Skip to content
GitLab
  1. 15 Jan, 2019 2 commits
  3. 08 Jan, 2019 2 commits
    • Matt Caswell's avatar
      Don't artificially limit the size of the ClientHello · bbcfd60e
      Matt Caswell authored 
      

We were setting a limit of SSL3_RT_MAX_PLAIN_LENGTH on the size of the
ClientHello. AFAIK there is nothing in the standards that requires this
limit.

The limit goes all the way back to when support for extensions was first
added for TLSv1.0. It got converted into a WPACKET max size in 1.1.1. Most
likely it was originally added to avoid the complexity of having to grow
the init_buf in the middle of adding extensions. With WPACKET this is
irrelevant since it will grow automatically.

This issue came up when an attempt was made to send a very large
certificate_authorities extension in the ClientHello.

We should just remove the limit.

Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
Reviewed-by: default avatarViktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7424)

(cherry picked from commit 7835e97b)
      bbcfd60e
    • FdaSilvaYY's avatar
      Fix CID 1434549: Unchecked return value in test/evp_test.c · 37cad7e6
      FdaSilvaYY authored 
      

5. check_return: Calling EVP_EncodeUpdate without checking return value
(as is done elsewhere 4 out of 5 times).

Fix CID 1371695, 1371698: Resource leak in test/evp_test.c

- leaked_storage: Variable edata going out of scope leaks the storage it
points to.

- leaked_storage: Variable encode_ctx going out of scope leaks the
storage it points to

Fix CID 1430437, 1430426, 1430429 : Dereference before null check in test/drbg_cavs_test.c

check_after_deref: Null-checking drbg suggests that it
may be null, but it has already been dereferenced on all paths leading
to the check

Fix CID 1440765: Dereference before null check in test/ssltestlib.c

check_after_deref: Null-checking ctx suggests that it may be null, but
it has already been dereferenced on all paths leading to the check.

Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
Reviewed-by: default avatarMatthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: default avatarBernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/7993)

(cherry picked from commit 760e2d60e62511a6fb96f547f6730d05eb5f47ec)
      37cad7e6
  5. 07 Jan, 2019 5 commits
  7. 06 Jan, 2019 2 commits
  9. 04 Jan, 2019 7 commits
  11. 03 Jan, 2019 3 commits
  13. 31 Dec, 2018 1 commit
  15. 30 Dec, 2018 1 commit
  17. 29 Dec, 2018 1 commit
  19. 27 Dec, 2018 1 commit
  21. 23 Dec, 2018 1 commit
  23. 22 Dec, 2018 3 commits
  25. 20 Dec, 2018 1 commit
    • Ken Goldman's avatar
      Admit unknown pkey types at security level 0 · ea7d2c58
      Ken Goldman authored 
      

The check_key_level() function currently fails when the public key
cannot be extracted from the certificate because its algorithm is not
supported.  However, the public key is not needed for the last
certificate in the chain.

This change moves the check for level 0 before the check for a
non-NULL public key.

For background, this is the TPM 1.2 endorsement key certificate.
I.e., this is a real application with millions of certificates issued.
The key is an RSA-2048 key.

The TCG (for a while) specified

     Public Key Algorithm: rsaesOaep

rather than the commonly used

     Public Key Algorithm: rsaEncryption

because the key is an encryption key rather than a signing key.
The X509 certificate parser fails to get the public key.

Reviewed-by: default avatarViktor Dukhovni <viktor@openssl.org>
Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7906)
      ea7d2c58
  27. 19 Dec, 2018 1 commit
  29. 15 Dec, 2018 1 commit
    • Dr. Matthias St. Pierre's avatar
      man: harmonize the various formulations in the HISTORY sections · df75c2bf
      Dr. Matthias St. Pierre authored 
      

While stereotyped repetitions are frowned upon in literature, they
serve a useful purpose in manual pages, because it is easier for
the user to find certain information if it is always presented in
the same way. For that reason, this commit harmonizes the varying
formulations in the HISTORY section about which functions, flags,
etc. were added in which OpenSSL version.

It also attempts to make the pod files more grep friendly by
avoiding to insert line breaks between the symbol names and the
corresponding version number in which they were introduced
(wherever possible). Some punctuation and typographical errors
were fixed on the way.

Reviewed-by: default avatarTim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7854)
      df75c2bf
  31. 14 Dec, 2018 1 commit
  33. 13 Dec, 2018 3 commits
  35. 12 Dec, 2018 4 commits