 2018 2 次提交
-
-
由 Andy Polyakov 提交于
Reviewed-by: NTim Hudson <tjh@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7643) (cherry picked from commit 6b956fe77b8aeb899ef7bdfa147a00bda51b804a)
-
由 Andy Polyakov 提交于
Reviewed-by: NTim Hudson <tjh@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7643) (cherry picked from commit 79d7fb990cd28bbe2888ed8f9051ab54c9f986b0)
-
- 15 11月, 2018 1 次提交
-
-
由 Richard Levitte 提交于
Fixes #7641 [extended tests] Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7642) (cherry picked from commit c7af8b0a267981c25cc42643493289a01ffe1bbd)
-
- 14 11月, 2018 6 次提交
-
-
由 Vitezslav Cizek 提交于
dsa_builtin_paramgen2 expects the L parameter to be greater than N, otherwise the generation will get stuck in an infinite loop. Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: NPaul Dale <paul.dale@oracle.com> Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (cherry picked from commit 3afd38b277a806b901e039c6ad281c5e5c97ef67) (Merged from https://github.com/openssl/openssl/pull/7493)
-
由 Matt Caswell 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7620) (cherry picked from commit 65d2c16cbe0da8efed2f285f59930297326fb435)
-
由 Richard Levitte 提交于
Reviewed-by: NMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7633) (cherry picked from commit 2dc37bc2b4c678462a24d2904604e58c0c5ac1cb)
-
由 Richard Levitte 提交于
We therefore must add defaults. Reviewed-by: NViktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7626) (cherry picked from commit 45cdae1c7c93fe7ef2a981da4c36c3b8cb09e855)
-
由 Richard Levitte 提交于
When libssl and libcrypto are compiled on Linux with "-rpath", but not "--enable-new-dtags", the RPATH takes precedence over LD_LIBRARY_PATH, and we end up running with the wrong libraries. This is resolved by using full (or at least relative, rather than just the filename to be found on LD_LIBRARY_PATH) paths to the shared objects. Reviewed-by: NViktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7626) (cherry picked from commit 18289399743da6c3db462f37fc8797738e8acf7c)
-
由 Richard Levitte 提交于
Fixes #7634 Reviewed-by: NViktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7635)
-
- 13 11月, 2018 1 次提交
-
-
由 Viktor Dukhovni 提交于
SSL_get_signature_nid() -- local signature algorithm SSL_get_signature_type_nid() -- local signature algorithm key type SSL_get_peer_tmp_key() -- Peer key-exchange public key SSL_get_tmp_key -- local key exchange public key Aliased pre-existing SSL_get_server_tmp_key(), which was formerly just for clients, to SSL_get_peer_tmp_key(). Changed internal calls to use the new name. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
- 12 11月, 2018 8 次提交
-
-
由 Matt Caswell 提交于
Reviewed-by: NViktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7503) (cherry picked from commit 6e68dae85a8f91944370125561c7ec0d5da46c20)
-
由 Matt Caswell 提交于
Reviewed-by: NViktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7503) (cherry picked from commit fb8c83599e869516552f7c27bdc4dd26947fe657)
-
由 Matt Caswell 提交于
SSL(_CTX)?_set_client_CA_list() was a server side only function in 1.1.0. If it was called on the client side then it was ignored. In 1.1.1 it now makes sense to have a CA list defined for both client and server (the client now sends it the the TLSv1.3 certificate_authorities extension). Unfortunately some applications were using the same SSL_CTX for both clients and servers and this resulted in some client ClientHellos being excessively large due to the number of certificate authorities being sent. This commit seperates out the CA list updated by SSL(_CTX)?_set_client_CA_list() and the more generic SSL(_CTX)?_set0_CA_list(). This means that SSL(_CTX)?_set_client_CA_list() still has no effect on the client side. If both CA lists are set then SSL(_CTX)?_set_client_CA_list() takes priority. Fixes #7411 Reviewed-by: NViktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7503) (cherry picked from commit 98732979001dbb59320803713c4c91ba40234250)
-
由 Richard Levitte 提交于
Just refering to a hash table element as an array reference will automatically create that element. Avoid that by defaulting to a separate empty array reference. Fixes #7543 Reviewed-by: NTim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7544) (cherry picked from commit 3bed01a09071fb289484dfd265f0a8a991537282)
-
由 Matt Caswell 提交于
Reviewed-by: NViktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7442) (cherry picked from commit 24ae00388fb9e25af8f94d36b7c191ae90061586)
-
由 Matt Caswell 提交于
Reviewed-by: NViktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7442) (cherry picked from commit 83c81eebed52aa84b6b34d26e984c859158ca1c0)
-
由 Matt Caswell 提交于
TLSv1.3 is more restrictive about the curve used. There must be a matching sig alg defined for that curve. Therefore if we are using some other curve in our certificate then we should not negotiate TLSv1.3. Fixes #7435 Reviewed-by: NViktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7442) (cherry picked from commit de4dc598024fd0a9c2b7a466fd5323755d369522)
-
由 Richard Levitte 提交于
