- 12 Apr, 2017 21 commits
-
-
Pauli authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3195)
-
Richard Levitte authored
Reviewed-by:
Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3174)
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
We're already checking that custom DER decodes to expected values (or fails to do so), but we didn't check if values encode back to expected DER. Reviewed-by:
-
Pauli authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Pauli authored
It isn't easy to use the test framework since it turns memory debugging on as well and the CRYPTO_mem_leaks_fp function cannot be called twice. Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Jon Spillett authored
Reviewed-by:
-
Jon Spillett authored
Reviewed-by:
-
Jon Spillett authored
Reviewed-by:
-
Jon Spillett authored
Reviewed-by:
-
Jon Spillett authored
Reviewed-by:
-
Jon Spillett authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Jon Spillett authored
Reviewed-by:
-
- 11 Apr, 2017 12 commits
-
-
Frank Morgner authored
fixes segmentation fault in case of not enough memory for object creation CLA: trivial Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Richard Levitte authored
Clearing a misunderstanding. The routines c2i_uint64_int() and i2c_uint64_int() expect to receive that internal values are absolute and with a separate sign flag, and the x_int64.c code handles values that aren't absolute and have the sign bit embedded. We therefore need to convert between absolute and non-absolute values for the encoding of negative values to be correct. [extended tests] Reviewed-by:
-
Richard Levitte authored
{ 0x80, 0x00, 0x00, 0x00 } decoded isn't (positive) 0x80000000, it's (negative) INT32_MIN. Reviewed-by: -
Todd Short authored
SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by:
Kurt Roeckx <kurt@openssl.org> Reviewed-by:
-
Rich Salz authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
- 10 Apr, 2017 7 commits
-
-
Pauli authored
Reviewed-by:
-
Benjamin Kaduk authored
RFC 7301 mandates that the server SHALL respond with a fatal "no_application_protocol" alert when there is no overlap between the client's supplied list and the server's list of supported protocols. In commit 06217867 we changed from ignoring non-success returns from the supplied alpn_select_cb() to treating such non-success returns as indicative of non-overlap and sending the fatal alert. In effect, this is using the presence of an alpn_select_cb() as a proxy to attempt to determine whether the application has configured a list of supported protocols. However, there may be cases in which an application's architecture leads it to supply an alpn_select_cb() but have that callback be configured to take no action on connections that do not have ALPN configured; returning SSL_TLSEXT_ERR_NOACK from the callback would be the natural way to do so. Unfortunately, the aforementioned behavior change also treated SSL_TLSEXT_ERR_NOACK as indicative of no overlap and terminated the connection; this change supplies special handling for SSL_TLSEXT_ERR_NOACK returns from the callback. In effect, it provides a way for a callback to obtain the behavior that would have occurred if no callback was registered at all, which was not possible prior to this change. Reviewed-by:
-
Richard Levitte authored
The deprecation checking code here didn't work the same way as in Configure, and used $config{options} to find an --api= option that was never there. This is replaced with checking $config{api}, which is the controlling variable for deprecation. Reviewed-by: -
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
Teach util/mkdef.pl to recognise these lines: #if OPENSSL_API_COMPAT < 0xXXXXXXXXL #if OPENSSL_API_COMPAT >= 0xXXXXXXXXL and add corresponding markers in util/*.num A final 'make update' sets those markers right for LONG and ZLONG. Reviewed-by: -
Richard Levitte authored
Replace all remaining uses of LONG and ZLONG with INT32 / ZINT32. Reviewed-by:
-
Richard Levitte authored
Don't compile code that still uses LONG when it's deprecated Reviewed-by:
-
