- 07 Jun, 2019 1 commit
-
-
David Makepeace authored
[skip ci] Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9102) (cherry picked from commit 87762939b508c7968d3c54d44c1319416c27603e)
-
- 06 Jun, 2019 1 commit
-
-
Dr. Matthias St. Pierre authored
Fixes #9092 Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9093) (cherry picked from commit e6071f29c24cd22ac7857bf88917598265cc90a9)
-
- 04 Jun, 2019 3 commits
-
-
Dr. Matthias St. Pierre authored
In commit 2b8fa1d5 the version-specific SSL/TLS methods were deprecated. This patch improves the documentation of that change by stating the deprecation more prominently in the manual page and explaining the reason for the deprecation. Fixes #8989 Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9001) (cherry picked from commit f308fa2573b0320236cd2c2d73db37c49e3eb779)
-
Vitezslav Cizek authored
The 4 kB SPACE_SYS_STR_REASONS in crypto/err/err.c isn't enough for some locales. The Russian locales consume 6856 bytes, Ukrainian even 7000. build_SYS_str_reasons() contains an overflow check: if (cnt > sizeof(strerror_pool)) cnt = sizeof(strerror_pool); But since commit 9f15e5b911ba6053e09578f190354568e01c07d7 it no longer works as cnt is incremented once more after the condition. cnt greater than sizeof(strerror_pool) results in an unbounded OPENSSL_strlcpy() in openssl_strerror_r(), eventually causing a crash. When the first received error string was empty or contained only spaces, cur would move in front of the start of the strerror_pool. Also don't call openssl_strerror_r when the pool is full. Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8966) (cherry picked from commit fac9200a881a83bef038ebed628ebd409786a1a6)
-
Dr. Matthias St. Pierre authored
The DEBUG_SAFESTACK preprocessor define is obsolete since 2008 when the non-safestack code was removed by commit 985de863 . Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9070) (cherry picked from commit d4f63f1c)
-
- 03 Jun, 2019 3 commits
-
-
Matt Caswell authored
Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/8773) (cherry picked from commit a77b4dba)
-
Matt Caswell authored
If we receive a KeyUpdate message (update requested) from the peer while we are in the middle of a write, we should defer sending the responding KeyUpdate message until after the current write is complete. We do this by waiting to send the KeyUpdate until the next time we write and there is no pending write data. This does imply a subtle change in behaviour. Firstly the responding KeyUpdate message won't be sent straight away as it is now. Secondly if the peer sends multiple KeyUpdates without us doing any writing then we will only send one response, as opposed to previously where we sent a response for each KeyUpdate received. Fixes #8677 Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/8773) (cherry picked from commit feb9e31c40c49de6384dd0413685e9b5a15adc99)
-
Shane Lontis authored
Fixes #8923 Found using the openssl cms -resign option. This uses an alternate path to do the signing which was not adding the required signed attribute content type. The content type attribute should always exist since it is required is there are any signed attributes. As the signing time attribute is always added in code, the content type attribute is also required. The CMS_si_check_attributes() method adds validity checks for signed and unsigned attributes e.g. The message digest attribute is a signed attribute that must exist if any signed attributes exist, it cannot be an unsigned attribute and there must only be one instance containing a single value. Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8944) (cherry picked from commit 19e512a8)
-
- 31 May, 2019 4 commits
-
-
David Benjamin authored
Reviewed-by:
Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9050) (cherry picked from commit 8be6a4ed02297f380bbea269f2e1c08a592444bc)
-
Retropotenza authored
CLA: trivial Fixes #8911 Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8866) (cherry picked from commit fdbb3a865575136f3b432690357423c2512831fa)
-
Sambit Kumar Dash authored
Minor typo. CLA: trivial Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8866) (cherry picked from commit 3527cfcf283d2ee2e14e85f8e432eb1bcc687dbe)
-
Sambit Kumar Dash authored
Method name correction. CLA: trivial Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/9052) (cherry picked from commit 3c9a8d4a5155e1b02fab63ea97b8131eadda8320)
-
- 30 May, 2019 2 commits
-
-
agnosticdev authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9041) (cherry picked from commit 03da376f)
-
Pauli authored
Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8606) (cherry picked from commit 711a161f03ef9ed7cd149a22bf1203700c103e96)
-
- 29 May, 2019 2 commits
-
-
Dr. Matthias St. Pierre authored
openssl_config_int() returns the uninitialized variable `ret` when compiled with OPENSSL_SYS_UEFI. Fixes #9026 Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9029) (cherry picked from commit f4a96507fb880d5f5a707c138388cb8b5b1ba8c8)
-
Iuri Rezende Souza authored
CLA: trivial Reviewed-by:
Paul Yang <yang.yang@baishancloud.com> Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9021) (cherry picked from commit ea8d07b155d26abb52574a1c1366b662a27ffbed)
