- Feb 23, 2016
-
-
FdaSilvaYY authored
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> (cherry picked from commit 04f2a0b5)
-
- Feb 19, 2016
-
-
Dr. Stephen Henson authored
Fix double free bug when parsing malformed DSA private keys. Thanks to Adam Langley (Google/BoringSSL) for discovering this bug using libFuzzer. CVE-2016-0705 Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 6c88c71b)
-
- Feb 12, 2016
-
-
Andy Polyakov authored
It's never problem if CRYPTO_ctr128_encrypt is called from EVP, because buffer in question is always aligned within EVP_CIPHER_CTX structure. RT#4218 Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 5e4bbeb4)
-
- Feb 11, 2016
-
-
Andy Polyakov authored
Trouble is that LINK variable assignment in make-file interferes with LINK environment variable, which can be used to modify Microsoft's LINK.EXE behaviour. RT#4289 Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit d44bb1c3) Resolved conflicts: util/pl/VC-32.pl (cherry picked from commit 0fffd522)
-
- Feb 10, 2016
-
-
Andy Polyakov authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 740b2b9a)
-
- Jan 28, 2016
-
-
Kurt Roeckx authored
Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org> (cherry picked from commit 2b0c11a6)
-
Richard Levitte authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 41a28cb2)
-
Matt Caswell authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Richard Levitte authored
This solves an earlier cherry-pick mistake. Reviewed-by: Matt Caswell <matt@openssl.org>
-
Matt Caswell authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Update CHANGES and NEWS with details of the issues fixed in the forthcoming release. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Viktor Dukhovni authored
Based on patch by: Nimrod Aviram <nimrod.aviram@gmail.com> CVE-2015-3197 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Modified version of the commit ffaef3f1 in the master branch by Stephen Henson. This makes the SSL_OP_SINGLE_DH_USE option a no-op and always generates a new DH key for every handshake regardless. This is a follow on from CVE-2016-0701. This branch is not impacted by that CVE because it does not support X9.42 style parameters. It is still possible to generate parameters based on primes that are not "safe", although by default OpenSSL does not do this. The documentation does sign post that using such parameters is unsafe if the private DH key is reused. However to avoid accidental problems or future attacks this commit has been backported to this branch. Issue reported by Antonio Sanso Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
-
- Jan 19, 2016
-
-
Richard Levitte authored
For BSD systems, Configure adds a shared_ldflags including a reference to the Makefile variable LIBRPATH, but since it must be passed down to Makefile.shared, care must be taken so the value of LIBRPATH doesn't get expanded too early, or it ends up giving an empty string. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit c64879d3)
-
Alessandro Ghedini authored
RT#4080 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
-
Prayag Verma authored
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 02f70372)
-
- Jan 17, 2016
-
-
Viktor Dukhovni authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
- Jan 14, 2016
-
-
Dr. Stephen Henson authored
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit 9aa00b18) Conflicts: apps/x509.c
-
- Jan 10, 2016
-
-
Kurt Roeckx authored
Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org>
-
Kurt Roeckx authored
Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 1918e01c)
-
- Jan 05, 2016
-
-
Viktor Dukhovni authored
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
-
- Dec 28, 2015
-
-
Rich Salz authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 41977c53)
-
- Dec 27, 2015
-
-
Matt Caswell authored
Describe the usage of the OCSP callback functions on both the client and the server side. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit c52c3b5e)
-
Matt Caswell authored
It makes no sense to call the OCSP status callback if we are resuming a session because no certificates will be sent. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit 0ac62399)
-
Matt Caswell authored
If a server sends the status_request extension then it may choose to send the CertificateStatus message. However this is optional. We were treating it as mandatory and the connection was failing. Thanks to BoringSSL for reporting this issue. RT#4120 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit 905943af)
-
- Dec 22, 2015
-
-
David Benjamin authored
Found by clang scan-build. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org> RT: #4184, MR: #1496 (cherry picked from commit 679d8751)
-
- Dec 20, 2015
-
-
Dr. Stephen Henson authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 6656ba71)
-
- Dec 19, 2015
-
-
Richard Levitte authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 17592f32)
-
Richard Levitte authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 6d97060e)
-
Richard Levitte authored
No dummy arguments. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 7eb51251)
-
Richard Levitte authored
BIO_int_ctrl isn't made for the purpose BIO_get_conn_int_port used it for. This also changes BIO_C_GET_CONNECT to actually return the port instead of assigning it to a pointer that was never returned back to the caller. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 2a60fccd)
-
Matt Caswell authored
Fix some more URLs mangled by indent in the reformat. These ones don't exist in master so we have a separate commit. Based on a patch supplied by Arnaud Lacombe <al@aerilon.ca> Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Some URLs in the source code ended up getting mangled by indent. This fixes it. Based on a patch supplied by Arnaud Lacombe <al@aerilon.ca> Reviewed-by: Richard Levitte <levitte@openssl.org>
-
- Dec 18, 2015
-
-
Richard Levitte authored
Since we don't use the eay style any more, there's no point tryint to tell emacs to use it. Reviewed-by: Ben Laurie <ben@openssl.org>
-
- Dec 16, 2015
-
-
Rich Salz authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 2e31ef03)
-
- Dec 14, 2015
-
-
Emilia Kasper authored
Commit 2b0180c3 attempted to do this but only hit one of many BN_mod_exp codepaths. Fix remaining variants and add a test for each method. Thanks to Hanno Boeck for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit d911097d) (cherry picked from commit 44e4f5b0)
-
Richard Levitte authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 474a53b3)
-
- Dec 10, 2015
-
-
Matt Caswell authored
A BIO_flush call in the DTLS code was not correctly setting the |rwstate| variable to SSL_WRITING. This means that SSL_get_error() will not return SSL_ERROR_WANT_WRITE in the event of an IO retry. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 67f60be8)
-
Matt Caswell authored
If using DTLS and NBIO then if a second or subsequent handshake message fragment hits a retry, then the retry attempt uses the wrong fragment offset value. This commit restores the fragment offset from the last attempt. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 2ad226e8)
-