- Aug 16, 2015
-
-
Rich Salz authored
Best hope of keeping current. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 4f46473a)
-
- Aug 14, 2015
-
-
Dr. Stephen Henson authored
Clarify and update documention for extra chain certificates. PR#3878. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 2fd7fb99)
-
Dr. Stephen Henson authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 6d5f8265)
-
Rich Salz authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
- Aug 13, 2015
-
-
Ismo Puustinen authored
Part of RT 3997 Per Ben, just jump to common exit code. Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit cc2829e6)
-
- Aug 12, 2015
-
-
Dr. Stephen Henson authored
PR#3974 PR#3975 Reviewed-by: Matt Caswell <matt@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 891eac46) Conflicts: crypto/cms/cms_enc.c
-
Dr. Stephen Henson authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit a187e08d) Conflicts: crypto/cms/cms_smime.c
-
- Aug 11, 2015
-
-
Matt Caswell authored
When config'd with "sctp" running "make test" causes a seg fault. This is actually due to the way ssltest works - it dives under the covers and frees up BIOs manually and so some BIOs are NULL when the SCTP code does not expect it. The simplest fix is just to add some sanity checks to make sure the BIOs aren't NULL before we use them. This problem occurs in master and 1.0.2. The fix has also been applied to 1.0.1 to keep the code in sync. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit f75d5171)
-
Matt Caswell authored
There are some missing return value checks in the SCTP code. In master this was causing a compilation failure when config'd with "--strict-warnings sctp". Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit d8e8590e)
-
Matt Caswell authored
The function BN_MONT_CTX_set was assuming that the modulus was non-zero and therefore that |mod->top| > 0. In an error situation that may not be the case and could cause a seg fault. This is a follow on from CVE-2015-1794. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Guy Leaver (guleaver) authored
If a client receives a ServerKeyExchange for an anon DH ciphersuite with the value of p set to 0 then a seg fault can occur. This commits adds a test to reject p, g and pub key parameters that have a 0 value (in accordance with RFC 5246) The security vulnerability only affects master and 1.0.2, but the fix is additionally applied to 1.0.1 for additional confidence. CVE-2015-1794 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
-
- Aug 08, 2015
-
-
David Woodhouse authored
Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Ben Laurie <ben@openssl.org> (cherry picked from commit 2bfbeb26)
-
- Aug 06, 2015
-
-
Anton Blanchard authored
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 11252459)
-
- Aug 04, 2015
-
-
Matt Caswell authored
EC_KEY_set_public_key_affine_coordinates was using some variables that only apply if OPENSSL_NO_EC2M is not defined. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit 8d11b7c7)
-
- Aug 01, 2015
-
-
Dirk Wetter authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit e36ce2d9)
-
- Jul 31, 2015
-
-
Loganaden Velvindron authored
From a CloudFlare patch. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
-
Rich Salz authored
Thanks, folks! 348 Benjamin Kaduk 317 Christian Brueffer 254 Erik Tews 253 Erik Tews 219 Carl Mehner 155 (ghost) 95 mancha 51 DominikNeubauer (Manually picked from 59c554b36e39256ac2cfc34dca052453e10c6d9c) Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
-
Nicholas Cooper authored
Manual cherry-pick from main branch, since the header file moved in master. Reviewed-by: Matt Caswell <matt@openssl.org>
-
- Jul 30, 2015
-
-
Dr. Stephen Henson authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
Matt Caswell authored
The DTLS code is supposed to drop packets if we try to write them out but the underlying BIO write buffers are full. ssl3_write_pending() contains an incorrect test for DTLS that controls this. The test only checks for DTLS1 so DTLS1.2 does not correctly clear the internal OpenSSL buffer which can later cause an assert to be hit. This commit changes the test to cover all DTLS versions. RT#3967 Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 5e8b24db)
-
Martin Vejnar authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit fa4629b6)
-
- Jul 29, 2015
-
-
Rich Salz authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 932af161)
-
- Jul 27, 2015
-
-
Matt Caswell authored
The function SSL_set_session_ticket_ext can be used to set custom session ticket data passed in the initial ClientHello. This can be particularly useful for EAP-FAST. However, when using SSLv23_method, the session does not get created until the ServerHello has been received. The extension code will only add the SessionTicket data to the ClientHello if a session already exists. Therefore SSL_set_session_ticket_ext has no impact when used in conjunction with SSLv23_method. The solution is to simply create the session during creation of the ClientHello instead of waiting for the ServerHello. This commit fixes the test failure introduced by the previous commit. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
-
Matt Caswell authored
The function SSL_set_session_ticket_ext sets the ticket data to be sent in the ClientHello. This is useful for EAP-FAST. This commit adds a test to ensure that when this function is called the expected ticket data actually appears in the ClientHello. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
-
- Jul 23, 2015
-
-
Emilia Kasper authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit f4ee22be)
-
- Jul 15, 2015
-
-
mancha authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Rich Salz authored
This reverts commit e5c0bc6c . Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Ernie Hershey authored
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit ad282e63)
-
- Jul 14, 2015
-
-
GitHub User authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit e5c0bc6c)
-
- Jul 13, 2015
-
-
Richard Levitte authored
This leaves behind files with names ending with '.iso-8859-1'. These should be safe to remove. If something went wrong when re-encoding, there will be some files with names ending with '.utf8' left behind. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Richard Levitte authored
This requires 'iconv' and that 'file' can take the options '-b' and '-i'. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit f608b406)
-
Richard Levitte authored
Fixes GH#330 Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit eeb97bce) Conflicts: apps/Makefile
-
- Jul 10, 2015
-
-
Richard Levitte authored
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit da24e6f8)
-
Richard Levitte authored
Instead of piping through tardy, and possibly suffering from bugs in certain versions, use --transform, --owner and --group directly with GNU tar (we already expect that tar variant). Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 27f98436) Conflicts: Makefile.org
-
- Jul 09, 2015
-
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 2fc52c91)
-
Peter Waltenberg authored
Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 99dcd880)
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Matt Caswell authored
Reviewed-by: Stephen Henson <steve@openssl.org>
-
Matt Caswell authored
Reviewed-by: Stephen Henson <steve@openssl.org>
-