- 27 11月, 2014 1 次提交
-
-
由 Matt Caswell 提交于
Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
- 26 11月, 2014 2 次提交
-
-
由 Matt Caswell 提交于
PR#3608 Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Matt Caswell 提交于
PR#3574 Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
- 21 11月, 2014 4 次提交
-
-
由 Dr. Stephen Henson 提交于
When using the -xcert option to test certificate validity print out if we pass Suite B compliance. We print out "not tested" if we aren't in Suite B mode. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Annie Yousar 提交于
In keygen, return KEY_SIZE_TOO_SMALL not INVALID_KEYBITS. ** I also increased the minimum from 256 to 512, which is now documented in CHANGES file. ** Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Rich Salz 提交于
Fix CONF_load_modules to CONF_modules_load. Document that it calls exit. Advise against using it now. Add an error print to stderr. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
- 20 11月, 2014 11 次提交
-
-
由 David Benjamin 提交于
the session's version (server). See also BoringSSL's commit bdf5e72f50e25f0e45e825c156168766d8442dde. Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
由 Matt Caswell 提交于
ECDH_compute_key is silently ignored and the KDF is run on duff data Thanks to github user tomykaira for the suggested fix. Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
由 Emilia Kasper 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Emilia Kasper 提交于
once the ChangeCipherSpec message is received. Previously, the server would set the flag once at SSL3_ST_SR_CERT_VRFY and again at SSL3_ST_SR_FINISHED. This would allow a second CCS to arrive and would corrupt the server state. (Because the first CCS would latch the correct keys and subsequent CCS messages would have to be encrypted, a MitM attacker cannot exploit this, though.) Thanks to Joeri de Ruiter for reporting this issue. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Emilia Kasper 提交于
The server must send a NewSessionTicket message if it advertised one in the ServerHello, so make a missing ticket message an alert in the client. An equivalent change was independently made in BoringSSL, see commit 6444287806d801b9a45baf1f6f02a0e3a16e144c. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Emilia Kasper 提交于
The client sends a session ID with the session ticket, and uses the returned ID to detect resumption, so we do not need to peek at handshake messages: s->hit tells us explicitly if we're resuming. An equivalent change was independently made in BoringSSL, see commit 407886f589cf2dbaed82db0a44173036c3bc3317. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Emilia Kasper 提交于
The same change was independently made in BoringSSL, see commit 9eaeef81fa2d4fd6246dc02b6203fa936a5eaf67 Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Emilia Kasper 提交于
This ensures that it's zeroed even if the SSL object is reused (as in ssltest.c). It also ensures that it applies to DTLS, too. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
由 Dr. Stephen Henson 提交于
If no keyfile has been specified use the certificate file instead. Fix typo: we need to check the chain is not NULL, not the chain file. Reviewed-by: NMatt Caswell <matt@openssl.org> (cherry picked from commit 786370b1b09b919d9306f27336e13783e4fe3fd0)
-
由 Dr. Stephen Henson 提交于
When no-ssl3 is set only make SSLv3 disabled by default. Retain -ssl3 options for s_client/s_server/ssltest. When no-ssl3-method is set SSLv3_*method() is removed and all -ssl3 options. We should document this somewhere, e.g. wiki, FAQ or manual page. Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
- 19 11月, 2014 2 次提交
-
-
由 Dr. Stephen Henson 提交于
Don't send or parse any extensions other than RI (which is needed to handle secure renegotation) for SSLv3. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Dr. Stephen Henson 提交于
The supported signature algorithms extension needs to be processed before the certificate to use is decided and before a cipher is selected (as the set of shared signature algorithms supported may impact the choice). Reviewed-by: NMatt Caswell <matt@openssl.org> (cherry picked from commit 56e8dc542bd693b2dccea8828b3d8e5fc6932d0c) Conflicts: ssl/ssl.h ssl/ssl_err.c
-
- 18 11月, 2014 4 次提交
-
-
由 Matt Caswell 提交于
Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
-
- 17 11月, 2014 8 次提交
-
-
由 Jan Hykel 提交于
Don't attempt to access msg structure if recvmsg returns an error. PR#3483 Reviewed-by: NStephen Henson <steve@openssl.org> Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Mike Bland 提交于
Change-Id: I626d751f19f24df6b967c17498d6189cc0acb96c Signed-off-by: NMike Bland <mbland@acm.org> Signed-off-by: NGeoff Thorpe <geoff@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Mike Bland 提交于
