Skip to content
  1. Feb 18, 2019
  2. Feb 17, 2019
  3. Feb 15, 2019
  4. Feb 14, 2019
    • Matt Caswell's avatar
      Fix -verify_return_error in s_client · 9c931841
      Matt Caswell authored
      
      
      The "verify_return_error" option in s_client is documented as:
      
       Return verification errors instead of continuing. This will typically
       abort the handshake with a fatal error.
      
      In practice this option was ignored unless also accompanied with the
      "-verify" option. It's unclear what the original intention was. One fix
      could have been to change the documentation to match the actual behaviour.
      However it seems unecessarily complex and unexpected that you should need
      to have both options. Instead the fix implemented here is make the option
      match the documentation so that "-verify" is not also required.
      
      Note that s_server has a similar option where "-verify" (or "-Verify") is
      still required. This makes more sense because those options additionally
      request a certificate from the client. Without a certificate there is no
      possibility of a verification failing, and so "-verify_return_error" doing
      nothing seems ok.
      
      Fixes #8079
      
      Reviewed-by: default avatarNicola Tuveri <nic.tuv@gmail.com>
      (Merged from https://github.com/openssl/openssl/pull/8080)
      
      (cherry picked from commit 78021171dbcb05ddab1b5daffbfc62504ea709a4)
      9c931841
    • Matt Caswell's avatar
      Don't signal SSL_CB_HANDSHAKE_START for TLSv1.3 post-handshake messages · 37857e9b
      Matt Caswell authored
      
      
      The original 1.1.1 design was to use SSL_CB_HANDSHAKE_START and
      SSL_CB_HANDSHAKE_DONE to signal start/end of a post-handshake message
      exchange in TLSv1.3. Unfortunately experience has shown that this confuses
      some applications who mistake it for a TLSv1.2 renegotiation. This means
      that KeyUpdate messages are not handled properly.
      
      This commit removes the use of SSL_CB_HANDSHAKE_START and
      SSL_CB_HANDSHAKE_DONE to signal the start/end of a post-handshake
      message exchange. Individual post-handshake messages are still signalled in
      the normal way.
      
      This is a potentially breaking change if there are any applications already
      written that expect to see these TLSv1.3 events. However, without it,
      KeyUpdate is not currently usable for many applications.
      
      Fixes #8069
      
      Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/8096)
      
      (cherry picked from commit 4af5836b)
      37857e9b
    • Sam Roberts's avatar
      Ignore cipher suites when setting cipher list · 1c31fe7e
      Sam Roberts authored
      
      
      set_cipher_list() sets TLSv1.2 (and below) ciphers, and its success or
      failure should not depend on whether set_ciphersuites() has been used to
      setup TLSv1.3 ciphers.
      
      Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
      Reviewed-by: default avatarBen Kaduk <kaduk@mit.edu>
      Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/7759)
      
      (cherry picked from commit 3c83c5ba)
      1c31fe7e
    • Richard Levitte's avatar
      Configure: stop forcing use of DEFINE macros in headers · cd272eee
      Richard Levitte authored
      
      
      There are times when one might want to use something like
      DEFINE_STACK_OF in a .c file, because it defines a stack for a type
      defined in that .c file.  Unfortunately, when configuring with
      `--strict-warnings`, clang aggressively warn about unused functions in
      such cases, which forces the use of such DEFINE macros to header
      files.
      
      We therefore disable this warning from the `--strict-warnings`
      definition for clang.
      
      (note for the curious: `-Wunused-function` is enabled via `-Wall`)
      
      Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
      (Merged from https://github.com/openssl/openssl/pull/8234)
      
      (cherry picked from commit f11ffa505f8a9345145a26a05bf77b012b6941bd)
      cd272eee
  5. Feb 13, 2019
  6. Feb 11, 2019
  7. Feb 10, 2019
  8. Feb 08, 2019
  9. Feb 07, 2019
  10. Feb 05, 2019
  11. Feb 04, 2019
  12. Feb 02, 2019
  13. Feb 01, 2019
  14. Jan 31, 2019
  15. Jan 30, 2019
  16. Jan 29, 2019
  17. Jan 28, 2019