- 16 Mar, 2017 16 commits
-
-
Matt Caswell authored
Test that if the server selects a ciphersuite with a different hash from the PSK in the original ClientHello, the second ClientHello does not contain the PSK. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2895)
-
Matt Caswell authored
Choose a new ciphersuite for the HRR. Don't just use the one from the session. Reviewed-by:
-
Matt Caswell authored
Don't include a PSK that does not have the right hash for the selected ciphersuite following an HRR. Reviewed-by:
-
Matt Caswell authored
Draft-19 changes the HRR transcript hash so that the initial ClientHello is replaced in the transcript with a special synthetic message_hash message that just contains a hash of ClientHello1 as its message body. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
As per draft-19 Reviewed-by:
-
Matt Caswell authored
The end of early data is now indicated by a new handshake message rather than an alert. Reviewed-by:
-
Matt Caswell authored
These are self-generated test vectors which gives us very little confidence that we've got the implementation right. However until we can get vectors from somewhere else (or ideally official vectors) this is all we've got. At least it will tell us if we accidentally break something at some point in the future. Reviewed-by:
-
Matt Caswell authored
TLSv1.3 draft 19 introduces a new pre HKDF-extract Derive-Secret stage. Reviewed-by:
-
Matt Caswell authored
This change will mean we will lose interoperability with draft-18 implementations. Reviewed-by:
-
Paul Yang authored
For the function that get the changed fds, it should be 'ASYNC_WAIT_CTX_get_changed_fds()' instead of 'ASYNC_WAIT_CTX_fds_have_changed()'. CLA: trivial Signed-off-by:
Paul Yang <paulyang.inf@gmail.com> Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2966)
-
FdaSilvaYY authored
clean an useless static qualifier and a dead comment. Reviewed-by:
-
Benjamin Kaduk authored
It's even removing a BUGS entry! Reviewed-by:
Emilia Käsper <emilia@openssl.org> Reviewed-by:
-
Benjamin Kaduk authored
Some things were not removed from util/indent.pro when they were removed from the code. grep '^-T' util/indent.pro | awk '{print $2} > /tmp/a grep -rF -f /tmp/a --exclude CHANGES --exclude 'INSTALL' --exclude 'LICENSE' --exclude 'NEWS' --exclude 'NOTES*' --exclude 'README*' --exclude indent.pro --exclude-dir corpora -o -h *|sort|uniq>/tmp/b comm -23 <(sort /tmp/a) /tmp/b >/tmp/c grep -v -E '(LHASH_OF|STACK_OF)' /tmp/c > /tmp/d grep -v -Ff /tmp/d util/indent.pro > util/indent.pro Manually adjusted to retain time_t and the ossl_*intmax_t types. Reviewed-by: -
Benjamin Kaduk authored
Reviewed-by:
-
Pauli authored
tests. [skip ci] Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
-
- 15 Mar, 2017 15 commits
-
-
Bernd Edlinger authored
Reviewed-by:
-
Benjamin Kaduk authored
tls1_get_curvelist() does not read from its third parameter, so the assignments prior to function call were dead code and can be removed. Reviewed-by:
-
Benjamin Kaduk authored
Instead of making a positive comparison against the invalid value that our server would send, make a negative check against the only value that is not an error. Reviewed-by:
-
Richard Levitte authored
Reviewed-by: -
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
Just as for DH, DSA and RSA, this gives the engine associated with the key. Reviewed-by:
-
Pauli authored
describe the vagaries in their behaviour. [skip ci] Reviewed-by:
-
Pauli authored
Reviewed-by:
Andy Polyakov <appro@openssl.org> Reviewed-by:
-
Matt Caswell authored
The logic for testing whether the sessionfile has been created or not was faulty and could result in race conditions. If you "lose" the tests hang waiting for a session file that's never going to arrive. Fixes #2950 Reviewed-by:
-
Andy Polyakov authored
Reviewed-by: -
Andy Polyakov authored
Strawberry Perl bailed out running test\run_tests.pl insisting on setup() being called explicitly. Reviewed-by: -
Benjamin Kaduk authored
Zero out the length alongside the NULLing of the pointer, to bring parity between the selected and proposed fields.. Reviewed-by:
-
Richard Levitte authored
It turns out that /DSF didn't do any good for our purposes. Instead, remove the CALL_DEBUG flag from any image we link. This ensures that we can have debugging information in the image files, but don't automatically end up in a debugging session upon image activation. Unfortunately, this means the CALL_DEBUG must be turned on when there is a need to run with the debugger activated, and to turn it off when done. This has been documented in NOTES.VMS. Reviewed-by:
-
Jon Spillett authored
Add python cryptography testing instructions too Reviewed-by:
-
Dr. Stephen Henson authored
Import test data from: ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip This is a set of RSA-PSS and RSA-OAEP test vectors including some edge cases with unusual key sizes. Reviewed-by:
-
- 14 Mar, 2017 9 commits
-
-
Matt Caswell authored
The previous 2 commits fixed some issues in the Boring tests. This re-enables those tests. [extended tests] Reviewed-by:
-
Matt Caswell authored
After a resumption it is documented that SSL_get_peer_cert_chain() will return NULL. In BoringSSL it still returns the chain. We don't support that so we should update the shim to call SSL_get_peer_certificate() instead when checking whether a peer certificate is available. Reviewed-by:
-
Matt Caswell authored
OpenSSL requires that we set the session id context. BoringSSL apparently does not require this, so wasn't setting it. Reviewed-by:
-
Benjamin Kaduk authored
No need to break out of the loop and repeat the loop termination condition when we can just return. Reviewed-by:
Kurt Roeckx <kurt@openssl.org> Reviewed-by:
-
Richard Levitte authored
[.util]shareable_image_wrap.c.in was never useful because lib$spawn() insisted on combining stdout and stderr into one. Instead, we introduce two scripts that create and destroy a temporary environment where the local shareable images become available, [.util]local_shlib.com and [.util]unlocal_shlib.com. They also define DBG$IMAGE_DSF_PATH, which is require so the debugger can find the Debug Symbol Files. Reviewed-by:
-
Richard Levitte authored
That makes it possible to run images without automagically ending up in a debug session, while still being able to debug when required. All .DSF files must reside in the same directory to be useful. Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
Rich Salz authored
Using a cert with Cyrillic characters, kindly supplied by Dmitry Belyavsky Reviewed-by:
-
Emilia Kasper authored
This gets us a newer Clang, and newer Go. 1.1.0 already runs on Trusty without issues. To do this, we need to disable afalgeng in the -Werror build. afalgeng isn't compatible with the -Werror build on Travis Trusty due to kernel header mismatch. (See also 97043e46 ) Reviewed-by:
-