This is the only Makefile without SRC defined. This change enables a standard Makefile include directive to cover crypto/jpake/*.d files. This was automatically applied by AddSrcVarIfNeeded() in: https://code.google.com/p/mike-bland/source/browse/openssl/update_makefiles.py Change-Id: I030204a1bc873b5de5b06c8ddc0b94bb224c6650 Signed-off-by: NMike Bland <mbland@acm.org> Signed-off-by: NGeoff Thorpe <geoff@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Mike Bland 提交于
These correspond to targets of the same name in test/Makefile that clash when using the single-makefile build method using GitConfigure and GitMake. Change-Id: If7e900c75f4341b446608b6916a3d76f202026ea Signed-off-by: NMike Bland <mbland@acm.org> Signed-off-by: NGeoff Thorpe <geoff@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Mike Bland 提交于
Before this change, variables for which a '=' appeared in the assignment would be parsed as the entire string up until the final '='. For example: BUILD_CMD=shlib_target=; if [ -n "$(SHARED_LIBS)" ]; then \ would result in the variable name "BUILD_CMD=shlib_target". This doesn't appear to harm the current generation of MINFO, but creates problems for other Makefile-related work I'm attempting. Change-Id: I1f3a606d67fd5464bb459e8f36c23b3e967b77e1 Signed-off-by: NMike Bland <mbland@acm.org> Signed-off-by: NGeoff Thorpe <geoff@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Mike Bland 提交于
These are based on debug-ben-debug-64-clang and is intended to produce consistent settings for folks involved in the unit testing effort detailed at: http://wiki.openssl.org/index.php/Unit_Testing -fsanitize has been removed from the set of clang flags for now. Apparently clang 3.1, which ships with FreeBSD 9.1, completely ignores -fsanitize. Clang 3.3, which ships with FreeBSD 9.2, compiles with it, but fails to link due to the absence of libasan: http://lists.freebsd.org/pipermail/freebsd-hackers/2013-December/043995.html https://www.mail-archive.com/cfe-commits@cs.uiuc.edu/msg92260.html http://reviews.llvm.org/D2644 We need -Wno-error=unused-const-variable because of this error: .../crypto/ec/ec_lib.c:74:19: error: unused variable 'EC_version' [-Werror,-Wunused-const-variable] static const char EC_version[] = "EC" OPENSSL_VERSION_PTEXT; Change-Id: I2cba53537137186114c083049ea1233550a741f9 Signed-off-by: NMike Bland <mbland@acm.org> Signed-off-by: NGeoff Thorpe <geoff@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Mike Bland 提交于
This fixes the errors when trying to assemble .s files using GitMake on OS X. Change-Id: I2221f558619302d22e0c57d7203173d634155678 Signed-off-by: NMike Bland <mbland@acm.org> Signed-off-by: NGeoff Thorpe <geoff@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Mike Bland 提交于
cscope.out is generated by cscope as described in: http://wiki.openssl.org/index.php/Testing_and_Development_Tools_and_Tips .d files are compiler-generated Makefile dependency files (e.g. using 'gcc -MMD -MP foo.c'). Change-Id: I2338858a6b6ee0527837d10a8b55cff1689023fd Signed-off-by: NMike Bland <mbland@acm.org> Signed-off-by: NGeoff Thorpe <geoff@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 13 11月, 2014 6 次提交
-
-
由 Dr. Stephen Henson 提交于
Print out more details of the conection in ssltest specifically: server certificate curve name for EC, server temporary key (if any) and peer signing digest. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Dr. Stephen Henson 提交于
Add command line support for SSL_CONF: server side arguments are prefixed by -s_ (e.g. -s_no_ssl3) and client side with -c_. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Dr. Stephen Henson 提交于
If the hash or public key algorithm is "undef" the signature type will receive special handling and shouldn't be included in the cross reference table. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Alok Menghrajani 提交于
Out is the buffer which needs to contain at least inl + cipher_block_size - 1 bytes. Outl is just an int*. Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
由 Michal Bozon 提交于
PR#3535 Reviewed-by: NStephen Henson <steve@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
- 11 11月, 2014 2 次提交
-
-
由 Kurt Roeckx 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Russell Coker 提交于
This doesn't really fix the datarace but changes it so it can only happens once. This isn't really a problem since we always just set it to the same value. We now just stop writing it after the first time. PR3584, https://bugs.debian.org/534534Signed-off-by: NKurt Roeckx <kurt@roeckx.be> Reviewed-by: NRich Salz <rsalz@openssl.org>
-