- Nov 19, 2014
-
-
Dr. Stephen Henson authored
If no keyfile has been specified use the certificate file instead. Fix typo: we need to check the chain is not NULL, not the chain file. Reviewed-by: Matt Caswell <matt@openssl.org>
-
Dr. Stephen Henson authored
The supported signature algorithms extension needs to be processed before the certificate to use is decided and before a cipher is selected (as the set of shared signature algorithms supported may impact the choice). Reviewed-by: Matt Caswell <matt@openssl.org>
-
- Nov 18, 2014
-
-
Matt Caswell authored
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
-
Matt Caswell authored
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
-
Matt Caswell authored
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
-
- Nov 17, 2014
-
-
Jan Hykel authored
Don't attempt to access msg structure if recvmsg returns an error. PR#3483 Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 012aa9ec)
-
- Nov 13, 2014
-
-
Dr. Stephen Henson authored
If the hash or public key algorithm is "undef" the signature type will receive special handling and shouldn't be included in the cross reference table. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 55f7fb88)
-
- Nov 12, 2014
-
-
Alok Menghrajani authored
Out is the buffer which needs to contain at least inl + cipher_block_size - 1 bytes. Outl is just an int*. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 5211e094)
-
Michal Bozon authored
PR#3535 Reviewed-by: Stephen Henson <steve@openssl.org>
-
Matt Caswell authored
Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit e04d426b)
-
- Nov 11, 2014
-
-
Kurt Roeckx authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
- Nov 10, 2014
-
-
Russell Coker authored
This doesn't really fix the datarace but changes it so it can only happens once. This isn't really a problem since we always just set it to the same value. We now just stop writing it after the first time. PR3584, https://bugs.debian.org/534534 Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Daniel Kahn Gillmor authored
see RT #3203 Future versions of OpenSSL use the canonical terms "ECDHE" and "DHE" as configuration strings and compilation constants. This patch introduces aliases so that the stable 1.0.2 branch can be forward-compatible with code and configuration scripts that use the normalized terms, while avoiding changing any library output for stable users. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org>
-
- Oct 30, 2014
-
-
Andy Polyakov authored
PR: 3474 Reviewed-by: Kurt Roeckx <kurt@openssl.org> (cherry picked from commit 66962039)
-
- Oct 29, 2014
-
-
Andy Polyakov authored
Reviewed-by: Stephen Henson <steve@openssl.org> (cherry picked from commit d45282fc)
-
- Oct 28, 2014
-
-
Samuel Neves authored
Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Emilia Käsper <emilia@openssl.org>
-
Emilia Kasper authored
Tighten client-side session ticket handling during renegotiation: ensure that the client only accepts a session ticket if the server sends the extension anew in the ServerHello. Previously, a TLS client would reuse the old extension state and thus accept a session ticket if one was announced in the initial ServerHello. Reviewed-by: Bodo Moeller <bodo@openssl.org> (cherry picked from commit d663df23)
-
- Oct 27, 2014
-
-
Emilia Kasper authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Emilia Kasper authored
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Geoff Thorpe <geoff@openssl.org> (cherry picked from commit fd28a41e) Conflicts: ssl/ssltest.c
-
- Oct 24, 2014
-
-
Dr. Stephen Henson authored
SSL_set_SSL_CTX is used to change the SSL_CTX for SNI, keep the supported signature algorithms and raw cipherlist. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 14e14bf6)
-
Dr. Stephen Henson authored
Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit c800c27a) Conflicts: ssl/ssl.h ssl/ssl_err.c ssl/ssl_locl.h
-
- Oct 23, 2014
-
-
Dr. Stephen Henson authored
Since SNI will typically switch the SSL_CTX structure to the one corresponding to the appopriate server we need to parse custom extensions using the switched SSL_CTX not the original one. This is done by parsing custom extensions *after* SNI. Reviewed-by: Emilia Käsper <emilia@openssl.org>
-
- Oct 22, 2014
-
-
Andy Polyakov authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 9f4bd9d5)
-
- Oct 21, 2014
-
-
Bodo Moeller authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Bodo Moeller authored
listed after TLS_FALLBACK_SCSV. RT: 3575 Reviewed-by: Emilia Kasper <emilia@openssl.org>
-
Kurt Roeckx authored
When we're configured with no-ssl3 and we receive an SSL v3 Client Hello, we set the method to NULL. We didn't used to do that, and it breaks things. This is a regression introduced in 62f45cc2 . Keep the old method since the code is not able to deal with a NULL method at this time. CVE-2014-3569, PR#3571 Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 392fa7a9)
-
- Oct 20, 2014
-
-
Tim Hudson authored
Reviewed-by: Geoff Thorpe <geoff@openssl.org> (cherry picked from commit c882abd5)
-
- Oct 17, 2014
-
-
Kurt Cancemi authored
Reviewed-by: Ben Laurie <ben@openssl.org> (cherry picked from commit 87d388c9)
-
- Oct 15, 2014
-
-
Matt Caswell authored
Reviewed-by: Dr Stephen Henson <steve@openssl.org>
-
Matt Caswell authored
Reviewed-by: Bodo Möller <bodo@openssl.org>
-
Geoff Thorpe authored
CVE-2014-3568 Reviewed-by: Emilia Kasper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
CVE-2014-3567 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 5dc6070a03779cd524f0e67f76c945cb0ac38320)
-
Matt Caswell authored
Related to CVE-2014-3513 This fix was developed by the OpenSSL Team Reviewed-by: Tim Hudson <tjh@openssl.org> Conflicts: util/mkdef.pl util/ssleay.num Conflicts: util/mkdef.pl
-
Matt Caswell authored
CVE-2014-3513 This issue was reported to OpenSSL on 26th September 2014, based on an original issue and patch developed by the LibreSSL project. Further analysis of the issue was performed by the OpenSSL team. The fix was developed by the OpenSSL team. Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Bodo Moeller authored
Reviewed-by: Tim Hudson <tjh@openssl.org>
-
Andy Polyakov authored
RT: 3553 Reviewed-by: Emilia Kasper <emilia@openssl.org> (cherry picked from commit 69d5747f)
-
Bodo Moeller authored
handling out of #ifndef OPENSSL_NO_DTLS1 section. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Bodo Moeller authored
TLS_FALLBACK_SCSV support, restoring a reviewed state instead. Reviewed-by: Stephen Henson <(steve@openssl.org)>
-
Bodo Moeller authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
- Oct 06, 2014
-
-
Matt Caswell authored
Patch supplied by Matthieu Patou <mat@matws.net>, and modified to also remove duplicate definition of PKCS7_type_is_digest. PR#3551 Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit e0fdea3e)
-