- 24 Sep, 2017 1 commit
-
-
Saagar Jha authored
CLA: trivial Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4407)
-
- 23 Sep, 2017 4 commits
-
-
Kurt Roeckx authored
Reviewed-by:Andy Polyakov <appro@openssl.org> GH: #4410
-
Kurt Roeckx authored
Found by OSS-Fuzz and the tests Reviewed-by: -
Dr. Stephen Henson authored
Avoid duplicate assertion by removing dhparam from SSL_CONF parameter list: dhparam is handled manually by s_server. Reviewed-by:
-
Pichulin Dmitrii authored
Reviewed-by:
Paul Dale <paul.dale@oracle.com> Reviewed-by:
Stephen Henson <steve@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4405)
-
- 22 Sep, 2017 3 commits
-
-
Dr. Stephen Henson authored
Instead of storing supported groups in on-the-wire format store them as parsed uint16_t values. This simplifies handling of groups as the values can be directly used instead of being converted. Reviewed-by:
-
Andy Polyakov authored
The warning flag in question was added in GCC version 6, hence addition has to be conditional. Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4401)
-
David Benjamin authored
This guards against the name constraints check consuming large amounts of CPU time when certificates in the presented chain contain an excessive number of names (specifically subject email names or subject alternative DNS names) and/or name constraints. Name constraints checking compares the names presented in a certificate against the name constraints included in a certificate higher up in the chain using two nested for loops. Move the name constraints check so that it happens after signature verification so peers cannot exploit this using a chain with invalid signatures. Also impose a hard limit on the number of name constraints check loop iterations to further mitigate the issue. Thanks to NCC for finding this issue. Fix written by Martin Kreichgauer. Reviewed-by:
-
- 21 Sep, 2017 4 commits
-
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
Patrick Steuer authored
Compilation failed due to -Werror=misleading-indentation. Signed-off-by:
Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by:
-
Andy Polyakov authored
Detect clang even if it's disguised, e.g. cross-compiler or invoked by explicit path name, and add the option based on that. Reviewed-by:
-
Benjamin Kaduk authored
This option was lost when converting to a table-driven option parser in commit 7e1b7485 . Reviewed-by:
-
- 20 Sep, 2017 5 commits
-
-
Dr. Stephen Henson authored
Reviewed-by:
-
Dr. Stephen Henson authored
Reviewed-by:
-
Dr. Stephen Henson authored
Reviewed-by:
-
Dr. Stephen Henson authored
Allo RSA certificate to be used for RSA-PSS signatures: this needs to be explicit because RSA and RSA-PSS certificates are now distinct types. Reviewed-by:
-
Dr. Stephen Henson authored
Recognise RSA-PSS certificate algorithm and add a new certificate type. Reviewed-by:
-
- 19 Sep, 2017 1 commit
-
-
David Benjamin authored
c2i_ASN1_BIT_STRING takes length as a long but uses it as an int. Check bounds before doing so. Previously, excessively large inputs to the function could write a single byte outside the target buffer. (This is unreachable as asn1_ex_c2i already uses int for the length.) Thanks to NCC for finding this issue. Fix written by Martin Kreichgauer. Reviewed-by:
-
- 18 Sep, 2017 1 commit
-
-
Pauli authored
Use the defined typechecking stack method to sort the compression methods stack rather than using the generic function and apply type casts. Reviewed-by:
-
- 17 Sep, 2017 1 commit
-
-
Pauli authored
Address coverity report of null pointer being dereferenced. Reviewed-by:
-
- 15 Sep, 2017 1 commit
-
-
Christian Heimes authored
OpenSSL 1.1.0 made SSL_CTX and SSL structs opaque and introduced a new API to set the minimum and maximum protocol version for SSL_CTX with TLS_method(). Add getters to introspect the configured versions: int SSL_CTX_get_min_proto_version(SSL_CTX *ctx); int SSL_CTX_get_max_proto_version(SSL_CTX *ctx); int SSL_get_min_proto_version(SSL *ssl); int SSL_get_max_proto_version(SSL *ssl); NOTE: The getters do not resolv the version in case when the minimum or maxium version are configured as '0' (meaning auto-select lowest and highst version number). Signed-off-by:
Christian Heimes <christian@python.org> Reviewed-by:
-
- 14 Sep, 2017 12 commits
-
-
Pauli authored
Introduced by #4372 Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Pauli authored
Also use strndup instead of a malloc/memcpy pair. Reviewed-by:
-
Rich Salz authored
Reviewed-by:
-
Rich Salz authored
Reviewed-by:
-
Benjamin Kaduk authored
Reviewed-by:
-
Paul Yang authored
[to be squashed] [skip ci] Reviewed-by:
-
Paul Yang authored
1. make app pkey methods cleanup internal 2. add EVP_PKEY_meth_remove Fixes travis-ci failure in #4337 Reviewed-by:
-
Pauli authored
size_t variable. Reviewed-by:
-
Pauli authored
This reverts commit cc9c5689 for the file pbe_scrypt.c instead of scrypt.c Reviewed-by:
-
Pauli authored
This reverts commit 1caaea13 . Reviewed-by:
-
Pauli authored
This reverts commit a89c9a0d . Reviewed-by:
-
- 13 Sep, 2017 2 commits
-
-
Benjamin Kaduk authored
The peek result is now called 'err', not just 'e'. Reviewed-by:
-
Paul Yang authored
A new method is added to EVP_PKEY_METH as: int (*check) (EVP_PKEY_CTX *ctx); and to EVP_PKEY_ASN1_METHOD as: int (*pkey_check) (EVP_PKEY_CTX *ctx); This is used to check the validity of a specific key. The order of calls is: EVP_PKEY_check -> pmeth.check -> ameth.pkey_check. Reviewed-by:
-
- 12 Sep, 2017 4 commits
-
-
Rich Salz authored
Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4359)
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
Simply put, any NAME type OSS_STORE_INTO is a new object that can be looked into, and potentially lead to a whole tree of data to dive into. The recursive option allows someone to view the whole tree and its data in one go. Reviewed-by:
-
Richard Levitte authored
crypto/rand/rand_egd.c makes extensive use of stdio functions. When they are disabled, it makes sense to disable egd as well. Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4358)
-
- 11 Sep, 2017 1 commit
-
-
Andy Polyakov authored
Reviewed-by:
-
