- May 21, 2018
-
-
Matt Caswell authored
In TLSv1.2 and below we always cache new sessions by default on the server side in the internal cache (even when we're using session tickets). This is in order to support resumption from a session id. In TLSv1.3 there is no session id. It is only possible to resume using the ticket. Therefore, in the default case, there is no point in caching the session in the internal store. There is still a reason to call the external cache new session callback because applications may be using the callbacks just to know about when sessions are created (and not necessarily implementing a full cache). If the application also implements the remove session callback then we are forced to also store it in the internal cache so that we can create timeout events. Otherwise the external cache could just fill up indefinitely. This mostly addresses the issue described in #5628. That issue also proposes having an option to not create full stateless tickets when using the internal cache. That aspect hasn't been addressed yet. Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/6293)
-
Matt Caswell authored
If the lengths of both names is 0 then don't attempt to do a memcmp. Issue reported by Simon Friedberger, Robert Merget and Juraj Somorovsky. Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6291)
-
- May 20, 2018
-
-
Richard Levitte authored
This adds the possibility to exclude files by regexp in util/copy.pl Partial fix for #3254 Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
-
Richard Levitte authored
--quiet stops warnings of this sort: Cannot find "BIO_read_ex" in podpath: cannot find suitable replacement path, cannot resolve link We know what causes these warnings, it's perfectly innocuous, and we don't want to hear it any more. Partial fix for #3254 Reviewed-by: -
Todd Short authored
Reviewed-by:
Andy Polyakov <appro@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6255)
-
Richard Levitte authored
A previous change of this function introduced a fragility when the destination happens to be the same as the source. Such alias isn't recommended, but could still happen, for example in this kind of code: X509_NAME *subject = X509_get_issuer_name(x); /* ... some code passes ... */ X509_set_issuer_name(x, subject); Fixes #4710 Reviewed-by:
-
- May 18, 2018
-
-
Matt Caswell authored
Using the ca application to sign certificates with EdDSA failed because it is not possible to set the digest to "null". This adds the capability and updates the documentation accordingly. Fixes #6201 Reviewed-by:
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
- May 17, 2018
-
-
Matt Caswell authored
Experiments have shown that the lookup table used by BN_GF2m_mod_arr introduces sufficient timing signal to recover the private key for an attacker with access to cache timing information on the victim's host. This only affects binary curves (which are less frequently used). No CVE is considered necessary for this issue. The fix is to replace the lookup table with an on-the-fly calculation of the value from the table instead, which can be performed in constant time. Thanks to Youngjoo Shin for reporting this issue. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Also allows the apps to set it. Reviewed-by:
-
Matt Caswell authored
We send a session ticket automatically in TLSv1.3 at the end of the handshake. This commit provides the ability to set how many tickets should be sent. By default this is one. Fixes #4978 Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
- May 16, 2018
-
-
Richard Levitte authored
There are *roff parsers that are strict about the NAME section being one line only. The man(7) on Debian GNU/Linux suggests that this is appropriate, so we compensate our multi-line NAME sections by fixing the *roff output. Noted by Eric S. Raymond Related to #6264 Reviewed-by:
-
- May 15, 2018
-
-
Gregor Jasny authored
CLA: trivial Reviewed-by:
-
Andy Polyakov authored
LINK can outsmart itself and choose to not update export .lib upon corresponding .dll re-link. Since dependency is between .lib and all .obj-s, re-compilation of any .obj makes NMAKE relink .dll and all .exe-s over and over... Reviewed-by: -
Matt Caswell authored
Also retains support for drafts 27 and 26 Fixes #6257 Reviewed-by:
-
- May 14, 2018
-
-
Matt Caswell authored
Also fixes no-tls1_2-method, no-tls1_3, no-tls, no-ec Reviewed-by:
-
Matt Caswell authored
Fixes #6239 Reviewed-by:
-
Richard Levitte authored
'install' depends on 'install_docs', so making the latter explicit is a waste. Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
The Console UI method always set echo on after prompting without echo. However, echo might not have been on originally, so just restore the original TTY settings. Fixes #2373 Reviewed-by:
-
- May 12, 2018
-
-
FdaSilvaYY authored
Reviewed-by:
-
FdaSilvaYY authored
because there are actually 18 curves defined, but only 16 are plugged for ecdsa test. Deduce array size using OSSL_NELEM and so remove various magic numbers, which required some declarations moving. Implement OPT_PAIR list search without a null-ending element. Fix some comparison between signed and unsigned integer expressions. Reviewed-by:
-
Kurt Roeckx authored
Found by OSS-fuzz Bug introduced in commit 61fb5923 Reviewed-by:
Matt Caswell <matt@openssl.org> GH: #6235
-
Matt Caswell authored
In DTLS if we have buffered a fragment for a zero length message (e.g. ServerHelloDone) then, when we unbuffered the fragment, we were attempting to memcpy the contents of the fragment which is zero length and a NULL pointer. This is undefined behaviour. We should check first whether we have a zero length fragment. Fixes a travis issue. [extended tests] Reviewed-by:
-
Richard Levitte authored
Fixes #4716 Reviewed-by:
-
- May 11, 2018
-
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
Matt Caswell authored
Don't call the decrypt ticket callback if we've already encountered a fatal error. Do call it if we have an empty ticket present. Change the return code to have 5 distinct returns codes and separate it from the input status value. Reviewed-by:
-
Matt Caswell authored
The recent change in behaviour where you do not get a NewSessionTicket message sent if you established the connection using a PSK caused a mem leak to be triggered in sslapitest. It was actually a latent bug and we were just lucky we never hit it before. The problem is due to complexity with the way PSK sessions were set up in the early_data tests. PSK session reference counting was handled differently to normal session reference counting. This meant there were lots of special cases in the code where we don't free a session if it is a PSK. It makes things easier if we just handle PSK reference counts in the same way as other session reference counts, and then we can remove all of the special case code. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
The return value from the ticket_key callback was not properly handled in TLSv1.3, so that a ticket was *always* renewed even if the callback requested that it should not be. Also the ticket decrypt callback was not being called at all in TLSv1.3. Reviewed-by:
-
Matt Caswell authored
When a server call SSL_write_early_data() to write to an unauthenticated client the buffering BIO is still in place, so we should ensure we flush the write. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
This was preventing DTLS connections from being made from the command line. Reviewed-by:
-