Setting the SipHash hash size and setting its key is done with two independent functions... and yet, the internals depend on both. Unfortunately, the function to change the size wasn't adapted for the possibility that the key was set first, with a different hash size. This changes the hash setting function to fix the internal values (which is easy, fortunately) according to the hash size. evpmac.txt value for digestsize:8 is also corrected. Reviewed-by: NPaul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7613) (cherry picked from commit 425036130dfb3cfbef5937772f7526ce60133264)
-
- 11 11月, 2018 1 次提交
-
-
由 Tomas Mraz 提交于
Reviewed-by: NKurt Roeckx <kurt@roeckx.be> Reviewed-by: NRichard Levitte <levitte@openssl.org> GH: #7391 (cherry picked from commit 75b68c9e4e8591a4ebe083cb207aeb121baf549f)
-
- 10 11月, 2018 2 次提交
-
-
由 Mansour Ahmadi 提交于
Reviewed-by: NPaul Yang <yang.yang@baishancloud.com> Reviewed-by: NNicola Tuveri <nic.tuv@gmail.com> Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7427) (cherry picked from commit d896b79b0994a35ecfd1c8e729d348d67236150e)
-
由 Billy Brumley 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NNicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7599) (cherry picked from commit dd41956d80686638d74fd203bd67060f90966280)
-
- 09 11月, 2018 5 次提交
-
-
由 Bernd Edlinger 提交于
Fixes #7022 Reviewed-by: NPaul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7588) (cherry picked from commit e2d227bb4a25bb75354a40816439630a8162f073)
-
由 Richard Levitte 提交于
... otherwise, it's taken to be part of a device name. Reviewed-by: NMatt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7602) (cherry picked from commit e9994901f835420764d020968d4588fc09ec74c3)
-
由 Richard Levitte 提交于
We only had the main 'install' target depend on 'all'. This changes the dependencies so targets like install_dev, install_runtime_libs, install_engines and install_programs depend on build targets that are correspond to them more specifically. This increases the parallel possibilities. Fixes #7466 Reviewed-by: NPaul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7583) (cherry picked from commit e8d01a608705e4320082a11a3870aa7e19c7290f)
-
由 Richard Levitte 提交于
When trying 'make -j{n} install', you may occasionally run into trouble because to sub-targets (install_dev and install_runtime) try to install the same shared libraries. That makes parallel install difficult. This is solved by dividing install_runtime into two parts, one for libraries and one for programs, and have install_dev depend on install_runtime_libs instead of installing the shared runtime libraries itself. Fixes #7466 Reviewed-by: NPaul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7583) (cherry picked from commit c1123d9f7efb005a109aeccaba82c40bf9bd4c1d)
-
由 Paul Yang 提交于
[skip-ci] Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7546) (cherry picked from commit e5a8712d03334c4b7cb9f29d6d1daee399c1223e)
-
- 08 11月, 2018 5 次提交
-
-
由 Dr. Matthias St. Pierre 提交于
Commit c7504aeb (pr #6432) fixed a regression for applications in chroot environments, which compensated the fact that the new OpenSSL CSPRNG (based on the NIST DRBG) now reseeds periodically, which the previous one didn't. Now the reseeding could fail in the chroot environment if the DEVRANDOM devices were not present anymore and no other entropy source (e.g. getrandom()) was available. The solution was to keep the file handles for the DEVRANDOM devices open by default. In fact, the fix did more than this, it opened the DEVRANDOM devices early and unconditionally in rand_pool_init(), which had the unwanted side effect that the devices were opened (and kept open) even in cases when they were not used at all, for example when the getrandom() system call was available. Due to a bug (issue #7419) this even happened when the feature was disabled by the application. This commit removes the unconditional opening of all DEVRANDOM devices. They will now only be opened (and kept open) on first use. In particular, if getrandom() is available, the handles will not be opened unnecessarily. This change does not introduce a regression for applications compiled for libcrypto 1.1.0, because the SSLEAY RNG also seeds on first use. So in the above constellation the CSPRNG will only be properly seeded if it is happens before the forking and chrooting. Fixes #7419 Reviewed-by: NPaul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7437) (cherry picked from commit 8cfc19716c22dac737ec8cfc5f7d085e7c37f4d8)
-
由 Dr. Matthias St. Pierre 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7462) (cherry picked from commit 1901516a4ba909fff12e0e7815aa2d499f4d6d67)
-
由 Dr. Matthias St. Pierre 提交于
and remove duplicate rand_drbg_seedlen() implementation again. Reviewed-by: NRichard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7462) (cherry picked from commit 1c615e4ce97715ae3af9255bc57be32a49687966)
-
由 Matt Caswell 提交于
Previously we indicated this as a malloc failure which isn't very helpful. Reviewed-by: NKurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/7479) (cherry picked from commit 680bd131b69d57e891888ab70d300176a5a16617)
-
由 Matt Caswell 提交于
use_ecc() was always returning 1 because there are default (TLSv1.3) ciphersuites that use ECC - even if those ciphersuites are disabled by other options. Fixes #7471 Reviewed-by: NKurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/7479) (cherry picked from commit 589b6227a85ea0133fe91d744b16dd72edee929a)
-