- Dec 28, 2017
-
-
Matt Caswell authored
Now that we attempt to send early data in the first TCP packet along with the ClientHello, the documentation for SSL_write_early_data() needed a tweak. Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4802)
-
Matt Caswell authored
We don't keep track of the number of bytes written between in the SSL_write_ex() call and the subsequent flush. If the flush needs to be retried then we will have forgotten how many bytes actually got written. The simplest solution is to just disable it for this scenario. Reviewed-by:
-
Matt Caswell authored
We'd like the first bit of early_data and the ClientHello to go in the same TCP packet if at all possible to enable things like TCP Fast Open. Also, if you're only going to send one block of early data then you also don't need to worry about TCP_NODELAY. Fixes #4783 Reviewed-by:
-
Richard Levitte authored
The idea is to be able to add extension value lines directly on the command line instead of through the config file, for example: openssl req -new -extension 'subjectAltName = DNS:dom.ain, DNS:oth.er' \ -extension 'certificatePolicies = 1.2.3.4' Fixes #3311 Thank you Jacob Hoffman-Andrews for the inspiration Reviewed-by:Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4986)
-
- Dec 27, 2017
-
-
Bernd Edlinger authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4981)
-
Andy Polyakov authored
Reviewed-by:
Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4974)
-
Richard Levitte authored
The simplifications that were made when Makefile.shared was removed didn't work quite right. Also, this is what we do on Unix and Windows anyway, so this makes us more consistent across all platforms. Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4982)
-
- Dec 26, 2017
-
-
Paul Yang authored
Variables n, d, p are no longer there. [skip ci] Reviewed-by:
-
Daniel Bevenius authored
This commit is a suggestion to hopefully improve x509.pod. I had to re-read it the first time through and with these changes it reads a little easier, and wondering if others agree. Reviewed-by:
Paul Dale <paul.dale@oracle.com> Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4924)
-
- Dec 25, 2017
-
-
Kurt Roeckx authored
This comment was correct for the original commit introducing this function (5a3d21c0), but was fixed in commit d2fa1829 (and 67b8bcee ) Reviewed-by:
-
- Dec 23, 2017
-
-
Andy Polyakov authored
Hardware used for benchmarking courtesy of Atos, experiments run by Romain Dolbeau <romain.dolbeau@atos.net>. Kudos! Reviewed-by:
-
- Dec 22, 2017
-
-
Andy Polyakov authored
Reviewed-by:
-
Daniel Bevenius authored
Reviewed-by:
-
- Dec 18, 2017
-
-
Bernd Edlinger authored
Reviewed-by:
-
Richard Levitte authored
This is because VMS perl will otherwise lowercase them Reviewed-by:
-
Richard Levitte authored
It is a hack, but it existed in the recently removed Makefile.shared, and its use is documented in fuzz/README.md, so we cannot drop it now. Fixes https://github.com/google/oss-fuzz/issues/1037 Reviewed-by:
-
- Dec 17, 2017
-
-
Pauli authored
Reviewed-by:
-
Dr. Matthias St. Pierre authored
Previously, the RAND_DRBG_uninstantiate() call was not exactly inverse to RAND_DRBG_instantiate(), because some important member values of the drbg->ctr member where cleared. Now these values are restored internally. Signed-off-by:
Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
-
Dr. Matthias St. Pierre authored
Signed-off-by:
-
Dr. Matthias St. Pierre authored
Every DRBG now supports automatic reseeding not only after a given number of generate requests, but also after a specified time interval. Signed-off-by:
-
Dr. Matthias St. Pierre authored
A third shared DRBG is added, the so called master DRBG. Its sole purpose is to reseed the two other shared DRBGs, the public and the private DRBG. The randomness for the master DRBG is either pulled from the os entropy sources, or added by the application using the RAND_add() call. The master DRBG reseeds itself automatically after a given number of generate requests, but can also be reseeded using RAND_seed() or RAND_add(). A reseeding of the master DRBG is automatically propagated to the public and private DRBG. This construction fixes the problem, that up to now the randomness provided by RAND_add() was added only to the public and not to the private DRBG. Signed-off-by:
-
Paul Yang authored
Reviewed-by:
Matt Caswell <matt@openssl.org> GH: #4934
-
Daniel Bevenius authored
This commit adds comments to bio_method_st definitions where the function pointers are defined as NULL. Most of the structs have comments but some where missing and not all consitent. CLA: trivial Reviewed-by:
-
- Dec 15, 2017
-
-
Bernd Edlinger authored
Rename bio_info_cb to BIO_info_cb. Reviewed-by:
-
Bernd Edlinger authored
Ignore libssl.map/libcrypto.map instead of ssl.map/crypto.map Reviewed-by:
-
- Dec 14, 2017
-
-
Todd Short authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
This fixes a bug where some CCS records were written with the wrong TLS record version. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Flush following the CCS after an HRR. Only flush the HRR if middlebox compat is turned off. Reviewed-by:
-
Matt Caswell authored
Normally we flush immediately after writing the ClientHello. However if we are going to write a CCS immediately because we've got early_data to come, then we should move the flush until after the CCS. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
The CCS may be sent at different times based on whether or not we sent an HRR earlier. In order to make that decision this commit also updates things to make sure we remember whether an HRR was used or not. Reviewed-by:
-
Matt Caswell authored
Ensure that after an HRR we can only negotiate TLSv1.3 Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