-
- 28 May, 2019 6 commits
-
-
Richard Levitte authored
Not all Unixen know the -v option Reviewed-by:
Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9012) (cherry picked from commit 3b8033f3f593ac06aaea5d050960366001ef99f0)
-
Richard Levitte authored
Use -bnoentry, not -bexpall Reviewed-by:
Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9012) (cherry picked from commit f3d6a3644679d37e791408ff3750d0baa76d1206)
-
Tomas Mraz authored
The #7408 implemented mandatory digest checking in TLS. However this broke compatibility of DSS support with GnuTLS which supports only SHA1 with DSS. There is no reason why SHA256 would be a mandatory digest for DSA as other digests in SHA family can be used as well. Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9015) (cherry picked from commit cd4c83b52423008391b50abcccf18a7d8fcce03b)
-
Richard Levitte authored
Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Richard Levitte authored
Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Richard Levitte authored
Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9034)
-
- 27 May, 2019 7 commits
-
-
Richard Levitte authored
Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9017)
-
Richard Levitte authored
OpenSSL 1.1.1's Configure treats the strings in @disablables as regexps, which means that the 'buildtest-c++' option needs a bit of escaping to be interpreted as intended. Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9016)
-
Richard Levitte authored
Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8370) (cherry picked from commit 284d19c2)
-
Richard Levitte authored
Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8370) (cherry picked from commit 26a053d1)
-
Richard Levitte authored
Disabled by default Fixes #8360 Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8370) (cherry picked from commit ac4033d6)
-
Richard Levitte authored
We add the extra warning and sanitizer options to check our code, which is entirely in C. We support C++ compilers uniquely for the sake of certain external test suites, and those projects can probably sanitize their own code themselves. [extended tests] Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9013) (cherry picked from commit 3b437400)
-
Richard Levitte authored
The documentation of what a X509_LOOKUP implementation must do was unclear and confusing. Most of all, clarification was needed that it must store away the found objects in the X509_STORE. Fixes #8707 Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8755) (cherry picked from commit 19f43f02aa5349034d0a7a60c3a750e046f994b5)
-
- 26 May, 2019 1 commit
-
-
FdaSilvaYY authored
Add a few coverage test case. Fixes #8949 [extended tests] Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8959) (cherry picked from commit 5b3accde606ffe01466426bd59407ffca0690d23)
-
- 24 May, 2019 3 commits
-
-
voev authored
CLA: trivial Reviewed-by:
Shane Lontis <shane.lontis@oracle.com> Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8979)
-
agnosticdev authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8995) (cherry picked from commit 5435a830765a63692b8e1e406142d1602133a5a0)
-
Sambit Kumar Dash authored
CLA: trivial Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8952) (cherry picked from commit 55e09d17d4c84213d372651b0c91bdc9ef786728)
-
- 23 May, 2019 2 commits
-
-
Bernd Edlinger authored
e.g. openssl speed -evp id-aes256-wrap-pad was crashing because the return code from EVP_CipherInit_ex was ignored. Not going to allow that cipher mode because wrap ciphers produces more bytes output than the input length and EVP_Update_loop is not really prepared for that. Reviewed-by:
Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8739) (cherry picked from commit 5d238a1032fee0e4759c2ed7fbd09cb9d7125a72)
-
Matt Caswell authored
This imports all of the NIST CAVS test vectors for CCM (SP800-38C) and coverts them for use within evp_test. This commit also adds a script to convert the .rsp CAVS files into the evp_test format. Reviewed-by:
Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8981) (cherry picked from commit ecb0f148a94c9b0076240ca1d7904ab50a7dc9a4)
-
- 22 May, 2019 3 commits
-
-
Patrick Steuer authored
Fixes #7323 Signed-off-by:
Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8970) (cherry picked from commit 3f950d87650776d0e2874588081fecb7bdd4fbd0)
-
Patrick Steuer authored
Fixes #8957 Signed-off-by:
Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8970) (cherry picked from commit e8d0678da4942dd027981175b16b6b3162731205)
-
Patrick Steuer authored
67c81ec311 forgot about s390x Signed-off-by:
Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8971) (cherry picked from commit 887e22dd8b6f054e39b2d20fc8870eaba7fc61a8)
-
- 21 May, 2019 2 commits
-
-
Kurt Roeckx authored
Fixes: #8737 Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by:
Richard Levitte <levitte@openssl.org> GH: #8741 (cherry picked from commit 70b0b977)
-
Matt Caswell authored
This reverts commit dcb982d792d6064ed3493e79749208d8c257ff04. This change is causing extended tests to fail. [extended tests] Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8964) (cherry picked from commit 2c23689402f1894861519d0c1ad762a3e52f4677)
-