- 29 Sep, 2016 19 commits
-
-
Dr. Stephen Henson authored
Reviewed-by:Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: -
Dr. Stephen Henson authored
Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
In plain PSK we don't need to do anymore construction after the preamble. We weren't detecting this case and treating it as an unknown cipher. Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
WPACKET_allocate_bytes() requires you to know the size of the data you are allocating for, before you create it. Sometimes this isn't the case, for example we know the maximum size that a signature will be before we create it, but not the actual size. WPACKET_reserve_bytes() enables us to reserve bytes in the WPACKET, but not count them as written yet. We then subsequently need to acall WPACKET_allocate_bytes to actually count them as written. Reviewed-by: -
Matt Caswell authored
This was a temporary function needed during the conversion to WPACKET. All callers have now been converted to the new way of doing this so this function is no longer required. Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
Merge declarations of same type together. Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
Some functions were being called from both code that used WPACKETs and code that did not. Now that more code has been converted to use WPACKETs some of that duplication can be removed. Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
If we have a handshake fragment waiting then dtls1_read_bytes() was not correctly setting the value of recvd_type, leading to an uninit read. Reviewed-by: -
Matt Caswell authored
The new large message test in sslapitest needs OPENSSL_NO_DTLS guards Reviewed-by:Richard Levitte <levitte@openssl.org>
-
- 28 Sep, 2016 10 commits
-
-
Richard Levitte authored
Before loading a key from an engine, it may need to be initialized. When done loading the key, we must de-initialize the engine. (if the engine is already initialized somehow, only the reference counter will be incremented then decremented) Reviewed-by:Stephen Henson <steve@openssl.org>
-
Rich Salz authored
This reverts commit 0a720029 . This fails to call ENGINE_finish; an alternate fix is forthcoming. Reviewed-by:
-
David Woodhouse authored
When I said before that s_client "used to work in 1.0.2" that was only partly true. It worked for engines which provided a default generic method for some key type, because it called ENGINE_set_default() and that ended up being an implicit initialisation and functional refcount. But an engine which doesn't provide generic methods doesn't get initialised, and then when you try to use it you get an error: cannot load client certificate private key file from engine 140688147056384:error:26096075:engine routines:ENGINE_load_private_key:not initialised:crypto/engine/eng_pkey.c:66: unable to load client certificate private key file cf. https://github.com/OpenSC/libp11/issues/107 (in which we discover that engine_pkcs11 *used* to provide generic methods that OpenSSL would try to use for ephemeral DH keys when negotiating ECDHE cipher suites in TLS, and that didn't work out very well.) Reviewed-by:
-
David Woodhouse authored
This used to work in 1.0.2 but disappeared when the argument parsing was revamped. Reviewed-by:
-
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
Add the ability to test both server initiated and client initiated reneg. Reviewed-by: -
Matt Caswell authored
Add update for testing renegotiation. Also change info on CTLOG_FILE environment variable - which always seems to be required. Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
The conversion to WPACKET broke the construction of the renegotiation extension. Reviewed-by: -
Matt Caswell authored
Reviewed-by:
-
- 26 Sep, 2016 11 commits
-
-
David Benjamin authored
Reviewed-by:
Matt Caswell <matt@openssl.org>
-
David Benjamin authored
The TLSProxy::Record->new call hard-codes a version, like 70-test_sslrecords.t. Reviewed-by:
-
David Benjamin authored
Reviewed-by:
-
David Benjamin authored
Avoid making the CI blow up. Reviewed-by:
-
David Benjamin authored
This is a regression test for https://github.com/openssl/openssl/pull/1431 . It tests a maximally-padded record with each possible invalid offset. This required fixing a bug in Message.pm where the client sending a fatal alert followed by close_notify was still treated as success. Reviewed-by:
-
Matt Caswell authored
A mem leak could occur on an error path. Also the mempacket BIO_METHOD needs to be cleaned up, because of the newly added DTLS test. Also fixed a double semi-colon in ssltestlib.c Reviewed-by: -
David Benjamin authored
This would have caught 099e2968. This is a port of the test added in https://boringssl.googlesource.com/boringssl/+/7c040756178e14a4d181b6d93abb3827c93189c4 Reviewed-by:
Emilia Käsper <emilia@openssl.org> Reviewed-by:
-
Matt Caswell authored
commit c536b6be introduced a bug that causes a reachable assert. This fixes it. Reviewed-by:
-
Matt Caswell authored
Reviewed-by: -
Robert Swiecki authored
Reviewed-by:
-
Matt Caswell authored
The buffer to receive messages is initialised to 16k. If a message is received that is larger than that then the buffer is "realloc'd". This can cause the location of the underlying buffer to change. Anything that is referring to the old location will be referring to free'd data. In the recent commit c1ef7c97 (master) and 4b390b6c (1.1.0) the point in the code where the message buffer is grown was changed. However s->init_msg was not updated to point at the new location. CVE-2016-6309 Reviewed-by:
-
