- 18 May, 2018 1 commit
-
-
Dr. Matthias St. Pierre authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6273)
-
- 17 May, 2018 7 commits
-
-
Matt Caswell authored
Experiments have shown that the lookup table used by BN_GF2m_mod_arr introduces sufficient timing signal to recover the private key for an attacker with access to cache timing information on the victim's host. This only affects binary curves (which are less frequently used). No CVE is considered necessary for this issue. The fix is to replace the lookup table with an on-the-fly calculation of the value from the table instead, which can be performed in constant time. Thanks to Youngjoo Shin for reporting this issue. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Also allows the apps to set it. Reviewed-by:
-
Matt Caswell authored
We send a session ticket automatically in TLSv1.3 at the end of the handshake. This commit provides the ability to set how many tickets should be sent. By default this is one. Fixes #4978 Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6249)
-
- 16 May, 2018 1 commit
-
-
Richard Levitte authored
There are *roff parsers that are strict about the NAME section being one line only. The man(7) on Debian GNU/Linux suggests that this is appropriate, so we compensate our multi-line NAME sections by fixing the *roff output. Noted by Eric S. Raymond Related to #6264 Reviewed-by:
-
- 15 May, 2018 3 commits
-
-
Gregor Jasny authored
CLA: trivial Reviewed-by:
Andy Polyakov <appro@openssl.org> Reviewed-by:
-
Andy Polyakov authored
LINK can outsmart itself and choose to not update export .lib upon corresponding .dll re-link. Since dependency is between .lib and all .obj-s, re-compilation of any .obj makes NMAKE relink .dll and all .exe-s over and over... Reviewed-by: -
Matt Caswell authored
Also retains support for drafts 27 and 26 Fixes #6257 Reviewed-by:
-
- 14 May, 2018 6 commits
-
-
Matt Caswell authored
Also fixes no-tls1_2-method, no-tls1_3, no-tls, no-ec Reviewed-by:
-
Matt Caswell authored
Fixes #6239 Reviewed-by:
-
Richard Levitte authored
'install' depends on 'install_docs', so making the latter explicit is a waste. Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
The Console UI method always set echo on after prompting without echo. However, echo might not have been on originally, so just restore the original TTY settings. Fixes #2373 Reviewed-by:
-
- 12 May, 2018 5 commits
-
-
FdaSilvaYY authored
Reviewed-by:
-
FdaSilvaYY authored
because there are actually 18 curves defined, but only 16 are plugged for ecdsa test. Deduce array size using OSSL_NELEM and so remove various magic numbers, which required some declarations moving. Implement OPT_PAIR list search without a null-ending element. Fix some comparison between signed and unsigned integer expressions. Reviewed-by:
-
Kurt Roeckx authored
Found by OSS-fuzz Bug introduced in commit 61fb5923 Reviewed-by:
Matt Caswell <matt@openssl.org> GH: #6235
-
Matt Caswell authored
In DTLS if we have buffered a fragment for a zero length message (e.g. ServerHelloDone) then, when we unbuffered the fragment, we were attempting to memcpy the contents of the fragment which is zero length and a NULL pointer. This is undefined behaviour. We should check first whether we have a zero length fragment. Fixes a travis issue. [extended tests] Reviewed-by:
-
Richard Levitte authored
Fixes #4716 Reviewed-by:
-
- 11 May, 2018 16 commits
-
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
Matt Caswell authored
Don't call the decrypt ticket callback if we've already encountered a fatal error. Do call it if we have an empty ticket present. Change the return code to have 5 distinct returns codes and separate it from the input status value. Reviewed-by:
-
Matt Caswell authored
The recent change in behaviour where you do not get a NewSessionTicket message sent if you established the connection using a PSK caused a mem leak to be triggered in sslapitest. It was actually a latent bug and we were just lucky we never hit it before. The problem is due to complexity with the way PSK sessions were set up in the early_data tests. PSK session reference counting was handled differently to normal session reference counting. This meant there were lots of special cases in the code where we don't free a session if it is a PSK. It makes things easier if we just handle PSK reference counts in the same way as other session reference counts, and then we can remove all of the special case code. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
The return value from the ticket_key callback was not properly handled in TLSv1.3, so that a ticket was *always* renewed even if the callback requested that it should not be. Also the ticket decrypt callback was not being called at all in TLSv1.3. Reviewed-by:
-
Matt Caswell authored
When a server call SSL_write_early_data() to write to an unauthenticated client the buffering BIO is still in place, so we should ensure we flush the write. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
This was preventing DTLS connections from being made from the command line. Reviewed-by:
-
Matt Caswell authored
The TLS code marks records as read when its finished using a record. The DTLS code did not do that. However SSL_has_pending() relies on it. So we should make DTLS consistent. Reviewed-by:
-
Matt Caswell authored
If using an old style PSK callback and no certificate is configured for the server, we should prefer ciphersuites based on SHA-256, because that is the default hash for those callbacks as specified in the TLSv1.3 spec. Reviewed-by:
-
Matt Caswell authored
The s_client/s_server docs were missing documentation for this option. Reviewed-by:
-
Matt Caswell authored
If we have no certificate and we are using "old style" PSKs then we will always default to using SHA-256 for that PSK. However we may have selected a ciphersuite that is not based on SHA-256. Therefore if we see that there are no certificates and we have been configured for "old style" PSKs then we should prefer SHA-256 based ciphersuites during the selection process. Fixes #6197 Reviewed-by:
-
Kurt Roeckx authored
Reviewed-by: -
Kurt Roeckx authored
Reviewed-by: -
Matt Caswell authored
In certain circumstances in the DTLS code we have to drop a record (e.g. if it is a stale retransmit). We then have to move on to try and read the next record. Some applications using blocking sockets (e.g. s_server/s_client will hang if there isn't actually any data to be read from the socket yet). Others can tolerate this. Therefore SSL_read()/SSL_write() can sometimes return SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE even when using blocking sockets. Applications can use the mode SSL_MODE_AUTO_RETRY, to switch this behaviour off so that we never return unless we have read the data we wanted to. Commit ad962252 fixed a DTLS problem where we always retried even if SSL_MODE_AUTO_RETRY was not set. However that fix caused the Boring ossl_shim to fail in some tests because it was relying on the previous (buggy) behaviour. The ossl_shim should be set into SSL_MODE_AUTO_RETRY if it is not operating asynchronously to avoid this problem. [extended tests] Reviewed-by:
-
- 10 May, 2018 1 commit
-
-
Andy Polyakov authored
Reviewed-by:
-
