- 07 Jul, 2017 19 commits
-
-
Matt Caswell authored
1.1.0 included the previous value for SSL_OP_ALLOW_NO_DHE_KEX in SSL_OP_ALL. This might cause binary compatibility issues. We should choose a value that is not in SSL_OP_ALL. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3833)
-
Matt Caswell authored
Also the associated configuration parameters and command line switches. Reviewed-by:
-
Matt Caswell authored
Allow that mode to be configured if desired. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3852)
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Otherwise the ClientHello test fails Reviewed-by:
-
Matt Caswell authored
In most scenarios the length of the input data is the hashsize, or 0 if the data is NULL. However with the new ticket_nonce changes the length can be different. Reviewed-by:
-
Matt Caswell authored
Our test was using 32. The latest ticket nonce changes now validate this value and so sslapitest was failing. Reviewed-by:
-
Matt Caswell authored
This just adds the processing for sending and receiving the newly added ticket_nonce field. It doesn't actually use it yet. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
We were not freeing the session created when loading a PSK session file. Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3855)
-
Richard Levitte authored
TAP::Parser::Aggregator::has_errors may return any number, not just 0 and 1. With Perl on VMS, any number from 2 and on is interpreted as a VMS status, the 3 lower bits are the encoded severity (1 = SUCCESS, for example), so depending on what has_errors returns, a test failure might be interpreted as a success. Therefore, it's better to make sure the exit code is 0 or 1, nothing else (they are special on VMS, and mean SUCCESS or FAILURE, to match Unix conventions). Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3880)
-
Richard Levitte authored
VMS renames our libraries to fit VMS conventions. This must be accounted for when we want to load them. Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Pauli authored
Some linkers like it this way. Reviewed-by:
-
- 06 Jul, 2017 5 commits
-
-
Rich Salz authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3875)
-
Pauli authored
Add length limits to avoid problems with sprintf, strcpy and strcat. This replaces recently removed code but also guards some previously missing function calls (for DOS & Windows). Reworked the BIO_dump_indent_cb code to reduce temporary storage. Reviewed-by:
-
Rich Salz authored
Document an internal assumption that these are only for use with files, and return an error if not. That made the code much simpler. Leave it as writing 1024 bytes, even though we don't need more than 256 from a security perspective. But the amount isn't specified, now, so we can change it later if we want. Reviewed-by:
-
Pauli authored
Check that sprint, strcpy don't overflow. Avoid some strlen operations when the previous sprintf return value can be used. Also fix the undefined behaviour `*(long *)x = y` when x isn't a long or character pointer. ISO/IEC 9899:1999 6.5/7 for the details. Reviewed-by:
-
Pauli authored
This includes strcat, strcpy and sprintf. In the x509 app, the code has been cleaned up as well. Reviewed-by:
-
- 05 Jul, 2017 16 commits
-
-
Rich Salz authored
Reviewed-by:
-
Pauli authored
It won't overflow the buffer and will allocate new buffers sufficiently large to hold new strings longer than the expansion factor. Reviewed-by:
-
Pauli authored
Clean up some of the formatting "return x" instead of "return (x)" mostly. Reviewed-by:
-
Rich Salz authored
[extended tests] Reviewed-by:
-
Rich Salz authored
Original text: Document openssl dgst -hmac option Reviewed-by: -
Rich Salz authored
Original text: Clarify use of |$end0| in stitched x86-64 AES-GCM code. There was some uncertainty about what the code is doing with |$end0| and whether it was necessary for |$len| to be a multiple of 16 or 96. Hopefully these added comments make it clear that the code is correct except for the caveat regarding low memory addresses. Change-Id: Iea546a59dc7aeb400f50ac5d2d7b9cb88ace9027 Reviewed-on: https://boringssl-review.googlesource.com/7194 Reviewed-by:Adam Langley <agl@google.com> Reviewed-by:
-
Rich Salz authored
Comment in the commit: /* Ignore NULLs, thanks to Bob Beck <beck@obtuse.com> */ Reviewed-by: -
Rich Salz authored
Original text: Check if a random "file" is really a device file, and treat it specially if it is. Add a few OpenBSD-specific cases. This is part of a large change submitted by Markus Friedl <markus@openbsd.or Reviewed-by: -
Rich Salz authored
Original text: Fix Perl problems on sparc64. This is part of a large change submitted by Markus Friedl <markus@openbsd.org> Reviewed-by: -
Richard Levitte authored
The way try_decode_params works in raw more, it would take the first ASN1 that could decode and return a STORE_INFO with the resulting EVP_PKEY. This change has it go through all the matching ASN1 methods and properly check if there's more than one match, i.e. an ambiguity. Reviewed-by:
-
Benjamin Kaduk authored
If the result of a SSL_{CTX_,}set_{min,max}_proto_version() call leaves the min and max version identical, and support for that version is compiled out of the library, return an error. Such an object has no hope of successfully completing a handshake, and this error may be easier to decipher than the resulting handshake failure. Reviewed-by: -
Benjamin Kaduk authored
Since BN_CTX_init() is gone, all calls use BN_CTX_new(). Also, essentially all consumers will use BN_CTX_start()/BN_CTX_end(), so make that more clear from the BN_CTX_new() man page. Document the thread-unsafety of individual BN_CTX objects. Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3682)
-
Richard Levitte authored
- in EVP_read_pw_string_min(), the return value from UI_add_* wasn't properly checked - in UI_process(), |state| was never made NULL, which means an error when closing the session wouldn't be accurately reported. Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3849)
-
Richard Levitte authored
When tree_calculate_user_set() fails, a jump to error failed to deallocate a possibly allocated |auth_nodes|. Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Rich Salz authored
[extended tests] Original text: Use BUF_strlcpy() instead of strcpy(). Use BUF_strlcat() instead of strcat(). Use BIO_snprintf() instead of sprintf(). In some cases, keep better track of buffer lengths. This is part of a large change submitted by Markus Friedl <markus@openbsd.org> Reviewed-by:
-
