- 31 May, 2015 2 commits
-
-
Matt Caswell authored
dtls1_get_message has an |mt| variable which is the type of the message that is being requested. If it is negative then any message type is allowed. However the value of |mt| is not checked in one of the main code paths, so a peer can send a message of a completely different type and it will be processed as if it was the message type that we were expecting. This has very little practical consequences because the current behaviour will still fail when the format of the message isn't as expected. Reviewed-by: Andy Polyakov <appro@openssl.org>
-
Rich Salz authored
Reviewed-by: Tim Hudson <tjh@openssl.org>
-
- 30 May, 2015 2 commits
-
-
Dr. Stephen Henson authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
Rich Salz authored
Where we called openssl_cleanse, make sure we do it on all error paths. Be consistent in use of sizeof(foo) when possible. Reviewed-by: Andy Polyakov <appro@openssl.org>
-
- 29 May, 2015 6 commits
-
-
Matt Caswell authored
struct ccs_header_st is not used so it should be removed. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
-
Richard Levitte authored
Almost two months ago, the warning about non-existing config file was supressed by setting the environment variable OPENSSL_CONF to /dev/null everywhere. Now that this warning is gone, that practice is no longer needed. Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Richard Levitte authored
The module loading feature got broken a while ago, so restore it, but have it a bit more explicit this time around. Reviewed-by: Stephen Henson <steve@openssl.org>
-
Richard Levitte authored
Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Peter Dettman authored
RT 3871 Reviewed-by: Richard Levitte <levitte@openssl.org>
-
- 28 May, 2015 10 commits
-
-
Rich Salz authored
Create app_load_config(), a routine to load config file. Remove the "always load config" from the main app. Change the places that used to load config to call the new common routine. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Rich Salz authored
Using an enum with -Wswitch means all lookup routines handle all cases. Remove X509_LU_PKEY which was never used. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
The new accessors SSL_get_client_random, SSL_get_server_random and SSL_SESSION_get_master_key should return a size_t to match the type of the |outlen| parameter. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Change the new SSL_get_client_random(), SSL_get_server_random() and SSL_SESSION_get_master_key() functions to use size_t for |outlen| instead of int. Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Nick Mathewson authored
Signed-off-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Nick Mathewson authored
Tor uses these values to implement a low-rent clone of RFC 5705 (which, in our defense, we came up with before RFC 5705 existed). But now that ssl_st is opaque, we need another way to get at them. Includes documentation, with suitable warnings about not actually using these functions. Signed-off-by: Nick Mathewson <nickm@torproject.org> Signed-off-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Nick Mathewson authored
Signed-off-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Nick Mathewson authored
On the server side, if you want to know which ciphers the client offered, you had to use session->ciphers. But that field is no longer visible, so we need a method to get at it. Signed-off-by: Nick Mathewson <nickm@torproject.org> Signed-off-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
-
- 27 May, 2015 1 commit
-
-
Emilia Kasper authored
In master, the 'dh' command is gone, so use 'dhparam' instead to determine if we're compiled with DH. Also, set "@SECLEVEL=1" for the weak DH test, so that it actually passes. Reviewed-by: Dr Stephen Henson <steve@openssl.org>
-
- 26 May, 2015 13 commits
-
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Add support for PKCS#8 private key encryption using the scrypt algorithm in the pkcs8 utility. Update documentation. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
This adds a new function which will encrypt a private key using PKCS#8 based on an X509_ALGOR structure and reimplements PKCS8_encrypt to use it. Update pkcs8 utlity to use PKCS8_set0_pbe. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Set a specific error if the parameters are otherwise valid but exceed the memory limit. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Add support for PKCS#12 and PBKDF2 password based encryption tests. Add additional test data. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Emilia Kasper authored
Also add more ciphersuite test coverage, and a negative test for 512-bit DHE. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 1ee85aab75d7c9f20058f781bfe9222323df08eb)
-
Matt Caswell authored
The size of the SRP extension can never be negative (the variable |size| is unsigned). Therefore don't check if it is less than zero. RT#3862 Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
The return value of i2d functions can be negative if an error occurs. Therefore don't assign the return value to an unsigned type and *then* check if it is negative. RT#3862 Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
The members of struct timeval on OpenVMS are unsigned. The logic for calculating timeouts needs adjusting to deal with this. RT#3862 Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Andy Polyakov authored
RT#3860 Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Billy Brumley authored
RT#3858 Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Andy Polyakov authored
RT#3859 Reviewed-by: Tim Hudson <tjh@openssl.org>
-
- 25 May, 2015 4 commits
-
-
Hanno Böck authored
The "out" variable is used for both key and csr. Close it after writing the first one so it can be re-used when writing the other. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Rich Salz authored
Thanks to Brian Carpenter <brian.carpenter@gmail.com> for finding this. Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Matt Caswell authored
If the record received is for a version that we don't support, previously we were sending an alert back. However if the incoming record already looks like an alert then probably we shouldn't do that. So suppress an outgoing alert if it looks like we've got one incoming. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
-
Rich Salz authored
The 'http proxy' commit broke s_client default host/port value. Thanks to Matt for the simplest fix. Reviewed-by: Matt Caswell <matt@openssl.org>
-
- 24 May, 2015 2 commits
-
-
Matt Caswell authored
Version negotiation was broken (one of the late changes in the review process broke it). The problem is that TLS clients do not set first_packet, whereas TLS/DTLS servers and DTLS clients do. The simple fix is to set first_packet for TLS clients too. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
-
Andy Polyakov authored
bn_get_bits5 was overstepping array boundary by 1 byte. It was exclusively read overstep and data could not have been used. The only potential problem would be if array happens to end on the very edge of last accesible page. Reviewed-by: Richard Levitte <levitte@openssl.org>
-